Summary

• extend the image_generate tool schema/dispatch path to accept reference_images
• pass references through the current openai-codex provider as Responses input_image content
• keep the current raw SSE / httpx Codex Responses path from main instead of reverting to SDK stream parsing
• set the Codex image_generation tool to action: edit whenever references are present
• add bounded validation for reference inputs: max 8 refs, 20 MB local files, 30 MB data URLs, base64 data-URL validation, and basic PNG/JPEG/WebP/GIF MIME detection

Relationship to prior PRs

This overlaps with earlier reference-image work:

• feat(image_gen): add reference_images for image-to-image (openai-codex) #21463 — first-class reference_images support via SDK client.responses.stream(...)
• feat(image_gen): multi-reference input support, starting with openai-codex #15308 — provider capability-contract idea via a references field / supports_references
• fix(image-gen): forward reference images to providers #18805 — stricter validation for URL/data/local references

This PR is intentionally narrower and updated for current main / Hermes 0.15:

• targets the current raw SSE Codex provider path introduced after the earlier PRs
• keeps the public field name reference_images, matching feat(image_gen): add reference_images for image-to-image (openai-codex) #21463 / fix(image-gen): forward reference images to providers #18805 and the local Hermes 0.15 tool schema direction
• adds action: "edit" when references are provided
• does not introduce a broader provider capability contract in this PR; the schema notes that reference_images is currently honored by openai-codex, while other backends may reject or ignore it

Follow-ups can add provider-level capability advertisement / shared normalization helpers if maintainers prefer that broader direction.

Hermes 0.15 compatibility

• rebased on current main (0.15.1) instead of the older 0.14-era base
• preserves the current plugin-provider dispatch behavior, including explicit image_gen.provider = "fal" routing through the FAL plugin
• keeps image_gen.model forwarding unchanged
• preserves plain text-to-image behavior: no action is sent when reference_images is absent
• allows existing local-path callers to continue using normal paths; local references are validated for existence, size, and image MIME before being embedded as data URLs

Testing

• python -m pytest tests/plugins/image_gen/test_openai_codex_provider.py tests/tools/test_image_generation_plugin_dispatch.py tests/tools/test_image_generation.py -q -o 'addopts='
• python -m py_compile plugins/image_gen/openai-codex/__init__.py tools/image_generation_tool.py tests/plugins/image_gen/test_openai_codex_provider.py tests/tools/test_image_generation_plugin_dispatch.py tests/tools/test_image_generation.py
• git diff --check
• compatibility smoke: imported hermes_cli.__version__ == "0.15.1" and verified image_generate exposes reference_images