fix(image): surface Gemini safety blocks instead of 'no image data' - #371

Summary

When Gemini refuses an image prompt, the 200 response has no image part and carries the reason in promptFeedback.blockReason or candidates[].finishReason (IMAGE_SAFETY, PROHIBITED_CONTENT, ...), sometimes with refusal text. generateGeminiImages ignored all of it and always threw the generic Gemini returned no image data, so a safety block looked the same as an outage and users retried (and paid for) the same prompt.

When no image part is found, the error message is now built from blockReason (+ blockReasonMessage) or the first non-STOP finishReason (+ refusal text); otherwise it falls back to the old message. No issue was filed; found while reading generateGeminiImages.

Change risk level

• P0 — Low risk: copy, style tweaks, defaults, local display conditions, test assertions. No Runtime/API/persistence contract changes.
• P1 — Medium risk: shared state, business logic, persistence, cross-component interaction, Runtime request parameters, shared components.
• P2 — High risk: Daemon/Runtime, protocol, database migration, process management, service configuration, build/packaging, release pipeline, or Web/Desktop parity changes.

Verification

• Targeted checks for the changed files / closest tests
• pnpm typecheck for affected packages (TypeScript changes)
• Module tests for affected areas (P1+)
• Production build (only when touching compile boundaries, lazy loading, assets, or build config)
• Service restart + health check (P2 daemon/runtime changes)
• Web/Desktop parity checks (shared UI, Bridge, or packaging changes)

Actually ran:

• pnpm --filter ./apps/daemon exec vitest run test/integration/image-generation-api.test.ts: the two new cases (prompt blocked, IMAGE_SAFETY finish) fail on master with the generic message and pass with this change (22/22).
• pnpm --filter ./apps/daemon typecheck

Intentionally skipped, and why:

Full suite, build and Desktop packaging: the change is local to the Gemini error message in provider.ts.

Web / Desktop parity

• This change does not affect Web/Desktop parity
• General capability implemented once in shared Web/Daemon code (no per-bridge forks)
• Platform-specific entries are hidden when the capability is unavailable (no silent no-op buttons)
• The same flow was checked on the other platform, not only the one where the issue was reported

Checklist

• Focused change — no unrelated refactors or fixes mixed in
• Docs updated in the same PR if user-visible behavior changed
• No .runtime/, credentials, Codex sessions, build caches, or user data committed

This change was prepared with an AI coding assistant (Claude Code) and submitted by a human contributor.