go bananas

Appearance

Changelog ​

The canonical changelog is CHANGELOG.md in the repository. It is the single maintained record of backend releases and of the gobananas-cli / gobananas-mcp proxy versions.

Since 1.3.0 ​

Changes merged to main after the 1.3.0 entry, grouped by area. Dates are merge dates.

Images and models ​

  • Faces default to GPT Image 2.6 Flare (November 2026) — a picture with a character and no model_id now uses GPT Image 2.6 Flare when your workspace allows it and has an OpenAI key. It used to use GPT Image 2. To keep a character on GPT Image 2, pass model_id: "openai-gpt-image-2" or save it as the character's preferred model.
  • OpenAI options a model can't take answer 400 (November 2026) — for example quality: "xhigh" on GPT Image 2, or a transparent jpeg. These used to fail as a server error (500); they are now refused with a 400 that says what the model supports, before OpenAI is called.
  • Posters without made-up details (November 2026) — when you leave out a poster line, the model is told to add no venue, address, date, time, price, phone number or web address that your lines and brief don't give. Before, a poster with no footer could show an invented address.
  • Posters without placeholder text (November 2026) — a poster line you don't give (title, subtitle, body or footer) is now left out. It used to be filled with a placeholder such as "supporting line", which models that render text accurately drew on the poster.
  • GPT Image 2.6 Flare is the OpenAI default (November 2026) — new OpenAI workspaces start on openai-gpt-image-2.6-flare, and the key is checked against it at setup. It is also the first choice for a poster without model_id, and the first OpenAI model the Composer's automatic fallback tries. A face request without model_id still uses GPT Image 2. Existing workspaces keep their defaults. See OpenAI GPT Image 2.6.
  • Complexity for GPT Image 2.6 (November 2026) — the 2.6 models take complexity (low, medium or high): how much the model plans before rendering, separate from quality. Left out, 2.6 plans at high. Other OpenAI models refuse it with a 400. In the Composer it is under Advanced Options. See OpenAI GPT Image 2.6.
  • GPT Image 2.6 (November 2026) — openai-gpt-image-2.6-flare and openai-gpt-image-2.6-sunburst joined the models. They have the same controls as GPT Image 2.5. Masked edits are not available for them yet. Defaults are unchanged. See OpenAI GPT Image 2.6.
  • Camera looks (17 October 2026, #286, #288 and #289) — camera_look picks one of eight built-in real-camera looks, such as disposable-flash or instant-film. It works on generate_image, start_generation, generate_with_subscription, POST /api/images and POST /api/generations/start, and on each item of batch_generate and POST /api/images/batch. It can't be combined with enhance_prompt or image_to_edit_id. See Camera looks.
  • Faces on GPT Image 2 (18 October 2026, #302) — a generation with a character and no model_id now uses GPT Image 2 ahead of the workspace default, when the workspace allows GPT Image 2, has an OpenAI key, and the request fits that model. An explicit model_id or the character's preferred model still wins.
  • 9:16 on OpenAI models (18 October 2026, #298) — a 9:16 request on an OpenAI model is now sent as 1088×1920. It was sent as 1080×1920, which GPT Image 2 refuses, so those requests failed.
  • Nano Banana 2.1 (7 October 2026, #221 and #224) — gemini-nano-banana-2.1 joined the models, with 1K, 2K and 4K output, Google Search and thinking. Every workspace can use it. Nano Banana 2 (gemini-flash-image) is retired: requests and saved settings that name it now use Nano Banana 2.1.
  • Square by default (26 September 2026) — generate_image (and POST /api/images) now makes a square image when no aspect ratio is given and no scene, style preset or character supplies one. Before, the model chose its own shape. Edits with no ratio from the request, a scene, style preset or character still keep the source image's shape.

References and characters ​

  • Reference sheets (18 October 2026, #310) — reference_sheet makes an identity plate for a recurring character: face-plate, outfit-plate or three-panel. A plate has flat, even light on a grey background, so a later scene sets the light. It works on the same tools as camera_look, and can't be combined with camera_look, enhance_prompt or image_to_edit_id. See Reference sheets.
  • Character reference scope (18 October 2026, #305) — a reference_assets item with role character takes scope: face, wardrobe or full (the default). With a face plate and an outfit plate, the prompt says which picture gives what. scope on any other role is a 400 invalid_reference_assets.
  • Reference labels in the console (28 September 2026, #178) — on Prompt, you can label what each reference picture is for.
  • Typed reference_assets (27 September 2026, #177) — generate_image and POST /api/images accept reference_assets: each reference has a role (logo, style, composition, template, character or product), one source and an optional weight. See Reference roles.

Generating ​

  • ChatGPT subscription is optional (12 October 2026, #257 and #258) — a signed-in generate_image with no connected ChatGPT subscription now uses the workspace's own Gemini or OpenAI key for its default model instead of refusing. A ChatGPT Free account counts as not connected, since it can't make images. A connected subscription is still tried first, and the server never moves to the keys on its own after a subscription generation fails. See ChatGPT subscription.
  • Automatic fallback on Prompt (29 September 2026, #201 and #202) — when the chosen model can't be used right now, for example after a daily limit, Prompt tries another available option and a note says what it used. It never moves on after a content block or an unknown result. A switch in the Prompt settings turns it off.
  • Blank batch fields (17 and 18 October 2026, #291 and #293) — in batch_generate and POST /api/images/batch, an item's empty negative_prompt, style_preset_name or system_instruction now counts as unset, so the batch defaults apply.
  • Async generation jobs (27 September 2026, #156 and #160) — POST /api/generations/start, GET /api/generations/:id and POST /api/generations/:id/cancel, plus the MCP tools start_generation, get_generation_status and cancel_generation. Jobs keep running when the client disconnects, take an idempotency key, and are capped at 3 unfinished per workspace. See Async generation.
  • Projects and tags (10 October 2026, #247 to #250 and #252) — an image can be in one project and carry up to 20 tags. Every tool that makes images takes project and tags, and search_images and GET /api/images filter by them. New tools list_projects and organize_images. See Projects and tags.
  • Starter pack (30 September 2026, #205) — a new personal workspace starts with 4 characters, 4 products, 6 scenes and 10 styles, each with a picture. They don't count towards the monthly storage limit. Owners and managers can add the pack to another workspace with Add starter pack.
  • Short image links (29 September 2026, #196) — MCP tool results now lead with a short link such as https://gobananasai.com/i/…, which redirects to the image, and give the full URL on the next line. POST /api/images returns it as short_url.
  • Real health checks (28 September 2026, #185) — check_quota now writes and reads a test file in storage, and reports a provider billing or daily-quota refusal it has seen. A failed storage check, or a refusal that covers the selected model, makes canGenerate false.

Error answers ​

  • Request mistakes get a code (29 September to 16 October 2026, #197, #212, #276 and #281) — a request that can never succeed as sent now answers 400, 404 or 409 with a code, such as unknown_model, image_not_found or character_name_taken. Many of these used to answer 500. MCP tools answer them with -32602 instead of -32603, so clients don't retry them. See Error codes.
  • Rejected provider keys (16 October 2026, #284) — when Gemini or OpenAI rejects the workspace's key, the edit, continue-edit, character and product routes now answer as POST /api/images does: 422 provider_credentials_rejected with fixed text, never the provider's. A batch item's error carries the same text, and MCP tools give it with -32603.
  • Provider failures keep their message (18 to 23 October 2026, #285, #308 and #317) — character, multi-character and product generation now answer a provider failure with 500 and the provider's message, as POST /api/images does. That includes a billing limit, a daily quota and a per-minute rate limit, which used to answer 400.
  • Rejected references answer -32602 (24 October 2026) — over MCP, a rejected reference_assets entry (Image generation failed: reference_assets[N]: …) now answers -32602, so clients don't retry it. It used to answer -32603. REST already answered 400 invalid_reference_assets. A stored reference that storage fails to read is now a server error: 500 over REST and -32603 over MCP, where it used to be that 400.
  • No internal text in MCP errors (10 October 2026, #243) — a database or network failure in an MCP tool now gives a generic message with an errorId, as REST does.
  • Other workspaces' items look missing (11 October 2026, #254 and #255) — deleting or bulk-editing another workspace's image, or looking up its execution, now answers like a missing one (404) instead of 403. Also, the gallery list's operationType filter (GET /api/images and GET /api/images/ids) accepts upload and refuses an unknown value with a 400. Before, an unknown value returned every image.

Fixes ​

  • PATCH /api/products/:id (18 and 23 October 2026, #308 and #317) — product_name must be 1 to 100 characters, and tags and product_url a string or null; a bad value answers 400 Validation error: …. A name another product uses answers 409 product_name_taken. Both are checked before any image is uploaded.
  • Async edits that saved nothing end failed (18 and 19 October 2026, #304 and #315) — an edit sent with Prefer: respond-async that fails before its image starts saving now ends failed with a message. Examples are a provider refusal, a timeout or the monthly storage quota. Before, these ended as an uncertain outcome. A failure after saving began stays uncertain, since the image may exist. The edit is never sent again, and its Idempotency-Key stays used, so a retry needs a new key.
  • Higgsfield credentials stay out of messages (19 and 23 October 2026, #312 and #322) — when Higgsfield rejects the credentials, request_higgsfield_video and get_higgsfield_video_status answer fixed text. Other Higgsfield messages keep their text, with every copy of the workspace's key id and secret replaced by [redacted].
  • Provider "access forbidden" text (18 October 2026, #300) — a Gemini 403 now gives only Google's status and reason codes. An OpenAI 403 keeps its text, with any sk-… key text replaced by [key removed].
  • search_images and uploads (11 October 2026, #254) — search no longer fails on a page that contains an uploaded image, and uploads can be filtered for.

Website and connecting ​

  • Public website, sign-in at /login (28 September 2026, #180) — signed-out visitors to gobananasai.com now see the website, with pricing, connect and the legal pages. Sign-in and sign-up moved to gobananasai.com/login. Emailed links and connector sign-in still work. See Accounts and sign-in.
  • Pricing (29 September 2026, #199) — the pricing page shows Go Bananas as free, with images made through your own ChatGPT or Codex subscription or Gemini or OpenAI key. Pro, at $9.99 a month, is listed as coming soon.
  • UI refresh (27 September 2026, #143) — the console's buttons, cards, badges, form fields and dialogs were restyled.
  • MCP host and listings (24 September 2026) — https://mcp.gobananasai.com is the MCP address (https://gobananasai.com/mcp still works), with a public setup page at gobananasai.com/connect, a plugin for Claude Code and Codex, and a listing on the official MCP Registry as com.gobananasai/go-bananas. Every MCP tool now carries a title and read-only/destructive hints.

Accounts and security ​

  • Two-step sign-in for super-admins (27 September 2026, #145 and #146) — super-admins confirm sign-in with a 6-digit code from an authenticator app, or a one-time backup code.
  • Account deletion and data export (25 September 2026) — self-service from Your account: download everything as one JSON file, or delete your account after a 7-day grace period. See Account & Privacy.
  • Data retention (25 September 2026) — expired sign-in sessions, tokens, one-time links and old job logs are deleted on an hourly schedule.
  • API keys stored only as hashes (25 September 2026) — Go Bananas API keys are kept as SHA-256 hashes and shown once, at creation. Older plain-text keys keep working and are converted automatically. Since 26 September a revoked key can no longer authenticate through an old plain-text entry.
  • Email confirmation for new signups (24 September 2026) — self-signup accounts confirm their email before a workspace is created.

CLI and MCP proxy releases ​

gobananas-cli and gobananas-mcp share a version line (Node.js 20.3 or later). See the CLI guide for usage.

1.5 ​

  • 1.5.3 — the gobananas-mcp proxy gives AI clients the same instructions as the server, including its newer advice for real-looking photos: put the camera first and skip "8K" and "masterpiece". No command, flag or tool changed.
  • 1.5.2 — gb subscription status describes the ChatGPT connection in plain words, including a Free plan that can't make images, and says what gb generate uses instead. The --json output is unchanged. A refused gb generate --subscription says nothing was generated and names the fix.
  • 1.5.1 — a proxy whose server URL is https://mcp.gobananasai.com now saves local image copies too.
  • 1.5.0 — Codex and the ChatGPT app's Codex mode don't display pictures from gobananasai.com, so the proxy saves a copy of each new image to ~/Pictures/go-bananas/ and adds its path to the reply. Other clients get copies only when GO_BANANAS_IMAGE_DIR names a folder; GO_BANANAS_IMAGE_DIR=off turns copies off. In the ChatGPT app's project folders, images are filed under the ChatGPT project's name, never the folder id.

1.4 ​

  • 1.4.0 — the MCP connector sends the name of the folder it runs in with each request, and Go Bananas files new images under that project. Inside a git repository it sends the repository's folder name. Only the name is sent, never the path. Set GO_BANANAS_PROJECT=off to send none, or GO_BANANAS_PROJECT=<name> to choose it. Your home folder, Desktop, Documents, Downloads and temporary folders are never used as the project.

1.3.5 to 1.3.9 ​

  • 1.3.9 — when a browser login expires with several calls in flight, each call the expired login refused is resent once with GO_BANANAS_API_KEY, and calls the server already accepted finish.
  • 1.3.8 — the MCP SDK is 1.32.1, which fixes a security advisory. A refused tool call is shown as an error and the command fails, instead of printing success. Help text lists Nano Banana 2.1.
  • 1.3.7 — proxies renew a browser login under a shared lock, so two renewing at once no longer cancel it. When the login has expired and an API key is set, the call is retried once with the key. go_bananas_diagnose reports real storage and provider health.
  • 1.3.6 — when Go Bananas rejects the sign-in, the MCP proxy says the tool did not run and is safe to retry, instead of warning that it may have completed.
  • 1.3.5 — the MCP proxy and CLI read the browser-login token for every request and refresh it on a 401, so a long session no longer fails a call with "Access token has expired". Also the first published release to carry the 1.3.4 changes.

1.3.0 to 1.3.4 ​

  • 1.3.4 — MCP session hardening, agent connector hardening and gallery recovery. Not published to npm on its own; its changes shipped in 1.3.5.
  • 1.3.3 — explicit subscription generation goes through the dedicated fail-closed MCP tool, and a missing images:generate OAuth scope is reported instead of claiming the subscription is ready.
  • 1.3.0 – 1.3.2 — subscription routing, explicit generation lanes, source/billing provenance and subscription status commands.

Highlights ​

  • 1.3.0 (21 September 2026) — Codex subscription image generation through a hosted runner, with the generate_with_subscription and get_subscription_status tools.
  • 1.3.0 — upload_media and POST /api/media/upload: video, audio and image uploads become durable public R2 URLs with the original extension preserved.
  • 1.3.0 — Posters, Higgsfield video handoff and automated character identity refresh as first-class MCP tools.
  • 1.3.0 — Nano Banana 2 Lite (gemini-flash-lite-image) became the default model, and OpenAI GPT Image 2.5 Flare and Sunburst joined the model registry.
  • 1.2.0 (1 May 2026) — Multi-provider image models: OpenAI gpt-image-2 alongside Gemini Flash and Pro, with a per-request model_id override and a per-tenant allowlist.

Version History ​

Versioning Policy ​

Go Bananas! follows Semantic Versioning:

  • MAJOR: Breaking API changes
  • MINOR: New features, backward compatible
  • PATCH: Bug fixes, backward compatible

API Versioning ​

The API is currently unversioned. Future breaking changes will be introduced with:

/api/v2/images

The original endpoints will remain available during deprecation periods.

Deprecation Policy ​

  1. Announcement: 3 months before removal
  2. Warning Headers: X-API-Deprecated: true
  3. Documentation: Updated with migration guides
  4. Removal: After deprecation period

Migration Guides ​

Migrating to 1.0 ​

If upgrading from pre-release versions:

  1. Database Migration

    bash
    npm run db:migrate

  2. Update API Keys

    • Old format keys continue to work
    • New keys use sk_live_ prefix

  3. MCP Configuration

    • Update to new streamable HTTP transport
    • SSE endpoint remains for legacy support

Roadmap ​

Planned work is tracked as issues at github.com/davendra/go-bananas-app/issues. Useful labels: production-safety, spec, enhancement.

Next Steps ​