@boyingliu01/xp-gate 0.25.0 → 0.27.0

package/plugins/dsh/skills/clipboard-vision/__tests__/clipboard-vision.test.cjs

@@ -1,273 +0,0 @@
-/**
- * @test REQ-379 privacy-safe clipboard vision
- * @intent Verify one-shot clipboard image analysis enforces local-first privacy boundaries
- * @covers AC-379-01, AC-379-02, AC-379-03, AC-379-04, AC-379-05, AC-379-06
- */
-const fs = require('fs');
-const crypto = require('crypto');
-const os = require('os');
-const path = require('path');
-const { spawnSync } = require('child_process');
-
-const ROOT = path.resolve(__dirname, '..');
-const BASH_SCRIPT = path.join(ROOT, 'scripts', 'clipboard-vision.sh');
-const POWERSHELL_SCRIPT = path.join(ROOT, 'scripts', 'clipboard-vision.ps1');
-const SECRET = 'cv-secret-must-never-leak';
-
-function writeExecutable(file, content) {
-  fs.writeFileSync(file, content, { mode: 0o755 });
-}
-
-function createFixture() {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'clipboard-vision-test-'));
-  const bin = path.join(root, 'bin');
-  const temp = path.join(root, 'temp');
-  fs.mkdirSync(bin);
-  fs.mkdirSync(temp);
-  const image = path.join(root, 'clipboard.png');
-  fs.writeFileSync(image, Buffer.from('89504e470d0a1a0a', 'hex'));
-  const clipboardCount = path.join(root, 'clipboard-count');
-  const curlCount = path.join(root, 'curl-count');
-  const curlArgs = path.join(root, 'curl-args');
-  const curlBody = path.join(root, 'curl-body');
-
-  writeExecutable(path.join(bin, 'pngpaste'), `#!/usr/bin/env bash
-set -euo pipefail
-printf x >> "${clipboardCount}"
-cp "${image}" "$1"
-`);
-  writeExecutable(path.join(bin, 'curl'), `#!/usr/bin/env bash
-set -euo pipefail
-printf x >> "${curlCount}"
-printf '%s\n' "$@" > "${curlArgs}"
-while [ "$#" -gt 0 ]; do
-  if [ "$1" = '--data-binary' ]; then cp "\${2#@}" "${curlBody}"; shift 2; continue; fi
-  if [ "$1" = '--output' ]; then output="$2"; shift 2; continue; fi
-  if [ "$1" = '--write-out' ]; then shift 2; continue; fi
-  shift
-done
-if [ -n "\${CV_FAKE_RESPONSE:-}" ]; then
-  printf '%s' "$CV_FAKE_RESPONSE" > "$output"
-else
-  printf '%s' '{"choices":[{"message":{"content":"described safely"}}]}' > "$output"
-fi
-printf '%s' "\${CV_FAKE_STATUS:-200}"
-`);
-
-  return { root, bin, temp, image, clipboardCount, curlCount, curlArgs, curlBody };
-}
-
-function run(fixture, args = [], env = {}) {
-  return spawnSync('bash', [BASH_SCRIPT, ...args], {
-    encoding: 'utf8',
-    env: {
-      ...process.env,
-      PATH: `${fixture.bin}:${process.env.PATH}`,
-      TMPDIR: fixture.temp,
-      CLIPBOARD_VISION_MODEL: 'fixture-model',
-      CLIPBOARD_VISION_API_KEY: SECRET,
-      ...env,
-    },
-  });
-}
-
-function combined(result) {
-  return `${result.stdout}${result.stderr}`;
-}
-
-function count(file) {
-  return fs.existsSync(file) ? fs.readFileSync(file, 'utf8').length : 0;
-}
-
-function consentToken(hostname, model, base = `https://${hostname}/v1`) {
-  const url = new URL(base);
-  const scheme = url.protocol.slice(0, -1).toLowerCase();
-  const normalizedHost = url.hostname.toLowerCase();
-  const port = url.port || (scheme === 'https' ? '443' : '80');
-  const displayHost = normalizedHost.includes(':') ? `[${normalizedHost}]` : normalizedHost;
-  const endpoint = `${scheme}://${displayHost}:${port}${url.pathname.replace(/\/+$/, '')}/chat/completions`;
-  return crypto.createHash('sha256').update(`${endpoint}\n${model}`, 'utf8').digest('hex');
-}
-
-function assertNoTempFiles(fixture) {
-  expect(fs.readdirSync(fixture.temp)).toEqual([]);
-}
-
-describe('clipboard-vision Bash client', () => {
-  let fixture;
-
-  beforeEach(() => {
-    fixture = createFixture();
-  });
-
-  afterEach(() => {
-    fs.rmSync(fixture.root, { recursive: true, force: true });
-  });
-
-  it('fails without model configuration before reading clipboard or calling network', () => {
-    const result = run(fixture, [], { CLIPBOARD_VISION_MODEL: '' });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('rejects a non-loopback endpoint in local mode before reading clipboard', () => {
-    const result = run(fixture, [], { CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1' });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('requires both remote opt-in and destination-bound confirmation', () => {
-    const endpoint = { CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1' };
-    const optInOnly = run(fixture, ['--allow-remote'], endpoint);
-    const confirmationOnly = run(fixture, ['--confirm-remote', consentToken('vision.example.test', 'fixture-model')], endpoint);
-
-    expect(optInOnly.status).not.toBe(0);
-    expect(confirmationOnly.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('prints disclosure and expected token before rejecting missing confirmation', () => {
-    const result = run(fixture, ['--allow-remote'], {
-      CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1',
-    });
-
-    expect(result.status).not.toBe(0);
-    expect(result.stderr).toContain('vision.example.test');
-    expect(result.stderr).toContain('fixture-model');
-    expect(result.stderr.toLowerCase()).toContain('image');
-    expect(result.stderr).toContain(consentToken('vision.example.test', 'fixture-model'));
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('accepts the confirmation token bound to normalized hostname and exact model', () => {
-    const token = consentToken('vision.example.test', 'fixture-model');
-    const result = run(fixture, ['--allow-remote', '--confirm-remote', token], {
-      CLIPBOARD_VISION_API_BASE: 'https://VISION.Example.Test/v1',
-    });
-
-    expect(result.status, combined(result)).toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(1);
-    expect(count(fixture.curlCount)).toBe(1);
-  });
-
-  it('rejects a token for a changed destination before clipboard or network', () => {
-    const staleToken = consentToken('old.example.test', 'fixture-model');
-    const result = run(fixture, ['--allow-remote', '--confirm-remote', staleToken], {
-      CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1',
-    });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('rejects a token for a changed model before clipboard or network', () => {
-    const staleToken = consentToken('vision.example.test', 'old-model');
-    const result = run(fixture, ['--allow-remote', '--confirm-remote', staleToken], {
-      CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1',
-    });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('never exposes the API key in output or request JSON', () => {
-    const result = run(fixture);
-
-    expect(result.status, combined(result)).toBe(0);
-    expect(combined(result)).not.toContain(SECRET);
-    expect(fs.readFileSync(fixture.curlBody, 'utf8')).not.toContain(SECRET);
-  });
-
-  it('rejects oversized clipboard images before network access', () => {
-    fs.writeFileSync(fixture.image, Buffer.alloc(33));
-    const result = run(fixture, [], { CLIPBOARD_VISION_MAX_BYTES: '32' });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-    assertNoTempFiles(fixture);
-  });
-
-  it('removes temporary files after success', () => {
-    const result = run(fixture);
-
-    expect(result.status, combined(result)).toBe(0);
-    expect(result.stdout.trim()).toBe('described safely');
-    assertNoTempFiles(fixture);
-  });
-
-  it('redacts API failure bodies and removes temporary files after failure', () => {
-    const response = `upstream body contains ${SECRET}`;
-    const result = run(fixture, [], { CV_FAKE_STATUS: '500', CV_FAKE_RESPONSE: response });
-
-    expect(result.status).not.toBe(0);
-    expect(combined(result)).not.toContain(response);
-    expect(combined(result)).not.toContain(SECRET);
-    assertNoTempFiles(fixture);
-  });
-
-  it('performs exactly one clipboard read and one request per explicit invocation', () => {
-    const result = run(fixture);
-
-    expect(result.status, combined(result)).toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(1);
-    expect(count(fixture.curlCount)).toBe(1);
-  });
-});
-
-describe('clipboard-vision PowerShell contract', () => {
-  it('keeps credentials in the environment and enforces bound consent, bounds, and cleanup', () => {
-    const content = fs.readFileSync(POWERSHELL_SCRIPT, 'utf8');
-
-    expect(content).toMatch(/\$env:CLIPBOARD_VISION_API_KEY/);
-    expect(content).toMatch(/AllowRemote/);
-    expect(content).toMatch(/ConfirmRemote/);
-    expect(content).toMatch(/SHA256/i);
-    expect(content).toMatch(/CLIPBOARD_VISION_MAX_BYTES/);
-    expect(content).toMatch(/finally\s*\{/i);
-    expect(content).toMatch(/Remove-Item/);
-    expect(content).not.toMatch(/https:\/\/(?!127\.0\.0\.1|localhost|\[::1\])/);
-  });
-
-  it('disables HTTP redirects so loopback cannot forward the clipboard body remotely', () => {
-    const content = fs.readFileSync(POWERSHELL_SCRIPT, 'utf8');
-
-    expect(content).toMatch(/MaximumRedirection\s+0/);
-  });
-
-  it('validates an absolute HTTP(S) URI without credentials before disclosure or seams', () => {
-    const content = fs.readFileSync(POWERSHELL_SCRIPT, 'utf8');
-    const validationPosition = content.indexOf('IsAbsoluteUri');
-    const disclosurePosition = content.indexOf('Remote disclosure');
-    const clipboardPosition = content.indexOf('CLIPBOARD_VISION_TEST_IMAGE');
-
-    expect(validationPosition).toBeGreaterThan(0);
-    expect(content).toMatch(/Scheme[^\n]+https?/i);
-    expect(content).toMatch(/UserInfo/);
-    expect(validationPosition).toBeLessThan(disclosurePosition);
-    expect(validationPosition).toBeLessThan(clipboardPosition);
-  });
-
-  it('ships a discoverable Windows-CI executable behavior harness', () => {
-    expect(fs.existsSync(path.join(ROOT, '__tests__', 'clipboard-vision.Tests.ps1'))).toBe(true);
-  });
-
-  it('wires the discoverable PowerShell harness into windows-latest CI', () => {
-    let repoRoot = ROOT;
-    while (!fs.existsSync(path.join(repoRoot, '.github', 'workflows', 'cross-platform-ci.yml'))) {
-      repoRoot = path.dirname(repoRoot);
-    }
-    const workflow = fs.readFileSync(path.join(repoRoot, '.github', 'workflows', 'cross-platform-ci.yml'), 'utf8');
-
-    expect(workflow).toContain('windows-latest');
-    expect(workflow).toContain('clipboard-vision.Tests.ps1');
-    expect(workflow).toMatch(/shell:\s*pwsh/);
-  });
-});

package/plugins/dsh/skills/clipboard-vision/describe-clipboard.ps1

@@ -1,115 +0,0 @@
-# describe-clipboard.ps1
-# Reads image from clipboard, sends to vision model API, writes description to stdout.
-# API key is read from CLIPBOARD_VISION_API_KEY environment variable.
-# WARNING: Do not enable -Verbose or Set-PSDebug -Trace 2 — the API key would be logged.
-param(
-    [string]$OutputFile = "$env:TEMP\clipboard_desc.txt"
-)
-
-$ErrorActionPreference = "Stop"
-
-# Platform guard
-if (-not $IsWindows) {
-    Write-Host "ERROR: This script requires Windows (uses .NET System.Windows.Forms)"
-    exit 1
-}
-
-$apiKey = $env:CLIPBOARD_VISION_API_KEY
-if (-not $apiKey) {
-    Write-Host "ERROR: CLIPBOARD_VISION_API_KEY environment variable not set"
-    exit 1
-}
-
-$tempPng = $null
-$img = $null
-
-try {
-    # --- Read clipboard image ---
-    Add-Type -AssemblyName System.Windows.Forms -ErrorAction Stop
-    Add-Type -AssemblyName System.Drawing -ErrorAction Stop
-
-    $img = [System.Windows.Forms.Clipboard]::GetImage()
-    if (-not $img) {
-        Write-Host "ERROR: No image found in clipboard"
-        exit 1
-    }
-
-    # Save to temp PNG
-    $tempPng = Join-Path $env:TEMP "clipboard_$(Get-Date -Format 'yyyyMMdd_HHmmss').png"
-    $img.Save($tempPng, [System.Drawing.Imaging.ImageFormat]::Png)
-
-    # Convert to base64
-    $bytes = [System.IO.File]::ReadAllBytes($tempPng)
-    $base64 = [System.Convert]::ToBase64String($bytes)
-
-    # --- Build API request ---
-    $apiBase = "https://lab.iwhalecloud.com/gpt-proxy"
-    $model = "LOCAL/Qwen3.5-122B-A10B"
-
-    $body = @{
-        model = $model
-        messages = @(
-            @{
-                role = "user"
-                content = @(
-                    @{
-                        type = "text"
-                        text = "Describe this image in detail. Include all visible text, UI elements, code, error messages, objects, people, and any information conveyed. Be specific and thorough but concise. If it contains code or terminal output, quote it exactly."
-                    },
-                    @{
-                        type = "image_url"
-                        image_url = @{
-                            url = "data:image/png;base64,$base64"
-                        }
-                    }
-                )
-            }
-        )
-        max_tokens = 1024
-        temperature = 0.1
-    } | ConvertTo-Json -Depth 5
-
-    # --- Call API ---
-    $response = Invoke-RestMethod -Uri "$apiBase/chat/completions" `
-        -Method Post `
-        -Headers @{
-            "Authorization" = "Bearer $apiKey"
-            "Content-Type"  = "application/json"
-        } `
-        -Body ([System.Text.Encoding]::UTF8.GetBytes($body)) `
-        -TimeoutSec 30
-
-    # Validate response structure
-    if (-not $response.choices -or -not $response.choices[0].message -or -not $response.choices[0].message.content) {
-        Write-Host "ERROR: Unexpected API response structure"
-        Write-Host "Response: $($response | ConvertTo-Json -Compress -Depth 2)"
-        exit 1
-    }
-
-    $description = $response.choices[0].message.content
-} catch {
-    Write-Host "ERROR: $_"
-    exit 1
-} finally {
-    # Cleanup temp file and GDI+ handle
-    if ($tempPng -and (Test-Path $tempPng)) {
-        Remove-Item $tempPng -Force -ErrorAction SilentlyContinue
-    }
-    if ($img) {
-        $img.Dispose()
-    }
-}
-
-if (-not $description) {
-    Write-Host "ERROR: Empty response from vision model"
-    exit 1
-}
-
-# Write to output file
-$description | Out-File -FilePath $OutputFile -Encoding UTF8 -Force
-
-# Output to stdout
-Write-Host "Clipboard image description saved to: $OutputFile"
-Write-Host "---"
-Write-Host $description
-Write-Host "---"

package/plugins/dsh/skills/clipboard-vision/describe-clipboard.sh

@@ -1,161 +0,0 @@
-#!/usr/bin/env bash
-# describe-clipboard.sh
-# Cross-platform: reads clipboard image, calls vision API, writes description.
-# Works on: WSL/Linux (xclip), macOS (osascript), Windows Git Bash (PowerShell)
-#
-# Requires CLIPBOARD_VISION_API_KEY environment variable.
-# WARNING: Do not run with `set -x` — the API key would be logged.
-set -euo pipefail
-
-OUTPUT_FILE="${1:-/tmp/clipboard_desc.txt}"
-API_KEY="${CLIPBOARD_VISION_API_KEY:-}"
-API_BASE="${CLIPBOARD_VISION_API_BASE:-https://lab.iwhalecloud.com/gpt-proxy}"
-MODEL="LOCAL/Qwen3.5-122B-A10B"
-TEMP_PNG=""
-
-if [ -z "$API_KEY" ]; then
-    echo "ERROR: CLIPBOARD_VISION_API_KEY environment variable not set" >&2
-    exit 1
-fi
-
-cleanup() {
-    if [ -n "$TEMP_PNG" ] && [ -f "$TEMP_PNG" ]; then
-        rm -f "$TEMP_PNG"
-    fi
-}
-trap cleanup EXIT
-
-# --- Detect platform and read clipboard ---
-get_base64_from_clipboard() {
-    local platform b64_cmd
-    platform="$(uname -s)"
-
-    if [ "$platform" = "Linux" ]; then
-        b64_cmd="base64 -w 0"
-        # WSL / Linux: use xclip or wl-paste
-        if command -v xclip &>/dev/null; then
-            TARGETS="$(xclip -selection clipboard -o -t TARGETS 2>/dev/null || echo "")"
-            if echo "$TARGETS" | grep -qx "image/png"; then
-                TEMP_PNG="$(mktemp /tmp/clipboard_XXXXXX.png)"
-                xclip -selection clipboard -o -t image/png > "$TEMP_PNG"
-                $b64_cmd "$TEMP_PNG"
-            else
-                echo "ERROR: No PNG image in clipboard (xclip targets: ${TARGETS:-none})" >&2
-                exit 1
-            fi
-        elif command -v wl-paste &>/dev/null; then
-            TEMP_PNG="$(mktemp /tmp/clipboard_XXXXXX.png)"
-            wl-paste -t image/png > "$TEMP_PNG"
-            $b64_cmd "$TEMP_PNG"
-        else
-            echo "ERROR: No clipboard tool found (install xclip or wl-clipboard)" >&2
-            exit 1
-        fi
-    elif [ "$platform" = "MINGW64_NT" ] || [ "$platform" = "MSYS_NT" ] || [ "${OS:-}" = "Windows_NT" ]; then
-        b64_cmd="base64 -w 0"
-        # Windows Git Bash: delegate to PowerShell
-        PS_EXE="/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe"
-        if [ ! -f "$PS_EXE" ]; then
-            PS_EXE="powershell.exe"
-        fi
-        TEMP_PNG="$(mktemp --suffix=.png)"
-        WIN_TEMP="$(cygpath -w "$TEMP_PNG" 2>/dev/null || echo "$TEMP_PNG")"
-        "$PS_EXE" -NoProfile -NonInteractive -Command "
-            Add-Type -AssemblyName System.Windows.Forms;
-            Add-Type -AssemblyName System.Drawing;
-            \$img = [System.Windows.Forms.Clipboard]::GetImage();
-            if (-not \$img) { Write-Host 'NO_IMAGE'; exit 1 };
-            \$img.Save('$WIN_TEMP', [System.Drawing.Imaging.ImageFormat]::Png);
-            Write-Host 'OK';
-        " > /dev/null
-        if [ ! -f "$TEMP_PNG" ] || [ ! -s "$TEMP_PNG" ]; then
-            echo "ERROR: No image found in clipboard" >&2
-            exit 1
-        fi
-        $b64_cmd "$TEMP_PNG"
-    else
-        # macOS
-        b64_cmd="base64 -b 0"
-        if command -v osascript &>/dev/null; then
-            TEMP_PNG="$(mktemp /tmp/clipboard_XXXXXX.png)"
-            if ! osascript -e "set theFile to (open for access POSIX file \"$TEMP_PNG\" with write permission)" \
-                            -e "write (the clipboard as «class PNGf») to theFile" \
-                            -e "close access theFile" 2>/dev/null; then
-                echo "ERROR: Failed to read image from macOS clipboard" >&2
-                exit 1
-            fi
-            if [ ! -s "$TEMP_PNG" ]; then
-                echo "ERROR: No image in clipboard" >&2
-                exit 1
-            fi
-            $b64_cmd "$TEMP_PNG"
-        else
-            echo "ERROR: Unsupported platform ($platform)" >&2
-            exit 1
-        fi
-    fi
-}
-
-# --- Build and send API request via python3 (safe JSON construction) ---
-call_vision_api() {
-    local b64="$1"
-    python3 -c "
-import json, sys, os, urllib.request
-
-api_key = os.environ['CLIPBOARD_VISION_API_KEY']
-api_base = os.environ.get('CLIPBOARD_VISION_API_BASE', 'https://lab.iwhalecloud.com/gpt-proxy')
-model = 'LOCAL/Qwen3.5-122B-A10B'
-
-body = json.dumps({
-    'model': model,
-    'messages': [{
-        'role': 'user',
-        'content': [
-            {'type': 'text', 'text': 'Describe this image in detail. Include all visible text, UI elements, code, error messages, objects, people, and any information conveyed. Be specific and thorough but concise. If it contains code or terminal output, quote it exactly.'},
-            {'type': 'image_url', 'image_url': {'url': f'data:image/png;base64,{sys.argv[1]}'}}
-        ]
-    }],
-    'max_tokens': 1024,
-    'temperature': 0.1
-}).encode('utf-8')
-
-req = urllib.request.Request(
-    f'{api_base}/chat/completions',
-    data=body,
-    headers={
-        'Authorization': f'Bearer {api_key}',
-        'Content-Type': 'application/json'
-    }
-)
-
-try:
-    with urllib.request.urlopen(req, timeout=30) as resp:
-        data = json.loads(resp.read().decode('utf-8'))
-    if not data.get('choices') or not data['choices'][0].get('message'):
-        print('ERROR: Unexpected API response structure', file=sys.stderr)
-        sys.exit(1)
-    content = data['choices'][0]['message'].get('content', '')
-    if not content:
-        print('ERROR: Empty response from vision model', file=sys.stderr)
-        sys.exit(1)
-    print(content)
-except Exception as e:
-    print(f'ERROR: API call failed: {e}', file=sys.stderr)
-    sys.exit(1)
-" "$b64"
-}
-
-# --- Main ---
-echo "[clipboard-vision] Reading clipboard..." >&2
-B64="$(get_base64_from_clipboard)"
-
-echo "[clipboard-vision] Calling vision model ($MODEL)..." >&2
-
-DESCRIPTION="$(call_vision_api "$B64")"
-
-echo "$DESCRIPTION" > "$OUTPUT_FILE"
-echo "[clipboard-vision] Description saved to: $OUTPUT_FILE" >&2
-
-echo "---"
-echo "$DESCRIPTION"
-echo "---"

package/plugins/dsh/skills/clipboard-vision/scripts/clipboard-vision.ps1

@@ -1,86 +0,0 @@
-[CmdletBinding()]
-param(
-    [switch]$AllowRemote,
-    [string]$ConfirmRemote
-)
-
-$ErrorActionPreference = 'Stop'
-$ApiBase = if ($env:CLIPBOARD_VISION_API_BASE) { $env:CLIPBOARD_VISION_API_BASE } else { 'http://127.0.0.1:11434/v1' }
-$Model = $env:CLIPBOARD_VISION_MODEL
-$ApiKey = $env:CLIPBOARD_VISION_API_KEY
-$MaxBytes = if ($env:CLIPBOARD_VISION_MAX_BYTES) { [long]$env:CLIPBOARD_VISION_MAX_BYTES } else { 10485760 }
-
-if (-not $Model) { throw 'CLIPBOARD_VISION_MODEL is required' }
-if ($MaxBytes -le 0) { throw 'CLIPBOARD_VISION_MAX_BYTES must be positive' }
-$Endpoint = $null
-if (-not [Uri]::TryCreate($ApiBase, [UriKind]::Absolute, [ref]$Endpoint) -or
-    -not $Endpoint.IsAbsoluteUri -or
-    $Endpoint.Scheme -notin @('http', 'https') -or
-    $Endpoint.UserInfo.Length -ne 0 -or
-    $Endpoint.Query.Length -ne 0 -or
-    $Endpoint.Fragment.Length -ne 0) {
-    throw 'CLIPBOARD_VISION_API_BASE must be an absolute HTTP(S) URI without credentials'
-}
-$Address = $null
-$LiteralAddress = [Net.IPAddress]::TryParse($Endpoint.Host.Trim('[', ']'), [ref]$Address)
-$Loopback = $LiteralAddress -and [Net.IPAddress]::IsLoopback($Address)
-$NormalizedHost = $Endpoint.Host.Trim('[', ']').ToLowerInvariant()
-$EffectivePort = if ($Endpoint.IsDefaultPort) { if ($Endpoint.Scheme -eq 'https') { 443 } else { 80 } } else { $Endpoint.Port }
-$DisplayHost = if ($NormalizedHost.Contains(':')) { "[$NormalizedHost]" } else { $NormalizedHost }
-$BasePath = $Endpoint.AbsolutePath.TrimEnd('/')
-$EffectiveEndpoint = "$($Endpoint.Scheme.ToLowerInvariant())://$DisplayHost`:$EffectivePort$BasePath/chat/completions"
-if (-not $Loopback) {
-    $ConsentBytes = [Text.Encoding]::UTF8.GetBytes("$EffectiveEndpoint`n$Model")
-    $Hasher = [Security.Cryptography.SHA256]::Create()
-    try { $ExpectedConfirmation = ([BitConverter]::ToString($Hasher.ComputeHash($ConsentBytes))).Replace('-', '').ToLowerInvariant() } finally { $Hasher.Dispose() }
-    [Console]::Error.WriteLine("Remote disclosure: clipboard image data will be sent to $EffectiveEndpoint using model $Model.")
-    [Console]::Error.WriteLine("Confirmation token for this canonical endpoint and model: $ExpectedConfirmation")
-    if (-not $AllowRemote -or $ConfirmRemote -cne $ExpectedConfirmation) {
-        throw 'Remote endpoint requires -AllowRemote and the disclosed -ConfirmRemote token'
-    }
-}
-
-$TempDirectory = Join-Path ([IO.Path]::GetTempPath()) ("clipboard-vision-" + [Guid]::NewGuid())
-$ImagePath = Join-Path $TempDirectory 'clipboard.png'
-try {
-    New-Item -ItemType Directory -Path $TempDirectory | Out-Null
-    if ($env:CLIPBOARD_VISION_TEST_IMAGE) {
-        Copy-Item -LiteralPath $env:CLIPBOARD_VISION_TEST_IMAGE -Destination $ImagePath
-    } else {
-        Add-Type -AssemblyName System.Windows.Forms
-        Add-Type -AssemblyName System.Drawing
-        $Image = [Windows.Forms.Clipboard]::GetImage()
-        if ($null -eq $Image) { throw 'Clipboard does not contain an image' }
-        try { $Image.Save($ImagePath, [Drawing.Imaging.ImageFormat]::Png) } finally { $Image.Dispose() }
-    }
-    if ((Get-Item $ImagePath).Length -gt $MaxBytes) { throw "Clipboard image exceeds $MaxBytes bytes" }
-
-    $Encoded = [Convert]::ToBase64String([IO.File]::ReadAllBytes($ImagePath))
-    $Body = @{
-        model = $Model
-        messages = @(@{ role = 'user'; content = @(
-            @{ type = 'text'; text = 'Describe this clipboard image.' },
-            @{ type = 'image_url'; image_url = @{ url = "data:image/png;base64,$Encoded" } }
-        ) })
-    } | ConvertTo-Json -Depth 8 -Compress
-    $Headers = @{}
-    if ($ApiKey) { $Headers.Authorization = "Bearer $ApiKey" }
-    try {
-        if ($env:CLIPBOARD_VISION_TEST_HTTP_CAPTURE) {
-            Set-Content -LiteralPath $env:CLIPBOARD_VISION_TEST_HTTP_CAPTURE -Value $Body -Encoding utf8
-            if ($env:CV_TEST_HTTP_FAILURE) { throw 'test HTTP failure body secret' }
-            if ($env:CV_TEST_MALFORMED_JSON) { $Response = $null }
-            elseif ($env:CV_TEST_NON_STRING) { $Response = @{ choices = @(@{ message = @{ content = @{ value = 1 } } }) } }
-            else { $Response = @{ choices = @(@{ message = @{ content = 'test description' } }) } }
-        } else {
-            $Response = Invoke-RestMethod -Method Post -Uri $EffectiveEndpoint -Headers $Headers -ContentType 'application/json' -Body $Body -MaximumRedirection 0
-        }
-    } catch {
-        throw 'Vision API request failed (response body redacted)'
-    }
-    $Result = $Response.choices[0].message.content
-    if ($Result -isnot [string]) { throw 'Invalid vision API response (body redacted)' }
-    $Result
-} finally {
-    Remove-Item -LiteralPath $TempDirectory -Recurse -Force -ErrorAction SilentlyContinue
-}