@boyingliu01/xp-gate 0.26.0 → 0.27.1

package/plugins/claude-code/skills/clipboard-vision/__tests__/clipboard-vision.Tests.ps1

@@ -1,138 +0,0 @@
-# @test REQ-379 Windows privacy-safe clipboard vision
-# @intent Verify bound remote consent and redirect blocking on Windows CI
-# @covers AC-379-02, AC-379-03, AC-379-06
-
-Describe 'clipboard-vision PowerShell behavior' {
-    BeforeAll {
-        $ScriptPath = Join-Path $PSScriptRoot '..\scripts\clipboard-vision.ps1'
-        $Fixture = Join-Path ([IO.Path]::GetTempPath()) ("clipboard-vision-pester-" + [Guid]::NewGuid())
-        $ImagePath = Join-Path $Fixture 'clipboard.png'
-        $CapturePath = Join-Path $Fixture 'request.json'
-        New-Item -ItemType Directory -Path $Fixture | Out-Null
-        [IO.File]::WriteAllBytes($ImagePath, [byte[]](137, 80, 78, 71, 13, 10, 26, 10))
-        $env:CLIPBOARD_VISION_TEST_IMAGE = $ImagePath
-        $env:CLIPBOARD_VISION_TEST_HTTP_CAPTURE = $CapturePath
-        $env:CLIPBOARD_VISION_MODEL = 'windows-fixture-model'
-
-        $ConsentBytes = [Text.Encoding]::UTF8.GetBytes("https://vision.example.test:443/v1/chat/completions`nwindows-fixture-model")
-        $Hasher = [Security.Cryptography.SHA256]::Create()
-        try {
-            $Token = ([BitConverter]::ToString($Hasher.ComputeHash($ConsentBytes))).Replace('-', '').ToLowerInvariant()
-        } finally {
-            $Hasher.Dispose()
-        }
-    }
-
-    BeforeEach {
-        Remove-Item -LiteralPath $CapturePath -ErrorAction SilentlyContinue
-        Remove-Item Env:CLIPBOARD_VISION_MAX_BYTES -ErrorAction SilentlyContinue
-        Remove-Item Env:CV_TEST_MALFORMED_JSON -ErrorAction SilentlyContinue
-        Remove-Item Env:CV_TEST_NON_STRING -ErrorAction SilentlyContinue
-        Remove-Item Env:CV_TEST_HTTP_FAILURE -ErrorAction SilentlyContinue
-        $env:CLIPBOARD_VISION_API_BASE = 'https://VISION.Example.Test/v1'
-    }
-
-    AfterAll {
-        Remove-Item Env:CLIPBOARD_VISION_TEST_IMAGE -ErrorAction SilentlyContinue
-        Remove-Item Env:CLIPBOARD_VISION_TEST_HTTP_CAPTURE -ErrorAction SilentlyContinue
-        Remove-Item Env:CLIPBOARD_VISION_API_BASE -ErrorAction SilentlyContinue
-        Remove-Item Env:CLIPBOARD_VISION_MODEL -ErrorAction SilentlyContinue
-        Remove-Item Env:CLIPBOARD_VISION_MAX_BYTES -ErrorAction SilentlyContinue
-        Remove-Item Env:CV_TEST_MALFORMED_JSON -ErrorAction SilentlyContinue
-        Remove-Item Env:CV_TEST_NON_STRING -ErrorAction SilentlyContinue
-        Remove-Item Env:CV_TEST_HTTP_FAILURE -ErrorAction SilentlyContinue
-        Remove-Item -LiteralPath $Fixture -Recurse -Force -ErrorAction SilentlyContinue
-    }
-
-    It 'rejects invalid endpoints before disclosure or HTTP capture' {
-        foreach ($InvalidBase in @(
-            'relative/path',
-            'ftp://vision.example.test/v1',
-            'file:///tmp/vision',
-            'https://user:secret@vision.example.test/v1'
-        )) {
-            $env:CLIPBOARD_VISION_API_BASE = $InvalidBase
-            $Disclosure = { & $ScriptPath -AllowRemote -ConfirmRemote 'unused' 2>&1 | Out-String }
-            $Disclosure | Should -Throw
-            Test-Path $CapturePath | Should -BeFalse
-            try { & $Disclosure | Out-Null } catch { $_.Exception.Message | Should -Not -Match 'Remote disclosure' }
-        }
-    }
-
-    It 'rejects stale consent after endpoint scheme port or path changes' {
-        foreach ($ChangedBase in @(
-            'http://vision.example.test/v1',
-            'https://vision.example.test:8443/v1',
-            'https://vision.example.test/other'
-        )) {
-            $env:CLIPBOARD_VISION_API_BASE = $ChangedBase
-            { & $ScriptPath -AllowRemote -ConfirmRemote $Token 2>$null } | Should -Throw
-            Test-Path $CapturePath | Should -BeFalse
-        }
-    }
-
-    It 'rejects an unrelated stale confirmation token' {
-        { & $ScriptPath -AllowRemote -ConfirmRemote 'stale-token' 2>$null } | Should -Throw
-        Test-Path $CapturePath | Should -BeFalse
-    }
-
-    It 'returns the successful response and captures one request' {
-        $Result = & $ScriptPath -AllowRemote -ConfirmRemote $Token 2>$null
-
-        $Result | Should -BeExactly 'test description'
-        Test-Path $CapturePath | Should -BeTrue
-        (Get-Content -LiteralPath $CapturePath -Raw) | Should -Match 'windows-fixture-model'
-    }
-
-    It 'rejects malformed and non-string responses' {
-        $env:CV_TEST_MALFORMED_JSON = '1'
-        { & $ScriptPath -AllowRemote -ConfirmRemote $Token 2>$null } | Should -Throw
-        Remove-Item Env:CV_TEST_MALFORMED_JSON
-
-        $env:CV_TEST_NON_STRING = '1'
-        { & $ScriptPath -AllowRemote -ConfirmRemote $Token 2>$null } | Should -Throw '*redacted*'
-    }
-
-    It 'redacts HTTP failures without exposing the secret response body' {
-        $env:CV_TEST_HTTP_FAILURE = '1'
-        $Failure = { & $ScriptPath -AllowRemote -ConfirmRemote $Token 2>&1 }
-
-        $Failure | Should -Throw '*redacted*'
-        try { & $Failure | Out-Null } catch {
-            $_.Exception.Message | Should -Not -Match 'secret'
-        }
-    }
-
-    It 'rejects an oversized image' {
-        $env:CLIPBOARD_VISION_MAX_BYTES = '4'
-
-        { & $ScriptPath -AllowRemote -ConfirmRemote $Token 2>$null } | Should -Throw '*exceeds*'
-    }
-
-    It 'enforces No output parameter support without writing a file' {
-        $OutputPath = Join-Path $Fixture 'result.txt'
-
-        { & $ScriptPath -AllowRemote -ConfirmRemote $Token -Output $OutputPath 2>$null } | Should -Throw
-        Test-Path $OutputPath | Should -BeFalse
-    }
-
-    It 'treats localhost as remote and literal IPv4 and IPv6 loopback as local' {
-        $env:CLIPBOARD_VISION_API_BASE = 'http://localhost:11434/v1'
-        { & $ScriptPath 2>$null } | Should -Throw
-
-        foreach ($LoopbackBase in @('http://127.9.8.7:11434/v1', 'http://[::1]:11434/v1')) {
-            $env:CLIPBOARD_VISION_API_BASE = $LoopbackBase
-            & $ScriptPath 2>$null | Should -BeExactly 'test description'
-        }
-    }
-
-    It 'keeps redirect blocking and executable test seams in the production script' {
-        $Content = Get-Content -LiteralPath $ScriptPath -Raw
-
-        $Content | Should -Match 'MaximumRedirection\s+0'
-        $Content | Should -Match 'SHA256'
-        $Content | Should -Match 'CLIPBOARD_VISION_TEST_IMAGE'
-        $Content | Should -Match 'CLIPBOARD_VISION_TEST_HTTP_CAPTURE'
-        $Content | Should -Not -Match '\$Output|Set-Content.*Result'
-    }
-}

package/plugins/claude-code/skills/clipboard-vision/__tests__/clipboard-vision.test.cjs

@@ -1,273 +0,0 @@
-/**
- * @test REQ-379 privacy-safe clipboard vision
- * @intent Verify one-shot clipboard image analysis enforces local-first privacy boundaries
- * @covers AC-379-01, AC-379-02, AC-379-03, AC-379-04, AC-379-05, AC-379-06
- */
-const fs = require('fs');
-const crypto = require('crypto');
-const os = require('os');
-const path = require('path');
-const { spawnSync } = require('child_process');
-
-const ROOT = path.resolve(__dirname, '..');
-const BASH_SCRIPT = path.join(ROOT, 'scripts', 'clipboard-vision.sh');
-const POWERSHELL_SCRIPT = path.join(ROOT, 'scripts', 'clipboard-vision.ps1');
-const SECRET = 'cv-secret-must-never-leak';
-
-function writeExecutable(file, content) {
-  fs.writeFileSync(file, content, { mode: 0o755 });
-}
-
-function createFixture() {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'clipboard-vision-test-'));
-  const bin = path.join(root, 'bin');
-  const temp = path.join(root, 'temp');
-  fs.mkdirSync(bin);
-  fs.mkdirSync(temp);
-  const image = path.join(root, 'clipboard.png');
-  fs.writeFileSync(image, Buffer.from('89504e470d0a1a0a', 'hex'));
-  const clipboardCount = path.join(root, 'clipboard-count');
-  const curlCount = path.join(root, 'curl-count');
-  const curlArgs = path.join(root, 'curl-args');
-  const curlBody = path.join(root, 'curl-body');
-
-  writeExecutable(path.join(bin, 'pngpaste'), `#!/usr/bin/env bash
-set -euo pipefail
-printf x >> "${clipboardCount}"
-cp "${image}" "$1"
-`);
-  writeExecutable(path.join(bin, 'curl'), `#!/usr/bin/env bash
-set -euo pipefail
-printf x >> "${curlCount}"
-printf '%s\n' "$@" > "${curlArgs}"
-while [ "$#" -gt 0 ]; do
-  if [ "$1" = '--data-binary' ]; then cp "\${2#@}" "${curlBody}"; shift 2; continue; fi
-  if [ "$1" = '--output' ]; then output="$2"; shift 2; continue; fi
-  if [ "$1" = '--write-out' ]; then shift 2; continue; fi
-  shift
-done
-if [ -n "\${CV_FAKE_RESPONSE:-}" ]; then
-  printf '%s' "$CV_FAKE_RESPONSE" > "$output"
-else
-  printf '%s' '{"choices":[{"message":{"content":"described safely"}}]}' > "$output"
-fi
-printf '%s' "\${CV_FAKE_STATUS:-200}"
-`);
-
-  return { root, bin, temp, image, clipboardCount, curlCount, curlArgs, curlBody };
-}
-
-function run(fixture, args = [], env = {}) {
-  return spawnSync('bash', [BASH_SCRIPT, ...args], {
-    encoding: 'utf8',
-    env: {
-      ...process.env,
-      PATH: `${fixture.bin}:${process.env.PATH}`,
-      TMPDIR: fixture.temp,
-      CLIPBOARD_VISION_MODEL: 'fixture-model',
-      CLIPBOARD_VISION_API_KEY: SECRET,
-      ...env,
-    },
-  });
-}
-
-function combined(result) {
-  return `${result.stdout}${result.stderr}`;
-}
-
-function count(file) {
-  return fs.existsSync(file) ? fs.readFileSync(file, 'utf8').length : 0;
-}
-
-function consentToken(hostname, model, base = `https://${hostname}/v1`) {
-  const url = new URL(base);
-  const scheme = url.protocol.slice(0, -1).toLowerCase();
-  const normalizedHost = url.hostname.toLowerCase();
-  const port = url.port || (scheme === 'https' ? '443' : '80');
-  const displayHost = normalizedHost.includes(':') ? `[${normalizedHost}]` : normalizedHost;
-  const endpoint = `${scheme}://${displayHost}:${port}${url.pathname.replace(/\/+$/, '')}/chat/completions`;
-  return crypto.createHash('sha256').update(`${endpoint}\n${model}`, 'utf8').digest('hex');
-}
-
-function assertNoTempFiles(fixture) {
-  expect(fs.readdirSync(fixture.temp)).toEqual([]);
-}
-
-describe('clipboard-vision Bash client', () => {
-  let fixture;
-
-  beforeEach(() => {
-    fixture = createFixture();
-  });
-
-  afterEach(() => {
-    fs.rmSync(fixture.root, { recursive: true, force: true });
-  });
-
-  it('fails without model configuration before reading clipboard or calling network', () => {
-    const result = run(fixture, [], { CLIPBOARD_VISION_MODEL: '' });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('rejects a non-loopback endpoint in local mode before reading clipboard', () => {
-    const result = run(fixture, [], { CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1' });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('requires both remote opt-in and destination-bound confirmation', () => {
-    const endpoint = { CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1' };
-    const optInOnly = run(fixture, ['--allow-remote'], endpoint);
-    const confirmationOnly = run(fixture, ['--confirm-remote', consentToken('vision.example.test', 'fixture-model')], endpoint);
-
-    expect(optInOnly.status).not.toBe(0);
-    expect(confirmationOnly.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('prints disclosure and expected token before rejecting missing confirmation', () => {
-    const result = run(fixture, ['--allow-remote'], {
-      CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1',
-    });
-
-    expect(result.status).not.toBe(0);
-    expect(result.stderr).toContain('vision.example.test');
-    expect(result.stderr).toContain('fixture-model');
-    expect(result.stderr.toLowerCase()).toContain('image');
-    expect(result.stderr).toContain(consentToken('vision.example.test', 'fixture-model'));
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('accepts the confirmation token bound to normalized hostname and exact model', () => {
-    const token = consentToken('vision.example.test', 'fixture-model');
-    const result = run(fixture, ['--allow-remote', '--confirm-remote', token], {
-      CLIPBOARD_VISION_API_BASE: 'https://VISION.Example.Test/v1',
-    });
-
-    expect(result.status, combined(result)).toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(1);
-    expect(count(fixture.curlCount)).toBe(1);
-  });
-
-  it('rejects a token for a changed destination before clipboard or network', () => {
-    const staleToken = consentToken('old.example.test', 'fixture-model');
-    const result = run(fixture, ['--allow-remote', '--confirm-remote', staleToken], {
-      CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1',
-    });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('rejects a token for a changed model before clipboard or network', () => {
-    const staleToken = consentToken('vision.example.test', 'old-model');
-    const result = run(fixture, ['--allow-remote', '--confirm-remote', staleToken], {
-      CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1',
-    });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('never exposes the API key in output or request JSON', () => {
-    const result = run(fixture);
-
-    expect(result.status, combined(result)).toBe(0);
-    expect(combined(result)).not.toContain(SECRET);
-    expect(fs.readFileSync(fixture.curlBody, 'utf8')).not.toContain(SECRET);
-  });
-
-  it('rejects oversized clipboard images before network access', () => {
-    fs.writeFileSync(fixture.image, Buffer.alloc(33));
-    const result = run(fixture, [], { CLIPBOARD_VISION_MAX_BYTES: '32' });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-    assertNoTempFiles(fixture);
-  });
-
-  it('removes temporary files after success', () => {
-    const result = run(fixture);
-
-    expect(result.status, combined(result)).toBe(0);
-    expect(result.stdout.trim()).toBe('described safely');
-    assertNoTempFiles(fixture);
-  });
-
-  it('redacts API failure bodies and removes temporary files after failure', () => {
-    const response = `upstream body contains ${SECRET}`;
-    const result = run(fixture, [], { CV_FAKE_STATUS: '500', CV_FAKE_RESPONSE: response });
-
-    expect(result.status).not.toBe(0);
-    expect(combined(result)).not.toContain(response);
-    expect(combined(result)).not.toContain(SECRET);
-    assertNoTempFiles(fixture);
-  });
-
-  it('performs exactly one clipboard read and one request per explicit invocation', () => {
-    const result = run(fixture);
-
-    expect(result.status, combined(result)).toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(1);
-    expect(count(fixture.curlCount)).toBe(1);
-  });
-});
-
-describe('clipboard-vision PowerShell contract', () => {
-  it('keeps credentials in the environment and enforces bound consent, bounds, and cleanup', () => {
-    const content = fs.readFileSync(POWERSHELL_SCRIPT, 'utf8');
-
-    expect(content).toMatch(/\$env:CLIPBOARD_VISION_API_KEY/);
-    expect(content).toMatch(/AllowRemote/);
-    expect(content).toMatch(/ConfirmRemote/);
-    expect(content).toMatch(/SHA256/i);
-    expect(content).toMatch(/CLIPBOARD_VISION_MAX_BYTES/);
-    expect(content).toMatch(/finally\s*\{/i);
-    expect(content).toMatch(/Remove-Item/);
-    expect(content).not.toMatch(/https:\/\/(?!127\.0\.0\.1|localhost|\[::1\])/);
-  });
-
-  it('disables HTTP redirects so loopback cannot forward the clipboard body remotely', () => {
-    const content = fs.readFileSync(POWERSHELL_SCRIPT, 'utf8');
-
-    expect(content).toMatch(/MaximumRedirection\s+0/);
-  });
-
-  it('validates an absolute HTTP(S) URI without credentials before disclosure or seams', () => {
-    const content = fs.readFileSync(POWERSHELL_SCRIPT, 'utf8');
-    const validationPosition = content.indexOf('IsAbsoluteUri');
-    const disclosurePosition = content.indexOf('Remote disclosure');
-    const clipboardPosition = content.indexOf('CLIPBOARD_VISION_TEST_IMAGE');
-
-    expect(validationPosition).toBeGreaterThan(0);
-    expect(content).toMatch(/Scheme[^\n]+https?/i);
-    expect(content).toMatch(/UserInfo/);
-    expect(validationPosition).toBeLessThan(disclosurePosition);
-    expect(validationPosition).toBeLessThan(clipboardPosition);
-  });
-
-  it('ships a discoverable Windows-CI executable behavior harness', () => {
-    expect(fs.existsSync(path.join(ROOT, '__tests__', 'clipboard-vision.Tests.ps1'))).toBe(true);
-  });
-
-  it('wires the discoverable PowerShell harness into windows-latest CI', () => {
-    let repoRoot = ROOT;
-    while (!fs.existsSync(path.join(repoRoot, '.github', 'workflows', 'cross-platform-ci.yml'))) {
-      repoRoot = path.dirname(repoRoot);
-    }
-    const workflow = fs.readFileSync(path.join(repoRoot, '.github', 'workflows', 'cross-platform-ci.yml'), 'utf8');
-
-    expect(workflow).toContain('windows-latest');
-    expect(workflow).toContain('clipboard-vision.Tests.ps1');
-    expect(workflow).toMatch(/shell:\s*pwsh/);
-  });
-});

package/plugins/claude-code/skills/clipboard-vision/describe-clipboard.ps1

@@ -1,115 +0,0 @@
-# describe-clipboard.ps1
-# Reads image from clipboard, sends to vision model API, writes description to stdout.
-# API key is read from CLIPBOARD_VISION_API_KEY environment variable.
-# WARNING: Do not enable -Verbose or Set-PSDebug -Trace 2 — the API key would be logged.
-param(
-    [string]$OutputFile = "$env:TEMP\clipboard_desc.txt"
-)
-
-$ErrorActionPreference = "Stop"
-
-# Platform guard
-if (-not $IsWindows) {
-    Write-Host "ERROR: This script requires Windows (uses .NET System.Windows.Forms)"
-    exit 1
-}
-
-$apiKey = $env:CLIPBOARD_VISION_API_KEY
-if (-not $apiKey) {
-    Write-Host "ERROR: CLIPBOARD_VISION_API_KEY environment variable not set"
-    exit 1
-}
-
-$tempPng = $null
-$img = $null
-
-try {
-    # --- Read clipboard image ---
-    Add-Type -AssemblyName System.Windows.Forms -ErrorAction Stop
-    Add-Type -AssemblyName System.Drawing -ErrorAction Stop
-
-    $img = [System.Windows.Forms.Clipboard]::GetImage()
-    if (-not $img) {
-        Write-Host "ERROR: No image found in clipboard"
-        exit 1
-    }
-
-    # Save to temp PNG
-    $tempPng = Join-Path $env:TEMP "clipboard_$(Get-Date -Format 'yyyyMMdd_HHmmss').png"
-    $img.Save($tempPng, [System.Drawing.Imaging.ImageFormat]::Png)
-
-    # Convert to base64
-    $bytes = [System.IO.File]::ReadAllBytes($tempPng)
-    $base64 = [System.Convert]::ToBase64String($bytes)
-
-    # --- Build API request ---
-    $apiBase = "https://lab.iwhalecloud.com/gpt-proxy"
-    $model = "LOCAL/Qwen3.5-122B-A10B"
-
-    $body = @{
-        model = $model
-        messages = @(
-            @{
-                role = "user"
-                content = @(
-                    @{
-                        type = "text"
-                        text = "Describe this image in detail. Include all visible text, UI elements, code, error messages, objects, people, and any information conveyed. Be specific and thorough but concise. If it contains code or terminal output, quote it exactly."
-                    },
-                    @{
-                        type = "image_url"
-                        image_url = @{
-                            url = "data:image/png;base64,$base64"
-                        }
-                    }
-                )
-            }
-        )
-        max_tokens = 1024
-        temperature = 0.1
-    } | ConvertTo-Json -Depth 5
-
-    # --- Call API ---
-    $response = Invoke-RestMethod -Uri "$apiBase/chat/completions" `
-        -Method Post `
-        -Headers @{
-            "Authorization" = "Bearer $apiKey"
-            "Content-Type"  = "application/json"
-        } `
-        -Body ([System.Text.Encoding]::UTF8.GetBytes($body)) `
-        -TimeoutSec 30
-
-    # Validate response structure
-    if (-not $response.choices -or -not $response.choices[0].message -or -not $response.choices[0].message.content) {
-        Write-Host "ERROR: Unexpected API response structure"
-        Write-Host "Response: $($response | ConvertTo-Json -Compress -Depth 2)"
-        exit 1
-    }
-
-    $description = $response.choices[0].message.content
-} catch {
-    Write-Host "ERROR: $_"
-    exit 1
-} finally {
-    # Cleanup temp file and GDI+ handle
-    if ($tempPng -and (Test-Path $tempPng)) {
-        Remove-Item $tempPng -Force -ErrorAction SilentlyContinue
-    }
-    if ($img) {
-        $img.Dispose()
-    }
-}
-
-if (-not $description) {
-    Write-Host "ERROR: Empty response from vision model"
-    exit 1
-}
-
-# Write to output file
-$description | Out-File -FilePath $OutputFile -Encoding UTF8 -Force
-
-# Output to stdout
-Write-Host "Clipboard image description saved to: $OutputFile"
-Write-Host "---"
-Write-Host $description
-Write-Host "---"

package/plugins/claude-code/skills/clipboard-vision/describe-clipboard.sh

@@ -1,161 +0,0 @@
-#!/usr/bin/env bash
-# describe-clipboard.sh
-# Cross-platform: reads clipboard image, calls vision API, writes description.
-# Works on: WSL/Linux (xclip), macOS (osascript), Windows Git Bash (PowerShell)
-#
-# Requires CLIPBOARD_VISION_API_KEY environment variable.
-# WARNING: Do not run with `set -x` — the API key would be logged.
-set -euo pipefail
-
-OUTPUT_FILE="${1:-/tmp/clipboard_desc.txt}"
-API_KEY="${CLIPBOARD_VISION_API_KEY:-}"
-API_BASE="${CLIPBOARD_VISION_API_BASE:-https://lab.iwhalecloud.com/gpt-proxy}"
-MODEL="LOCAL/Qwen3.5-122B-A10B"
-TEMP_PNG=""
-
-if [ -z "$API_KEY" ]; then
-    echo "ERROR: CLIPBOARD_VISION_API_KEY environment variable not set" >&2
-    exit 1
-fi
-
-cleanup() {
-    if [ -n "$TEMP_PNG" ] && [ -f "$TEMP_PNG" ]; then
-        rm -f "$TEMP_PNG"
-    fi
-}
-trap cleanup EXIT
-
-# --- Detect platform and read clipboard ---
-get_base64_from_clipboard() {
-    local platform b64_cmd
-    platform="$(uname -s)"
-
-    if [ "$platform" = "Linux" ]; then
-        b64_cmd="base64 -w 0"
-        # WSL / Linux: use xclip or wl-paste
-        if command -v xclip &>/dev/null; then
-            TARGETS="$(xclip -selection clipboard -o -t TARGETS 2>/dev/null || echo "")"
-            if echo "$TARGETS" | grep -qx "image/png"; then
-                TEMP_PNG="$(mktemp /tmp/clipboard_XXXXXX.png)"
-                xclip -selection clipboard -o -t image/png > "$TEMP_PNG"
-                $b64_cmd "$TEMP_PNG"
-            else
-                echo "ERROR: No PNG image in clipboard (xclip targets: ${TARGETS:-none})" >&2
-                exit 1
-            fi
-        elif command -v wl-paste &>/dev/null; then
-            TEMP_PNG="$(mktemp /tmp/clipboard_XXXXXX.png)"
-            wl-paste -t image/png > "$TEMP_PNG"
-            $b64_cmd "$TEMP_PNG"
-        else
-            echo "ERROR: No clipboard tool found (install xclip or wl-clipboard)" >&2
-            exit 1
-        fi
-    elif [ "$platform" = "MINGW64_NT" ] || [ "$platform" = "MSYS_NT" ] || [ "${OS:-}" = "Windows_NT" ]; then
-        b64_cmd="base64 -w 0"
-        # Windows Git Bash: delegate to PowerShell
-        PS_EXE="/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe"
-        if [ ! -f "$PS_EXE" ]; then
-            PS_EXE="powershell.exe"
-        fi
-        TEMP_PNG="$(mktemp --suffix=.png)"
-        WIN_TEMP="$(cygpath -w "$TEMP_PNG" 2>/dev/null || echo "$TEMP_PNG")"
-        "$PS_EXE" -NoProfile -NonInteractive -Command "
-            Add-Type -AssemblyName System.Windows.Forms;
-            Add-Type -AssemblyName System.Drawing;
-            \$img = [System.Windows.Forms.Clipboard]::GetImage();
-            if (-not \$img) { Write-Host 'NO_IMAGE'; exit 1 };
-            \$img.Save('$WIN_TEMP', [System.Drawing.Imaging.ImageFormat]::Png);
-            Write-Host 'OK';
-        " > /dev/null
-        if [ ! -f "$TEMP_PNG" ] || [ ! -s "$TEMP_PNG" ]; then
-            echo "ERROR: No image found in clipboard" >&2
-            exit 1
-        fi
-        $b64_cmd "$TEMP_PNG"
-    else
-        # macOS
-        b64_cmd="base64 -b 0"
-        if command -v osascript &>/dev/null; then
-            TEMP_PNG="$(mktemp /tmp/clipboard_XXXXXX.png)"
-            if ! osascript -e "set theFile to (open for access POSIX file \"$TEMP_PNG\" with write permission)" \
-                            -e "write (the clipboard as «class PNGf») to theFile" \
-                            -e "close access theFile" 2>/dev/null; then
-                echo "ERROR: Failed to read image from macOS clipboard" >&2
-                exit 1
-            fi
-            if [ ! -s "$TEMP_PNG" ]; then
-                echo "ERROR: No image in clipboard" >&2
-                exit 1
-            fi
-            $b64_cmd "$TEMP_PNG"
-        else
-            echo "ERROR: Unsupported platform ($platform)" >&2
-            exit 1
-        fi
-    fi
-}
-
-# --- Build and send API request via python3 (safe JSON construction) ---
-call_vision_api() {
-    local b64="$1"
-    python3 -c "
-import json, sys, os, urllib.request
-
-api_key = os.environ['CLIPBOARD_VISION_API_KEY']
-api_base = os.environ.get('CLIPBOARD_VISION_API_BASE', 'https://lab.iwhalecloud.com/gpt-proxy')
-model = 'LOCAL/Qwen3.5-122B-A10B'
-
-body = json.dumps({
-    'model': model,
-    'messages': [{
-        'role': 'user',
-        'content': [
-            {'type': 'text', 'text': 'Describe this image in detail. Include all visible text, UI elements, code, error messages, objects, people, and any information conveyed. Be specific and thorough but concise. If it contains code or terminal output, quote it exactly.'},
-            {'type': 'image_url', 'image_url': {'url': f'data:image/png;base64,{sys.argv[1]}'}}
-        ]
-    }],
-    'max_tokens': 1024,
-    'temperature': 0.1
-}).encode('utf-8')
-
-req = urllib.request.Request(
-    f'{api_base}/chat/completions',
-    data=body,
-    headers={
-        'Authorization': f'Bearer {api_key}',
-        'Content-Type': 'application/json'
-    }
-)
-
-try:
-    with urllib.request.urlopen(req, timeout=30) as resp:
-        data = json.loads(resp.read().decode('utf-8'))
-    if not data.get('choices') or not data['choices'][0].get('message'):
-        print('ERROR: Unexpected API response structure', file=sys.stderr)
-        sys.exit(1)
-    content = data['choices'][0]['message'].get('content', '')
-    if not content:
-        print('ERROR: Empty response from vision model', file=sys.stderr)
-        sys.exit(1)
-    print(content)
-except Exception as e:
-    print(f'ERROR: API call failed: {e}', file=sys.stderr)
-    sys.exit(1)
-" "$b64"
-}
-
-# --- Main ---
-echo "[clipboard-vision] Reading clipboard..." >&2
-B64="$(get_base64_from_clipboard)"
-
-echo "[clipboard-vision] Calling vision model ($MODEL)..." >&2
-
-DESCRIPTION="$(call_vision_api "$B64")"
-
-echo "$DESCRIPTION" > "$OUTPUT_FILE"
-echo "[clipboard-vision] Description saved to: $OUTPUT_FILE" >&2
-
-echo "---"
-echo "$DESCRIPTION"
-echo "---"