@davait/aipictury 1.9.2

package/LICENSE.md

@@ -0,0 +1,77 @@
+# AIPictury — License
+
+Copyright © 2026 Davait, Inc. All rights reserved.
+
+AIPictury — the GPU server, the web app at aipictury.com, the AIPictury extension for Visual
+Studio Code and the `aipictury` command-line tool, with their source code, documentation, designs
+and assets (together, the "Software") — is the property of Davait, Inc. ("Davait") and is
+protected by copyright and other intellectual-property laws.
+
+## 1. What you may do
+
+Subject to this License and to any other terms Davait agrees with you in writing, Davait grants
+you a personal, non-exclusive, non-transferable, revocable license to install and use the
+Software, in the form Davait distributes it, to use the AIPictury service with your own AIPictury
+account and your own GPU server.
+
+## 2. What you may not do
+
+Unless Davait allows it in writing, you may not:
+
+- copy, modify, translate or create derivative works of the Software, except as needed to use it
+  under section 1;
+- distribute, sublicense, sell, rent, lease, lend, host for others or otherwise make the Software
+  available to third parties;
+- reverse-engineer, decompile or disassemble the Software, except where applicable law expressly
+  allows it despite this restriction;
+- remove, alter or obscure any copyright, trademark or other notice in the Software;
+- use the Software to build a competing product or service, or in breach of any law or of the
+  AIPictury acceptable-use policy.
+
+## 3. Ownership
+
+The Software is licensed, not sold. Davait and its licensors keep all right, title and interest
+in it, including every copy and every improvement. "AIPictury" and "Davait" are names and marks of
+Davait, Inc. No right to them is granted beyond naming the Software truthfully.
+
+## 4. Third-party components
+
+The Software works with components owned by others — among them the models it runs (for example
+LTX-Video, FLUX, Qwen, Gemma and Whisper), ffmpeg, ComfyUI, Ollama, llama.cpp, Firebase and the
+open-source libraries listed in its package manifests (`package.json`, `requirements.txt`). Each
+is licensed to you by its owner under its own terms, which this License does not change. Your use
+of those components, and of what they produce, is subject to their licenses.
+
+## 5. Your content
+
+What you create or upload with the Software — prompts, conversations, pictures, clips and files —
+is yours. Davait keeps it only as needed to provide the service to your account, as described in
+its privacy policy.
+
+## 6. No warranty
+
+THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND
+NON-INFRINGEMENT. Content produced by models can be wrong, offensive or similar to existing works;
+you are responsible for checking it and for how you use it.
+
+## 7. Limitation of liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY LAW, DAVAIT AND ITS LICENSORS ARE NOT LIABLE FOR ANY INDIRECT,
+INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF DATA, PROFITS, REVENUE
+OR GOODWILL, ARISING OUT OF OR RELATED TO THE SOFTWARE, EVEN IF ADVISED OF THEIR POSSIBILITY.
+THEIR TOTAL LIABILITY IS LIMITED TO THE AMOUNT YOU PAID DAVAIT FOR THE SOFTWARE IN THE TWELVE
+MONTHS BEFORE THE CLAIM.
+
+## 8. Termination
+
+This License ends automatically if you breach it. Davait may end it on notice. When it ends you
+must stop using the Software and delete your copies. Sections 2 to 7 and 9 survive it.
+
+## 9. General
+
+This License is the whole agreement between you and Davait about the Software, unless another
+written agreement with Davait says otherwise. If a provision is unenforceable, the rest stays in
+force. Davait may update this License; the version shipped with each release applies to it.
+
+Questions about this License: Davait, Inc.

package/README.md

@@ -0,0 +1,39 @@
+# @davait/aipictury
+
+The AIPictury agent in a terminal: the same agent as the AIPictury extension for VS Code — its
+tools, approvals, Plan mode, MCP servers, skills and conversations — on your own GPU server,
+signed in to your AIPictury account.
+
+```
+npm install -g @davait/aipictury
+aipictury login            # your AIPictury account, in the browser
+aipictury                  # a conversation in this folder
+aipictury -p "question"    # one answer, printed (pipes and scripts)
+aipictury --help           # everything else
+```
+
+Your GPU server is the one chosen with your account at https://aipictury.com (or `--server`).
+
+## In a conversation
+
+- `/` for commands — `/help` lists them, Tab completes: `/compact`, `/btw`, `/resume`,
+  `/rename`, `/export`, `/todos`, `/model`, `/effort`, `/mode`, `/permissions`, `/mcp`,
+  `/status`, `/usage`, `/init`, `/review`, and the project's own commands and skills.
+- `@path` mentions a file (Tab completes it); it is read and sent with the message.
+- `!command` runs it in the folder; its output goes with your next message.
+- A line ending in `\` continues on the next; a paste of many lines is one message.
+- Esc or Ctrl+C stops a run; Ctrl+C twice at the prompt quits. Up and down bring back what you
+  typed, across runs.
+
+## Scripts
+
+```
+aipictury -p "why does it fail?" < log.txt
+aipictury -p "…" --output-format json            # or stream-json
+aipictury -p "…" --allowedTools "Bash(npm test:*),Edit" --disallowedTools "WebFetch"
+aipictury -p "…" --mcp-config servers.json --add-dir ../shared --append-system-prompt "Be brief."
+```
+
+## License
+
+Copyright © 2026 Davait, Inc. All rights reserved. Proprietary software: see LICENSE.md.

package/ext/about.js

@@ -0,0 +1,209 @@
+'use strict'
+// About AIPictury agent: the agent's own version, and the server it is connected to as that
+// server describes itself — every model it holds (type, parameters), what makes pictures
+// and video, and its GPUs. Drawn from the connected server, so it changes when the server
+// does: switching servers redraws it on its own.
+
+const vscode = require('vscode')
+
+let panel = null
+let lastServer = ''
+
+const esc = (s) => String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]))
+const gb = (mb) => (mb == null ? '—' : `${(mb / 1024).toFixed(1)} GB`)
+
+/** A model as one line: name (type, parameters). */
+function modelLine(m) {
+  const kinds = (m.kinds || []).filter((k) => k !== 'text')
+  const type = ['text', ...kinds].join(' · ')
+  const params = [m.parameters, m.quantization].filter(Boolean).join(', ')
+  return `${m.name} (${type}${params ? `, ${params}` : ''})`
+}
+
+function render({ server, version, about, error, config, account = {}, access = {} }) {
+  const s = about?.server || {}
+  const models = about?.models || []
+  const roles = about?.roles || {}
+  const gpus = about?.gpus || []
+  const generation = about?.generation || []
+  const roleName = { agent: 'coding agent', edit: 'quick edits', commit: 'commit messages', vision: 'images' }
+  const modelRows = models.map((m) => `
+      <li class="model${m.roles?.length ? ' used' : ''}">
+        <div class="line">${esc(modelLine(m))}</div>
+        <div class="sub">${[m.engine && `<b>${esc(m.engine)}</b>`, m.family && `family ${esc(m.family)}`, m.size_gb && `${m.size_gb} GB on disk`,
+          m.context && `context ${Number(m.context).toLocaleString()} tokens`,
+          m.roles?.length && `<b>${m.roles.map((r) => esc(roleName[r] || r)).join(', ')}</b>`,
+          m.same_as?.length && `also named ${esc(m.same_as.join(', '))}`].filter(Boolean).join(' · ')}</div>
+      </li>`).join('')
+  const genRows = generation.map((g) => `
+      <li class="model${g.available ? '' : ' off'}"><div class="line">${esc(g.label)} (${esc(g.kind)}${g.params ? `, ${esc(g.params)}` : ''})</div>
+      <div class="sub">${g.available ? 'available' : 'not installed on this server'}</div></li>`).join('')
+  const gpuRows = gpus.map((g) => {
+    const pct = g.vram_total_mb ? Math.round((100 * (g.vram_used_mb || 0)) / g.vram_total_mb) : 0
+    const facts = [
+      `VRAM ${gb(g.vram_used_mb)} of ${gb(g.vram_total_mb)} used`,
+      g.utilization != null && `${g.utilization}% busy`,
+      g.temperature != null && `${g.temperature} °C`,
+      g.power_draw != null && `${Math.round(g.power_draw)} W of ${Math.round(g.power_limit)} W`,
+      g.driver && `driver ${esc(g.driver)}`, g.pcie && `PCIe ${esc(g.pcie)}`,
+    ].filter(Boolean).join(' · ')
+    return `<li class="gpu"><div class="line">GPU ${esc(g.index)} — ${esc(g.name)}</div>
+      <div class="bar"><span style="width:${pct}%"></span></div><div class="sub">${facts}</div></li>`
+  }).join('')
+  const online = !!about && !error
+  return `<!doctype html><html><head><meta charset="utf-8">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline';">
+<style>
+body { font-family: var(--vscode-font-family); font-size: var(--vscode-font-size); color: var(--vscode-foreground);
+  background: var(--vscode-editor-background); padding: 18px 22px; max-width: 900px; line-height: 1.5; }
+h1 { font-size: 1.4em; margin: 0 0 2px; } h2 { font-size: 1.05em; margin: 22px 0 6px; }
+.muted, .sub { color: var(--vscode-descriptionForeground); } .sub { font-size: 0.92em; }
+.dot { display: inline-block; width: 8px; height: 8px; border-radius: 50%; margin-right: 6px; background: var(--vscode-charts-red); }
+.dot.on { background: var(--vscode-charts-green); }
+details { border: 1px solid var(--vscode-panel-border); border-radius: 6px; padding: 4px 10px; margin: 6px 0; }
+summary { cursor: pointer; padding: 4px 0; font-weight: 600; }
+ul { list-style: none; margin: 4px 0; padding: 0; }
+li { padding: 5px 0; border-top: 1px solid var(--vscode-panel-border); } li:first-child { border-top: 0; }
+.line { font-family: var(--vscode-editor-font-family); } li.used .line { font-weight: 600; } li.off { opacity: 0.55; }
+.bar { height: 6px; border-radius: 3px; background: var(--vscode-panel-border); margin: 4px 0; overflow: hidden; }
+.bar span { display: block; height: 100%; background: var(--vscode-progressBar-background, #0e70c0); }
+table { border-collapse: collapse; } td { padding: 2px 14px 2px 0; vertical-align: top; }
+.actions { margin-top: 18px; display: flex; gap: 8px; flex-wrap: wrap; }
+button { background: var(--vscode-button-secondaryBackground); color: var(--vscode-button-secondaryForeground); border: 0;
+  border-radius: 4px; padding: 5px 12px; cursor: pointer; } button.primary { background: var(--vscode-button-background); color: var(--vscode-button-foreground); }
+.err { color: var(--vscode-errorForeground); }
+</style></head><body>
+<h1>About AIPictury agent</h1>
+<div class="muted">A coding agent on your own GPU.</div>
+<div class="muted" id="copyright">Copyright © 2026 Davait, Inc. All rights reserved.</div>
+<h2>The agent</h2>
+<table>
+<tr><td>Version</td><td><b id="agent-version">${esc(version)}</b></td></tr>
+<tr><td>VS Code</td><td>${esc(vscode.version)}</td></tr>
+<tr><td>Mode · effort</td><td>${esc(config.mode)} · ${esc(config.effort)}</td></tr>
+<tr><td>Model for this editor</td><td>${esc(config.model || roles.agent || '—')}${config.model ? '' : ' (the server\'s agent role)'}</td></tr>
+</table>
+<h2>Your account</h2>
+<table id="account">
+${account.user ? `<tr><td>Signed in as</td><td><b>${esc(account.user.email || account.user.displayName)}</b></td></tr>
+<tr><td>Kept with it</td><td>${esc(account.keeps || '—')}</td></tr>`
+    : '<tr><td></td><td class="err">Not signed in — the agent needs your AIPictury account</td></tr>'}
+</table>
+<h2>GPU server</h2>
+<table>
+<tr><td>Address</td><td><span class="dot${online ? ' on' : ''}"></span><span id="server">${esc(server || 'none set')}</span></td></tr>
+<tr><td>From</td><td id="server-source">${esc(access.source || '—')}</td></tr>
+${access.auth ? `<tr><td>Who may use it</td><td id="server-auth">${esc(access.auth)}</td></tr>` : ''}
+${access.yours ? `<tr><td>Your account</td><td id="server-yours"${access.refused ? ' class="err"' : ''}>${esc(access.yours)}</td></tr>` : ''}
+${online && s.version && s.version !== version ? `<tr><td></td><td class="err" id="version-skew">The server runs ${esc(s.version)} and this agent ${esc(version)}: update the older one</td></tr>` : ''}
+${online ? `<tr><td>AIPictury</td><td id="server-version">${esc(s.version)}</td></tr>
+<tr><td>Host</td><td>${esc(s.host)}</td></tr>
+<tr><td>Context window</td><td>${Number(s.context_window || 0).toLocaleString()} tokens</td></tr>
+<tr><td>Web app's chat model</td><td>${esc(s.chat_model)}</td></tr>` : `<tr><td></td><td class="err" id="error">${esc(error || 'not answering')}</td></tr>`}
+</table>
+${online ? `
+<h2>Models</h2>
+<details id="models" open><summary>Language models on this server (${models.length})</summary><ul>${modelRows || '<li class="sub">none installed</li>'}</ul></details>
+<details id="generation" open><summary>Pictures and video (${generation.length})</summary><ul>${genRows || '<li class="sub">none</li>'}</ul></details>
+<h2>GPUs</h2>
+<ul id="gpus">${gpuRows || '<li class="sub">no GPU reported</li>'}</ul>` : ''}
+<div class="actions">
+<button class="primary" data-cmd="refresh">Refresh</button>
+${account.user ? '<button data-cmd="aipictury.account">Account</button>' : '<button class="primary" data-cmd="aipictury.signIn">Sign in</button>'}
+<button data-cmd="aipictury.setServer">Change server</button>
+<button data-cmd="aipictury.openSettings">Choose models</button>
+<button data-cmd="aipictury.openStudio">Open aipictury.com</button>
+</div>
+<h2>How to use it</h2>
+<div class="sub">@ mentions a file (@src/app.ts#10-20, @folder/, @terminal:name) · / lists the commands (/plan, /rewind,
+/btw, /compact, /export, /status…) · # remembers a rule for this project, ## for you everywhere · ↑ ↓ earlier prompts ·
+Shift+Tab the mode · Esc stops. Keys: ⌘Esc / Ctrl+Esc to the agent and back · ⌘⇧Esc a new tab · ⌥K mention the
+selection · Ctrl+O every reasoning fold. AIPICTURY.md, AGENTS.md or CLAUDE.md is read into every conversation; MCP
+servers come from .mcp.json.</div>
+<script>
+const vscode = acquireVsCodeApi()
+document.querySelectorAll('button[data-cmd]').forEach((b) => b.addEventListener('click', () => vscode.postMessage({ cmd: b.dataset.cmd })))
+</script>
+</body></html>`
+}
+
+/** Whether the server takes this account: what it asks for (health) and its answer to /api/me. */
+async function fetchAccess(server) {
+  const access = {}
+  if (!server) return access
+  try {
+    const health = await (await fetch(`${server}/api/health`, { signal: AbortSignal.timeout(10_000) })).json()
+    access.auth = { required: health.owned ? 'its owner\'s AIPictury accounts only' : 'AIPictury accounts — but it has no owner set, so it refuses everyone',
+      optional: 'anyone; signed-in calls are kept per account', off: 'anyone (no accounts)' }[health.auth] || health.auth
+    if (health.auth && health.auth !== 'off') {
+      const me = await fetch(`${server}/api/me`, { signal: AbortSignal.timeout(10_000) })
+      if (me.ok) access.yours = (await me.json()).account ? 'accepted' : 'not signed in here (anonymous)'
+      else if (me.status === 401) { access.refused = true; access.yours = `refused: ${(await me.json().catch(() => ({}))).detail || 'no reason given'}` }
+      else if (me.status === 404) access.yours = 'not asked (the server predates 1.9.0 — update it)'
+    }
+  } catch { /* the address does not answer: said by the About call */ }
+  return access
+}
+
+/** The server's own account of itself, or why it could not be had. */
+async function fetchAbout(server) {
+  if (!server) return { error: 'no GPU server is set: choose it at aipictury.com (it is kept with your account), or "Change server" for this machine' }
+  try {
+    const response = await fetch(`${server}/api/about`, { signal: AbortSignal.timeout(30_000) })
+    if (!response.ok) {
+      const detail = response.status === 401 ? (await response.json().catch(() => ({}))).detail : ''
+      throw new Error(`the server answered ${response.status}${detail ? `: ${detail}` : ''}${response.status === 404 ? ' (it predates 1.6.0 — update it)' : ''}`)
+    }
+    return { about: await response.json() }
+  } catch (error) {
+    return { error: error.cause?.code ? `not reachable (${error.cause.code})` : error.message }
+  }
+}
+
+async function refresh(context, state) {
+  if (!panel) return
+  const server = require('./gpuServer').url()
+  lastServer = server
+  const version = require('./package.json').version
+  const cfg = vscode.workspace.getConfiguration('aipictury')
+  const MODES = { ask: 'Manual', edits: 'Edit Automatically', plan: 'Plan', never: 'Auto' }
+  const config = { mode: MODES[cfg.get('approval', 'ask')] || cfg.get('approval', 'ask'), effort: cfg.get('effort', 'high'), model: state?.model?.() || null }
+  const gpu = require('./gpuServer')
+  const ctl = state?.account?.()
+  const kinds = ['conversations', 'memory', 'settings', 'usage'].filter((k) => ctl?.keeps?.(k))
+  const account = { user: ctl?.user?.() || null, keeps: [...kinds, 'renders'].join(', ') }
+  const source = gpu.source() === 'setting' ? 'this machine (the aipictury.server setting)'
+    : gpu.source() === 'account' ? `your account (chosen at aipictury.com) — its ${gpu.route() === 'lan' ? 'LAN' : 'WAN'} address` : 'nowhere yet'
+  panel.webview.html = render({ server, version, about: null, error: 'asking the server…', config, account, access: { source } })
+  const [got, access] = await Promise.all([fetchAbout(server), fetchAccess(server)])
+  if (!panel || server !== lastServer) return                // the server changed meanwhile
+  panel.webview.html = render({ server, version, ...got, config, account, access: { source, ...access } })
+}
+
+let opened = null
+/** Draws it again when it is open (the account or the GPU server changed). */
+function refreshOpen() { if (panel && opened) refresh(opened.context, opened.state) }
+
+/** Opens (or brings forward) the About view. `state.model()` says the model chosen here,
+ *  `state.account()` the account controller (accountUi). */
+function showAbout(context, state = {}) {
+  opened = { context, state }
+  if (panel) { panel.reveal(); refresh(context, state); return panel }
+  panel = vscode.window.createWebviewPanel('aipictury.about', 'About AIPictury agent', vscode.ViewColumn.Active,
+    { enableScripts: true })
+  panel.iconPath = vscode.Uri.joinPath(context.extensionUri, 'media', 'icon.svg')
+  panel.webview.onDidReceiveMessage((m) => {
+    if (m.cmd === 'refresh') refresh(context, state)
+    else if (String(m.cmd).startsWith('aipictury.')) vscode.commands.executeCommand(m.cmd)
+  })
+  // A different server is a different machine: its models and GPUs are read again.
+  const sub = vscode.workspace.onDidChangeConfiguration((e) => {
+    if (e.affectsConfiguration('aipictury.server') || e.affectsConfiguration('aipictury.approval')
+        || e.affectsConfiguration('aipictury.effort')) refresh(context, state)
+  })
+  panel.onDidDispose(() => { sub.dispose(); panel = null })
+  refresh(context, state)
+  return panel
+}
+
+module.exports = { showAbout, refreshOpen, render, modelLine, fetchAbout, fetchAccess, current: () => panel }

package/ext/account.js

@@ -0,0 +1,242 @@
+'use strict'
+// The AIPictury account for the editor and the CLI (Firebase Authentication). Signing in happens
+// in the browser, as the gcloud and firebase CLIs do it: a page served here at
+// http://localhost:<random port> (localhost is an authorized domain) signs in with Firebase's own
+// SDK — email and password, or Google — and hands the session back to this server once, with a
+// one-time key only this page was given. What is kept is the refresh token, in the caller's
+// storage (VS Code's secret storage; the CLI's credentials file); ID tokens are minted from it
+// when needed. AIPICTURY_FIREBASE_EMULATOR="auth host:port,firestore host:port" (tests) points
+// everything at the local emulators. No VS Code here.
+const http = require('http')
+const crypto = require('crypto')
+const fs = require('fs')
+const path = require('path')
+
+const SIGNIN_TIMEOUT = 10 * 60_000
+
+function emulatorHosts(env = process.env) {
+  const [auth, firestore, storage] = String(env.AIPICTURY_FIREBASE_EMULATOR || '').split(',').map((s) => s.trim()).filter(Boolean)
+  return { auth: auth || null, firestore: firestore || null, storage: storage || null }
+}
+
+const esc = (s) => String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]))
+
+function page({ config, emulator, nonce, client, script }) {
+  const boot = JSON.stringify({ config, emulator, nonce, client }).replace(/</g, '\\u003c')
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Sign in to AIPictury</title>
+<style>
+:root{color-scheme:light dark;--bg:#0a0a0c;--panel:#131316;--line:#26262b;--text:#e9e9ec;--muted:#8b8b95;--accent:#7c5cff;--err:#fca5a5;--ok:#34d399}
+@media (prefers-color-scheme:light){:root{--bg:#f6f6f8;--panel:#fff;--line:#dedee3;--text:#18181b;--muted:#5f5f6b;--err:#b42318;--ok:#067647}}
+*{box-sizing:border-box}body{margin:0;min-height:100dvh;display:flex;align-items:center;justify-content:center;padding:16px;background:var(--bg);color:var(--text);font:15px/1.5 system-ui,sans-serif}
+main{width:100%;max-width:400px;background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:22px;display:flex;flex-direction:column;gap:14px}
+h1{margin:0;font-size:19px}p{margin:0;color:var(--muted);font-size:13px}
+.tabs{display:flex;gap:4px;padding:3px;border:1px solid var(--line);border-radius:10px}.tabs button{flex:1;padding:7px;border:0;border-radius:8px;background:none;color:var(--muted);cursor:pointer;font:inherit}
+.tabs button[aria-selected=true]{background:var(--accent);color:#fff}
+button.primary,button.google{width:100%;padding:10px;border-radius:10px;font:inherit;cursor:pointer}
+button.primary{border:0;background:var(--accent);color:#fff;font-weight:600}button.google{border:1px solid var(--line);background:none;color:var(--text);display:flex;gap:10px;align-items:center;justify-content:center}
+button:disabled{opacity:.5;cursor:default}
+.or{display:flex;align-items:center;gap:10px;color:var(--muted);font-size:12px}.or::before,.or::after{content:'';flex:1;height:1px;background:var(--line)}
+label{display:block;font-size:13px;color:var(--muted);margin-bottom:4px}input{width:100%;padding:9px 10px;border:1px solid var(--line);border-radius:8px;background:none;color:var(--text);font:inherit}
+.row{display:flex;gap:6px}.row input{flex:1;min-width:0}.row button{padding:0 10px;border:1px solid var(--line);border-radius:8px;background:none;color:var(--muted);cursor:pointer}
+form{display:flex;flex-direction:column;gap:10px}.link{align-self:flex-start;padding:0;border:0;background:none;color:var(--accent);cursor:pointer;font:inherit;font-size:13px}
+.note{padding:8px 10px;border-radius:8px;font-size:13px}.note.err{color:var(--err)}.note.ok{color:var(--ok)}
+.done-view{display:none}body.done .form-view{display:none}body.done .done-view{display:flex;flex-direction:column;gap:10px}
+:focus-visible{outline:2px solid var(--accent);outline-offset:2px}
+</style></head><body><main>
+<div class="form-view" style="display:contents">
+<h1>Sign in to AIPictury</h1>
+<p>For ${esc(client)}: your projects, conversations and rules, kept with your account.</p>
+<div class="tabs" role="tablist"><button role="tab" data-mode="signin" aria-selected="true">Sign in</button><button role="tab" data-mode="register" aria-selected="false">Create account</button></div>
+<button class="google" id="google" type="button"><svg viewBox="0 0 48 48" width="18" height="18" aria-hidden="true"><path fill="#FFC107" d="M43.6 20.5H42V20H24v8h11.3C33.7 32.7 29.2 36 24 36c-6.6 0-12-5.4-12-12s5.4-12 12-12c3.1 0 5.8 1.2 7.9 3.1l5.7-5.7C34 6.1 29.3 4 24 4 12.9 4 4 12.9 4 24s8.9 20 20 20 20-8.9 20-20c0-1.3-.1-2.4-.4-3.5z"/><path fill="#FF3D00" d="m6.3 14.7 6.6 4.8C14.7 15.1 19 12 24 12c3.1 0 5.8 1.2 7.9 3.1l5.7-5.7C34 6.1 29.3 4 24 4 16.3 4 9.7 8.3 6.3 14.7z"/><path fill="#4CAF50" d="M24 44c5.2 0 9.9-2 13.4-5.2l-6.2-5.2C29.2 35.1 26.7 36 24 36c-5.2 0-9.6-3.3-11.3-8l-6.5 5C9.5 39.6 16.2 44 24 44z"/><path fill="#1976D2" d="M43.6 20.5H42V20H24v8h11.3c-.8 2.2-2.2 4.2-4.1 5.6l6.2 5.2C37 39.2 44 34 44 24c0-1.3-.1-2.4-.4-3.5z"/></svg>Continue with Google</button>
+<div class="or" id="or">or with email</div>
+<form id="form" novalidate>
+<div id="name-field" hidden><label for="name">Name (optional)</label><input id="name" autocomplete="name"></div>
+<div><label for="email">Email</label><input id="email" type="email" autocomplete="email" required></div>
+<div id="password-field"><label for="password">Password</label><div class="row"><input id="password" type="password" autocomplete="current-password"><button type="button" id="show" aria-pressed="false" aria-label="Show the password">Show</button></div></div>
+<div id="note" class="note" role="status" hidden></div>
+<button class="primary" id="submit" type="submit">Sign in</button>
+</form>
+<button class="link" id="forgot" type="button">Forgot your password?</button>
+</div>
+<div class="done-view" role="status"><h1>You are signed in</h1><p>As <strong id="done-who"></strong>, in <span id="done-client"></span>. You can close this tab.</p></div>
+<p class="copy">© 2026 Davait, Inc. All rights reserved.</p>
+</main>
+<script>window.AIPICTURY_SIGNIN=${boot}</script><script type="module">${script}</script></body></html>`
+}
+
+class Account {
+  /**
+   * `store`: { get: async () => saved | undefined, set: async (saved) => {}, delete: async () => {} }
+   * `config`: the Firebase web config. `client`: what to call ourselves on the page ("VS Code").
+   */
+  constructor({ store, config, client = 'VS Code', script = null, env = process.env, fetchImpl = globalThis.fetch }) {
+    this.store = store
+    this.config = config
+    this.client = client
+    this.script = script                         // the page's bundle (media/vendor/signin.js)
+    this.emulator = emulatorHosts(env)
+    this.fetch = fetchImpl
+    this.cache = null                            // { idToken, expires }
+    this.listeners = new Set()
+  }
+
+  onChange(fn) { this.listeners.add(fn); return { dispose: () => this.listeners.delete(fn) } }
+  emit(user) { for (const fn of this.listeners) { try { fn(user) } catch { /* a listener's own problem */ } } }
+
+  /** Who is signed in ({ uid, email, displayName, photoURL }), or null. */
+  async user() {
+    const s = await this.store.get()
+    return s ? { uid: s.uid, email: s.email, displayName: s.displayName, photoURL: s.photoURL } : null
+  }
+
+  /**
+   * Signs in through the browser. `open(url)` opens the page (the system browser; a test's).
+   * Resolves to the user once the page has handed the session over; rejects on a timeout or
+   * when `signal` aborts.
+   */
+  signIn({ open, signal, timeoutMs = SIGNIN_TIMEOUT } = {}) {
+    const nonce = crypto.randomBytes(24).toString('base64url')
+    const script = this.script ?? fs.readFileSync(path.join(__dirname, 'media', 'vendor', 'signin.js'), 'utf8')
+    return new Promise((resolve, reject) => {
+      let settled = false
+      let origin = ''
+      const server = http.createServer((req, res) => {
+        const url = new URL(req.url, 'http://localhost')
+        const security = { 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'no-referrer' }
+        if (req.method === 'GET' && url.pathname === '/' && url.searchParams.get('n') === nonce) {
+          res.writeHead(200, { ...security, 'Content-Type': 'text/html; charset=utf-8',
+            // The page talks to Firebase (and Google's sign-in) and to this server only.
+            'Content-Security-Policy': "default-src 'self'; script-src 'self' 'unsafe-inline' https://apis.google.com https://*.gstatic.com; "
+              + "connect-src 'self' https://*.googleapis.com https://*.firebaseapp.com http://127.0.0.1:* http://localhost:*; "
+              + "frame-src https://*.firebaseapp.com https://accounts.google.com http://127.0.0.1:* http://localhost:*; img-src 'self' data: https:; style-src 'unsafe-inline'" })
+          res.end(page({ config: this.config, emulator: this.emulator.auth, nonce, client: this.client, script }))
+          return
+        }
+        if (req.method === 'POST' && url.pathname === '/done' && url.searchParams.get('n') === nonce && !settled
+            && req.headers.origin === origin) {
+          let body = ''
+          req.on('data', (c) => { body += c; if (body.length > 64 * 1024) req.destroy() })
+          req.on('end', async () => {
+            try {
+              const got = JSON.parse(body)
+              if (!got.uid || !got.refreshToken) throw new Error('the page sent no session')
+              await this.store.set({ uid: got.uid, email: got.email || null, displayName: got.displayName || null,
+                photoURL: got.photoURL || null, refreshToken: got.refreshToken })
+              this.cache = got.idToken ? { idToken: got.idToken, expires: Date.now() + 50 * 60_000 } : null
+              res.writeHead(200, { ...security, 'Content-Type': 'application/json' })
+              res.end('{"ok":true}')
+              done(null, await this.user())
+            } catch (error) {
+              res.writeHead(400, { ...security, 'Content-Type': 'application/json' })
+              res.end(JSON.stringify({ error: error.message }))
+            }
+          })
+          return
+        }
+        res.writeHead(404, security)
+        res.end()
+      })
+      const timer = setTimeout(() => done(new Error('signing in took too long — try again')), timeoutMs)
+      const abort = () => done(new Error('signing in was cancelled'))
+      signal?.addEventListener('abort', abort, { once: true })
+      function done(error, user) {
+        if (settled) return
+        settled = true
+        clearTimeout(timer)
+        signal?.removeEventListener('abort', abort)
+        server.close()
+        server.closeAllConnections?.()
+        if (error) reject(error)
+        else resolve(user)
+      }
+      server.listen(0, '127.0.0.1', async () => {
+        origin = `http://localhost:${server.address().port}`
+        try { await open(`${origin}/?n=${nonce}`) } catch (error) { done(error) }
+      })
+      // A promise of a user: listeners are told once it is settled.
+    }).then((user) => { this.emit(user); return user })
+  }
+
+  async signOut() {
+    await this.store.delete()
+    this.cache = null
+    this.emit(null)
+  }
+
+  /** A valid ID token for the signed-in user, refreshed when it is about to expire; null when signed out. */
+  async idToken() {
+    if (this.cache && this.cache.expires > Date.now() + 60_000) return this.cache.idToken
+    const saved = await this.store.get()
+    if (!saved?.refreshToken) return null
+    const base = this.emulator.auth ? `http://${this.emulator.auth}/securetoken.googleapis.com` : 'https://securetoken.googleapis.com'
+    const ask = () => this.fetch(`${base}/v1/token?key=${encodeURIComponent(this.config.apiKey)}`, {
+      method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: saved.refreshToken }).toString(),
+      signal: AbortSignal.timeout(20_000),
+    })
+    // A connection kept open from an earlier refresh may have been closed by the other end while
+    // idle (ECONNRESET: "fetch failed"): a refresh is safe to ask again, once, on a new one.
+    const response = await ask().catch((error) => (error?.name === 'TypeError' ? ask() : Promise.reject(error)))
+    const data = await response.json().catch(() => ({}))
+    if (!response.ok) {
+      // A revoked or expired session (the password changed, the account deleted): signed out.
+      if (/TOKEN_EXPIRED|USER_DISABLED|USER_NOT_FOUND|INVALID_REFRESH_TOKEN/.test(data?.error?.message || '')) await this.signOut()
+      throw new Error(`the account could not be reached: ${data?.error?.message || response.status}`)
+    }
+    if (data.refresh_token && data.refresh_token !== saved.refreshToken) await this.store.set({ ...saved, refreshToken: data.refresh_token })
+    this.cache = { idToken: data.id_token, expires: Date.now() + (Number(data.expires_in) || 3600) * 1000 }
+    return data.id_token
+  }
+}
+
+/** The CLI's store: ~/.aipictury/credentials.json, readable by its owner only. */
+function fileStore(file) {
+  return {
+    async get() { try { return JSON.parse(fs.readFileSync(file, 'utf8')) } catch { return undefined } },
+    async set(value) {
+      fs.mkdirSync(path.dirname(file), { recursive: true })
+      const tmp = `${file}.${process.pid}.tmp`
+      fs.writeFileSync(tmp, JSON.stringify(value), { mode: 0o600 })
+      fs.renameSync(tmp, file)
+      fs.chmodSync(file, 0o600)
+    },
+    async delete() { fs.rmSync(file, { force: true }) },
+  }
+}
+
+/**
+ * fetch, with the account's token on every call to the GPU server — and only those, never another
+ * site. `server()`: its address; `signedIn()`: whether to send one. A server that answers "verify
+ * your email" is asked once more with a fresh token: the cached one predates the verification.
+ */
+function serverFetch({ fetch: plainFetch, account, server, signedIn = () => true }) {
+  const withToken = (input, init, token) => {
+    const headers = new Headers(init.headers || (typeof input === 'object' ? input.headers : undefined))
+    if (!headers.has('Authorization')) headers.set('Authorization', `Bearer ${token}`)
+    // The GPU run this call is part of (gpuRun.js), so the server holds the GPU for it.
+    for (const [k, v] of Object.entries(require('./gpuRun').headers())) if (!headers.has(k)) headers.set(k, v)
+    return { ...init, headers }
+  }
+  return async (input, init = {}) => {
+    let sent = init
+    let token = null
+    try {
+      const url = typeof input === 'string' ? input : input?.url || String(input)
+      const base = String(server() || '').replace(/\/+$/, '')
+      if (base && (url === base || url.startsWith(`${base}/`)) && signedIn()) token = await account.idToken().catch(() => null)
+      if (token) sent = withToken(input, init, token)
+    } catch { token = null; sent = init }
+    const ours = Boolean(token)
+    const response = await plainFetch(input, sent)
+    const resendable = !(init.body && typeof init.body === 'object' && typeof init.body.getReader === 'function')
+    if (!ours || response.status !== 401 || !resendable) return response
+    const detail = await response.clone().text().catch(() => '')
+    if (!/verify your email/i.test(detail)) return response
+    account.cache = null
+    const fresh = await account.idToken().catch(() => null)
+    return fresh ? plainFetch(input, withToken(input, init, fresh)) : response
+  }
+}
+
+module.exports = { Account, fileStore, emulatorHosts, page, serverFetch }