@tyvm/knowhow 0.0.155 → 0.0.156

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tyvm/knowhow",
-  "version": "0.0.155",
+  "version": "0.0.156",
   "description": "ai cli with plugins and agents",
   "main": "ts_build/src/index.js",
   "bin": {

package/src/agents/tools/index.ts

@@ -13,6 +13,7 @@ export * from "./readFile";
 export * from "./scanFile";
 export * from "./textSearch";
 export * from "./visionTool";
+export * from "./loadImageAsBase64";
 export * from "./writeFile";
 export * from "./fileSearch";
 export * from "./language";

package/src/agents/tools/list.ts

@@ -20,6 +20,7 @@ import {
   stopObservingDefinition,
 } from "./observe";
 import { skillsToolDefinitions } from "./skills";
+import { loadImageAsBase64Definition } from "./loadImageAsBase64";
 
 function getPluginNames(): string {
   try {
@@ -720,6 +721,7 @@ export const includedTools = [
       },
     },
   },
+  loadImageAsBase64Definition,
   googleSearchDefinition,
   startAgentTaskDefinition,
   replyToParentDefinition,

package/src/agents/tools/loadImageAsBase64.ts

@@ -0,0 +1,83 @@
+import fs from "fs";
+import path from "path";
+import { Tool } from "../../clients/types";
+
+const MAX_IMAGE_BYTES = 15 * 1024 * 1024;
+
+const MIME_TYPES: Record<string, string> = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  bmp: "image/bmp",
+  svg: "image/svg+xml",
+  avif: "image/avif",
+  ico: "image/x-icon",
+};
+
+function detectMimeType(buffer: Buffer, fallback: string): string {
+  if (buffer.length >= 3 && buffer[0] === 0xff && buffer[1] === 0xd8 && buffer[2] === 0xff) {
+    return "image/jpeg";
+  }
+  if (buffer.length >= 4 && buffer[0] === 0x89 && buffer[1] === 0x50 && buffer[2] === 0x4e && buffer[3] === 0x47) {
+    return "image/png";
+  }
+  if (buffer.length >= 4 && buffer.subarray(0, 4).toString("ascii") === "GIF8") {
+    return "image/gif";
+  }
+  if (
+    buffer.length >= 12 &&
+    buffer.subarray(0, 4).toString("ascii") === "RIFF" &&
+    buffer.subarray(8, 12).toString("ascii") === "WEBP"
+  ) {
+    return "image/webp";
+  }
+  return fallback;
+}
+
+/** Load a reasonably sized image from the worker filesystem for UI/AI preview. */
+export async function loadImageAsBase64(
+  filePath: string,
+  detail: "auto" | "low" | "high" = "auto"
+): Promise<string> {
+  const stats = await fs.promises.stat(filePath).catch(() => null);
+  if (!stats) throw new Error(`File not found: ${filePath}`);
+  if (!stats.isFile()) throw new Error(`Path is not a file: ${filePath}`);
+  if (stats.size > MAX_IMAGE_BYTES) {
+    throw new Error(`Image is too large to preview (${Math.ceil(stats.size / 1024 / 1024)} MB; maximum 15 MB)`);
+  }
+
+  const extension = path.extname(filePath).slice(1).toLowerCase();
+  const extensionMimeType = MIME_TYPES[extension];
+  if (!extensionMimeType) {
+    throw new Error(`Unsupported image format: ${extension || "unknown"}`);
+  }
+
+  const image = await fs.promises.readFile(filePath);
+  const mimeType = detectMimeType(image, extensionMimeType);
+  return JSON.stringify({
+    type: "image_url",
+    image_url: {
+      url: `data:${mimeType};base64,${image.toString("base64")}`,
+      detail,
+    },
+  });
+}
+
+export const loadImageAsBase64Definition: Tool = {
+  type: "function",
+  function: {
+    name: "loadImageAsBase64",
+    description: "Load an image from the worker filesystem and return it as a base64 data URL for previewing.",
+    parameters: {
+      type: "object",
+      positional: true,
+      properties: {
+        filePath: { type: "string", description: "Absolute or workspace-relative image path" },
+        detail: { type: "string", enum: ["auto", "low", "high"], description: "Image detail hint" },
+      },
+      required: ["filePath"],
+    },
+  },
+};

package/src/auth/keyAuth.ts

@@ -10,7 +10,6 @@ import {
   signMessage,
 } from "./keyManager";
 
-const JWT_FILE_PATH = path.join(process.cwd(), ".knowhow", ".jwt");
 const DEFAULT_API_URL = process.env.KNOWHOW_API_URL || "https://api.knowhow.tyvm.ai";
 
 /**
@@ -140,13 +139,14 @@ export async function registerPublicKey(
 }
 
 export function storeJwt(jwt: string): void {
-  const directory = path.dirname(JWT_FILE_PATH);
-  const temporaryPath = `${JWT_FILE_PATH}.${process.pid}.tmp`;
+  const jwtFilePath = path.join(process.cwd(), ".knowhow", ".jwt");
+  const directory = path.dirname(jwtFilePath);
+  const temporaryPath = `${jwtFilePath}.${process.pid}.tmp`;
   fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
   try {
     fs.writeFileSync(temporaryPath, jwt, { mode: 0o600, flag: "wx" });
-    fs.renameSync(temporaryPath, JWT_FILE_PATH);
-    fs.chmodSync(JWT_FILE_PATH, 0o600);
+    fs.renameSync(temporaryPath, jwtFilePath);
+    fs.chmodSync(jwtFilePath, 0o600);
   } finally {
     fs.rmSync(temporaryPath, { force: true });
   }

package/src/commands/services.ts

@@ -69,32 +69,37 @@ export async function setupServices() {
 
   Agents.setAgentContext(agentContext);
 
-  console.log("🔌 Connecting to MCP...");
-  try {
-    await Mcp.connectToConfigured(Tools);
-  } catch (mcpError) {
-    const msg = mcpError instanceof Error ? mcpError.message : String(mcpError);
-    console.warn(
-      `⚠ Some MCP servers failed to connect (continuing without them): ${msg}`
-    );
-  }
-  // Attempt silent JWT refresh via SSH identity before registering models.
-  // This handles the case where the JWT has expired but the user has a valid
-  // SSH identity registered — they shouldn't need to run `knowhow login` again
-  // unless they want to switch organizations.
+  // Refresh authentication before MCP transports, model clients, or remote
+  // sync modules can read the project JWT file.
   try {
     const startupConfig = getConfigSync();
     if (startupConfig.orgId && !process.env.KNOWHOW_JWT) {
-      await authenticateWithKey(
+      const refreshed = await authenticateWithKey(
         startupConfig.orgId,
         process.env.KNOWHOW_API_URL || "https://api.knowhow.tyvm.ai",
         startupConfig.cliIdentityPath
       );
+      if (!refreshed) {
+        console.warn(
+          `⚠ Could not renew the Knowhow session: no available CLI identity is registered ` +
+          `for configured organization ${startupConfig.orgId}. Run \`knowhow login\` to select ` +
+          `an organization and register the global identity.`
+        );
+      }
     }
-  } catch (_err) {
-    // Non-fatal: if SSH refresh fails (no key, revoked, network issue), we
-    // continue with the existing JWT (or no JWT). The user will see model
-    // warnings if no valid JWT is available.
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn(`⚠ Could not renew the Knowhow session before startup: ${message}`);
+  }
+
+  console.log("🔌 Connecting to MCP...");
+  try {
+    await Mcp.connectToConfigured(Tools);
+  } catch (mcpError) {
+    const msg = mcpError instanceof Error ? mcpError.message : String(mcpError);
+    console.warn(
+      `⚠ Some MCP servers failed to connect (continuing without them): ${msg}`
+    );
   }
 
   console.log("Connecting to clients...");

package/src/login.ts

@@ -1,12 +1,13 @@
 import http from "./utils/http";
 import fs from "fs";
+import os from "os";
 import path from "path";
 import { ask } from "./utils";
 import { getConfig, updateConfig } from "./config";
 import { KNOWHOW_API_URL } from "./services/KnowhowClient";
 import { BrowserLoginService } from "./auth/browserLogin";
 import { authenticateWithKey, hasKeyPair, registerPublicKey } from "./auth/keyAuth";
-import { getOrCreatePublicKey } from "./auth/keyManager";
+import { getDefaultPrivateKeyPath, getOrCreatePublicKey } from "./auth/keyManager";
 
 /**
  * Log in to Knowhow.
@@ -40,18 +41,19 @@ export async function login(jwtFlag?: boolean, identityPath?: string): Promise<v
     fs.chmodSync(jwtFile, 0o600);
     console.log("JWT updated successfully.");
   } else {
+    const selectedIdentityPath = identityPath ?? getDefaultPrivateKeyPath();
     const config = await getConfig();
     const orgId = config.orgId;
 
     // A local key is not proof of registration. Let the selected environment
     // check it, but only when an organization is available to bind the attempt.
-    if (orgId && hasKeyPair(identityPath)) {
+    if (orgId && hasKeyPair(selectedIdentityPath)) {
       console.log("Found CLI identity — authenticating with public key...");
       try {
-        const success = await authenticateWithKey(orgId, KNOWHOW_API_URL, identityPath);
+        const success = await authenticateWithKey(orgId, KNOWHOW_API_URL, selectedIdentityPath);
         if (success) {
           console.log("✅ Successfully authenticated via public key!");
-          return await postLoginConfigUpdate(identityPath);
+          return await postLoginConfigUpdate(selectedIdentityPath);
         }
         console.warn("Key authentication returned no JWT, falling back to browser login...");
       } catch (error: unknown) {
@@ -61,7 +63,8 @@ export async function login(jwtFlag?: boolean, identityPath?: string): Promise<v
     }
 
     // Fall back when no org/key is configured or when key auth is unavailable.
-    await doBrowserLogin(identityPath);
+    await doBrowserLogin(selectedIdentityPath);
+    identityPath = selectedIdentityPath;
   }
 
   await postLoginConfigUpdate(identityPath);
@@ -101,6 +104,15 @@ async function doBrowserLogin(identityPath?: string): Promise<void> {
   }
 }
 
+function isTemporaryIdentityPath(identityPath: string): boolean {
+  const resolvedIdentity = path.resolve(identityPath);
+  const temporaryRoots = new Set([os.tmpdir(), "/tmp", "/var/tmp"]);
+  return Array.from(temporaryRoots).some((temporaryRoot) => {
+    const relativePath = path.relative(path.resolve(temporaryRoot), resolvedIdentity);
+    return relativePath !== "" && !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
+  });
+}
+
 /** After any successful login, update the local config with the current user/org. */
 async function postLoginConfigUpdate(identityPath?: string): Promise<void> {
   try {
@@ -129,8 +141,12 @@ async function postLoginConfigUpdate(identityPath?: string): Promise<void> {
       config.orgId = orgId;
     }
 
-    if (identityPath) {
+    if (identityPath && !isTemporaryIdentityPath(identityPath)) {
       config.cliIdentityPath = path.resolve(identityPath);
+    } else if (
+      config.cliIdentityPath && isTemporaryIdentityPath(config.cliIdentityPath)
+    ) {
+      delete config.cliIdentityPath;
     }
 
     await updateConfig(config);

package/src/processors/Base64ImageDetector.ts

@@ -316,25 +316,26 @@ export class Base64ImageProcessor {
 
   createProcessor(): MessageProcessorFunction {
     return (originalMessages: Message[], modifiedMessages: Message[]) => {
-      // Only process the last (newest) message for hint injection.
-      // Processing all historical messages on every call would re-append hints
-      // to already-processed messages, causing the hint to multiply and busting
-      // Anthropic's prefix cache (which requires byte-identical prior messages).
       const lastIndex = modifiedMessages.length - 1;
       if (lastIndex < 0) return;
 
       const lastMessage = modifiedMessages[lastIndex];
 
-      // Process user messages (images from user input)
-      if (lastMessage.role === "user") {
-        this.processMessageContent(lastMessage);
+      // Every request starts with a fresh clone of the persisted thread. Normalize
+      // all images: parallel calls can place another tool result after an image,
+      // while historical image results remain persisted as JSON strings.
+      for (const message of modifiedMessages) {
+        if (message.role === "user") {
+          this.processMessageContent(message);
+        }
+        if (message.role === "tool") {
+          this.processToolMessageContent(message);
+        }
       }
 
-      // Process tool messages (images from loadImageAsBase64 tool)
-      // Tool responses come back as JSON strings that need to be parsed
-      // and converted to proper image content before the agent sees them
+      // Add path hints only to the newest message. Re-appending hints to history
+      // would multiply them and invalidate the provider's prompt cache.
       if (lastMessage.role === "tool") {
-        this.processToolMessageContent(lastMessage);
         // After processing tool content (which may not convert to image if it's plain text
         // describing a screenshot path), add hints for any image file paths found in the text.
         this.applyImagePathHintsToMessage(lastMessage);

package/src/tunnel.ts

@@ -14,8 +14,9 @@ const PROD_TUNNEL_WORKER_DOMAIN = "worker.tyvm-apps.com";
 
 /**
  * Resolve the tunnel domain and protocol from the environment and API URL.
- * TUNNEL_WORKER_DOMAIN takes precedence. Otherwise dev API URLs use the dev
- * tunnel domain and all other API URLs use the production tunnel domain.
+ * TUNNEL_WORKER_DOMAIN takes precedence. Otherwise localhost API URLs use the
+ * local tunnel proxy, dev API URLs use the dev tunnel domain, and all other API
+ * URLs use the production tunnel domain.
  */
 export function extractTunnelDomain(apiUrl: string): {
   domain: string;
@@ -26,10 +27,19 @@ export function extractTunnelDomain(apiUrl: string): {
     const useHttps = url.protocol === "https:";
     const configuredDomain = process.env.TUNNEL_WORKER_DOMAIN?.trim();
 
+    const isLocalApi =
+      url.hostname === "localhost" ||
+      url.hostname.endsWith(".localhost") ||
+      url.hostname === "127.0.0.1" ||
+      url.hostname === "[::1]";
     const isDevApi = url.hostname.split(".").includes("dev");
     const domain =
       configuredDomain ||
-      (isDevApi ? `worker.dev.tyvm-apps.com` : PROD_TUNNEL_WORKER_DOMAIN);
+      (isLocalApi
+        ? `worker.localhost:${url.port || (useHttps ? "443" : "80")}`
+        : isDevApi
+          ? `worker.dev.tyvm-apps.com`
+          : PROD_TUNNEL_WORKER_DOMAIN);
 
     return { domain, useHttps };
   } catch (err) {

package/tests/processors/Base64ImageDetector.test.ts

@@ -220,6 +220,38 @@ describe("Base64ImageDetector", () => {
       expect(content[0].image_url.url).toBe(imageDataUrl);
     });
 
+    it("should process an image result that is not the newest parallel tool result", () => {
+      const imageDataUrl =
+        "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PchI7wAAAABJRU5ErkJggg==";
+      const modifiedMessages: Message[] = [
+        {
+          role: "tool",
+          content: JSON.stringify({
+            type: "image_url",
+            image_url: { url: imageDataUrl, detail: "high" },
+          }),
+          tool_call_id: "call_image",
+        },
+        {
+          role: "tool",
+          content: "A later readFile result",
+          tool_call_id: "call_file",
+        },
+        {
+          role: "user",
+          content: "A pending workflow update",
+        },
+      ];
+
+      detector.createProcessor()([], modifiedMessages);
+
+      expect(Array.isArray(modifiedMessages[0].content)).toBe(true);
+      expect((modifiedMessages[0].content as any[])[0]).toEqual({
+        type: "image_url",
+        image_url: { url: imageDataUrl, detail: "high" },
+      });
+    });
+
     it("should not promote a compressed image URL placeholder to image content", () => {
       const toolResponseJson = JSON.stringify({
         type: "image_url",

package/tests/unit/agents/tools/loadImageAsBase64.test.ts

@@ -0,0 +1,44 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import {
+  loadImageAsBase64,
+  loadImageAsBase64Definition,
+} from "../../../../src/agents/tools/loadImageAsBase64";
+import { Base64ImageProcessor } from "../../../../src/processors/Base64ImageDetector";
+import { ToolsService } from "../../../../src/services/Tools";
+
+describe("loadImageAsBase64 tool", () => {
+  it("returns an image data URL with a MIME type detected from its bytes", async () => {
+    const directory = await fs.promises.mkdtemp(path.join(os.tmpdir(), "knowhow-image-"));
+    const filePath = path.join(directory, "incorrectly-named.jpg");
+
+    try {
+      await fs.promises.writeFile(filePath, Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]));
+      const result = JSON.parse(await loadImageAsBase64(filePath));
+
+      expect(result).toMatchObject({
+        type: "image_url",
+        image_url: { detail: "auto" },
+      });
+      expect(result.image_url.url).toMatch(/^data:image\/png;base64,/);
+    } finally {
+      await fs.promises.rm(directory, { recursive: true, force: true });
+    }
+  });
+
+  it("can also be registered by the image message processor without duplication", () => {
+    const toolsService = new ToolsService();
+    toolsService.defineTools(
+      [loadImageAsBase64Definition],
+      { loadImageAsBase64 }
+    );
+
+    new Base64ImageProcessor(toolsService);
+
+    expect(
+      toolsService.getToolNames().filter((name) => name === "loadImageAsBase64")
+    ).toHaveLength(1);
+    expect(typeof toolsService.getFunction("loadImageAsBase64")).toBe("function");
+  });
+});

package/tests/unit/auth/keyAuth.test.ts

@@ -24,12 +24,16 @@ jest.mock("../../../src/auth/browserLogin", () => ({
   getCliUserAgent: () => "test-agent",
 }));
 
+import fs from "fs";
+import os from "os";
+import path from "path";
 import {
   authenticateWithKey,
   exchangeAvailablePublicKeyJwt,
   exchangePublicKeyJwt,
   hasKeyPair,
   registerPublicKey,
+  storeJwt,
 } from "../../../src/auth/keyAuth";
 
 describe("keyAuth", () => {
@@ -109,6 +113,23 @@ describe("keyAuth", () => {
     expect(signMessage).not.toHaveBeenCalled();
   });
 
+  it("stores a refreshed JWT in the active isolated project", () => {
+    const originalCwd = process.cwd();
+    const temporaryProject = fs.mkdtempSync(path.join(os.tmpdir(), "knowhow-key-auth-"));
+    try {
+      process.chdir(temporaryProject);
+
+      storeJwt("fresh-project-jwt");
+
+      const jwtPath = path.join(temporaryProject, ".knowhow", ".jwt");
+      expect(fs.readFileSync(jwtPath, "utf8")).toBe("fresh-project-jwt");
+      expect(fs.statSync(jwtPath).mode & 0o777).toBe(0o600);
+    } finally {
+      process.chdir(originalCwd);
+      fs.rmSync(temporaryProject, { recursive: true, force: true });
+    }
+  });
+
   it("registers only server-owned Ed25519 key fields in the selected environment", async () => {
     post.mockResolvedValueOnce({ data: {}, status: 201 });
 

package/tests/unit/login.test.ts

@@ -26,7 +26,10 @@ jest.mock("../../src/auth/keyAuth", () => ({
   registerPublicKey,
 }));
 
-jest.mock("../../src/auth/keyManager", () => ({ getOrCreatePublicKey }));
+jest.mock("../../src/auth/keyManager", () => ({
+  getDefaultPrivateKeyPath: () => "/keys/default",
+  getOrCreatePublicKey,
+}));
 jest.mock("../../src/config", () => ({ getConfig, updateConfig }));
 jest.mock("../../src/utils", () => ({ ask: jest.fn() }));
 
@@ -88,6 +91,41 @@ describe("login public-key bootstrap", () => {
     );
   });
 
+  it("does not persist a temporary identity path into project configuration", async () => {
+    const temporaryIdentity = path.join(os.tmpdir(), "knowhow-login-test-key");
+    getConfig.mockResolvedValue({
+      orgId: "org-1",
+      cliIdentityPath: "/tmp/knowhow-csrf-e2e-key",
+      modelProviders: [],
+    });
+    registerPublicKey.mockResolvedValueOnce(undefined);
+
+    await expect(login(false, temporaryIdentity)).resolves.toBeUndefined();
+
+    expect(getOrCreatePublicKey).toHaveBeenCalledWith(temporaryIdentity);
+    expect(updateConfig).toHaveBeenCalledTimes(1);
+    expect(updateConfig.mock.calls[0][0]).toEqual(
+      expect.not.objectContaining({
+        cliIdentityPath: expect.any(String),
+      })
+    );
+  });
+
+  it("persists the default identity selected during browser bootstrap", async () => {
+    registerPublicKey.mockResolvedValueOnce(undefined);
+
+    await expect(login(false)).resolves.toBeUndefined();
+
+    expect(getOrCreatePublicKey).toHaveBeenCalledWith("/keys/default");
+    expect(updateConfig).toHaveBeenCalledWith(
+      expect.objectContaining({
+        orgId: "org-1",
+        cliIdentityPath: "/keys/default",
+        modelProviders: [{ provider: "knowhow" }],
+      })
+    );
+  });
+
   it("safely falls back to browser PKCE when the selected key cannot authenticate", async () => {
     hasKeyPair.mockReturnValue(true);
     getConfig.mockResolvedValue({ orgId: "org-1", modelProviders: [] });

package/tests/unit/services/Mcp.test.ts

@@ -0,0 +1,56 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+interface CapturedTransportOptions {
+  requestInit?: { headers?: Record<string, string> };
+}
+
+let capturedOptions: CapturedTransportOptions | undefined;
+
+jest.mock("@modelcontextprotocol/sdk/client/streamableHttp.js", () => ({
+  StreamableHTTPClientTransport: jest.fn().mockImplementation(
+    (_url: URL, options: unknown) => {
+      capturedOptions = options as CapturedTransportOptions;
+      return { close: jest.fn() };
+    }
+  ),
+}));
+
+import { McpService } from "../../../src/services/Mcp";
+
+describe("McpService JWT file transport", () => {
+  let temporaryDirectory: string;
+  let tokenFile: string;
+
+  beforeEach(() => {
+    capturedOptions = undefined;
+    temporaryDirectory = fs.mkdtempSync(path.join(os.tmpdir(), "knowhow-mcp-"));
+    tokenFile = path.join(temporaryDirectory, ".jwt");
+  });
+
+  afterEach(() => {
+    fs.rmSync(temporaryDirectory, { recursive: true, force: true });
+  });
+
+  it("reads the refreshed JWT when the transport is created", () => {
+    fs.writeFileSync(tokenFile, "expired-jwt");
+    fs.writeFileSync(tokenFile, "fresh-jwt");
+
+    new McpService().createTransport({
+      name: "authenticated-remote",
+      url: "https://api.example.test/mcp",
+      authorization_token_file: tokenFile,
+    });
+
+    expect(capturedOptions).toEqual(
+      expect.objectContaining({
+        requestInit: {
+          headers: expect.objectContaining({
+            Authorization: "Bearer fresh-jwt",
+          }),
+        },
+      })
+    );
+  });
+});

package/tests/unit/tunnel.test.ts

@@ -0,0 +1,51 @@
+import { extractTunnelDomain } from "../../src/tunnel";
+
+describe("extractTunnelDomain", () => {
+  const originalTunnelWorkerDomain = process.env.TUNNEL_WORKER_DOMAIN;
+
+  beforeEach(() => {
+    delete process.env.TUNNEL_WORKER_DOMAIN;
+  });
+
+  afterAll(() => {
+    if (originalTunnelWorkerDomain === undefined) {
+      delete process.env.TUNNEL_WORKER_DOMAIN;
+    } else {
+      process.env.TUNNEL_WORKER_DOMAIN = originalTunnelWorkerDomain;
+    }
+  });
+
+  it("uses the local tunnel proxy for a localhost API URL", () => {
+    expect(extractTunnelDomain("http://localhost:4000")).toEqual({
+      domain: "worker.localhost:4000",
+      useHttps: false,
+    });
+  });
+
+  it("uses the local tunnel proxy for loopback API URLs", () => {
+    expect(extractTunnelDomain("http://127.0.0.1:4000")).toEqual({
+      domain: "worker.localhost:4000",
+      useHttps: false,
+    });
+  });
+
+  it("continues to select dev and production tunnel domains", () => {
+    expect(extractTunnelDomain("https://api.dev.knowhow.tyvm.ai")).toEqual({
+      domain: "worker.dev.tyvm-apps.com",
+      useHttps: true,
+    });
+    expect(extractTunnelDomain("https://api.knowhow.tyvm.ai")).toEqual({
+      domain: "worker.tyvm-apps.com",
+      useHttps: true,
+    });
+  });
+
+  it("allows an explicit tunnel domain to override localhost detection", () => {
+    process.env.TUNNEL_WORKER_DOMAIN = "worker.override.example";
+
+    expect(extractTunnelDomain("http://localhost:4000")).toEqual({
+      domain: "worker.override.example",
+      useHttps: false,
+    });
+  });
+});

package/ts_build/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@tyvm/knowhow",
-    "version": "0.0.155",
+    "version": "0.0.156",
     "description": "ai cli with plugins and agents",
     "main": "ts_build/src/index.js",
     "bin": {

package/ts_build/src/agents/tools/index.d.ts

@@ -13,6 +13,7 @@ export * from "./readFile";
 export * from "./scanFile";
 export * from "./textSearch";
 export * from "./visionTool";
+export * from "./loadImageAsBase64";
 export * from "./writeFile";
 export * from "./fileSearch";
 export * from "./language";

package/ts_build/src/agents/tools/index.js

@@ -29,6 +29,7 @@ __exportStar(require("./readFile"), exports);
 __exportStar(require("./scanFile"), exports);
 __exportStar(require("./textSearch"), exports);
 __exportStar(require("./visionTool"), exports);
+__exportStar(require("./loadImageAsBase64"), exports);
 __exportStar(require("./writeFile"), exports);
 __exportStar(require("./fileSearch"), exports);
 __exportStar(require("./language"), exports);