@webship.co/workspace 1.0.0-beta1 → 1.0.0-rc1

package/core/workspace-app/tests/unit/images-ai.test.js

@@ -0,0 +1,201 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const http = require('http');
+
+const ai = require('../../images-ai');
+
+const root = path.join(__dirname, '..', '..');
+const read = (p) => fs.readFileSync(path.join(root, p), 'utf8');
+const PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==', 'base64');
+
+test('the plan checks every choice and estimates the cost before anything is sent', () => {
+  const p = ai.plan({ prompt: 'A calm blue lake', model: 'gpt-image-2.5-sunburst', shape: 'landscape', quality: 'medium', count: '3', name: 'Lake 1' });
+  assert.deepEqual([p.model, p.size, p.quality, p.n, p.name], ['gpt-image-2.5-sunburst', '1536x1024', 'medium', 3, 'Lake-1']);
+  assert.equal(p.estimate.toFixed(3), ((0.053 + ai.DESCRIBE_ESTIMATE) * 3).toFixed(3));
+  const odd = ai.plan({ prompt: 'x', model: 'dall-e-9', shape: 'huge', quality: 'max', count: '99' });
+  assert.deepEqual([odd.model, odd.size, odd.quality, odd.n], ['gpt-image-2.5-flare', '1024x1024', 'low', 4]);
+  assert.equal(ai.plan({ prompt: '  ' }).ok, false);
+  assert.match(ai.planHtml(p), /hx-trigger="confirmed-remove"/);
+  assert.match(ai.planHtml(p), /"confirm":"yes"/);
+});
+
+test('nothing is generated without confirm=yes, nor without a real key', async () => {
+  assert.equal((await ai.generate({ prompt: 'x' })).status, 400);
+  const noKey = await ai.generate({ prompt: 'x', confirm: 'yes' }, { key: '' });
+  assert.equal(noKey.ok, false);
+  assert.ok([503].includes(noKey.status) || /settings\.yml/.test(noKey.error));
+});
+
+test('a run saves each image with a sidecar and reports what it cost, against a stand-in for OpenAI', async () => {
+  let seen = null;
+  const srv = http.createServer((req, res) => {
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      seen = { auth: req.headers.authorization, body: JSON.parse(body), url: req.url };
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ data: [{ b64_json: PNG.toString('base64') }], usage: { output_tokens: 400, input_tokens: 20 } }));
+    });
+  });
+  await new Promise((r) => srv.listen(0, r));
+  process.env.OPENAI_IMAGES_API = `http://127.0.0.1:${srv.address().port}/v1/images/generations`;
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gen-'));
+  try {
+    // The stand-in is plain http, so the request module is swapped for this one run.
+    const https = require('https');
+    const realRequest = https.request;
+    https.request = http.request;
+    const r = await ai.generate({ prompt: 'A small test square', quality: 'low', count: '1', name: 'test', confirm: 'yes' }, { key: 'sk-test-key', dir });
+    https.request = realRequest;
+    assert.equal(r.ok, true, r.error);
+    assert.deepEqual(r.made, ['generated/test.png']);
+    assert.equal(seen.auth, 'Bearer sk-test-key');
+    assert.deepEqual([seen.body.model, seen.body.size, seen.body.quality, seen.body.n], ['gpt-image-2.5-flare', '1024x1024', 'low', 1]);
+    assert.ok(fs.readFileSync(path.join(dir, 'test.png')).equals(PNG));
+    const side = JSON.parse(fs.readFileSync(path.join(dir, 'test.png.json'), 'utf8'));
+    assert.equal(side.prompt, 'A small test square');
+    assert.equal(side.model, 'gpt-image-2.5-flare');
+    assert.equal(r.cost.toFixed(6), (400 * 30 / 1e6 + 20 * 5 / 1e6).toFixed(6));
+  } finally {
+    delete process.env.OPENAI_IMAGES_API;
+    srv.close();
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('the key never reaches the page, a URL or a log line', () => {
+  const src = read('images-ai.js');
+  assert.match(read('images-providers/openai.js'), /Authorization: `Bearer \$\{key\}`/);
+  assert.doesNotMatch(src, /console\.(log|error)/);
+  assert.match(read('images-providers/http.js'), /replace\(\/sk-\[A-Za-z0-9_-\]\+\/g, 'sk-…'\)/);
+  assert.doesNotMatch(ai.formHtml(), /sk-[A-Za-z0-9]{8}/);
+  assert.match(read('images-page.js'), /btn\('secondary', 'bolt', 'Generate with AI'/);
+  assert.match(read('actions/images.js'), /if \(form\.confirm !== 'yes'\) \{\n\s+const p = ai\.plan\(form\);/);
+});
+
+// A stand-in for OpenAI that records each request and answers per path.
+async function standIn(answer) {
+  const seen = [];
+  const srv = http.createServer((req, res) => {
+    const chunks = [];
+    req.on('data', (d) => chunks.push(d));
+    req.on('end', () => {
+      const raw = Buffer.concat(chunks);
+      seen.push({ url: req.url, auth: req.headers.authorization, type: req.headers['content-type'], raw });
+      const [status, body] = answer(req.url, raw);
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(body));
+    });
+  });
+  await new Promise((r) => srv.listen(0, r));
+  const base = `http://127.0.0.1:${srv.address().port}`;
+  process.env.OPENAI_IMAGES_API = `${base}/v1/images/generations`;
+  process.env.OPENAI_EDITS_API = `${base}/v1/images/edits`;
+  process.env.OPENAI_CHAT_API = `${base}/v1/chat/completions`;
+  const https = require('https');
+  const real = https.request;
+  https.request = http.request;
+  return { seen, close: () => { https.request = real; srv.close(); delete process.env.OPENAI_IMAGES_API; delete process.env.OPENAI_EDITS_API; delete process.env.OPENAI_CHAT_API; } };
+}
+
+const DESCRIBED = { choices: [{ message: { content: JSON.stringify({ summary: 'A small blue square on white.', alt: 'Blue square' }) } }], usage: { prompt_tokens: 100, completion_tokens: 50 } };
+
+test('a generated image keeps its prompt in a readable .md, with an AI summary and alt text from a vision call', async () => {
+  const s = await standIn((url) => (url.includes('chat') ? [200, DESCRIBED]
+    : [200, { data: [{ b64_json: PNG.toString('base64') }], usage: { output_tokens: 400, input_tokens: 20 } }]));
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gen-'));
+  try {
+    const r = await ai.generate({ prompt: 'A small test square', quality: 'low', count: '1', name: 'sq', confirm: 'yes' }, { key: 'sk-test-key', dir });
+    assert.equal(r.ok, true, r.error);
+    const chat = s.seen.find((x) => x.url.includes('chat'));
+    const body = JSON.parse(chat.raw.toString());
+    assert.equal(chat.auth, 'Bearer sk-test-key');
+    assert.equal(body.model, ai.VISION_MODEL);
+    assert.deepEqual(body.response_format, { type: 'json_object' });
+    const img = body.messages[1].content.find((c) => c.type === 'image_url');
+    assert.match(img.image_url.url, /^data:image\/png;base64,/);
+    assert.equal(img.image_url.detail, 'low');
+    const side = JSON.parse(fs.readFileSync(path.join(dir, 'sq.png.json'), 'utf8'));
+    assert.deepEqual([side.summary, side.alt, side.described_by], ['A small blue square on white.', 'Blue square', ai.VISION_MODEL]);
+    const md = fs.readFileSync(path.join(dir, 'sq.md'), 'utf8');
+    assert.match(md, /^<!-- images: how this image was made -->\n# sq\n\n!\[Blue square\]\(\.\/sq\.png\)/);
+    assert.match(md, /A small blue square on white\./);
+    assert.match(md, /- \*\*Prompt:\*\* A small test square/);
+    assert.equal(r.cost.toFixed(6), (400 * 30 / 1e6 + 20 * 5 / 1e6 + 100 * 0.2 / 1e6 + 50 * 1.25 / 1e6).toFixed(6));
+    // The .md is not an image, so no list shows it.
+    assert.equal(require('../../images').IMAGE_RE.test('sq.md'), false);
+  } finally {
+    s.close();
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('when the description call fails the image is kept, marked "not written", and Describe it is offered', async () => {
+  const s = await standIn((url) => (url.includes('chat') ? [500, { error: { message: 'busy' } }]
+    : [200, { data: [{ b64_json: PNG.toString('base64') }], usage: { output_tokens: 10 } }]));
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gen-'));
+  try {
+    const r = await ai.generate({ prompt: 'x', count: '1', name: 'nodesc', confirm: 'yes' }, { key: 'sk-test-key', dir });
+    assert.equal(r.ok, true);
+    assert.deepEqual(r.undescribed, ['nodesc.png']);
+    assert.equal(JSON.parse(fs.readFileSync(path.join(dir, 'nodesc.png.json'), 'utf8')).description, 'not written');
+    const page = read('images-page.js');
+    assert.match(page, /hx-post="\/actions\/image-describe" hx-trigger="confirmed-remove"/);
+    assert.match(page, /made\.description === 'not written' \? 'The description was not written\.'/);
+    assert.equal((await ai.describeExisting({ file: 'x.png' })).status, 400);
+  } finally {
+    s.close();
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('Copy Markdown uses the alt text, and the plan prices the description', () => {
+  assert.match(read('images-page.js'), /data-copy="\$\{esc\(`!\[\$\{String\(\(made && made\.alt\) \|\| im\.name/);
+  const p = ai.plan({ prompt: 'x', quality: 'low', count: '2' });
+  assert.equal(p.estimate.toFixed(3), ((0.006 + ai.DESCRIBE_ESTIMATE) * 2).toFixed(3));
+  assert.match(ai.planHtml(p), /for the description/);
+});
+
+test('Edit with AI sends the source as multipart, never overwrites, records its source, and refuses an SVG', async () => {
+  const s = await standIn((url) => (url.includes('chat') ? [200, DESCRIBED]
+    : [200, { data: [{ b64_json: PNG.toString('base64') }], usage: { output_tokens: 300, input_tokens: 50, input_tokens_details: { image_tokens: 40, text_tokens: 10 } } }]));
+  const imagesRoot = require('../../workspaces').workspaceDir('images');
+  const dir = fs.mkdtempSync(path.join(imagesRoot, 'test-ai-edit-'));
+  const relDir = path.basename(dir);
+  try {
+    fs.writeFileSync(path.join(dir, 'pic.png'), PNG);
+    fs.writeFileSync(path.join(dir, 'pic-ai-v1.png'), PNG);
+    assert.equal((await ai.editImage({ src: 'images', file: `${relDir}/pic.png`, prompt: 'warmer' }, { key: 'sk-test-key' })).status, 400);
+    const r = await ai.editImage({ src: 'images', file: `${relDir}/pic.png`, prompt: 'make it warmer', quality: 'low', confirm: 'yes' }, { key: 'sk-test-key' });
+    assert.equal(r.ok, true, r.error);
+    assert.equal(r.name, 'pic-ai-v2.png');
+    const edit = s.seen.find((x) => x.url.includes('edits'));
+    assert.match(edit.type, /^multipart\/form-data; boundary=/);
+    const raw = edit.raw.toString('latin1');
+    assert.match(raw, /name="prompt"\r\n\r\nmake it warmer\r\n/);
+    assert.match(raw, /name="image"; filename="pic\.png"\r\nContent-Type: image\/png/);
+    assert.equal(edit.auth, 'Bearer sk-test-key');
+    const side = JSON.parse(fs.readFileSync(path.join(dir, 'pic-ai-v2.png.json'), 'utf8'));
+    assert.deepEqual(side.source, { workspace: 'images', path: `${relDir}/pic.png` });
+    assert.equal(side.edit_prompt, 'make it warmer');
+    assert.equal(side.alt, 'Blue square');
+    assert.ok(fs.readFileSync(path.join(dir, 'pic.png')).equals(PNG), 'the source is unchanged');
+    fs.writeFileSync(path.join(dir, 'logo.svg'), '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1 1"/>');
+    assert.match(ai.editPlan({ src: 'images', file: `${relDir}/logo.svg`, prompt: 'x' }).error, /SVG cannot be edited/);
+    assert.equal(ai.aiVersionName(dir, 'pic.png', 'png'), 'pic-ai-v3.png');
+    assert.equal(ai.nearestSize(1600, 1000), '1536x1024');
+    assert.match(ai.editPlanHtml(ai.editPlan({ src: 'images', file: `${relDir}/pic.png`, prompt: 'x' })), /hx-trigger="confirmed-remove"/);
+  } finally {
+    s.close();
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('an edit of an image from another workspace is saved into images/edited/', () => {
+  const p = ai.editPlan({ src: 'docs', file: 'nothing-here.png', prompt: 'x' });
+  assert.equal(p.ok, false);
+  assert.match(read('images-ai.js'), /const dir = src === 'images' \? path\.dirname\(where\.abs\) : path\.join\(workspaceDir\('images'\), 'edited'\);/);
+});

package/core/workspace-app/tests/unit/images-create.test.js

@@ -0,0 +1,59 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const path = require('path');
+
+const create = require('../../images-create');
+
+const root = path.join(__dirname, '..', '..');
+const read = (p) => fs.readFileSync(path.join(root, p), 'utf8');
+
+test('an upload is an image by its bytes, not by its name', () => {
+  assert.equal(create.sniff(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])), 'png');
+  assert.equal(create.sniff(Buffer.from([0xff, 0xd8, 0xff, 0xe0])), 'jpg');
+  assert.equal(create.sniff(Buffer.from('GIF89a......')), 'gif');
+  assert.equal(create.sniff(Buffer.from('RIFF....WEBPVP8 ')), 'webp');
+  assert.equal(create.sniff(Buffer.from('....ftypavif....')), 'avif');
+  assert.equal(create.sniff(Buffer.from('<?xml version="1.0"?>\n<svg xmlns="http://www.w3.org/2000/svg"></svg>')), 'svg');
+  assert.equal(create.sniff(Buffer.from('#!/bin/sh\nrm -rf /')), '');
+  assert.equal(create.sniff(Buffer.from('<html><svg></svg></html>')), '');
+  assert.equal(create.MAX_UPLOAD, 25 * 1024 * 1024);
+});
+
+test('an upload or a screenshot only ever lands inside the images workspace', () => {
+  assert.equal(create.targetDir('../dev'), null);
+  assert.equal(create.targetDir('a/../../etc'), null);
+  assert.equal(create.targetDir('.hidden'), null);
+  assert.equal(create.targetDir('ok;rm -rf'), null);
+});
+
+test('an edit is ImageMagick argv from fixed lists and checked numbers, saved under a new name', () => {
+  const dir = '/tmp/x';
+  const src = '/tmp/x/shot.png';
+  const crop = create.editArgs(src, dir, { crop: '16:9', width: '800', format: 'webp', quality: '70' }, { width: 1600, height: 1000 });
+  assert.deepEqual(crop.args, [`${src}[0]`, '-auto-orient', '-gravity', 'center', '-crop', '1600x900+0+0', '+repage',
+    '-resize', '800x', '-quality', '70', 'webp:/tmp/x/shot-v2.webp']);
+  assert.equal(crop.changed, true);
+  const tall = create.editArgs(src, dir, { crop: '1:1' }, { width: 1600, height: 1000 });
+  assert.ok(tall.args.includes('1000x1000+0+0'));
+  const junk = create.editArgs(src, dir, { width: '9999999', format: 'exe', crop: '; rm', quality: '500' }, { width: 10, height: 10 });
+  assert.equal(junk.changed, false);
+  assert.ok(!junk.args.some((a) => /rm|exe|9999999/.test(a)));
+  const jpg = create.editArgs(src, dir, { format: 'jpg', quality: '500' }, null);
+  assert.ok(jpg.args.includes('-quality') && jpg.args.includes('85'));
+});
+
+test('upload, screenshot and edit are wired, with the upload on its own binary route', () => {
+  const server = read('server.js');
+  assert.match(server, /pathname === '\/actions\/image-upload' && isValidWorkspace\('images'\)\) \{\n\s+if \(foreignOrigin\(req\)\)/);
+  const actions = read('actions/images.js');
+  assert.match(actions, /'\/actions\/image-screenshot': image_screenshot/);
+  assert.match(actions, /'\/actions\/image-edit': image_edit/);
+  const page = read('images-page.js');
+  assert.match(page, /btn\('primary', 'upload', 'Upload images'/);
+  assert.match(page, /btn\('default', 'tabler:camera', 'Screenshot a page'/);
+  const ui = read('public/ui.js');
+  assert.match(ui, /fetch\(`\/actions\/image-upload\?path=\$\{encodeURIComponent\(folder\)\}&name=\$\{encodeURIComponent\(f\.name\)\}`/);
+  assert.match(create.screenshotFormHtml(), /name="width"/);
+  assert.match(create.editFormHtml('a.png'), /Save as a new file/);
+});

package/core/workspace-app/tests/unit/images-providers.test.js

@@ -0,0 +1,248 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const http = require('http');
+
+const providers = require('../../images-providers');
+const ai = require('../../images-ai');
+
+const root = path.join(__dirname, '..', '..');
+const read = (p) => fs.readFileSync(path.join(root, p), 'utf8');
+const PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==', 'base64');
+
+// A stand-in for every provider: it records each request and answers per path.
+async function standIn(answer) {
+  const seen = [];
+  const srv = http.createServer((req, res) => {
+    const chunks = [];
+    req.on('data', (d) => chunks.push(d));
+    req.on('end', () => {
+      const raw = Buffer.concat(chunks);
+      seen.push({ url: req.url, headers: req.headers, raw, json: (() => { try { return JSON.parse(raw); } catch (_) { return null; } })() });
+      const [status, body] = answer(req.url, raw);
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(body));
+    });
+  });
+  await new Promise((r) => srv.listen(0, r));
+  const base = `http://127.0.0.1:${srv.address().port}`;
+  const env = {
+    GEMINI_INTERACTIONS_API: `${base}/gemini/interactions`,
+    XAI_IMAGES_API: `${base}/xai/images/generations`,
+    XAI_EDITS_API: `${base}/xai/images/edits`,
+    STABILITY_CORE_API: `${base}/stability/core`,
+    ANTHROPIC_MESSAGES_API: `${base}/anthropic/messages`,
+    OPENAI_CHAT_API: `${base}/openai/chat`,
+  };
+  Object.assign(process.env, env);
+  const https = require('https');
+  const real = https.request;
+  https.request = http.request;
+  return { seen, close: () => { https.request = real; srv.close(); for (const k of Object.keys(env)) delete process.env[k]; } };
+}
+
+test('every provider keeps the registry contract', () => {
+  assert.deepEqual(providers.ORDER, ['openai', 'gemini', 'xai', 'stability', 'anthropic', 'claude-code']);
+  for (const p of providers.list()) {
+    assert.equal(typeof p.id, 'string');
+    assert.equal(typeof p.label, 'string');
+    assert.ok(Array.isArray(p.kinds) && p.kinds.length, p.id);
+    const a = p.available();
+    assert.equal(typeof a.ok, 'boolean', p.id);
+    if (!a.ok) assert.match(a.why, /settings\.yml|claude CLI/, p.id);
+    for (const kind of p.kinds) {
+      if (kind === 'generate' || kind === 'edit') {
+        assert.ok(p.models[p.defaultModel], `${p.id} default model`);
+        assert.ok(Object.keys(p.sizes).length, `${p.id} sizes`);
+        assert.ok(p.qualities === null || p.qualities.length, `${p.id} qualities`);
+      }
+      if (kind === 'generate') assert.ok(p.async || typeof p.generate === 'function', `${p.id} generate`);
+      if (kind === 'edit') assert.ok(p.async || typeof p.edit === 'function', `${p.id} edit`);
+      if (kind === 'svg') assert.ok(p.async || typeof p.svg === 'function', `${p.id} svg`);
+    }
+  }
+  assert.equal(providers.pick('nope', 'generate').id, 'openai');
+  assert.equal(providers.pick('stability', 'generate').id, 'stability');
+  assert.equal(providers.pick('stability', 'edit').id, 'openai', 'Stability does not edit');
+  assert.deepEqual(providers.list('svg').map((p) => p.id), ['openai', 'gemini', 'anthropic', 'claude_code_cli']);
+});
+
+test('a provider with a placeholder key is unavailable, shown disabled with the key to set, and nothing is sent', async () => {
+  for (const id of ['gemini', 'xai', 'stability', 'anthropic']) {
+    const p = providers.get(id);
+    assert.equal(p.key(), '', `${id} reads the shipped placeholder as no key`);
+    assert.deepEqual(p.available(), { ok: false, why: `set ai_providers.${id}.api_key in settings.yml` });
+  }
+  const html = ai.providerSelectHtml('generate', 'gemini');
+  assert.match(html, /<option value="gemini" disabled>Google Gemini \(set ai_providers\.gemini\.api_key in settings\.yml\)<\/option>/);
+  const s = await standIn(() => [200, {}]);
+  try {
+    assert.equal((await ai.generate({ prompt: 'x', provider: 'stability' })).status, 400, 'no confirm, no call');
+    const r = await ai.generate({ prompt: 'x', provider: 'stability', confirm: 'yes' });
+    assert.equal(r.status, 503);
+    assert.match(r.error, /ai_providers\.stability\.api_key/);
+    assert.equal(s.seen.length, 0);
+  } finally {
+    s.close();
+  }
+});
+
+test('Gemini: the Interactions request, the key in x-goog-api-key, and the image read from the output steps', async () => {
+  const s = await standIn(() => [200, { steps: [{ type: 'thought' }, { type: 'model_output', content: [{ type: 'text', text: 'here' }, { type: 'image', mime_type: 'image/png', data: PNG.toString('base64') }] }] }]);
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gem-'));
+  try {
+    const r = await ai.generate({ prompt: 'A lake', provider: 'gemini', shape: 'landscape', quality: 'medium', count: '1', name: 'lake', confirm: 'yes' },
+      { key: 'AIzaTESTKEY', dir, describe: false });
+    assert.equal(r.ok, true, r.error);
+    assert.equal(r.cost, null, 'no published figure, so no made-up cost');
+    const call = s.seen[0];
+    assert.equal(call.url, '/gemini/interactions');
+    assert.equal(call.headers['x-goog-api-key'], 'AIzaTESTKEY');
+    assert.equal(call.headers.authorization, undefined);
+    assert.deepEqual(call.json, { model: 'gemini-nano-banana-2.1', input: [{ type: 'text', text: 'A lake' }],
+      response_format: { type: 'image', aspect_ratio: '16:9', image_size: '2K' } });
+    assert.ok(fs.readFileSync(path.join(dir, 'lake.png')).equals(PNG));
+    assert.equal(JSON.parse(fs.readFileSync(path.join(dir, 'lake.png.json'), 'utf8')).provider, 'Google Gemini');
+  } finally {
+    s.close();
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('xAI: generate and edit with a Bearer key, base64 asked for, the edit image as a data URL', async () => {
+  const s = await standIn(() => [200, { data: [{ b64_json: PNG.toString('base64') }] }]);
+  try {
+    const xai = providers.get('xai');
+    const g = await xai.generate({ model: 'grok-imagine-image-2.0', prompt: 'A fox', n: 2 }, 'xai-TESTKEY');
+    assert.equal(g.images.length, 1);
+    assert.equal(s.seen[0].url, '/xai/images/generations');
+    assert.equal(s.seen[0].headers.authorization, 'Bearer xai-TESTKEY');
+    assert.deepEqual(s.seen[0].json, { model: 'grok-imagine-image-2.0', prompt: 'A fox', n: 2, response_format: 'b64_json' });
+    const e = await xai.edit({ model: 'grok-imagine-image-2.0', prompt: 'warmer' }, { name: 'a.png', type: 'image/png', data: PNG }, 'xai-TESTKEY');
+    assert.ok(e.image.equals(PNG));
+    assert.equal(s.seen[1].url, '/xai/images/edits');
+    assert.deepEqual(s.seen[1].json.image, { type: 'image_url', url: `data:image/png;base64,${PNG.toString('base64')}` });
+  } finally {
+    s.close();
+  }
+});
+
+test('Stability: multipart with prompt, aspect ratio and PNG, JSON asked for, one call per image', async () => {
+  const s = await standIn(() => [200, { image: PNG.toString('base64'), finish_reason: 'SUCCESS' }]);
+  try {
+    const st = providers.get('stability');
+    const r = await st.generate({ prompt: 'A hill', size: '9:16', n: 2 }, 'sk-STABTEST');
+    assert.equal(r.images.length, 2);
+    assert.equal(r.cost.toFixed(2), '0.06');
+    const call = s.seen[0];
+    assert.equal(call.headers.authorization, 'Bearer sk-STABTEST');
+    assert.equal(call.headers.accept, 'application/json');
+    assert.match(call.headers['content-type'], /^multipart\/form-data; boundary=/);
+    const raw = call.raw.toString('latin1');
+    assert.match(raw, /name="prompt"\r\n\r\nA hill\r\n/);
+    assert.match(raw, /name="aspect_ratio"\r\n\r\n9:16\r\n/);
+    assert.match(raw, /name="output_format"\r\n\r\npng\r\n/);
+  } finally {
+    s.close();
+  }
+});
+
+test('Anthropic and OpenAI SVG source: the key in its own header, the text read back', async () => {
+  const s = await standIn((url) => (url.includes('anthropic')
+    ? [200, { content: [{ type: 'text', text: '{"svg":"<svg/>"}' }] }]
+    : [200, { choices: [{ message: { content: '{"svg":"<svg/>"}' } }], usage: { prompt_tokens: 1000, completion_tokens: 2000 } }]));
+  try {
+    const a = await providers.get('anthropic').svg({ system: 'sys', messages: [{ role: 'user', content: 'draw' }], model: 'claude-haiku-5-5' }, 'sk-ant-TEST');
+    assert.equal(a.text, '{"svg":"<svg/>"}');
+    const call = s.seen[0];
+    assert.equal(call.headers['x-api-key'], 'sk-ant-TEST');
+    assert.equal(call.headers['anthropic-version'], '2023-06-01');
+    assert.deepEqual([call.json.model, call.json.system, call.json.messages[0].content], ['claude-haiku-5-5', 'sys', 'draw']);
+    const o = await providers.get('openai').svg({ system: 'sys', messages: [{ role: 'user', content: 'draw' }], model: 'gpt-5.4-mini' }, 'sk-TEST');
+    assert.equal(o.cost.toFixed(6), (1000 * 0.75 / 1e6 + 2000 * 4.5 / 1e6).toFixed(6));
+    assert.deepEqual(s.seen[1].json.response_format, { type: 'json_object' });
+  } finally {
+    s.close();
+  }
+});
+
+test('an error from a provider is shown with any key masked', async () => {
+  const s = await standIn(() => [401, { error: { message: 'Incorrect API key provided: sk-abcdef123456 (Bearer sk-abcdef123456)' } }]);
+  try {
+    await assert.rejects(providers.get('xai').generate({ prompt: 'x', n: 1 }, 'sk-abcdef123456'), (e) => {
+      assert.doesNotMatch(e.message, /abcdef123456/);
+      assert.match(e.message, /sk-…/);
+      return true;
+    });
+  } finally {
+    s.close();
+  }
+});
+
+test('Claude Code: a session from a 0600 prompt file, no prompt text on the shell line, limited tools', async () => {
+  const cc = providers.get('claude_code_cli');
+  const calls = [];
+  const start = async (action, payload) => { calls.push({ action, payload }); return { ok: true }; };
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cc-'));
+  const secret = "a lighthouse; rm -rf ~ $(whoami) `id` 'quoted'";
+  try {
+    const r = await cc.startSession({ kind: 'generate', name: 'lighthouse', dir, prompt: secret, pixels: [1024, 1024], palette: 'blue #0074e0' }, start);
+    assert.equal(r.ok, true, r.error);
+    const { cmd, session } = calls[0].payload;
+    assert.equal(calls[0].action, 'start');
+    assert.equal(session, 'images--claude-lighthouse');
+    assert.doesNotMatch(cmd, /lighthouse;|whoami|rm -rf|quoted/, 'the prompt never reaches the line');
+    assert.match(cmd, /^claude -p "\$\(cat '[^']+\.txt'\)" /);
+    assert.match(cmd, /--allowedTools Write Read --disallowedTools Bash WebFetch WebSearch/);
+    assert.match(cmd, /&& node '[^']+images-claude-finish\.js' '[^']+\.job\.json'$/);
+    const promptFile = cmd.match(/cat '([^']+)'/)[1];
+    assert.equal(fs.statSync(promptFile).mode & 0o777, 0o600);
+    const prompt = fs.readFileSync(promptFile, 'utf8');
+    assert.match(prompt, /a lighthouse; rm -rf/);
+    assert.match(prompt, /lighthouse\.svg: one self-contained SVG with viewBox="0 0 1024 1024" and no width or height/);
+    assert.match(prompt, /Do not run any commands/);
+    const job = cmd.match(/'([^']+\.job\.json)'$/)[1];
+    assert.equal(fs.statSync(job).mode & 0o777, 0o600);
+    fs.rmSync(promptFile, { force: true });
+    fs.rmSync(job, { force: true });
+    fs.rmSync(path.join(path.dirname(path.dirname(promptFile)), `${session}.cwd`), { force: true });
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('Claude Code in the forms: no charge, watched on Screens, the confirm dialog still asked, SVG-only for edits', () => {
+  const p = ai.plan({ prompt: 'a lighthouse', provider: 'claude_code_cli', count: '3' });
+  assert.deepEqual([p.provider, p.n, p.estimate, p.quality], ['claude_code_cli', 1, 0, null]);
+  const html = ai.planHtml(p);
+  assert.match(html, /No API charge: it uses your own Claude Code login\./);
+  assert.match(html, /watch it on Screens/);
+  assert.match(html, /hx-trigger="confirmed-remove"/);
+  assert.deepEqual(ai.editProviders(true).map((x) => x.id), ['claude_code_cli']);
+  assert.ok(!ai.editProviders(false).some((x) => x.id === 'claude_code_cli'));
+  assert.match(read('actions/images.js'), /if \(r\.async\) return send\(startedHtml\(r\.session/);
+});
+
+test('the finish step sanitises the SVG and writes its records', () => {
+  const finish = require('../../scripts/images-claude-finish');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ccf-'));
+  try {
+    fs.writeFileSync(path.join(dir, 'pic.svg'), '<svg viewBox="0 0 10 10" onload="x()"><script>x()</script><rect width="5" height="5" fill="#0074e0"/></svg>');
+    fs.writeFileSync(path.join(dir, 'pic.claude.json'), JSON.stringify({ summary: 'A blue square.', alt: 'Blue square' }));
+    const job = path.join(dir, 'pic.job.json');
+    fs.writeFileSync(job, JSON.stringify({ kind: 'generate', name: 'pic', dir, prompt: 'a square', pixels: [10, 10], png: false }));
+    assert.equal(finish.main(job), 0);
+    const svg = fs.readFileSync(path.join(dir, 'pic.svg'), 'utf8');
+    assert.doesNotMatch(svg, /script|onload/);
+    assert.match(svg, /<rect /);
+    const side = JSON.parse(fs.readFileSync(path.join(dir, 'pic.svg.json'), 'utf8'));
+    assert.deepEqual([side.provider, side.summary, side.alt, side.prompt], ['claude_code_cli', 'A blue square.', 'Blue square', 'a square']);
+    assert.ok(!fs.existsSync(path.join(dir, 'pic.claude.json')));
+    assert.ok(!fs.existsSync(job));
+    assert.match(fs.readFileSync(path.join(dir, 'pic.md'), 'utf8'), /- \*\*Provider:\*\* claude_code_cli/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});