api2img 0.1.0

package/README.md

@@ -0,0 +1,56 @@
+# Api2img Skill
+
+## 功能
+为了 **解决通过中转 API 使用 Codex的用户无法生图的问题**。
+
+api2img 专门面向通过中转 API 使用 Codex，同时又有图片生成&编辑需求的人。
+
+
+## 优势
+
+- **简单**：一条指令安装。
+- **安全**：API Key 使用 Windows DPAPI 保存到当前用户本机，不要求把密钥贴到聊天里。
+- **不污染环境**：不会覆盖你原来的 `OPENAI_API_KEY`、`OPENAI_BASE_URL` 等变量，只在子进程里临时映射。
+
+
+## 安装
+
+方式1（小白推荐）：直接告诉你的 Agent：
+```powershell
+帮我安装这个 codex 技能：npx api2img
+```
+
+方式2：命令行输入：
+
+```powershell
+npx api2img
+```
+
+## 支持功能
+
+会在必要时自动被 codex 调用，正常生图用也可以使用，比如：
+
+- 【生成】生成一张xxx图
+- 【修改】替换图片里的某个部分
+- 【上传】修改我上传图片里的xxx
+
+### 使用流程
+
+```powershell
+1、第一次使用时，Codex 会自动引导你填写第三方生图 API 地址，并打开安全输入流程保存 API Key，不需要把密钥粘贴到聊天里。
+```
+其他功能（用自然语言跟 Codex 说）：
+```powershell
+2、我要修改 api2img 技能的 url 与 apikey
+```
+
+```powershell
+3、我要删除 api2img 技能的 url 与 apikey
+```
+
+
+
+## 注意
+
+- 生成图片会把提示词、上传的图片发送到你配置的三方中转商。
+- 请不要用不可信接口处理身份证件、人脸、工作机密等各类私人敏感内容。

package/SKILL.md

@@ -0,0 +1,122 @@
+---
+name: api2img
+description: Use first whenever the user asks to generate, edit, or modify an image.
+---
+
+# api2img
+
+## Priority
+
+Use this skill before other image generation paths when the user asks to create, edit, or modify bitmap images, unless they explicitly request another provider.
+
+This skill wraps the bundled image generation CLI:
+
+`$env:USERPROFILE\.codex\skills\.system\imagegen\scripts\image_gen.py`
+
+## Configuration
+
+Before the first generation call, check that both dedicated variables exist:
+
+- DPAPI-encrypted API key file at `scripts/api2img-api-key.dpapi.txt`
+- `CODEX_API2IMG_BASE_URL`
+
+Do not use or overwrite the user's existing `OPENAI_API_KEY`, `OPENAI_BASE_URL`, or other provider variables. The wrapper decrypts the api2img key and maps it to the `OPENAI_*` names only inside the child PowerShell process that runs the CLI.
+
+If the base URL is missing, ask the user for it. Once the user provides the base URL, run the configuration command immediately. Pass `-Language zh` when the current conversation with the user is in Chinese, `-Language en` when it is in English, or omit it only when the language is unclear. If the API key is missing or being rotated and the command is running in a redirected/non-interactive Codex shell, it automatically opens a visible PowerShell window for hidden key entry and returns instead of silently waiting in the background. Tell the user to enter the key in that window. The key is saved using Windows DPAPI for the current Windows user; the URL is saved only to `CODEX_API2IMG_BASE_URL`.
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File "$env:USERPROFILE\.codex\skills\api2img\scripts\configure-api2img.ps1" -BaseUrl "<url>" -Language zh
+```
+
+To rotate an existing saved key, pass `-UpdateKey`:
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File "$env:USERPROFILE\.codex\skills\api2img\scripts\configure-api2img.ps1" -UpdateKey -Language zh
+```
+
+To clear the saved api2img API key and base URL, pass `-Clear`:
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File "$env:USERPROFILE\.codex\skills\api2img\scripts\configure-api2img.ps1" -Clear -Language zh
+```
+
+`-Clear` only removes api2img's DPAPI key file, `CODEX_API2IMG_BASE_URL`, and the legacy `CODEX_API2IMG_API_KEY` user variable if present. It must not be combined with `-BaseUrl` or `-UpdateKey`, and it must not modify `OPENAI_API_KEY`, `OPENAI_BASE_URL`, or other provider variables.
+
+Do not ask the user to paste keys into chat. Do not pass keys on the command line. Do not print the key after storing it.
+
+If the command prints `Opened a visible PowerShell window for hidden key entry`, do not rerun it or wait on the background command. Ask the user to finish the prompt in the spawned window, then verify configuration before generation.
+
+## Privacy
+
+- Image generation sends the prompt to `CODEX_API2IMG_BASE_URL`.
+- Image editing sends the prompt plus the input image files, and mask files when present, to `CODEX_API2IMG_BASE_URL`.
+- Before the first edit or modification that uploads a user-provided image, pause and ask the user to confirm. In Chinese conversations, say: `提示：你上传的图片可能会被第三方 API 获取，请注意自己的信息安全。请回复确认继续，我再上传图片进行修改。`
+- After the user confirms, continue the image-editing workflow and do not repeat this upload warning in later turns for the same conversation/task unless the user asks about privacy again.
+- Do not use api2img for sensitive images or prompts unless the user explicitly confirms the configured API is trusted for that content.
+- Do not create extra local logs containing prompts, image paths, decrypted keys, or API responses.
+
+## Quick Start
+
+Run the wrapper with normal imagegen CLI arguments:
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File "$env:USERPROFILE\.codex\skills\api2img\scripts\invoke-api2img.ps1" generate --prompt "Primary request: a clean product mockup of a ceramic coffee mug" --size 1024x1024 --out "output\imagegen\mug.png"
+```
+
+Edit or modify an existing image with `edit` and one or more `--image` inputs:
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File "$env:USERPROFILE\.codex\skills\api2img\scripts\invoke-api2img.ps1" edit --image "input.png" --prompt "Primary request: change the background to a quiet studio setting while preserving the subject." --size 1024x1024 --out "output\imagegen/input-edited.png"
+```
+
+Use `--mask` when the user provides a mask or asks for a localized edit:
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File "$env:USERPROFILE\.codex\skills\api2img\scripts\invoke-api2img.ps1" edit --image "input.png" --mask "mask.png" --prompt "Primary request: replace only the masked area with fresh flowers." --size 1024x1024 --out "output\imagegen/input-masked-edit.png"
+```
+
+Use `--dry-run` to validate payloads without making an image request:
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File "$env:USERPROFILE\.codex\skills\api2img\scripts\invoke-api2img.ps1" generate --prompt "Primary request: test configuration" --size 1024x1024 --dry-run
+```
+
+## Workflow
+
+1. Check configuration before the first generation attempt.
+2. For image edits or modifications, complete the one-time upload confirmation gate in `Privacy` before calling `edit`.
+3. Shape a concise structured prompt while preserving the user's intent.
+4. Run `scripts/invoke-api2img.ps1` with `generate`, `edit`, or `generate-batch`.
+5. Use `edit --image <path>` when the user provides an existing image and asks to revise, transform, restyle, remove, replace, or otherwise modify it. Use `--mask <path>` for mask-constrained edits.
+6. Save assets in the workspace, normally under `output/imagegen/` unless the user names another path.
+7. Inspect the generated or edited file when visual quality matters.
+8. Report the saved path and mention that `api2img` was used.
+
+## Reliability
+
+- Image generation can take several minutes. Use 300000-600000 ms timeouts for a single 1024x1024 image, and longer for edits, batches, or large outputs.
+- Do not treat a shell timeout as proof that generation failed. First check the expected output path and `output/imagegen/` for new files.
+- If the command times out, check whether a Python/imagegen process is still running before retrying.
+- If an output file appears after a timeout, inspect it and continue from it instead of rerunning the same prompt.
+- For long prompts on Windows, store the prompt in a here-string variable and invoke the script with `& $script generate --prompt $prompt ...`.
+
+## Prompt Shape
+
+```text
+Use case: <photorealistic-natural | product-mockup | ui-mockup | illustration-story | stylized-concept | logo-brand | precise-object-edit>
+Asset type: <where it will be used>
+Primary request: <user request>
+Style/medium: <photo, illustration, 3D, etc.>
+Composition/framing: <wide, close-up, centered, etc.>
+Lighting/mood: <if relevant>
+Text (verbatim): "<exact text, if any>"
+Constraints: <must keep / must avoid>
+Avoid: no watermark, no unintended text
+```
+
+## Output Notes
+
+- The bundled CLI default output is `output/imagegen/output.png`.
+- Use `--out` or `--out-dir` when the user names a destination.
+- Do not overwrite existing assets unless the user explicitly requested replacement.
+- For multiple distinct assets, run one prompt per asset or use `generate-batch`; do not use `--n` as a substitute for different prompts.

package/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "api2img"
+  short_description: "Use first for image generation and edits."
+  default_prompt: "Use $api2img to generate, edit, or modify an image."

package/bin/install.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+
+const fs = require("fs");
+const path = require("path");
+
+const packageRoot = path.resolve(__dirname, "..");
+const home = process.env.USERPROFILE || process.env.HOME;
+
+if (!home) {
+  console.error("Cannot find USERPROFILE or HOME. Please install manually into .codex/skills/api2img.");
+  process.exit(1);
+}
+
+const target = path.join(home, ".codex", "skills", "api2img");
+const entries = ["SKILL.md", "README.md", "agents", "scripts"];
+const excludedNames = new Set([
+  "api2img-api-key.dpapi.txt",
+  "node_modules",
+  "output",
+  ".git"
+]);
+
+function copyRecursive(source, destination) {
+  const stat = fs.statSync(source);
+
+  if (stat.isDirectory()) {
+    fs.mkdirSync(destination, { recursive: true });
+    for (const child of fs.readdirSync(source)) {
+      if (excludedNames.has(child)) continue;
+      copyRecursive(path.join(source, child), path.join(destination, child));
+    }
+    return;
+  }
+
+  fs.mkdirSync(path.dirname(destination), { recursive: true });
+  fs.copyFileSync(source, destination);
+}
+
+fs.mkdirSync(target, { recursive: true });
+
+for (const entry of entries) {
+  copyRecursive(path.join(packageRoot, entry), path.join(target, entry));
+}
+
+console.log(`api2img Codex skill installed to: ${target}`);
+console.log("Restart Codex if it does not pick up the skill immediately.");

package/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "api2img",
+  "version": "0.1.0",
+  "description": "Install the api2img Codex skill for image generation and editing through a relay API.",
+  "bin": {
+    "api2img": "bin/install.js"
+  },
+  "files": [
+    "SKILL.md",
+    "README.md",
+    "agents",
+    "scripts",
+    "bin"
+  ],
+  "license": "MIT"
+}

package/scripts/configure-api2img.ps1

@@ -0,0 +1,150 @@
+param(
+  [string] $BaseUrl,
+
+  [switch] $UpdateKey,
+
+  [switch] $Clear,
+
+  [switch] $NoRelaunch,
+
+  [ValidateSet("auto", "zh", "en")]
+  [string] $Language = "auto"
+)
+
+$ErrorActionPreference = "Stop"
+
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$keyFile = Join-Path $scriptDir "api2img-api-key.dpapi.txt"
+
+$keyExists = Test-Path -LiteralPath $keyFile
+$shouldPromptKey = $UpdateKey -or -not $keyExists
+
+function Resolve-Language {
+  param([string] $RequestedLanguage)
+
+  if ($RequestedLanguage -in @("zh", "en")) {
+    return $RequestedLanguage
+  }
+
+  if ([System.Globalization.CultureInfo]::CurrentUICulture.Name -like "zh*") {
+    return "zh"
+  }
+
+  return "en"
+}
+
+function Decode-Text {
+  param([string] $Base64Text)
+  [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($Base64Text))
+}
+
+$resolvedLanguage = Resolve-Language -RequestedLanguage $Language
+
+$messages = @{
+  en = @{
+    NoChanges = "No changes requested. Provide -BaseUrl, pass -UpdateKey to replace the saved API key, or pass -Clear to remove api2img configuration."
+    ClearCannotCombine = "-Clear cannot be combined with -BaseUrl or -UpdateKey."
+    Cleared = "api2img configuration cleared:"
+    KeyCleared = "API key=<DPAPI key file removed>"
+    UrlCleared = "CODEX_API2IMG_BASE_URL=<removed>"
+    LegacyKeyCleared = "CODEX_API2IMG_API_KEY=<legacy user variable removed if present>"
+    OpenedWindow = "api2img needs an API key. Opened a visible PowerShell window for hidden key entry."
+    EnterKey = "Enter the api2img API key. Input is hidden and will be saved with Windows DPAPI for this user."
+    Prompt = "API key"
+    Saved = "api2img configuration saved:"
+    KeySaved = "API key=<DPAPI encrypted for current Windows user>"
+    KeyPreserved = "API key=<existing DPAPI key preserved>"
+  }
+  zh = @{
+    NoChanges = (Decode-Text "5rKh5pyJ6ZyA6KaB5L+u5pS555qE6YWN572u44CC6K+35o+Q5L6bIC1CYXNlVXJs77yM5oiW5L2/55SoIC1VcGRhdGVLZXkg5pu/5o2i5bey5L+d5a2Y55qEIEFQSSBrZXnvvIzkuZ/lj6/ku6Xkvb/nlKggLUNsZWFyIOa4heepuiBhcGkyaW1nIOmFjee9ruOAgg==")
+    ClearCannotCombine = (Decode-Text "LUNsZWFyIOS4jeiDveWSjCAtQmFzZVVybCDmiJYgLVVwZGF0ZUtleSDlkIzml7bkvb/nlKjjgII=")
+    Cleared = (Decode-Text "YXBpMmltZyDphY3nva7lt7LmuIXnqbrvvJo=")
+    KeyCleared = (Decode-Text "QVBJIGtleT085bey5Yig6ZmkIERQQVBJIGtleSDmlofku7Y+")
+    UrlCleared = (Decode-Text "Q09ERVhfQVBJMklNR19CQVNFX1VSTD085bey56e76ZmkPg==")
+    LegacyKeyCleared = (Decode-Text "Q09ERVhfQVBJMklNR19BUElfS0VZPTzlt7Lnp7vpmaTml6fniYjnlKjmiLflj5jph4/vvIzlpoLlrZjlnKg+")
+    OpenedWindow = (Decode-Text "YXBpMmltZyDpnIDopoEgQVBJIGtleeOAguW3suaJk+W8gOS4gOS4quWPr+ingeeahCBQb3dlclNoZWxsIOeql+WPo++8jOivt+WcqOWFtuS4rei+k+WFpemakOiXj+eahCBrZXnjgII=")
+    EnterKey = (Decode-Text "6K+36L6T5YWlIGFwaTJpbWcgQVBJIGtleeOAgui+k+WFpeWGheWuueS8mumakOiXj++8jOW5tuS8muS9v+eUqOW9k+WJjSBXaW5kb3dzIOeUqOaIt+eahCBEUEFQSSDliqDlr4bkv53lrZjjgII=")
+    Prompt = "API key"
+    Saved = (Decode-Text "YXBpMmltZyDphY3nva7lt7Lkv53lrZjvvJo=")
+    KeySaved = (Decode-Text "QVBJIGtleT085bey5L2/55So5b2T5YmNIFdpbmRvd3Mg55So5oi355qEIERQQVBJIOWKoOWvhuS/neWtmD4=")
+    KeyPreserved = (Decode-Text "QVBJIGtleT085L+d55WZ546w5pyJIERQQVBJIOWKoOWvhiBrZXk+")
+  }
+}
+
+if ($Clear -and (-not [string]::IsNullOrWhiteSpace($BaseUrl) -or $UpdateKey)) {
+  throw $messages[$resolvedLanguage].ClearCannotCombine
+}
+
+if ($Clear) {
+  if (Test-Path -LiteralPath $keyFile) {
+    Remove-Item -LiteralPath $keyFile -Force
+  }
+  [Environment]::SetEnvironmentVariable("CODEX_API2IMG_BASE_URL", $null, "User")
+  [Environment]::SetEnvironmentVariable("CODEX_API2IMG_API_KEY", $null, "User")
+  Remove-Item Env:\CODEX_API2IMG_BASE_URL -ErrorAction SilentlyContinue
+  Remove-Item Env:\CODEX_API2IMG_API_KEY -ErrorAction SilentlyContinue
+
+  Write-Host $messages[$resolvedLanguage].Cleared
+  Write-Host $messages[$resolvedLanguage].KeyCleared
+  Write-Host $messages[$resolvedLanguage].UrlCleared
+  Write-Host $messages[$resolvedLanguage].LegacyKeyCleared
+  exit 0
+}
+
+if ([string]::IsNullOrWhiteSpace($BaseUrl) -and -not $shouldPromptKey) {
+  throw $messages[$resolvedLanguage].NoChanges
+}
+
+function Quote-Argument {
+  param([string] $Value)
+  '"' + ($Value -replace '"', '\"') + '"'
+}
+
+if ($shouldPromptKey -and -not $NoRelaunch -and ([Console]::IsInputRedirected -or [Console]::IsOutputRedirected)) {
+  $arguments = @(
+    "-NoProfile",
+    "-ExecutionPolicy", "Bypass",
+    "-NoExit",
+    "-File", (Quote-Argument $PSCommandPath),
+    "-NoRelaunch",
+    "-Language", $resolvedLanguage
+  )
+
+  if (-not [string]::IsNullOrWhiteSpace($BaseUrl)) {
+    $arguments += @("-BaseUrl", (Quote-Argument $BaseUrl))
+  }
+
+  if ($UpdateKey) {
+    $arguments += "-UpdateKey"
+  }
+
+  Start-Process powershell -ArgumentList ($arguments -join " ")
+  Write-Host $messages[$resolvedLanguage].OpenedWindow
+  exit 0
+}
+
+if ($shouldPromptKey) {
+  Write-Host $messages[$resolvedLanguage].EnterKey
+  $secureKey = Read-Host -Prompt $messages[$resolvedLanguage].Prompt -AsSecureString
+  $encryptedKey = ConvertFrom-SecureString -SecureString $secureKey
+  Set-Content -LiteralPath $keyFile -Value $encryptedKey -Encoding ASCII
+
+  # Remove the legacy plaintext user variable if it exists from an older api2img setup.
+  if (-not [string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable("CODEX_API2IMG_API_KEY", "User"))) {
+    [Environment]::SetEnvironmentVariable("CODEX_API2IMG_API_KEY", $null, "User")
+  }
+}
+
+if (-not [string]::IsNullOrWhiteSpace($BaseUrl)) {
+  [Environment]::SetEnvironmentVariable("CODEX_API2IMG_BASE_URL", $BaseUrl.TrimEnd("/"), "User")
+}
+
+Write-Host $messages[$resolvedLanguage].Saved
+if ($shouldPromptKey) {
+  Write-Host $messages[$resolvedLanguage].KeySaved
+} else {
+  Write-Host $messages[$resolvedLanguage].KeyPreserved
+}
+if (-not [string]::IsNullOrWhiteSpace($BaseUrl)) {
+  Write-Host "CODEX_API2IMG_BASE_URL=$($BaseUrl.TrimEnd('/'))"
+}

package/scripts/invoke-api2img.ps1

@@ -0,0 +1,12 @@
+$ErrorActionPreference = "Stop"
+
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+. (Join-Path $scriptDir "load-api2img-env.ps1")
+
+$imageGenScript = Join-Path $env:USERPROFILE ".codex\skills\.system\imagegen\scripts\image_gen.py"
+
+if (-not (Test-Path -LiteralPath $imageGenScript)) {
+  throw "Missing image generation CLI script: $imageGenScript"
+}
+
+python $imageGenScript @args

package/scripts/load-api2img-env.ps1

@@ -0,0 +1,43 @@
+# Loads api2img credentials for this PowerShell process only.
+# The API key is stored as a DPAPI-encrypted file for the current Windows user.
+# The base URL is stored in the dedicated CODEX_API2IMG_BASE_URL variable.
+
+$ErrorActionPreference = "Stop"
+
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$keyFile = Join-Path $scriptDir "api2img-api-key.dpapi.txt"
+
+$apiKey = $null
+if (Test-Path -LiteralPath $keyFile) {
+  $encryptedKey = (Get-Content -Raw -LiteralPath $keyFile).Trim()
+  $secureKey = ConvertTo-SecureString -String $encryptedKey
+  $credential = [System.Management.Automation.PSCredential]::new("api2img", $secureKey)
+  $apiKey = $credential.GetNetworkCredential().Password
+}
+
+$baseUrl = [Environment]::GetEnvironmentVariable("CODEX_API2IMG_BASE_URL", "Process")
+if ([string]::IsNullOrWhiteSpace($baseUrl)) {
+  $baseUrl = [Environment]::GetEnvironmentVariable("CODEX_API2IMG_BASE_URL", "User")
+}
+
+$missing = @()
+if ([string]::IsNullOrWhiteSpace($apiKey)) { $missing += "DPAPI encrypted API key" }
+if ([string]::IsNullOrWhiteSpace($baseUrl)) { $missing += "CODEX_API2IMG_BASE_URL" }
+
+if ($missing.Count -gt 0) {
+  $configure = Join-Path $scriptDir "configure-api2img.ps1"
+  throw @"
+api2img is not configured. Missing: $($missing -join ', ')
+
+Ask the user for the base URL, then have them enter the image API key only through the hidden terminal prompt:
+powershell -NoProfile -ExecutionPolicy Bypass -File "$configure" -BaseUrl "<url>"
+
+The key is entered interactively and saved with Windows DPAPI for the current user. The URL is saved only to CODEX_API2IMG_BASE_URL. This does not modify OPENAI_API_KEY or OPENAI_BASE_URL.
+"@
+}
+
+$env:OPENAI_API_KEY = $apiKey
+$env:OPENAI_BASE_URL = $baseUrl.TrimEnd("/")
+
+Write-Host "api2img environment loaded for this PowerShell process only."
+Write-Host "CODEX_API2IMG_BASE_URL=$env:OPENAI_BASE_URL"