opc-agent 3.0.1 → 4.0.1

package/src/tools/image-generator.ts

@@ -0,0 +1,150 @@
+/**
+ * Image Generator — multi-backend image generation tool.
+ * Supports DALL·E (OpenAI), Stable Diffusion (local), and Replicate.
+ */
+
+export interface ImageGenConfig {
+  provider?: 'dalle' | 'stable-diffusion' | 'replicate';
+  openaiApiKey?: string;
+  replicateApiKey?: string;
+  sdApiUrl?: string;
+  defaultModel?: string;
+  defaultSize?: string;
+}
+
+export interface ImageGenResult {
+  success: boolean;
+  url?: string;
+  base64?: string;
+  error?: string;
+  provider: string;
+}
+
+export class ImageGenerator {
+  private config: ImageGenConfig;
+
+  constructor(config?: ImageGenConfig) {
+    this.config = {
+      provider: config?.provider,
+      openaiApiKey: config?.openaiApiKey || process.env.OPENAI_API_KEY,
+      replicateApiKey: config?.replicateApiKey || process.env.REPLICATE_API_TOKEN,
+      sdApiUrl: config?.sdApiUrl || process.env.SD_API_URL,
+      defaultModel: config?.defaultModel || 'dall-e-3',
+      defaultSize: config?.defaultSize || '1024x1024',
+    };
+  }
+
+  /** Auto-detect best available provider */
+  detectProvider(): string | null {
+    if (this.config.openaiApiKey) return 'dalle';
+    if (this.config.sdApiUrl) return 'stable-diffusion';
+    if (this.config.replicateApiKey) return 'replicate';
+    return null;
+  }
+
+  /** Get configuration status for the settings UI */
+  getStatus(): { configured: boolean; providers: { name: string; configured: boolean }[] } {
+    return {
+      configured: !!this.detectProvider(),
+      providers: [
+        { name: 'dalle', configured: !!this.config.openaiApiKey },
+        { name: 'stable-diffusion', configured: !!this.config.sdApiUrl },
+        { name: 'replicate', configured: !!this.config.replicateApiKey },
+      ],
+    };
+  }
+
+  async generate(prompt: string, options?: { provider?: string; size?: string; model?: string }): Promise<ImageGenResult> {
+    const provider = options?.provider || this.config.provider || this.detectProvider();
+    if (!provider) {
+      return { success: false, error: 'No image generation provider configured. Please set OPENAI_API_KEY, SD_API_URL, or REPLICATE_API_TOKEN.', provider: 'none' };
+    }
+
+    switch (provider) {
+      case 'dalle': return this.generateDalle(prompt, options);
+      case 'stable-diffusion': return this.generateSD(prompt, options);
+      case 'replicate': return this.generateReplicate(prompt, options);
+      default: return { success: false, error: `Unknown provider: ${provider}`, provider };
+    }
+  }
+
+  private async generateDalle(prompt: string, options?: { size?: string; model?: string }): Promise<ImageGenResult> {
+    const apiKey = this.config.openaiApiKey;
+    if (!apiKey) return { success: false, error: 'OPENAI_API_KEY not configured', provider: 'dalle' };
+
+    try {
+      const res = await fetch('https://api.openai.com/v1/images/generations', {
+        method: 'POST',
+        headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          model: options?.model || this.config.defaultModel || 'dall-e-3',
+          prompt,
+          size: options?.size || this.config.defaultSize || '1024x1024',
+          n: 1,
+        }),
+      });
+      const data = await res.json() as { data?: Array<{ url: string }>; error?: { message: string } };
+      if (data.error) return { success: false, error: data.error.message, provider: 'dalle' };
+      const url = data.data?.[0]?.url;
+      return url ? { success: true, url, provider: 'dalle' } : { success: false, error: 'No image returned', provider: 'dalle' };
+    } catch (err) {
+      return { success: false, error: (err as Error).message, provider: 'dalle' };
+    }
+  }
+
+  private async generateSD(prompt: string, options?: { size?: string }): Promise<ImageGenResult> {
+    const apiUrl = this.config.sdApiUrl;
+    if (!apiUrl) return { success: false, error: 'SD_API_URL not configured', provider: 'stable-diffusion' };
+
+    try {
+      const [w, h] = (options?.size || '1024x1024').split('x').map(Number);
+      const res = await fetch(`${apiUrl}/sdapi/v1/txt2img`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ prompt, width: w || 1024, height: h || 1024 }),
+      });
+      const data = await res.json() as { images?: string[] };
+      if (data.images?.length) {
+        return { success: true, base64: data.images[0], provider: 'stable-diffusion' };
+      }
+      return { success: false, error: 'No image generated', provider: 'stable-diffusion' };
+    } catch (err) {
+      return { success: false, error: (err as Error).message, provider: 'stable-diffusion' };
+    }
+  }
+
+  private async generateReplicate(prompt: string, _options?: { model?: string }): Promise<ImageGenResult> {
+    const apiKey = this.config.replicateApiKey;
+    if (!apiKey) return { success: false, error: 'REPLICATE_API_TOKEN not configured', provider: 'replicate' };
+
+    try {
+      const res = await fetch('https://api.replicate.com/v1/predictions', {
+        method: 'POST',
+        headers: { 'Authorization': `Token ${apiKey}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          version: 'stability-ai/sdxl:39ed52f2a78e934b3ba6e2a89f5b1c712de7dfea535525255b1aa35c5565e08b',
+          input: { prompt },
+        }),
+      });
+      const prediction = await res.json() as { id: string; urls?: { get: string }; error?: string };
+      if (prediction.error) return { success: false, error: prediction.error, provider: 'replicate' };
+
+      // Poll for completion (max 60s)
+      const getUrl = prediction.urls?.get || `https://api.replicate.com/v1/predictions/${prediction.id}`;
+      for (let i = 0; i < 30; i++) {
+        await new Promise(r => setTimeout(r, 2000));
+        const poll = await fetch(getUrl, { headers: { 'Authorization': `Token ${apiKey}` } });
+        const result = await poll.json() as { status: string; output?: string[]; error?: string };
+        if (result.status === 'succeeded' && result.output?.length) {
+          return { success: true, url: result.output[0], provider: 'replicate' };
+        }
+        if (result.status === 'failed') {
+          return { success: false, error: result.error || 'Generation failed', provider: 'replicate' };
+        }
+      }
+      return { success: false, error: 'Timeout waiting for image generation', provider: 'replicate' };
+    } catch (err) {
+      return { success: false, error: (err as Error).message, provider: 'replicate' };
+    }
+  }
+}

package/src/tools/web-scraper.ts

@@ -0,0 +1,179 @@
+/**
+ * Web Scraper - v0.10.0
+ * Fetch URL content and extract readable text in markdown format.
+ * Uses a simple readability-style extraction (no external dependencies).
+ */
+
+export interface ScrapedContent {
+  title: string;
+  content: string;  // markdown
+  url: string;
+  wordCount: number;
+}
+
+const MAX_CONTENT_LENGTH = 5000;
+
+/**
+ * Fetch a URL and extract readable content as markdown.
+ */
+export async function scrapeUrl(url: string, maxLength = MAX_CONTENT_LENGTH): Promise<ScrapedContent> {
+  const response = await fetch(url, {
+    headers: {
+      'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
+      Accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+    },
+    signal: AbortSignal.timeout(15000),
+    redirect: 'follow',
+  });
+
+  const contentType = response.headers.get('content-type') || '';
+  const text = await response.text();
+
+  // If not HTML, return raw text
+  if (!contentType.includes('html')) {
+    const truncated = text.slice(0, maxLength);
+    return {
+      title: url,
+      content: truncated,
+      url,
+      wordCount: truncated.split(/\s+/).length,
+    };
+  }
+
+  return extractReadableContent(text, url, maxLength);
+}
+
+/**
+ * Extract readable content from HTML using simple heuristics.
+ */
+export function extractReadableContent(html: string, url: string, maxLength = MAX_CONTENT_LENGTH): ScrapedContent {
+  // Extract title
+  const titleMatch = html.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
+  const title = titleMatch ? decodeEntities(titleMatch[1]).trim() : url;
+
+  // Remove non-content elements
+  let content = html;
+
+  // Remove script, style, nav, header, footer, aside, iframe
+  const removePatterns = [
+    /<script[\s\S]*?<\/script>/gi,
+    /<style[\s\S]*?<\/style>/gi,
+    /<nav[\s\S]*?<\/nav>/gi,
+    /<footer[\s\S]*?<\/footer>/gi,
+    /<aside[\s\S]*?<\/aside>/gi,
+    /<iframe[\s\S]*?<\/iframe>/gi,
+    /<noscript[\s\S]*?<\/noscript>/gi,
+    /<!--[\s\S]*?-->/g,
+  ];
+
+  for (const pattern of removePatterns) {
+    content = content.replace(pattern, '');
+  }
+
+  // Try to find main content area
+  const mainContent = findMainContent(content);
+  content = mainContent || content;
+
+  // Convert to markdown-ish text
+  content = htmlToMarkdown(content);
+
+  // Clean up whitespace
+  content = content
+    .replace(/\n{3,}/g, '\n\n')
+    .replace(/[ \t]+/g, ' ')
+    .trim();
+
+  // Truncate
+  if (content.length > maxLength) {
+    content = content.slice(0, maxLength) + '\n\n...[truncated]';
+  }
+
+  return {
+    title,
+    content,
+    url,
+    wordCount: content.split(/\s+/).filter(Boolean).length,
+  };
+}
+
+/**
+ * Try to find the main content area of the page.
+ */
+function findMainContent(html: string): string | null {
+  // Try common content selectors
+  const patterns = [
+    /<article[^>]*>([\s\S]*?)<\/article>/i,
+    /<main[^>]*>([\s\S]*?)<\/main>/i,
+    /<div[^>]*class="[^"]*(?:content|article|post|entry|main)[^"]*"[^>]*>([\s\S]*?)<\/div>/i,
+    /<div[^>]*id="[^"]*(?:content|article|post|entry|main)[^"]*"[^>]*>([\s\S]*?)<\/div>/i,
+  ];
+
+  for (const pattern of patterns) {
+    const match = html.match(pattern);
+    if (match && match[1] && match[1].length > 200) {
+      return match[1];
+    }
+  }
+
+  // Fallback: find body content
+  const bodyMatch = html.match(/<body[^>]*>([\s\S]*?)<\/body>/i);
+  return bodyMatch ? bodyMatch[1] : null;
+}
+
+/**
+ * Simple HTML to Markdown conversion.
+ */
+function htmlToMarkdown(html: string): string {
+  let md = html;
+
+  // Headers
+  md = md.replace(/<h1[^>]*>([\s\S]*?)<\/h1>/gi, '\n# $1\n');
+  md = md.replace(/<h2[^>]*>([\s\S]*?)<\/h2>/gi, '\n## $1\n');
+  md = md.replace(/<h3[^>]*>([\s\S]*?)<\/h3>/gi, '\n### $1\n');
+  md = md.replace(/<h4[^>]*>([\s\S]*?)<\/h4>/gi, '\n#### $1\n');
+  md = md.replace(/<h5[^>]*>([\s\S]*?)<\/h5>/gi, '\n##### $1\n');
+  md = md.replace(/<h6[^>]*>([\s\S]*?)<\/h6>/gi, '\n###### $1\n');
+
+  // Paragraphs and line breaks
+  md = md.replace(/<p[^>]*>/gi, '\n');
+  md = md.replace(/<\/p>/gi, '\n');
+  md = md.replace(/<br\s*\/?>/gi, '\n');
+
+  // Links
+  md = md.replace(/<a[^>]*href="([^"]*)"[^>]*>([\s\S]*?)<\/a>/gi, '[$2]($1)');
+
+  // Bold and italic
+  md = md.replace(/<(?:strong|b)[^>]*>([\s\S]*?)<\/(?:strong|b)>/gi, '**$1**');
+  md = md.replace(/<(?:em|i)[^>]*>([\s\S]*?)<\/(?:em|i)>/gi, '*$1*');
+
+  // Code
+  md = md.replace(/<code[^>]*>([\s\S]*?)<\/code>/gi, '`$1`');
+  md = md.replace(/<pre[^>]*>([\s\S]*?)<\/pre>/gi, '\n```\n$1\n```\n');
+
+  // Lists
+  md = md.replace(/<li[^>]*>([\s\S]*?)<\/li>/gi, '- $1\n');
+
+  // Blockquote
+  md = md.replace(/<blockquote[^>]*>([\s\S]*?)<\/blockquote>/gi, '\n> $1\n');
+
+  // Remove remaining HTML tags
+  md = md.replace(/<[^>]+>/g, '');
+
+  // Decode entities
+  md = decodeEntities(md);
+
+  return md;
+}
+
+function decodeEntities(text: string): string {
+  return text
+    .replace(/&amp;/g, '&')
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&#x27;/g, "'")
+    .replace(/&#39;/g, "'")
+    .replace(/&nbsp;/g, ' ')
+    .replace(/&#(\d+);/g, (_, n) => String.fromCharCode(parseInt(n)))
+    .replace(/&#x([0-9a-fA-F]+);/g, (_, n) => String.fromCharCode(parseInt(n, 16)));
+}

package/src/tools/web-search.ts

@@ -0,0 +1,180 @@
+/**
+ * Web Search Engine Manager - v0.10.0
+ * Supports multiple search backends with automatic fallback.
+ * Default: DuckDuckGo (free, no API key required).
+ */
+
+export interface SearchResult {
+  title: string;
+  url: string;
+  snippet: string;
+}
+
+export interface SearchOptions {
+  maxResults?: number;
+  engine?: SearchEngine;
+}
+
+export type SearchEngine = 'duckduckgo' | 'brave' | 'searxng' | 'google';
+
+export interface SearchEngineConfig {
+  enabled: boolean;
+  apiKey?: string;
+  baseUrl?: string;  // For SearXNG self-hosted
+}
+
+export interface WebSearchConfig {
+  defaultEngine: SearchEngine;
+  enabled: boolean;
+  engines: Partial<Record<SearchEngine, SearchEngineConfig>>;
+}
+
+export const DEFAULT_SEARCH_CONFIG: WebSearchConfig = {
+  defaultEngine: 'duckduckgo',
+  enabled: true,
+  engines: {
+    duckduckgo: { enabled: true },
+  },
+};
+
+/**
+ * Parse DuckDuckGo HTML search results.
+ */
+export function parseDuckDuckGoHTML(html: string): SearchResult[] {
+  const results: SearchResult[] = [];
+  // Match result blocks: <a class="result__a" href="...">title</a> ... <a class="result__snippet">snippet</a>
+  const resultBlocks = html.split(/class="result__body"/);
+
+  for (let i = 1; i < resultBlocks.length && results.length < 10; i++) {
+    const block = resultBlocks[i];
+
+    // Extract URL and title from result__a
+    const linkMatch = block.match(/class="result__a"[^>]*href="([^"]*)"[^>]*>([\s\S]*?)<\/a>/);
+    if (!linkMatch) continue;
+
+    let url = linkMatch[1];
+    const title = stripHTML(linkMatch[2]).trim();
+
+    // DuckDuckGo wraps URLs in redirect, extract actual URL
+    const uddgMatch = url.match(/[?&]uddg=([^&]+)/);
+    if (uddgMatch) {
+      url = decodeURIComponent(uddgMatch[1]);
+    }
+
+    // Extract snippet
+    const snippetMatch = block.match(/class="result__snippet"[^>]*>([\s\S]*?)<\/a>/);
+    const snippet = snippetMatch ? stripHTML(snippetMatch[1]).trim() : '';
+
+    if (title && url) {
+      results.push({ title, url, snippet });
+    }
+  }
+
+  return results;
+}
+
+/**
+ * Search using DuckDuckGo HTML interface (no API key needed).
+ */
+export async function searchDuckDuckGo(query: string, maxResults = 5): Promise<SearchResult[]> {
+  const url = `https://html.duckduckgo.com/html/?q=${encodeURIComponent(query)}`;
+  const response = await fetch(url, {
+    headers: {
+      'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
+    },
+    signal: AbortSignal.timeout(15000),
+  });
+  const html = await response.text();
+  return parseDuckDuckGoHTML(html).slice(0, maxResults);
+}
+
+/**
+ * Search using Brave Search API.
+ */
+export async function searchBrave(query: string, apiKey: string, maxResults = 5): Promise<SearchResult[]> {
+  const url = `https://api.search.brave.com/res/v1/web/search?q=${encodeURIComponent(query)}&count=${maxResults}`;
+  const response = await fetch(url, {
+    headers: { 'X-Subscription-Token': apiKey, Accept: 'application/json' },
+    signal: AbortSignal.timeout(15000),
+  });
+  const data = await response.json() as any;
+  return (data.web?.results || []).slice(0, maxResults).map((r: any) => ({
+    title: r.title || '',
+    url: r.url || '',
+    snippet: r.description || '',
+  }));
+}
+
+/**
+ * Search using SearXNG instance.
+ */
+export async function searchSearXNG(query: string, baseUrl: string, maxResults = 5): Promise<SearchResult[]> {
+  const url = `${baseUrl.replace(/\/$/, '')}/search?q=${encodeURIComponent(query)}&format=json`;
+  const response = await fetch(url, { signal: AbortSignal.timeout(15000) });
+  const data = await response.json() as any;
+  return (data.results || []).slice(0, maxResults).map((r: any) => ({
+    title: r.title || '',
+    url: r.url || '',
+    snippet: r.content || '',
+  }));
+}
+
+/**
+ * Search using Google Custom Search API.
+ */
+export async function searchGoogle(query: string, apiKey: string, maxResults = 5): Promise<SearchResult[]> {
+  // apiKey format: "key:cx" (API key and Custom Search Engine ID)
+  const [key, cx] = apiKey.split(':');
+  const url = `https://www.googleapis.com/customsearch/v1?q=${encodeURIComponent(query)}&key=${key}&cx=${cx}&num=${maxResults}`;
+  const response = await fetch(url, { signal: AbortSignal.timeout(15000) });
+  const data = await response.json() as any;
+  return (data.items || []).slice(0, maxResults).map((r: any) => ({
+    title: r.title || '',
+    url: r.link || '',
+    snippet: r.snippet || '',
+  }));
+}
+
+/**
+ * Unified search function with fallback.
+ */
+export async function webSearch(query: string, config?: WebSearchConfig, options?: SearchOptions): Promise<SearchResult[]> {
+  const cfg = config || DEFAULT_SEARCH_CONFIG;
+  if (!cfg.enabled) return [];
+
+  const maxResults = options?.maxResults || 5;
+  const engine = options?.engine || cfg.defaultEngine;
+
+  // Try requested engine first, then fallback chain
+  const fallbackOrder: SearchEngine[] = [engine, 'duckduckgo', 'brave', 'searxng', 'google']
+    .filter((e, i, arr) => arr.indexOf(e) === i) as SearchEngine[];
+
+  for (const eng of fallbackOrder) {
+    const engCfg = cfg.engines[eng];
+    if (engCfg && !engCfg.enabled) continue;
+
+    try {
+      switch (eng) {
+        case 'duckduckgo':
+          return await searchDuckDuckGo(query, maxResults);
+        case 'brave':
+          if (engCfg?.apiKey) return await searchBrave(query, engCfg.apiKey, maxResults);
+          continue;
+        case 'searxng':
+          if (engCfg?.baseUrl) return await searchSearXNG(query, engCfg.baseUrl, maxResults);
+          continue;
+        case 'google':
+          if (engCfg?.apiKey) return await searchGoogle(query, engCfg.apiKey, maxResults);
+          continue;
+      }
+    } catch {
+      continue; // Fallback to next engine
+    }
+  }
+
+  return [];
+}
+
+function stripHTML(html: string): string {
+  return html.replace(/<[^>]+>/g, '').replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&#x27;/g, "'").replace(/&nbsp;/g, ' ');
+}

package/tests/api-server.test.ts

@@ -0,0 +1,148 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { APIServer } from '../src/core/api-server';
+
+function createMockAgent(overrides: any = {}) {
+  return {
+    name: 'test-agent',
+    state: 'running',
+    config: { model: 'test-model', name: 'test-agent' },
+    chat: async (msg: string) => `echo: ${msg}`,
+    ...overrides,
+  };
+}
+
+async function request(port: number, method: string, path: string, body?: any, headers?: Record<string, string>) {
+  const res = await fetch(`http://127.0.0.1:${port}${path}`, {
+    method,
+    headers: { 'Content-Type': 'application/json', ...headers },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  return res;
+}
+
+describe('APIServer', () => {
+  let server: APIServer;
+  const port = 19876;
+
+  beforeAll(async () => {
+    server = new APIServer({ port, host: '127.0.0.1', agent: createMockAgent() });
+    await server.start();
+  });
+  afterAll(async () => { await server.stop(); });
+
+  it('GET /health returns ok', async () => {
+    const res = await request(port, 'GET', '/health');
+    expect(res.status).toBe(200);
+    const data: any = await res.json();
+    expect(data.status).toBe('ok');
+  });
+
+  it('GET /v1/models lists models', async () => {
+    const res = await request(port, 'GET', '/v1/models');
+    const data: any = await res.json();
+    expect(data.object).toBe('list');
+    expect(data.data[0].id).toBe('test-model');
+  });
+
+  it('GET /v1/agent/status returns agent info', async () => {
+    const res = await request(port, 'GET', '/v1/agent/status');
+    const data: any = await res.json();
+    expect(data.name).toBe('test-agent');
+    expect(data.state).toBe('running');
+  });
+
+  it('POST /v1/chat/completions non-streaming', async () => {
+    const res = await request(port, 'POST', '/v1/chat/completions', {
+      model: 'test-model',
+      messages: [{ role: 'user', content: 'hello' }],
+    });
+    expect(res.status).toBe(200);
+    const data: any = await res.json();
+    expect(data.choices[0].message.content).toBe('echo: hello');
+    expect(data.choices[0].finish_reason).toBe('stop');
+    expect(data.id).toMatch(/^chatcmpl-/);
+    expect(data.object).toBe('chat.completion');
+  });
+
+  it('POST /v1/chat/completions streaming', async () => {
+    const res = await request(port, 'POST', '/v1/chat/completions', {
+      messages: [{ role: 'user', content: 'hi' }],
+      stream: true,
+    });
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toBe('text/event-stream');
+    const text = await res.text();
+    expect(text).toContain('data: ');
+    expect(text).toContain('[DONE]');
+    // Parse SSE chunks
+    const chunks = text.split('\n').filter(l => l.startsWith('data: ') && !l.includes('[DONE]'));
+    expect(chunks.length).toBeGreaterThan(0);
+    const first = JSON.parse(chunks[0].slice(6));
+    expect(first.object).toBe('chat.completion.chunk');
+  });
+
+  it('POST /v1/chat/completions rejects missing messages', async () => {
+    const res = await request(port, 'POST', '/v1/chat/completions', { model: 'x' });
+    expect(res.status).toBe(400);
+    const data: any = await res.json();
+    expect(data.error.type).toBe('invalid_request_error');
+  });
+
+  it('POST /v1/chat/completions rejects invalid JSON', async () => {
+    const res = await fetch(`http://127.0.0.1:${port}/v1/chat/completions`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not json',
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it('OPTIONS returns CORS headers', async () => {
+    const res = await fetch(`http://127.0.0.1:${port}/v1/models`, { method: 'OPTIONS' });
+    expect(res.status).toBe(204);
+    expect(res.headers.get('access-control-allow-origin')).toBe('*');
+  });
+
+  it('unknown route returns 404', async () => {
+    const res = await request(port, 'GET', '/v1/unknown');
+    expect(res.status).toBe(404);
+    const data: any = await res.json();
+    expect(data.error.code).toBe(404);
+  });
+
+  it('POST /v1/embeddings returns 501 without embed provider', async () => {
+    const res = await request(port, 'POST', '/v1/embeddings', { input: 'hello' });
+    expect(res.status).toBe(501);
+  });
+
+  it('POST /v1/embeddings rejects missing input', async () => {
+    const res = await request(port, 'POST', '/v1/embeddings', { model: 'x' });
+    expect(res.status).toBe(400);
+  });
+});
+
+describe('APIServer with auth', () => {
+  let server: APIServer;
+  const port = 19877;
+
+  beforeAll(async () => {
+    server = new APIServer({ port, host: '127.0.0.1', apiKey: 'secret-key', agent: createMockAgent() });
+    await server.start();
+  });
+  afterAll(async () => { await server.stop(); });
+
+  it('rejects unauthenticated requests', async () => {
+    const res = await request(port, 'GET', '/v1/models');
+    expect(res.status).toBe(401);
+  });
+
+  it('accepts valid Bearer token', async () => {
+    const res = await request(port, 'GET', '/v1/models', undefined, { Authorization: 'Bearer secret-key' });
+    expect(res.status).toBe(200);
+  });
+
+  it('health check works without auth', async () => {
+    const res = await request(port, 'GET', '/health');
+    expect(res.status).toBe(200);
+  });
+});