image-edit implementation

Shared image runtime

createImageRuntime(ctx) from elowen-plugin-shared/imageRuntime is the supported entry, and Image-edit and Image-gen call it once from an awaited register. It reads ctx.config.provider and asks ctx.provider(id) for that provider's descriptor, which carries only an id, a label and a type. When this installation configures no provider with that id the runtime logs one info message and returns null, so no tool is registered. Otherwise it exposes providerId, provider, model, files, ok, fail and render. runtime.model keeps the trimmed configured model id, including an OpenRouter vendor namespace, or falls back to gpt-image-2.5-sunburst for the connected ChatGPT account and gpt-image-1 for every other provider type; resolveModel stays a private implementation function. A connected ChatGPT account needs no API key.

Source loading

EditImage loads the source itself before it renders. A file_path must end in .png, .jpg or .jpeg and is read through runtime.files.read with a 10 MB cap, the same cap the plugin applies to a downloaded source. A url is fetched through ctx.host.publicHttp(): that client resolves the hostname, refuses any answer that is not a global address and connects only to the address it checked, under a two-minute timeout and at most five redirects. A response with a content type must be PNG or JPEG, a response without one is treated as PNG, and a non-success status, an oversized body or a foreign content type fails the call before any render. Image-edit declares the network capability for that client; both image manifests declare the project-files read.

Rendering and file authority

runtime.render('edit', request, outputPath?, overwrite?) validates the output extension and a boolean overwrite before the provider call, and refuses overwrite without an explicit output path. It then calls the host's ctx.images operation once with the source bytes and their MIME type, maps the reported format to .png, .jpg or .webp with PNG as the default when a response reports none, corrects a mismatched requested extension, and writes the bytes through ctx.host.projectFiles().write with that overwrite. One call is one render and one write, with no polling, extra copy or retry, and the result text carries the saved path instead of sharing the image. A matching output extension preserves the path, including .jpeg, and an output path that names the source replaces it only with overwrite: true.

Core keeps both the credential and the file authority: ctx.images authorizes each render against the accounts of the provider the plugin names, and provider or file failures propagate to the tool as errors. Provider identity is not a credential and not an account-availability check, and ctx.images owns image-render authorization.

Release requirement and test coverage

The shipped core archive must export and include the imageRuntime subpath and its declarations; the shared API number alone does not establish that a newly added subpath exists there. requiresCore records the release paired with the declared shared API level, 0.30.4 for shared API 14, and the marketplace compatibility gate rejects a candidate whose archived manifest needs a newer core before staging it.

The paired registry tests stage the real plugin bytes through prepareCandidate and load both entries through loadPlugins. Registration fixtures call ctx.provider directly, while the real-loader fixture supplies host.providerDescriptor and a host.projectFiles guard whose read and write throw, so an accidental tool execution cannot pass, and a public HTTP client whose request throws. A capable source checkout at an unchanged released version is not proof that an older published archive is capable.