Add an image_generate tool on the engine's own Redrob credential

[flxkm522]

Option 1 from the media-output plan: image generation runs inside the engine, using the Redrob credential the engine already holds.

Why a built-in tool, not a Cowork plugin

The Redrob key belongs to Redrob Code. It lives in auth.json or REDROB_API_KEY, Cowork's server deliberately never reads it, and no plugin API hands it out. A Cowork plugin could only reach the key in two bad ways:

• Register a second redrob auth hook. ProviderAuth keeps one hook per provider, so this would replace "Connect Redrob" in onboarding.
• Read provider.key from an undocumented chat.params argument. That's fragile, and it's handling a secret.

A built-in avoids both. The key stays where it is, and the image is billed to the same account as the chat.

What it does

• image_generate (src/tool/image_generate.ts):
  • Request: POST {CONSOLE_URL}/chat/completions with modalities: ["image","text"]. Default model is google/gemini-2.5-flash-image; model can be overridden. The gateway relays images since mckinley-and-rice/redrob-console#230.
  • Output: writes the picture to artifacts/<slug>.png (or .jpg/.webp/.gif) and returns it as an attachment (data: URL). Cowork already renders tool attachments inline in chat (session-sync.ts → message-list.tsx), and the model sees what it made.
  • File naming: the name is chosen before anything is spent, and an existing file is never overwritten (logo.png → logo-2.png).
  • Permission: asked as edit, like write, so plan mode denies it.
  • Errors: a gateway refusal comes back with the gateway's own message (e.g. 402 out of credit). A model that answers only in text produces a clear error quoting what it said. With no key, the tool fails before anything is sent.
  • Metadata: carries filepath, model, and the billed costUsd from the gateway's redrob block.
  • Accepted images: only inline PNG, JPEG, WebP and GIF (≤ 20 MiB). Remote URLs and SVG are refused.
• Registry: the tool is offered only while a Redrob credential exists (auth store or env), checked on every request. Without one, it would be a tool that fails on every call.
• REDROB_CONSOLE_URL is read per call, the same developer seam CONSOLE_URL already honours. That lets the test point at a local stand-in.

Proof

Command	Result
bun test test/tool/image_generate.test.ts	7 pass. Uses a real local HTTP stand-in for the gateway. Covers: bearer key from the auth store; request body (model, modalities, prompt); bytes written to artifacts/; attachment shape; costUsd in metadata; edit permission on the relative path; no overwrite; named model and file name; no-image error; 402 relayed; no key means no request sent; slug and data-URL guards
bun test test/tool/registry.test.ts	16 pass, including the new test that hides the tool without a credential and shows it with an auth-store or env key
bun test (all of packages/redrob)	3454 pass / 3 fail. The 3 failures are tui.test.ts, project.test.ts and write.test.ts "OS denies write access"; they also fail on develop in this sandbox (it runs as root)
bun typecheck (turbo, 18 packages)	exit 0, also run by the pre-push hook
prettier --check, oxlint on the changed files	clean

Not covered: a live call against console.redrob.ai. Reaching users needs a release and a redrobCodeVersion bump in Cowork.

[flxkm522]

Superseded by #80, which consolidates all redrob-code engine PRs into a single squashed PR on develop (reviewed + refactored for lean code and docs). Closing this; its content is included there.