feat(http): inline image previews

Author: lex

LEARNINGS.md

@@ -31,4 +31,11 @@ pitfall, log it here. Check this file before starting any task.
 - 2026-07-02: http/block-index — inter-block separator lines (after last content line of a block, before next `###`) must NOT be associated with any block. `find_request_block_bounds` returns nil for cursor on these lines. Fix: track `last_content_line` per block during scan, set `block.end_line = last_content_line`, exclude trailing empties/comments from block range. See `lua/poste/http/cache.lua:150-165`.
 - 2026-07-02: http/block-index — `detect_script_context` via line_type fails on buffers without `###` blocks because file-level area only classifies lines as `var` or `file`. Completion tests call `detect_script_context` on bare buffers (no `###`). Fix: add pre/post-script detection to file-level area in cache scanner. See `lua/poste/http/cache.lua:101-128`.
 - 2026-07-02: http/build_pending_request — `build_pending_request` used `buf_content:find("\n###", ...)` to find block end, which picks up inter-block comments and wrong content after var injection. Fix: pass `block_end` through callback chain from `execute_request` → `start_curl_job` → `build_pending_request`; replace `\n###` scan with block_line extraction using numeric line bounds. See `lua/poste/http/run.lua:166-242`.
-- 2026-07-04: http/file-include — `< file` expansion in `process_form_data` embeds raw file content into buffer content before Rust parser splits blocks on `###`. File content containing `###` at line start creates false block boundaries, truncating the request body. Fix: move `< file` expansion out of Lua `process_form_data` (now only does magic vars), into Rust `run.rs:resolve_file_includes` after `parse_at_line` so Rust parser never sees file content `###`. See `lua/poste/http/request_vars.lua:37-88` and `crates/poste-cli/src/run.rs:104-106`.
+- 2026-07-04: http/file-include — `< file` expansion in `process_form_data` embeds raw file content into buffer content before Rust parser splits blocks on `###`. File content containing `###` at line start creates false block boundaries, truncating the request body. Fix: move `< file` expansion out of Lua `process_form_data` (now only does magic vars), into Rust `run.rs:resolve_file_includes` after `parse_at_line` so Rust parser never sees file content `###`. See `lua/poste/http/request_vars.lua:37-88` and `crates/poste-cli/src/run.rs:104-106`.
+- 2026-07-04: http/image-preview — Kitty graphics protocol (`\033_Ga=T,f=100,m=0;BASE64\033\\`) doesn't work through Neovim's Lua `io.write()`. ESC (0x1b) bytes are stripped or mangled by Neovim's output pipeline (libvterm's stdout processing), causing raw base64 to appear as literal terminal text. `os.execute('printf ... > /dev/tty')` would bypass the pipeline, but it blocks the UI. `jobstart({stdout = 1})` inherit doesn't exist — Neovim always captures child stdout through a pipe. Fix: use system viewer (`open`/`xdg-open` via `jobstart`) which works everywhere. Kitty inline kept as best-effort commented attempt. See `lua/poste/http/format.lua:156-195`.
+- 2026-07-04: http/image-preview — terminal preview buffers created with fake/test buffers can break if code writes `vim.bo[buf]` directly after `nvim_open_term()`. Fix: use `nvim_set_option_value(..., { buf = buf })` for preview buffer options so the path works with both real buffers and mocked test buffers. See `lua/poste/http/format.lua:208-240`.
+- 2026-07-04: http/image-preview — `nvim_open_term()` is still an internal libvterm terminal, so kitty graphics output renders blank inside Neovim even in Kitty/WezTerm. Fix: render image previews as a small colored-cell buffer using ImageMagick sampling + extmark background highlights instead of trying to pass graphics escape codes through Neovim. See `lua/poste/http/format.lua:184-340`.
+- 2026-07-04: http/image-preview — colored-cell fallback is not a usable image preview. Fix: remove the built-in preview path, prefer `image.nvim` when installed, and otherwise fall back to opening the file externally. See `lua/poste/http/format.lua:232-305` and `lua/poste/http/buffer.lua:267-275`.
+- 2026-07-04: http/binary-upload — `< file.png` inline expanded via `String::from_utf8_lossy` corrupts binary data, and null bytes in `--data-binary <inline>` arg fail with "nul byte found in provided data" (OS rejects NUL in argv). Fix: `Request.body` changed from `String` to `Vec<u8>`, `resolve_file_includes` preserves raw bytes, executor writes body to tempfile and uses `--data-binary @path`. See `crates/poste-cli/src/run.rs:203-239`, `crates/poste-exec/src/executor.rs:117-122`.
+- 2026-07-04: http/image-preview — `image.nvim` can render against the existing response buffer/window; a separate preview popup is unnecessary. Fix: body view now auto-renders inline when `image.nvim` is installed, and `K` only falls back to external open when inline render is unavailable. See `lua/poste/http/format.lua:195-300` and `lua/poste/http/view.lua:94-151`.
+- 2026-07-04: http/image-preview — `image.nvim` inline render follows the current cursor/anchor, so rendering at line 1 overlays metadata text. Fix: reserve real blank lines after the binary metadata block and move the cursor to the first blank line before calling `image.from_file(...):render()`. See `lua/poste/http/format.lua:155-236` and `lua/poste/http/view.lua:159-170`.

crates/poste-cli/src/run.rs

@@ -104,11 +104,11 @@ pub async fn execute(args: RunArgs) -> Result<()> {
     // Save raw body AFTER variable substitution but BEFORE file include
     // resolution — so Verbose/Rqst tabs show `{{host}}` expanded but
     // `< ./photo.png` kept as-is (not dumping binary content).
-    request.raw_body = request.body.clone();
+    request.raw_body = request.body_str().to_string();
 
     // Expand < file directives in the body (must happen after parsing so that
     // ### in file content doesn't corrupt block boundary detection).
-    request.body = resolve_file_includes(&request.body, &search_dir)?;
+    request.body = resolve_file_includes(request.body_str(), &search_dir)?;
 
     // Resolve connection name for SQL protocols
     if crate::util::is_sql_protocol(&request.protocol)
@@ -200,32 +200,31 @@ pub async fn execute(args: RunArgs) -> Result<()> {
 /// - absolute paths
 ///
 /// On read error the original line is kept (same as Lua behavior).
-fn resolve_file_includes(body: &str, base_dir: &Path) -> Result<String> {
+fn resolve_file_includes(body: &str, base_dir: &Path) -> Result<Vec<u8>> {
     let home = std::env::var("HOME").ok();
-    let mut result = String::with_capacity(body.len());
+    let mut result = Vec::with_capacity(body.len());
     for line in body.lines() {
         let trimmed = line.trim();
         if let Some(path_str) = trimmed.strip_prefix("< ") {
             let resolved = resolve_include_path(path_str.trim(), base_dir, &home);
             match std::fs::read(&resolved) {
                 Ok(bytes) => {
-                    let content = String::from_utf8_lossy(&bytes);
-                    result.push_str(&content);
+                    result.extend_from_slice(&bytes);
                     // file content includes its own newlines; don't add another
                 }
                 Err(_) => {
                     // keep original line on error
-                    result.push_str(line);
-                    result.push('\n');
+                    result.extend_from_slice(line.as_bytes());
+                    result.push(b'\n');
                 }
             }
         } else {
-            result.push_str(line);
-            result.push('\n');
+            result.extend_from_slice(line.as_bytes());
+            result.push(b'\n');
         }
     }
     // Preserve trailing-newline semantics of the original body
-    if !body.is_empty() && !body.ends_with('\n') && result.ends_with('\n') {
+    if !body.is_empty() && !body.ends_with('\n') && result.last() == Some(&b'\n') {
         result.pop();
     }
     Ok(result)

crates/poste-core/src/parser.rs

@@ -212,7 +212,7 @@ impl Parser {
             name,
             protocol,
             connection,
-            body,
+            body: body.into_bytes(),
             raw_body: String::new(), // filled by CLI after resolve_file_includes
         })
     }
@@ -591,8 +591,8 @@ Authorization: Bearer {{api_key}}
         let request = parser
             .parse_block(block, Protocol::Http, &HashMap::new())
             .unwrap();
-        assert!(request.body.contains("GET /users/123"));
-        assert!(request.body.contains("Authorization: Bearer secret"));
+        assert!(request.body_str().contains("GET /users/123"));
+        assert!(request.body_str().contains("Authorization: Bearer secret"));
     }
 
     #[test]
@@ -614,7 +614,7 @@ GET http://{{host}}:{{port}}/{{timeout}}
         let request = parser.parse_at_line(content, 6, "http").unwrap();
 
         // host should be from request_vars (highest priority)
-        assert!(request.body.contains("http://request.com:8080/30"));
+        assert!(request.body_str().contains("http://request.com:8080/30"));
     }
 
     #[test]
@@ -624,9 +624,9 @@ GET http://{{host}}:{{port}}/{{timeout}}
         let request = parser
             .parse_block(block, Protocol::Http, &HashMap::new())
             .unwrap();
-        assert!(request.body.contains("GET /api/data"));
-        assert!(!request.body.contains("{%"));
-        assert!(!request.body.contains("local x"));
+        assert!(request.body_str().contains("GET /api/data"));
+        assert!(!request.body_str().contains("{%"));
+        assert!(!request.body_str().contains("local x"));
     }
 
     #[test]
@@ -637,8 +637,8 @@ GET http://{{host}}:{{port}}/{{timeout}}
         let request = parser
             .parse_block(block, Protocol::Http, &HashMap::new())
             .unwrap();
-        assert!(request.body.contains("GET /api/data"));
-        assert!(!request.body.contains("{%"));
+        assert!(request.body_str().contains("GET /api/data"));
+        assert!(!request.body_str().contains("{%"));
     }
 
     #[test]
@@ -648,8 +648,8 @@ GET http://{{host}}:{{port}}/{{timeout}}
         let request = parser
             .parse_block(block, Protocol::Http, &HashMap::new())
             .unwrap();
-        assert!(request.body.contains("GET /api/data"));
-        assert!(!request.body.contains("gen.lua"));
+        assert!(request.body_str().contains("GET /api/data"));
+        assert!(!request.body_str().contains("gen.lua"));
     }
 
     #[test]
@@ -659,17 +659,17 @@ GET http://{{host}}:{{port}}/{{timeout}}
         let request = parser
             .parse_block(block, Protocol::Http, &HashMap::new())
             .unwrap();
-        assert!(request.body.contains("GET /api/data"));
-        assert!(!request.body.contains("check.lua"));
+        assert!(request.body_str().contains("GET /api/data"));
+        assert!(!request.body_str().contains("check.lua"));
     }
 
     #[test]
     fn test_assertion_external_stripped_multi_block() {
         let parser = Parser::new(HashMap::new());
         let content = "### Request 1\nGET /api/data\n> ./scripts/check.lua\n\n### Request 2\nGET /api/other\n";
         let request = parser.parse_at_line(content, 2, "http").unwrap();
-        assert!(request.body.contains("GET /api/data"));
-        assert!(!request.body.contains("check.lua"));
+        assert!(request.body_str().contains("GET /api/data"));
+        assert!(!request.body_str().contains("check.lua"));
     }
 
     #[test]
@@ -679,7 +679,7 @@ GET http://{{host}}:{{port}}/{{timeout}}
         let request = parser
             .parse_block(block, Protocol::Http, &HashMap::new())
             .unwrap();
-        assert!(request.body.contains("GET /api?token=injected-value"));
+        assert!(request.body_str().contains("GET /api?token=injected-value"));
     }
 
     // ---- @var enhancements: quote stripping, {{var}} in values, multi-line blocks ----
@@ -720,7 +720,7 @@ GET /api?{{page}}
         assert_eq!(vars.get("page"), Some(&"pageNum=1&pageSize=10".to_string()));
 
         let req = parser.parse_at_line(content, 5, "http").unwrap();
-        assert!(req.body.contains("GET /api?pageNum=1&pageSize=10"));
+        assert!(req.body_str().contains("GET /api?pageNum=1&pageSize=10"));
     }
 
     #[test]
@@ -739,9 +739,9 @@ POST /api/data
 {"key": "value"}
 "#;
         let req = parser.parse_at_line(content, 8, "http").unwrap();
-        assert!(req.body.contains("Authorization: abc123"));
-        assert!(req.body.contains("X-Custom: yes"));
-        assert!(req.body.contains("{\"key\": \"value\"}"));
+        assert!(req.body_str().contains("Authorization: abc123"));
+        assert!(req.body_str().contains("X-Custom: yes"));
+        assert!(req.body_str().contains("{\"key\": \"value\"}"));
     }
 
     #[test]
@@ -755,8 +755,8 @@ POST /api/data
 GET /{{page}}
 "#;
         let req = parser.parse_at_line(content, 4, "http").unwrap();
-        assert!(req.body.contains("GET /id=99"));
-        assert!(!req.body.contains("{{pageNum}}"));
+        assert!(req.body_str().contains("GET /id=99"));
+        assert!(!req.body_str().contains("{{pageNum}}"));
     }
 
     #[test]
@@ -769,7 +769,7 @@ GET /{{page}}
 GET {{path}}
 "#;
         let req = parser.parse_at_line(content, 5, "http").unwrap();
-        assert!(req.body.contains("GET /api/v1/users"));
+        assert!(req.body_str().contains("GET /api/v1/users"));
     }
 
     #[test]
@@ -787,9 +787,9 @@ POST /api/data
         let req = parser
             .parse_block(block, Protocol::Http, &HashMap::new())
             .unwrap();
-        assert!(req.body.contains("POST /api/data"));
-        assert!(req.body.contains("Authorization: secret"));
-        assert!(req.body.contains("Content-Type: application/json"));
+        assert!(req.body_str().contains("POST /api/data"));
+        assert!(req.body_str().contains("Authorization: secret"));
+        assert!(req.body_str().contains("Content-Type: application/json"));
     }
 
     #[test]
@@ -803,8 +803,8 @@ GET /api
 Authorization: {{token}}
 "#;
         let req = parser.parse_at_line(content, 5, "http").unwrap();
-        assert!(req.body.contains("Authorization: secret"));
-        assert!(!req.body.contains("{{admin_token}}"));
+        assert!(req.body_str().contains("Authorization: secret"));
+        assert!(!req.body_str().contains("{{admin_token}}"));
     }
 
     #[test]
@@ -821,8 +821,8 @@ GET /api
 Authorization: {{token}}
 "#;
         let req = parser.parse_at_line(content, 5, "http").unwrap();
-        assert!(req.body.contains("Authorization: secret"));
-        assert!(!req.body.contains("{{admin_token}}"));
+        assert!(req.body_str().contains("Authorization: secret"));
+        assert!(!req.body_str().contains("{{admin_token}}"));
     }
 
     #[test]
@@ -837,7 +837,7 @@ Authorization: {{token}}
         let req = parser
             .parse_block(block, Protocol::Http, &HashMap::new())
             .unwrap();
-        assert!(req.body.contains("Authorization: secret"));
+        assert!(req.body_str().contains("Authorization: secret"));
     }
 
     #[test]
@@ -888,13 +888,13 @@ Authorization: {{token}}
         let parser = Parser::new(HashMap::new());
         let content = "### Request 1\nGET /api/one\n\n> {% client.test(\"a\", function() end) %}\n\n# ─────────────────\n# Comment between blocks\n# ─────────────────\n\n### Request 2\nGET /api/two\n";
         let request = parser.parse_at_line(content, 2, "http").unwrap();
-        assert!(request.body.contains("GET /api/one"));
+        assert!(request.body_str().contains("GET /api/one"));
         assert!(
-            !request.body.contains("Comment between blocks"),
+            !request.body_str().contains("Comment between blocks"),
             "body should not contain inter-block comments"
         );
         assert!(
-            !request.body.contains("──"),
+            !request.body_str().contains("──"),
             "body should not contain inter-block comment decorations"
         );
     }
@@ -906,10 +906,10 @@ Authorization: {{token}}
         let request = parser
             .parse_block(content, Protocol::Http, &HashMap::new())
             .unwrap();
-        assert!(!request.body.contains("{{$timestamp}}"));
-        assert!(!request.body.contains("{{$uuid}}"));
-        assert!(request.body.contains("\"ts\": \""));
-        assert!(request.body.contains("\"uuid\": \""));
+        assert!(!request.body_str().contains("{{$timestamp}}"));
+        assert!(!request.body_str().contains("{{$uuid}}"));
+        assert!(request.body_str().contains("\"ts\": \""));
+        assert!(request.body_str().contains("\"uuid\": \""));
     }
 
     #[test]
@@ -924,7 +924,7 @@ X-Val: {{a}}
 "#;
         // Should not hang or panic — caps at 20 iterations
         let req = parser.parse_at_line(content, 5, "http").unwrap();
-        let body = req.body;
+        let body = req.body_str();
         assert!(body.contains("X-Val: {{b}}") || body.contains("X-Val: {{a}}"));
     }
 }

crates/poste-core/src/request.rs

@@ -15,13 +15,19 @@ pub struct Request {
     pub protocol: Protocol,
     pub connection: String,
     /// Resolved body after file includes (`< filename`) and magic vars are expanded.
-    /// This is what gets sent as the HTTP request body (via curl --data-binary).
-    pub body: String,
+    /// Raw bytes — binary-safe for HTTP file uploads.
+    pub body: Vec<u8>,
     /// Original body before file include resolution, for display in the request
-    /// preview / Verbose tab.  If empty, falls back to `body`.
+    /// preview / Verbose tab.  If empty, falls back to `body` converted to string.
     pub raw_body: String,
 }
 
+impl Request {
+    pub fn body_str(&self) -> &str {
+        std::str::from_utf8(&self.body).unwrap_or("")
+    }
+}
+
 /// Replace the database name in a connection URL.
 /// "postgres://user:pass@host:5432/olddb" → "postgres://user:pass@host:5432/newdb"
 /// Handles URLs with or without auth, port, and existing database.

crates/poste-core/src/sql_parser.rs

@@ -22,8 +22,8 @@ pub struct SqlParseResult {
 /// The body has already been through variable substitution in `parser.rs`,
 /// so `{{var}}` references are already resolved.
 pub fn parse_sql_request(request: &Request) -> Result<SqlParseResult> {
-    let database = extract_database(&request.body);
-    let statements = split_statements(&request.body);
+    let database = extract_database(request.body_str());
+    let statements = split_statements(request.body_str());
 
     Ok(SqlParseResult {
         connection: request.connection.clone(),
@@ -196,7 +196,7 @@ mod tests {
             name: Some("test".to_string()),
             protocol: Protocol::Postgres,
             connection: "postgres://localhost/test".to_string(),
-            body: body.to_string(),
+            body: body.to_string().into_bytes(),
             raw_body: body.to_string(),
         }
     }