sharp by wasm

src/api/routes/vfsExec.js

@@ -84,7 +84,7 @@ export function register(app, basePath = '') {
      *       response also carries `columns` (name/type) and `rows` (data row count). Only declared columns are
      *       emitted, in header order; missing values become empty cells. Execution runs in the same isolated worker
      *       sandbox as the `javascript_execute` tool — including authenticated `fetch()` against this API,
-     *       `fs`/`vfs`, `sharp`, ExcelJS, PDFKit and WebCrypto globals.
+     *       `fs`/`vfs`, `optimizeImage`, ExcelJS, PDFKit and WebCrypto globals.
      *
      *       The path is taken from the URL (like `DELETE /vfs/{*path}`); the run arguments are the JSON body.
      *       Path traversal (`..`), null bytes, and backslashes are rejected with HTTP 400, as is a path that does