3 Commits

Include renames

Author	SHA1	Message	Date
steveandClaude Fable 5	966ea16166	fix: review findings — NaN threshold guard, percent-escape rejection in upstream model ids ... - Segment: reject NaN thresholds (NaN fails every comparison, so it passed the [0,1] range check and reached the shim as the literal string "NaN"); ±Inf were already caught by the range comparisons, now covered by tests too. - upstreamPath: reject '%' in model ids — %2F/%2E%2E percent-escapes decode back into path structure server-side, bypassing the literal /?#/.. rejection. Ids never legitimately contain '%'. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01WWCQcYStWXBYUy5sZWnbLT	2026-07-16 19:00:11 -04:00
steveandClaude Fable 5	4a752ffa2a	fix: harden upstream path + binary-body validation (gadfly round 1) ... - upstreamPath rejects '..' in model ids AND in the rest path — the rest can embed SERVER-SUPPLIED components (ACE-Step result file URLs), so dot-dot/scheme smuggling toward other proxy endpoints is refused - singleImageResult requires positive image evidence (sniffed magic OR declared image/*): an empty-Content-Type error page can no longer pass as 'the image' via sniffImageMIME's PNG-default labelling - upscale/background responses get a dedicated 256MB cap (the 64MB cap is JSON-sized; a 4x PNG legitimately exceeds it) - mesh JSON-detection widened (512-byte whitespace-tolerant peek + reject declared application/json) - Transcribe now reuses buildMultipart; transcriptionFilename takes (filename, mime) so diarize shares it without a fake request struct; truncateForError stops shadowing builtin cap; OnlyMask doc de-ambiguated Co-Authored-By: Claude Fable 5 <[email protected]>	2026-07-13 00:50:21 -04:00
steveandClaude Fable 5	e98493bcfb	feat: media expansion surfaces — edit mask, upscale, background removal, interpolation, diarization, meshgen (ADR-0020) ... - imagegen.EditRequest.Mask -> sd-server img2img inpainting (white=repaint) - imagegen.Upscaler + BackgroundRemover, videogen.Interpolator, audio.DiarizationModel: new optional provider-minted surfaces - NEW meshgen leaf package (image->3D, glb/stl/obj) - provider/llamaswap: all five via the /upstream/<model>/<path> passthrough (upstreamPath helper, shared one-file multipart builder); binary success bodies validated (non-image, non-video, JSON-mesh rejection); diarization pins output=json (vtt/srt drop speaker labels) Co-Authored-By: Claude Fable 5 <[email protected]>	2026-07-12 23:52:34 -04:00