@mrgoonie/multix 0.14.0 → 0.14.1

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.14.1](https://github.com/mrgoonie/multix-cli/compare/v0.14.0...v0.14.1) (2026-10-11)
+
+
+### Fixed
+
+* **replicate:** harden output downloads, --prefer-wait and create errors ([#88](https://github.com/mrgoonie/multix-cli/issues/88)) ([e29e81d](https://github.com/mrgoonie/multix-cli/commit/e29e81d7b3e54e5b65f4905c1adb629f2d4df6c4))
+
 ## [0.14.0](https://github.com/mrgoonie/multix-cli/compare/v0.13.0...v0.14.0) (2026-10-11)
 
 

package/README.md

@@ -98,6 +98,7 @@ Set at least one provider key. Add to `.env` in your project root or `~/.multix/
 | `CLOUDFLARE_AI_IMAGE_MODEL` | No | Image model setting; only `@cf/black-forest-labs/flux-1-schnell` is accepted |
 | `CLOUDFLARE_AI_TTS_MODEL` | No | Speech model setting; only `@cf/myshell-ai/melotts` is accepted |
 | `MULTIX_OUTPUT_DIR` | No | Override default output dir (`./multix-output`) |
+| `MULTIX_MAX_DOWNLOAD_MB` | No | Size limit per downloaded Replicate output file (default `2048`) |
 | `MULTIX_IMAGE_FORMAT` | No | `webp` (default) or `original` to keep provider image format/quality |
 | `OPENROUTER_IMAGE_MODEL` | No | Default OpenRouter model |
 | `OPENROUTER_FALLBACK_MODELS` | No | Comma-separated fallback model ids |
@@ -556,9 +557,11 @@ multix replicate cancel <prediction-id>
 
 **Notes:**
 - Auth: `Authorization: Bearer $REPLICATE_API_TOKEN` (`REPLICATE_API_KEY` accepted as fallback).
-- Default behavior waits with bounded polling; `--async` prints the prediction id plus resume/cancel commands. `--prefer-wait` sends `Prefer: wait=N` and keeps polling if the job is still running.
+- Default behavior waits with bounded polling; `--async` prints the prediction id plus resume/cancel commands. `--prefer-wait [seconds]` (an integer from 1 to 60; the bare flag means 60) sends `Prefer: wait=N` and keeps polling if the job is still running. Put the prompt before a bare `--prefer-wait`; any other value is rejected.
 - Only `succeeded` exits 0; `failed`, `canceled`, and `aborted` exit non-zero with Replicate's error.
+- If submitting fails with a network error, timeout, 5xx, or an unreadable 2xx response, the prediction may still have been created and billed (Replicate has no idempotency key). Check https://replicate.com/predictions before retrying.
 - Every media URL in the output (string, list, or nested object) is downloaded as `replicate-<id8>-NN.<ext>` (`<id8>` = first 8 characters of the prediction id); text outputs are printed. Output URLs expire, so download promptly. If any download fails, the command exits non-zero and prints `multix replicate status <id> --download` to retry.
+- Output downloads use `https://` only and refuse `localhost` and loopback, private, link-local, or other special-purpose IP literals (hostnames are not resolved), including on redirects. Files are written to `<path>.part` and renamed when complete, so a failed download never clobbers an existing file. Hosts other than `replicate.delivery` are downloaded with a warning that names the host. Each file is capped at `MULTIX_MAX_DOWNLOAD_MB` (default 2048).
 - `replicate image` converts images to WebP by default; `--image-format original`, `--no-webp`, `MULTIX_IMAGE_FORMAT=original`, an explicit `--output-format`, or a non-`.webp` `--output` extension keeps the provider format.
 - Local files (`--image`, `--file key=path`) up to 256 KB are inlined as data URIs; larger files (< 100 MB) are uploaded via the Replicate Files API.
 

package/dist/cli.js

@@ -1120,40 +1120,168 @@ import fs8 from "fs";
 import path7 from "path";
 
 // src/core/http-client.ts
-init_errors();
-import { once } from "events";
 import fs3 from "fs";
 import path3 from "path";
+import { Readable } from "stream";
 import { pipeline } from "stream/promises";
+init_errors();
+init_redact();
 async function httpJson(opts) {
   return fetchJson(opts);
 }
-async function downloadFile(url, dest, timeoutMs = DEFAULT_TIMEOUT_MS, headers2) {
-  fs3.mkdirSync(path3.dirname(dest), { recursive: true });
-  let response;
-  try {
-    response = await globalThis.fetch(url, {
-      signal: AbortSignal.timeout(timeoutMs),
-      ...headers2 ? { headers: headers2 } : {}
+var MAX_DOWNLOAD_ENV = "MULTIX_MAX_DOWNLOAD_MB";
+var DEFAULT_MAX_DOWNLOAD_MB = 2048;
+var MAX_REDIRECTS = 5;
+function formatMb2(bytes) {
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+var DownloadTooLargeError = class extends MultixError {
+  constructor(limitBytes, url) {
+    super(
+      `Download from ${redactUrl(url)} exceeds the ${formatMb2(limitBytes)} limit (set ${MAX_DOWNLOAD_ENV} to change it)`,
+      "DOWNLOAD_TOO_LARGE"
+    );
+    this.limitBytes = limitBytes;
+    this.name = "DownloadTooLargeError";
+  }
+  limitBytes;
+};
+function maxDownloadBytes() {
+  const raw = resolveKey(MAX_DOWNLOAD_ENV)?.trim();
+  if (!raw) return DEFAULT_MAX_DOWNLOAD_MB * 1024 * 1024;
+  const mb = Number(raw);
+  if (!Number.isFinite(mb) || mb <= 0) {
+    throw new ConfigError(
+      `${MAX_DOWNLOAD_ENV} must be a positive number of megabytes, got "${raw}"`
+    );
+  }
+  const bytes = Math.floor(mb * 1024 * 1024);
+  if (bytes < 1) {
+    throw new ConfigError(`${MAX_DOWNLOAD_ENV} is too small: "${raw}" MB is less than one byte`);
+  }
+  return bytes;
+}
+async function fetchWithValidatedRedirects(url, opts = {}) {
+  const doFetch = opts.fetch ?? ((input, init) => globalThis.fetch(input, init));
+  const { validateUrl, signal } = opts;
+  const maxRedirects = opts.maxRedirects ?? MAX_REDIRECTS;
+  let current = url;
+  let headers2 = opts.headers;
+  for (let hop = 0; ; hop++) {
+    await validateUrl?.(current);
+    let response;
+    try {
+      response = await doFetch(current, {
+        ...signal ? { signal } : {},
+        ...headers2 ? { headers: headers2 } : {},
+        ...validateUrl ? { redirect: "manual" } : {}
+      });
+    } catch (cause) {
+      const msg = cause instanceof Error ? cause.message : String(cause);
+      throw new HttpError(0, msg, current);
+    }
+    const location = response.headers.get("location");
+    if (!validateUrl || !location || response.status < 300 || response.status >= 400) {
+      return { response, url: current };
+    }
+    await response.body?.cancel().catch(() => {
     });
-  } catch (cause) {
-    const msg = cause instanceof Error ? cause.message : String(cause);
-    throw new HttpError(0, msg, url);
+    if (hop >= maxRedirects) {
+      throw new HttpError(response.status, `too many redirects (over ${maxRedirects})`, current);
+    }
+    let next;
+    try {
+      next = new URL(location, current);
+    } catch {
+      throw new HttpError(response.status, "redirect with a malformed Location header", current);
+    }
+    if (next.origin !== new URL(current).origin) headers2 = void 0;
+    current = next.toString();
+  }
+}
+function removeQuietly(file) {
+  try {
+    fs3.rmSync(file, { force: true });
+  } catch {
   }
+}
+function replaceFile(from, to) {
+  try {
+    fs3.renameSync(from, to);
+  } catch (err2) {
+    const code = err2.code;
+    const existing = fs3.statSync(to, { throwIfNoEntry: false });
+    if (!existing?.isFile() || code !== "EEXIST" && code !== "EPERM" && code !== "EACCES") {
+      throw err2;
+    }
+    fs3.rmSync(to, { force: true });
+    fs3.renameSync(from, to);
+  }
+}
+async function downloadToFile(url, opts) {
+  const signal = AbortSignal.timeout(opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  const { response, url: finalUrl } = await fetchWithValidatedRedirects(url, {
+    signal,
+    headers: opts.headers,
+    validateUrl: opts.validateUrl,
+    fetch: opts.fetch
+  });
   if (!response.ok) {
-    throw new HttpError(response.status, "(download failed)", url);
+    await response.body?.cancel().catch(() => {
+    });
+    throw new HttpError(response.status, "(download failed)", finalUrl);
   }
   if (!response.body) {
-    throw new HttpError(0, "Response body is null", url);
+    throw new HttpError(0, "Response body is null", finalUrl);
+  }
+  const body = response.body;
+  const { maxBytes } = opts;
+  const declared = Number(response.headers.get("content-length") ?? Number.NaN);
+  if (maxBytes !== void 0 && Number.isFinite(declared) && declared > maxBytes) {
+    await body.cancel().catch(() => {
+    });
+    throw new DownloadTooLargeError(maxBytes, finalUrl);
   }
-  const fileStream = fs3.createWriteStream(dest);
+  let dest;
   try {
-    await pipeline(response.body, fileStream);
+    dest = typeof opts.dest === "function" ? opts.dest(response) : opts.dest;
+    fs3.mkdirSync(path3.dirname(dest), { recursive: true });
   } catch (err2) {
-    if (!fileStream.closed) await once(fileStream, "close");
+    await body.cancel().catch(() => {
+    });
     throw err2;
   }
-  return response.headers.get("content-type") ?? void 0;
+  let bytes = 0;
+  async function* countBytes(source) {
+    for await (const chunk of source) {
+      bytes += chunk.byteLength;
+      if (maxBytes !== void 0 && bytes > maxBytes)
+        throw new DownloadTooLargeError(maxBytes, finalUrl);
+      yield chunk;
+    }
+  }
+  const part = `${dest}.part`;
+  let fileStream;
+  try {
+    fileStream = fs3.createWriteStream(part);
+    await pipeline(
+      Readable.fromWeb(body),
+      countBytes,
+      fileStream
+    );
+    replaceFile(part, dest);
+  } catch (err2) {
+    if (fileStream && !fileStream.closed) {
+      await new Promise((resolve) => fileStream?.once("close", () => resolve()));
+    }
+    removeQuietly(part);
+    throw err2;
+  }
+  return { dest, contentType: response.headers.get("content-type") ?? void 0, bytes };
+}
+async function downloadFile(url, dest, timeoutMs = DEFAULT_TIMEOUT_MS, headers2) {
+  const result = await downloadToFile(url, { dest, timeoutMs, headers: headers2 });
+  return result.contentType;
 }
 async function fetchBytes(urlOrDataUri) {
   if (urlOrDataUri.startsWith("data:")) {
@@ -6080,7 +6208,7 @@ var HEYGEN_OPERATIONS = {
 };
 
 // src/providers/heygen/node-helpers.ts
-import { once as once2 } from "events";
+import { once } from "events";
 import fs29 from "fs";
 import path32 from "path";
 import { pipeline as pipeline2 } from "stream/promises";
@@ -7087,7 +7215,7 @@ function inferExtension(url, fallback) {
 function safeSlug(value) {
   return value.replace(/[^A-Za-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "out";
 }
-var MAX_REDIRECTS = 5;
+var MAX_REDIRECTS2 = 5;
 var isRedirect = (status) => [301, 302, 303, 307, 308].includes(status);
 async function downloadHttpsOnly(url, dest, timeoutMs) {
   const signal = AbortSignal.timeout(timeoutMs);
@@ -7109,7 +7237,7 @@ async function downloadHttpsOnly(url, dest, timeoutMs) {
     const location = response.headers.get("location");
     if (isRedirect(response.status) && location) {
       await response.body?.cancel();
-      if (hop >= MAX_REDIRECTS) throw new HttpError(0, "too many redirects", url);
+      if (hop >= MAX_REDIRECTS2) throw new HttpError(0, "too many redirects", url);
       current = new URL(location, current).href;
       continue;
     }
@@ -7120,7 +7248,7 @@ async function downloadHttpsOnly(url, dest, timeoutMs) {
     try {
       await pipeline2(response.body, fileStream);
     } catch (err2) {
-      if (!fileStream.closed) await once2(fileStream, "close");
+      if (!fileStream.closed) await once(fileStream, "close");
       throw err2;
     }
     return;
@@ -10225,8 +10353,8 @@ async function downloadOpenRouterVideo(opts) {
   }
   fs43.mkdirSync(path50.dirname(dest), { recursive: true });
   const ws = fs43.createWriteStream(dest);
-  const { pipeline: pipeline4 } = await import("stream/promises");
-  await pipeline4(r.body, ws);
+  const { pipeline: pipeline3 } = await import("stream/promises");
+  await pipeline3(r.body, ws);
   logger.success(`Saved ${dest}`);
   if (opts.output) {
     fs43.mkdirSync(path50.dirname(path50.resolve(opts.output)), { recursive: true });
@@ -10537,6 +10665,19 @@ function mapReplicateError(error, subject) {
   }
   return new ReplicateApiError(message, status, retryAfterMs);
 }
+var ORPHAN_HINT = "The prediction may have been created anyway (Replicate has no idempotency key); check https://replicate.com/predictions before retrying to avoid paying twice";
+function withOrphanHint(error) {
+  if (error instanceof ReplicateApiError) {
+    const { status } = error;
+    const mayExist = status === 0 || status >= 200 && status < 300 || status >= 500;
+    if (!mayExist) return error;
+    return new ReplicateApiError(`${error.message}. ${ORPHAN_HINT}`, status, error.retryAfterMs);
+  }
+  if (error instanceof ProviderError) {
+    return new ProviderError(`${error.message}. ${ORPHAN_HINT}`, error.provider);
+  }
+  return error;
+}
 function validatePrediction(value) {
   if (value === null || typeof value !== "object" || typeof value.id !== "string" || typeof value.status !== "string") {
     throw new ProviderError("Malformed Replicate response: missing prediction id/status", PROVIDER);
@@ -10605,7 +10746,7 @@ var ReplicateClient = class {
           await this.sleep(delay);
           continue;
         }
-        throw mapReplicateError(error, subject);
+        throw withOrphanHint(mapReplicateError(error, subject));
       }
     }
   }
@@ -10752,23 +10893,137 @@ init_errors();
 
 // src/providers/replicate/commands/prediction-flow.ts
 init_errors();
+import { InvalidArgumentError, Option as Option2 } from "commander";
 
 // src/providers/replicate/node-outputs.ts
 init_errors();
-init_redact();
-import { once as once3 } from "events";
 import fs44 from "fs";
 import path51 from "path";
-import { Readable } from "stream";
-import { pipeline as pipeline3 } from "stream/promises";
+init_redact();
 
 // src/providers/replicate/output.ts
 init_redact();
+
+// src/core/url-safety.ts
+init_errors();
+function ipv4Octets(host) {
+  const parts = host.split(".");
+  if (parts.length !== 4 || !parts.every((p) => /^\d{1,3}$/.test(p))) return void 0;
+  const octets = parts.map(Number);
+  return octets.every((o) => o <= 255) ? octets : void 0;
+}
+function isNonPublicIpv4([a = 0, b = 0, c2 = 0]) {
+  return a === 0 || // "this network" / unspecified
+  a === 10 || a === 127 || // loopback
+  a === 100 && b >= 64 && b <= 127 || // carrier-grade NAT
+  a === 169 && b === 254 || // link-local (cloud metadata)
+  a === 172 && b >= 16 && b <= 31 || a === 192 && b === 0 && c2 === 0 || // IETF protocol assignments
+  a === 192 && b === 0 && c2 === 2 || // TEST-NET-1
+  a === 192 && b === 168 || a === 198 && (b === 18 || b === 19) || // benchmarking
+  a === 198 && b === 51 && c2 === 100 || // TEST-NET-2
+  a === 203 && b === 0 && c2 === 113 || // TEST-NET-3
+  a >= 224;
+}
+function ipv6Groups(host) {
+  if (!/^[0-9a-f:.]+$/i.test(host) || !host.includes(":")) return void 0;
+  let text = host;
+  const tail = /^(.*:)(\d+\.\d+\.\d+\.\d+)$/.exec(text);
+  if (tail) {
+    const octets = ipv4Octets(tail[2]);
+    if (!octets) return void 0;
+    const [a = 0, b = 0, c2 = 0, d = 0] = octets;
+    text = `${tail[1]}${(a << 8 | b).toString(16)}:${(c2 << 8 | d).toString(16)}`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return void 0;
+  const parse = (s) => s === "" ? [] : s.split(":");
+  const head = parse(halves[0]);
+  const rest = halves.length === 2 ? parse(halves[1]) : [];
+  const missing = 8 - head.length - rest.length;
+  if (halves.length === 2 ? missing < 1 : missing !== 0) return void 0;
+  const all = [...head, ...Array(halves.length === 2 ? missing : 0).fill("0"), ...rest];
+  if (!all.every((g) => /^[0-9a-f]{1,4}$/i.test(g))) return void 0;
+  return all.map((g) => Number.parseInt(g, 16));
+}
+function embeddedIpv4(hi, lo) {
+  return [hi >> 8, hi & 255, lo >> 8, lo & 255];
+}
+function isNonPublicIpv6(groups) {
+  const [g0 = 0, g1 = 0, g2 = 0, g3 = 0, g4 = 0, g5 = 0, g6 = 0, g7 = 0] = groups;
+  const zeroUpTo = (n) => groups.slice(0, n).every((g) => g === 0);
+  if (zeroUpTo(5) && g5 === 65535) return isNonPublicIpv4(embeddedIpv4(g6, g7));
+  if (g0 === 100 && g1 === 65435 && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0) {
+    return isNonPublicIpv4(embeddedIpv4(g6, g7));
+  }
+  if (g0 === 8194) return isNonPublicIpv4(embeddedIpv4(g1, g2));
+  return g0 === 0 || // unspecified (::), loopback (::1), IPv4-compatible and other reserved
+  g0 === 256 && g1 === 0 && g2 === 0 && g3 === 0 || // discard-only 100::/64
+  (g0 & 65024) === 64512 || // unique local fc00::/7
+  (g0 & 65472) === 65152 || // link-local fe80::/10
+  (g0 & 65472) === 65216 || // deprecated site-local fec0::/10
+  (g0 & 65280) === 65280;
+}
+function bareHost(hostname) {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+function isLoopbackHost(hostname) {
+  const host = bareHost(hostname);
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  const octets = ipv4Octets(host);
+  if (octets) return octets[0] === 127;
+  const groups = ipv6Groups(host);
+  if (!groups) return false;
+  if (groups.slice(0, 5).every((g) => g === 0) && groups[5] === 65535) {
+    return groups[6] !== void 0 && groups[6] >> 8 === 127;
+  }
+  return groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1;
+}
+function isNonPublicHost(hostname) {
+  const host = bareHost(hostname);
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  const octets = ipv4Octets(host);
+  if (octets) return isNonPublicIpv4(octets);
+  const groups = ipv6Groups(host);
+  return groups !== void 0 && isNonPublicIpv6(groups);
+}
+function checkUrlSafety(url, opts) {
+  const action = opts.action ?? "download from";
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new ProviderError(`Refusing to ${action} a malformed URL`, opts.provider);
+  }
+  const host = parsed.hostname.toLowerCase().replace(/\.$/, "");
+  const localOk = opts.allowLocalhostHttp === true && isLoopbackHost(host);
+  const httpOk = parsed.protocol === "https:" || localOk && parsed.protocol === "http:";
+  if (!httpOk) {
+    throw new ProviderError(
+      `Refusing to ${action} ${host || "this URL"}: only https:// URLs are allowed`,
+      opts.provider
+    );
+  }
+  if (!localOk && isNonPublicHost(host)) {
+    throw new ProviderError(
+      `Refusing to ${action} ${host}: it points to a local or private address`,
+      opts.provider
+    );
+  }
+  const trusted = (opts.trustedHosts ?? []).some((t) => host === t || host.endsWith(`.${t}`));
+  return { host, trusted };
+}
+
+// src/providers/replicate/output.ts
 var HTTP_RE = /^https?:\/\//i;
 var DATA_URI_RE = /^data:[^,]*,/i;
 function isMediaRef(value) {
   return typeof value === "string" && (HTTP_RE.test(value) || DATA_URI_RE.test(value));
 }
+var REPLICATE_DELIVERY_HOST = "replicate.delivery";
+function checkOutputUrl(url) {
+  return checkUrlSafety(url, { provider: "replicate", trustedHosts: [REPLICATE_DELIVERY_HOST] });
+}
 function extractOutput(output) {
   const result = { media: [], texts: [] };
   const seen = /* @__PURE__ */ new Set();
@@ -10927,59 +11182,53 @@ function resolveDestination(predictionId, index, count, ext, opts) {
   const base = givenExt ? output.slice(0, -givenExt.length) : output;
   return `${base}-${String(index + 1).padStart(2, "0")}${ext}`;
 }
-async function writeResponse(response, dest) {
-  if (!response.body) throw new HttpError(0, "Response body is null", response.url);
-  const fileStream = fs44.createWriteStream(dest);
-  try {
-    await pipeline3(
-      Readable.fromWeb(response.body),
-      fileStream
-    );
-  } catch (err2) {
-    if (!fileStream.closed) await once3(fileStream, "close");
-    throw err2;
-  }
-}
 async function saveOne(item, predictionId, index, count, opts) {
   if (item.url.startsWith("data:")) {
     const comma = item.url.indexOf(",");
     const meta = item.url.slice(5, comma);
     const payload = item.url.slice(comma + 1);
     const bytes = meta.endsWith(";base64") ? Buffer.from(payload, "base64") : Buffer.from(decodeURIComponent(payload));
-    const dest2 = resolveDestination(
+    const dest = resolveDestination(
       predictionId,
       index,
       count,
       extFromUrl4(item.url) ?? ".bin",
       opts
     );
-    fs44.mkdirSync(path51.dirname(dest2), { recursive: true });
-    fs44.writeFileSync(dest2, bytes);
-    return dest2;
-  }
-  const doFetch = opts.fetch ?? ((url, init) => globalThis.fetch(url, init));
-  let response;
-  try {
-    response = await doFetch(item.url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
-  } catch (cause) {
-    throw new HttpError(0, cause instanceof Error ? cause.message : String(cause), item.url);
-  }
-  if (!response.ok) {
-    const hint = response.status === 404 || response.status === 410 ? " (output may have expired)" : "";
-    throw new HttpError(response.status, `download failed${hint}`, item.url);
+    fs44.mkdirSync(path51.dirname(dest), { recursive: true });
+    fs44.writeFileSync(dest, bytes);
+    return dest;
   }
-  const ext = extFromUrl4(item.url) ?? extFromContentType(response.headers.get("content-type")) ?? ".bin";
-  const dest = resolveDestination(predictionId, index, count, ext, opts);
-  fs44.mkdirSync(path51.dirname(dest), { recursive: true });
+  const warned = opts.warnedHosts;
   try {
-    await writeResponse(response, dest);
+    const { dest } = await downloadToFile(item.url, {
+      dest: (response) => {
+        const ext = extFromUrl4(item.url) ?? extFromContentType(response.headers.get("content-type")) ?? ".bin";
+        return resolveDestination(predictionId, index, count, ext, opts);
+      },
+      timeoutMs: DOWNLOAD_TIMEOUT_MS,
+      maxBytes: opts.maxBytes,
+      fetch: opts.fetch,
+      validateUrl: (url) => {
+        const { host, trusted } = checkOutputUrl(url);
+        if (!trusted && !warned.has(host)) {
+          warned.add(host);
+          opts.logger.warn(
+            `Output ${item.path} is served from ${host}, not ${REPLICATE_DELIVERY_HOST}`
+          );
+        }
+      }
+    });
+    return dest;
   } catch (err2) {
-    fs44.rmSync(dest, { force: true });
+    if (err2 instanceof HttpError && (err2.status === 404 || err2.status === 410)) {
+      throw new HttpError(err2.status, "download failed (output may have expired)", err2.rawUrl);
+    }
     throw err2;
   }
-  return dest;
 }
 async function saveMediaOutputs(predictionId, media, opts) {
+  const withCap = { ...opts, maxBytes: maxDownloadBytes(), warnedHosts: /* @__PURE__ */ new Set() };
   const saved = [];
   const failed = [];
   for (let i = 0; i < media.length; i++) {
@@ -10987,7 +11236,7 @@ async function saveMediaOutputs(predictionId, media, opts) {
     if (!item) continue;
     opts.logger.debug(`Downloading ${item.path} from ${redactUrl(item.url).slice(0, 200)}`);
     try {
-      const dest = await saveOne(item, predictionId, i, media.length, opts);
+      const dest = await saveOne(item, predictionId, i, media.length, withCap);
       saved.push(dest);
       opts.logger.success(`Saved ${dest}`);
     } catch (e) {
@@ -11004,10 +11253,22 @@ async function saveMediaOutputs(predictionId, media, opts) {
 }
 
 // src/providers/replicate/commands/prediction-flow.ts
+var DEFAULT_PREFER_WAIT_SECONDS = 60;
+function parsePreferWaitSeconds(raw) {
+  const n = Number(raw);
+  if (!/^\d+$/.test(raw.trim()) || n < 1 || n > 60) {
+    throw new InvalidArgumentError(
+      `Expected an integer number of seconds from 1 to 60 (a bare --prefer-wait means ${DEFAULT_PREFER_WAIT_SECONDS}); put the prompt before the flag.`
+    );
+  }
+  return n;
+}
 function addFlowOptions(cmd, defaultTimeoutMs) {
-  return cmd.option("--async", "Submit and return immediately with the prediction id").option("--wait", "Wait for a terminal status (default unless --async)").option(
-    "--prefer-wait [seconds]",
-    "Ask Replicate to hold the create request open (1-60s, default 60); keeps polling if still running"
+  return cmd.option("--async", "Submit and return immediately with the prediction id").option("--wait", "Wait for a terminal status (default unless --async)").addOption(
+    new Option2(
+      "--prefer-wait [seconds]",
+      "Ask Replicate to hold the create request open for 1-60s (bare flag: 60); keeps polling if still running"
+    ).argParser(parsePreferWaitSeconds).preset(String(DEFAULT_PREFER_WAIT_SECONDS))
   ).option("--wait-timeout <ms>", "Polling timeout in milliseconds", String(defaultTimeoutMs)).option("--download", "Download media outputs (default)").option("--no-download", "Print output URLs instead of downloading").option("--output <path>", "Output file path, or a directory for multiple outputs").option("-v, --verbose", "Verbose logging");
 }
 function parsePositiveInt2(raw, flag, max) {
@@ -11019,11 +11280,6 @@ function parsePositiveInt2(raw, flag, max) {
   }
   return n;
 }
-function parsePreferWait(value) {
-  if (value === void 0 || value === false) return void 0;
-  if (value === true) return 60;
-  return parsePositiveInt2(value, "--prefer-wait", 60);
-}
 function resumeCommand3(id) {
   return `multix replicate status ${id} --wait --download`;
 }
@@ -11078,13 +11334,16 @@ async function executePrediction2(params) {
   const { client, model, input, opts, logger } = params;
   if (opts.async && opts.wait)
     throw new ValidationError("--async and --wait are mutually exclusive");
-  if (opts.async && opts.preferWait) {
+  if (opts.async && opts.preferWait !== void 0) {
     throw new ValidationError("--async and --prefer-wait are mutually exclusive");
   }
   const waitTimeoutMs = parsePositiveInt2(opts.waitTimeout, "--wait-timeout");
-  const preferWaitSeconds = parsePreferWait(opts.preferWait);
   logger.info(`Submitting to Replicate ${describeModelRef(model)}...`);
-  const prediction2 = await client.createPrediction({ model, input, preferWaitSeconds });
+  const prediction2 = await client.createPrediction({
+    model,
+    input,
+    preferWaitSeconds: opts.preferWait
+  });
   if (opts.async) {
     printAsyncHandle(prediction2);
     return;
@@ -11156,7 +11415,7 @@ import fs45 from "fs";
 import path52 from "path";
 var DATA_URI_MAX_BYTES = 256 * 1024;
 var UPLOAD_MAX_BYTES = 100 * 1024 * 1024;
-function formatMb2(bytes) {
+function formatMb3(bytes) {
   return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
 }
 async function resolveFileInput(value, client, logger) {
@@ -11172,7 +11431,7 @@ async function resolveFileInput(value, client, logger) {
   if (stat.size === 0) throw new ValidationError(`Input file is empty: ${value}`);
   if (stat.size >= UPLOAD_MAX_BYTES) {
     throw new ValidationError(
-      `Input file ${value} is ${formatMb2(stat.size)}; Replicate accepts uploads under 100MB. Host it and pass an https URL instead.`
+      `Input file ${value} is ${formatMb3(stat.size)}; Replicate accepts uploads under 100MB. Host it and pass an https URL instead.`
     );
   }
   const filename = path52.basename(filePath);
@@ -11182,7 +11441,7 @@ async function resolveFileInput(value, client, logger) {
     logger.debug(`Inlining ${filename} (${stat.size} bytes) as a data URI`);
     return `data:${contentType};base64,${bytes.toString("base64")}`;
   }
-  logger.info(`Uploading ${filename} (${formatMb2(stat.size)}) to Replicate Files...`);
+  logger.info(`Uploading ${filename} (${formatMb3(stat.size)}) to Replicate Files...`);
   const file = await client.uploadFile({
     data: new Blob([bytes], { type: contentType }),
     filename,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrgoonie/multix",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "AI multimodal CLI — OpenAI, Gemini, MiniMax, OpenRouter, Leonardo, BytePlus, ElevenLabs, fal.ai, Atlas Cloud, Replicate, HeyGen, ffmpeg, ImageMagick, doc-to-md",
   "type": "module",
   "bin": {

package/skill/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: multix
 description: AI multimodal CLI — generate and edit images (OpenAI, Codex driver, Gemini Nano Banana, Imagen, MiniMax, OpenRouter, Leonardo, BytePlus Seedream, Cloudflare Workers AI FLUX.1 Schnell, fal.ai FLUX, Replicate FLUX), generate video (Gemini Veo, MiniMax Hailuo, OpenRouter via Veo/Seedance/Kling, Leonardo via Motion/Veo/Kling/Hailuo/Seedance/LTX, BytePlus Seedance, Cloudflare AI Gateway via Replicate, fal.ai queue models, Replicate direct API models incl. P-Video, HeyGen Video Agent and scripted avatar videos), video translation and lipsync (HeyGen), TTS/STT/music (OpenAI, Gemini Flash TTS incl. Gemini 3.8 with delivery-style control, MiniMax, Cloudflare Workers AI MeloTTS, ElevenLabs), 3D models (BytePlus Hyper3D/Hitem3d), analyze/transcribe media, convert documents to Markdown, optimize media via ffmpeg/ImageMagick, and self-update the CLI. Use whenever the user wants to create, edit, or transform images/video/audio/3D/documents from a CLI, mentions any of: OpenAI, Codex image driver, image-to-image, i2i, image edit, watercolor/cyberpunk style transfer, reference image, OpenRouter, Nano Banana, Flux, Seedream, Veo, Hailuo, Seedance, Kling, Cloudflare Workers AI, AI Gateway, fal.ai, Atlas Cloud, Replicate, replicate.com models, Replicate predictions, HeyGen, avatar video, talking head, Video Agent, video translation, dubbing, lipsync, video generation, text-to-video, image-to-video, i2v, ElevenLabs voice cloning, updating/upgrading multix, or asks for batch media optimization.
-version: 0.14.0 # x-release-please-version
+version: 0.14.1 # x-release-please-version
 ---
 
 # multix — AI Multimodal CLI
@@ -178,7 +178,9 @@ multix replicate status <prediction-id> --wait --download
 multix replicate cancel <prediction-id>
 ```
 
-Shared flags: `--async`, `--wait`, `--prefer-wait [seconds]` (sends `Prefer: wait=N`, still polls if unfinished), `--wait-timeout <ms>`, `--no-download` (print URLs), `--output <path|dir/>`. `failed`/`canceled`/`aborted` predictions exit non-zero. Local files up to 256 KB are inlined as data URIs; larger files (< 100 MB) go through the Replicate Files API.
+Shared flags: `--async`, `--wait`, `--prefer-wait [seconds]` (integer 1-60, bare flag = 60; sends `Prefer: wait=N`, still polls if unfinished; put the prompt before a bare flag), `--wait-timeout <ms>`, `--no-download` (print URLs), `--output <path|dir/>`. `failed`/`canceled`/`aborted` predictions exit non-zero. Local files up to 256 KB are inlined as data URIs; larger files (< 100 MB) go through the Replicate Files API.
+
+Output downloads are `https://` only; `localhost` and loopback/private/link-local/special-purpose IP literals (including redirects; hostnames are not resolved) are refused, non-`replicate.delivery` hosts are downloaded with a warning, and each file is capped at `MULTIX_MAX_DOWNLOAD_MB` (default 2048). If submitting fails with a network error, timeout, 5xx, or an unreadable 2xx response, the prediction may still exist and bill: check https://replicate.com/predictions before retrying instead of resubmitting blindly.
 
 ## HeyGen
 
@@ -384,6 +386,7 @@ Requires `cwebp` (libwebp: `brew install webp`, `apt install webp`) on `PATH`.
 | Variable | Purpose |
 |---|---|
 | `MULTIX_OUTPUT_DIR` | Override default output dir |
+| `MULTIX_MAX_DOWNLOAD_MB` | Size limit per downloaded Replicate output file (default 2048) |
 | `OPENAI_IMAGE_MODEL` / `OPENAI_TTS_MODEL` / `OPENAI_STT_MODEL` | OpenAI model defaults |
 | `OPENROUTER_IMAGE_MODEL` | Default OpenRouter image model |
 | `OPENROUTER_FALLBACK_MODELS` | CSV; applies to `generate` AND `i2i` |