ima2-gen 1.1.5 → 1.1.7

package/lib/promptImport/githubSource.js

@@ -0,0 +1,205 @@
+import { promptImportError } from "./errors.js";
+
+const ALLOWED_HOSTS = new Set(["github.com", "raw.githubusercontent.com"]);
+const SUPPORTED_EXTENSIONS = new Set(["md", "markdown", "txt"]);
+const OWNER_REPO_RE = /^[A-Za-z0-9_.-]+$/;
+
+function safeDecode(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    throw promptImportError("INVALID_GITHUB_SOURCE", "Invalid encoded GitHub path");
+  }
+}
+
+function assertCleanPath(path) {
+  const lower = path.toLowerCase();
+  if (path.includes("\0") || lower.includes("%00")) {
+    throw promptImportError("INVALID_GITHUB_SOURCE", "GitHub path contains a null byte");
+  }
+  if (/%2f|%5c/i.test(path)) {
+    throw promptImportError("INVALID_GITHUB_SOURCE", "GitHub path contains an encoded slash");
+  }
+  const decoded = safeDecode(path);
+  if (decoded.includes("\\") || decoded.split("/").includes("..")) {
+    throw promptImportError("INVALID_GITHUB_SOURCE", "GitHub path traversal is not allowed");
+  }
+  return decoded.replace(/^\/+/, "");
+}
+
+function extensionForPath(path) {
+  const match = /\.([A-Za-z0-9]+)$/.exec(path);
+  return match?.[1]?.toLowerCase() ?? "";
+}
+
+function assertSupportedFilePath(path) {
+  const ext = extensionForPath(path);
+  if (!ext) {
+    throw promptImportError("FOLDER_IMPORT_DEFERRED", "Folder import is planned for a later version", 422);
+  }
+  if (!SUPPORTED_EXTENSIONS.has(ext)) {
+    throw promptImportError("UNSUPPORTED_EXTENSION", "Only .md, .markdown, and .txt files are supported");
+  }
+  return ext;
+}
+
+function assertOwnerRepo(owner, repo) {
+  if (!OWNER_REPO_RE.test(owner || "") || !OWNER_REPO_RE.test(repo || "")) {
+    throw promptImportError("INVALID_GITHUB_SOURCE", "Invalid GitHub owner or repository");
+  }
+}
+
+function normalizeUrlInput(input) {
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    return null;
+  }
+  if (!["http:", "https:"].includes(url.protocol)) {
+    throw promptImportError("INVALID_GITHUB_SOURCE", "Only http(s) GitHub URLs are supported");
+  }
+  if (!ALLOWED_HOSTS.has(url.hostname)) {
+    throw promptImportError("INVALID_GITHUB_SOURCE", "Only GitHub file URLs are supported");
+  }
+
+  const parts = url.pathname.split("/").filter(Boolean);
+  if (url.hostname === "github.com") {
+    const [owner, repo, marker, ref, ...pathParts] = parts;
+    assertOwnerRepo(owner, repo);
+    if (marker !== "blob") {
+      throw promptImportError("FOLDER_IMPORT_DEFERRED", "Only GitHub file URLs are supported in PR1", 422);
+    }
+    if (!ref || pathParts.length === 0) {
+      throw promptImportError("FOLDER_IMPORT_DEFERRED", "Folder import is planned for a later version", 422);
+    }
+    const path = assertCleanPath(pathParts.join("/"));
+    const ext = assertSupportedFilePath(path);
+    return {
+      kind: "github",
+      owner,
+      repo,
+      ref: safeDecode(ref),
+      path,
+      extension: ext,
+      htmlUrl: url.toString(),
+      rawUrl: `https://raw.githubusercontent.com/${owner}/${repo}/${encodeURIComponent(safeDecode(ref))}/${path}`,
+      tags: ["github", `repo:${owner}/${repo}`, `ref:${safeDecode(ref)}`, `file:${path.split("/").pop()}`, `ext:${ext}`],
+    };
+  }
+
+  const [owner, repo, ref, ...pathParts] = parts;
+  assertOwnerRepo(owner, repo);
+  if (!ref || pathParts.length === 0) {
+    throw promptImportError("FOLDER_IMPORT_DEFERRED", "Folder import is planned for a later version", 422);
+  }
+  const path = assertCleanPath(pathParts.join("/"));
+  const ext = assertSupportedFilePath(path);
+  return {
+    kind: "github",
+    owner,
+    repo,
+    ref: safeDecode(ref),
+    path,
+    extension: ext,
+    htmlUrl: `https://github.com/${owner}/${repo}/blob/${safeDecode(ref)}/${path}`,
+    rawUrl: url.toString(),
+    tags: ["github", `repo:${owner}/${repo}`, `ref:${safeDecode(ref)}`, `file:${path.split("/").pop()}`, `ext:${ext}`],
+  };
+}
+
+function normalizeShorthand(input) {
+  const match = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)(?:@([^:]+))?:(.+)$/.exec(input);
+  if (!match) {
+    throw promptImportError("INVALID_GITHUB_SOURCE", "Enter a GitHub file URL or owner/repo:path");
+  }
+  const [, owner, repo, rawRef, rawPath] = match;
+  assertOwnerRepo(owner, repo);
+  const ref = rawRef ? safeDecode(rawRef.trim()) : "main";
+  if (ref.includes("/")) {
+    throw promptImportError("AMBIGUOUS_GITHUB_REF", "Branches with slashes need GitHub API folder support planned for PR3");
+  }
+  const path = assertCleanPath(rawPath.trim());
+  const ext = assertSupportedFilePath(path);
+  return {
+    kind: "github",
+    owner,
+    repo,
+    ref,
+    path,
+    extension: ext,
+    htmlUrl: `https://github.com/${owner}/${repo}/blob/${ref}/${path}`,
+    rawUrl: `https://raw.githubusercontent.com/${owner}/${repo}/${encodeURIComponent(ref)}/${path}`,
+    tags: ["github", `repo:${owner}/${repo}`, `ref:${ref}`, `file:${path.split("/").pop()}`, `ext:${ext}`],
+  };
+}
+
+function validateFinalFetchUrl(rawUrl) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw promptImportError("INVALID_GITHUB_SOURCE", "GitHub fetch returned an invalid final URL");
+  }
+  if (!["http:", "https:"].includes(url.protocol)) {
+    throw promptImportError("INVALID_GITHUB_SOURCE", "GitHub fetch returned an unsupported protocol");
+  }
+  if (!ALLOWED_HOSTS.has(url.hostname)) {
+    throw promptImportError("INVALID_GITHUB_SOURCE", "GitHub fetch redirected to an unsupported host");
+  }
+  const parts = url.pathname.split("/").filter(Boolean);
+  if (url.hostname === "github.com") {
+    const marker = parts[2];
+    if (parts.length < 5 || marker !== "blob") {
+      throw promptImportError("INVALID_GITHUB_SOURCE", "GitHub fetch redirected to a non-file page");
+    }
+    const finalPath = assertCleanPath(parts.slice(4).join("/"));
+    assertSupportedFilePath(finalPath);
+    return;
+  }
+  if (parts.length < 4) {
+    throw promptImportError("INVALID_GITHUB_SOURCE", "GitHub fetch returned a non-file path");
+  }
+  const finalPath = assertCleanPath(parts.slice(3).join("/"));
+  assertSupportedFilePath(finalPath);
+}
+
+export function normalizeGitHubSource(input) {
+  const trimmed = typeof input === "string" ? input.trim() : "";
+  if (!trimmed) {
+    throw promptImportError("INVALID_GITHUB_SOURCE", "GitHub source is required");
+  }
+  return normalizeUrlInput(trimmed) ?? normalizeShorthand(trimmed);
+}
+
+export async function fetchGitHubSourceText(source, limits) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), limits.fetchTimeoutMs);
+  try {
+    const response = await fetch(source.rawUrl, { signal: controller.signal });
+    validateFinalFetchUrl(response.url);
+    if (!response.ok) {
+      throw promptImportError("INVALID_GITHUB_SOURCE", `GitHub file fetch failed with ${response.status}`, 422);
+    }
+    const contentLength = Number(response.headers.get("content-length") || 0);
+    if (contentLength > limits.maxFileBytesForPreview) {
+      throw promptImportError("REMOTE_FILE_TOO_LARGE", "Remote file is too large", 413);
+    }
+    const buffer = await response.arrayBuffer();
+    if (buffer.byteLength > limits.maxFileBytesForPreview) {
+      throw promptImportError("REMOTE_FILE_TOO_LARGE", "Remote file is too large", 413);
+    }
+    return new TextDecoder("utf-8", { fatal: false }).decode(buffer);
+  } catch (error) {
+    if (error?.name === "AbortError") {
+      throw promptImportError("REMOTE_FETCH_TIMEOUT", "GitHub fetch timed out", 504);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export function isSupportedPromptFileName(filename) {
+  return SUPPORTED_EXTENSIONS.has(extensionForPath(filename || ""));
+}

package/lib/promptImport/parsePromptCandidates.js

@@ -0,0 +1,140 @@
+import { createHash } from "crypto";
+
+function normalizeWhitespace(text) {
+  return text.replace(/\r\n/g, "\n").replace(/[ \t]+\n/g, "\n").trim();
+}
+
+function stripFrontmatter(text) {
+  return text.replace(/^---\s*\n[\s\S]*?\n---\s*\n/, "");
+}
+
+function isBoilerplate(line) {
+  const trimmed = line.trim();
+  return (
+    !trimmed ||
+    /^\[!\[.*\]\(.+\)\]\(.+\)$/.test(trimmed) ||
+    /^!\[.*\]\(.+\)$/.test(trimmed) ||
+    /^\[.*\]\(.+\)$/.test(trimmed)
+  );
+}
+
+function titleFromFilename(filename) {
+  return (filename || "Imported prompt")
+    .replace(/\.(txt|md|markdown)$/i, "")
+    .replace(/[-_]+/g, " ")
+    .trim() || "Imported prompt";
+}
+
+function candidateId(text, ordinal) {
+  return `candidate_${ordinal}_${createHash("sha256").update(text).digest("hex").slice(0, 10)}`;
+}
+
+function headingName(heading, fallback) {
+  return heading?.replace(/^#+\s*/, "").trim() || fallback;
+}
+
+function allowedCandidate(text, limits) {
+  const length = text.trim().length;
+  return length >= limits.minCandidateChars && length <= limits.maxCandidateChars;
+}
+
+function cleanMarkdownBody(text) {
+  return normalizeWhitespace(
+    text
+      .split("\n")
+      .filter((line) => !isBoilerplate(line))
+      .filter((line) => !/^\|.*\|$/.test(line.trim()))
+      .join("\n"),
+  );
+}
+
+function pushCandidate(candidates, rawText, options) {
+  const text = normalizeWhitespace(rawText);
+  if (!allowedCandidate(text, options.limits)) return;
+  const ordinal = candidates.length + 1;
+  candidates.push({
+    id: candidateId(text, ordinal),
+    name: options.name,
+    text,
+    tags: [...new Set(options.tags)],
+    warnings: options.warnings ?? [],
+    source: options.source,
+  });
+}
+
+function parseMarkdown(text, options) {
+  const source = stripFrontmatter(text).slice(0, options.limits.maxSourceCharsScanned);
+  const fencePattern = /```([A-Za-z0-9_-]*)\n([\s\S]*?)```/g;
+  const acceptedFenceLanguages = new Set(["", "prompt", "text", "markdown", "md"]);
+  const ranges = [];
+
+  for (const match of source.matchAll(fencePattern)) {
+    const language = (match[1] || "").toLowerCase();
+    if (!acceptedFenceLanguages.has(language)) continue;
+    ranges.push([match.index ?? 0, (match.index ?? 0) + match[0].length]);
+    pushCandidate(options.candidates, match[2], {
+      ...options,
+      name: `${options.baseName} ${options.candidates.length + 1}`,
+    });
+    if (options.candidates.length >= options.limits.maxPromptCandidatesPerFile) return;
+  }
+
+  const withoutFences = source
+    .split("\n")
+    .filter((line, index, lines) => {
+      const offset = lines.slice(0, index).join("\n").length + (index > 0 ? 1 : 0);
+      return !ranges.some(([start, end]) => offset >= start && offset < end);
+    })
+    .join("\n");
+  const sections = withoutFences.split(/(?=^#{1,4}\s+)/gm);
+  for (const section of sections) {
+    const heading = /^#{1,4}\s+(.+)$/m.exec(section)?.[1];
+    const body = cleanMarkdownBody(section.replace(/^#{1,4}\s+.+$/m, ""));
+    pushCandidate(options.candidates, body, {
+      ...options,
+      name: headingName(heading, `${options.baseName} ${options.candidates.length + 1}`),
+    });
+    if (options.candidates.length >= options.limits.maxPromptCandidatesPerFile) return;
+  }
+}
+
+function splitTextPrompts(text) {
+  const normalized = normalizeWhitespace(text);
+  const separatorBlocks = normalized.split(/\n\s*---+\s*\n/g).filter(Boolean);
+  const blocks = separatorBlocks.length > 1
+    ? separatorBlocks
+    : normalized.split(/\n\s*\n+/g).filter(Boolean);
+  const numbered = normalized.split(/(?=^\s*\d+[.)]\s+)/gm).filter(Boolean);
+  const longLines = normalized.split("\n").map((line) => line.trim()).filter((line) => line.length >= 80);
+  return blocks.length > 1 ? blocks : numbered.length > 1 ? numbered : longLines.length > 1 ? longLines : [normalized];
+}
+
+function parsePlainText(text, options) {
+  const chunks = splitTextPrompts(text.slice(0, options.limits.maxSourceCharsScanned));
+  for (const chunk of chunks) {
+    const clean = chunk.replace(/^\s*\d+[.)]\s+/, "");
+    pushCandidate(options.candidates, clean, {
+      ...options,
+      name: `${options.baseName} ${options.candidates.length + 1}`,
+    });
+    if (options.candidates.length >= options.limits.maxPromptCandidatesPerFile) return;
+  }
+}
+
+export function parsePromptCandidates({ text, filename, source, tags = [], limits }) {
+  const candidates = [];
+  const extension = (filename.split(".").pop() || "").toLowerCase();
+  const baseName = titleFromFilename(filename);
+  const common = {
+    candidates,
+    limits,
+    baseName,
+    tags,
+    source,
+  };
+
+  if (extension === "txt") parsePlainText(text, common);
+  else parseMarkdown(text, common);
+
+  return candidates.slice(0, limits.maxPromptCandidatesPerFile);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ima2-gen",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "Local OAuth image generation studio with classic and node workflows",
   "type": "module",
   "bin": {
@@ -18,7 +18,7 @@
     "test:package-install": "node --test tests/package-install-smoke.mjs",
     "setup": "node bin/ima2.js setup",
     "prepublishOnly": "npm test && npm run build && npm run test:package-install && npm run lint:pkg",
-    "lint:pkg": "node -e \"const p=require('./package.json'); const req=['name','version','bin']; for(const k of req){if(!p[k])throw new Error('missing '+k)} const mustInclude=['bin/','lib/','routes/','server.js']; for(const f of mustInclude){if(!p.files.includes(f))throw new Error('files[] must include '+f)}\"",
+    "lint:pkg": "node -e \"const p=require('./package.json'); const req=['name','version','bin']; for(const k of req){if(!p[k])throw new Error('missing '+k)} const mustInclude=['bin/','lib/','routes/','integrations/','server.js']; for(const f of mustInclude){if(!p.files.includes(f))throw new Error('files[] must include '+f)}\"",
     "release:patch": "npm version patch && npm publish && git push origin main --tags",
     "release:minor": "npm version minor && npm publish && git push origin main --tags",
     "release:major": "npm version major && npm publish && git push origin main --tags"
@@ -39,6 +39,7 @@
     "bin/",
     "lib/",
     "routes/",
+    "integrations/",
     "ui/dist/",
     "docs/",
     "assets/",

package/routes/annotations.js

@@ -0,0 +1,95 @@
+import { getDb } from "../lib/db.js";
+
+const MAX_ANNOTATION_PAYLOAD_CHARS = 256 * 1024;
+
+function getBrowserId(req) {
+  const browserId = req.headers["x-ima2-browser-id"];
+  return typeof browserId === "string" && browserId.trim() ? browserId.trim() : null;
+}
+
+function isSafeFilename(filename) {
+  return (
+    typeof filename === "string" &&
+    filename.length > 0 &&
+    filename.length <= 240 &&
+    !filename.includes("..") &&
+    !filename.startsWith("/") &&
+    !filename.includes("\\")
+  );
+}
+
+function normalizePayload(value) {
+  const payload = value?.annotations ?? value;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return { error: "annotations payload is required" };
+  }
+  const paths = Array.isArray(payload.paths) ? payload.paths : [];
+  const boxes = Array.isArray(payload.boxes) ? payload.boxes : [];
+  const memos = Array.isArray(payload.memos) ? payload.memos : [];
+  const normalized = { paths, boxes, memos };
+  const text = JSON.stringify(normalized);
+  if (text.length > MAX_ANNOTATION_PAYLOAD_CHARS) {
+    return { error: "annotations payload is too large" };
+  }
+  return { payload: normalized, text };
+}
+
+export function registerAnnotationRoutes(app) {
+  app.get("/api/annotations/:filename", (req, res) => {
+    try {
+      const browserId = getBrowserId(req);
+      const filename = decodeURIComponent(req.params.filename);
+      if (!browserId) return res.status(400).json({ error: "X-Ima2-Browser-Id header is required" });
+      if (!isSafeFilename(filename)) return res.status(400).json({ error: "invalid filename" });
+
+      const row = getDb()
+        .prepare("SELECT payload FROM image_annotations WHERE browser_id = ? AND filename = ?")
+        .get(browserId, filename);
+      const annotations = row ? JSON.parse(row.payload) : null;
+      res.json({ annotations });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.put("/api/annotations/:filename", (req, res) => {
+    try {
+      const browserId = getBrowserId(req);
+      const filename = decodeURIComponent(req.params.filename);
+      if (!browserId) return res.status(400).json({ error: "X-Ima2-Browser-Id header is required" });
+      if (!isSafeFilename(filename)) return res.status(400).json({ error: "invalid filename" });
+
+      const normalized = normalizePayload(req.body);
+      if (normalized.error) return res.status(400).json({ error: normalized.error });
+
+      const id = `${browserId}:${filename}`;
+      getDb().prepare(`
+        INSERT INTO image_annotations (id, browser_id, filename, payload, schema_version, updated_at)
+        VALUES (?, ?, ?, ?, 1, unixepoch())
+        ON CONFLICT(browser_id, filename) DO UPDATE SET
+          payload = excluded.payload,
+          schema_version = excluded.schema_version,
+          updated_at = unixepoch()
+      `).run(id, browserId, filename, normalized.text);
+      res.json({ ok: true });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.delete("/api/annotations/:filename", (req, res) => {
+    try {
+      const browserId = getBrowserId(req);
+      const filename = decodeURIComponent(req.params.filename);
+      if (!browserId) return res.status(400).json({ error: "X-Ima2-Browser-Id header is required" });
+      if (!isSafeFilename(filename)) return res.status(400).json({ error: "invalid filename" });
+
+      getDb()
+        .prepare("DELETE FROM image_annotations WHERE browser_id = ? AND filename = ?")
+        .run(browserId, filename);
+      res.json({ ok: true });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+}

package/routes/canvasVersions.js

@@ -0,0 +1,64 @@
+import express from "express";
+import { createCanvasVersion, updateCanvasVersion } from "../lib/canvasVersionStore.js";
+
+function decodeHeader(value) {
+  if (typeof value !== "string" || !value) return null;
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+
+function getRequestBuffer(req) {
+  return Buffer.isBuffer(req.body) ? req.body : Buffer.alloc(0);
+}
+
+function getPrompt(req) {
+  return decodeHeader(req.headers["x-ima2-canvas-prompt"]);
+}
+
+export function registerCanvasVersionRoutes(app, ctx) {
+  const rawPng = express.raw({ type: "image/png", limit: ctx.config.server.bodyLimit });
+
+  app.post("/api/canvas-versions", rawPng, async (req, res) => {
+    try {
+      const sourceFilename =
+        typeof req.query.sourceFilename === "string"
+          ? req.query.sourceFilename
+          : decodeHeader(req.headers["x-ima2-canvas-source-filename"]);
+      const item = await createCanvasVersion(ctx, {
+        sourceFilename,
+        prompt: getPrompt(req),
+        buffer: getRequestBuffer(req),
+      });
+      res.status(201).json({ item });
+    } catch (err) {
+      res.status(err.status || 500).json({
+        error: err.message,
+        code: err.code || "CANVAS_VERSION_SAVE_FAILED",
+      });
+    }
+  });
+
+  app.put("/api/canvas-versions/:filename", rawPng, async (req, res) => {
+    try {
+      const filename = decodeURIComponent(req.params.filename);
+      const sourceFilename =
+        typeof req.query.sourceFilename === "string"
+          ? req.query.sourceFilename
+          : decodeHeader(req.headers["x-ima2-canvas-source-filename"]);
+      const item = await updateCanvasVersion(ctx, filename, {
+        sourceFilename,
+        prompt: getPrompt(req),
+        buffer: getRequestBuffer(req),
+      });
+      res.json({ item });
+    } catch (err) {
+      res.status(err.status || 500).json({
+        error: err.message,
+        code: err.code || "CANVAS_VERSION_SAVE_FAILED",
+      });
+    }
+  });
+}

package/routes/comfy.js

@@ -0,0 +1,39 @@
+import { exportImageToComfy, isComfyBridgeError } from "../lib/comfyBridge.js";
+
+const ALLOWED_BODY_KEYS = new Set(["filename"]);
+
+function hasExactBodyShape(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return false;
+  const keys = Object.keys(body);
+  return keys.length === 1 && ALLOWED_BODY_KEYS.has(keys[0]) && typeof body.filename === "string";
+}
+
+function errorPayload(code, message) {
+  return {
+    ok: false,
+    error: { code, message },
+  };
+}
+
+export function registerComfyRoutes(app, ctx) {
+  app.post("/api/comfy/export-image", async (req, res) => {
+    try {
+      if (!hasExactBodyShape(req.body)) {
+        return res.status(400).json(errorPayload(
+          "COMFY_IMAGE_INVALID",
+          "Request body must contain exactly one filename.",
+        ));
+      }
+      const result = await exportImageToComfy(ctx, { filename: req.body.filename });
+      return res.json(result);
+    } catch (error) {
+      if (isComfyBridgeError(error)) {
+        return res.status(error.status).json(errorPayload(error.code, error.message));
+      }
+      return res.status(502).json(errorPayload(
+        "COMFY_UPLOAD_FAILED",
+        "Could not upload image to ComfyUI.",
+      ));
+    }
+  });
+}