ima2-gen 2.0.15 → 2.0.16

package/routes/nodes.js

@@ -1,455 +1,10 @@
-import { mkdir } from "fs/promises";
-import { newNodeId, saveNode, loadNodeMeta, loadAssetB64, } from "../lib/nodeStore.js";
-import { startJob, finishJob, registerJobAbortController, isJobCanceled, isStartJobFailure, INFLIGHT_RETRY_AFTER_SECONDS } from "../lib/inflight.js";
-import { isGenerationCanceledError, makeGenerationCanceledError, throwIfJobCanceled, } from "../lib/generationCancel.js";
-import { detectImageMimeFromB64, summarizeReferencePayload, validateAndNormalizeRefs } from "../lib/refs.js";
-import { classifyUpstreamError } from "../lib/errorClassify.js";
-import { normalizeOAuthParams } from "../lib/oauthNormalize.js";
-import { resolveProviderOptions } from "../lib/providerOptions.js";
-import { generateViaResponses, editViaResponses } from "../lib/responsesImageAdapter.js";
-import { generateViaGrok } from "../lib/grokImageAdapter.js";
-import { generateViaAgy } from "../lib/agyImageAdapter.js";
-import { generateViaGeminiApi } from "../lib/geminiApiImageAdapter.js";
-import { isNonRetryableGenerationError, normalizeGenerationFailure } from "../lib/generationErrors.js";
-import { logEvent, logError } from "../lib/logger.js";
+import { loadNodeMeta } from "../lib/nodeStore.js";
 import { errInfo } from "../lib/errInfo.js";
+import { runNodeGeneration } from "../lib/nodeGeneration.js";
 import { requireRuntimeContext } from "../lib/runtimeContext.js";
-import { validateModeration, imageFormatFromMime, writeSse, dataUrlFromB64 } from "../lib/routeHelpers.js";
-import { publish } from "../lib/eventBus.js";
-import { publishJobEvent } from "../lib/ssePublish.js";
-import { asUpstream, wantsSse, writeNodeError, loadParentNodeB64, toGrokReferences, nodeErrorDetails, } from "../lib/nodeHelpers.js";
 export function registerNodeRoutes(app, ctxRaw) {
     const ctx = requireRuntimeContext(ctxRaw);
-    app.post("/api/node/generate", async (req, res) => {
-        const body = (req.body ?? {});
-        const asyncMode = body.async === true;
-        const streamResponse = !asyncMode && wantsSse(req);
-        const parentNodeId = (typeof body.parentNodeId === "string" ? body.parentNodeId : null);
-        const requestId = typeof body.requestId === "string" ? body.requestId : (req.id ?? "");
-        const sessionId = typeof body.sessionId === "string" ? body.sessionId : null;
-        const clientNodeId = typeof body.clientNodeId === "string" ? body.clientNodeId : null;
-        let finishMeta = {};
-        let finishStatus = "completed";
-        let finishHttpStatus;
-        let finishErrorCode;
-        let finishCanceled = false;
-        const cancelController = new AbortController();
-        const referencePayload = summarizeReferencePayload(body.references);
-        try {
-            const { prompt, quality: rawQuality = "medium", size = "1024x1024", format = "png", moderation = "low", references = [], externalSrc = null, mode: promptMode = "auto", contextMode: rawContextMode = "parent-plus-refs", searchMode: rawSearchMode = "on", model: rawModel, reasoningEffort: rawReasoningEffort, } = body;
-            const { provider = "oauth" } = body;
-            const { quality, warnings: qualityWarnings } = normalizeOAuthParams({ provider, quality: rawQuality });
-            const normalizedPromptMode = promptMode === "direct" ? "direct" : "auto";
-            const contextMode = ["parent-plus-refs", "parent-only", "ancestry"].includes(rawContextMode)
-                ? rawContextMode
-                : "parent-plus-refs";
-            const searchMode = ["off", "auto", "on"].includes(rawSearchMode) ? rawSearchMode : "on";
-            const providerOptions = resolveProviderOptions(ctx, {
-                provider,
-                rawModel,
-                rawReasoningEffort,
-                rawSize: size,
-                rawWebSearchEnabled: body.webSearchEnabled,
-                searchMode,
-            });
-            if (providerOptions.error) {
-                finishStatus = "error";
-                finishHttpStatus = providerOptions.status;
-                finishErrorCode = providerOptions.code;
-                return res.status(providerOptions.status).json({
-                    error: { code: providerOptions.code, message: providerOptions.error },
-                    parentNodeId,
-                });
-            }
-            const imageModel = providerOptions.model;
-            const reasoningEffort = providerOptions.reasoningEffort;
-            const effectiveSize = providerOptions.size;
-            const webSearchEnabled = providerOptions.webSearchEnabled;
-            const activeProvider = providerOptions.provider;
-            const effectiveImageModel = (activeProvider === "grok" || activeProvider === "grok-api") && quality === "high"
-                ? "grok-imagine-image-quality"
-                : imageModel;
-            if (contextMode === "ancestry") {
-                finishStatus = "error";
-                finishHttpStatus = 400;
-                finishErrorCode = "CONTEXT_MODE_UNSUPPORTED";
-                return res.status(400).json({
-                    error: { code: "CONTEXT_MODE_UNSUPPORTED", message: "Ancestry context is not supported yet." },
-                    parentNodeId,
-                });
-            }
-            if (!prompt || typeof prompt !== "string") {
-                finishStatus = "error";
-                finishHttpStatus = 400;
-                finishErrorCode = "INVALID_PROMPT";
-                return res.status(400).json({
-                    error: { code: "INVALID_PROMPT", message: "Prompt is required" },
-                    parentNodeId,
-                });
-            }
-            const refCheckResult = validateAndNormalizeRefs(references);
-            if (refCheckResult.error) {
-                finishStatus = "error";
-                finishHttpStatus = 400;
-                finishErrorCode = refCheckResult.code;
-                return res.status(400).json({
-                    error: { code: refCheckResult.code, message: refCheckResult.error },
-                    code: refCheckResult.code,
-                    parentNodeId,
-                });
-            }
-            const refCheck = refCheckResult;
-            const moderationCheck = validateModeration(ctx, moderation);
-            if (moderationCheck.error) {
-                finishStatus = "error";
-                finishHttpStatus = 400;
-                finishErrorCode = "INVALID_MODERATION";
-                return res.status(400).json({
-                    error: { code: "INVALID_MODERATION", message: moderationCheck.error },
-                    parentNodeId,
-                });
-            }
-            const startTime = Date.now();
-            let parentB64 = null;
-            if (parentNodeId) {
-                parentB64 = await loadParentNodeB64(ctx, parentNodeId);
-            }
-            else if (typeof externalSrc === "string" && externalSrc.length > 0) {
-                parentB64 = await loadAssetB64(ctx.rootDir, externalSrc, ctx.config.storage.generatedDir);
-            }
-            const operation = parentB64 ? "edit" : "generate";
-            const referenceDiagnostics = refCheck.referenceDiagnostics || [];
-            const generateReferenceDiagnostics = operation === "generate" ? referenceDiagnostics : [];
-            const referenceMismatchCount = generateReferenceDiagnostics.filter((ref) => ref.warnings?.includes("mime_mismatch")).length;
-            const refsForRequest = contextMode === "parent-only" ? [] : (refCheck.refDetails || refCheck.refs);
-            const parentImagePresent = !!parentB64;
-            const inputImageCount = (parentImagePresent ? 1 : 0) + refsForRequest.length;
-            if ((activeProvider === "grok" || activeProvider === "agy" || activeProvider === "grok-api" || activeProvider === "gemini-api") && inputImageCount > 3) {
-                finishStatus = "error";
-                finishHttpStatus = 400;
-                const code = activeProvider === "agy" ? "AGY_REF_TOO_MANY" : "GROK_REF_TOO_MANY";
-                return res.status(400).json({
-                    error: {
-                        code,
-                        message: `${activeProvider === "agy" ? "Agy" : "Grok"} image editing supports up to 3 reference images.`,
-                    },
-                    code,
-                    parentNodeId,
-                });
-            }
-            const started = startJob({
-                requestId,
-                kind: "node",
-                prompt: body.prompt,
-                meta: {
-                    kind: "node",
-                    sessionId,
-                    parentNodeId,
-                    clientNodeId,
-                    refsCount: referencePayload.refsCount,
-                    referenceBytes: referencePayload.referenceBytes,
-                    referenceB64Chars: referencePayload.referenceB64Chars,
-                },
-            });
-            if (started && isStartJobFailure(started)) {
-                finishStatus = "error";
-                finishHttpStatus = started.code === "TOO_MANY_JOBS" ? 429 : 409;
-                finishErrorCode = started.code;
-                if (started.code === "TOO_MANY_JOBS") {
-                    res.setHeader("Retry-After", String(INFLIGHT_RETRY_AFTER_SECONDS));
-                }
-                return writeNodeError(res, finishHttpStatus, started.code, started.code === "TOO_MANY_JOBS"
-                    ? "Too many concurrent generation jobs"
-                    : "Request ID already in use", parentNodeId, {}, requestId);
-            }
-            registerJobAbortController(requestId, cancelController);
-            if (asyncMode)
-                res.status(202).json({ requestId });
-            logEvent("node", "request", {
-                requestId,
-                operation,
-                sessionId,
-                parentNodeId,
-                clientNodeId,
-                quality,
-                model: effectiveImageModel,
-                size: effectiveSize,
-                moderation,
-                refs: refsForRequest.length,
-                referenceBytes: referencePayload.referenceBytes,
-                referenceMismatchCount,
-                refDetectedMimes: [...new Set(generateReferenceDiagnostics.map((ref) => ref.detectedMime).filter(Boolean))].join(","),
-                refDeclaredMimes: [...new Set(generateReferenceDiagnostics.map((ref) => ref.declaredMime).filter(Boolean))].join(","),
-                inputImageCount,
-                parentImagePresent,
-                contextMode,
-                searchMode,
-                webSearchEnabled,
-                promptChars: prompt.length,
-                promptMode: normalizedPromptMode,
-            });
-            const emitProgress = streamResponse || asyncMode;
-            if (streamResponse) {
-                res.writeHead(200, {
-                    "Content-Type": "text/event-stream; charset=utf-8",
-                    "Cache-Control": "no-cache, no-transform",
-                    Connection: "keep-alive",
-                });
-                writeSse(res, "phase", { requestId, phase: "streaming" });
-                publish(requestId, "phase", { requestId, phase: "streaming" });
-            }
-            else if (asyncMode) {
-                publish(requestId, "phase", { requestId, phase: "streaming" });
-            }
-            let b64, usage, webSearchCalls = 0, revisedPrompt = null;
-            const grokDirectApiKey = activeProvider === "grok-api" ? ctx.xaiApiKey : undefined;
-            let resultFormat = activeProvider === "grok" || activeProvider === "agy" || activeProvider === "grok-api" || activeProvider === "gemini-api" ? "jpeg" : format;
-            const maxAttempts = inputImageCount > 0 ? 1 : 2;
-            let lastErr = null;
-            for (let attempt = 0; attempt < maxAttempts; attempt++) {
-                try {
-                    logEvent("node", "attempt", {
-                        requestId,
-                        attempt,
-                        operation,
-                        sessionId,
-                        parentNodeId,
-                        clientNodeId,
-                        model: effectiveImageModel,
-                        moderation,
-                        quality,
-                        size: effectiveSize,
-                        refs: refsForRequest.length,
-                        inputImageCount,
-                        parentImagePresent,
-                        contextMode,
-                        searchMode,
-                        webSearchEnabled,
-                    });
-                    const r = activeProvider === "gemini-api"
-                        ? await generateViaGeminiApi(parentB64 ? `Edit this image: ${prompt}` : prompt, requireRuntimeContext(ctx), {
-                            model: effectiveImageModel,
-                            size: effectiveSize,
-                            signal: cancelController.signal,
-                            requestId,
-                            references: parentB64
-                                ? [{ b64: parentB64, declaredMime: null, detectedMime: null }, ...(refCheck.refDetails || [])]
-                                : refCheck.refDetails,
-                        })
-                        : activeProvider === "agy"
-                            ? await generateViaAgy(parentB64 ? `Edit this image: ${prompt}` : prompt, {
-                                references: parentB64
-                                    ? [{ b64: parentB64, declaredMime: null, detectedMime: null }]
-                                    : undefined,
-                                signal: cancelController.signal,
-                                requestId,
-                            })
-                            : activeProvider === "grok" || activeProvider === "grok-api"
-                                ? await generateViaGrok(prompt, ctx, {
-                                    model: effectiveImageModel,
-                                    size: effectiveSize,
-                                    requestId,
-                                    signal: cancelController.signal,
-                                    references: toGrokReferences(parentB64, refsForRequest),
-                                    directApiKey: grokDirectApiKey,
-                                })
-                                : parentB64
-                                    ? await editViaResponses(activeProvider, prompt, parentB64, quality, effectiveSize, moderation, normalizedPromptMode, ctx, requestId, {
-                                        model: effectiveImageModel,
-                                        references: refsForRequest,
-                                        searchMode,
-                                        reasoningEffort,
-                                        webSearchEnabled,
-                                        signal: cancelController.signal,
-                                    })
-                                    : await generateViaResponses(activeProvider, prompt, quality, effectiveSize, moderation, refsForRequest, requestId, normalizedPromptMode, ctx, {
-                                        model: effectiveImageModel,
-                                        reasoningEffort,
-                                        webSearchEnabled,
-                                        signal: cancelController.signal,
-                                        partialImages: emitProgress ? 2 : 0,
-                                        onPartialImage: emitProgress
-                                            ? (partial) => {
-                                                if (isJobCanceled(requestId))
-                                                    return;
-                                                const pd = { requestId, image: dataUrlFromB64(format, partial.b64), index: partial.index };
-                                                if (streamResponse)
-                                                    writeSse(res, "partial", pd);
-                                                publish(requestId, "partial", pd);
-                                            }
-                                            : null,
-                                    });
-                    throwIfJobCanceled(requestId);
-                    if (r.b64) {
-                        b64 = r.b64;
-                        usage = r.usage;
-                        webSearchCalls = r.webSearchCalls || 0;
-                        revisedPrompt = r.revisedPrompt || null;
-                        if (activeProvider === "grok" || activeProvider === "grok-api" || activeProvider === "gemini-api") {
-                            resultFormat = imageFormatFromMime(("mime" in r ? r.mime : undefined) || detectImageMimeFromB64(r.b64) || "image/jpeg");
-                        }
-                        break;
-                    }
-                    lastErr = { message: "Empty response (safety refusal)" };
-                }
-                catch (e) {
-                    lastErr = asUpstream(e);
-                    if (isNonRetryableGenerationError(lastErr))
-                        break;
-                }
-                if (attempt + 1 < maxAttempts) {
-                    logEvent("node", "retry", {
-                        requestId,
-                        attempt: attempt + 1,
-                        operation,
-                        parentNodeId,
-                        clientNodeId,
-                        errorCode: lastErr?.code,
-                        errorEventType: lastErr?.eventType,
-                        errorEventCount: lastErr?.eventCount,
-                    });
-                }
-            }
-            if (!b64) {
-                const finalErr = normalizeGenerationFailure(lastErr, {
-                    safetyMessage: lastErr?.message || "Empty response after generation attempt",
-                });
-                finishStatus = "error";
-                finishHttpStatus = finalErr.status || 500;
-                finishErrorCode = finalErr.code || "NODE_GEN_FAILED";
-                logEvent("node", "final_error", {
-                    requestId,
-                    operation,
-                    finalCode: finishErrorCode,
-                    upstreamCode: lastErr?.upstreamCode || lastErr?.code,
-                    errorEventType: lastErr?.eventType,
-                    errorEventCount: lastErr?.eventCount,
-                    diagnosticReason: lastErr?.diagnosticReason,
-                    retryKind: lastErr?.retryKind,
-                    referencesDroppedOnRetry: lastErr?.referencesDroppedOnRetry,
-                    attempts: maxAttempts,
-                    outerHttpAlreadyCommitted: res.headersSent,
-                    sseErrorSent: streamResponse,
-                });
-                return writeNodeError(res, finishHttpStatus ?? 500, finishErrorCode ?? "NODE_GEN_FAILED", finalErr.message, parentNodeId, nodeErrorDetails(finalErr, lastErr), requestId);
-            }
-            const nodeId = newNodeId();
-            throwIfJobCanceled(requestId);
-            const elapsed = +((Date.now() - startTime) / 1000).toFixed(1);
-            const meta = {
-                nodeId,
-                parentNodeId,
-                sessionId,
-                clientNodeId,
-                prompt,
-                userPrompt: prompt,
-                revisedPrompt,
-                promptMode: normalizedPromptMode,
-                options: { quality, size: effectiveSize, format: resultFormat, moderation },
-                model: effectiveImageModel,
-                reasoningEffort,
-                createdAt: Date.now(),
-                createdAtIso: new Date().toISOString(),
-                elapsed,
-                usage: usage || null,
-                webSearchCalls,
-                webSearchEnabled,
-                contextMode,
-                searchMode,
-                provider: activeProvider,
-                kind: parentB64 ? "edit" : "generate",
-                requestId,
-                refsCount: refsForRequest.length,
-                quality,
-                size: effectiveSize,
-                format: resultFormat,
-                moderation,
-            };
-            await mkdir(ctx.config.storage.generatedDir, { recursive: true });
-            throwIfJobCanceled(requestId);
-            const { filename } = await saveNode(ctx.rootDir, {
-                nodeId,
-                b64,
-                meta,
-                ext: resultFormat,
-                generatedDir: ctx.config.storage.generatedDir,
-            });
-            finishMeta = { nodeId, filename, imageChars: b64.length };
-            finishHttpStatus = 200;
-            logEvent("node", "saved", {
-                requestId,
-                nodeId,
-                filename,
-                imageChars: b64.length,
-                elapsedMs: Date.now() - startTime,
-            });
-            const payload = {
-                nodeId,
-                parentNodeId,
-                requestId,
-                image: dataUrlFromB64(resultFormat, b64),
-                filename,
-                url: `/generated/${filename}`,
-                elapsed,
-                usage,
-                webSearchCalls,
-                webSearchEnabled,
-                provider: activeProvider,
-                model: effectiveImageModel,
-                reasoningEffort,
-                size: effectiveSize,
-                format: resultFormat,
-                moderation,
-                refsCount: refsForRequest.length,
-                contextMode,
-                searchMode,
-                warnings: qualityWarnings,
-                revisedPrompt,
-                promptMode: normalizedPromptMode,
-            };
-            publishJobEvent(requestId, "done", payload);
-            if (res.writableEnded) {
-                // async mode — response already sent
-            }
-            else if (streamResponse) {
-                writeSse(res, "done", payload);
-                res.end();
-            }
-            else {
-                res.json(payload);
-            }
-        }
-        catch (e) {
-            const err = errInfo(e);
-            const ext = (err.raw && typeof err.raw === "object" ? err.raw : {});
-            const code = err.code || classifyUpstreamError(err.message) || "NODE_GEN_FAILED";
-            if (isGenerationCanceledError(err.raw) || isJobCanceled(requestId)) {
-                const canceled = makeGenerationCanceledError();
-                finishCanceled = true;
-                finishHttpStatus = canceled.status;
-                finishErrorCode = canceled.code;
-                return writeNodeError(res, canceled.status, canceled.code, canceled.message, parentNodeId, {}, requestId);
-            }
-            finishStatus = "error";
-            finishHttpStatus = err.status || 500;
-            finishErrorCode = code;
-            logError("node", "error", err.raw, { requestId, code, parentNodeId, sessionId, clientNodeId });
-            writeNodeError(res, err.status || 500, code, err.message, parentNodeId, {
-                upstreamCode: ext.upstreamCode || null,
-                upstreamType: ext.upstreamType || null,
-                upstreamParam: ext.upstreamParam || null,
-            }, requestId);
-        }
-        finally {
-            finishJob(requestId, {
-                canceled: finishCanceled,
-                status: finishStatus,
-                httpStatus: finishHttpStatus,
-                errorCode: finishErrorCode,
-                meta: finishMeta,
-            });
-        }
-    });
+    app.post("/api/node/generate", (req, res) => runNodeGeneration(req, res, ctx));
     app.get("/api/node/:nodeId", async (req, res) => {
         try {
             const { nodeId } = req.params;

package/routes/video.js

@@ -21,8 +21,14 @@ import { generateVideoThumbnail } from "../lib/videoThumb.js";
 import { publish } from "../lib/eventBus.js";
 import { publishJobEvent } from "../lib/ssePublish.js";
 function sendSse(res, event, data) {
-    res.write(`event: ${event}\n`);
-    res.write(`data: ${JSON.stringify(data)}\n\n`);
+    if (res.writableEnded || res.destroyed)
+        return;
+    try {
+        res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+    }
+    catch {
+        /* client went away mid-write; bus emit still delivers */
+    }
 }
 function dualEmitVideo(res, requestId, event, data) {
     if (!res.writableEnded)
@@ -107,6 +113,7 @@ export function registerVideoRoutes(app, ctxRaw) {
         let finishErrorCode;
         let finishMeta = {};
         let finishCanceled = false;
+        let jobOwned = false;
         const cancelController = new AbortController();
         if (!asyncMode) {
             res.setHeader("Content-Type", "text/event-stream; charset=utf-8");
@@ -249,6 +256,7 @@ export function registerVideoRoutes(app, ctxRaw) {
                     ? "Too many concurrent generation jobs"
                     : "Request ID already in use");
             }
+            jobOwned = true;
             registerJobAbortController(requestId, cancelController);
             if (asyncMode)
                 res.status(202).json({ requestId });
@@ -389,7 +397,8 @@ export function registerVideoRoutes(app, ctxRaw) {
             }
         }
         finally {
-            finishJob(requestId, { canceled: finishCanceled, status: finishStatus, httpStatus: finishHttpStatus, errorCode: finishErrorCode, meta: finishMeta });
+            if (jobOwned)
+                finishJob(requestId, { canceled: finishCanceled, status: finishStatus, httpStatus: finishHttpStatus, errorCode: finishErrorCode, meta: finishMeta });
             if (!res.writableEnded)
                 res.end();
         }

package/routes/videoExtended.js

@@ -15,6 +15,15 @@ function routeError(message, status = 400) {
     return Object.assign(new Error(message), { status });
 }
 function sendError(res, err) {
+    if (err?.name === "TimeoutError") {
+        res.status(504).json({ error: "Video operation timed out", code: "VIDEO_TIMEOUT" });
+        return;
+    }
+    if (err?.name === "AbortError") {
+        if (!res.headersSent)
+            res.status(499).json({ error: "Request canceled", code: "REQUEST_CANCELED" });
+        return;
+    }
     res.status(typeof err?.status === "number" ? err.status : 500).json({ error: err?.message || String(err) });
 }
 async function safeGeneratedFile(ctx, file, options = {}) {
@@ -102,7 +111,11 @@ async function saveVideoResult(ctx, options) {
     invalidateHistoryIndex();
     return { filename, url: `/generated/${encodeURIComponent(filename)}`, sourceUrl: options.videoUrl };
 }
-function requestSignal(req, res) {
+function envDeadline(name, fallbackMs) {
+    const value = Number(process.env[name]);
+    return Number.isFinite(value) && value >= 1000 ? value : fallbackMs;
+}
+function requestSignal(req, res, timeoutMs) {
     const ac = new AbortController();
     const abort = () => {
         if (!res.writableEnded)
@@ -110,7 +123,7 @@ function requestSignal(req, res) {
     };
     req.on("aborted", abort);
     res.on("close", abort);
-    return ac.signal;
+    return AbortSignal.any([ac.signal, AbortSignal.timeout(timeoutMs)]);
 }
 function requirePrompt(value) {
     return typeof value === "string" && value.trim() ? value : null;
@@ -143,7 +156,7 @@ export function registerVideoExtendedRoutes(app, ctxRaw) {
             if (!videoUrl || typeof videoUrl !== "string")
                 return res.status(400).json({ error: "videoUrl required" });
             const validModel = validateEditModel(model);
-            const signal = requestSignal(req, res);
+            const signal = requestSignal(req, res, envDeadline("IMA2_VIDEO_EDIT_TIMEOUT_MS", 10 * 60_000));
             const { url, headers } = videoProxyUrl(ctx, "/v1/videos/edits");
             const video = await resolveVideoInput(ctx, videoUrl);
             const apiRes = await fetch(url, { method: "POST", headers, body: JSON.stringify({ model: validModel, prompt, video }), signal });
@@ -182,7 +195,7 @@ export function registerVideoExtendedRoutes(app, ctxRaw) {
             const dur = Number(duration);
             if (!Number.isInteger(dur) || dur < 2 || dur > 10)
                 return res.status(400).json({ error: "duration must be an integer between 2 and 10" });
-            const signal = requestSignal(req, res);
+            const signal = requestSignal(req, res, envDeadline("IMA2_VIDEO_EXTEND_TIMEOUT_MS", 10 * 60_000));
             const { url, headers } = videoProxyUrl(ctx, "/v1/videos/extensions");
             const video = await resolveVideoInput(ctx, videoUrl);
             const apiRes = await fetch(url, { method: "POST", headers, body: JSON.stringify({ model: validModel, prompt, duration: dur, video }), signal });
@@ -238,6 +251,7 @@ export function registerVideoExtendedRoutes(app, ctxRaw) {
     // --- Video Analysis (Grok 4.3 Vision) ---
     app.post("/api/video/analyze", async (req, res) => {
         try {
+            const signal = requestSignal(req, res, envDeadline("IMA2_VIDEO_ANALYZE_TIMEOUT_MS", 2 * 60_000));
             const { videoUrl } = req.body ?? {};
             if (!videoUrl || typeof videoUrl !== "string")
                 return res.status(400).json({ error: "videoUrl required" });
@@ -268,6 +282,7 @@ export function registerVideoExtendedRoutes(app, ctxRaw) {
                                 ],
                             }],
                     }),
+                    signal,
                 });
                 if (!apiRes.ok) {
                     const t = await apiRes.text();

package/server.js

@@ -10,7 +10,7 @@ import { startGrokProxy } from "./lib/grokProxyLauncher.js";
 import { startOAuthProxy } from "./lib/oauthLauncher.js";
 import { migrateGeneratedStorage } from "./lib/storageMigration.js";
 import { purgeStaleJobs } from "./lib/inflight.js";
-import { configureLogger } from "./lib/logger.js";
+import { configureLogger, logError } from "./lib/logger.js";
 import { createRequestLogger } from "./lib/requestLogger.js";
 import { configureApiCachePolicy } from "./lib/apiCachePolicy.js";
 import { configureRoutes } from "./routes/index.js";
@@ -21,6 +21,7 @@ import { stopAgentQueueWorker } from "./lib/agentQueueWorker.js";
 import { reapCardNewsJobs } from "./lib/cardNewsJobStore.js";
 import { reapTerminalJobs } from "./lib/inflight.js";
 import { errInfo } from "./lib/errInfo.js";
+import { timingSafeEqual } from "node:crypto";
 const rootDir = dirname(fileURLToPath(import.meta.url));
 async function loadApiKey() {
     if (process.env.OPENAI_API_KEY) {
@@ -152,11 +153,43 @@ function setUiStaticHeaders(res, filePath) {
         res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
     }
 }
+export function isLoopbackHost(host) {
+    const normalized = String(host || "").trim().toLowerCase();
+    return normalized === "127.0.0.1" || normalized === "::1" || normalized === "localhost";
+}
+export function assertLanAccessConfiguration(host, token) {
+    if (isLoopbackHost(host) || token)
+        return;
+    const message = `[server.security] Refusing non-loopback host ${host || "<empty>"}: set IMA2_LAN_TOKEN to enable LAN access.`;
+    console.error(message);
+    throw new Error(message);
+}
+function tokenMatches(actual, expected) {
+    if (typeof actual !== "string")
+        return false;
+    const actualBuffer = Buffer.from(actual);
+    const expectedBuffer = Buffer.from(expected);
+    return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);
+}
+function createLanApiGuard(host, token) {
+    const requiredToken = isLoopbackHost(host) ? "" : String(token || "");
+    return function lanApiGuard(req, res, next) {
+        if (!requiredToken || !req.path.startsWith("/api"))
+            return next();
+        const supplied = req.get("x-ima2-token") ?? req.query.token;
+        if (tokenMatches(supplied, requiredToken))
+            return next();
+        return res.status(401).json({
+            error: { code: "LAN_TOKEN_REQUIRED", message: "A valid IMA2 LAN token is required" },
+        });
+    };
+}
 export function buildApp(ctx) {
     const app = express();
     configureApiCachePolicy(app);
     configureLogger({ level: ctx.config.log.level });
     app.use(createRequestLogger());
+    app.use(createLanApiGuard(ctx.config.server.host, ctx.config.server.lanToken));
     app.use(express.json({ limit: ctx.config.server.bodyLimit }));
     app.use(express.static(join(ctx.rootDir, "ui", "dist"), {
         setHeaders: setUiStaticHeaders,
@@ -173,6 +206,24 @@ export function buildApp(ctx) {
         immutable: true,
     }));
     configureRoutes(app, ctx);
+    app.use((_req, res) => {
+        res.status(404).json({ error: { code: "NOT_FOUND", message: "Route not found" } });
+    });
+    app.use((error, _req, res, _next) => {
+        const info = errInfo(error);
+        const candidateStatus = Number(info.status);
+        const operational = Boolean(error?.isOperational)
+            || (Number.isInteger(candidateStatus) && candidateStatus >= 400 && candidateStatus < 500);
+        const status = operational ? candidateStatus : 500;
+        if (!operational)
+            logError("server", "unhandled:error", error);
+        res.status(status).json({
+            error: {
+                code: operational && info.code ? info.code : "INTERNAL_ERROR",
+                message: operational ? info.message : "Internal server error",
+            },
+        });
+    });
     return app;
 }
 function runtimeHostUrl(host) {
@@ -309,6 +360,7 @@ export async function createRuntimeContext(overrides = {}) {
 }
 export async function startServer(overrides = {}) {
     const ctx = await createRuntimeContext(overrides);
+    assertLanAccessConfiguration(ctx.config.server.host, ctx.config.server.lanToken);
     await migrateGeneratedStorage(ctx);
     purgeStaleJobs();
     const app = buildApp(ctx);