pixelkiln 0.12.0 → 0.12.1

package/CONTRIBUTING.md

@@ -15,6 +15,7 @@ npm ci
 npm run test:release
 npm run typecheck
 npm run test:docs
+npm run test:security
 npm test
 npm run build
 npm run test:package
@@ -72,6 +73,9 @@ wire contracts.
   workflow detail in `docs/`, and link every guide from `docs/README.md`.
 - Run `npm run test:docs` after changing Markdown or the CLI command/flag
   surface. It checks local links, the docs index, README size, and CLI coverage.
+- Run `npm run test:security` after changing provider source handling, lockfile
+  fixtures, or benchmark state. It scans tracked JSON without printing a
+  credential-bearing value.
 - Run the website lint and build checks when changing `website/` or the
   canonical Markdown it renders.
 - Run the package smoke test when changing exports, build configuration, the
@@ -85,6 +89,8 @@ wire contracts.
   I/O and estimates must carry their cost unit.
 - Provider responses are untrusted input and need runtime validation before
   entering the lockfile.
+- Temporary signed URLs must not settle in a committed lockfile. Persist a
+  refreshable provider reference and keep storage credentials transient.
 - Lockfile writes must remain atomic and resumable. Additive defaults should
   preserve valid v2 files when extending lock entries.
 - Unknown flags and ambiguous output selection are errors. Silent widening is

package/PROVIDERS.md

@@ -26,6 +26,8 @@ them.
 Live tests now cover single-candidate RD Fast and RD Plus stills from cost quote
 through submit, poll, PNG download, lockfile provenance, and cache validation.
 The RD Plus run covered isometric-asset, top-down-asset, and environment styles.
+Lockfiles retain refreshable `retrodiffusion://` result references rather than
+temporary signed storage URLs.
 Retro Diffusion's multi-candidate review, tileset, GIF, and spritesheet paths
 have mocked integration coverage but still need representative paid live runs.
 

package/README.md

@@ -57,7 +57,7 @@ PixelKiln keeps the missing record:
 | Plan and budget | Offline manifest/lock/disk diff, provider-unit estimates, hard `--budget` ceiling, JSON/CI gate. |
 | Generate and review | Resumable submit/poll/pick/fetch pipeline with a fast local candidate sheet. |
 | Existing-art onboarding | Manifest scaffolding, exact-hash account adoption, and prompt recovery. |
-| Recovery | Validated local content cache, provider URL restore, account object-hash cache, and resumable jobs. |
+| Recovery | Validated local content cache, durable provider-reference restore, account object-hash cache, and resumable jobs. |
 | Shared-account safety | Cross-project claim files or a registered workspace catalog, sibling-style exclusion, reviewed salvage, keep/discard tags, separate confirmed purge. |
 | Quality control | Palette distance, transparency, color-count, relative outlier, cache-integrity, and doctor gates. |
 | Sprite packaging | Deterministic RGBA packing, stable-cell mounting, explicit external input lists, structural output roles. |

package/SECURITY.md

@@ -29,10 +29,19 @@ reporter.
 
 PixelKiln handles provider credentials, paid API actions, remote object deletion,
 local output paths, a localhost review server, and generated HTML containing
-provider data. Reports involving authentication leakage, path traversal,
+provider data. Temporary provider result URLs can also contain signing
+credentials in their query string. Reports involving authentication leakage, path traversal,
 cross-origin review actions, HTML/script injection, unsafe overwrite/delete
 behavior, lockfile corruption, or budget bypass are security relevant.
 
 Never attach a real `PIXELLAB_API_KEY`, `RD_API_KEY`, `.env` file, private
 provider URL, or unredacted lockfile from a confidential project to a public
 report.
+
+PixelKiln keeps durable provider references in lockfiles when an adapter can
+refresh an expiring result. After successful ingestion it removes signed URLs,
+inline data URLs, and local file URLs from settled lock entries. A failed
+download may retain its source locally so `fetch` can retry, but that in-flight
+lockfile should not be committed. `npm run test:security` checks every tracked
+JSON file for credential-bearing URLs and reports only the file and JSON path,
+never the sensitive value.

package/dist/cli.js

@@ -1963,6 +1963,7 @@ function firstUrl(urls) {
 
 // src/providers/retrodiffusion.ts
 var DEFAULT_BASE_URL2 = "https://api.retrodiffusion.ai/v1";
+var SOURCE_PROTOCOL = "retrodiffusion:";
 var RetroDiffusionClient = class {
   constructor(token, baseUrl = DEFAULT_BASE_URL2, request = fetch) {
     this.token = token;
@@ -2042,7 +2043,7 @@ var RetroDiffusionProvider = class _RetroDiffusionProvider {
     return new _RetroDiffusionProvider(new RetroDiffusionClient(void 0));
   }
   static forDownloads() {
-    return _RetroDiffusionProvider.forOffline();
+    return new _RetroDiffusionProvider(new RetroDiffusionClient(process.env.RD_API_KEY));
   }
   supports(generator) {
     return generator === "map" || generator === "pixflux" || generator === "tiles" || generator === "animation";
@@ -2148,11 +2149,15 @@ var RetroDiffusionProvider = class _RetroDiffusionProvider {
     const urls = sources.map((source) => source.url);
     if (!urls.length) return { status: "failed", error: "Retro Diffusion task returned no images" };
     if (urls.length > 1) return { status: "review", candidateUrls: urls };
+    const durableSources = sources.map((source, index) => ({
+      ...source,
+      url: sourceRef2(jobId, index, mediaType)
+    }));
     return {
       status: "ready",
       objectId: `${jobId}#0`,
-      sourceUrl: urls[0],
-      sources,
+      sourceUrl: durableSources[0].url,
+      sources: durableSources,
       metadata: {
         balanceCost: task.result?.balance_cost ?? null,
         remainingBalance: task.result?.remaining_balance ?? null,
@@ -2171,9 +2176,26 @@ var RetroDiffusionProvider = class _RetroDiffusionProvider {
     if (task.status !== "succeeded") throw new Error(`Retro Diffusion task ${jobId} is not ready`);
     const url = resultSources(task.result, MediaType.PNG)[index]?.url;
     if (!url) throw new Error(`Retro Diffusion task ${jobId} has no candidate at index ${index}`);
-    return { objectId: `${jobId}#${index}`, sourceUrl: url };
+    return { objectId: `${jobId}#${index}`, sourceUrl: sourceRef2(jobId, index, MediaType.PNG) };
   }
   async download(url) {
+    if (url.startsWith(`${SOURCE_PROTOCOL}//`)) {
+      const reference = parseSourceRef(url);
+      const task = await this.client.task(reference.jobId);
+      if (task.status !== "succeeded") {
+        throw new Error(`Retro Diffusion task ${reference.jobId} is not ready`);
+      }
+      const source = resultSources(task.result, reference.mediaType)[reference.index]?.url;
+      if (!source) {
+        throw new Error(
+          `Retro Diffusion task ${reference.jobId} has no output at index ${reference.index}`
+        );
+      }
+      return this.downloadResolved(source);
+    }
+    return this.downloadResolved(url);
+  }
+  async downloadResolved(url) {
     const data = /^data:[^;]+;base64,(.+)$/.exec(url)?.[1];
     if (data) return Buffer.from(data, "base64");
     const response = await fetch(url);
@@ -2184,6 +2206,23 @@ var RetroDiffusionProvider = class _RetroDiffusionProvider {
     return { unit: "usd", remaining: await this.client.balance() };
   }
 };
+function sourceRef2(jobId, index, mediaType) {
+  const url = new URL("retrodiffusion://output");
+  url.searchParams.set("job", jobId);
+  url.searchParams.set("index", String(index));
+  url.searchParams.set("mediaType", mediaType);
+  return url.href;
+}
+function parseSourceRef(value) {
+  const url = new URL(value);
+  const jobId = url.searchParams.get("job");
+  const index = Number(url.searchParams.get("index"));
+  const rawMediaType = url.searchParams.get("mediaType");
+  if (url.protocol !== SOURCE_PROTOCOL || url.hostname !== "output" || !jobId || !Number.isInteger(index) || index < 0 || rawMediaType !== MediaType.PNG && rawMediaType !== MediaType.GIF) {
+    throw new Error("Invalid durable Retro Diffusion source reference");
+  }
+  return { jobId, index, mediaType: rawMediaType };
+}
 function retroOptions(spec) {
   return spec.providerOptions;
 }
@@ -3343,6 +3382,45 @@ async function poll(provider, lock, lockPath, opts = {}) {
 import { existsSync as existsSync6 } from "fs";
 import { mkdir as mkdir2, readFile as readFile4, rename as rename2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import path9 from "path";
+
+// src/source-url.ts
+var SENSITIVE_QUERY_KEYS = /* @__PURE__ */ new Set([
+  "access_token",
+  "apikey",
+  "api_key",
+  "auth",
+  "authorization",
+  "awsaccesskeyid",
+  "googleaccessid",
+  "key",
+  "sig"
+]);
+function isSensitiveSourceUrl(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return false;
+  }
+  if (parsed.username || parsed.password) return true;
+  for (const key of parsed.searchParams.keys()) {
+    const normalized = key.toLowerCase();
+    if (SENSITIVE_QUERY_KEYS.has(normalized) || normalized.includes("credential") || normalized.includes("signature") || normalized.includes("security-token") || normalized.includes("token")) return true;
+  }
+  return false;
+}
+function shouldPersistSourceUrl(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return true;
+  }
+  if (parsed.protocol === "data:" || parsed.protocol === "file:") return false;
+  return !isSensitiveSourceUrl(value);
+}
+
+// src/pipeline/fetch.ts
 async function fetchAssets(provider, specs, lock, lockPath, opts = {}) {
   const log2 = opts.onProgress ?? (() => {
   });
@@ -3444,15 +3522,16 @@ async function fetchAssets(provider, specs, lock, lockPath, opts = {}) {
           await rename2(tmp, target);
           log2(`  wrote   ${path9.relative(process.cwd(), target)}`);
         }
+        const persistentSources = sources.filter((source) => shouldPersistSourceUrl(source.url));
         upsert(lock, key, {
           status: "downloaded",
           provider: provider.id,
           outputs,
-          // Inline providers can hand the pipeline a machine-local temp file.
-          // Once its bytes are in the durable content cache, retaining that
-          // path makes a committed lockfile non-portable and falsely suggests
-          // the source still exists on another checkout.
-          ...cacheDir && sources.every((source) => source.url.startsWith("file://")) ? { sourceUrl: null, sourceUrls: [] } : {},
+          // A finished lock may be committed. Inline bytes, machine-local
+          // paths, and credential-bearing signed URLs are useful while a
+          // download is retryable but must not survive successful ingestion.
+          sourceUrl: persistentSources[0]?.url ?? null,
+          sourceUrls: persistentSources,
           downloadedAt: (/* @__PURE__ */ new Date()).toISOString(),
           error: null
         });