Skip to content

Venice Forge v1.0.6

Choose a tag to compare

View all tags
@spearchucker667 spearchucker667 released this 07 Jun 01:33
v1.0.6
f579594

What's Changed

Production Media Studio handoffs, derivative lineage, and 29-role semantic theme contract

  • Production transient handoffs (VERIFY-040) — useImageWorkspaceStore now drives Use settings, Regenerate, Same seed, Remix & Generate, Upscale, and Edit without any dev-only window.__veniceImageStudio bridge. The store is non-persisted and consumes each request exactly once.
  • Derivative lineage — upsertDerivative persists the child, deduplicates the parent's childrenIds, and rolls back the child if the parent-write fails. Regenerate, Upscale, Edit, Remix, and Background-remove now produce correctly typed derivatives with both directions of the parent ↔ child link.
  • Model-aware image sizing — 13 width × height pairs and aspect ratios for aspect-only / aspect-resolution models. Seed control covers the full signed range, with a central clampSeed / randomSeed / serializeSeed helper. Quality and variants are gated on model capabilities and only emitted when supported.
  • 29-role semantic theme contract (VERIFY-041) — themes now normalize legacy persisted data, expose complete runtime / bootstrap / Tailwind variables, round-trip full snake_case YAML, and apply semantic roles to global / shared controls. Forge Dracula has WCAG AA pair coverage for text, inputs, buttons, statuses, selection, disabled text, and focus.

Windows path-canonicalization fix

  • mediaService.ts allowlist bases are now canonicalized through fs.realpath() before containment comparison. Previously the child path was realpath'd but the allowlist bases were only path.resolve()'d, so on Windows CI (C:\Users\RUNNER~1 ↔ C:\Users\runneradmin 8.3 short-name mismatches) isWithin() returned false for files that legitimately lived inside the allowed directory. Three call sites updated: importMediaFromPath, revealMediaInFolder, readMediaMeta. Production security posture unchanged — symlink / junction escape protection, null-byte and overlong-path rejection, sibling-traversal rejection, and the Pictures/Venice Forge subfolder requirement are all preserved.

Windows test fixture stability

  • The mediaService.test.ts cleanup helpers now delete only the named fixture files, never the parent temp dirs, so the realpathSync'd mock paths stay stable for the entire test run. Added diagnostic messages to every expect(result.ok) assertion that include result.error, the target path, the mocked temp root, and the mocked app.getPath('downloads') value, so future CI failures are self-diagnosing.

Internal prompt-enhancer LLM

  • New prompt-enhancer-service.ts (config-driven model, temperature, max tokens, system prompts) honours internal_prompt_enhancer.enabled in config.yaml. Inspector Enhance / Remix buttons present a review modal and patch the result via onPatch only after explicit user approval. Default system prompts affirm safety-guard authority; the model id is venice-uncensored-1-2.

Character avatars (HTTPS-allowlisted)

  • resolveCharacterImageUrl reads all known image fields (photoUrl / photo_url / avatar_url / image / image_url / nested {url}), normalizes relative URLs, and rejects anything outside the Venice-host allowlist (outerface.venice.ai, venice.ai, api.venice.ai over HTTPS only). data:, file:, blob:, javascript:, localhost, and private-IP / loopback / link-local avatars are all blocked at the URL-resolver layer.

Repo hygiene

  • Removed POST_AUDIT_FINDINGS.md, docs/AUDIT_TODO.md, docs/deep-research-report.md (stale duplicates).
  • docs/design/VENICE_UI_EXTRACTION.md and docs/design/VENICE_UI_PARITY_REFERENCE.md gitignored as local-only design-roadmap scratchpads.
  • docs/POST_VENICE_JINA_AUDIT_2026_06_06.md and docs/AUDIT_FOLLOWUP_2026_06_05.md each gained a "Status: historical, canonical source is docs/summary_of_work.md" header.
  • verify-markdown-links honours root .gitignore (mini-gitignore parser supports anchoring, negation, and globs) — locked by VERIFY-034. This unblocks CI on local-only docs/AGENTS/*.md files.
  • .github/workflows/ci.yml gained a windows-sensitive-tests job (no continue-on-error). .github/workflows/release.yml gained per-job timeouts and a concurrency group.

Misc hardening

  • 2 MiB Jina response cap with stream cancellation and normalized 413 failures (VERIFY-039).
  • Web-mode Jina keys remain ephemeral and never enter localStorage / sessionStorage / IndexedDB (VERIFY-038).
  • OS-secure configured state enables Venice UI actions without copying the persisted key into renderer memory (VERIFY-037).
  • Linux packaging now ships arm64 AppImage + deb + rpm.
  • Built artifacts contain no source maps.

Full changelog: v1.0.5...v1.0.6

Assets 30
Loading