Merge branch 'dev' into review/pewds-pr6738-terra-20261027

Integrate PR #6739 foundation (backend security, bridge hardening, Python 3.11 test fixture correction) with PR #6738 remediations.
- Reconcile routes/email/email_routes.py harmonizing _LIST_LOCK and _LIST_EPOCH with #6738 cache invalidation and thread-safe mutation.
- Preserve editor-session validation, legacy-browser tool restrictions, image-tool authorization, and email cache concurrency invariants.

src/agent_tools/editor_tools.py

@@ -78,7 +78,16 @@ def _parse(content: Any) -> Dict[str, Any]:
 
 
 def _session(args: Dict[str, Any], ctx: Dict[str, Any]) -> str:
-    return str(args.get("session") or args.get("editor_session") or ctx.get("session_id") or "default")
+    # Explicit editor session bound in context is authoritative;
+    # otherwise fallback to caller/tool args, then default.
+    # Note: ctx.get("session_id") is the chat/turn UUID, NOT the editor canvas session.
+    return str(ctx.get("editor_session") or args.get("session") or args.get("editor_session") or "default")
+
+
+def _incognito(ctx: Dict[str, Any]) -> bool:
+    runtime = ctx.get("client_runtime_context")
+    state = runtime.get("web_ui_state") if isinstance(runtime, dict) else None
+    return ctx.get("incognito") is True or (isinstance(state, dict) and state.get("incognito") is True)
 
 
 async def _post(path: str, payload: Dict[str, Any], owner: Optional[str], timeout: float = _EDITOR_TIMEOUT) -> Dict[str, Any]:
@@ -107,17 +116,26 @@ def _data_url_bytes(data_url: str) -> bytes:
     return base64.b64decode(b64)
 
 
+def _image_reference_path(value: str) -> bool:
+    # Never use the internal tool credential to fetch an arbitrary app route.
+    generated = re.fullmatch(r"/api/generated-image/[a-f0-9]{8,64}\.(?:png|jpg|jpeg|webp|gif)", value)
+    upload = re.fullmatch(r"/api/upload/[a-fA-F0-9]{32}(?:\.[A-Za-z0-9]+)?", value)
+    return bool(generated or upload)
+
+
 def _persist_png(image_bytes: bytes, owner: Optional[str], session_id: Optional[str], prompt: str, model: str) -> Dict[str, Any]:
     """Save an edited/generated PNG and return {image_id, image_url, image_size}."""
     from core.database import GalleryImage, SessionLocal
     from src.constants import GENERATED_IMAGES_DIR
 
     db = SessionLocal()
+    image_path = None
     try:
         root = Path(GENERATED_IMAGES_DIR).resolve()
         root.mkdir(parents=True, exist_ok=True)
         filename = f"{uuid.uuid4().hex[:12]}.png"
-        (root / filename).write_bytes(image_bytes)
+        image_path = root / filename
+        image_path.write_bytes(image_bytes)
         new_id = str(uuid.uuid4())
         width = height = 0
         try:
@@ -163,6 +181,11 @@ def _persist_png(image_bytes: bytes, owner: Optional[str], session_id: Optional[
         return {"image_id": new_id, "image_url": f"/api/generated-image/{filename}", "image_size": size or None}
     except Exception:
         db.rollback()
+        if image_path is not None:
+            try:
+                image_path.unlink(missing_ok=True)
+            except OSError:
+                logger.warning("Failed to remove uncommitted editor image", exc_info=True)
         raise
     finally:
         db.close()
@@ -198,7 +221,7 @@ async def _place_layer(data_url: str, name: str, owner: Optional[str], session:
     }
     try:
         data = await _post("/api/editor/bridge/command", payload, owner, timeout=90)
-        return data.get("ok") is not False
+        return bool(data.get("ok") is True and data.get("completed", True) is not False)
     except Exception as exc:  # pragma: no cover - defensive
         logger.warning("editor layer placement failed: %s", exc)
         return False
@@ -367,28 +390,46 @@ class RunEditorCommandTool:
         args = _parse(content)
         op = str(args.get("op") or "").strip()
         if not op:
-            return "run_editor_command: invalid", {"error": "run_editor_command needs `op`.", "exit_code": 1}
+            return "run_editor_command: invalid", {"error": "run_editor_command needs `op`.", "exit_code": 1, "completed": False}
         params = args.get("params") if isinstance(args.get("params"), dict) else {}
+        wait = bool(args.get("wait", True))
         payload = {
             "session": _session(args, ctx),
             "op": op,
             "params": params,
-            "wait": bool(args.get("wait", True)),
+            "wait": wait,
             "timeout": float(args.get("timeout") or 60),
         }
         try:
             data = await _post("/api/editor/bridge/command", payload, ctx.get("owner"))
         except Exception as exc:
-            return f"run_editor_command: {op}", {"error": f"run_editor_command failed: {exc}", "exit_code": 1}
-        ok = data.get("ok")
+            return f"run_editor_command: {op}", {"error": f"run_editor_command failed: {exc}", "exit_code": 1, "completed": False, "status": "failed"}
+
+        is_queued = bool(data.get("queued")) or data.get("status") == "queued"
+        if is_queued and (not wait or not data.get("ok")):
+            summary = json.dumps({"status": "queued", "queued": data.get("queued"), "session": data.get("session")}, ensure_ascii=False)
+            return f"run_editor_command: {op}", {
+                "output": summary,
+                "queued": data.get("queued"),
+                "status": "queued",
+                "pending": True,
+                "completed": False,
+                "ok": False,
+                "exit_code": 1,
+            }
+
+        ok = bool(data.get("ok") is True and data.get("completed", True) is not False)
+        status = data.get("status") or ("completed" if ok else "failed")
         result = data.get("result")
-        summary = json.dumps({"ok": ok, "error": data.get("error"), "result": result}, ensure_ascii=False)
+        summary = json.dumps({"ok": ok, "status": status, "error": data.get("error"), "result": result}, ensure_ascii=False)
         return f"run_editor_command: {op}", {
             "output": summary[:4000],
             "result": result,
             "screenshot": data.get("screenshot"),
+            "status": status,
+            "completed": ok,
             "ok": ok,
-            "exit_code": 0 if ok is not False else 1,
+            "exit_code": 0 if ok else 1,
         }
 
 
@@ -442,10 +483,14 @@ class AiEditImageTool:
         image = _as_data_url(args.get("image"))
         if image is None and isinstance(args.get("image"), str) and args["image"].startswith("/"):
             # A same-origin gallery/attachment URL: fetch it (owner-scoped) as bytes.
+            if not _image_reference_path(args["image"]):
+                return "ai_edit_image: invalid image", {"error": "Invalid image reference.", "exit_code": 1}
             try:
                 async with httpx.AsyncClient(timeout=60) as client:
                     resp = await client.get(f"{_INTERNAL_BASE}{args['image']}", headers=_internal_headers(owner))
                     resp.raise_for_status()
+                    if not resp.headers.get("content-type", "").lower().startswith("image/"):
+                        return "ai_edit_image: invalid image", {"error": "Image reference is not an image.", "exit_code": 1}
                     image = _as_data_url("data:image/png;base64," + base64.b64encode(resp.content).decode())
             except Exception:
                 image = None
@@ -550,10 +595,13 @@ class AiEditImageTool:
             "model": data.get("model") or model_choice or "",
             "exit_code": 0,
         }
-        try:
-            info.update(_persist_png(_data_url_bytes(data_url), owner, ctx.get("session_id"), f"ai_edit_image:{op}", f"ai_edit_image:{op}"))
-        except Exception as exc:
-            logger.warning("ai_edit_image persist failed: %s", exc)
+        if _incognito(ctx):
+            info["image_url"] = data_url
+        else:
+            try:
+                info.update(_persist_png(_data_url_bytes(data_url), owner, ctx.get("session_id"), f"ai_edit_image:{op}", f"ai_edit_image:{op}"))
+            except Exception as exc:
+                logger.warning("ai_edit_image persist failed: %s", exc)
         _t["persist"] = time.perf_counter()
         if bool(args.get("place", True)):
             placed = await _place_layer(
@@ -626,10 +674,13 @@ class GenerateImageLayerTool:
             "model": data.get("image_model") or str(args.get("model") or ""),
             "exit_code": 0,
         }
-        try:
-            info.update(_persist_png(_data_url_bytes(data_url), owner, ctx.get("session_id"), prompt, "generate_image"))
-        except Exception as exc:
-            logger.warning("generate_image persist failed: %s", exc)
+        if _incognito(ctx):
+            info["image_url"] = data_url
+        else:
+            try:
+                info.update(_persist_png(_data_url_bytes(data_url), owner, ctx.get("session_id"), prompt, "generate_image"))
+            except Exception as exc:
+                logger.warning("generate_image persist failed: %s", exc)
         if bool(args.get("place", True)):
             placed = await _place_layer(
                 data_url,

src/editor_agent_model.py

@@ -341,12 +341,6 @@ async def self_check(
 
 def _candidates(owner: Optional[str], override: Optional[str]) -> List[Dict[str, Any]]:
     cands: List[Dict[str, Any]] = []
-    if override:
-        base, model = _split_override(override)
-        if model:
-            cands.append(
-                {"base": base or local_bases()[0], "model": model, "headers": None, "source": "override"}
-            )
     for base in local_bases():
         cands.append({"base": base, "model": local_model(), "headers": None, "source": "local"})
     try:
@@ -362,6 +356,17 @@ def _candidates(owner: Optional[str], override: Optional[str]) -> List[Dict[str,
                 break
     except Exception:
         pass
+    if override:
+        base, model = _split_override(override)
+        # A request may choose a configured endpoint, never introduce a URL.
+        # Prefer an exact model match (including hosted credentials) over the
+        # first local endpoint when a bare model id is supplied.
+        matching = [c for c in cands if not base or str(c["base"]).rstrip("/") == base.rstrip("/")]
+        selected = next((c for c in matching if c["model"] == model), None)
+        if selected is None and model and matching and matching[0]["source"] == "local":
+            selected = {**matching[0], "model": model}
+        if selected is not None:
+            cands.insert(0, {**selected, "source": "override"})
     return cands
 
 

src/editor_style_guide.py

@@ -486,11 +486,11 @@ _RECOLOR_EXCLUDE_RE = re.compile(
 )
 
 
-_RECOLOR_TRAILING_ADJ = re.compile(
-    r"\s+\b(?:bright|brighter|vivid|vibrant|dark|darker|light|lighter|deep|"
-    r"pale|more|less|very|really|slightly|totally|completely)\b\s*$",
-    re.I,
-)
+_RECOLOR_TRAILING_ADJECTIVES = frozenset({
+    "bright", "brighter", "vivid", "vibrant", "dark", "darker", "light",
+    "lighter", "deep", "pale", "more", "less", "very", "really",
+    "slightly", "totally", "completely",
+})
 
 
 def _hex_rgb01(hex_color: str):
@@ -557,9 +557,9 @@ def _recolor_object_phrase(prompt: str, target_word: str) -> str:
         words.pop(0)
     if len(words) > 1 and words[-1].casefold() in {"to", "into"}:
         words.pop()
+    while len(words) > 1 and words[-1].lower() in _RECOLOR_TRAILING_ADJECTIVES:
+        words.pop()
     phrase = " ".join(words)
-    while phrase and _RECOLOR_TRAILING_ADJ.search(phrase):
-        phrase = _RECOLOR_TRAILING_ADJ.sub("", phrase).strip()
     return phrase or "the subject"
 
 

src/fixture_email.py

@@ -119,12 +119,6 @@ def execute_fixture_email(tool: str, args: dict[str, Any], owner: str | None = N
 
     bare = tool.removeprefix("mcp__email__")
     if bare == "list_email_accounts":
-        accounts = {}
-        for index, message in enumerate(messages):
-            row = _row(index, message)
-            identity = (row["account_id"], row["account"], row["account_email"])
-            accounts.setdefault(identity, {"id": row["account_id"], "name": row["account"],
-                                            "email": row["account_email"], "default": not accounts})
         return {
             "accounts": [{"id": "fixture", "name": "Fixture mailbox", "default": True}],
             "output": "Fixture mailbox (default)",

src/settings.py

@@ -47,9 +47,8 @@ DEFAULT_SETTINGS = {
     "image_gen_enabled": False,
     "image_model": "",
     "image_quality": "medium",
-    # Local editor-agent/planner model (Quick Edit NL planner). When empty the
-    # server auto-detects the local Qwen3.5-9B vision server on seneca and falls
-    # back to the hosted chat model. See src/editor_agent_model.py.
+    # Optional editor planner/caption endpoints. Empty uses configured chat
+    # fallback without probing a developer-specific host.
     "editor_agent_base_url": "",
     "editor_agent_model": "",
     "editor_caption_base_url": "",

src/tool_capabilities.py

@@ -227,8 +227,16 @@ _register(
     ToolEffect.READ_PRIVATE,
 )
 _register(
-    {"plan_edit", "run_editor_command"},
+    {"plan_edit"},
+    ToolEffect.NETWORK_EGRESS,
+    result_integrity=ResultIntegrity.EXTERNAL_UNTRUSTED,
+)
+_register(
+    {"run_editor_command"},
+    ToolEffect.READ_PRIVATE,
+    ToolEffect.WRITE_PRIVATE,
     ToolEffect.UI_SIDE_EFFECT,
+    result_integrity=ResultIntegrity.EXTERNAL_UNTRUSTED,
 )
 _register(
     {

src/tool_schemas.py

@@ -1545,7 +1545,7 @@ FUNCTION_TOOL_SCHEMAS = [
                 "properties": {
                     "op": {"type": "string", "description": "Editor op name from the catalog, e.g. adjustments.applyMasked"},
                     "params": {"type": "object", "description": "Parameters for the op"},
-                    "session": {"type": "string", "description": "Editor session id (defaults to the open session)"},
+                    "session": {"type": "string", "description": "Editor session id when no turn-bound session is available; the bound session takes precedence"},
                     "wait": {"type": "boolean", "description": "Wait for the editor result (default true)"}
                 },
                 "required": ["op"]
@@ -1560,7 +1560,7 @@ FUNCTION_TOOL_SCHEMAS = [
             "parameters": {
                 "type": "object",
                 "properties": {
-                    "session": {"type": "string", "description": "Editor session id (defaults to the open session)"}
+                    "session": {"type": "string", "description": "Editor session id when no turn-bound session is available; the bound session takes precedence"}
                 }
             }
         }
@@ -1583,7 +1583,7 @@ FUNCTION_TOOL_SCHEMAS = [
                     "steps": {"type": "integer", "description": "Optional sampler steps. Use 8 for removal/expand edits (default 4 is too weak for those)."},
                     "place": {"type": "boolean", "description": "Place the result as a new layer (default true)"},
                     "model": {"type": "string", "description": "Optional image model id to route this edit to (from GET /api/editor/image-models); omit to use the configured default"},
-                    "session": {"type": "string", "description": "Editor session id"}
+                    "session": {"type": "string", "description": "Editor session id when no turn-bound session is available; the bound session takes precedence"}
                 },
                 "required": ["op"]
             }