Daniel bd8e413bc7 fix: an assistant attachment must be the image type it claims to be ... The MIME type was taken on trust here. Anything at all could be posted as image/png: it passed the size and base64 checks, was stored in the saved chat, and was handed to a provider as a data URI. Documents and S3 uploads have always been sniffed by fileType.js; this was the one upload path that was not. Now sniffed with the same helper, so there is one idea of what a PNG looks like. A PHP payload, a shell script, an ELF or PE binary, a zip, or a real PDF labelled image/png are all refused with a message that says what is wrong. What this does not claim: bytes hidden after a valid PNG header still make a valid PNG, and no sniffer can promise otherwise. The protection is that the file is never executed and never served as anything but an image. Existing fixtures used buffers of 0x07 as stand-in images, which are correctly refused now. They carry real file headers instead — a fixture should be the thing it claims to be, exactly like a real upload. Also adds the deck theme system: five palettes in assets/deck-themes.json, render_pptx.py rebinding its palette from the theme rather than hardcoding it, the theme carried on the deck and validated against the same catalogue the renderer reads, a picker on the generate form, and PUT /my-resources/:id/theme to re-skin a stored deck with no model call. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU		2026-09-12 19:00:10 +02:00
..
account-boundary.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
admin-clinical-assistant-wiring.test.js	fix: the assistant settings page says what saves what	2026-09-11 04:04:31 +02:00
admin-docs-toc.test.js	test docs toc links	2026-05-09 01:33:06 +02:00
assistant-attachment-roundtrip.test.js	fix: an assistant attachment must be the image type it claims to be	2026-09-12 19:00:10 +02:00
assistant-autosave.test.js	fix: image Done state, chat titles that keep whole words, and readable extension cards	2026-09-10 06:44:22 +02:00
assistant-citation-modal.test.js	feat: Open WebUI-style assistant workspace — 3-column layout, markdown/math/code/tables, autosave with images, translation (LibreTranslate+DeepL), citation modal, Learning Hub moved in, handoff removed	2026-09-08 18:52:35 +02:00
assistant-citations.test.js	feat: citation quality tracking, and the SSO settings fit a phone	2026-09-10 23:44:43 +02:00
assistant-component-css.test.js	refactor: drop the "Saved Chats" header and collapse arrow from the rail	2026-09-10 13:27:29 +02:00
assistant-enter-to-send.test.js	feat: Enter sends in the assistant, and the person chooses	2026-09-12 18:05:36 +02:00
assistant-export-owner.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
assistant-image-attachments.test.js	fix: an assistant attachment must be the image type it claims to be	2026-09-12 19:00:10 +02:00
assistant-image-done.test.js	fix: image Done state, chat titles that keep whole words, and readable extension cards	2026-09-10 06:44:22 +02:00
assistant-image-intent.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
assistant-math-mhchem.test.js	fix: reviewer findings — mhchem macro wrapping, regenerate history dedupe, strict safe image allowlist, stale docs	2026-09-08 19:25:31 +02:00
assistant-message-actions.test.js	fix: send button morphs into a clickable STOP icon while working (no more disabled spinner); grouped bottom-left tools; silent-recording message; completed images auto-join the library; transient image-status retries	2026-09-09 04:12:30 +02:00
assistant-mobile.test.js	fix: recordings that produced nothing, and the boxes that zoomed on iOS	2026-09-11 00:16:19 +02:00
assistant-saved-tables.test.js	feat: saved chats grouped by recency, a visible sidebar toggle, and acknowledgements answered cheaply	2026-09-09 18:59:45 +02:00
assistant-sharing-boundary.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
assistant-sources-cleaning.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
assistant-translate.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
assistant-user-markdown.test.js	feat: Open WebUI-style assistant workspace — 3-column layout, markdown/math/code/tables, autosave with images, translation (LibreTranslate+DeepL), citation modal, Learning Hub moved in, handoff removed	2026-09-08 18:52:35 +02:00
assistant-voice-mode.test.js	fix: voice mode reads the answer that just arrived, and reads what the page shows	2026-09-11 21:10:50 +02:00
assistant-voice.test.js	fix: OWUI-style polish — fullscreen workspace replaces main menu, row-click saved chats (delete stays as hover), markdown-rendered patient handout, admin-only raw transcript, /api TTS URL, scrollable unclipped tables, action buttons hidden in exports, autosave-only copy	2026-09-08 22:41:08 +02:00
assistant-workspace-layout.test.js	revert: remove the signed-out assistant preview	2026-09-11 05:09:02 +02:00
attachment-magic-bytes.test.js	fix: an assistant attachment must be the image type it claims to be	2026-09-12 19:00:10 +02:00
backend-hardening.test.js	fix: expired invitations can be cleared too, revoked ones still cannot	2026-09-11 20:41:18 +02:00
bedside-respiratory-ventilation.test.js	allow bedside respiratory without weight	2026-05-08 09:10:33 +02:00
build-id.test.js	feat: a deploy you can repeat, and prove afterwards	2026-09-11 00:41:11 +02:00
calc-math.test.js	feat: B — extract drug data to public/data/drugs.json (schema v1.0)	2026-04-20 04:23:24 +02:00
calculators-data.test.js	consolidate calculator growth helpers	2026-05-08 04:36:39 +02:00
clinical-assistant-prompt-pool.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
clinical-conversation.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
clinical-generation-options.test.js	Send reasoning options only to supported model	2026-08-27 21:25:38 +02:00
clinical-mcp-session-lifecycle.test.js	refactor: retrieval is text-only; admins can add model ids discovery never returns	2026-09-09 23:35:06 +02:00
clinical-notes-entrypoints.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
clinical-release-integration.test.js	fix: the assistant settings page says what saves what	2026-09-11 04:04:31 +02:00
clinical-retrieval-title.test.js	refactor: retrieval is text-only; admins can add model ids discovery never returns	2026-09-09 23:35:06 +02:00
clinical-table-preservation.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
deck-review.test.js	feat: modifying a deck can see it	2026-09-12 06:55:16 +02:00
doc-spec.test.js	feat: Word is built by python-docx from the same typed source as the deck	2026-09-11 21:58:53 +02:00
e2e-harness.test.js	test(e2e): repair the harness, taking the browser suite from 96 failures to 11	2026-09-11 18:54:03 +02:00
embeddings-provider.test.js	fix litellm metadata model discovery	2026-05-09 04:46:06 +02:00
empty-answer.test.js	fix: an empty answer from the model was the one failure never caught	2026-09-12 07:41:04 +02:00
extension-transfer.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
frontend-prompt-env.test.js	feat: image fallback chains for every workflow, and a library worth looking at	2026-09-12 14:53:04 +02:00
frontend-rendering-safety.test.js	feat: the announcement banner renders Markdown, safely	2026-09-10 19:08:12 +02:00
generated-image-cache.test.js	feat: an image library — every picture this account has made	2026-09-12 14:36:30 +02:00
generated-image-storage.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
generated-image-tools.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
generated-images-ui.test.js	fix: correct a false Settings claim; make every test child's stdout pure TAP	2026-09-10 15:41:44 +02:00
generated-images.integration.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
image-fallback-chain.test.js	feat: image fallback chains for every workflow, and a library worth looking at	2026-09-12 14:53:04 +02:00
image-key-collision.test.js	fix: a second deck reused the first deck's pictures	2026-09-12 08:26:09 +02:00
image-library.test.js	feat: image fallback chains for every workflow, and a library worth looking at	2026-09-12 14:53:04 +02:00
learning-hub-ai-category.test.js	extract learning hub cms controller	2026-05-08 16:23:01 +02:00
learning-hub-ai-panel-controller.test.js	extract learning hub ai panel controller	2026-05-08 16:54:48 +02:00
learning-hub-editor.test.js	extract learning hub ai panel controller	2026-05-08 16:54:48 +02:00
learning-hub-manual-category.test.js	fix: make manual CMS category creation visible and keyboard-accessible	2026-09-07 01:16:40 +02:00
learning-hub-quiz-controller.test.js	extract learning hub quiz controller	2026-05-08 16:38:51 +02:00
learning-hub-webdav-controller.test.js	extract learning hub webdav controller	2026-05-08 16:44:02 +02:00
learning-retrieval.test.js	feat: the Learning screen can ask for grounding, and says what it got	2026-09-11 14:39:49 +02:00
login-codes.test.js	feat: sign in with a code emailed to you, offered beside the password	2026-09-11 20:12:03 +02:00
mcp-shutdown.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
metrics.test.js	fix metrics route normalization	2026-05-08 20:22:14 +02:00
model-defaults.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
models-changed-propagation.test.js	fix: a newly added model reaches every picker, including the user-facing ones	2026-09-12 17:46:18 +02:00
module-entrypoints.test.js	convert learning hub to module	2026-05-08 09:01:34 +02:00
my-resources-refine.test.js	feat: modifying a deck can see it	2026-09-12 06:55:16 +02:00
my-resources-stale-results.test.js	fix: the last run's illustration no longer sits under an empty form	2026-09-12 17:43:19 +02:00
my-resources.test.js	fix: a second deck reused the first deck's pictures	2026-09-12 08:26:09 +02:00
notes-sanitize.test.js	fix diagram delete confirmation	2026-05-08 06:28:12 +02:00
patient-takehome.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
pe-guide-data.test.js	move pe guide data to json	2026-05-08 08:56:21 +02:00
policy-flows.test.js	chore: Kitten and Supertonic retired; Kokoro is the local voice	2026-09-12 16:45:05 +02:00
policy-ui.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
prompt-administration.test.js	fix: mobile layout regression, workspace menu in the assistant rail, prompt as principles	2026-09-09 22:24:10 +02:00
release.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
review-model-vision-guard.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
session-quiz-ed-regressions.test.js	fix: correct a false Settings claim; make every test child's stdout pure TAP	2026-09-10 15:41:44 +02:00
slide-shapes.test.js	feat: record what a deck wanted and could not have	2026-09-11 22:51:15 +02:00
slide-spec.test.js	fix: a deck the model fumbles once is asked for again, not abandoned	2026-09-12 05:34:14 +02:00
stt-provider.test.js	simplify speech and embeddings through litellm	2026-05-09 05:09:02 +02:00
transcription-memory-policy.test.js	feat: a retried transcript goes back to the tab the audio came from	2026-09-11 12:39:50 +02:00
tts-provider.test.js	chore: Kitten and Supertonic retired; Kokoro is the local voice	2026-09-12 16:45:05 +02:00
vision-tool.test.js	fix: the active library view is unmistakable, and a leading question cannot mislead the vision model	2026-09-12 16:27:21 +02:00
web-search.test.js	feat: My Resources says what it is, offers its sources in one place, and Modify gets them too	2026-09-11 18:54:17 +02:00
well-visit-data.test.js	remove legacy well visit schedule data	2026-05-08 08:59:23 +02:00