Fixed confirmed findings before public exposure:
HIGH:
- upload filename path traversal → store.safe_name() strips to basename
- login rate-limit XFF bypass → key on request.client.host + per-username bucket;
auth.check_login() burns bcrypt time on unknown users (no enumeration)
- cross-user read access → per-user isolation: guests see/use/download/delete only
their own assets & jobs (owner sees all); WS job events scoped per-user
MEDIUM:
- unbounded upload read → bounded chunked streaming to the 1GB cap
- asset member path check → Path.is_relative_to boundary + ownership gate
- WS token-in-query-string leak → session-cookie-only WS auth
LOW:
- retry_job bypassed the per-user job cap → cap now checked on retry
- wholesale API-key injection → env_for_operator injects a paid key only to
operators that declare it (guest local jobs never receive fal/OpenRouter keys)
- session revocation → users.session_epoch, bumped on password change
- int() 500s → 400; net-lane defense-in-depth (guests blocked by requires_env AND
resources==net, so a mis-tagged paid op is still blocked)
+ public /api/health for serve.sh & proxy; docs/VPS.md; mb MB_TOKEN bearer auth
tests/smoke.sh: 34 checks passing incl. all new hardening.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New operator: briaai/RMBG-2.0 image->transparent cutout, fully local on Apple
Silicon (weights unlocked by owner HF license). Free local alternative to the
cloud fal_bg_remove; the recommended pre-pass before SF3D / image->3D. Verified:
clean 1024px cutout of the FLUX astrolabe (alpha 0-255, 86.6% removed, thin rings
preserved). Same OpenMP guardrails as sf3d. scripts/install_rmbg.sh; venvs/rmbg.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- mb: zero-dependency python CLI for the full API (ops/upload/run/wait/follow/
download incl. folder assets, retry/cancel, settings). Schema-aware -p k=v
coercion. Works from any tailnet machine via MB_HOST. Tested end-to-end
(upload -> blender_convert -> download).
- AGENTS.md: complete handover brief for other agents using this box as an
asset factory — endpoints, CLI reference, catalog, recipes, lanes/etiquette.
- scripts/serve.sh (headless start/restart) + scripts/install_launchagent.sh
(optional boot persistence, owner-run)
- flux_local upgraded to mflux 0.18 reality: flux2-klein-4b default (Apache,
UNGATED — runs with zero keys), klein-9b, schnell/schnell-4bit community
quant, dev/krea-dev. Research verdict: FLUX.1-dev no longer competitive
(Elo ~1027) vs klein ~1083-1119 vs nano-banana ~1154.
- openrouter_image rewritten to the dedicated Image API (POST /api/v1/images):
b64_json parsing, seed, resolution/aspect, exact usage.cost logging; model
enum: gemini-2.5-flash-image / 3.1-flash-image (NB2) / 3-pro-image
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- flux_local: prompt->image fully on-device via mflux (schnell/dev, steps,
quantize, seed, size). Both FLUX repos are HF-gated as of 2026-07 (schnell
included) — clean GatedRepoError surfaces with a hint; needs owner HF token.
- openrouter_image: prompt->image via OpenRouter chat/completions with
modalities [image,text]; parses data-URL images from the response; model
picker for nano-banana / nano-banana-pro. Gated on OPENROUTER_API_KEY.
- settings: openrouter_key added to vault (masked/redacted/env-injected)
- scripts/install_mflux.sh; venv installed
- A/B flow: run both with the same prompt, judge in Compare mode
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
