Skip to content

test: pin LoRA URL validation and family/cap payload lockstep - #405

Draft
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/missing-test-coverage-4dc4
Draft

test: pin LoRA URL validation and family/cap payload lockstep#405
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/missing-test-coverage-4dc4

Conversation

@cursor

@cursor cursor Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Risky behavior now covered

  • normalizeLoraUrl (CivitAI / bare HF repo / HF file-page). NanoGPT pulls the LoRA URL server-side. A signed CivitAI link (civitai.com / civitai.red / civit.ai) is a charged 422; a bare user/repo id or an HF /blob/ page that is not a .safetensors file is the same class of billed miss. The helper must throw before /images/generations. HF /blob/ must rewrite to /resolve/ so the server gets the raw file.
  • loraFamily / loraCap / imageTakesLora / loraBodyFor. Ordered classifier (klein before flux-2, spicy excluded). A one-sided family edit ships the wrong param shape (lora_url vs lora_url_N vs lora_weights) or the old krea cap of 1 (stacks 2–3 silently dropped). Inpaint ids must stay out of the image LoRA box (those carry no lora_url).
  • play runGraph. A CivitAI URL on a real image node must POST zero times and surface as a node error — not a billed 422. A good HF blob URL must land rewritten on the wire.

Test files added/updated

  • Added scripts/check-lora-url-gates.mjs — extracts the shipped helpers from index.html, play RUNTIME, and vendor/njs-engine.js; drives the same URL / family / cap / body table; drives real runGraph() via play-engine.mjs.
  • Updated .githooks/pre-committouches_loragates runs the check when index.html, play.html, vendor/njs-engine.js, the checker, or play-engine.mjs change.

Why these tests materially reduce regression risk

These are hand-copied validation / capability gates with a paid-call blast radius and no prior behavioral assertions (twin-drift only proves the source lines exist; check-lora-models.mjs is a live catalog audit, not pre-commit, and does not drive normalizeLoraUrl or runGraph):

  • Dropping the CivitAI / repo-id refuse, or sending an HF file-page URL un-rewritten, bills a generation the adapter never loads.
  • A one-sided family/cap edit (the krea-cap-1 class, or treating spicy as ltx) posts the wrong keys — stacks 2–3 vanish, or a loras override we do not implement is implied.
  • Losing the play imgExtraloraParams throw lets a bad URL reach genImage.

No production behavior change. Offline, deterministic, no API spend. Ran node scripts/check-lora-url-gates.mjs — green.

Open in Web View Automation 

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
nanoodle c2369d4 Commit Preview URL

Branch Preview URL
Sep 01 2026, 08:52 PM

@cursor
cursor Bot force-pushed the cursor/missing-test-coverage-4dc4 branch from 689b828 to e7cf8e7 Compare September 1, 2026 20:47
CivitAI / bare HF repo / HF file-page URLs must throw before a paid
image POST. Drive the shipped helpers on all three surfaces and assert
play runGraph never bills a bad LoRA URL.

Co-authored-by: mikkel <mikkel@255bits.com>
@cursor
cursor Bot force-pushed the cursor/missing-test-coverage-4dc4 branch from e7cf8e7 to c2369d4 Compare September 1, 2026 20:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant