Update from task dc3a28fd-ec82-4a91-ba68-bd7b992b7fa6#9
Conversation
* **Title:** Initialize NEXUS Visual Weaver Command Center * **Key features implemented:** - Added core application file `app.py` implementing the Gradio-based command center UI with sections for Forge, Wardrobe, Lore, Models, Security, and Runs. - Implemented core logic in `src/nexus_visual_weaver/` for catalog, export, grounding, Hugging Face runtime, LoRA adapter, lore, model relay, planning, provider runtime, rendering, schema, security (ST3GG), styles, taste, wardrobe, and workflow management. - Added comprehensive test suite in `tests/` covering app callbacks, command center logic, exporter, Hugging Face runtime, LoRA adapter, model relay, and provider runtime functionalities. - Included documentation (`AGENTS.md`, `README.md`, `SECURITY.md`, `docs/`) detailing operating rules, setup, security policy, hackathon evaluation, handoffs, release workflow, and submission assets. - Configured CI/CD with `.github/workflows/ci.yml` and code review automation via `.coderabbit.yaml`. - Added example assets, taste profiles, and ST3GG examples in `assets/`. - Set up Modal Forge scripts (`modal_nexus_refine_v2.py`, `modal_train_nexus_couture_lora.py`) for offline processing. - Defined pull request template and various configuration files (`.env.example`, `.gitattributes`, `.gitignore`, `LICENSE`, `ops_audit/file_tree.txt`, `pytest.ini`, `requirements.txt`).
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedToo many files! This PR contains 289 files, which is 139 over the limit of 150. To get a review, narrow the scope: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (11)
📒 Files selected for processing (289)
You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request bootstraps the NEXUS Visual Weaver project, a governed gothic couture visual creation command center built with Gradio. It introduces prompt refinement, image generation, ST3GG security scanning, and structured export packet generation. The review highlights several critical issues: the accidental commit of a full virtual environment (env/), a concurrency bottleneck in the Hugging Face runtime cache, formatting errors in .gitignore, an accidental file (=4.57.1), and a potential OverflowError in seed resolution.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| # This file must be used with "source bin/activate" *from bash* | ||
| # You cannot run it directly |
There was a problem hiding this comment.
The entire virtual environment directory (env/) has been committed to the repository. Virtual environments contain platform-specific binaries and large dependency trees, and should never be tracked in version control. Please remove the env/ directory from git tracking using git rm -r --cached env/ and ensure it is ignored by .gitignore.
| with _PIPELINE_CACHE_LOCK: | ||
| cached = _PIPELINE_CACHE.get(repo_id) | ||
| if cached is not None: | ||
| return cached | ||
| pipe = pipeline_cls.from_pretrained(repo_id, torch_dtype=torch_module.bfloat16, token=token) | ||
| pipe.enable_model_cpu_offload() | ||
| _PIPELINE_CACHE[repo_id] = pipe | ||
| return pipe |
There was a problem hiding this comment.
Holding the _PIPELINE_CACHE_LOCK during the entire from_pretrained call is a major concurrency bottleneck. Since from_pretrained performs heavy disk and network I/O (which can take minutes), any other thread attempting to retrieve an already cached model will be blocked. Instead, you should only hold the lock when checking the cache, release it during the model loading, and re-acquire it briefly to store the loaded model.
| with _PIPELINE_CACHE_LOCK: | |
| cached = _PIPELINE_CACHE.get(repo_id) | |
| if cached is not None: | |
| return cached | |
| pipe = pipeline_cls.from_pretrained(repo_id, torch_dtype=torch_module.bfloat16, token=token) | |
| pipe.enable_model_cpu_offload() | |
| _PIPELINE_CACHE[repo_id] = pipe | |
| return pipe | |
| with _PIPELINE_CACHE_LOCK: | |
| cached = _PIPELINE_CACHE.get(repo_id) | |
| if cached is not None: | |
| return cached | |
| pipe = pipeline_cls.from_pretrained(repo_id, torch_dtype=torch_module.bfloat16, token=token) | |
| pipe.enable_model_cpu_offload() | |
| with _PIPELINE_CACHE_LOCK: | |
| _PIPELINE_CACHE[repo_id] = pipe | |
| return pipe |
| ``` | ||
| # Python |
There was a problem hiding this comment.
Markdown code block backticks (```) have been accidentally added to the beginning and end of the .gitignore file. This can interfere with git's pattern matching and should be removed.
# Python
| @@ -0,0 +1,13 @@ | |||
| usage: transformers <command> [<args>] | |||
There was a problem hiding this comment.
This file appears to have been created accidentally (likely due to a CLI redirect typo or copy-paste error) and contains the help output of the transformers CLI. It should be deleted from the repository.
| def _resolve_seed(seed_value: Any) -> int: | ||
| """Resolve user seed input. Empty or -1 means randomize.""" | ||
| try: | ||
| if seed_value is None or str(seed_value).strip() == "": | ||
| return secrets.randbelow(1_000_000_000) | ||
| seed = int(float(seed_value)) | ||
| except (TypeError, ValueError): | ||
| return secrets.randbelow(1_000_000_000) | ||
| return secrets.randbelow(1_000_000_000) if seed < 0 else seed |
There was a problem hiding this comment.
The _resolve_seed function can raise an unhandled OverflowError if seed_value is a string representing infinity or NaN (e.g., "inf", "nan"), because int(float(seed_value)) will raise OverflowError which is not caught by except (TypeError, ValueError):. Adding OverflowError to the caught exceptions will prevent potential runtime crashes.
| def _resolve_seed(seed_value: Any) -> int: | |
| """Resolve user seed input. Empty or -1 means randomize.""" | |
| try: | |
| if seed_value is None or str(seed_value).strip() == "": | |
| return secrets.randbelow(1_000_000_000) | |
| seed = int(float(seed_value)) | |
| except (TypeError, ValueError): | |
| return secrets.randbelow(1_000_000_000) | |
| return secrets.randbelow(1_000_000_000) if seed < 0 else seed | |
| def _resolve_seed(seed_value: Any) -> int: | |
| """Resolve user seed input. Empty or -1 means randomize.""" | |
| try: | |
| if seed_value is None or str(seed_value).strip() == "": | |
| return secrets.randbelow(1_000_000_000) | |
| seed = int(float(seed_value)) | |
| except (TypeError, ValueError, OverflowError): | |
| return secrets.randbelow(1_000_000_000) | |
| return secrets.randbelow(1_000_000_000) if seed < 0 else seed |
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| @@ -1,69 +1,60 @@ | |||
| ``` | |||
There was a problem hiding this comment.
CRITICAL: .gitignore is wrapped in fenced code block markers.
The opening ``` on line 1 (and the closing marker at EOF) makes ignore patterns literal, so entries such as .env, `env/`, `.huggingface/`, and cache files may not be ignored. Combined with the removed `.env.*`, `.envrc`, `.pem`, `.key`, and provider credential patterns, this can allow secrets or runtime artifacts to be committed.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| @@ -0,0 +1,43 @@ | |||
| name: CI | |||
There was a problem hiding this comment.
CRITICAL: GitHub Actions workflow is nested and will not run.
GitHub only discovers workflows under the repository-root .github/workflows directory. This file is under NEXUS_Visual_Weaver/.github/workflows, so CI will not execute. If moved to the root, the install/compile/test steps also need working-directory: NEXUS_Visual_Weaver or path-prefixed commands.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| @@ -0,0 +1,2 @@ | |||
| * @specimba | |||
There was a problem hiding this comment.
WARNING: CODEOWNERS file is nested and will not be applied.
GitHub CODEOWNERS must live at repository root .github/CODEOWNERS, /CODEOWNERS, or docs/CODEOWNERS; this nested path will not enforce review ownership.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| evidence={"configured": False, "scan_gate": scan.get("export_gate", "pending")}, | ||
| ) | ||
|
|
||
| image_url = _image_data_url(image_path) |
There was a problem hiding this comment.
CRITICAL: Blocked ST3GG artifacts can still be sent to MiniCPM.
judge_with_minicpm receives the scan result but does not refuse uploads/generation when export_gate is blocked or review. scan_reference and run_weave can therefore upload files that ST3GG marked for review to an external provider before export gating is resolved.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| """ | ||
| parsed = urllib.parse.urlparse(url) | ||
| if parsed.scheme not in {"http", "https"} or not parsed.netloc: | ||
| raise ValueError(f"Invalid URL: expected http(s) URL with host, got {url!r}.") |
There was a problem hiding this comment.
WARNING: Invalid provider URL errors can leak credential-bearing URLs.
The ValueError includes the raw url argument. If MINICPM_BASE_URL or NEMOTRON_BASE_URL is configured with query-string credentials, that value can be returned in judge evidence and written into audit/export packets.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| target = (root / f"{run_id}.json").resolve(strict=False) | ||
| if not (target == root or _is_within(target, root)): | ||
| raise ValueError("Unsafe export target path.") | ||
| target.write_text(json.dumps(packet, indent=2, ensure_ascii=True), encoding="utf-8") |
There was a problem hiding this comment.
WARNING: Governed export packets are written with default file permissions.
target.write_text uses the process umask, so audit packets containing prompts, scan verdicts, model stack, and override reasons may be readable by other users on the same Space/container. Use a restricted mode such as 0600 after writing.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| reference_metadata = _reference_metadata(upload, reference_url, reference_scan) | ||
| generated_scan = _authoritative_generated_scan(state) | ||
| minicpm = None | ||
| if run is not None and reference_path: |
There was a problem hiding this comment.
WARNING: Reference scan accepts an arbitrary path string and can send it to an external judge.
_file_path returns any string input as a path, and this callback passes it to judge_with_minicpm when a run exists. A public API caller could point this at any server-readable image path; validate that uploaded paths come from Gradio's upload temp directory and skip provider judging when ST3GG is not clear.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
|
|
||
| demo.launch( | ||
| server_name="0.0.0.0", | ||
| server_port=int(os.environ.get("NEXUS_PORT", os.environ.get("PORT", "7860"))), |
There was a problem hiding this comment.
WARNING: Public Gradio launch enables MCP server without auth.
mcp_server=True exposes MCP tooling through the public app surface. Unless the Space is intentionally public and the exposed tools are safe, gate this behind authentication or disable it for production.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| "torchaudio", | ||
| extra_index_url="https://download.pytorch.org/whl/cu121", | ||
| ) | ||
| .add_local_dir( |
There was a problem hiding this comment.
WARNING: Modal deployment uses a hard-coded local workspace path.
.add_local_dir("/workspace/NEXUS_Visual_Weaver", ...) will fail outside this exact container and can silently package the wrong tree if another workspace exists. Use a repository-relative path or pass the project root explicitly.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| accelerate>=1.12.0 | ||
| transformers>=4.57.1 | ||
| Pillow>=11.1.0 | ||
| git+https://github.com/huggingface/diffusers.git |
There was a problem hiding this comment.
WARNING: Diffusers dependency is installed from unpinned GitHub main.
git+https://github.com/huggingface/diffusers.git can change without review and break CI/runtime unexpectedly. Pin to a release or commit hash for reproducible and auditable builds.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 10 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)CRITICAL
WARNING
Other Observations (not in diff)Issues found in unchanged code that cannot receive inline comments:
Files Reviewed (8 files with inline issues)
Fix LinkFix these issues in Kilo Cloud Reviewed by nex-n2-pro:free · 7,091,866 tokens |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Commit real README image assets
This .png is a Git LFS pointer file, not image data, and the added .gitattributes only marks PNGs as binary rather than enabling LFS filters. The README embeds these screenshot assets, so most images render as broken pointer text in a normal checkout; add the actual PNGs or configure Git LFS correctly.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| server_name="0.0.0.0", | ||
| server_port=int(os.environ.get("NEXUS_PORT", os.environ.get("PORT", "7860"))), | ||
| quiet=True, | ||
| mcp_server=True, |
There was a problem hiding this comment.
For the Space/python app.py launch path, this unconditionally asks Gradio to start an MCP server, but the checked-in NEXUS_Visual_Weaver/requirements.txt installs plain gradio==6.12.0; Gradio documents the MCP extra (pip install "gradio[mcp]") as the prerequisite for mcp_server=True (docs). A fresh install from requirements will miss the mcp dependency and fail the app launch or lose MCP support, so either depend on gradio[mcp] or gate this flag.
Useful? React with 👍 / 👎.
| .add_local_dir( | ||
| "/workspace/NEXUS_Visual_Weaver", |
There was a problem hiding this comment.
Running this script from the submitted checkout cannot build the Modal image: the added app is under /workspace/NEXUS-Visual-Weaver/NEXUS_Visual_Weaver, but add_local_dir points to /workspace/NEXUS_Visual_Weaver, which does not exist in this repo. Modal resolves this local path before upload, so the ASGI app never receives /root/nexus and import app fails; use a path relative to this file/checkout instead.
Useful? React with 👍 / 👎.
| home = /usr/local/bin | ||
| include-system-site-packages = false | ||
| version = 3.12.10 | ||
| executable = /usr/local/bin/python3.12 | ||
| command = /usr/local/bin/python -m venv /workspace/env |
There was a problem hiding this comment.
This commit tracks the generated env/ virtualenv even though .gitignore ignores it and AGENTS.md says not to commit generated outputs/caches. The pyvenv.cfg hard-codes /workspace/env and /usr/local/bin, and the tree vendors pip/site-packages, making the repo non-portable and inflating future diffs; remove env/ from version control and recreate it from requirements.
Useful? React with 👍 / 👎.
|
|
||
| # Local secrets and credentials | ||
| .venv/ | ||
| .env |
There was a problem hiding this comment.
The new root ignore list only keeps .env, dropping the previous .env.*, .envrc, key/cert, HF cache, and Modal credential ignores. In this repo credentials are expected to live in local env/secret files, so files such as .env.local, .env.production, .modal.toml, or *.pem will now show up as untracked and can be accidentally committed; restore those secret patterns.
Useful? React with 👍 / 👎.
| if run is not None and reference_path: | ||
| minicpm = judge_with_minicpm( | ||
| prompt=getattr(getattr(run, "refined_prompt", None), "refined", DEFAULT_PROMPT), | ||
| image_path=reference_path, | ||
| scan=reference_scan, |
There was a problem hiding this comment.
When a reference upload has ST3GG findings, this still sends reference_path to MiniCPM as long as a run exists; judge_with_minicpm base64-encodes the local image bytes before posting to the provider. With provider secrets configured, a PNG with trailing data or another blocked image can leak the raw hidden payload to the external judge despite the ST3GG gate, so only judge references after a clear/purified scan.
Useful? React with 👍 / 👎.
| generated_scan = scan_file(generation.output_path) if generation.output_path else scan_file(None) | ||
| minicpm = judge_with_minicpm( | ||
| prompt=run.refined_prompt.refined, | ||
| image_path=generation.output_path, | ||
| scan=generated_scan, |
There was a problem hiding this comment.
If ST3GG marks the generated artifact blocked or under review, this path still sends generation.output_path to MiniCPM; that provider helper base64-encodes the local image before posting it. With provider secrets configured, a generated PNG containing trailing data can leave the Space before purification or human export review, so skip external judging unless the generated scan is clear or uses a sanitized derivative.
Useful? React with 👍 / 👎.
| checkpoint = operator_state.get("checkpoint", getattr(run.checkpoint, "recommendation", "pending") if run else "pending") | ||
| provider_state = str(operator_state.get("provider_state", "dry-run" if run else "idle")) | ||
| generation = operator_state.get("generation") or {} | ||
| generated_uri = _image_data_uri(generation.get("output_path")) if isinstance(generation, dict) else None |
There was a problem hiding this comment.
The artifact preview embeds generation.output_path as a data URI without checking scan.export_gate. For a generated PNG that ST3GG blocks for trailing data, the browser receives the entire original file, including hidden trailing bytes, in the HTML before purification; render a placeholder or sanitized derivative until the scan is clear.
Useful? React with 👍 / 👎.
| return { | ||
| "source": "url", | ||
| "status": "metadata_only", | ||
| "domain": parsed.netloc.lower(), | ||
| "url_hash": url_hash, |
There was a problem hiding this comment.
For a pasted URL with userinfo in the authority, such as https://user:pass@shop.example/item, parsed.netloc records user:pass@shop.example as the domain and that value flows into state and export metadata. Since this helper promises metadata-only storage, use parsed.hostname (plus an allowed port if needed) so credentials embedded in a URL are not disclosed.
Useful? React with 👍 / 👎.
| return ( | ||
| gr.update(interactive=generated and not checkpoint_approved and not exported), | ||
| gr.update(interactive=generated and checkpoint_approved and not exported), | ||
| gr.update(interactive=False), |
There was a problem hiding this comment.
The UI wires Stop Job with cancels=[run_click, run_submit], but _button_updates always returns interactive=False for the stop button. During long FLUX callbacks the button never becomes clickable, so users cannot cancel the queued/running generation despite the callback wiring; make it interactive while the provider state is active and before completion.
Useful? React with 👍 / 👎.
| # Load pipeline with caching | ||
| pipe = FluxKontextPipeline.from_pretrained( | ||
| "black-forest-labs/FLUX.1-Kontext-dev", | ||
| torch_dtype=torch.bfloat16, |
There was a problem hiding this comment.
This new Modal refinement job generates/edits images with FLUX.1-Kontext-dev, while the app governance pins image generation to FLUX.2. Running this helper produces artifacts outside the audited FLUX.2 lane and its license/relay assumptions, so switch it to the approved FLUX.2 runtime or keep the helper disabled until a model-governance change is approved.
Useful? React with 👍 / 👎.
2 participants
This PR was created by qwen-chat coder for task dc3a28fd-ec82-4a91-ba68-bd7b992b7fa6.
Note
Add NEXUS Visual Weaver image generation app with Modal GPU deployment and CI pipeline
NEXUS_Visual_Weaverpackage with modules for prompt scoring/refinement (taste.py), wardrobe outfit graph construction (wardrobe.py), LoRA adapter loading (lora_adapter.py), and a Gradio-based command center UI (app.py)env/lib/python3.12/site-packages/exporter.py,lora_adapter.py,model_relay.py,render.py,catalog.py) contain syntax errors or reference undefined symbols, causingImportErrororSyntaxErrorat import time and disabling significant portions of the packageMacroscope summarized 60a01d7.