5 Commits

Include renames

Author	SHA1	Message	Date
Vito Sansevero	be205f3dcc	feat: add pre-commit hooks for local CI checks ... - Black (auto-fix formatting on commit) - Flake8 (block on syntax errors and undefined names) - Bandit (security scan, non-blocking to match CI) - Tests (run on pre-push only) - Apply Black formatting fixes caught by the new hooks	2026-02-08 05:27:03 -08:00
Vito Sansevero	ed40be066c	fix: prevent stack trace exposure in SSE error responses ... Log exception details server-side only; send generic error messages to clients via SSE streams to resolve code scanning alerts.	2026-02-08 05:23:04 -08:00
Vito Sansevero	113d663fce	fix: resolve 15 GitHub code scanning security alerts ... - Fix XSS in showFullPrompt() across admin.js, gallery.js, metadata.html by replacing HTML string interpolation with DOM manipulation (createElement + textContent), eliminating unsafe user content injection - Fix stack trace exposure in py/api error responses by replacing str(e) with generic messages and adding logger.exception() for server-side traceability	2026-02-07 13:04:52 -08:00
Vito Sansevero	2737a4b1ef	style: apply Black formatter (line-length=88) to all Python files ... Automated formatting pass across 30 files to establish consistent code style enforced by CI. No logic changes.	2026-02-07 08:30:09 -08:00
Vito Sansevero	4548beb723	refactor: split api.py into domain modules and extract frontend JS ... Phase 4 structural refactoring: - Split monolithic py/api.py (5.3k lines) into domain mixins: prompts.py, images.py, admin.py, logging_routes.py, autotag_routes.py - Extract inline JS from admin.html into web/js/admin.js - Extract inline JS from gallery.html into web/js/gallery.js - Add gzip compression middleware to API responses (Phase 5.4) - Standardize API error envelope with success: false (Phase 5.3) - Add filmstrip image enrichment to prompt list responses (Phase 5.2)	2026-02-07 07:02:25 -08:00