feat/vision sidecar

[Desperado]

• fix(update): make TestExtractBinaryZip arch-aware
• feat: add gemma 4 vision sidecar for text-only backends like z.ai glm

[qualitymaxapp]

QualityMax Review

Reviewing 369e48aa93f8 now.

Max's current mission: Max is debugging a particularly sneaky bug.

 /\_/\            \  /
( o.o )  --->  .-o--o-.
 > ^ <        <   BUG  >
 /| |\        '-o--o-'
(_| |_)          /  \

The completed review will replace this message.

[qualitymaxapp]

QualityMax Review — canonical overview updated; inline findings are attached to this review.

[qualitymaxapp]

⚠️ QualityMax Pipeline

Gate	Result
🔍 AI diff review	✅ Clean · gemini-3.1-flash-lite · completed · 11 eligible / 11 reviewed · gemini-3.1-flash-lite
🔍 SAST	completed · 11 eligible / 11 reviewed · claude-haiku-4-5-20251001
🔍 Canonical PR review delivery	completed · 0 eligible / 0 reviewed · exact-head review #5247243486 and overview #5728556476 confirmed
🧪 Repo Tests	✅ 850/850 passed (go)

_{Powered by QualityMax — AI-Powered Test Automation}

[qualitymaxapp]

QualityMax Review — canonical overview updated; inline findings are attached to this review.

[qualitymaxapp]

QualityMax Review — canonical overview updated; inline findings are attached to this review.

[qualitymaxapp]

QualityMax Review — canonical overview updated; inline findings are attached to this review.

[qualitymaxapp]

⚠️ QualityMax Diff Analysis — WARN

The vision sidecar implementation is well-integrated and logically sound, but the prompt injection mitigation is insufficient. The current sanitization strategy for the description output is easily bypassed, potentially allowing the vision model to influence the main LLM's behavior via indirect prompt injection.

🟡 Finding 1: security

File: internal/agent/cerebras_vision.go:175 | Severity: warning

What: The sanitization of the vision sidecar description is weak and susceptible to prompt injection.

Fix: Instead of simple string replacement, consider using a more robust delimiter or a structured format (like JSON) for the description. Alternatively, instruct the main LLM in its system prompt to treat the content within tags as untrusted data rather than instructions.

Fix with your LLM agent

<your-llm-agent> "Fix the security issue in internal/agent/cerebras_vision.go at line 175: The sanitization of the vision sidecar description is weak and susceptible to prompt injection."

Fix all findings with your LLM agent

<your-llm-agent> "Fix all QualityMax review findings in this PR:\n- security in internal/agent/cerebras_vision.go:175: The sanitization of the vision sidecar description is weak and susceptible to prompt injection."

Change diagram — Flow

graph TD
    A[User Input: Prompt + Images] --> B{ShouldUseVisionSidecar?}
    B -- Yes --> C[DescribeImagesWithGemma (Cerebras)]
    C --> D[BuildSidecarAugmentedPrompt]
    D --> E[RunCLI (Main LLM)]
    B -- No --> E
    E --> F[Final Response]

Loading

_{Analyzed commit 67ffe068 with gemini-3.1-flash-lite (12 files, 11598 tokens) | Customize review preferences}

[qualitymaxapp]

QualityMax Review — canonical overview updated; inline findings are attached to this review.

[qualitymaxapp]

QualityMax Review — canonical overview updated; inline findings are attached to this review.

[Desperado]

👋 Thanks for the vision sidecar! A review turned up 4 bugs plus the lint errors that fail CI. The fixes are in #213, which targets feat/vision-sidecar:

• 🛑 HIGH: pressing Esc couldn't stop the Gemma image read
• 🛑 HIGH: text in a screenshot could close the </image-descriptions> block (prompt injection)
• ⚠️ MEDIUM: the header could name images Gemma never read
• ⚠️ MEDIUM: /screenshot and /paste images were dropped when the image read failed
• 🔧 Fixed the two errcheck lint errors in cerebras_vision_test.go

Once #213 is merged in, please rebase on main. The branch is behind v1.36.0 and v1.37.0, which both touched internal/agent/. 🙏