fix(vision-sidecar): address #206 review findings

[Desperado]

Follow-up to #206. Merge this into feat/vision-sidecar, and #206 picks up the fixes.

Fixes

HIGH

• Esc couldn't stop the image read (internal/repl/repl.go). DescribeImagesWithGemma ran on context.Background(), so pressing Esc did nothing for up to 2 minutes, and then the CLI turn started anyway. It now runs on a context that Esc cancels, and cancelling skips the turn.
• Screenshot text could close the description block (internal/agent/cerebras_vision.go). The guard only matched the exact lowercase </image-descriptions>, so text like </IMAGE-DESCRIPTIONS> or </image-descriptions > copied from a screenshot could close the block and pass instructions to the CLI agent. Every < in the description is now escaped.

MEDIUM

• The header could name the wrong images. It listed every attachment, while Gemma only receives the ones with image data. Both now use the same filter (usableSidecarImages), so Gemma's [n] numbers match the file names.
• /screenshot and /paste images were dropped when the image read failed. They now fall back to the built-in multimodal backend, as before the sidecar existed. If no such backend is set up, the turn fails with a clear error. Images dragged in as file paths behave as before: the turn runs without the image and a notice says so.

CI

• Fixed the two errcheck lint errors in cerebras_vision_test.go (the unchecked Decode and Encode calls).

Tests

• New tests:
  • The escape test tries four spellings of the closing tag. All four fail against the old guard.
  • The header test fails when the filter is removed.
  • A cancellation test checks that cancelling stops a stalled Gemma call.
• go build ./..., go vet, gofmt, go test ./... and golangci-lint v1.64.8 (the version CI uses) all pass locally. The sidecar tests also pass under -race.
• Not tested automatically: the fallback to the built-in multimodal backend lives inside repl.Run, which the existing tests can't drive. To check it by hand, set an invalid Cerebras key and run /screenshot with a text-only CLI backend.

#206 still needs a rebase on main.

[qualitymaxapp]

QualityMax Review

Verdict: COMMENT · Confidence: evidence-backed scan

Re-review: Open the QualityMax check and select Re-review after it completes.

Files eligible: 3 · Files reviewed: 3 · Files with findings: 0 · Findings: 0 · Inline cards: 0

Priority findings

priority	location	finding
—	—	No blocking findings

Review gates

gate	status
AI diff review	completed · eligible 3, reviewed 3 · LLM · served gemini-3.1-flash-lite
SAST	completed · eligible 3, reviewed 3 · hybrid · served qwen3.7-plus
Overall review evidence	clean
Inline evidence	not needed

Important files

file	risk	note	next step
—	—	No findings	—

Change diagram — Flow

flowchart TD
    A[User Input] --> B{Use Vision Sidecar?}
    B -- Yes --> C[Start Sidecar Context]
    C --> D[Describe Images with Gemma]
    D -- Success --> E[Build Augmented Prompt]
    D -- Failure --> F{Embedded Backend Available?}
    F -- Yes --> G[Fallback to Embedded Backend]
    F -- No --> H[Report Error/Run Text-Only]
    E --> I[Execute CLI Turn]
    G --> I
    H --> I
    B -- No --> I
    I --> J[Cleanup Sidecar Context]

Loading

Review lifecycle

Use the inline cards to inspect evidence and suggested remediation. Re-run the QualityMax review after pushing a fix; unchanged cards are identified by their stable finding marker. Dismiss with a reason through the existing QualityMax/GitHub review feedback flow. 0 prior card(s) are stale/resolved on this head. @qmax Q&A is tracked separately.

Proof legend: VERIFIED independently judged patch · REPRODUCED verified finding · GROUNDED deterministic evidence · MODEL-ONLY model judgment.

QualityMax project results are available in the configured project.

_{Receipt · commit d1b51eaa1d68fbffde289ed70a99bf61b3cf9546 · run 2026-09-27T07:50:15+00:00 · model served qwen3.7-plus, gemini-3.1-flash-lite · model requested qwen3.7-plus, gemini-3.1-flash-lite · model review recorded — 1015 model output tokens · model source repository ai_review_preferences.preferred_model · re-review 2 · proof counts {}}

[qualitymaxapp]

QualityMax Review — canonical overview updated; no inline findings were created for this review.

[qualitymaxapp]

⚠️ QualityMax Pipeline

Gate	Result
🔍 AI diff review	✅ Clean · gemini-3.1-flash-lite · completed · 3 eligible / 3 reviewed · gemini-3.1-flash-lite
🔍 SAST	completed · 3 eligible / 3 reviewed · qwen3.7-plus
🔍 Canonical PR review delivery	completed · 0 eligible / 0 reviewed · exact-head review #5329398201 and overview #5853950192 confirmed
🧪 Repo Tests	✅ 853/853 passed (go)

_{Powered by QualityMax — AI-Powered Test Automation}