fix(image): normalize JPEG MIME and infer reference image types

[xxynet]

⚠️ Base branch must be dev. PRs targeting main will be rejected.

Summary

Fix reference-image generation failing with Unsupported image MIME type: image/jpg after #328. The <img> and <selfie> tags constructed MIME types directly from filename extensions, bypassing the content inference added in #315. JPEG references now use image/jpeg, and reference images with misleading or missing extensions use the existing content detection.

Type of change

• feat: New feature
• fix: Bug fix
• refactor: Code refactor (no functional change)
• docs: Documentation update
• chore: Build, CI, dependencies, or other maintenance
• style: Code style / formatting (no logic change)
• test: Adding or updating tests

Changes

• Let <img> and <selfie> reference images use the existing Image MIME inference instead of explicitly assigning image/<extension>.
• Normalize image/jpg to image/jpeg before OpenAI edit-upload validation so externally supplied Data URLs and explicit MIME values remain compatible.
• Add regression coverage for JPEG MIME aliases, uppercase subtype spelling, Data URLs, and explicit Base64 MIME values; assert the uploaded filename, bytes, and canonical MIME.
• Affected paths: reference-image tags → Image.to_data_url() → image providers, and OpenAI image-edit upload conversion. Text-to-image behavior is unchanged. Unsupported image types and malformed Base64 remain rejected by the existing validation.

Screenshots / Logs

Before: a .jpg reference from <img> or <selfie> produced image/jpg and was rejected before reaching the image-edit API.
After: tag inputs use content inference, and OpenAI uploads accept the JPEG alias while sending canonical image/jpeg.

Regression validation on dev, using the host Python environment:

python -m pytest tests/test_openai_image_client.py tests/test_message_elements.py tests/test_media_refs.py tests/test_image_compression.py tests/test_kira_ai_file_tag.py -q
97 passed, 1 warning

The warning is an existing Authlib deprecation warning. git diff --check origin/dev...HEAD passed. API calls were mocked; live image generation was not exercised. Regression risks are MIME selection for reference-image tags and upload validation; related media conversion, storage, compression, file-tag, and OpenAI tests passed.

Checklist

• I have tested these changes locally
• I have updated documentation if needed — no documentation changes needed
• New dependencies have been added to requirements.txt (if applicable) — no new dependencies
• If this PR introduces new features, they have been discussed with the owner or maintainer — not applicable; bug fix only
• This PR does not introduce breaking changes

Summary by CodeRabbit

• Bug Fixes
  • Improved compatibility when editing images with OpenAI: inputs labeled image/jpg or image/JPG are now recognized as JPEG and uploaded with the correct JPEG format. Existing image/jpeg inputs continue to work.
  • Reference images used with AI image tags are no longer assigned a MIME type based on their filename extension.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 1282e398-375c-4b4e-a23a-086dedb51950

📥 Commits

Reviewing files that changed from the base of the PR and between 69a5572 and bb26ced.

📒 Files selected for processing (3)

• core/plugin/builtin_plugins/kira-ai/tags.py
• core/provider/src/openai/model_clients.py
• tests/test_openai_image_client.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Kira AI image tags no longer infer MIME types from reference image extensions or pass MIME metadata to Image elements. The OpenAI image client converts image/jpg to image/jpeg, with tests covering JPEG MIME spellings and input sources.

Changes

Image MIME handling

Layer / File(s)	Summary
Reference image MIME handling core/plugin/builtin_plugins/kira-ai/tags.py, core/provider/src/openai/model_clients.py, tests/test_openai_image_client.py	ImgTag and SelfieTag omit extension-derived MIME metadata when creating reference Image elements. The OpenAI client normalizes image/jpg to image/jpeg. Tests cover three MIME spellings from data URLs and explicit MIME metadata.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to bb26c

Reference-image uploads retain their detected supported format, and JPEG aliases are canonicalized. No actionable merge-blocking risk is identified.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to bb26c

Reference-image handling can now send some non-image local files to an external image provider. The exposure depends on image generation being enabled and a reference path being selected, but it warrants a security design review.

Retained concerns

• High · security · inferred: An ImgTag-selected local file with an unrecognized MIME and non-image contents can be labeled JPEG and passed to the external image-edit upload, whereas the prior extension-derived MIME was rejected.

Security review details

Security Blast Radius

• inferred — For the OpenAI edit path, exposure is bounded by files readable by the bot process and paths selectable through an enabled ImgTag; the destination is the configured external image provider, not an attacker-selected endpoint.

Security Findings and Attack Paths

• inferred — If an enabled ImgTag selects a readable file with an unrecognized MIME and no detected image signature, its bytes can pass as a JPEG upload. The old explicit image/ value would not pass the supported-MIME check for that file.

Trust Boundaries and Controls

• observed — The edit converter rejects unsupported MIME, invalid Base64, and empty data, but does not verify decoded image contents. A name that resolves to a recognized non-image MIME can still be rejected.
• observed — SelfieTag's reference path is configuration-controlled, not supplied by its tag arguments, so it does not establish the same direct path-selection route as ImgTag.

Hardening Proposals

• proposed — Before provider upload, restrict tag-selected references to authorized file locations and validate that their decoded contents are an allowed image format; do not use the JPEG fallback as proof that arbitrary file bytes are an image.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main changes: JPEG MIME normalization and reference image type inference.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the image trail
JPEG bytes ride without fail
“jpg” becomes “jpeg”
The tags leave MIME claims behind
Then hop away, with files in line}

_{Comment @coderabbitai help to get the list of available commands.}