#138
Pull Requests/mrmps/classifier-dev/#138

Refuse audio and video at the dgemma door instead of silently dropping them

Openmrmpswants to merge intofrom
1 commit5 files changed+54-3

What

POST /v1/systemone bodies on the dgemma door (model "dgemma" named, or images present) that also carry audio, audios, video or videos are now refused with 400 dgemma_input and a message naming the medium. The developer guide, the OpenAPI description and request schema, and AGENTS.md now state that images are dgemma's only media and why.

Why

The pod's structured-read interposer silently drops keys it does not read. Verified against the live pod through production: audio: 42 and video: [wav data URL] both answered HTTP 200 with the text-only input token count — a confident answer about media the model never looked at, with no signal to the caller.

The capability reality, checked at each layer:

Layerimagevideoaudio
DiffusionGemma 26B-A4B in vLLM (diffusion_gemma.py)yesyesno — no audio input path
Pod interposer (structured_server.py, vllm-project/vllm#57250)images onlydroppeddropped
Beam hosted jev/diffusiongemma1 image max422422
classifier.dev gateway (before this PR)validatedforwarded + silently ignoredforwarded + silently ignored

Audio can never work on this model. Video can — the model declares the video modality and vllm-project/vllm#57589 fixed its multimodal path — but enabling it is a pod-side interposer change (build video_url parts), not a Worker one; until then refusing is the honest answer.

Tests

New unit cases: all four media keys refused on both doors with nothing called upstream; audio without images and without naming dgemma still goes to TypeSafe to validate. npm run typecheck clean, bun test 823 pass / 0 fail.

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Behavior Changes
    • DiffusionGemma requests containing audio or video are now rejected with a 400 dgemma_input response instead of being silently ignored. Image inputs remain supported; audio-only requests routed to other models are unaffected.
  • Documentation
    • Updated API documentation to clarify audio and video support and the conditions for these refusals.

Activity

2
M
Refuse audio and video at the dgemma door instead of silently dropping them
34e829b
coderabbitai[bot]1mo ago

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9089a71c-f78b-45f2-a6bd-53e8b532cb46

📥 Commits

Reviewing files that changed from the base of the PR and between 43818f818af44b5db6ea81ec9489f427138a35f6 and 34e829b45314d305ee30659e1210ead3acf434e5.

📒 Files selected for processing (5)
  • AGENTS.md
  • src/dgemma.ts
  • src/docs.ts
  • src/openapi.ts
  • test/dgemma.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

Walkthrough

The DiffusionGemma route now refuses requests with non-null audio or video fields. Tests cover these refusals and confirm that an audio-only request without dgemma or images is routed to TypeSafe. Documentation describes the supported media and refusal responses.

Changes

DiffusionGemma media input

Layer / File(s)Summary
Route validation, tests, and media documentation
src/dgemma.ts, test/dgemma.test.ts, AGENTS.md, src/docs.ts, src/openapi.ts		The route returns dgemma_input for non-null audio, audios, video, or videos fields. Tests cover rejection and TypeSafe routing. Documentation states that images are the only supported DiffusionGemma media and describes audio and video refusals.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: myxamediyar

Merge Risk: ⚪ Minimal · up to 34e82

The change rejects unsupported media for DiffusionGemma while preserving the described TypeSafe routing path; no merge-blocking risk is identified.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 34e82

The new refusal reduces the chance of a successful-looking answer to media the image-capable service did not process. It changes a public API response, but the reviewed path does not show expanded access or privileges.

Retained concerns No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The changed control limits unsupported-media handling at the public dgemma request boundary; reviewed code does not show a new credential, privilege, or provider-reachability path.

Trust Boundaries and Controls

  • observed — For the selected dgemma route, attacker-supplied non-null audio or video fields trigger a refusal before model-provider dispatch. The guard does not claim ownership of plain TypeSafe requests.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely summarizes the main change: dgemma now refuses audio and video instead of silently dropping them.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 4 files. (1 skipped: 1 …
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.