Skip to content

Validate document-image bytes before uploading to IT Glue - #16

Merged
selic merged 1 commit into
mainfrom
fix/validate-document-image-bytes
Sep 16, 2026
Merged

selic merged 1 commit into
mainfrom
fix/validate-document-image-bytes

Conversation

@selic

@selic selic commented Sep 16, 2026

Copy link
Copy Markdown
Member

Problem

A colleague's itglue_create_document_image call (document 25040194, routing-diagram.png, content_base64) failed with IT Glue's opaque:

Error: Validation failed. Paperclip::Errors::NotIdentifiedByImageMagickError

Decoding the base64 from the screenshot: valid PNG signature and IHDR (1100×321, 8-bit palette), PLTE chunk starts — and then the body is missing. The base64 was cut off in transit (or reconstructed by the assistant), so IT Glue's ImageMagick could not decode it. Nothing in the error tells the model that.

Fix

  • sniffImage() in src/tools/binary-input.ts identifies PNG/JPEG/GIF/WebP/BMP/TIFF/SVG by magic bytes and checks each container's end-of-image marker (IEND, FF D9, 0x3B, RIFF length, </svg>).
  • assertRenderableImage() turns that into a clear UploadInputError: "truncated — header valid, end-of-image marker missing… use url / file_path" or "not a recognizable image… if the assistant wrote the base64 it is not a real image".
  • itglue_create_document_image runs it before calling IT Glue. Attachments are not gated (they may legitimately be PDFs, config exports, …).
  • Tool description now tells the model never to write or reconstruct base64 and to prefer url/file_path.
  • Tests: the exact truncated header from the failed call is a fixture; existing handler tests now upload a real 1×1 PNG. 146 passing.

No behaviour change for valid uploads.

🤖 Generated with Claude Code

A colleague's itglue_create_document_image call failed with IT Glue's
opaque "Validation failed. Paperclip::Errors::NotIdentifiedByImageMagickError".
The content_base64 carried a valid PNG signature and IHDR (1100x321) but the
body never arrived — the base64 was cut off in transit (or reconstructed by
the assistant), and IT Glue's ImageMagick could not decode it.

Sniff the bytes first: recognise PNG/JPEG/GIF/WebP/BMP/TIFF/SVG by magic
bytes, check the container's end-of-image marker (IEND, FFD9, 0x3B, RIFF
length, </svg>), and fail fast with a message that names the cause and points
at url/file_path so the server reads the bytes itself. Attachments are not
gated (they may be PDFs, configs, etc.). The tool description now also tells
the model never to write base64 by hand.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@selic
selic merged commit 58e88ca into main Sep 16, 2026
2 checks passed
@selic
selic deleted the fix/validate-document-image-bytes branch September 16, 2026 12:31
@selic selic mentioned this pull request Sep 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant