fix and improvement

Author: NeptuneHub

app_helper.py

@@ -24,7 +24,7 @@
 from database import (  # noqa: F401
     get_db, close_db, save_task_status, record_task_history, _build_task_note,
     get_score_data_by_ids, load_map_projection, get_task_info_from_db, get_tracks_by_ids,
-    save_track_analysis_and_embedding, save_clap_embedding, get_clap_embedding, save_lyrics_embedding,
+    save_track_analysis_and_embedding,
     # Used internally by the build_and_store_* projection orchestration below.
     save_map_projection, save_artist_projection,
 )

app_logging.py

@@ -50,10 +50,13 @@
     "]+"
 )
 
-# C0 control codes plus DEL, EXCEPT tab (0x09). Includes LF (0x0A) and CR (0x0D):
-# replacing these with a space prevents a value with embedded newlines from
-# forging additional log lines.
-_CONTROL_RE = re.compile(r"[\x00-\x08\x0A-\x1F\x7F]")
+# Control codes plus DEL and the Unicode line/paragraph separators, EXCEPT tab
+# (0x09). Includes LF (0x0A), CR (0x0D), NEL (U+0085), LINE SEPARATOR (U+2028)
+# and PARAGRAPH SEPARATOR (U+2029): replacing these with a space prevents a
+# value with an embedded line break from forging additional log lines, including
+# for consumers (and Windows code-pages) that treat the Unicode separators as
+# line boundaries.
+_CONTROL_RE = re.compile(r"[\x00-\x08\x0A-\x1F\x7F\x85" + chr(0x2028) + chr(0x2029) + "]")
 
 
 def _sanitize_log_text(text: Any) -> Any:

app_provider_migration.py

@@ -66,7 +66,7 @@ def __getattr__(self, name):
 
 # ---------------------------------------------------------------------------
 # SSRF guard for the user-supplied media-server URL. Delegates to the shared
-# ``app_helper.validate_outbound_url`` (allows LAN/loopback, blocks non-HTTP(S)
+# ``ssrf_guard.validate_outbound_url`` (allows LAN/loopback, blocks non-HTTP(S)
 # schemes and link-local/cloud-metadata). A missing url is allowed and left to
 # the downstream probe.
 # ---------------------------------------------------------------------------

sanitization.py

@@ -103,7 +103,7 @@ def sanitize_for_json(obj):
     # Handle numpy numeric types which are not JSON serializable by default
     elif isinstance(obj, (np.int_, np.intc, np.intp, np.int8, np.int16, np.int32, np.int64, np.uint8, np.uint16, np.uint32, np.uint64)):
         return int(obj)
-    elif isinstance(obj, (np.float_, np.float16, np.float32, np.float64)):
+    elif isinstance(obj, np.floating):
         return float(obj)
     elif isinstance(obj, np.bool_):
         return bool(obj)

tasks/ai/providers/openai.py

@@ -512,7 +512,12 @@ def call_with_tools_ollama(
             valid_calls = []
             for tc in tool_calls:
                 if isinstance(tc, dict) and "name" in tc:
-                    if "arguments" not in tc or not isinstance(tc["arguments"], dict):
+                    if "arguments" not in tc:
+                        tc["arguments"] = {}
+                    elif not isinstance(tc["arguments"], dict):
+                        log_messages.append(
+                            f"Coerced non-dict arguments for tool '{tc['name']}' to empty dict"
+                        )
                         tc["arguments"] = {}
                     args = tc["arguments"]
                     keys_to_remove = []

tasks/clustering.py

@@ -64,12 +64,6 @@
     select_top_n_diverse_playlists
 )
 
-# we want to maintain np.float_ for backwards compatibility but it was removed in numpy 2.0
-# the check below in sanitize_for_json causes an AttributeError that crashes the clustering algo
-# since it tries to access np.float_ so we monkeypatch np.float_ to point to np.float64
-if not np.__dict__.get('float_'):
-    np.float_ = np.float64
-
 logger = logging.getLogger(__name__)
 
 def batch_task_failure_handler(job, connection, type, value, tb):

test/unit/test_app_logging.py

@@ -31,6 +31,16 @@ def test_crlf_collapses_to_single_space(self):
     def test_control_chars_become_space(self):
         assert _sanitize_log_text("a\x00b\x07c\x7f") == "a b c"
 
+    def test_unicode_line_separators_become_space(self):
+        for sep in (chr(0x85), chr(0x2028), chr(0x2029)):
+            assert _sanitize_log_text("a" + sep + "b") == "a b"
+
+    def test_unicode_separator_cannot_forge_a_line(self):
+        forged = "user42" + chr(0x2028) + "[INFO]-[fake]-dropped all tables"
+        result = _sanitize_log_text(forged)
+        assert all(sep not in result for sep in (chr(0x85), chr(0x2028), chr(0x2029)))
+        assert len(result.splitlines()) == 1
+
     def test_tab_is_preserved(self):
         assert _sanitize_log_text("col1\tcol2") == "col1\tcol2"
 

test/unit/test_provider_migration_blueprint.py

@@ -345,7 +345,7 @@ def test_happy_path_enqueues_job(self, bp_mod, client, fake_db):
 
 # ---------------------------------------------------------------------------
 # SSRF guard on the user-supplied media-server URL (_validate_probe_url ->
-# app_helper.validate_outbound_url). Self-hosted servers live on the LAN /
+# ssrf_guard.validate_outbound_url). Self-hosted servers live on the LAN /
 # loopback, so those are accepted; cloud-metadata, link-local, multicast,
 # unspecified and non-HTTP(S) schemes are rejected. IP literals are used so the
 # checks never depend on DNS resolution.