fix(image): respect caller-pinned model on mature/private-adult routing

editImage and generateImage unconditionally re-ran PolicyAwareImageRouter
for mature/private-adult tiers and overwrote any explicit provider/model
the caller had pre-resolved. This silently discarded callers (e.g.
wilds-ai's image-jobs layer) that had substituted a working pinned-version
model for a known-broken catalog entry, reverting the resolution to the
broken slug while keeping the pinned version SHA in providerOptions —
a model+version mismatch that broke the Replicate call.

Now: when opts.provider or opts.model is set, the catalog re-resolution
is skipped and the caller's pin survives. The disable_safety_checker
bypass for Replicate still always fires for mature+ (load-bearing for
uncensored prompts) regardless of which model the caller pinned, but
caller-set replicate.disableSafetyChecker is honored to allow opt-out.

Author: jddunn

src/api/editImage.ts

@@ -191,27 +191,34 @@ export async function editImage(opts: EditImageOptions): Promise<EditImageResult
         opts.policyTier
         && (opts.policyTier === 'mature' || opts.policyTier === 'private-adult')
       ) {
-        const { PolicyAwareImageRouter } = await import(
-          '../media/images/PolicyAwareImageRouter.js'
-        );
-        const { createUncensoredModelCatalog } = await import(
-          '../core/llm/routing/UncensoredModelCatalog.js'
-        );
-        const imageRouter = new PolicyAwareImageRouter(createUncensoredModelCatalog());
-        // When the caller didn't pin a capability, default to img2img so
-        // the catalog never picks a txt2img-only model for an edit call.
-        const capabilities = opts.capabilities ?? ['img2img'];
-        const pref = imageRouter.getPreferredProvider(
-          opts.policyTier as 'mature' | 'private-adult',
-          capabilities,
-        );
-        if (pref) {
-          providerId = pref.providerId;
-          modelId = pref.modelId;
-          const existingReplicate =
-            (effectiveProviderOptions as Record<string, unknown> | undefined)?.replicate as
-              | Record<string, unknown>
-              | undefined;
+        // Caller-pin precedence: when a caller explicitly passes
+        // `provider` and/or `model` for a mature-tier edit, that
+        // resolution carries information the agentos catalog can't
+        // (specifically: pinned version SHAs for community Replicate
+        // models that 422 on the modern endpoint without a version,
+        // and face-anchor models the catalog flags as broken). The
+        // wilds-ai image-jobs layer relies on this — it substitutes
+        // `lucataco/ip-adapter-faceid-sdxl` (a known-broken catalog
+        // entry) with `zsxkib/pulid` plus a pinned version SHA before
+        // calling editImage. Re-running the router here would silently
+        // discard that substitution and revert to the broken slug.
+        const callerPinnedModel =
+          (typeof opts.model === 'string' && opts.model.length > 0)
+          || (typeof opts.provider === 'string' && opts.provider.length > 0);
+
+        // Always set disableSafetyChecker for Replicate on mature+
+        // tiers, regardless of which model the caller pinned. This is
+        // load-bearing for uncensored prompts to render — Replicate's
+        // default NSFW filter vetoes them otherwise. Caller's existing
+        // explicit setting wins (allows opt-out for test surfaces).
+        const existingReplicate =
+          (effectiveProviderOptions as Record<string, unknown> | undefined)?.replicate as
+            | Record<string, unknown>
+            | undefined;
+        if (
+          existingReplicate === undefined
+          || typeof existingReplicate.disableSafetyChecker === 'undefined'
+        ) {
           effectiveProviderOptions = {
             ...(effectiveProviderOptions ?? {}),
             replicate: {
@@ -220,6 +227,27 @@ export async function editImage(opts: EditImageOptions): Promise<EditImageResult
             },
           } as ImageProviderOptionBag;
         }
+
+        if (!callerPinnedModel) {
+          const { PolicyAwareImageRouter } = await import(
+            '../media/images/PolicyAwareImageRouter.js'
+          );
+          const { createUncensoredModelCatalog } = await import(
+            '../core/llm/routing/UncensoredModelCatalog.js'
+          );
+          const imageRouter = new PolicyAwareImageRouter(createUncensoredModelCatalog());
+          // When the caller didn't pin a capability, default to img2img so
+          // the catalog never picks a txt2img-only model for an edit call.
+          const capabilities = opts.capabilities ?? ['img2img'];
+          const pref = imageRouter.getPreferredProvider(
+            opts.policyTier as 'mature' | 'private-adult',
+            capabilities,
+          );
+          if (pref) {
+            providerId = pref.providerId;
+            modelId = pref.modelId;
+          }
+        }
       }
 
       const resolved = resolveMediaProvider(providerId, modelId, {

src/api/generateImage.ts

@@ -302,27 +302,53 @@ export async function generateImage(opts: GenerateImageOptions): Promise<Generat
       // `'face-consistency'` from the presence of a reference image so
       // character portraits keep the right face instead of drifting.
       if (opts.policyTier && (opts.policyTier === 'mature' || opts.policyTier === 'private-adult')) {
-        const { PolicyAwareImageRouter } = await import('../media/images/PolicyAwareImageRouter.js');
-        const { createUncensoredModelCatalog } = await import('../core/llm/routing/UncensoredModelCatalog.js');
-        const imageRouter = new PolicyAwareImageRouter(createUncensoredModelCatalog());
-        const inferredCaps =
-          opts.capabilities
-          ?? (opts.referenceImageUrl ? ['face-consistency'] : undefined);
-        const pref = imageRouter.getPreferredProvider(
-          opts.policyTier as 'mature' | 'private-adult',
-          inferredCaps,
-        );
-        if (pref) {
-          providerId = pref.providerId;
-          modelId = pref.modelId;
+        // Caller-pin precedence: when a caller explicitly passes
+        // `provider` and/or `model` for a mature-tier generate, that
+        // resolution carries information the agentos catalog can't
+        // (specifically: pinned version SHAs for community Replicate
+        // models that 422 on the modern endpoint, and face-anchor
+        // models the catalog flags as broken). Re-running the router
+        // here would silently discard the substitution. Same fix
+        // shape as editImage.ts.
+        const callerPinnedModel =
+          (typeof opts.model === 'string' && opts.model.length > 0)
+          || (typeof opts.provider === 'string' && opts.provider.length > 0);
+
+        // Always set disableSafetyChecker for Replicate on mature+
+        // tiers, regardless of which model the caller pinned —
+        // load-bearing for uncensored prompts to render. Caller's
+        // existing explicit setting wins (allows opt-out).
+        const existingReplicate =
+          (opts.providerOptions?.replicate as Record<string, unknown>) ?? undefined;
+        if (
+          existingReplicate === undefined
+          || typeof existingReplicate.disableSafetyChecker === 'undefined'
+        ) {
           opts.providerOptions = {
             ...opts.providerOptions,
             replicate: {
-              ...((opts.providerOptions?.replicate as Record<string, unknown>) ?? {}),
+              ...(existingReplicate ?? {}),
               disableSafetyChecker: true,
             },
           };
         }
+
+        if (!callerPinnedModel) {
+          const { PolicyAwareImageRouter } = await import('../media/images/PolicyAwareImageRouter.js');
+          const { createUncensoredModelCatalog } = await import('../core/llm/routing/UncensoredModelCatalog.js');
+          const imageRouter = new PolicyAwareImageRouter(createUncensoredModelCatalog());
+          const inferredCaps =
+            opts.capabilities
+            ?? (opts.referenceImageUrl ? ['face-consistency'] : undefined);
+          const pref = imageRouter.getPreferredProvider(
+            opts.policyTier as 'mature' | 'private-adult',
+            inferredCaps,
+          );
+          if (pref) {
+            providerId = pref.providerId;
+            modelId = pref.modelId;
+          }
+        }
       }
 
       const resolved = resolveMediaProvider(providerId, modelId, {