Merge branch 'main' into feature/modality-support-detection

Author: fitzpr

.devcontainer/Dockerfile

@@ -7,6 +7,9 @@ SHELL ["/bin/bash", "-c"]
 
 USER root
 
+# Remove the Yarn repository (has expired GPG key and we don't use Yarn)
+RUN rm -f /etc/apt/sources.list.d/yarn.list 2>/dev/null || true
+
 # Install required system packages + ODBC prerequisites
 RUN apt-get update && apt-get install -y \
     sudo \
@@ -20,15 +23,17 @@ RUN apt-get update && apt-get install -y \
  && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # Install the Azure CLI, Microsoft ODBC Driver 18 & SQL tools
+# Note: Debian Trixie's sqv rejects SHA1 signatures, so we use gpg directly to import the Microsoft key
 RUN apt-get update && apt-get install -y \
       apt-transport-https \
       ca-certificates \
       gnupg \
       lsb-release \
- && curl -sL https://packages.microsoft.com/config/debian/12/packages-microsoft-prod.deb \
-      -o packages-microsoft-prod.deb \
- && dpkg -i packages-microsoft-prod.deb \
- && rm packages-microsoft-prod.deb \
+ && curl -sL https://packages.microsoft.com/keys/microsoft.asc \
+      | gpg --dearmor \
+      > /usr/share/keyrings/microsoft-archive-keyring.gpg \
+ && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/debian/12/prod bookworm main" \
+      > /etc/apt/sources.list.d/microsoft.list \
  && apt-get update \
  && ACCEPT_EULA=Y apt-get install -y \
       msodbcsql18 \

.devcontainer/devcontainer_setup.sh

@@ -71,6 +71,13 @@ if [ -f "package.json" ]; then
 
     # Install Playwright browsers and system dependencies for E2E testing
     echo "📦 Installing Playwright browsers..."
+
+    # Remove third-party repos with SHA1 signature issues (rejected since 2026-02-01)
+    # Playwright deps come from Debian main repos, these aren't needed
+    sudo rm -f /etc/apt/sources.list.d/yarn.list \
+               /etc/apt/sources.list.d/nodesource.list \
+               /etc/apt/sources.list.d/microsoft.list 2>/dev/null || true
+
     npx playwright install --with-deps chromium
 
     echo "✅ Frontend dependencies installed."

.env_example

@@ -19,27 +19,45 @@ PLATFORM_OPENAI_CHAT_GPT4O_MODEL="gpt-4o"
 AZURE_OPENAI_GPT4O_ENDPOINT="https://xxxx.openai.azure.com/openai/v1"
 AZURE_OPENAI_GPT4O_KEY="xxxxx"
 AZURE_OPENAI_GPT4O_MODEL="deployment-name"
-# Since deployment name may be custom and differ from the actual underlying model,
-# you can specify the underlying model for identifier purposes
+# Since Azure deployment name may be custom and differ from the actual underlying model,
+# you can specify the underlying model for identifier purposes. If not specified,
+# identifiers will default to the value of the standard MODEL environment variable.
 AZURE_OPENAI_GPT4O_UNDERLYING_MODEL="gpt-4o"
 
 AZURE_OPENAI_INTEGRATION_TEST_ENDPOINT="https://xxxxx.openai.azure.com/openai/v1"
 AZURE_OPENAI_INTEGRATION_TEST_KEY="xxxxx"
 AZURE_OPENAI_INTEGRATION_TEST_MODEL="deployment-name"
+AZURE_OPENAI_INTEGRATION_TEST_UNDERLYING_MODEL=""
 
 AZURE_OPENAI_GPT3_5_CHAT_ENDPOINT="https://xxxxx.openai.azure.com/openai/v1"
 AZURE_OPENAI_GPT3_5_CHAT_KEY="xxxxx"
 AZURE_OPENAI_GPT3_5_CHAT_MODEL="deployment-name"
+AZURE_OPENAI_GPT3_5_CHAT_UNDERLYING_MODEL=""
 
 AZURE_OPENAI_GPT4_CHAT_ENDPOINT="https://xxxxx.openai.azure.com/openai/v1"
 AZURE_OPENAI_GPT4_CHAT_KEY="xxxxx"
 AZURE_OPENAI_GPT4_CHAT_MODEL="deployment-name"
+AZURE_OPENAI_GPT4_CHAT_UNDERLYING_MODEL=""
+
+# Endpoints that host models with fewer safety mechanisms (e.g. via adversarial fine tuning
+# or content filters turned off) can be defined below and used in adversarial attack testing scenarios.
+AZURE_OPENAI_GPT4O_UNSAFE_CHAT_ENDPOINT="https://xxxxx.openai.azure.com/openai/v1"
+AZURE_OPENAI_GPT4O_UNSAFE_CHAT_KEY="xxxxx"
+AZURE_OPENAI_GPT4O_UNSAFE_CHAT_MODEL="deployment-name"
+AZURE_OPENAI_GPT4O_UNSAFE_CHAT_UNDERLYING_MODEL=""
+
+AZURE_OPENAI_GPT4O_UNSAFE_CHAT_ENDPOINT2="https://xxxxx.openai.azure.com/openai/v1"
+AZURE_OPENAI_GPT4O_UNSAFE_CHAT_KEY2="xxxxx"
+AZURE_OPENAI_GPT4O_UNSAFE_CHAT_MODEL2="deployment-name"
+AZURE_OPENAI_GPT4O_UNSAFE_CHAT_UNDERLYING_MODEL2=""
 
 AZURE_FOUNDRY_DEEPSEEK_ENDPOINT="https://xxxxx.eastus2.models.ai.azure.com"
 AZURE_FOUNDRY_DEEPSEEK_KEY="xxxxx"
+AZURE_FOUNDRY_DEEPSEEK_MODEL=""
 
 AZURE_FOUNDRY_PHI4_ENDPOINT="https://xxxxx.models.ai.azure.com"
 AZURE_CHAT_PHI4_KEY="xxxxx"
+AZURE_FOUNDRY_PHI4_MODEL=""
 
 AZURE_FOUNDRY_MISTRAL_LARGE_ENDPOINT="https://xxxxx.services.ai.azure.com/openai/v1/"
 AZURE_FOUNDRY_MISTRAL_LARGE_KEY="xxxxx"
@@ -75,6 +93,7 @@ AZURE_OPENAI_GPT5_RESPONSES_ENDPOINT="https://xxxxxxxxx.azure.com/openai/v1"
 AZURE_OPENAI_GPT5_COMPLETION_ENDPOINT="https://xxxxxxxxx.azure.com/openai/v1"
 AZURE_OPENAI_GPT5_KEY="xxxxxxx"
 AZURE_OPENAI_GPT5_MODEL="gpt-5"
+AZURE_OPENAI_GPT5_UNDERLYING_MODEL="gpt-5"
 
 PLATFORM_OPENAI_RESPONSES_ENDPOINT="https://api.openai.com/v1"
 PLATFORM_OPENAI_RESPONSES_KEY="sk-xxxxx"
@@ -83,6 +102,7 @@ PLATFORM_OPENAI_RESPONSES_MODEL="o4-mini"
 AZURE_OPENAI_RESPONSES_ENDPOINT="https://xxxxx.openai.azure.com/openai/v1"
 AZURE_OPENAI_RESPONSES_KEY="xxxxx"
 AZURE_OPENAI_RESPONSES_MODEL="o4-mini"
+AZURE_OPENAI_RESPONSES_UNDERLYING_MODEL="o4-mini"
 
 OPENAI_RESPONSES_ENDPOINT=${PLATFORM_OPENAI_RESPONSES_ENDPOINT}
 OPENAI_RESPONSES_KEY=${PLATFORM_OPENAI_RESPONSES_KEY}
@@ -103,6 +123,7 @@ PLATFORM_OPENAI_REALTIME_MODEL="gpt-4o-realtime-preview"
 AZURE_OPENAI_REALTIME_ENDPOINT = "wss://xxxx.openai.azure.com/openai/v1"
 AZURE_OPENAI_REALTIME_API_KEY = "xxxxx"
 AZURE_OPENAI_REALTIME_MODEL = "gpt-4o-realtime-preview"
+AZURE_OPENAI_REALTIME_UNDERLYING_MODEL = "gpt-4o-realtime-preview"
 
 OPENAI_REALTIME_ENDPOINT = ${PLATFORM_OPENAI_REALTIME_ENDPOINT}
 OPENAI_REALTIME_API_KEY = ${PLATFORM_OPENAI_REALTIME_API_KEY}
@@ -119,10 +140,12 @@ OPENAI_REALTIME_UNDERLYING_MODEL = ""
 OPENAI_IMAGE_ENDPOINT1  = "https://xxxxx.openai.azure.com/openai/v1"
 OPENAI_IMAGE_API_KEY1 = "xxxxxx"
 OPENAI_IMAGE_MODEL1 = "deployment-name"
+OPENAI_IMAGE_UNDERLYING_MODEL1 = "dall-e-3"
 
 OPENAI_IMAGE_ENDPOINT2 = "https://api.openai.com/v1"
 OPENAI_IMAGE_API_KEY2 = "sk-xxxxx"
 OPENAI_IMAGE_MODEL2 = "dall-e-3"
+OPENAI_IMAGE_UNDERLYING_MODEL2 = "dall-e-3"
 
 OPENAI_IMAGE_ENDPOINT = ${OPENAI_IMAGE_ENDPOINT2}
 OPENAI_IMAGE_API_KEY = ${OPENAI_IMAGE_API_KEY2}
@@ -140,10 +163,12 @@ OPENAI_IMAGE_UNDERLYING_MODEL = ""
 OPENAI_TTS_ENDPOINT1 = "https://xxxxx.openai.azure.com/openai/v1"
 OPENAI_TTS_KEY1 = "xxxxxxx"
 OPENAI_TTS_MODEL1 = "tts"
+OPENAI_TTS_UNDERLYING_MODEL1 = "tts"
 
 OPENAI_TTS_ENDPOINT2 = "https://api.openai.com/v1"
 OPENAI_TTS_KEY2 = "xxxxxx"
 OPENAI_TTS_MODEL2 = "tts-1"
+OPENAI_TTS_UNDERLYING_MODEL2 = "tts-1"
 
 OPENAI_TTS_ENDPOINT = ${OPENAI_TTS_ENDPOINT2}
 OPENAI_TTS_KEY = ${OPENAI_TTS_KEY2}
@@ -161,6 +186,7 @@ OPENAI_TTS_UNDERLYING_MODEL = ""
 AZURE_OPENAI_VIDEO_ENDPOINT="https://xxxxx.cognitiveservices.azure.com/openai/v1"
 AZURE_OPENAI_VIDEO_KEY="xxxxxxx"
 AZURE_OPENAI_VIDEO_MODEL="sora-2"
+AZURE_OPENAI_VIDEO_UNDERLYING_MODEL="sora-2"
 
 OPENAI_VIDEO_ENDPOINT = ${AZURE_OPENAI_VIDEO_ENDPOINT}
 OPENAI_VIDEO_KEY = ${AZURE_OPENAI_VIDEO_KEY}

.github/instructions/style-guide.instructions.md

@@ -96,6 +96,27 @@ def process(self, data: str) -> str:
 
 ## Documentation Standards
 
+### Import Placement
+- **MANDATORY**: All import statements MUST be at the top of the file
+- Do NOT use inline/local imports inside functions or methods
+- The only exception is breaking circular import dependencies, which should be rare and documented
+
+```python
+# CORRECT — imports at the top of the file
+from contextlib import closing
+from sqlalchemy.exc import SQLAlchemyError
+
+def update_entry(self, entry: Base) -> None:
+    with closing(self.get_session()) as session:
+        ...
+
+# INCORRECT — inline import inside a function
+def update_entry(self, entry: Base) -> None:
+    from contextlib import closing          # ← WRONG, must be at top of file
+    with closing(self.get_session()) as session:
+        ...
+```
+
 ### Docstring Format
 - Use Google-style docstrings
 - Include type information in parameter descriptions
@@ -457,4 +478,13 @@ Before committing code, ensure:
 
 ---
 
+## File Editing Rules
+
+### Never Use `sed` for File Edits
+- **MANDATORY**: Never use `sed` (or similar stream-editing CLI tools) to modify source files
+- `sed` frequently corrupts files, applies partial edits, or silently fails
+- Always use the editor's built-in replace/edit tools (e.g., `replace_string_in_file`, `multi_replace_string_in_file`) to make targeted, verifiable changes
+
+---
+
 **Remember**: Clean code is written for humans to read. Make your intent clear and your code self-documenting.