feat(F-095): completed feature

work/artifacts/F-095/implementer.md

@@ -0,0 +1,14 @@
+# F-095 — Implementer evidence
+
+## Changes
+
+- Removed the erroneous empty `productsApi.update(productId, {})` call from URL image attachment.
+- The admin image editor now sends `{ url }` to `/api/upload`, then attaches the returned local `/uploads/...` URL to the product.
+- `/api/upload` now supports authenticated JSON URL imports: validates public HTTP(S) hosts, follows limited redirects, accepts only supported image MIME/signatures, enforces the 10MB limit, stores locally, mirrors peers, and generates thumbnails.
+- Existing multipart file upload behavior uses the shared local save helper.
+
+## Validation
+
+- Admin `npx tsc --noEmit` → exit 0
+- Admin ESLint on upload route and ImagesSection → 0 errors
+- Admin production build → exit 0

work/artifacts/F-095/leader-close.json

@@ -0,0 +1,15 @@
+{
+  "feature_id": "F-095",
+  "agent": "leader",
+  "verdict": "APPROVED",
+  "summary": "F-095 downloads validated remote images to local uploads before attaching them and removes the 400-causing empty PATCH.",
+  "evidence": [
+    "reviewer.json verdict=APPROVED",
+    "security.json verdict=APPROVED",
+    "qa.json verdict=APPROVED",
+    "Admin build exit 0",
+    "Root tests: 133 passed, 56 skipped",
+    "scripts/verify.sh exit 0"
+  ],
+  "timestamp": "2026-08-20T20:05:50Z"
+}

work/artifacts/F-095/qa.json

@@ -0,0 +1,14 @@
+{
+  "feature_id": "F-095",
+  "agent": "qa",
+  "verdict": "APPROVED",
+  "summary": "Remote image import changes pass admin build, root tests, typechecks, and harness verification.",
+  "evidence": [
+    "Admin npx tsc --noEmit exit 0",
+    "Admin npm run build exit 0",
+    "Root tests: 133 passed, 56 skipped",
+    "Admin ESLint upload route and ImagesSection exit 0",
+    "scripts/verify.sh exit 0"
+  ],
+  "timestamp": "2026-08-20T20:05:40Z"
+}

work/artifacts/F-095/reviewer.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-095",
+  "agent": "reviewer",
+  "verdict": "APPROVED",
+  "summary": "URL image import now downloads into the managed upload pipeline before product attachment and removes the 400-causing empty product PATCH.",
+  "evidence": [
+    "ImagesSection uploads URL JSON then attaches only the returned local path",
+    "Remote route validates MIME, signature, size, redirects, and public host",
+    "Existing multipart upload shares local persistence and thumbnail generation",
+    "Admin production build passes"
+  ],
+  "timestamp": "2026-08-20T20:05:00Z"
+}

work/artifacts/F-095/security.json

@@ -0,0 +1,14 @@
+{
+  "feature_id": "F-095",
+  "agent": "security",
+  "verdict": "APPROVED",
+  "summary": "Remote imports remain authenticated and constrained to public HTTP(S) image resources with redirect, size, MIME, and binary signature checks.",
+  "evidence": [
+    "Upload route requires authenticated backoffice session before remote fetch",
+    "localhost, local hostnames, private IPv4, and private IPv6 destinations are rejected",
+    "Only image MIME types supported by the existing upload pipeline are accepted",
+    "10MB limit, timeout, limited redirects, and image magic-byte validation are enforced",
+    "Remote URL is never stored directly as a product image"
+  ],
+  "timestamp": "2026-08-20T20:05:20Z"
+}

work/current.md

@@ -1,14 +1,22 @@
 # Feature actual
 
-## Feature activa: F-094 (in_progress) — Create and explain product variants from Publish tab
+## Feature activa: F-095 (in_progress) — Download remote image URL before attaching product image
 
-Backlog: 162 features (152 done, 9 pending, 1 in_progress).
+Backlog: 163 features (153 done, 9 pending, 1 in_progress).
 
 Últimas features cerradas: **F-080**, **F-081**, **F-082**, **F-083**, **F-084**, **F-085**, **F-086**, **F-087**.
 
 ## Incidencia actual (2026-08-20)
 
-Precios e Inventario indican que las variantes se crean desde Publicar, pero Publicar no ofrece creación ni explicación. F-094 añade la gestión de variantes allí.
+Añadir una imagen por URL devuelve 400 porque el flujo hace un PATCH vacío del producto y adjunta directamente la URL remota. F-095 descargará la imagen validada a uploads locales antes de adjuntarla.
+
+## Última incidencia resuelta (2026-08-20)
+
+F-094 cerrada con todos los gates aprobados. Publicar permite crear variantes y explica SKU/EAN, precios y stock.
+
+## Incidencia anterior (2026-08-20)
+
+Precios e Inventario indicaban que las variantes se creaban desde Publicar, pero Publicar no ofrecía creación ni explicación.
 
 ## Última incidencia resuelta (2026-08-20)
 

work/runtime-status.json

@@ -1,62 +1,13 @@
 {
-  "feature_id": "F-094",
+  "feature_id": "F-095",
   "stage": "close",
   "agent": "leader",
-  "action": "Validate F-094 gates and close variant workflow",
+  "action": "Validate F-095 gates and close remote image importer",
   "state": "running",
   "next_agent": "leader",
   "waiting_for": "verify.sh green",
-  "updated_at": "2026-08-20T20:01:42Z",
+  "updated_at": "2026-08-20T20:05:44Z",
   "timeline": [
-    {
-      "ts": "2026-08-20T19:48:12Z",
-      "agent": "leader",
-      "stage": "intake",
-      "state": "running",
-      "message": "Triage expiration date placement: move from SEO tab to General tab"
-    },
-    {
-      "ts": "2026-08-20T19:48:26Z",
-      "agent": "implementer",
-      "stage": "build",
-      "state": "running",
-      "message": "Move existing expirationDate control from SEO section into General section"
-    },
-    {
-      "ts": "2026-08-20T19:51:05Z",
-      "agent": "reviewer",
-      "stage": "review_gate",
-      "state": "running",
-      "message": "Review expiration date placement and unchanged save contract"
-    },
-    {
-      "ts": "2026-08-20T19:51:17Z",
-      "agent": "security",
-      "stage": "security_gate",
-      "state": "running",
-      "message": "Check expiration date move for unchanged validation and payload"
-    },
-    {
-      "ts": "2026-08-20T19:51:27Z",
-      "agent": "qa",
-      "stage": "qa_gate",
-      "state": "running",
-      "message": "Run F-092 admin checks, deployment smoke test, and verify"
-    },
-    {
-      "ts": "2026-08-20T19:51:36Z",
-      "agent": "leader",
-      "stage": "close",
-      "state": "running",
-      "message": "Validate F-092 gates and close expiration date placement"
-    },
-    {
-      "ts": "2026-08-20T19:51:56Z",
-      "agent": "leader",
-      "stage": "close",
-      "state": "done",
-      "message": "F-092 cerrado: caducidad en General y backend/admin redeployados"
-    },
     {
       "ts": "2026-08-20T19:55:40Z",
       "agent": "leader",
@@ -147,6 +98,55 @@
       "stage": "close",
       "state": "running",
       "message": "Validate F-094 gates and close variant workflow"
+    },
+    {
+      "ts": "2026-08-20T20:02:00Z",
+      "agent": "leader",
+      "stage": "close",
+      "state": "done",
+      "message": "F-094 cerrado: creación y explicación de variantes en Publicar"
+    },
+    {
+      "ts": "2026-08-20T20:02:19Z",
+      "agent": "leader",
+      "stage": "intake",
+      "state": "running",
+      "message": "Triage image URL 400 and implement secure remote download to uploads"
+    },
+    {
+      "ts": "2026-08-20T20:03:18Z",
+      "agent": "implementer",
+      "stage": "build",
+      "state": "running",
+      "message": "Implement remote image URL download and local attachment flow"
+    },
+    {
+      "ts": "2026-08-20T20:04:52Z",
+      "agent": "reviewer",
+      "stage": "review_gate",
+      "state": "running",
+      "message": "Review remote image download, validation, storage, and attachment flow"
+    },
+    {
+      "ts": "2026-08-20T20:05:06Z",
+      "agent": "security",
+      "stage": "security_gate",
+      "state": "running",
+      "message": "Check SSRF, remote content validation, size limits, and upload auth"
+    },
+    {
+      "ts": "2026-08-20T20:05:21Z",
+      "agent": "qa",
+      "stage": "qa_gate",
+      "state": "running",
+      "message": "Run image import typecheck, tests, build, and verify"
+    },
+    {
+      "ts": "2026-08-20T20:05:44Z",
+      "agent": "leader",
+      "stage": "close",
+      "state": "running",
+      "message": "Validate F-095 gates and close remote image importer"
     }
   ]
 }