feat(F-095): completed feature

work/artifacts/F-095/implementer.md

@@ -0,0 +1,14 @@
+# F-095 — Implementer evidence
+
+## Changes
+
+- Removed the erroneous empty `productsApi.update(productId, {})` call from URL image attachment.
+- The admin image editor now sends `{ url }` to `/api/upload`, then attaches the returned local `/uploads/...` URL to the product.
+- `/api/upload` now supports authenticated JSON URL imports: validates public HTTP(S) hosts, follows limited redirects, accepts only supported image MIME/signatures, enforces the 10MB limit, stores locally, mirrors peers, and generates thumbnails.
+- Existing multipart file upload behavior uses the shared local save helper.
+
+## Validation
+
+- Admin `npx tsc --noEmit` → exit 0
+- Admin ESLint on upload route and ImagesSection → 0 errors
+- Admin production build → exit 0

work/artifacts/F-095/leader-close.json

@@ -0,0 +1,15 @@
+{
+  "feature_id": "F-095",
+  "agent": "leader",
+  "verdict": "APPROVED",
+  "summary": "F-095 downloads validated remote images to local uploads before attaching them and removes the 400-causing empty PATCH.",
+  "evidence": [
+    "reviewer.json verdict=APPROVED",
+    "security.json verdict=APPROVED",
+    "qa.json verdict=APPROVED",
+    "Admin build exit 0",
+    "Root tests: 133 passed, 56 skipped",
+    "scripts/verify.sh exit 0"
+  ],
+  "timestamp": "2026-08-20T20:05:50Z"
+}

work/artifacts/F-095/qa.json

@@ -0,0 +1,14 @@
+{
+  "feature_id": "F-095",
+  "agent": "qa",
+  "verdict": "APPROVED",
+  "summary": "Remote image import changes pass admin build, root tests, typechecks, and harness verification.",
+  "evidence": [
+    "Admin npx tsc --noEmit exit 0",
+    "Admin npm run build exit 0",
+    "Root tests: 133 passed, 56 skipped",
+    "Admin ESLint upload route and ImagesSection exit 0",
+    "scripts/verify.sh exit 0"
+  ],
+  "timestamp": "2026-08-20T20:05:40Z"
+}

work/artifacts/F-095/reviewer.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-095",
+  "agent": "reviewer",
+  "verdict": "APPROVED",
+  "summary": "URL image import now downloads into the managed upload pipeline before product attachment and removes the 400-causing empty product PATCH.",
+  "evidence": [
+    "ImagesSection uploads URL JSON then attaches only the returned local path",
+    "Remote route validates MIME, signature, size, redirects, and public host",
+    "Existing multipart upload shares local persistence and thumbnail generation",
+    "Admin production build passes"
+  ],
+  "timestamp": "2026-08-20T20:05:00Z"
+}

work/artifacts/F-095/security.json

@@ -0,0 +1,14 @@
+{
+  "feature_id": "F-095",
+  "agent": "security",
+  "verdict": "APPROVED",
+  "summary": "Remote imports remain authenticated and constrained to public HTTP(S) image resources with redirect, size, MIME, and binary signature checks.",
+  "evidence": [
+    "Upload route requires authenticated backoffice session before remote fetch",
+    "localhost, local hostnames, private IPv4, and private IPv6 destinations are rejected",
+    "Only image MIME types supported by the existing upload pipeline are accepted",
+    "10MB limit, timeout, limited redirects, and image magic-byte validation are enforced",
+    "Remote URL is never stored directly as a product image"
+  ],
+  "timestamp": "2026-08-20T20:05:20Z"
+}