- Ya
- 22 Julai 2026, 17:13 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 6b6151b
AiProvider.supportsVision is a hand-editable database flag, and routing trusted it alone. The HuggingFace and Cohere adapters never read imageUrls at all, and their own supportsVision() — which correctly returns false — was consulted NOWHERE: dead code. So an org that ticked "supports vision" on a HuggingFace provider got the image silently dropped, a bare prompt sent, and a confident answer the model INVENTED. The rate-sheet extractor then staged those invented numbers as candidates carrying document provenance and a plausible 0.55 confidence, indistinguishable from values actually read off the sheet. A fabricated mortgage price is far worse than no price. The adapter is now the ground truth about what can go on the wire: selectVisionCandidates filters on adapter.supportsVision(), which also makes /vision-capability honest since it resolves through the same path. An unknown provider type is treated as incapable rather than risking an invented answer. Defense in depth: both adapters now refuse a request carrying imageUrls instead of dropping it, so anything that bypasses routing fails loudly.