Refactor installation and runner scripts for enhanced usability and security

- Updated the installation script to clarify that production wrappers do not include fixed test secrets, improving user guidance for local testing.
- Modified the jiggablend-manager and jiggablend-runner scripts to remove fixed test configurations, emphasizing the use of local test credentials via `make init-test`.
- Enhanced error handling in the runner script to ensure that an API key is provided, improving security and user feedback.
- Added new flags and options for the runner, including sandboxing capabilities and GPU ray tracing control, enhancing flexibility for users.
- Improved README documentation to reflect changes in usage and configuration, ensuring users have clear instructions for setup and execution.

web/static/job_new.js

@@ -21,9 +21,19 @@
   const enableExecutionInput = document.getElementById("enable-execution");
 
   let sessionID = "";
+  let detectedBlenderVersion = "";
   let pollTimer = null;
   let uploadInProgress = false;
 
+  function escapeHtml(value) {
+    return String(value ?? "")
+      .replaceAll("&", "&")
+      .replaceAll("<", "&lt;")
+      .replaceAll(">", "&gt;")
+      .replaceAll('"', "&quot;")
+      .replaceAll("'", "&#39;");
+  }
+
   function showError(msg) {
     errorEl.textContent = msg || "";
     errorEl.classList.toggle("hidden", !msg);
@@ -31,7 +41,10 @@
 
   function showStatus(msg) {
     statusEl.classList.remove("hidden");
-    statusEl.innerHTML = `<p>${msg}</p>`;
+    statusEl.replaceChildren();
+    const p = document.createElement("p");
+    p.textContent = msg || "";
+    statusEl.appendChild(p);
   }
 
   function setUploadBusy(busy) {
@@ -68,8 +81,9 @@
       outputFormatInput.value = "EXR";
     }
 
-    if (metadata.blender_version && blendVersionEl.querySelector(`option[value="${metadata.blender_version}"]`)) {
-      blendVersionEl.value = metadata.blender_version;
+    detectedBlenderVersion = metadata.blender_version || "";
+    if (detectedBlenderVersion && blendVersionEl.querySelector(`option[value="${detectedBlenderVersion}"]`)) {
+      blendVersionEl.value = detectedBlenderVersion;
     } else {
       blendVersionEl.value = "";
     }
@@ -80,12 +94,12 @@
     const scenes = metadata.scene_info || {};
     metadataPreview.innerHTML = `
       <div class="metadata-grid">
-        <div><strong>Detected file:</strong> ${status.file_name || fileName || "-"}</div>
-        <div><strong>Frames:</strong> ${metadata.frame_start ?? "-"} - ${metadata.frame_end ?? "-"}</div>
-        <div><strong>Render engine:</strong> ${render.engine || "-"}</div>
-        <div><strong>Resolution:</strong> ${render.resolution_x || "-"} x ${render.resolution_y || "-"}</div>
-        <div><strong>Frame rate:</strong> ${render.frame_rate || "-"}</div>
-        <div><strong>Objects:</strong> ${scenes.object_count ?? "-"}</div>
+        <div><strong>Detected file:</strong> ${escapeHtml(status.file_name || fileName || "-")}</div>
+        <div><strong>Frames:</strong> ${escapeHtml(metadata.frame_start ?? "-")} - ${escapeHtml(metadata.frame_end ?? "-")}</div>
+        <div><strong>Render engine:</strong> ${escapeHtml(render.engine || "-")}</div>
+        <div><strong>Resolution:</strong> ${escapeHtml(render.resolution_x || "-")} x ${escapeHtml(render.resolution_y || "-")}</div>
+        <div><strong>Frame rate:</strong> ${escapeHtml(render.frame_rate || "-")}</div>
+        <div><strong>Objects:</strong> ${escapeHtml(scenes.object_count ?? "-")}</div>
       </div>
     `;
   }
@@ -180,6 +194,7 @@
 
   function resetToUploadStep(message) {
     sessionID = "";
+    detectedBlenderVersion = "";
     clearInterval(pollTimer);
     setUploadBusy(false);
     mainBlendWrapper.classList.add("hidden");
@@ -264,7 +279,7 @@
       unhide_objects: Boolean(fd.get("unhide_objects")),
       enable_execution: Boolean(fd.get("enable_execution")),
     };
-    const blenderVersion = fd.get("blender_version");
+    const blenderVersion = fd.get("blender_version") || detectedBlenderVersion;
     if (blenderVersion) payload.blender_version = blenderVersion;
 
     const job = await createJob(payload);

web/static/job_show.js

@@ -259,13 +259,20 @@
       return;
     }
 
+    const escapeHtml = (value) => String(value ?? "")
+      .replaceAll("&", "&")
+      .replaceAll("<", "&lt;")
+      .replaceAll(">", "&gt;")
+      .replaceAll('"', "&quot;")
+      .replaceAll("'", "&#39;");
     output.innerHTML = filtered.map((entry) => {
       const level = String(entry.log_level || "INFO").toUpperCase();
-      const step = entry.step_name ? ` <span class="log-step">(${entry.step_name})</span>` : "";
-      const message = String(entry.message || "").replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+      const stepName = entry.step_name ? escapeHtml(entry.step_name) : "";
+      const step = stepName ? ` <span class="log-step">(${stepName})</span>` : "";
+      const message = escapeHtml(entry.message || "");
       return `<div class="log-line">
-        <span class="log-time">${formatTime(entry.created_at)}</span>
-        <span class="log-level ${levelClass(level)}">${level}</span>${step}
+        <span class="log-time">${escapeHtml(formatTime(entry.created_at))}</span>
+        <span class="log-level ${levelClass(level)}">${escapeHtml(level)}</span>${step}
         <span class="log-message">${message}</span>
       </div>`;
     }).join("");

web/templates/job_new.html

@@ -52,7 +52,7 @@
     </label>
     <div class="check-row">
       <label><input type="checkbox" id="unhide-objects" name="unhide_objects"> Unhide objects/collections</label>
-      <label><input type="checkbox" id="enable-execution" name="enable_execution"> Enable auto-execution in Blender</label>
+      <label><input type="checkbox" id="enable-execution" name="enable_execution" title="Allows Python drivers/scripts embedded in the .blend (--enable-autoexec). Job-bundled blender_addons/ always install automatically when present."> Allow .blend Python autoexec</label>
     </div>
     <button type="submit" class="btn primary">Create Job</button>
   </form>