fix: the sidecar reproduces the run: right-half metadata, redux paths, dead restore keys

[fxd0h]

What

Three sidecar asymmetries from the #578 audit, all on the write side of --config-from-metadata:

• get_right_half() dropped negative_prompt, image_paths and the redux fields, so the sidecar of an in-context result (the right half is the deliverable) couldn't reproduce the run. It now passes every stored attribute through, and a test compares the clone's attributes against the original so the next added field can't silently drop.
• redux_image_paths was serialized with str(list), a Python repr the restore side can never parse. Now a list of strings, same as image_paths one line above.
• The --save-full-image path in the three in-context CLIs saved the full composite without export_json_metadata, so --metadata only ever produced a sidecar for the cropped half.

Also resolves the dead-restore-branch checkbox: controlnet_save_canny and image_outpaint_padding were restored from keys no released writer has ever emitted (checked back to v.0.4.0, where the fixture's version string comes from). Writing them instead lost on both counts: outpaint's flag isn't registered on any real command since the 2025 prep commit (only the completions generator and test fixtures build parsers with it), and canny would need a boolean threaded through four layers of variant code to reproduce a side artifact. Both branches are deleted, plus a stray print() debug line in the outpaint parse block. The canny tests pass unchanged (they never pinned a sidecar-true restore); the outpaint test now asserts the key is ignored.

Part of #578.

Checklist (definition of done)

• Tests added/updated run in CI by default
• ruff check and ruff format are clean
• CHANGELOG.md: entry under Unreleased referencing this PR number (follow-up commit, number wasn't known)
• Docs updated where behavior changed (none changed: all fixes make existing flags do what their help already says)
• New model: n/a
• New/changed CLI: no new options; mflux-capabilities output unaffected

Verification

Ran the full CI selector locally on an M5 (uv run pytest -m "not slow and not high_memory_requirement"): 1438 passed, 62 deselected. ruff check, ruff format --check and ty check clean. The new right-half test fails on main (4 attributes differ) and passes here; the redux test fails on main with "['redux1.png', 'redux2.png']" as a single string.

Summary by CodeRabbit

• Security

  • Resolved 35 reported security findings and strengthened protection against vulnerable components.

• Bug Fixes

  • Image crops now retain prompts, image paths, Redux settings, and other metadata.
  • Full-image and composite outputs consistently save metadata sidecar files when enabled.
  • Redux image paths are now exported as proper JSON lists.
  • Metadata restoration no longer applies unsupported outpaint padding or obsolete settings.
  • Removed unexpected debug output during outpainting.

Greptile Summary

The PR makes generated-image sidecars more consistent and reproducible.

• Preserves all stored metadata when creating the right-half deliverable.
• Serializes Redux image paths as JSON lists.
• Exports metadata for optional full composite images across all three in-context CLIs.
• Removes unsupported metadata restoration branches and an outpaint debug print.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/mflux/utils/generated_image.py	Preserves the newly covered metadata fields on right-half clones and emits Redux image paths as proper JSON arrays.
src/mflux/cli/parser/parsers.py	Removes intentionally unsupported canny and outpaint restoration paths and deletes stray debug output.
src/mflux/models/flux/cli/flux_generate_in_context_catvton.py	Exports an independently named metadata sidecar when saving the full CatVTON composite.
src/mflux/models/flux/cli/flux_generate_in_context_dev.py	Exports an independently named metadata sidecar when saving the full development-model composite.
src/mflux/models/flux/cli/flux_generate_in_context_edit.py	Exports an independently named metadata sidecar when saving the full edit-model composite.
tests/metadata/test_generated_image.py	Verifies complete metadata preservation across cropping and proper Redux path serialization.
tests/arg_parser/test_cli_argparser.py	Updates the outpaint metadata test to enforce intentional ignoring of the unsupported sidecar key.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[In-context generation] --> B[GeneratedImage composite]
    B --> C[get_right_half]
    C --> D[Right-half image]
    C --> E[Preserved metadata]
    D --> F[Right-half output]
    E --> G[Right-half sidecar]
    B -->|save-full-image| H[Full composite output]
    B --> I[Full composite sidecar]
    G --> J[config-from-metadata]
    I --> J

Loading

_{Reviews (3): Last reviewed commit: "Merge remote-tracking branch 'fork/sidec..." | Re-trigger Greptile}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 62251d99-73eb-4111-aaa6-c131799bbb03

📥 Commits

Reviewing files that changed from the base of the PR and between 3b8cf2d and a9f166a.

📒 Files selected for processing (1)

• CHANGELOG.md

🚧 Files skipped from review as they are similar to previous changes (1)

• CHANGELOG.md

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

Walkthrough

The update preserves metadata when cropping or saving generated images, serializes Redux image paths as JSON lists, removes obsolete metadata restoration and debug output, and adds regression tests and changelog coverage.

Changes

Metadata consistency

Layer / File(s)	Summary
GeneratedImage metadata preservation src/mflux/utils/generated_image.py, tests/metadata/test_generated_image.py, CHANGELOG.md	get_right_half() now preserves image paths, Redux fields, and prompts. Redux image paths serialize as JSON lists. Tests cover metadata preservation and absent paths.
Full-image metadata export src/mflux/models/flux/cli/flux_generate_in_context_catvton.py, src/mflux/models/flux/cli/flux_generate_in_context_dev.py, src/mflux/models/flux/cli/flux_generate_in_context_edit.py	Full-image saves now export JSON metadata when --metadata is enabled.
Parser metadata restoration cleanup src/mflux/cli/parser/parsers.py, tests/arg_parser/test_cli_argparser.py	The parser no longer restores controlnet_save_canny or image_outpaint_padding from metadata. It also no longer prints normalized outpaint padding. Tests verify the ignored padding field.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to a9f16

This PR fixes metadata preservation and serialization for in-context outputs and removes unused restore paths; no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• mflux-community/mflux#267: Both changes update GeneratedImage.get_right_half() and cropped-image metadata serialization.
• mflux-community/mflux#604: Both changes ensure the --metadata flag produces JSON sidecars.
• mflux-community/mflux#632: Both changes update metadata sidecar handling in the parser and generated-image utilities.

Suggested reviewers: anthonywu

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the sidecar metadata, Redux path, and obsolete restore-key fixes.
Description check	✅ Passed	The description follows the template, explains the changes, records checklist status, and documents local test and lint verification.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[anthonywu]

assigning @ianscrivener to review and merge

[fxd0h]

@anthonywu heads up, our conflict resolutions crossed: your merge came from a main snapshot at #652, so GitHub still flagged the branch as conflicting against current main (and its changelog resolution predated the #651/#655 entries). I kept your merge commit in the history and merged today's main on top, restoring the full [Unreleased] section (#655 security, #651, #652, plus this PR's entry). Suite at the resolved tip: 1441 passed with the CI selector. Mergeable again now.