From 912e9dd0a6c55a8724932dcea225d856a11402f4 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Thu, 28 May 2026 17:52:04 -0400
Subject: [PATCH] fix: validate pixverse video response ids

---
 .../video-generation-provider.test.ts         | 24 +++++++++++++++++++
 .../pixverse/video-generation-provider.ts     |  6 ++---
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/extensions/pixverse/video-generation-provider.test.ts b/extensions/pixverse/video-generation-provider.test.ts
index 0873d4307a39..9300cd2c9ec7 100644
--- a/extensions/pixverse/video-generation-provider.test.ts
+++ b/extensions/pixverse/video-generation-provider.test.ts
@@ -224,6 +224,30 @@ describe("pixverse video generation provider", () => {
     });
   });
 
+  it("rejects fractional video ids before polling", async () => {
+    postJsonRequestMock.mockResolvedValue({
+      response: {
+        json: async () => ({
+          ErrCode: 0,
+          ErrMsg: "success",
+          Resp: { video_id: 123.5 },
+        }),
+      },
+      release: vi.fn(async () => {}),
+    });
+
+    const provider = buildPixVerseVideoGenerationProvider();
+    await expect(
+      provider.generateVideo({
+        provider: "pixverse",
+        model: "pixverse/v6",
+        prompt: "a quiet city street at sunrise",
+        cfg: {},
+      }),
+    ).rejects.toThrow("PixVerse video generation response missing video_id");
+    expect(fetchWithTimeoutMock).not.toHaveBeenCalled();
+  });
+
   it("uploads local image input before submitting image-to-video", async () => {
     postMultipartRequestMock.mockResolvedValue({
       response: {
diff --git a/extensions/pixverse/video-generation-provider.ts b/extensions/pixverse/video-generation-provider.ts
index 6c03a4dcf4b1..c4de3fecfd93 100644
--- a/extensions/pixverse/video-generation-provider.ts
+++ b/extensions/pixverse/video-generation-provider.ts
@@ -193,7 +193,7 @@ async function readPixVerseJson<T>(response: Pick<Response, "json">, label: stri
 }
 
 function readPixVerseVideoId(payload: PixVerseVideoCreateResponse): number {
-  const videoId = asFiniteNumber(payload.video_id);
+  const videoId = asSafeIntegerInRange(payload.video_id, { min: 0 });
   if (videoId == null) {
     throw new Error("PixVerse video generation response missing video_id");
   }
@@ -201,7 +201,7 @@ function readPixVerseVideoId(payload: PixVerseVideoCreateResponse): number {
 }
 
 function readPixVerseImageId(payload: PixVerseUploadImageResponse): number {
-  const imageId = asFiniteNumber(payload.img_id);
+  const imageId = asSafeIntegerInRange(payload.img_id, { min: 0 });
   if (imageId == null) {
     throw new Error("PixVerse image upload response missing img_id");
   }
@@ -209,7 +209,7 @@ function readPixVerseImageId(payload: PixVerseUploadImageResponse): number {
 }
 
 function readPixVerseStatus(payload: PixVerseVideoResultResponse): number {
-  const status = asFiniteNumber(payload.status);
+  const status = asSafeIntegerInRange(payload.status, { min: 0 });
   if (status == null) {
     throw new Error("PixVerse video status response missing status");
   }