Improve FlashVSR gRPC server

[gtong-nv]

No description provided.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[gtong-nv]

/ok to test 3a9a185

[greptile-apps]

Greptile Summary

The PR restricts FlashVSR’s gRPC server and browser viewer to loopback by default and adds random bearer tokens to protect unary session operations.

• Extends the protobuf schema and generated bindings with session tokens.
• Propagates tokens through the bundled unary client and validates them in the server.
• Updates loopback/tunneling documentation and adds focused server tests.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking rollout-compatibility concern for previously generated unary clients.

Token propagation is correct for the bundled client, but clients that omit the new field are denied both processing and cleanup, leaving their allocated sessions resident.

Files Needing Attention: integrations/flashvsr/flashvsr/grpc/protos/flashvsr.proto, integrations/flashvsr/flashvsr/grpc/uplift_server.py

Important Files Changed

Filename	Overview
integrations/flashvsr/flashvsr/grpc/uplift_server.py	Adds loopback-only binding and token validation for unary sessions; validation lacks an old-client rollout or orphan-session reclamation path.
integrations/flashvsr/flashvsr/grpc/uplift_client.py	Correctly captures the returned token and includes it in every unary chunk and cleanup request.
integrations/flashvsr/flashvsr/grpc/protos/flashvsr.proto	Adds wire-compatible fields whose server-side enforcement nevertheless creates a behavioral compatibility break for previously generated unary clients.
integrations/flashvsr/tests/test_grpc_client.py	Covers loopback binding and unauthorized access but not behavior or cleanup when a pre-token client omits the new field.
integrations/flashvsr/README.md	Documents the new loopback defaults and an SSH tunnel for remote access.

Sequence Diagram

sequenceDiagram
  participant Client
  participant Server
  Client->>Server: start_session(config)
  Server-->>Client: session_id + session_token
  loop Each unary chunk
    Client->>Server: upscale_chunk(session_id, token, frames)
    Server->>Server: Validate token and update cache
    Server-->>Client: Upscaled frames
  end
  Client->>Server: end_session(session_id, token)
  Server->>Server: Validate token and release session
  Server-->>Client: success

Loading

_{Reviews (1): Last reviewed commit: "Merge branch 'main' into dev/gtong/fix-f..." | Re-trigger Greptile}

[greptile-apps]

Mandatory token breaks old clients

Previously generated unary clients omit session_token, so the updated server denies both chunk processing and cleanup; this leaves the successfully allocated session and its GPU cache resident until the server restarts.