Features: BV Text node with management-gated writing assistance (translate,
improve, undo, prompt profiles); reuse of prepared MODEL/CLIP state for Krea 2
and Anima LLLite consumers; Regional refactoring.
Security boundaries: one wall-clock budget per Remote LLM request enforced by
a socket-closing watchdog across connect, TLS handshake, headers, chunk framing
and body; writing assistance uses the profile's configured timeout; a shared
bounded JSON reader with route-specific limits on every JSON route; endpoint
binding negative tests for the assist path.
Release and packaging: SECURITY.md; bundled-library notices and a readable
bundle header; Registry scan replica as a hard test with a pinned count; a
packaged-file-set test; publish only from a validated push to main with
provenance checks, pinned comfy-cli, an input manifest and a byte-exact
comparison of the stored archive; npm audit and a whole js/ rebuild gate in
Validate; design references, brand sources and a type declaration excluded
from the package. README and changelog for 1.4.4.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- Backend: plain imports and one download-host constant replace the three
literals the Registry's automated scan reported (environment lookup for the
autocomplete dataset, aiohttp session in the LUT downloader, catalog source
URLs built from the host constant, byte-identical). No behaviour changes.
- Frontend: own call sites no longer spell the scanner's socket literals
(queuePrompt captured once and invoked with call, Connector.wire, optional
connect); Prism is imported as core + JSON grammar, dropping the unused file
loader from the bundle. Remaining match: Function.prototype.bind inside the
vendored React production builds.
- BV Seed: action buttons take over the press via widget.onPointerDown and
fire on release inside the button, so normal clicks work again although the
ComfyUI frontend (1.49+) classifies any movement later than 32 ms after the
press as a drag.
- Tests: Registry scan replica with a checked-in baseline (report only),
queue-wrapper and negative routing tests, seed pointer sequence tests.
- Version 1.4.3, changelog and upgrade notes.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The LUT install directory is checked before it is created, so a linked
parent never causes a directory outside models/; installs check for an
existing file before downloading, run at most two in parallel with one per
entry, and parse off the event loop. Autocomplete searches each selected
dataset once and truncates terms. Raster masks are validated against a
32 megapixel budget before decoding, and text logs validate the name
before creating the log directory.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
