Features: BV Text node with management-gated writing assistance (translate,
improve, undo, prompt profiles); reuse of prepared MODEL/CLIP state for Krea 2
and Anima LLLite consumers; Regional refactoring.
Security boundaries: one wall-clock budget per Remote LLM request enforced by
a socket-closing watchdog across connect, TLS handshake, headers, chunk framing
and body; writing assistance uses the profile's configured timeout; a shared
bounded JSON reader with route-specific limits on every JSON route; endpoint
binding negative tests for the assist path.
Release and packaging: SECURITY.md; bundled-library notices and a readable
bundle header; Registry scan replica as a hard test with a pinned count; a
packaged-file-set test; publish only from a validated push to main with
provenance checks, pinned comfy-cli, an input manifest and a byte-exact
comparison of the stored archive; npm audit and a whole js/ rebuild gate in
Validate; design references, brand sources and a type declaration excluded
from the package. README and changelog for 1.4.4.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- Backend: plain imports and one download-host constant replace the three
literals the Registry's automated scan reported (environment lookup for the
autocomplete dataset, aiohttp session in the LUT downloader, catalog source
URLs built from the host constant, byte-identical). No behaviour changes.
- Frontend: own call sites no longer spell the scanner's socket literals
(queuePrompt captured once and invoked with call, Connector.wire, optional
connect); Prism is imported as core + JSON grammar, dropping the unused file
loader from the bundle. Remaining match: Function.prototype.bind inside the
vendored React production builds.
- BV Seed: action buttons take over the press via widget.onPointerDown and
fire on release inside the button, so normal clicks work again although the
ComfyUI frontend (1.49+) classifies any movement later than 32 ms after the
press as a drag.
- Tests: Registry scan replica with a checked-in baseline (report only),
queue-wrapper and negative routing tests, seed pointer sequence tests.
- Version 1.4.3, changelog and upgrade notes.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Raster masks are bounded per document as well as per mask (96 megapixels
and 128 MiB of embedded data), with a decoder spy test proving that the
header check runs before any pixel is decoded. The README and wiki now
state precisely what is migrated, that the response cache is deleted and
rebuilt, that old public files remain on a ComfyUI without the System
User API, and that the containment rule covers the listed consumers, not
arbitrary plugins. package-lock.json carries the 1.4.2 version.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Bump the version, add the 1.4.2 changelog and update notes, describe the
private storage, the local-only management gate and the download host in
the README. Exclude .github/ from Registry packages and remove the outdated
example workflows, regional fixtures, images and scripts from the runtime
repository; the workflows and documents that tests need now live under
tests/fixtures. The Remote LLM node shows when key management is unavailable
or local-only instead of failing on a 403.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Bump the version to 1.4.1 and add the changelog entry for the boundary
fixes. Move the internal docs/design notes to the private agents
workspace; only the theme catalog data used by the frontend tests stays.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- Text logs accept only .txt, .json and .log names; other endings are
rejected before any write.
- LoRA paths from workflows are approved by one shared rule: inside the
configured ComfyUI LoRA folders and .safetensors only, for loading and
for the Civitai metadata hashes alike. Metadata fails closed when the
folders are unknown.
- BV Remote LLM Provider no longer has an endpoint widget. The destination
is resolved by the backend from the provider catalog, the approved
API-key binding or the local settings file; the Configure dialog takes
the destination for custom bearer profiles and workflows saved before
this change drop the stale widget value on load.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Capture Nodes 2 and Classic DOM surfaces without selection artifacts, preserve preview images and live form state across serialization, and cover the renderer boundaries with focused regression tests.
- synchronize Python and private UI package metadata on version 1.2.2
- document the prepared, not-yet-released presentation, Regional Canvas, and LoRA changes
- remove the completed titlebar-port Canary experiment and its tests
Validated with npm ci, 455 Python tests, 634 Node tests, compileall, TypeScript typecheck, production build, bundle comparison, and secret scan.
- unify presentation lifecycle, port projection, and native node sizing
- add Regional Canvas image sources and the shared compact image picker
- align LoRA Registry outputs and 0.05 strength scrubbing
- retain the titlebar-port Canary as branch-only experiment evidence
Validated: 458 Python tests, 655 Node tests, TypeScript typecheck, compileall, production build, staged bundle match, and secret scan.
The titlebar-port Canary is throw-away experiment code and must be removed before merge or release.
