- Escape file names, paths and image metadata interpolated into
innerHTML in the local image loader and save image viewer (XSS via
crafted file names or a shared workflow's filename_prefix)
- Save image viewer: bind document drag listeners once and remove them
in disconnectedCallback instead of adding two per run; drop debug
logging and the window.kikoSaveImageTest helper
- Local image loader: check response.ok and surface 400/403 errors,
disconnect the ResizeObserver on node removal
- Gemini prompt: restore the user's node color after the run flash
- Workflow timer: chain onRemoved, merge properties in onConfigure
- Seed history: build entries with textContent
Vito Sansevero
37c00b633c