17 Commits

Include renames

Author	SHA1	Message	Date
Vito	6505d339aa	feat(system): thumbnails on Activity (#311) ... * feat(system): run thumbnail generation as an Activity job GET /prompt_manager/images/thumbnails/plan counts what a run would do (targets, fresh, remaining past the cap, source labels) and writes nothing. POST /prompt_manager/jobs/thumbnails {mode, size, quality} starts the "thumbnails" job: admission guarded, cancellable at a file boundary, outcome groups generated / skipped / errors. size is the longest edge (128-2048), quality the encoder, and rebuild writes fresh previews again through the same atomic rename, so a failed file keeps its old preview and originals are only read. The legacy gallery stream now starts or attaches to the same job and streams its unchanged frames. A client that goes away no longer stops the work; the gallery's Cancel asks the server to cancel the job. * feat(activity): per-kind job descriptors One descriptor table (activity-kinds.mjs) decides each job kind's pill verb, toasts, line, tiles, outcomes, openable rows and labels; the store re-exports it. The scan and image tagging views are unchanged. A thumbnail job counts Generated, Skipped and Errors, reads "Generating thumbnails" in the pill and "Thumbnails finished · N generated · M errors" when it ends. Any other kind (the health check, a held legacy-page operation) gets the generic descriptor with no tiles and no Results, instead of the scan's zero tiles. A running job without a known total shows an indeterminate progress bar and no percentage, and only a job the server can cancel shows Cancel. * feat(system): review and start thumbnail jobs Sources' Thumbnail generation -> Review options and Overview's Review thumbnails open the concept's Thumbnail maintenance dialog: scope, quality (preselected from Image loading quality) and preview size limit, a plan line from the read-only thumbnail plan (D99) and Start, which starts the thumbnails Activity job and opens it. A size outside 128-2048 requests nothing; a refused start shows the busy link toast. * fix(system): thumbnail job review fixes (#249 S5) - The legacy stream's first frame is job {id, started}, sent after the subscription so no runner frame is missed; it reads the registry after prepare, so a job started in that gap is attached to, not refused. - Every exit sets a truthful final status line; nothing to do never reads "Processing file 0 of 0". - Cancel is checked per file during the planning walk; a job cancelled there publishes no start frame. - The ffmpeg fallback keeps the chosen quality (-q:v) and the aspect ratio; the placeholder uses the chosen JPEG settings. - A locked preview on Windows reads "Preview in use by another program; the old one was kept", not the raw WinError. - Thumbnail work no longer defers the monitor's Needs review recording: it writes previews only, never records. - The disconnect test now proves the job outlives its stream (one worker, 9 files, three batches); the attach test waits on an event. * fix(gallery): cancel the stream's own thumbnail job by id The settings panel and the startup dialog cancel the job named by the stream's job frame, and only one their stream started. A Cancel before the frame waits for it, a double Cancel posts once, and a job another tab or System started keeps running. The startup dialog now settles on Cancel instead of staying on "Cancelling...". * fix(activity): indeterminate pill bar and the nothing-to-do line The pill's mini bar sweeps while a job's total is unknown instead of showing an empty fill. A finished thumbnail job with nothing to do shows the server's final line. Coverage floors raised for gallery.js and activity.mjs.	2026-10-23 16:58:06 -07:00
Vito	b4c7a15045	feat(review): Needs review page, live queue and concept comparison (#288) ... * feat(review): add review queue schema with restore validation Add the Needs review schema group (media_review_metadata, media_review_items, media_review_decisions) beside the image annotation group it cites. review_schema_error validates the catalog, columns, foreign keys, row values and canonical 8 MiB evidence read-only; migrate_review_state installs it in a SAVEPOINT after the annotation group, and verify_database_file requires it under require_library_state. A review group without a valid annotation group is refused. Decisions null their pair and image navigation through indexes when those are deleted. Old backups and annotation-era backups restore and gain the group; browser fixtures clear the new tables on reset. * feat(review): persist ambiguous sampler evidence from scans and new outputs The output scan and the live monitor now queue every file the ingestion resolver finds ambiguous for Needs review. The file is captured, its metadata is read again from the capture and resolved with the default profile, and only an ambiguous result is stored, bound to the capture's annotation byte record and fenced by its storage epoch. Evidence holds one hashed projection per selectable candidate; none, more than 16 or over 8 MiB is a limited item. Recording is idempotent per bytes and evidence and never touches a decision. Scan statuses, counters, outcome rows and legacy SSE events are unchanged; the job scope gains review_items/review_errors and the log a Needs review line. The monitor records after its fallback link, best effort. * feat(review): explicit association decisions with compatible linking Needs review gains its queue reads and decisions: - GET /prompt_manager/review/items lists pending items oldest first with the exact pending total and an HMAC keyset cursor bound to the storage epoch and the review index revision. - GET /prompt_manager/review/items/{id} adds the candidates (role texts, label, selectability), the dependency fingerprint and the digest. - POST /prompt_manager/review/items/{id}/decision applies a candidate only for a capture of the item's bytes that the current file still hashes to and whose evidence is unchanged, through the ingester's compatible-only rules in the same transaction as the decision row; a conflict writes nothing. Leave unresolved records the decision and links nothing. ingest_resolved_pair keeps its contract; its body moves into _ingest_resolved_pair_in, which runs in the caller's transaction. Items keep the file's recorded spelling so targets keep their case on Windows, and a rescan skips the copy and hash of a file whose size and mtime match the bytes an item already cites. * fix(review): build the spelling validation test from native paths On Windows the locator is case-folded and uses backslashes, so the fixed POSIX pair /out/a.png no longer folded to itself and the new spelling check refused the good case. The test now spells a mixed-case native path and folds it with os.path.normcase, and also refuses a locator of another file. * fix(review): Apply sees the file under every spelling and rechecks only its choice Apply now finds the legacy rows of the same physical file however its root is reached. The roots are real paths while the monitor links under the directory it watches, so a symlinked or junctioned root, subst or a mapped drive used to hide the monitor's row and Apply added a second, differently linked row. Same-name rows are resolved to their physical identity (normcase(realpath), else samefile); the dependency fingerprint covers all of them, two rows refuse the choice, one row is enriched under the ingester's compatible-only rules, and a same-name row the request did not classify is a changed association. Apply re-verifies only what the decision depends on: the bytes are still ambiguous and still offer the chosen candidate. A resolver change that rewords the reason or reorders candidates leaves pending items applicable. The resolver version is one constant in prompt_pair_resolver, shared by ingestion provenance and Needs review. The transaction's byte check receives the re-hashed digest (or the body's for Leave unresolved), every Apply refusal branch is tested with zero writes, and the root listing and realpath calls run on a worker thread. * fix(review): validate stored review evidence once per startup Startup used to run the full review validation twice (the early guard and the install) and the annotation group's row checks inside each, so every evidence document was parsed and re-encoded twice. The early guard is now catalog-only (a review group without annotation tables), and the install validates the group once, trusting the annotation group it has just validated. The evidence predicate no longer pattern-scans every document in SQL, because the streamed canonical pass proves it, and the codec is built once. Measured on a database with 40,000 items of 4 KiB evidence: startup open went from 7.7 s to 2.5 s. A test pins one evidence pass per reopen. Restore and verify_database_file keep the full validation. * fix(review): keep one capture worker for interactive requests Needs review recording from the scan and the monitor shared the capture store's two workers with the Tag dialog and Apply, so a busy scan could answer a user's preview or decision with "Too many previews are open". Background captures now never take the last worker or capture slot, and wait up to two seconds for room before counting the file as not added. Interactive captures are admitted or refused at once, as before. * fix(review): refresh the recorded spelling when a file is seen under a new one A case-only rename on Windows or macOS keeps size and mtime_ns, so the rescan skipped the file and the item kept the old spelling. Its target was then formatted from a name the directory no longer lists, the capture refused it, and the item stayed pending with no way to apply it. The skip path and a duplicate insert now record the current spelling for every item at the locator and move the review index revision; item revisions do not change, so an open decision stays valid. Tested under case-folding semantics on every platform. * fix(review): final capture store close and recoverable stale cursors Closing the capture store at shutdown now runs under the store lock and is final: a monitor recording or scan batch still in flight gets a capture error instead of creating a new temp directory and restore subscription after the cleanup. A well-formed queue cursor this process cannot verify (opened before a ComfyUI restart, whose cursor secret is per process) now answers 409 review-conflict with the current total, like any other stale page, instead of an uncoded 400. Malformed cursors stay 400. * fix(review): make only the shutdown cleanup final The previous commit made every close of the capture store final, which also refused the explicit closes that swap in a fresh store. Only the host's on_cleanup hook is final now; an observe after it answers a coded capture error instead of an unhandled 500. * refactor(admin): move Needs review recording into its own mixin _record_scanned_review, _record_review_sync, record_review_file and _log_review_items move unchanged from py/api/admin.py to py/api/review_recording.py (ReviewRecordingMixin), keeping admin.py from growing further past the size ceiling. No behaviour change. * fix(review): record the review fix round and the skip's residual risks in TESTING.md The Needs review paragraphs now state the rescan skip's residual risks (an in-place rewrite that keeps size and mtime_ns is never re-queued; a deleted or moved file leaves its pending item counted), the physical identity rule for Apply, the candidate-only recheck and shared resolver version, the spelling refresh, background capture admission, the final shutdown close, the stale-cursor answer and the measured startup validation cost. * feat(review): bind queue cursors to the storage epoch only A decision or a new item (the monitor records one per generation) no longer makes an open cursor stale: the (created_at, id) keyset stays ordered when items leave or are appended. A restore still answers storage-changed and an unverifiable cursor review-conflict. * feat(review): Needs review page, SAVED VIEWS row and Activity hook The concept's Metadata review page at #/review: the notice with the exact pending count, the queue's media cards (shared with Images through image-card.mjs), and the Resolve the association panel with the sampler context, the chosen path's prompt blocks, Leave for later and Apply association. Apply takes a fresh capture; refusals keep the selection and explain inline; an unanswered decision is resent once. SAVED VIEWS lists Needs review after Favorites with its count (retires D50), and an ended scan that recorded review items offers Review metadata in Activity (D87). Queue items carry the card's media url. * feat(review): re-read an open Needs review page when its queue changes An open Needs review page now follows the queue without polling. A new server-sent event stream, GET /prompt_manager/review/events, sends "ready" when it opens and "change" after every committed queue change: an item the scan or the monitor recorded, a spelling refresh, a decision from any tab, and a restore. database/review_changes.py notifies after the commit from whichever thread wrote it. The page re-reads its first page on each event, keeps the open item, its choice and an unanswered decision, and re-reads the SAVED VIEWS count with it. When the open item left the queue, the next one opens with a note. A keepalive comment every 25 s lets the server drop a closed tab; shutdown ends every stream. Leaving the page mid-decision now releases that decision's capture. D-NEW-F1 is renumbered D119 in markers and TESTING.md. * test(review): Needs review page workflows The review fixture now seeds a real monitor-fallback conflict (the monitor pipeline links a new output to the most recent prompt, then queues it), a limited item and a file under no current root, and can add an output through the monitor or leave one for a metadata scan. New workflows: Apply links the chosen pair to that file only; a real association conflict leaves the links unchanged and explains; a limited item and an unavailable file can only be left unresolved; a tag save leaves the item pending; keyboard focus, labels and touch targets; an open page shows items the monitor and a scan add and a decision made in another tab; leaving the page releases captures, the change stream and requests. The faked 409 conflict test is replaced by the real one. * test(review): cover the card Tag button and raise the review floors The card's Tag on Needs review now has a workflow, and the page's queue change hook has no unused default. review.mjs and review-state.mjs floors rise to their measured coverage; no other floor changes. * feat(review): keep the loaded depth on live re-reads and read once per visit A queue change re-read only the first 40 items, so the pages Load more had shown vanished and the page jumped. Each re-read now reads page after page until it holds as many items as were shown (a restore met after the first page reads again from the start), so the cards and the scroll position stay. The stream's ready made every visit read the queue twice. List reads now answer the queue's version (library_epoch, review_revision) and ready names the version read after subscribing; the page re-reads on ready only when the queue it shows is older. The SAVED VIEWS count follows the page's total, so a change costs no count read. A stream counts as open only once ready is sent. * test(review): compare Needs review with the approved concept review-concept.spec.mjs measures the whole Metadata review page as a tree in the concept and in production, on the review fixture's new concept-shaped queue (the concept's first three image names and sizes and its first prompt). mapConceptReview applies only D29, D119, D3, production's hooks and accessible names and sample data, and the page then matches at 1600x1100 and 390x844 in both themes. The gallery layout follows the concept at every breakpoint, the SAVED VIEWS rows match with Needs review after Favorites, the queue's Tag image dialog matches the needs-review reference, and a dropped notice border or reordered actions fail. The comparison found one gap: an unavailable file's card lost its media area. Its empty media button now keeps the concept's 1.33 ratio (D119). TESTING.md records the comparison, the extended D119 and a summary of the image-tagging slice (routes, S1, capture limits, the record-changing job, the no-download rule, the restart note). A ready whose version cannot be read re-reads the queue (covered by a page test). * test(review): give the multi-route shell comparison a fitting time budget The dispatched CI run failed "shell geometry, tokens and controls match the concept 390x844 light" on WebKit with a 30 s test timeout (no assertion failed). Each of these tests makes twelve page loads with captures, hovers and focus checks: 15-19 s on a CI WebKit runner on main, 22-31 s on this run's loaded shard. With 2 CPUs and 3 workers it fails locally the same way (6 of 12 timed out); with a 90 s budget, as the other multi-state concept comparisons have, all 12 pass. * fix(review): coalesce queue change events and answer queue thumbnails - The change stream sends the first notice at once and collapses the notices of the next 0.4 s into one trailing change, so a busy scan costs an open page one re-read per 0.4 s at most (COALESCE_SECONDS). - Queue items answer thumbnail_url, the same URL the Images listing builds (one shared helper, media_thumbnail_url), or null without a thumbnail. - The "duplicate and refused decision send nothing" test spies on notify_review_change instead of reading the next event. * fix(review): keep the live queue right through applies, Load more and lost streams - A change heard while a decision is in flight is owed and read once the decision is refused or unanswered (I1). - Load more has its own read: during a re-read it waits and continues from the re-read queue; a re-read started during Load more takes the click over, and a failed re-read leaves Load more clickable (I2, M7). - A stream the browser gave up on (503, proxy error) reopens after 3 s, doubling to 30 s, with a quiet "Live updates are paused" line while it is down (I3, D-NEW-F2). - A hidden tab closes its stream and a visible one reopens it; the ready version keeps that to at most one read (I4). - Apply fences on the detail's epoch and a re-read under another epoch reads the open item again (M3); leaving during the observe releases its capture (M4); an unanswered decision that landed finishes as recorded (M5); cards follow a re-read's url, target and availability and show thumbnails (M6, M10). - The unreadable-ready test asserts exactly one re-read (M1); the panel's long-file-name wrap carries its D119 marker and TESTING.md entry (M8). * docs(review): number the live-updates-paused deviation D120 * fix(review): refuse monitor recording beside record-changing jobs System S1 (#289) gives every record change a registry admission class. The scan already records Needs review items under its own records job. The monitor's recording lasts one file and is not a job, so it now checks the records admission: while a records or guarded job or hold runs it records nothing, logs that the file waits for the next scan, and answers deferred. The fallback link stands and the next "new" scan reads the ambiguous file again, because a fallback link is not a resolved one. JobRegistry.blocker and active iterate a snapshot of the jobs, since the monitor's worker thread now asks them too. * test(backup): wait for the restore, not a 5 s timer, in the thread test test_database_is_usable_from_every_thread_after_restore let its worker wait 5 s for the restore. On a stalled Windows runner (py3.11, where the previous restore test also took 25 s instead of 0.3 s) the restore took longer, the wait timed out, and the worker read the old database before the restore ran. The worker now waits for the event under a 120 s bound that only a hung test reaches, reports a timeout as an error, and the main thread releases it even when the restore raises. With a restore delayed by 6 s the old test fails and the new one passes. * fix(activity): drop Cancel job from a job that had ended before Activity opened Since #289 the Activity list removed an item's actions only when they were isConnected. On the first render the item is not in the page yet, so a job that had already ended when Activity opened kept its "Cancel job" (and a running job's progress was moved after its actions, then back). The list now asks parentNode instead. The review spec "a scan job with review items offers Review metadata in Activity" failed on this before the change (Expected 0 buttons on a finished job, Received 1) and passes after it. * fix(review): store non-finite evidence as null and count pending items canonical_evidence now follows main's non-finite policy (#303): NaN and ±Infinity are written as null instead of raising, so a NaN-stamped graph never turns a review item limited. The System Overview reports the review queue's pending total in needs_review.pending, read in the same snapshot as the Library counts. * fix(review): show the pending count on the System Overview review row The Overview's review row now reads "N ambiguous image links" with the concept's line, from needs_review.pending. Its Review metadata action stays aria-disabled until the Needs review page ships. The system specs and their concept comparison follow the real count. * feat(review): open Needs review from the System Overview review row Review metadata on the Overview's review row now opens #/review, the concept's go-review, instead of staying aria-disabled. * fix(system): answer the Overview and Statistics only after every read ended asyncio.gather answered at the first failed read while its sibling executor reads were still inside SQLite. In the suite the test teardown then deleted the database under the running read, and py3.10 on Ubuntu segfaulted in get_statistics (test_statistics_failure_is_an_error_envelope). Both routes now wait for all their reads before answering. * fix(review): queue only ambiguous files that nothing links, and heal the queue The maintainer's live scan (19,908 files, scope "new") reported 4,677 files under Needs review, but the queue held 10,232 items: every file the strict resolver found ambiguous was queued, including the ones the legacy browser-parser fallback then linked (all sampled "added" rows) and the ones already linked to a known prompt (135 of 200 sampled "known" rows). A file is now queued only when its final outcome is ambiguous and unlinked: the resolver finds it ambiguous, the fallback links nothing and no saved row links it already. An ambiguous file that a saved row links is reported as unchanged ("Already linked to its prompt"), not as Needs review. The queue heals itself. After each batch, the scan removes the pending items of every listed file (read, or skipped as known) that a saved row now links. The monitor does the same for each ambiguous output it links, and never queues one. Only an undecided item is removed (pending, revision 0, no decision row), so a decision is never deleted or changed and the schema needs no new state. The scan job's scope.review_items now counts this scan's files that are in the pending queue after it, new or already there, so it agrees with the review group's ambiguous rows and with the queue total. review_added and review_settled are new, and the log gains "already in Needs review" and "left Needs review · now linked" lines. A duplicate whose item is decided is reported as "decided" and is not counted. * fix(review): announce items that leave the queue, and seed only queueable files #284 now queues a file only when its final outcome is ambiguous and unlinked, and it removes the pending items of files that are now linked. That removal is a queue change, so it calls notify_review_change after its commit, like recording and decisions: an open Needs review page re-reads its queue, and its count follows. The review browser fixture wrote graphs that the scan's fallback links, and it produced the conflict item through the monitor's fallback link. Neither is queued any more. Its files now carry ComfyUI's Infinity stamp, which the legacy parser cannot read, so they stay unlinked with the same two candidates. The conflict item is queued first and its file is linked to another prompt afterwards. "monitor" additions go through record_review_file from a worker thread. * fix(review): never queue an ambiguous file with nothing to choose The maintainer's live queue held 39 items whose candidates all read "unresolved" ("No positive / No negative"). An ambiguous result is now reviewable only when at least two candidates are resolved with non-blank positive text. With none the file could not be traced; with exactly one, the untraced branches may still have made the file, so that text is not certain either. Both are reported unresolved, never linked and never queued (also the A1111 two-delimiter case, which has no candidates). A rescan removes the pending items of such files whose own evidence offers no choice, with the same safe delete as the linked settle (pending, revision 0, no decision row). A limited item (over 16 candidates) that holds at least two candidates is kept. The job scope gains review_untraced and the log "= N images left Needs review · nothing to choose". * test(review): seed the limited item from a graph with more candidates than stored An A1111 block with two negative lines offers no candidate to choose, so Needs review no longer queues it (#284). The fixture now records a graph of 17 samplers, which the recorder stores limited.	2026-10-23 15:02:18 -07:00
Vito	69de20a427	feat(system): Sources & scans (#309) ... * feat(system): report configured, effective and watched sources GET /prompt_manager/settings adds settings.monitoring_enabled, a sources block (configured roots with valid/code/reason, effective roots with their listing index and watch state, auto_detected) and the monitor state (present, observer_alive, scheduled). Every path is a public path. A source is "watching" only while a live observer scheduled it, "manual" when monitoring is off or the process has no monitor, and otherwise "restart_pending". POST accepts monitoring_enabled as a strict bool, saved under gallery.monitoring.enabled; restart_required_fields names it when the running observer does not already match. A save that changes the sources runs as a "Source change" records hold, so it is refused with 409 busy while a scan runs. Case variants of one folder are saved once. POST /prompt_manager/settings/validate-source {path} checks a path lexically (no "..", no control characters, native path forms only) and then against the gallery-root rules, answering a code and reason, and writes nothing. * fix(system): no existence oracle in source validation A gallery root's containment in the allowed ComfyUI folders is now decided before its existence and type, so a path outside them answers "outside-allowed" whether or not it exists. validate-source also folds the filesystem-root and home-directory codes into "outside-allowed", with one reason, and logs the detail server-side only. Paths inside the allowed folders still say "not-found" or "not-directory". The legacy settings save shares the same check. * feat(scan): scan one selected source POST /prompt_manager/jobs/scan accepts roots: indexes into the effective sources, strict non-negative ints (no bools or floats), deduplicated, at most 64, non-empty when present. An index past the sources is a 400 "unknown-source" and starts nothing. The job walks only the selected sources, resolved when it was requested, and keeps each file's listing root_index. Its scope records files, roots (null for every source) and output_folders, the number of folders walked, which the log's first line counts. The legacy /scan route still scans every source, and attaching to a scoped job keeps its payload keys. * feat(system): manage sources and start scans natively System > Sources & scans renders the concept's section on the server's sources: one row per effective source with its watch state and a scan scoped to that source, the 3.2.0 update notice with the legacy dismissal, Add source checked by validate-source, Remove, monitoring and worker threads as host drafts behind the one Save row, and Refresh files. A save refused by a running scan names the job. Thumbnail generation hands off to the legacy gallery until S5. Deviations D98, D113 and D-NEW-S4-1 are recorded in TESTING.md. * fix(security): decide source containment as text before any filesystem access Every caller (validate-source, POST /settings, config.json at load) now refuses a source through one check, sources.source_problem: the form check first, then GalleryConfig.gallery_root_problem, which compares the normalised spelling with the allowed folders before anything resolves, stats or opens the path. A UNC share, the \\?\ and \\.\ namespaces, a device or any outside folder is refused with no SMB request, no executor stall and no existence or timing oracle; only then is the path resolved and contained again, which still catches a symlink out. The filesystem root and the home directory answer outside-allowed with the same reason as any outside path, so no caller learns the home path. Also: - POST /settings runs the form checks and parses the roots off the loop; an unusable source is a coded 400 invalid-source naming its public path (as text) and its index. - ComfyUI folders outside the base directory are path anchors, so their sources round-trip and never collide by folder name. - A per-source scan sends each index with its public path; a stale or shifted index is 409 sources-changed and starts nothing. - A source still watched after monitoring was switched off is "stopping". - Roots are compared as folders, not spellings, so an unchanged legacy resend takes no source-change hold. - Tests: no realpath/stat/lstat of an outside path (native and Windows forms with ntpath fakes), the alike answers with /, ~ and a link to ~, an event instead of a timer wait, and a teardown that drains jobs before the temporary database goes. * fix(system): say what Sources saved, refused and still watches - A per-source scan sends the source's public path; when the sources changed since they were read the toast says the server's reason and the list and saved values are read again. - "watching until restart" for a source the running monitor still watches after monitoring was saved off, and the status adds "Restart ComfyUI to apply: Watch for new outputs." from restart_required_fields. - A save refused for one unusable source marks that row and the status is the server's message naming it. - A valid configured source the effective list holds under another spelling reads "same folder as another source". - The busy toast names the job the 409 named (ApiError keeps a validated running job and refused source), falling back to the list. - The Add source dialog's listeners live on the page scope and Enter adds; its markup is compared with the concept (D127). - TESTING.md: D-NEW-S4-1 is D127; D-NEW-S4-2 records the new copy; the Sources contract describes the lexical containment, invalid-source and sources-changed. * fix(security): guard the Windows form probes on a token of their own The no-filesystem guard matched "C:", which on a Windows runner is also the temporary ComfyUI tree the save may resolve for its trusted first entry. The probe paths now carry a token no trusted directory holds. * docs(system): number the Sources states deviation D128	2026-10-23 13:15:06 -07:00
Vito	785b744554	feat(system): Appearance section and browser display defaults (#307) ... * feat(system): share browser display defaults The workspace reads and writes the legacy gallery's gallerySettings object through preferences.mjs: workspaceLayout and workspaceDensity join the shared keys, a write re-reads the stored object and writes only the changed keys, denied storage or a full quota keeps the change for this tab and says so, and storage events report changes from other pages. The legacy gallery Save keeps keys it does not edit, and the viewer reads its video defaults through the shared module. * feat(system): Appearance defaults used by Images and the viewer System > Appearance is the concept's Browsing & display surface on real values: the browser rows edit this browser's display defaults through the shared gallerySettings object, and Open from ComfyUI and the node search auto-hide save to the server settings with their revision. A new Images visit starts from the default layout and size (the current view and saved views keep theirs); metadata off waits for Load metadata; cache off re-reads the shown file; paths off hides the Path row; the viewer reads the video defaults. D97 adds card details, collapsed viewer details and Reset display defaults; storage refused says Saved for this tab only. * fix(system): flag changes made while System was closed and keep embedded galleries fixed Final review fixes for System S3 (Appearance): - I1: the on-demand metadata deviation is D124 (TESTING.md, inspector markers); TESTING.md names the spec that pins it, since no concept comparison renders that state. - I2: System checks the display defaults for conflicts on mount, not only on storage events, and a browser write refuses a draft another page overtook, so a draft is never saved over another tab's value without the conflict status first. New two-tab spec. - I3: the layout and size defaults start the Images page only; embedded galleries (a prompt history's Shared gallery and dialogs) keep Grid/Comfortable. - M1: host rows whose /settings read failed say "Server settings could not be read." - M2: a rejected timeout shows the "Some changes were not saved" status. - M3: the browser loads on mount and on storage events never reject unhandled. - M4: the next accepted write stores the tab-only changes and clears the overlay. - M5: cache off never re-reads a source-changed selection, and refresh() never loads a deferred one. - M6: the System fixture refuses a config.json outside its temp root and restores it with os.replace. - M7: the inspection read counts wait on a request barrier, not frames. - M8 recorded as an open saved-views question in TESTING.md. * fix(system): answer a failed System read only after its other reads finish CI (py3.10 on ubuntu) crashed with a segfault inside SQLite in test_statistics_failure_is_an_error_envelope: the statistics and overview routes used asyncio.gather without return_exceptions, so the 500 answered on the first failure while get_statistics still ran in the executor, and the test tore the database down under it. Both routes now await every read before raising the first failure (failing before, passing after: TestFailedReadsSettleFirst). The frontend coverage merge failed on workspace/activity.mjs branches (86.3 < 87): no test asserted Activity's empty and failed-read states, so their branch was only reached in passing, depending on timing. A spec now asserts both.	2026-10-23 07:49:39 -07:00
Vito	c86739178d	feat(system): System page shell, review dialog and Overview (#298) ... * feat(system): read-only health check and truthful overview counts POST /prompt_manager/system/health runs the health check off-loop as a read registry job of kind "health" (one at a time, beside a scan, not cancellable, no file outcomes) and keeps the last report; GET returns it or null. The check reads one snapshot on its own mode=ro connection, closed in finally: integrity_check(100), foreign_key_check, stored hashes against utils.hashing, duplicate pair rows, the legacy consistency queries (now shared with check_consistency), and image links whose file is gone, counted only under readable sources. An unavailable source, or the absent Needs-review queue, makes its check unavailable and the report incomplete instead of producing a count. GET /prompt_manager/system/overview returns Library-eligible positive prompts and active negative variants, indexed images, the last health summary or null, backup null, the Needs-review count null, the effective sources with whether they were auto-detected, and the thumbnail plan's missing count. GET /prompt_manager/system/statistics lists runs and average rating per category of Library parents, with the /stats totals. * feat(system): native System route, drafts and shared review dialog - #/system/<section> renders the concept's System shell: section nav, settings layout and Save row with truthful status (D92); each section not delivered yet hands off to its legacy tools (D94). Overview's System card opens #/system/overview (Q12). - A module-level draft store saves browser, then host (expected_revision), then runtime; failed domains stay dirty, a stale revision is a conflict. - System row builders (setting, operation, section nav) on the scope. - openReviewDialog and backupNotice extracted from the scan review, which is now a thin caller with identical markup. - Overview images gain a "rated" count (images whose linked prompt is rated); the missing-files health check reports per source, so partial availability is visible. * feat(system): native Overview with health report and statistics System > Overview renders the concept's metrics and its Library health and Workspace preferences surfaces from GET /system/overview: real counts, "Not checked" until a health check ran, no invented review count, backup or thumbnail status (D93). Explore opens "Usage statistics" with the real runs and ratings per category and the Library totals (D96); the statistics route now also returns rated_images. Maintenance shows the concept's notice with Run health checks above its hand-off: the read-only check runs as a registry read job and opens the "Health report" with a chip per real result, missing files per source (D95). A load failure shows Retry and no zeros; late answers never repaint a newer section. Adds the System concept comparison (shell, Overview, both dialogs, the notice, mutation checks), the System workflow spec and its fixture hooks, and the TESTING.md "Native System" section. * test(system): coverage floors for the native Overview Adds the system-overview.mjs baseline and raises the system.mjs floors to their measured coverage; no other floor changes. * fix(system): keep health reports per database and off the event loop - A restore that replaces the database forgets the stored health report, and a check that started before the swap is not kept (database generation stamped at start). - The Overview no longer walks every source for the missing-thumbnail count; the page reads /images/thumbnails/status on its own. - Image sources for the health check and the Overview resolve in the executor; a failure to start the check answers the coded envelope. - Any exception fails only its own check; missing files reads its rows in the snapshot and stats the files after it ended. - The read-only URI keeps Windows UNC paths (empty authority). - An integrity count at SQLite's limit is flagged as capped. * fix(system): thumbnail row read, tracked health job and guarded host save - The Overview's thumbnail row is its own read of the thumbnail status: "Checking thumbnails…" until it answers, unavailable when it fails. - The health job is tracked in the Activity store (new store.track) and followed through its event stream instead of polling every 150 ms. - A host save before a read returned a revision fails without a request; System reads the host values on mount and after a conflict. - "100+ problems found" when the integrity count is capped. - D-NEW-S2-5 is D123 everywhere; the unused Overview hand-off is gone. - The concept spec builds the health report from the concept's own rows and asserts the full unmapped path list; surface tops pin the 18px offset. - TESTING.md: D96's reason, the read-only (WAL/SHM) standard, the UNC URI and the new behavior. Coverage floors raised for the touched files. * fix(system): make two health tests portable to Windows - Windows forbids "?" in file names, so the URI-character open test uses "#", "%" and a space there. - ntpath.realpath on Python 3.11+ returns a NUL-byte path instead of raising, so the bad-path test raises as POSIX does to reach the missing-files failure path on every platform.	2026-10-23 04:59:18 -07:00
Vito	b2cc489fd4	feat(inspect): copy settings summary and local workflow roles (#286) ... * feat(inspect): copy settings summary in the full inspector The legacy metadata page's COPY ALL (LI-4) becomes "Copy settings summary" after the six facts of the shared full inspector, so the Images viewer, the recorded history's current file and Inspect all offer it; the Images side panel keeps the concept's footer. The text is the legacy copyAllData template with its placeholders, filled from what the inspector shows. A unit test runs the template read from web/metadata.html on the legacy parse of every parity PNG: 22 of 25 are byte-equal, and the other three differ only by the ZeroOut guard (#249) or facts the legacy parse missed. Copying follows the concept's prompt copy: the toast "Settings summary copied.", or the select-to-copy dialog (now titled per copy) without a clipboard. The concept comparisons map the button as D-NEW-1. * feat(inspect): local execution evidence and prompt tracing A browser port of the server's inspection resolver for one sampler (PR L3 Task 8, LI-1). local-resolver.mjs answers inspect_prompt_evidence's {prompts, resolution} for a local read's records: execution evidence (read_pair_execution and its per-node match), every traced strategy (encoders, strings, concatenations, PromptManager and its historical classes, passthrough, zeroed, selector branches, composites, guiders), the latent stage walk, the R1 overwritten-text guard and the inspection profile's visit, depth, text, path, built and scanned bounds, with the same reason codes and outcome lines. py-json.mjs reads the records as CPython's json.loads does (dict order and last-wins keys, int versus float, BigInt past 2^53, NaN) and measures and strips text as str does. Several sampler candidates, detailer stages and A1111 parameters raise LocalResolverGap until Task 9. Nothing is wired into Inspect yet. Python is the oracle: test_local_inspect_parity compares the port with the server on the parity corpus, 107 named record sets, every work bound at its edge and 600 seeded fuzzed graphs, and requires gaps to be exactly the Task 9 paths. Sixteen porting mutations each fail the suite. The Node unit test replays committed server answers, which the Python suite keeps current. * fix(inspect): a list or object workflow node type answers malformed The R1 overwritten-text check looked every UI workflow node's `type` up among the subgraph IDs. A `type` that is a JSON list or object raised TypeError there, so the inspect route answered 500 "Prompt inspection failed". Such a workflow is now malformed evidence: the resolution is unresolved with reason_code `malformed` and the inspector's own "Prompt evidence is malformed" line, never exception text. The browser port answers the same, and the parity corpus gains the list, object, nested-subgraph and skipped-ID shapes. * fix(inspect): a list or object graph class_type is never a preview output With several sampler candidates the inspector first drops stages whose outputs reach only previews. That pass looked each API graph node's `class_type` up in the preview class set, so a list or object `class_type` raised TypeError and the inspect route answered 500. Only a string names a class now; such a node is an ordinary terminal, as the rest of the resolver already treats it. * feat(inspect): local candidate selection matching the inspector The browser port of the inspection resolver now answers every record set the server does, so no path is left to the server any more: - several sampler candidates, with the identical-branch rule (#270): a compare grid whose branches all resolve to one pair (text and recipe) is resolved, any other mix is ambiguous; - stages whose outputs reach only previews are dropped first; - detailer stages are judged with the samplers in their image ancestry (multistage-differs, cycles, depth and the per-stage visit budgets), and a sampler that only feeds detailers is not a candidate of its own; - A1111 `parameters`, with Python's multiline anchors, `\s` and Unicode `\d`, the bare footer and Template trailers, counted in code points. The parity corpus gains the selection cases and a seeded fuzzer, and every inspection vector now gives the server's prompts, resolution and facts locally. 16 of 17 mutations are caught; the uncaught one (not flattening an ambiguous upstream stage) cannot change any answer. * feat(inspect): local prompts resolved like the server's A file chosen on the Inspect page now shows the prompts and resolution the server's inspector gives the same records: buildLocalPayload takes its roles from the local resolver instead of the interim open roles, so the legacy fill applies exactly where it does for Images. The resolver reads the server's own node table. The page fetches web/js/inspection-semantics.json once through the API client as it mounts, before any selection; the static route serves that one JSON file by exact path (every other JSON stays forbidden). A table that cannot be fetched answers "The inspector's node table is unavailable." as the server does, and a later selection asks again. The Copy settings summary deviation is numbered D117. * fix(inspect): skip a workflow node whose type is a list or object The overwritten-PromptManager walk now skips such a node, on the server and in the browser port, instead of marking the whole file malformed. A prompt that resolves still resolves; the other nodes still feed the check. * fix(inspect): one JSON depth cap for both browser parsers py-json.mjs and local-video.mjs now refuse past the same 1,000 nested arrays or objects, counting every container as CPython's scanner does. Boundary vectors at 999, 1,000 and 1,001 for a deep prompt and a deep workflow run through the Python oracle, and TESTING.md gives the measured per-version server limits and both divergence directions. * fix(inspect): realpath containment for the exact-path node table route inspection-semantics.json now goes through the same realpath check as every other static file, so a symlink out of web/ is refused. The forbidden-path test asserts exactly 403. * fix(inspect): abortable, stepped local reads with a busy state The wait for the node table now ends with the selection's signal. A local read resolves and projects in bounded steps with a turn of the event loop between them, and the inspector carries aria-busy while it loads. A budget test covers maximal 2 MiB graphs and checks the stepped read is byte-identical to one synchronous build. The D117 wrap rule now targets only the summary button, and TESTING.md scopes the restart line to PRs L1 and L2. * fix(inspect): record the two CPython-JSON emulations as a follow-up	2026-10-23 01:38:36 -07:00
Vito	a8aff3a39d	feat(annotations): bulk Add tags and Auto-tag selected as Activity jobs (#283) ... * feat(activity): image tagging jobs for bulk Add tags and Auto-tag POST /prompt_manager/jobs/image-tags starts one record-changing "image-tags" job over 1..500 listed images (202, or the same 409 busy envelope as /jobs/scan). Add tags hashes each current file and unions a fixed set into that byte record; Auto-tag captures each still image, asks one legacy engine for its top N suggestions on the capture (count from the options or autotag.defaults.suggestion_limit), re-hashes the file and unions only onto the same bytes. Outcomes are grouped as tagged, unchanged, skipped (video, too large, file changed, file not found, not a still image) and errors; cancel stops at a file boundary. Auto-tag holds the shared model gate for the whole job (409 model-busy at start when it is held), loads the model once and never downloads one: an unavailable model fails the job before the first file. The registry gains blocker() so a start answers busy before taking the gate. * feat(annotations): Add tags and Auto-tag selected in the selection bar The Images selection bar gains the concept's Add tags and, beside it, Auto-tag selected (D85). Add tags starts the image-tags Activity job with the dialog's comma-separated names; Auto-tag selected reuses the Tag image model panel (server defaults, Suggestions count) without Generate, refuses a model that is not downloaded, and either starts the job (Apply automatically) or walks the selection one Tag image dialog at a time (Review each image, D90). Busy, model-busy and refused starts toast why; the selection stays; a finished job's files are read again. * feat(activity): show image tagging jobs with their own outcomes Image tagging jobs get their own Activity view (D89): the pill reads "Tagging", the item and heading line name the images and end with "N tagged · M errors", and the job view shows Tagged, Unchanged, Skipped and Errors tiles and outcomes, opens Tagged and Unchanged rows in the viewer, and reads "Tagging log" and "Cancel tagging". The per-kind table lives in activity-store.mjs; the scan's view is unchanged. The selection bar's copy without a concept line is recorded as D117. * fix(annotations): final review round for bulk image tagging - Rename the D117 copy deviation to D118 (D117 belongs to another PR). - The tagging job's progress line gives the scan's "about X min left" estimate, with each finished file as one batch. - The start body cap fits 500 targets of the longest legal path, even escaped; one byte over answers 413. - A capture store at capacity is retried with a short backoff, then the file is skipped with a rerun sentence instead of a Tag-dialog error. - Output roots and their labels are resolved once per job in the executor, not twice per file on the event loop. - Review each image holds Stop reviewing, Escape and x while a save is in flight, and its primary reads "Save and next" when only the manual field would be saved. - An Add tags field that parses to no names keeps the dialog and its text and reports the message on the field. - Image tagging finish toasts carry the counts ("... finished · N tagged · M errors"). - Specs: the bulk spec waits for the answered Start before checking that the invalid press sent nothing; the Activity spec uses a real error row.	2026-10-22 18:55:24 -07:00
Vito	195a1d33ac	feat(annotations): Tag image dialog, card Tag button and inspector tag chips (#281) ... * feat(annotations): image tagging controller with staged suggestions Add the UI-agnostic Tag image dialog controller (#249 C1): observe the file into a capture, prefill the saved tags and the server's tagging defaults, stage the top suggestions as removable chips, and save manual tags plus the remaining chips with case-insensitive dedupe (manual spelling first). Every read is serial-guarded; saves are sent once and a lost answer is resent identically only by Retry. Conflict, storage, file and capture outcomes keep the draft and gate Save on a reopen. ApiError now carries a validated copy of a tag-conflict body's current tag set so the dialog can show it. * feat(annotations): Tag image dialog beside Info on every image card Every Images and Library-embedded gallery card shows the concept's Tag after Info. Tag opens the concept's Tag image dialog (image-tagging.mjs over the C1 controller) in the shared modal shell with the sticky tagging-modal footer: capture preview, manual tags, the four legacy engines with real defaults, explicit Generate, removable suggestion chips (D83), legacy model labels (D84), a Suggestions count (D91) and Retry where the controller allows it. The capture is released on close, route change and pagehide. The Tags page gains the concept's Auto-tag images for the image selected in Images (aria-disabled without one, D115) and real Images counts that follow every save. Retires D9, #245 D2 and #245 D3. The toast now uses the mock's copy verbatim ("tags" even for one), C1's D60/D61/D68 markers are renumbered to D83/D84/D91, and at extreme zoom a card's info row stacks (and wraps Info and Tag) when its row is narrower than the narrowest bounded card, list rows included (D31). * feat(annotations): show image tags in the inspector and viewer The inspector parses the B3 envelope's image_tags facet (strictly: exact keys, current/none/unavailable, at most 100 vocabulary names) and draws one chip row after the prompt blocks: the file's current image tags first, then D21's linked tags not already shown (case-insensitive). In the Images panel image tags are Tags filter buttons and linked tags keep D21's rule; in the viewer and wherever no Tags filter exists every chip is plain. none and unavailable add no chips (D88, plan D65; D21 amended). The tagging fixture reset now drops leftover captures, so a long run of tagging tests in one worker stays below the capture store's limit. * fix(annotations): re-read a tagged file in place after a save After a tag save the selected file's inspection is re-read quietly: the panel and the viewer keep the current details until the new answer lands, with no "Loading file details…" in between. While a Tags filter or a search is active, Images re-reads its loaded range in place (same query, from the first page up to the loaded count, published once), keeping the cards, the scroll position and the selection while the selected file still matches; when it no longer matches, the panel follows the collection. * fix(annotations): give suggestion chips the concept chip corner The D83 chips took the later `.tag-suggestion` row rule's 5px corner; the concept `.chip` has 4px. The concept comparison of the Tag dialog found it. * test(annotations): compare the Tag dialog with the approved concept The Tag image dialog's inventory (order, text, field attributes, tokens, preview box, chips, status, sticky actions) must equal the concept's at 1600x1100 and 390x844, dark and light, opened, generated with WD14 and with a language model, for an empty result and in the review scope, and the card's Info and Tag group must equal the concept's. Production runs on the concept fixture with the concept image's tags saved and the fake model answering the concept's own sample; only D29, D83, D84 and D91 are mapped, and a mutation check shows the comparison notices a change. The D3 footer check again asserts a strictly shorter footer, with short seedless subtitles that stay on one line beside Info and Tag. * fix(annotations): final review round for the Tag image dialog - Option fields show the server defaults that Generate sends: the controller bumps an options revision on open and on a model change, and the panel re-renders only then (I1). - A tag conflict shows the current set at once ("Saved now: ...") and puts it ahead of the draft in the manual field, so the next Save sends what is shown (I2). - The opening sentence is the concept's on-screen copy; "Remove anything you do not want to add." leads the chips only while chips exist; the comparison's opened mapping is gone (I3). - ApiClient gains an additive keepalive option; the capture release and the Save PUT use it, and pagehide closes the dialog (I4). - Closing during a save keeps the capture until the PUT settles, then releases it and still reports the outcome (toast, page refresh) (I5). - A refresh asked during a page load is pending and runs once it settles; re-reads use pages up to 200 files; a failed re-read toasts; Load more waits for a refresh (I6, M2, M3). - The selection bar drops checked files a refreshed result no longer lists (I7). - D116 records Retry; after a failed Generate it takes Generate's own path, and after a changed storage, file or expired capture it observes again keeping the draft (I9, M4, M5). - A save made from Tags marks a filtered Images visit stale (M6). - images.mjs drops under 800 lines: the tagging wiring moves to images-tagging.mjs and the favorites star to images-favorites.mjs (unchanged), and reset() reuses dropSelection() (M1). - Restore the activity-scan.mjs coverage floors; drop the duplicate paired captures test (I8, M9). * fix(annotations): coverage floors for the Tag dialog round Floors for the new images-favorites.mjs and images-tagging.mjs, and the measured raises of image-tagging-state.mjs and image-tagging.mjs. activity-scan.mjs keeps main's floors.	2026-10-22 15:21:07 -07:00
Vito	a6f6697c50	feat(activity): shared job registry, Activity page and Scan for metadata (#269) ... * feat(activity): shared session job registry with the scan as its first kind The output scan now runs as the first kind of an in-memory JobRegistry (py/api/jobs.py, replacing py/api/scan_job.py). Each job keeps exact counters, at most 200 outcome rows per group and a log capped at 2,000 lines, with root-relative paths and public root labels only. New routes list, inspect, follow (SSE) and cancel jobs and start the scan (POST /prompt_manager/jobs/scan, 409 busy while another record-changing job runs). The legacy /prompt_manager/scan routes attach to the same job and stream unchanged payloads. * feat(activity): concept Activity page, top-bar button and progress pill The workspace gains the concept's Activity page (renderActivity), its top-bar button and sidebar row, fed by one session job store: a /jobs read, one SSE stream per running job, a 1-30 s capped backoff after a dropped stream and a 15 s list poll while visible. A job the server no longer lists shows as ended, so no pill stays stuck after a restart. D52: the counts show running jobs and hide at 0; the phone top-bar row may wrap. D53: the mockup's progress pill links the running job. D54: real job items with state chips, detail lines and Cancel job. Start and finish toasts follow the spec copy. Fake browser jobs come from tests/browser/workspace_activity_fixture.py. * feat(activity): Scan for metadata with its review dialog and job view Images -> Import keeps Rescan and adds the concept's "Review scan" row as "Scan for metadata". It opens the concept's "Review metadata scan" with the real source count, the fixed "All files" scope, a backup box that downloads the existing database backup, and Cancel / Start scan. Start scan starts the session scan job and opens its view; a start refused by another record-changing job toasts its title as a link. #/activity/<id> is now the approved job-view mockup: the heading with Download report (disabled until Activity-2) and Cancel scan, the Progress surface with the five counter tiles, the Results surface with the outcome list, path filter and capped rows (Added and Already known open the viewer through the listing identity), and the collapsed Scan log. Activity item titles link their views. The scan's progress line groups thousands. Deviations D55-D57 are recorded in TESTING.md. * fix(activity): stop the job store on pagehide and let proxied routes outlive teardown CI's touch coverage run failed "a resolver failure for the ComfyUI link never stops the shell from mounting" with "route.fulfill: Fetch response has been disposed": its trace shows two Library thumbnail requests started by the last route still in the spec's proxy-mount handler while the page fixture was torn down. - The proxy-mount handler ignores only that teardown error, and the workspace and Activity specs unroute with ignoreErrors before teardown. - The Activity store now ends its work on pagehide: the poll and backoff timers stop, the job streams close and a list read in flight is aborted (an older read is also aborted when a newer one starts). A pageshow from the back-forward cache reads the list again. * test(activity): compare the job view log's line height to the hundredth of a pixel WebKit reports the mockup's 11px/1.7 line height as 18.700001px, so the job view comparison failed on WebKit only. The measurement now rounds it, as other engine-dependent values are normalized. * fix(activity): final review round for the job store, job view and scan rows - Store: one failed list read no longer marks running jobs as ended; two in a row, or a good list without them, do (M1). A good read resets the backoff, except for a stream that keeps dropping while the list reads fine (M2). Finished jobs the server pruned are dropped (M3). Numbers group as en-US, like the server's lines (M13). - Job view: a job the store's list no longer has shows the not-found state (M3). Focus moves to the job heading when Cancel scan goes away, and to the item's title link in the list (M4). The detail is read only when its listed rows change or the open log grows, using the summary's new listed and log_length (M12). - Viewer rows open by exact identity: each scan row records its root's listing index, the source must still carry the row's label, and the workspace listing gains an exact `path` filter (M8, M9). - Scan rows name the prompt by its Library title, stored title first (M10). - A toast with a link stays 20 s, and any toast stays while hovered or focused (M14). - A real two-batch scan cancelled after batch 1 keeps partial counts (M7). - TESTING.md: D54, D56 and D57 updated (M5, M6). * test(activity): cover the held and linked toast and a job view pruned by the server Unit tests for the toast's 6.5 s and 20 s timeouts and its hover and focus hold, and a browser test for a finished job's open view after the server stops listing it. Coverage floors are only raised.	2026-10-21 14:22:30 -07:00
Vito	762669758b	feat(history): concept gallery cards, history comparison and CSS retirement (#266) ... * feat(history): concept shared gallery The history page's gallery is the concept's section.history-gallery with its panel heading (Shared gallery, <name> · same positive prompt) and the Images media cards, followed by the recorded executions. A saved variant with no images shows the concept's empty copy. Recorded as D47. * feat(history): drop the shared gallery's Linked images caption (D47 ruling) The concept's "Shared gallery" heading is the gallery's only heading: the embedded collection's "Linked images" heading and "N loaded · N linked images" count repeated it. mountImages gains caption: false and a focusTarget; only the history page's shared gallery passes them, so the Images page and the All images and Repeat run dialogs keep their caption. The layout row and the selected-image side panel stay (TESTING.md D47). * test(history): concept comparison for prompt history history-concept.spec.mjs compares the Prompt history with the concept's #prompt/alpine on the concept fixture at 1600x1100 and 390x844, both themes and motion settings, on Chromium and touch, with its behaviors in both documents and a mutation check. inventoryOf gains a history section; mapHistoryConcept applies D24, D35, D45, D46, D47 and the approved Show archived button, laying the concept out at runtime. Corrections it demonstrated: each compared negative mounts in a display: contents child of the concept's .compare-item (D25), and the concept fixture now links images oldest first and counts one pair use per image, so newest-first reads and lane run counts match the concept. history-canonical-comparison.mjs uses the concept's selectors for production and drops its closed polish entries. * feat(history): drop the Linked images caption from the history dialogs (D47 ruling) The maintainer extended the D47 trim to the history page's two media dialogs. All images for this positive and Repeat run are named by their own dialog title, as in the concept (app.js a1282-1304), so their embedded collection no longer shows the "Linked images" heading or the "N loaded · N linked images" count. A stranded focus returns to the dialog's close button. The Images page keeps its caption. The history concept comparison now records each dialog's caption count in both documents, and TESTING.md D47 covers the dialogs. * refactor(workspace): retire library.css and the interim page guards Every page is rebuilt, so the rules that waited for PRs D, E and F go. library.css is deleted with its link; the overlay is now the only stylesheet after concept.css. Deleted because the concept already draws them: the .library-grid tracks and breakpoints, the history .row-actions flex row and button size, summary cursors, h2 margins, and the sender and Recorded run dialogs' colors and border. Deleted because they had no effect: min-inline-size on block children, a .recorded-run-dialog pre limit, the general .prompt-inspector margin (now scoped to the Recorded run dialog, the only mount point that is not display: contents) and a 700px padding a later rule overrode. The duplicated sender and Recorded run dialog guards are merged into one rule each. Kept with a marker: windowed Library rows (D3), the shelf states (D40), the history panel's wrap, archived-lane and coarse-target rules (D45), and under the new D48 the production surfaces the concept never shows: recorded executions and the Recorded run dialog (#209, D26), the Archive negative confirmation (#235) and the prompt sender. They now use the concept's --green and --red tokens instead of private copies with the same values. The workspace browser specs on Chromium and the concept specs on touch pass unchanged. TESTING.md records D48 and closes the role-block gap. * refactor(workspace): drop the dead embedded caption and tighten the review guards - images.mjs: an embedded collection never has a caption (D47), so the caption option, its "Linked images" heading, the embedded count string and the heading arm of the focus fallback are removed; callers no longer pass caption:false. Behavior is unchanged. - workspace.css: delete the never-applied .recorded-run-dialog::backdrop rule (the concept's .ca-tools dialog::backdrop always won) and note that the D3 row's min-inline-size: 0 is load-bearing for the concept's <=700px 1fr track. - concept-css test: the waiting-rule guard is case-insensitive and is proven against the exact retired comments and the kept provenance labels. - history-concept spec: function replacement for the singular run label, and the DOM mutation removes Compare negatives by role. - D47 markers sit where the caption trim happens.	2026-10-21 05:16:38 -07:00
Vito	10a4847a6b	feat(history): concept heading, negative variants and compare (#265) ... * feat(history): concept heading and summary The Prompt history page takes the approved mock's heading and summary surface (docs/concepts/workspace/app.js renderHistory a591-598, #249 F1): - Heading description is "Prompt history · one positive, one shared gallery"; the actions stay "← Prompt library", "Edit metadata" and button.send "Send to ComfyUI" (aria-label "Send prompt pair to ComfyUI: <title>"), on one row at 1600. Send is disabled only while the selected pair's roles are loading (D24). - The summary is article.surface > span.chip category, the positive and selected negative prompt blocks, then .card-meta "N tracked runs · N images · N negative variants". Tracked runs come from the recorded history window's recorded_run_count (hidden until a read completes, kept while a refresh is in flight); images and variants from the saved positive's image_count and variant_count. - The summary's copy/send actions are named after the prompt, as in the concept ("Copy positive prompt: <title>"); mountPromptBlocks gains setTitle so an in-place metadata edit renames them without a remount. - mountRecordedHistory gains an optional onRecordedCount callback. Selector mapping: - .library-surface (history summary) -> .library-history article.surface - .library-surface .library-chip -> article.surface > span.chip - "Copy|Send <role> prompt[ to ComfyUI]" in "Saved prompt texts" -> "...: <title>" - heading p.muted "One positive prompt. Reusable negative variants. One shared gallery." -> "Prompt history · one positive, one shared gallery" - Unchanged: region "Saved prompt texts", .library-variants, .library-shared-gallery, .recorded-history (still .library-surface). Tests: workspace-history "history heading actions stay on one row at 1600 and are enabled after load" and "summary meta uses recorded runs" (both failed before), a prompt-blocks setTitle unit, and the mapped selectors in workspace-visual, workspace-library-editor and the canonical comparison. * feat(history): concept negative variants panel The history's Negative variants panel is the concept's (app.js a598, style.css 1059-1154): section.surface.timeline-panel with the panel heading (h2, p.small "Choose a red dot to change the negative and filter this gallery."), row actions Compare negatives (aria-pressed; its section is Task F3), + Add negative and the approved Show archived; a .timeline of .positive-lane and .variant-lane rows (--lane-offset 38 + 47i) with the "−" .variant-dot, "<name> · N runs" and a .run-dot when the pair's run_count > 1; and .timeline-lower with the legend and All images for this positive. D26: All images for this positive opens the concept dialog with the embedded, bounded (Load more) media gallery instead of filtering the shared gallery. The run dot opens Recorded run for the pair's newest recorded execution, else a Repeat run dialog with the pair's newest linked image. Backing data: - library variants carry prompt_pairs.run_count; - GET /prompt_manager/library/{positive_id}/history/pairs/{pair_id}/newest reads the newest run in the positive's exact raw-text scope whose current-epoch saved-pair hint still resolves to that pair (the get_history_run hint rule), inside the fenced history snapshot. - workspace-dialogs gains openContentDialog (onClose releases the body). - mountRecordedHistory returns openRun. D45 (new deviations): - a dot is named "Select negative <title>" when no other loaded lane has that title, else "Select negative variant N", so names stay unique; - the bounded "N of M saved negative variants" count stays a visually hidden status; "Saved combinations, not an execution timeline." is gone; - archived lanes (#235) are concept lanes marked .library-variant-archived at .6 emphasis with their Restore button; coarse dots keep a 47px target; the heading, legend row and All images button wrap at 390px and 200% zoom. Retired CSS: .library-branches, .library-positive-lane, .library-variant-lane, .library-variant-dot, .library-variants, .library-panel-heading, .library-variant-footer, .library-variant-summary. Selector mapping: - .library-variants -> .library-history .timeline-panel (region "Saved negative variants" unchanged) - .library-branches -> .timeline; .library-positive-lane -> .positive-lane - .library-variant-lane -> .variant-lane; .library-variant-dot -> .variant-dot - .library-variant-archived and .library-variant-restore unchanged - .library-variant-footer / button:last-child -> .timeline-lower / button - .library-variants > p.muted -> .timeline-panel .panel-heading .small - "Select negative variant N" -> "Select negative <title>" for titled pairs (history, native library, inspector, visual and real-host fixtures); untitled pairs unchanged - lane text "· N linked image(s)" -> "· N run(s)" - All images for this positive: aria-pressed filter -> dialog "All images for this positive"; tests that used it for the whole gallery select the lane linking the image, or read the dialog - variant panel row actions gain Compare negatives first Tests: new workspace-history "variants panel matches the concept", "run dot appears only for pairs with more than one run and opens its run", "all images dialog lists every image for the positive"; new workspace-library-editor "show archived and restore still work" (all four failed before the change). Python: variants carry run_count, newest pair run (DB and route). Unit: content dialog. The history fixture counts two canonical pairs and links one image to Clean geometry. * feat(history): compare negative variants Compare negatives now opens the concept's comparison (app.js a599-616, style.css 1155-1179) as a section.surface right after the timeline panel: h2 "Compare negative variants", p "Baseline compared with <name>. Choose another red dot to change the comparison.", a .compare-grid of two .compare-item negative blocks (baseline, selected), p.small "Added terms", then span.diff-added "+ term" per added term or p.small "No added terms.". Choosing another red dot updates the same section in place; pressing Compare negatives again removes it. D25: the baseline is the oldest active variant; with no selection the selected side falls back to it, as the concept's v does. The pure addedTerms(base, selected) in history-state.mjs is the concept's rule: comma split, trim, drop empty terms, exact case-sensitive difference that keeps the selected order and repeats. D46 (new deviations): - lanes are newest first, so the baseline is the lowest-id active variant, not the first lane; while the variant page has more, the oldest is not loaded and the section says "Load more negative variants to reach the baseline." instead of guessing; - the two blocks are named "Baseline" and "Selected" (regions and copy/send actions), so no name repeats on the page; - Compare negatives is disabled when there is no active variant. Selector mapping: none changed; the section is new (.library-history .timeline-panel + section.surface). Tests: unit "added terms split, trim and exact-diff like the concept"; workspace-history "compare toggles, follows the selected dot and stacks at 390" and "compare waits for the page holding the oldest active negative" (all failed before the change). * test(history): guard the newest-pair route and record D45/D46 TESTING.md lists the Prompt history page's spec decisions (D24-D26) and its new deviations D45 and D46 beside D23 and D40-D44, notes under D46 that production opens on the newest lane while the concept opens on its baseline, adds GET /prompt_manager/library/{positive_id}/history/pairs/ {pair_id}/newest to the history route list with its guards, and documents the detail variants' run_count. Tests: the newest-pair read skips a stale reference_epoch row, stops at 16 stale-hint candidates (17 newer stale rows hide an older valid run and report {run: null}), and rejects a negative-only or deleted positive; the route answers 404 for an ineligible positive, 503 storage-unavailable for storage failures without leaking details, and 409 history-changed for a restore during the snapshot. * fix(history): run-dot touch target, unique dot names and dialog cleanup - D45: under pointer: coarse the 12px run dot gets a 44px ::after target, and while a run dot shows the lane text wraps within 139px before it. - D45: dot names compare trimmed titles and never use a title that reads like a fallback "variant N", so names stay unique. - All images and Repeat run share one dialog-scope slot: each open replaces the previous scope instead of adding a cleanup per open. - A run-dot lookup that settles after the view went stale opens nothing. - Retire the unused .library-main .library-chip rule and the stale "Saved combinations" comparison note. Tests (workspace-history, Chromium and touch): the coarse run-dot target and lane width; a failed newest lookup shows the toast and Repeat run; Recorded run that cannot open (recorded history failed) falls back to Repeat run; an archived pair's Repeat run reads archive=archived; Compare negatives is disabled with no active variant; dot names stay unique. * fix(workspace): one inert handle for aborted history and prompt-block mounts An aborted parent no longer gets a separate never-called stub per method: mountRecordedHistory returns its hoisted openRun (it answers false before reading later state), and mountPromptBlocks returns one shared no-op for update, setState, setTitle and dispose. This keeps the history.mjs and prompt-blocks.mjs function-coverage floors (98) without lowering them. Tests: test:coverage (Chromium and touch, 922 workflows) passes for all 61 files; it failed before on history.mjs 94.44 and prompt-blocks.mjs 93.75 function coverage.	2026-10-21 02:25:25 -07:00
Vito	3476f8ede9	feat(inspector): concept comparison, Show in folder and toast placement (#264) ... * test(inspector): concept comparison for the panel and viewer details Compare the Images side panel and the viewer's full details with the concept (1600x1100 and 390x844, both themes): structure, tokens, geometry and controls, plus copy, the acknowledged pair send, the tag chip filter and Prompt history. mapInspectorConcept applies only D3, D20, D21 and D22; a mutation test shows the comparison notices a changed role label and a removed footer. The comparison showed the role copy and send names lacked the concept's ": <title>" subject, so the inspector now passes its title to the prompt blocks. It also showed that a recipe-linked image shows its recipe's own category and tags (#224), which the concept fixture's recipes lack; that is recorded as D38, and the fixture's new positive_links option links the compared image to its positive alone. * docs(inspector): renumber the recipe-category decision to D39 * feat(images): local-only Show in folder route POST /prompt_manager/images/reveal takes the listing identity {root_index, root_scope, path} and opens this computer's file manager at that file. It answers 403 not-local unless the client is loopback, no proxy header is present and Host/Origin name this computer; the scope is checked with _gallery_scope_error (409) and the path resolves only inside that root to a regular media file. Openers run as argv lists with an absolute executable, no shell and DEVNULL streams (D38). * feat(inspector): Show in folder after the File & provenance path The viewer's File & provenance offers "Show in folder" right after the Path value for a listed file only, POSTs its listing identity and toasts the outcome (opened, not-local, unavailable or failed). The browser test server stubs the opener; TESTING.md records the decision as D38. * fix(images): keep the discovery alert clear of the Rescan toast A rescan that leaves the Images discovery alert visible could show its fixed bottom toast over the alert on a short window. The concept's toast keeps its placement; the production-only alert now scrolls into view only as far as needed, with a 96px block-end scroll margin (D42). * docs(inspector): concept panel and viewer details * fix(images): open Windows folders through the shell API, not an Explorer command line Explorer splits its own command line on commas, so a gallery path such as output\a,\Windows\System32\calc.exe,b\x.png escaped the roots through [explorer, "/select,", path] (security review H1). Windows now selects the file with ILCreateFromPathW and SHOpenFolderAndSelectItems, and on any shell failure falls back to os.startfile on the folder. No process is started. * fix(images): re-check, isolate and reap the Show in folder opener - re-check that the real path is still a regular file inside its root right before launching; a changed target answers 404 (review L4) - run openers on a dedicated single worker, not ComfyUI's default executor, and make dbus-send wait for the FileManager1 reply (--print-reply --reply-timeout=2000) so a missing service falls back to xdg-open (L1) - reap launched processes on a daemon thread, give them a minimal environment with a fixed system PATH, and use /usr/bin/open on macOS and dbus-send/xdg-open resolved only on that PATH (L5) * fix(images): accept Show in folder only as a same-origin JSON request, one at a time - require an Origin equal to the request's own scheme://host:port and, when sent, Sec-Fetch-Site: same-origin; refuse every forwarding-style header (Via, X-Forwarded-*, X-Original-*, *-Client-IP, CF-Connecting-IP and the rest) as remote (security review M1, L2) - answer a non-JSON body with 415, so a cross-origin request always needs a CORS preflight (L2) - single flight plus a 1 s cooldown per process: 429 code busy (L1) - path resolution errors such as ENAMETOOLONG are a JSON 404, and neither that nor a start failure logs the client's path at error level (L3) * fix(inspector): say the folder is already opening on a busy Show in folder A 429 busy from the reveal route now toasts "The folder is already opening." The browser workflow checks that the reveal POST carries the page's own Origin and an application/json body, and TESTING.md D38 records the tightened route, the toast table and the accepted residual risk of a header-less local proxy. * test(inspector): compare the viewer details under a coarse pointer and prove its mutations The touch project measured production's D34 40px disclosure targets against the concept's fine-pointer summaries. The concept's plain-chip copy now also carries the recorded D34 coarse rule, so both documents are measured under the same emulation. The open File & provenance is compared too (D38 Show in folder and D20 Download original mapped), and the mutation check now removes the viewer's pair actions and Show in folder. * refactor(inspector): attach Show in folder to the Path value it follows The button was placed on the second fact row by position; the Path dd is now built by the caller and kept, so reordering the facts cannot move it. * test(inspector): let the uncertain-file send check fail again Inspector send buttons are named "... to ComfyUI: <title>", so the anchored regex could never match and the no-send assertion always passed. * fix(images): run the Windows folder fallback inside COM and keep desktop session variables Show in folder's os.startfile fallback now runs inside the same CoInitializeEx/CoUninitialize bracket as the shell selection, as ShellExecute callers should. The Linux opener keeps XAUTHORITY, DESKTOP_SESSION, XDG_SESSION_DESKTOP and XDG_CONFIG_HOME, so a file manager can reach the X11 display under GDM or SDDM and honour the user's mimeapps.list. A Windows-only test calls the real ILCreateFromPathW and ILFree on a temp file and pairs CoInitializeEx with CoUninitialize through the module's helper, without SHOpenFolderAndSelectItems, so no window opens on CI. * fix(images): scroll to the rescan's discovery alert only when the toast band covers it D42 scrolled the alert into view after every rescan, so a user scrolled down the grid was sent back to the top. It now scrolls only when the alert intersects the toast's band (its scroll-margin-block-end). * refactor(inspector): name prompt actions as PR #263 does The title option keeps its name, default and output ("Copy positive prompt: <title>") and now uses #263's actionName helper; the region-name arrow no longer shadows the title option. * test(inspector): the comparison opens Filters by its D44 active-count name After a tag chip applies its filter, the shared toolbar's Filters button reads "Filters · 1" (D44, #263), so the comparison opens it by that name. * fix(images): POSIX opener paths stay absolute under Python 3.13 on Windows Python 3.13 on Windows no longer counts "/usr/bin/x" as absolute, so the faked-Linux reveal tests failed on windows-latest py3.13 (the Linux and macOS openers are POSIX paths whatever host evaluates them). Use posixpath.isabs for those lookups.	2026-10-21 00:53:04 -07:00
Vito	0a7b0238ca	feat(library): concept prompt library cards, toolbar and caption (#263) ... * feat(library): concept toolbar and caption The Prompt library shelf uses the shared concept toolbar (search, category, sort, Filters): sorts are Recently added / Name A-Z / Highest rated, then Oldest first; the Tags filter moves to "Refine this view" (D14) and Refresh library is removed (D15), with Retry kept and re-reading failed categories. The caption is the concept's .section-caption, "N positive prompts · M negative variants" over the filtered set from variant_total. Library-embedded media cards keep the favorite star working: the Library gallery read already reports favorite (one batched lookup per page, now covered by a test), and star answers are delivered to every mounted embedded gallery, so a star toggles, repaints and survives a reload. The checkbox and selection bar stay Images-only. * feat(library): concept prompt cards with real runs and last use The Prompt library shelf renders the concept's article.prompt-card: .card-art (up to two previews), .card-title with a title button and the category chip, the positive prompt block, .card-meta ("− N negative variants", "N runs", "N images"), .tags, and .card-footer with the rating and last-use line and the positive send plus Explore history buttons. D23: "N runs" is the parent's run_count; the footer reads Used today / yesterday / N days ago / <Mon D> in the viewer's local calendar days, or "Not used yet"; stars carry a visually hidden "Rated N out of 5" and an unrated parent shows no stars. The positive is clamped to two lines while copy and send use the full text. Long titles wrap inside the title row and the category chip never breaks mid-word. Card actions are named after the prompt ("Copy positive prompt: <title>") through a new title option on the shared prompt blocks. The production .library-card CSS is removed and the row estimates follow the clamped card height. The shelf error now reads "Prompt library could not be loaded. Retry." (Refresh is gone). TESTING.md records D23, the production-only shelf copy (D40) and the concept search placeholder kept on the Library (D41). * test(library): concept comparison for the shelf library-concept.spec.mjs compares the Prompt library shelf with the immutable concept on the concept-shaped fixture: heading, toolbar, caption, grid and the six cards (art, title row, prompt block, meta, tags, footer) at 1600x1100 and 390x844 in both themes and motion settings, the 3-column grid at 1800x1100, and the behaviors in both documents (title and Explore history open history, the footer send carries the positive only, copy toasts "Prompt copied.", the "neon" search and the Landscapes category). A mutation test proves the comparison notices a footer padding change and a removed variants chip. mapLibraryConcept applies only recorded deviations: D14, D16, D23 (title min-width, singular variant chip, spoken rating, the two-line clamp the concept's samples exceed at 390px), D35, D36, D40 and the new D42 (tag chips in the store's alphabetical order). Each re-laid-out part is checked against the concept page with that deviation applied at runtime. Corrections the comparison demonstrated: - the fixture creates the concept's prompts last to first, so Recently added lists them in the concept's order; - the shelf no longer ends with the legacy "Current prompt library" link; Overview's legacy cards keep it, as with "Current gallery". The shared inventory gains the Library section, and reflow/withoutItems move into concept-inventory.mjs for both comparison specs. * test(workspace): reach the legacy Library from Overview, not the shelf The shelf no longer links the legacy Library (#249 E3). The shell destinations test now expects no legacy link on Prompt library and asserts Overview's "Open existing prompt library" card still links /prompt_manager/admin and that the page loads. * feat(library): Filters shows its active count; final review follow-ups - D44: the shared toolbar's Filters button reads "Filters · N" while N "Refine this view" filters are active (Library: Tags; Images: Source, Folder, Media, Tags), so a Browse-set Tags filter is visible on the shelf. The text is the accessible name. Unit and browser tests cover Browse -> "Filters · 1" -> Clear -> "Filters" and the Images counts. - Renumber the alphabetical tag chips deviation D42 -> D43 (D42 is #264's). - The caption count is a role=status region written only when it changes and kept shown while the shelf reloads. - usedLabel names the year for a use in another calendar year (D23). - prompt-blocks: same `title` option API as #264 (`subject` suffix); the region-name helper's parameter no longer shadows it. - Scope library.css .row-actions rules to the history panels; fix stale CSS and spec comments. - Retry re-reading a failed category list and the no-op Apply/search paths are covered by a browser test. - TESTING.md: D23 amendments (year, button vs link trade-off), D44, the legacy Library link wording.	2026-10-20 23:26:05 -07:00
Vito	00bda8f442	feat(inspector): concept prompt blocks, side panel and viewer details (#260) ... * feat(workspace): concept prompt blocks Shared prompt blocks (Images panel, viewer details, Library cards and saved texts, recorded runs) now render the approved mock's markup (app.js promptBlock a298-302, concept.css s550-588), #249 D22: - section.prompt-section.<role>[aria-label="<Role> prompt"] > .prompt-heading (span.role-label "+ Positive prompt" / "- Negative prompt"; .prompt-actions: copy button.icon-btn "Copy <role> prompt", then send button.send.icon-btn "Send <role> prompt to ComfyUI") + p.prompt-text. - No per-block source line; a file's evidence moves to the panel badge (D2) and "File & provenance" (D3). Recorded runs keep every field's source in "Frozen field provenance". - Empty text reads "No negative prompt (explicitly empty)" and still sends an explicit clear. Absent, ambiguous and unresolved roles render p.prompt-text.muted with the existing status strings and no actions; unknown role names render nothing and cannot be sent or copied. - Copy shows the shared toast "Prompt copied."; without a clipboard it opens the concept's "Copy prompt" select-to-copy dialog. - The data-send-role / data-copy-role contract is unchanged. The D22 interim overrides (26px actions, prompt-text margins, copy status, source line) are retired so the concept's rules apply; the action buttons measure the mock's 31x31. pre.prompt-text styling stays only for the Library editor's Archive dialog and frozen field provenance, which keep their own markup until their page rebuilds. Test selector mapping: .prompt-block / .prompt-positive -> .prompt-section(.positive) .prompt-block-heading h3 -> .prompt-heading span.role-label region pre / pre.prompt-text -> p.prompt-text "Empty negative prompt" -> "No negative prompt (explicitly empty)" "Send <role> prompt" -> "Send <role> prompt to ComfyUI" .prompt-source / copy status line -> removed (toast or Copy prompt dialog) copy button 30x26 -> 31x31 (measured in the mock) * feat(inspector): concept side panel The Images side panel is the concept's aside#image-inspector.detail-panel in the order of app.js imageDetails: plain cover, heading with the format chip, filename, the D21 evidence badge and category chip, prompt blocks, tag chips, the six facts and the footer (Send to ComfyUI pair, Prompt history). Provenance, raw records and downloads stay in the viewer's full details. Positive-scope tag chips set the Images Tags filter to that tag. * fix(inspector): mark the side panel's overlay rules with their D2 decision The overlay lint (tests/vendor/concept-css.test.mjs) requires a /* D<n> */ marker on every workspace.css rule that overrides a concept selector; the three .detail-panel rules from D2 lacked one. * feat(inspector): full details in the viewer The viewer's #viewer-details renders the concept's imageDetails(i, true): the side panel content without the cover in a class-less wrapper, then "File & provenance" and "Workflow & raw metadata" (pre[tabindex=0] > code and the two downloads with their unavailable reasons), then the pair send ("Send to ComfyUI", labelled "Send prompt pair to ComfyUI: <title>") and Prompt history buttons. One renderer now serves both variants. Provenance wording (maintainer, 2026-10-20): the six per-fact "<Fact>: Configuration evidence · <source>" lines and FACT_SOURCES are gone; the concept's "Prompt evidence: <badge>" line carries the D21 badge in lower case and is left out without a badge. The honest facts stay (current-file note, Source, Path, Size, Dimensions, Format, Media type, Modified, occurrence, association, Download original). An unverified format reads "PNG extension", no stray leading dot. inspector.css and images.css are deleted; only rules with a live consumer moved to the overlay under #249 D3 (inspector wrapping, the inert aria-disabled download, the narrow Images container, the Library and recorded-run prompt blocks, the Archive negative's prompt-block, the prompt sender) plus a D20 wrap rule for the viewer's buttons at 200% zoom. D1 review follow-ups: library.css no longer restyles recorded-run p.prompt-text.muted (m2); the copy fallback has a seam and unit tests for a missing clipboard and a refused write (m3); a stale test title is renamed (m4); the fallback trigger falls back to the same-role button when the clicked one was detached by a re-render (m7); TESTING.md records the D20 and D22 deviations (m1). Selector mapping in tests: .file-inspector-inner -> .panel-heading, .generation-facts -> .meta-grid (first), .file-facts -> details .meta-grid, .file-name -> #viewer-details > div > p.small, .file-inspector-footer -> #viewer-details, viewer "Send prompt pair" -> /^Send prompt pair to ComfyUI: /. * test(comfyui): real-host specs read the concept prompt blocks library-sender: an explicitly empty saved negative now reads the concept's "No negative prompt (explicitly empty)" (D22). The prompt-sender spec's panel and viewer selectors (complementary "Selected image details", the card image opening the viewer, .meta-grid facts, the labelled pair send) moved with the D3 commit. * test(comfyui): the frozen run's prompt regions read the concept prompt text * fix(inspector): coarse viewer-detail targets and Prompt history on the shown route - Prompt history closes the viewer and, when its target is the route already shown, re-renders it as the concept's go() does (navigateTo plus a router refresh event), instead of doing nothing. - The viewer details' disclosure summaries and "Download original" keep 40px targets on coarse pointers (#249 D34), as TESTING.md promises. - Drop the dead `.prompt-positive` rules and merge the two `pre.prompt-text` rules. - TESTING.md records the side panel's D20/D21 deviations.	2026-10-20 20:15:21 -07:00
Vito	2b8126b7be	feat(images): card selection checkbox and selection bar (Set category, Export metadata) (#259) ... * feat(images): card selection checkbox and the concept selection bar Every Images card's overlay starts with the concept's "Select <filename>" checkbox before the star. Checked image keys form the page's selection, kept across Load more, infinite scroll and bounded re-mounting and cleared whenever the collection is replaced. The #bulkbar between the filter row and the gallery shows "N selected" with Set category, Export metadata and Clear (the first two are wired by the next tasks); Clear empties it. The interim D8 star rule is removed, and the concept comparison now measures the overlay with its checkbox and the bar with one card checked. * feat(images): export the selected images' metadata as one JSON bundle The selection bar's Export metadata reads each checked image's inspection, at most four at a time, and downloads prompt-manager-images-metadata.json: format, version 1, exported_at and, in listing order, the same envelope the inspector's "Download metadata JSON" saves (one shared builder, metadataEnvelope). The button is aria-disabled and ignores a second press while it runs, the selection is kept, and the toast reports the exported count, the images that could not be read, or that none could (no download). Also: the bar and its count are built only on the Images page, the Library-embedded gallery is asserted to have no checkbox or bar, a sort change is asserted to clear the selection, the checkbox label test asserts the toggle and an unchanged selection and inspector, and TESTING.md records that a return to Images keeps the selection while a reload starts empty. * feat(images): set the category of the selected images' linked prompts The selection bar's Set category opens the concept's simpleInput dialog ("Categorize selected images", one Category field, Cancel / Apply) and posts the selection's distinct linked positive ids to /prompt_manager/bulk/category. Images have no category of their own; the listing's category filter matches the linked positive's, so that is what changes. With no linked image checked nothing is posted and a toast says so; on success the toast counts the prompts and any skipped images, then the categories and the listing reload (clearing the selection); a failure keeps the selection. The button ignores a second press while it runs. The bulk category route now rejects anything but a non-empty list of at most 1000 positive integer ids (deduplicated in order) and validates the category with validate_category; bad JSON or a non-object body is a 400. The response shape and the legacy admin request are unchanged. * test(images): zoomed card keyboard order follows the concept's checkbox before the star The card's Tab order is image, Select checkbox, star, Inspect (concept app.js:398), both ways; List hides the overlays as the concept does, so there the image is followed by Inspect. * fix(api): answer 400 for bulk category ids beyond SQLite's INTEGER range An id of 2**63 or more passed the parser and made sqlite3 raise OverflowError, which the route turned into a 500. * refactor(images): move the selection bar into images-selection.mjs and harden its actions - images.mjs is back under 800 lines; the bar, its checked set, Export metadata and Set category live in images-selection.mjs. - Busy flags release in finally; the dead guards are gone and the category targets are taken when the modal dialog opens. - The category write no longer carries the page signal; leaving Images mid-write drops the saved visit so the return reloads. - The categories and the listing reload together after Set category. - The Category field stops at the server's 100 characters; the server's updated_count is a tested pure helper. - New browser tests: leaving mid-export and mid-write, Blob URL revoke, updated_count 0 and a 400 rejection. - Additive coverage baseline entries for images-category, images-export and images-selection. - TESTING.md D8 records the dialog deviations and these rulings.	2026-10-20 16:04:15 -07:00
Vito	86d82186ee	feat(images): concept Images page — toolbar, cards, star, viewer, compared against the mock (#258) ... * feat(workspace): shared concept toolbar and dialogs Add the concept's shared page toolbar (search.toolbar with the search field, category filter, sort and Filters) and its dialogs in one modal shell: "Refine this view" (Source / Folder / Media / Tags, Apply filters), "Import & inspect" with only the real operations (Open inspector, Rescan), and the "Copy prompt" select-to-copy fallback. The sort lists the concept's three options first (D14); there is no Save view (D16). Every dialog returns focus to its trigger on close or Escape. Refs #249 * fix(workspace): bind shared dialogs to the page and its route - Drop the invented Refine note; every field is real (D14). - Ignore a late close event once the shell was reopened or replaced, so an action that opens the next dialog keeps it open. - Dialog openers require the page scope; disposing it closes and removes the shell unless a newer page's dialog is open. Every route change closes the shared dialog before the next page mounts. - Clear filters also reports category '' so the page clears the toolbar category, as the concept does. - The toolbar requires its scope and falls back to the first sort for an unknown value; dialog callbacks are validated up front. Refs #249 * feat(images): concept toolbar, filter row and caption The Images page now renders the approved mock's heading, shared toolbar, filter row, section caption and infinite continuation (#249, Task C2). - Heading: "Your generations, their prompts, and the next idea." with Import (upload icon) before New prompt (primary). - Toolbar (shared mountToolbar): search over filenames, linked prompt text, titles and tags; category (the Library's categories); sort Recently added / Name A–Z / Highest rated, then Oldest first and Name Z–A (D14). - Filter row: Grid/List/Masonry segmented control, Thumbnail size, the scope chip ("All output folders" or "<source> · <folder>") and "Group by positive prompt →". - Caption: "N of M images · K positive prompts" from positive_count; a plain cursor page keeps the first page's count and an unknown count hides the "· K positive prompts" part. The date span shows "<Today|Yesterday|weekday> · <Month D>" of the newest loaded result under a date sort and is hidden otherwise (D17). - Continuation: "N of M images · more load as you scroll" with Load more, the concept's end copy, Retry for a failed page, and the concept's "K more images loaded. N of M." toast. - The listing sends category, tags and sort=rating (PR B params). Old control -> new control: - "Search filenames" field -> toolbar search "Search workspace" (placeholder "Search prompts, tags, filenames…"), also matching prompt text and tags - Source select -> Filters -> "Refine this view" Source - Folder select -> Refine Folder (all sources' folders and ancestors) - Media select -> Refine Media - (new) Tags -> Refine Tags; Category -> toolbar category select - Sort select (Newest/Oldest/Filename A–Z/Z–A) -> toolbar sort (Recently added/Oldest first/Name A–Z/Name Z–A, plus Highest rated) - Layout buttons -> .segmented Grid/List/Masonry in the filter row - Thumbnail size field -> label.small + select#image-size - "Group by positive prompt" link -> button.chip "Group by positive prompt →" (#/library) - Refresh -> Import -> "Scan an output folder" -> Rescan (D15) - "Current gallery" link -> removed; Overview's tool cards link the legacy gallery (D29) - "All images" h2 + count -> .section-caption #result-count - .image-continuation -> .infinite-continuation (Retry kept) Legacy behavior kept: video items, keyboard grid navigation, scroll and filter restoration, bounded DOM, continuation retry, source-change recovery (now disabling the toolbar, Filters and Import). The Filters and Import dialogs close on route change and browser Back. The shared toolbar (C1) called .some() on select.options, which is an HTMLOptionsCollection in a browser (only the unit tests' fake DOM gave an array); setValue and setCategories now spread it first. The layout segmented control may wrap at extreme zoom (D31) instead of scrolling the 390px page sideways. The retired .image-filters, .image-view-controls, .image-toolbar, .image-layouts, .image-collection, .image-continuation and duplicated .image-workspace grid rules are gone from images.css. * test(workspace): model select.options as a browser collection The toolbar units' fake DOM returned select.options as an Array, so the toolbar's .some() call passed there while it threw in every browser (fixed in 12228e2). options is now an indexed, iterable, frozen HTMLOptionsCollection-like object without Array methods; against the C1 toolbar three units fail with "sort.options.some is not a function". The units also assert that an unknown sort falls back to the first option and that a still-listed category survives a category refresh. * fix(images): concept Load more focus, empty state and review rulings Review of #249 C2: - Load more and Retry focus the first appended image, as the concept does (app.js loadMoreImages). Focus moves without scrolling so the visible cards keep their place (bounded-DOM anchor), and only while focus is still on the pressed control: a viewer or a field the user moved to keeps it. When a last page adds nothing and the button hides, focus goes to the last image, never to the page; a failed page focuses Retry. - The concept's empty state beside the grid: .empty "No matching images. Try another search or category." - D17: the caption date shows only under Newest first (", YYYY" outside the current year) and is hidden under Oldest first and the name and rating sorts. - en-US number grouping in the embedded count too. - Refine "Folder" defaults to the concept's "All output folders". It is not narrowed by Source: the concept has no Source field, and the list holds every source's folders, so any pair can be chosen in one dialog. - The shared toast moves to toast.mjs; library-editor re-exports it. - The D32 overlay (extreme zoom) wraps the layout segmented control and the continuation row instead of pushing them out of the 390px column. - The legacy gallery checks moved to Overview's "Open existing image gallery" card (D29). Mapping additions: grid with no results -> .empty concept copy beside the grid; Load more press -> focus the first new image (concept). * feat(images): concept image cards; image opens the viewer Cards are the concept media card: .media-art > button.image-open with the image or video, and .media-info with the D10 title (linked title only when the link is confirmed, else the filename; title attribute = path), the D11 subtitle "W x H · EXT · Seed N" (seed shown as the listing's string) and an Inspect info button. The byte size and the Preview button are gone. Activating the image (click, Enter, Space) opens the viewer and focus returns to it on Escape; Info selects the image into the panel (D19). Arrow, Home and End navigation, bounded rendering and scroll restoration are kept. Columns and gap now come from the concept grid's computed style (gridMetrics) instead of a production breakpoint table, so the concept breakpoints apply; a 120px minimum card bounds extreme zoom (D3, D31). images.css card rules are retired into marked overlay rules. The scope chip reads "All output folders" when no folder is chosen (D14). * fix(images): pair-linked cards take the positive's title; concept Info, alt and size - Pair links title the card, inspector and viewer from the linked positive's Library title or confirmed first line, never the pair title (the negative variant's name). The card now equals the concept card, title included. - Info drops aria-pressed; the card's .selected carries selection, as in the concept. - Card images take the card title as alt and the listing's width/height. - One shared minimum card width for layout and the narrow-card class. - A debounced search that lands after a sort change no longer reloads page 1. - 200% zoom test also runs at an 800px viewport and device scale 2. Refs #249 * feat(images): concept hover zoom * feat(images): favorite images from the card * feat(images): concept viewer shell * fix(images): one favorite request per file across leaving and returning The pending set and the receiver of each answer now live at module level beside the saved visit. A press on a returned Images page waits for the request the earlier page sent, and its success or rollback reaches the card on screen, or the saved visit when no Images page is mounted. * fix(images): mark a star busy while its favorite request is pending The star carries aria-disabled="true" until the answer arrives, also on a card rendered after returning to Images, so the ignored second press is announced as unavailable instead of doing nothing silently. * perf(images): repaint one card on a favorite toggle instead of the collection stream.updateItem tells onChange which item it patched, and the Images page then skips the full layout pass (computed style, grid metrics and layout over every loaded item) because no card changed size or place. * docs(images): say the lone-star overlay rule is interim until the checkbox PR * test(images): concept comparison for the Images page images-concept.spec.mjs compares the production Images page with the immutable concept on the concept-shaped fixture: heading, toolbar, filter row, caption, grid, the first six cards, continuation and panel box in Grid, List and Masonry, at 1600x1100 and 390x844, dark and light, normal and reduced motion; plus hover zoom, the viewer title, focus restore, Info selection, search and Load more with its toast. mapImagesConcept applies only recorded deviations (D3, D8 and D16 follow-up PRs, D9, D10, D14, D15, D17, D29, D31, D32); removed row items flow again from the concept's own boxes. A mutation check proves the comparison fails on a .media-info padding change and on removed Inspect buttons. Corrections the comparison demonstrated: - the grid and continuation carry the concept's ids (image-grid, gallery-continuation); - bounded rendering reserves the card footer at its fractional height: offsetHeight rounded a wrapped 67.5px row up, so at 390px every card was a pixel taller and the grid 6px taller than the concept. Two mismatches wait for a ruling and are pinned on both sides: the category order (concept prompt order, production alphabetical) and the singular count line ("1 positive prompt"). * fix(images): ignore sub-pixel noise when the measured card footer grows Under page zoom the fractional footer height (rect / scale) can carry float noise above the stored value, which relaid the grid and scrolled for nothing. * test(images): map D35-D37 and widen the Images concept comparison - D35 (singular counts) and D36 (alphabetical categories) are mapped deviations instead of pinned values; a search for exactly one image checks both singular nouns, and a one-image Load more checks the toast and continuation. - Grid, cards and panel at 1200x900 (2 columns, 275px panel) and 1800x1100 (4 columns); Large and Compact join the layout loop. - Masonry tops and heights compare unrounded within one layout unit per card above in the column (D3), not as rounded integers. - The Save view and sample-tag re-layout is checked against the concept page with those items removed at runtime. - The Load more row is compared before the press in both documents (D37). - Two seedless fixture images (seedless_images on the concept reset) prove every row reserves the tallest footer (D3). - D10 paths come from the fixture manifest; the D8 star margin is mapped; list-row derivations cite D3 and D9. * fix(images): search never matches a pair's own variant title Search covers the filename, the linked positive's text and Library title, and its tags (#249 D12). The pair title names a negative variant, so a variant name alone no longer admits the positive's images. * fix(viewer): keep the Media controls group and drop a stale position description The concept viewer toolbar is again a named group (#249 D34 #8), and Previous/Next are described by the position line only while a single item is loaded. * docs(history): drop the remaining-polish notes the concept viewer and cards closed The viewer now takes the concept stage and toolbar, and Images cards open the viewer, select into the panel and favorite. Only the select checkbox (#249 D8 follow-up) and the tag button (#249 D9) stay outside #209. * test(images): the singular copy when scrolling loads one image; countCopy in the shared inventory helper * refactor(images): retire the replaced images.css rules and lint the kept page sheets The unused .image-facts rules go. The three prompt-block overrides on concept selectors are marked #249 D22 interim until PR D deletes the file, and every kept page stylesheet now passes the overlay lint. * test(images): the extreme-zoom anchor probe reads the fractional footer measurement Since the concept comparison (#249 C7) the grid measures footers with getBoundingClientRect, so the probe that hooked offsetHeight never fired. * test(images): cover the masonry fallback when a finite size underflows its ratio * docs(images): concept Images page and recorded deviations TESTING.md documents the Images page controls, the recorded #249 deviations and how the earlier workspace filters moved, and notes that every kept page stylesheet is linted. The frontend coverage baseline adds the toast, toolbar and workspace dialog modules. * fix(images): show that Import → Rescan runs, and how it ended The old Refresh button disabled itself while /gallery/rescan ran; Import → Rescan closed its dialog and showed nothing. Now a toast says the rescan started ("Rescanning output folders…") and how it ended ("Rescan finished. N files in M output folders.", from the scan's own total and roots, or "Rescan could not finish. Try again."). A reopened Import dialog shows Rescan as "Rescanning…" and aria-disabled, and ignores a press on it. Failing before: the held-rescan browser test saw no toast and no busy state; the dialog unit test found no "Rescanning…" button. * fix(images): rewrite the live status only when its text changes A star press republishes the stream, and the textContent setter replaced the continuation status, the count and the caption date with the same text, so a polite role="status" region could announce it again. Text and the role attribute are now written only when they change. Failing before: a MutationObserver saw 10 records on those nodes after a favorite toggle; now none. * fix(images): Refine's Folder list follows the chosen Source The workspace subfolder discovery returned only the union of every source's folders, so "Source: temp" could be paired with a folder that exists only under output and silently match nothing. In workspace mode each root now lists its own folders, and "Refine this view" offers only the chosen Source's folders: changing Source keeps a folder it also has and otherwise returns Folder to "All output folders", as the old field row did when it reloaded a Source's folders. Failing before: the API test found no per-root folders (KeyError), the dialog unit test and the browser test still offered output-only folders under the input source. * fix(images): an unchanged Refine apply keeps the loaded page "Apply filters" (and "Clear filters" with nothing set) reset the stream, refetched the first page and dropped the reader's scroll position even when no filter changed. Like the toolbar's equality guard, an unchanged refinement now does nothing. Failing before: the browser test counted one listing fetch after an unchanged Apply; now none, and the loaded cards stay in place. * fix(images): one discovery alert when sources and categories both fail With the server unreachable on load, the sources and the categories status paragraphs each fired role="alert" back to back. The page now keeps one alert, written once both first loads settled, naming whatever failed ("Sources, folders and categories could not be loaded. Rescan from Import to retry." when both did). Failing before: getByRole('alert') resolved to two elements. * fix(images): sort toolbar categories alphabetically on the client D36 promises alphabetical real categories, which held only while the server sorted them and a restored category was among its list. The page now sorts them case-insensitively itself, a restored category included. Failing before: the toolbar listed a server's [zeta, Alpha, beta] in that order. * refactor(db): drop the unused pair title from the link summary query _link_summary has not read the pair's own title since the card took the linked positive's Library title (D10), so the query no longer selects it; the row indexes and the stale comment are updated. All values stay bound. Failing before: the summary SQL still selected pp.title. * test(images): end negative checks on real signals, not fixed sleeps The "no second request" checks waited a fixed 150 ms or 1000 ms and the hover probe 450 ms, which can pass vacuously on a slow Firefox or WebKit run. They now read the fetches the page's code started (the API client calls fetch in the same task as the press), wait for a timer of the toolbar's own debounce delay set after the debounced report, and wait for the hover transition to finish. Checked by mutation: without the favorite pending guard or the toolbar equality guard, the rewritten checks fail. * docs(testing): record the Rescan feedback, Source-bound folders and category sort The Images contract now names the Rescan toasts and busy state (D15), the Folder list that follows Source and the no-op unchanged refinement (D14), and the page-side category sort (D36). * test(viewer): escape every regex metacharacter in the filename match * fix(viewer): title a linked card at once instead of waiting for its inspection On a slow runner the viewer showed only the filename until the inspection answered, while the concept titles it immediately. The card's linked title is already loaded, so the header uses it on open. The favorite test now waits for the first request to settle before the Space press, which the one-request-per-file guard otherwise ignores. * fix(images): cap the search at the listing API's 500 characters A longer paste was sent as is, the API rejected it and the collection showed "Images could not be loaded". The legacy search capped it.	2026-10-20 11:31:53 -07:00
Vito	9d398f9862	feat(workspace): concept shell — sidebar, topbar, heading and footer on the approved mock's CSS (#256) ... * build(workspace): vendor the approved concept stylesheet with a drift check * refactor(workspace): adopt the concept stylesheet as the workspace base * feat(workspace): concept sidebar with real navigation counts * feat(workspace): concept topbar with Theme and ComfyUI link * refactor(workspace): one concept heading and footer for every route * fix(workspace): keep the canvas link on the proxy mount A resolver failure no longer stops the shell from mounting: the ComfyUI link falls back to the root read from the page's own mount path (never another origin). Tests cover a non-standard /ComfyBackendDirect mount, including that no request escapes it. * test(workspace): concept fixture and shell comparison * test(workspace): concept fixture carries the concept inspector facts * fix(workspace): match the concept brand name and compare shell hover states * test(workspace): shell comparison mutation check and docs Add mutate() to the shared concept inventory and a shell mutation check: a nav-row min-height rule and a removed .breadcrumbs each make the comparison fail with the changed path. Harden the resolver-failure guard test with an injection count, make the overlay lint fail when workspace.css is missing, mark the library.css .row-actions leftovers for PR E, and document the concept CSS base, the overlay lint, the comparison method and the recorded shell deviations in TESTING.md. * fix(workspace): focus the page title on a route change A sidebar or history navigation now focuses #page-title, as the concept does on every hashchange (app.js 1168), so a screen reader announces the page heading instead of the main region. The first render leaves focus alone and the skip link still focuses main. The heading module's comment now describes what the shell does. * fix(workspace): give the Overview nav entry its own home glyph Overview reused the concept's Activity pulse byte for byte, so once the Activity row lands two entries would share one icon. Overview now has an outline home glyph. The shell comparison takes it from the D28 ruling instead of the concept's activity path, and the icon test checks that every approved glyph is distinct. * test(workspace): accept only #249 decision markers and state the lint scope The overlay lint accepted any D-number, so another issue's ruling such as "D5 (#245)" could mark a concept override. A marker now has to be a D-number with no other issue cited; the vocabulary rule that cited #245 reads "#245 decision 5". TESTING.md now states that the lint covers workspace.css only, lists the unmarked overrides still in images.css, and says PRs C and D run the lint over each page sheet they keep. * perf(workspace): re-read only Library and Tags counts after a Library write A confirmed Library or vocabulary write cannot change the Images count, but it re-read all three, including the Images output listing. It now re-reads only the Library and Tags counts. Each count has its own read, so a write never cancels an Images read that is still in flight.	2026-10-19 23:04:40 -07:00