46 Commits

Include renames

Author	SHA1	Message	Date
Vito	6c82098207	feat(images): data for the concept cards — linked titles, seed, search and filters, counts, favorites (#257) ... * feat(images): link summary on workspace image items * fix(images): carry title source and cut first-line titles like the Library Summaries gain title_source (stored or text). The inspector always shows a stored title and confirms only a first-line title against the file, so a stored title equal to the first line is no longer withheld. A link-title read failure no longer marks a readable link unavailable. First-line titles over 80 characters end with an ellipsis, as the Library's title() does. The card gate for unconfirmed first-line titles is pinned as an expected failure for B2. * feat(images): unambiguous seed on workspace items Workspace items gain `seed`, read with the shared generation-parameter parser from the prompt/workflow records the header open already loaded (each at most 2 MiB; no extra file reads, videos give None). A placeholder or non-integer seed gives None. JSON integers beyond 2**53 are recovered exactly, so the card prints the digits the inspector shows. The same parse confirms first-line card titles: a `text` title shows only when the file's parsed positive gives the same title. One helper applies that rule on the card and in the inspector, which now reads the positive from its own inspection records with the same parser. * fix(images): a deeply nested record no longer fails the workspace listing The Python parser recurses over nested arrays where JavaScript String() does not, so a crafted 2 KB PNG turned every workspace page holding it (and its inspect route) into a 500. Card facts now treat RecursionError like any record the parser cannot use: no seed and no confirmed title. Also: Library previews skip the card parse they never show; the parse runs after the file handle closes; the exact-seed read uses the one JSON reader (parse_js_json(..., exact_integers=True)) and the public number_string; record size is decided from the text length unless only the UTF-8 byte count can tell. * feat(images): search and filter workspace images by linked prompts The workspace listing now takes category (exact), tags (comma list, all required) and sort=rating, and q also matches the linked positive's text, Library title, pair title and tag names. One bounded, parameterized SELECT (get_image_link_matches / get_image_paths_matching) returns normalized paths of unambiguously linked images; the listing is intersected with it. Unlinked and ambiguous files are excluded by a category or tag filter and sort last by rating, with a newest-first tie-break. The cursor scope covers the new filters and sort; unknown values are still rejected. The derived listing values and sort orders are cached per gallery scan so a 50,000-file listing with 20,000 links pages well under 150 ms at p95. * test(images): count the filter budget everywhere, time it in one job The 150 ms wall-clock budget failed under the CI coverage tracer, so it is split. test_filter_work_is_bounded runs on every job and under coverage: one filter SELECT per request, the ambiguity probe is an index search (EXPLAIN QUERY PLAN), the per-scan values are built on the cold request only, and a cursor page calls the sort key at most ceil(log2 n)+3 times. test_filter_budget runs only with PROMPTMANAGER_PERF_BUDGET=1 and no tracer, asserts the best of three rounds' p95, and has its own non-required "perf budget" job. TESTING.md records the convention. * fix(images): rating sort works however many link rows the database holds The filter SELECT counted every generated_images row against a 500,000 row cap and materialized all of them first, so a large history made sort=rating answer 400 with nothing to narrow. The rows are now streamed and only paths in the listing's normalized set are kept, so memory is bounded by the listing; the cap and LinkFilterTooBroad are gone. * fix(images): rebuild workspace listing values only where the scan changed A TTL rescan that finds the same files reuses the previous values and sort orders; one that finds a few changes rebuilds only those files. Gallery invalidation and a gallery-roots change drop the derived values, so old roots no longer hold memory. category is trimmed like tags. * fix(images): a monitor invalidation rebuilds only the new files' values The image monitor invalidates the gallery whenever it sees a new file, and that dropped every derived workspace value, so the next request paid a full cold build. Invalidation now keeps the per-file values and drops only the sort orders; the rescan reuses every unchanged file and builds only new or changed ones. A gallery-roots change still drops everything. * feat(library): expose run count, last use and variant totals * fix(library): an out-of-range last use reads as unknown, not a failed list * perf(images): read positive counts only on a plain listing's first page * feat(images): persist image favorites Favorites are stored in image_favorites keyed by the gallery root label and the relative path, set and cleared through PUT/DELETE /prompt_manager/images/favorite with a {root_index, path} body validated against the rooted listing. Workspace image cards carry favorite: bool. The table is created by migration, travels with backups, is optional in old backups and required after a restore's migration. * fix(images): key favorites by the real root and case-normalized path Folder names are not unique across gallery roots, so two roots shown as "output" shared each other's stars. Favorites are now keyed by the root's real, case-normalized path (server-side only) and a case-normalized relative path, so a Windows case-only rename keeps its star while distinct Linux files stay distinct. Toggles look the file up in a per-scan dictionary instead of walking the listing. * fix(images): favorites lookup follows monitor invalidation and the stored key bound A monitor invalidation now also drops the favorites lookup, which held the previous scan list until the next toggle. PUT refuses a favorite whose root or relative key would exceed the schema's 4096-character bound, so the live database keeps passing startup and restore validation. * docs(testing): workspace data fields for the concept pages * fix(images): card facts read the inspector's projected graphs The inspector hands its browser parser only graphs the inspection projection parsed (strict JSON, depth 64, node ceiling); a deeper record is "limited" there, so the legacy fill never runs and no seed shows. The card parsed the raw records instead and showed a seed the inspector did not, e.g. for a 900-deep class_type beside a normal sampler. project_graph() is now the one projection step, used by the inspection response and by the card. The card runs the shared parser on the projected graphs, the same values the browser receives: big integers arrive as their exact digits, so the separate exact-integer re-parse and the parse_js_json flag it needed are gone. * fix(images): send the card seed as a decimal string JSON.parse rounds a number past 2**53, so a listing seed such as 9223372036854788153 reached the page as 9223372036854788000 while the inspector showed the file's digits. Every non-null card seed is now its decimal string. The Node parity harness now JSON.parses the real listing response and compares String(seed) with the seed the inspector shows, including a seed past 2**53. TESTING.md describes the string contract and drops the removed exact re-read. * fix(images): bound digit-string seeds and isolate each card's parse A seed recorded as a 5000-digit string reached int(), which raises ValueError past Python's integer string limit, and the listing answered 500. A digit-string seed now has at most 20 digits (2**64 fits), and the conversion falls back to no seed on ValueError. Each card's parse is also guarded in the page builder: an unexpected error in one file's records logs a warning and gives that card no seed and no first-line title, and the rest of the page still lists. * fix(images): filename search survives a failed prompt-link read On main a workspace q matched only file paths, so search worked with a broken database. Since search also matches linked prompts, any q turned a failed link read into a 500. A q without category, tags or the rating sort now falls back to filename matches with a null positive_count and logs the failure with its traceback; those linked filters still fail. * fix(images): card reads PNG records with the inspector's reader The card read PNG text through Pillow's header info, where a later duplicate prompt chunk silently wins and text after IDAT is missed. The inspector's bounded reader refuses conflicting duplicates and reads text after IDAT, so a file with two different prompt chunks showed a card seed the inspector refused. PNG cards now read their records with read_inspection_file, the reader the inspector uses. When it refuses a file the card keeps its dimensions from Pillow and shows no seed. Other formats still use Pillow's header info, as the inspector's header read does. * perf(images): read each card's header facts once per gallery scan Every page parsed each card's prompt and workflow records again, about 3.4 ms per 50 KB record set and 25 ms per 400 KB workflow, inside ComfyUI's server process, on every scroll-back and refresh. Dimensions, the seed and the parsed positive's display title are now cached per root by (path, mtime), beside the scan's per-file values and invalidated the same way: a rescan keeps unchanged files and prunes the rest, a roots change drops them all, and only files of the current scan are stored. An unreadable header is not stored. Links and favorites are still read on every page. * ci: run the perf budget on main pushes and on demand only The wall-clock budget has under 2x margin on shared ubuntu runners, and a red exact-head check blocks a merge that must never be rerun to green. The job now runs on each push to main and on workflow_dispatch, not on pull requests. TESTING.md says a red run on main means fix the code. * fix(library): cut display titles at 80 UTF-16 units, never inside a pair The server counted code points while the Library's JavaScript counts UTF-16 units, so a first line of emoji kept 80 emoji on cards but showed 40 in the Library. Both now cut at 80 UTF-16 units and drop a character that would straddle the limit instead of leaving half a surrogate pair.	2026-10-20 00:18:32 -07:00
Vito	a44cd27c2e	fix(parse): build array String() without recursion (#255) ... utils.generation_params converted nested arrays to strings recursively, so a crafted file with a value nested about 900 arrays deep raised RecursionError, where the browser parser returns a result. The join now runs on an explicit stack. A JS-parity case with 900-deep values pins it.	2026-10-19 22:04:32 -07:00
Vito	36564b4767	feat(parse): one generation-parameter parser in Python; scan links what the resolver cannot decide (#253) ... * feat(parse): port the browser generation-parameter parser to Python Adds utils/generation_params.py, a line-for-line port of extractGenerationParams in web/js/comfy-metadata.js, the parser behind the gallery, admin and metadata pages. The scan and live monitor can use it so every surface reads prompts the same way. The JavaScript parser is unchanged. The port reproduces the JavaScript value semantics the result depends on (property order, truthiness, String(), trim(), strict equality, Map keys, JSON.parse number rounding, and the inputs on which it throws), and runs its recursive tracing on an explicit stack so crafted graphs cannot exhaust the Python stack. Tests: - behaviour tests for each tracing rule, with JavaScript results as expected values, including the visit-limit boundary; - golden vectors of the JavaScript parser's results for every named case and every PNG fixture, so the comparison runs without Node; - a live comparison against the JavaScript parser when Node is present; - a randomized differential test over 9,000 generated graphs and workflows, coherent and corrupted, including inputs where the JavaScript throws. Five deliberate porting mistakes (trim, truthiness, prepend handling, visit limit, pair slot) each fail the tests. On a 38,602-file output folder, all 18,491 files with a workflow give identical results. * fix(scan): link the traced prompt when the pair resolver cannot decide The output scan skipped every file the pair resolver called ambiguous or unresolved, so workflows where several samplers share one prompt (a base pass, an upscale pass and a detailer) never reached the Library from a scan. It now links the positive prompt the shared parser traces for those files, the prompt the inspector and the legacy pages show. Files the resolver decides are stored as before, and graphs without a recognized sampler keep the legacy extractor (#252). Read-only scans of a 38,602-file output folder into temporary databases: - links: 1,500 before, 7,954 after; none of the 1,500 dropped or changed; - of the added links that differ from the pre-redesign scan, 1,275 replace a number, a LoRA tag, a fragment or a truncated prompt that scan stored. * refactor(parse): return a uniform pair from the SameValueZero key	2026-10-19 20:56:51 -07:00
Vito	6d2213ead5	feat(inspect): declarative node support matrix (#250) ... * feat(inspect): add a declarative inspection node semantics table * fix(inspect): bound and isolate the semantics table Bound the semantics loader: at most 1 MiB is read, containers may nest at most eight levels, and a RecursionError from the JSON parser becomes a SemanticsError instead of escaping. The table is no longer loaded at import. get_semantics() reads it on first use and caches only a valid result, and the resolver imports it lazily, only for a profile with semantics on. The default ingestion profile never imports the module, so a missing or corrupt table cannot break scan, monitor or admin import. Inspection of a prompt graph with an unusable table is unresolved with the reason "Inspection node semantics are unavailable" and an error log, rather than a crash. INSPECTION_PROFILE now has semantics on; no strategy consumes the table yet, so resolution is unchanged. * feat(inspect): resolve guider-based samplers Under INSPECTION_PROFILE the resolver discovers samplers from the semantics table and follows SamplerCustomAdvanced through its guider link (Reroutes allowed) to a listed guider: - CFGGuider: positive and negative, so the pair resolves. - BasicGuider: positive only. The state is "absent" with the reason "Guider has no negative input", the existing missing-negative path. - Any other guider, including DualCFGGuider (D17), is unsupported-node and names that guider. Guider hops draw visits, scan and depth from the existing budgets. A SamplerCustomAdvanced upstream in latent ancestry is an earlier stage, so the result stays multistage-ambiguous. Positive and negative provenance record guider_id. FaceDetailer (detailer-stage) is not a candidate yet: deciding it needs output ancestry. DEFAULT_PROFILE never loads the table and is unchanged. Vector changes (inspection profile only, default vectors unchanged): - f07b: no-sampler -> resolved (CFGGuider). - f17: no-sampler -> unsupported-node (FluxGuidance, Task 2.3). - f01b: no-sampler -> unsupported-node (EmptyFlux2LatentImage latent, Task 2.5). - f01: no-sampler -> ambiguous (24 SamplerCustomAdvanced branches). The no-sampler tests (resolver and inspect route) now use a sampler class the inspector does not know, because f17 has a supported one. * feat(inspect): trace conditioning through supported pass-through and selector nodes * feat(inspect): treat detailers as sampler stages * fix(inspect): choose selectors that share one condition together * fix(inspect): bound detailer stage chains by the depth limit * feat(inspect): support common text encoders and string sources * fix(inspect): keep pair execution evidence behind unreadable string sources * feat(inspect): accept any non-sampler latent origin * fix(inspect): queue each node once in breadth-first ancestry walks The latent and detailer image walks queued every link before checking whether its node was already seen, and popped from the list head. A dense shared fan-in grew the queue far past the visit budget before any visit was charged. Both walks now use a deque and enqueue each node at most once, charging every examined edge as scanned work; outcomes are unchanged. * fix(inspect): treat unlisted pipe and embed samplers as possible stages The latent and detailer ancestry walks only flagged unlisted nodes with a linked latent_image, guider, positive or negative input, so easy-use pipe samplers, Impact pipe detailers and embed-driven video samplers were walked through and the final sampler's prompt resolved silently. A separate stage-shaped input set (adding pipes, embeds and custom-sampler parts) now makes such nodes unsupported-node, named. * fix(inspect): walk each sampler's latent ancestry once per resolution Every selector branch run and candidate re-walked the same latent ancestry, so conditioning-carrying origins such as WanImageToVideo turned a three-selector graph from ambiguous into work-limit. The walk outcome is now cached per sampler; branch runs of one candidate pay for it once and other candidates are charged its visit cost, as the text memo does. Walks that ran out of work are not cached. Every link input is still walked. * fix(inspect): treat unlisted model-driven samplers as possible stages Unlisted samplers that link a model with conditioning or a latent under other input names (XlabsSampler, generic video samplers) were still walked through, so the final sampler's prompt resolved silently. An unlisted node with a linked model plus conditioning, neg_conditioning, samples or latent is now unsupported-node, named; model patches such as LoraLoader and ModelSampling nodes are not. * feat(inspect): compute facts from the resolved sampler * fix(inspect): merge facts across sampler branches when ambiguous * fix(inspect): merge facts over unresolved stages and share stage inputs via the table * feat(inspect): explain why a prompt could not be resolved * feat(inspect): port legacy parser rules the new resolver missed (PromptManager) R1: before 3.2.3 a save patch overwrote every PromptManager node's saved text with the last-run node's prompt. The legacy viewer recognizes the signature (comfy-metadata.js createContext: two or more PromptManager workflow nodes with one API text and different widget values). Inspection now refuses those nodes as malformed instead of resolving to another node's prompt; the inspector hands the parsed workflow to the resolver for this check only. Lands before the new pass-throughs (R6) that would otherwise make these graphs resolve to the wrong text. R7: this repository's node classes up to 07a5af3 (PromptManagerV2, Positive, Negative, Detailer, V2Text, PositiveText, NegativeText) resolve with their own outputs and their exact strip and ", " join. The default (ingestion) profile ignores both. * feat(inspect): port legacy parser rules the new resolver missed (A1111) R3: an accumulating batch saver repeats the A1111 parameters record once per batch item, identical except "Batch index: N". The bounded PNG reader now keeps the last copy (Pillow's rule, which #165 relied on) instead of calling the file unreadable. Any other difference, including a missing or second batch index, is still a conflict, and decoding the copies draws from the duplicate role budget. R4: parameters text that starts with "Negative prompt:" has an empty positive (#165), instead of showing the delimiter line as the positive. R5: the settings footer may be followed by sd-dynamic-prompts' one-line "Template:" and "Negative Template:" records, and may be "Steps: N" alone when there is no full footer. R10: commas inside A1111's quoted settings values no longer split them, so an "ADetailer prompt" with a comma keeps the other facts known. The facts' A1111 reader mirrors R4, R5 and R10; the default (ingestion) profile keeps the historical split. Also from the Task 2.7 review: a guard test fails on any uncoded unresolved reason without a user line (M1), and the encoder bounds role lines to the client's 512 code units (M4). * feat(inspect): port legacy parser rules the new resolver missed (installed nodes) R6 and R9 for nodes whose sources are installed beside ComfyUI, each entry's input names and output slots read from the node's code (the task report lists file and line): - detailer stages UltimateSDUpscale (image), UltimateSDUpscaleNoUpscale (upscaled_image) and DetailerForEach (image), judged with their upstream samplers like FaceDetailer; - pass-throughs ControlNetInpaintingAliMamaApply and LTXVConditioning (positive 0, negative 1) and FluxKontextMultiReferenceLatentMethod; - encoder Text to Conditioning, strings TextInput and DisplayText; - facts model pass-throughs Lora Loader (LoraManager), Power Lora Loader (rgthree), ModelPatchTorchSettings, CFGNorm, PerturbedAttentionGuidance. Impact Pack encodes a detailer's non-empty wildcard instead of its positive input, so FaceDetailer and DetailerForEach now list it as a prompt override: a literal wildcard is decided at run time and a linked one names its source, instead of resolving to the positive input. The overwritten PromptManager refusal (R1) still holds behind the new pass-throughs. The default profile does not read the table. * feat(inspect): port legacy parser rules the new resolver missed (upstream nodes) R6 and R9 for nodes not installed beside ComfyUI here. Their input names and output slots come from each pack's source at the commit the saved workflows record in the node's cnr_id and ver properties (the task report lists repository, commit, file and line): - samplers ClownsharKSampler_Beta (RES4LYF), KSampler (Efficient) and ttN KSampler_v2 (latent input "latent"); - pass-throughs SeedVarianceEnhancer and ApplyInstantIDAdvanced (positive 1, negative 2; output 0 is the model); - selector Switch conditioning [Crystools]; - encoder smZ CLIPTextEncode: its text when with_SDXL is false; when true the connected CLIP decides at run time which inputs are read, so the prompt is known only when text, text_g and text_l agree; - strings ttN text, CR Text, CR Prompt Text and TextBoxMira; - facts model pass-through CR Apply LoRA Stack. Inputs that replace what a sampler reads are not followed: RES4LYF options (may carry a guider, and with sigmas replace the settings), an Efficiency script and a ttN XY plot leave the prompt unsupported and the facts unresolved. The overwritten PromptManager refusal (R1) still holds behind SeedVarianceEnhancer. The default profile does not read the table. * test(inspect): cover batch copies past the role budget and orphan widgets * fix(inspect): match the batch index only in the settings footer Review I-1: duplicate A1111 parameters copies were compared after blanking "Batch index: N" anywhere in the record, so copies whose prompts differ only by that phrase were accepted. The field is now blanked only inside the record's one "Steps: N, ..." footer line, which must hold it exactly once; any other difference stays a conflict. Review M-4: the inspector parses the workflow record only when the API graph can show the overwritten-PromptManager signature (a PromptManager class, or a node with PromptManager's search_text input). * fix(inspect): refuse overwritten PromptManager text inside subgraphs Controller ruling on review M-1: PromptManager nodes inside subgraphs run as "<instance>:<inner>" API IDs, nested instances chaining their IDs. The overwritten-text check now walks subgraph instances (bounded in depth and nodes) and reads a text widget stored by name, so these nodes are refused like top-level ones, anchored or not. A definition without an instance runs nothing and is ignored. Review M-5: the historical adapters skip an explicit null prepend or append, as the 07a5af3 code's "if prepend_text:" did. * test(inspect): import unittest one way in the inspection suites Code scanning flagged the mixed 'import unittest' and 'from unittest import mock' forms. Use 'import unittest' plus 'import unittest.mock' everywhere. * fix(history): name the recorded run's current-file prompts apart from its frozen fields Now that the inspector resolves more saved files, the Recorded run dialog can hold two regions named "Positive prompt" (and two of each Copy/Send action): the frozen run field and the inline current file's prompt. Assistive technology could not tell them apart, and the real-host chronology test read two <pre> elements. Prompt blocks take an optional context label. The inline current file inside a recorded run names its regions "Current file positive prompt" and its actions "Copy/Send current file positive prompt"; the visible headings stay as in the concept. The real-host test now also scopes its frozen-field reads to the "Frozen run prompt texts" section, and a disposable-server workflow pins the distinct names with a resolved current file. * fix(inspect): drop preview-only stages from unanchored candidates A stage whose outputs reach only non-file outputs (PreviewImage and the other non_file_outputs) cannot have written a saved file, yet it stayed an unanchored candidate, so a preview-only FaceDetailer made the saved branch ambiguous (f01b). The inspection profile now drops such stages before detailer absorption, using two linear backward passes over the graph (charged like the consumer map; a failed pass keeps every stage). A stage without consumers, or one that also reaches any other terminal, is kept, and nothing is dropped when every stage is preview-only. Raw plus detailed double saves both write files and stay ambiguous. A file in the host temp folder may itself be a preview, so it is inspected with PREVIEW_INSPECTION_PROFILE, which keeps those stages. Workspace facts follow the same choice: an absent or unresolved result that names a sampler merges facts across that sampler's stages only, so the dropped detailer's settings no longer blur the saved file's facts. f01b now resolves (absent negative, guider has none); its vector is updated and the expected failure removed. The default profile is unchanged: differential against 39dcc40 identical over 160,256 cases. Over 60,054 inspection cases no previously resolved or absent result changed. * fix(history): name the current file's prompt pair button apart from the frozen run's The recorded run dialog nests the current-file inspector, whose footer repeated the "Send prompt pair" name. Name it from the prompt context, scope the real-host test to the frozen region, and add a dialog-wide duplicate-name check.	2026-10-19 17:26:37 -07:00
Vito	1ba9e22824	fix(database): stop SQLite write-lock starvation under concurrent saves (#246) ... * test(database): require identical WAL/NORMAL settings on managed connections (#242) Concurrent writers failed with 'database is locked' on Windows runners despite the 30 s busy timeout: every WAL commit flushed to disk while it held the write lock, so polling waiters starved. These tests pin the shared per-connection settings, including synchronous=NORMAL in WAL mode. * fix(database): stop WAL commits from holding the write lock across a flush (#242) Every managed connection now goes through configure_connection: WAL, foreign keys, the 30 s busy timeout and, when WAL is active, synchronous=NORMAL. Under FULL each commit flushed to disk while it held SQLite's only write lock; on slow Windows disks a burst of writers (a scan beside ComfyUI saves, or the concurrency tests) starved a polling waiter past the busy timeout and it failed with 'database is locked'. With a 60 ms emulated flush on Linux, 8 threads x 50 save+use calls went from 49.6 s with a 32.1 s worst call (and 'database is locked' in the unit test) to 0.7 s with a 0.4 s worst call. NORMAL in WAL mode keeps the database consistent after an application crash; only an OS crash or power loss can drop the most recent commits. In-memory or non-WAL databases keep SQLite's FULL default. * test(history): hold the first concurrent writer open past the bounded wait (#242) The concurrent replay tests expected every peer to succeed, but each peer only waits 250 ms for BEGIN IMMEDIATE by design. On a slow Windows runner three queued commits exceeded that and a peer raised 'database is locked'. Holding the first writer's transaction open for 500 ms makes the same failure deterministic on any host (20/20 locally). * test(history): let concurrent replay peers queue like ordinary writers (#242) History writes deliberately give up after a bounded 250 ms wait so they never stall ComfyUI; the existing bounded-timeout test still proves that. The concurrent replay tests assert that every peer succeeds, which is a serialization and first-capture property, so they now raise the budget to the shared 30 s busy timeout while the first writer is held open. The budget is one named constant, EXECUTION_BUSY_TIMEOUT_MS, shared by the transaction helper and the background writer. Before: 20/20 'database is locked' with the held writer. After: 0/20. * test(history): wait on restore handoff events, not a 5 s clock (#242) The retired-owner projection tests park a history read at a barrier while the test performs a full multipart restore, then release it. The barrier gave up after 5 s and raised inside the route handler, so on a slow Windows runner (a 694 s suite run) aiohttp answered with its text/plain 500 and the test reported 'history route missing'. Every wait already ends on an event; the ceiling now only stops a broken test from hanging (60 s). With restore slowed by 5.5 s locally, all 8 subtests failed with text/plain before and pass after. * docs(testing): add the concurrent SQLite test rule to the Windows preflight (#242)	2026-10-19 11:10:47 -07:00
Vito	048d599386	fix(inspect): bound inspection work, not graph size (#244) ... * test(inspect): add synthetic inspection parity fixtures and legacy characterization * test(inspect): pin test-time parity vectors and keep fixtures fully synthetic * fix(inspect): bound resolver work instead of graph size * fix(inspect): bound shared-node and stripped-text work in the inspection profile Keep one memo per resolution whose entries carry their unfolded visit cost; a memo hit charges that cost to the current candidate's allowance only. Cache node validation and charge input keys, stripped characters and copied provenance entries to a whole-resolution work budget before doing the work. The default profile is unchanged. * fix(inspect): keep memoized depth honest across inspection candidates A memo entry now records its height below the reusing depth; a hit raises depth-limit exactly where a fresh walk would, so each candidate's outcome matches its anchored result and does not depend on trace or node order. The default profile is unchanged. * test(inspect): pin memo height propagation Three samplers share one chain, each later one hanging below a memo hit. The third candidate must report depth-limit in both trace orders and when anchored; removing the memo-hit height propagation fails this test. The provenance test now asserts a plain subset. * fix(inspect): tolerate ComfyUI node metadata quirks in projections Projections now take a kind. Each prompt node keeps exactly class_type and inputs; _meta, is_changed and other node keys are validated and dropped, so "is_changed": [NaN] no longer marks the whole prompt graph malformed. A nonfinite value inside inputs, anywhere in a workflow, or in a retained carrier member projects to null and is never reported as a number. The carrier applies the prompt/workflow kinds to its members. Exact numbers are unchanged (Decimal spelling, unsafe integers as strings) and duplicate keys are still malformed. The 500-node gate is replaced by a 20,000-node backstop (workflow count includes subgraph definitions). Raw records are untouched. The f14 inspection vector's facts become known; default vectors are unchanged. * fix(inspect): budget metadata per record so large workflows never hide prompts PNG inspection no longer counts every text chunk against one shared 2 MiB budget. Role records (prompt, parameters, the pair execution record) keep a 2 MiB budget together, encoded and decoded, and exceeding it still fails the whole read. A workflow has its own 4 MiB budget: a chunk over it is skipped by seek, and a compressed one stops inflating at budget + 1. Only the workflow is then reported as limited (record format "limited", no raw text, workflow_graph limited); prompts, facts and the prompt graph are unaffected. Each text chunk's keyword is read first (at most 80 bytes). Chunks that are not retained are skipped by length without being read or checksummed, so memory stays bounded. Byte-identical duplicates of a retained record are accepted and do not consume budget; differing duplicates still raise "Duplicate prompt metadata", and a duplicate of a limited workflow stays limited. The chunk-count limit is unchanged. InspectionRead gains limited_records (empty by default). The reader is only used by the inspection routes, so ingestion, scan and import are unchanged. Vectors: f04-inspection (2.5 MB workflow, within the new workflow budget) and f15-inspection (identical duplicate chunks) now read and resolve, with the same outcome and facts as f05-inspection. Default vectors are unchanged. * fix(inspect): keep prompt evidence longest under the response budget * fix(inspect): bound identical duplicate chunk reads * fix(inspect): fail closed when role duplicates exceed their budget * fix(inspect): use the bounded inspection profile end to end Inspection routes resolve with INSPECTION_PROFILE and expose reason_code and node on the resolution; scan, live monitor and admin import keep the default profile (pinned by spies over the real resolver on f03). JS facts drop the entries and workflow node-count gates; per-lookup visit sets and the server's node ceiling bound the work. The validator accepts the textless `limited` workflow format, follows the workflow-first response omission order, and checks the closed reason-code vocabulary. The file inspector labels limited records and disables their workflow download. vectors.json: 12 inspection vectors gain their reason codes; f03 facts become known and f01 facts ambiguous. Default vectors are unchanged. A new parity test asserts vectors.json facts through the workspace JS. * chore(tools): add read-only inspection corpus tool tools/inspection_corpus.py runs the inspection route pipeline and the workspace JS facts of a chosen code tree over a media folder, read-only, and reports the #240 invariants H1 to H8 with aggregate counts. Rows hold statuses and SHA-256 digests of resolved role texts, never file names or prompt text unless --with-paths is given. Outputs inside the root or a code tree are refused. The facts-over-vectors test now fails instead of skipping when CI is set and Node.js is missing. * docs(testing): document bounded inspection work * fix(tools): fail the corpus run when facts or inspection did not run Rows whose facts were never computed (no or exiting Node.js) now fail H3, and a new harness line fails on any tool exception or missing facts, so a run where nothing was measured can no longer exit 0. Unreadable files stay inspector outcomes. A missing --node binary is refused, an exited harness is reaped, H8 has a 50 ms floor for tiny baselines, and JSONL rows are sorted by id. * docs(inspect): correct ceiling wording and bandit annotations Describe the two 20,000-node ceilings (prompt entries, workflow UI plus subgraph nodes) in TESTING.md, and use bare nosec ids so Bandit stops warning about unparsed test names. * test(inspect): make parity observation tuples explicit	2026-10-19 09:54:29 -07:00
Vito	ecd21165a7	feat(history): add chronological runs and exact output inspection (#227) ... * feat(history): add bounded chronological read projections (#209) * fix(history): validate internal continuation positions (#209) * feat(history): expose fenced history windows and run details (#209) * fix(history): release retired projection connections (#209) * feat(history): resolve reported outputs through current authorization (#209) * fix(history): reject invalid inspection targets (#209) * feat(history): add scoped history state and current-file adapter (#209) * fix(history): preserve slideshow and clear stale reentry actions (#209) * feat(history): render recorded executions and frozen run details (#209) * fix(history): recover receipts and refresh capture evidence (#209) * test(history): verify chronological history across restore and host modes (#209) * fix(history): enforce chronological marker visual parity (#209) * fix(history): resolve final chronological review findings Address #209 recovery, bounded visit restoration, exact receipt availability, and portable regression coverage. * test(history): repair Windows fixtures and review feedback Address #209 and PR #227 native path, cleanup, media and review-comment expectations. Document Windows portability preflight without changing production behavior. * ci: raise the viewerjs job budget for the larger browser suite The cross-browser workflows suite grew from 396 to 496 tests on this branch, which pushed the whole viewerjs job to about 25.5 minutes against the 25 minute cap set in #181. Two exact-head runs on this branch timed out without any test failing: run 39173019283 was killed on test 474 of 496, and run 39175125474 printed "496 passed (12.8m)" and was then cancelled during Playwright shutdown. Raise only the job budget. Browser projects, workers and per-test timeouts are unchanged. Splitting the browsers into parallel jobs is tracked separately.	2026-10-18 17:17:05 -07:00
Vito	ac23f22a37	fix(logging): close retired owned handlers (#225) ... * fix(logging): close replaced owned handlers (#218) * fix(logging): keep retired file handlers closed (#218)	2026-10-18 10:01:19 -07:00
Vito	d9537a726c	feat(workspace): complete shared inspector and collection viewer (#224) ... * feat(inspector): expose bounded physical file evidence * fix(inspector): distinguish ambiguous saved associations * feat(inspector): derive conservative generation facts * fix(inspector): guard fact ancestry and inspection state * feat(inspector): share complete file details and exports * fix(inspector): preserve fact states and touch targets * feat(viewer): navigate the loaded media collection Refs #216 * fix(viewer): refit after current stage geometry changes Ref #216. Observe the current media stage after readiness and wrapped title changes without rebuilding focused controls or resetting transforms at unchanged dimensions. * feat(viewer): add lifecycle-safe slideshow and media preferences * fix(viewer): resume gallery continuation after close (#216) * fix(images): guard source recovery and wrap viewer actions Clear stale root and folder intent, cancel old pages, and wait for current source discovery before loading a refreshed collection. Preserve safe retry through failed, superseded, and disposed discovery. Wrap narrow viewer footer actions and wait for measured gallery viewport settling in responsive checks. Refs #216; addresses PR #224 review. * test(viewer): await gallery layout after viewport changes Require actual inner, root client, and document widths to agree after each responsive-case viewport and CSS zoom transition. Keep the existing exact frame, overflow, focus, and coarse target assertions unchanged. Observed PR #224 CI initial mobile resize at537px before pending card relayout settled to356px. Refs #216.	2026-10-18 09:41:53 -07:00
Vito	4ef236aaf7	feat(history): persist exact run output references (#214) ... * feat(history): define bounded output reference contracts * feat(database): migrate execution output evidence to schema v3 * feat(history): persist immutable run output references * test(history): isolate mocked node gallery monitor * feat(history): capture bounded output descriptors with shared leases * fix(history): authenticate payload owners and release failed captures * feat(history): attach output evidence to exact finalized attempts * test(history): verify run output evidence on real ComfyUI * fix(history): release idle worker payload references * docs(history): clarify defensive lease cleanup * test(history): align output fixtures with native path styles * test(history): separate restore completion from writer drain * test(history): bound batch drains by progress and total time	2026-10-17 23:26:37 -07:00
Vito	bae542c9ac	feat(history): persist exact execution prompt contexts (#213) ... * feat(history): define exact bounded execution contexts * fix(history): retain observable sources and validate evidence * feat(history): migrate execution contexts to schema v2 * feat(history): persist immutable execution context snapshots * fix(history): preserve package identity for execution contexts * feat(history): bound context payloads beside lifecycle finalization * fix(history): fence context commits and resolve stored run identity * fix(history): bound persisted identifier bytes before restore reads * feat(history): bind exact runtime context to execution attempts * test(history): discover owner invalidation callback regression * feat(history): capture cached prompt strings without mutating host caches * test(history): verify durable contexts on real ComfyUI hosts * fix(history): scope transforms to captured source paths * test(ci): update execution context tooling fixtures (#209) * fix(history): harden context validation and worker fixtures (#209) * fix(history): honor close deadlines after early joins (#209)	2026-10-17 19:51:22 -07:00
Vito	763e6b37b1	feat(history): record durable ComfyUI execution attempts (#212) ... * feat(history): normalize bounded execution evidence (#209) * fix(history): bound lifecycle kind checks before hashing (#209) * feat(history): persist execution attempts with restore fencing (#209) * test(api): bootstrap standalone backup restore fixtures (#209) * feat(history): isolate bounded asynchronous ledger writes (#209) * feat(history): observe actual queue attempts without altering execution (#209) * fix(database): honor package-scoped configuration (#211) * test(history): exercise real cached and headless executions (#209) * fix(history): reject unsupported uniqueness and isolate package fixtures (#209) * test(history): support Python 3.10 package fixture cleanup (#209)	2026-10-17 16:42:07 -07:00
Vito	dc345671ae	feat(workspace): inspect and send positive and negative prompts (#206) ... * feat(workspace): inspect and send positive and negative prompts * docs(workspace): capture complete inspector and viewer previews * docs(inspector): explain the subprocess cleanup race * fix(workspace): defer observed gallery layout writes (#207) * fix(inspector): keep path-only prompt associations unverified	2026-10-17 13:43:19 -07:00
Vito	caa9649f32	feat: reuse positive and negative prompt combinations (#195) ... * feat(db): add pair schema and stage restore migrations for #193 * feat(database): persist reusable ordered prompt pairs (#193) * feat(api): expose reusable pairs and atomic metadata enrichment (#193) * feat(metadata): resolve canonical prompt pairs with bounded provenance (#193) * feat(scan): enrich image pairs without guessing or duplicate links (#193) * fix(database): preserve pair tags during global maintenance (#193) * feat(tracking): enrich live image pairs and cancel scans safely (#193) * feat(nodes): encode paired prompts and count cached recipe runs (#193) * fix(database): validate restored pair ownership and provenance (#193) * feat(admin): report pair scan outcomes and cancellation (#193) * feat(ui): add paired prompt editor and explicit recipe library for #193 * fix(autocomplete): include reusable pair metadata vocabulary (#193) * fix(pairs): honor recent sorting and conservative scan outcomes (#193) * fix(ui): protect paired draft saves and clarify negative variants (#193) * fix(metadata): preserve bounded paired execution evidence (#193) * fix(tracking): follow actual pair output roles and prefer execution evidence (#193) * docs(pairs): document live validation and retain renderer screenshots (#193) * test(api): inject disposable databases before API startup (#194) * test(api): canonicalize portable temporary gallery roots (#194) * docs(ui): prototype branching negative variant history (#193) * docs(ui): show selected negative beneath positive in timeline concept (#193) * docs: retain approved timeline for later gallery redesign (#193) * test(db): close restore fixture connections before cleanup (#194) * test(db): reuse existing handle guards in all pair fixtures (#194) * chore: clarify rollback test and intentional exception handling (#193)	2026-10-17 08:00:42 -07:00
Vito	3870590704	feat(ui): add Split Prompt Manager workspace (#192) ... * feat(ui): add Split Prompt Manager workspace (#186) * test(ui): use consistent unittest imports (#186)	2026-10-17 06:47:46 -07:00
Vito	a52ff4e052	feat(ui): add Focused Prompt Manager with shared autocomplete (#191) ... * feat(ui): add Focused Prompt Manager node (#186) * feat(ui): autocomplete saved Focused metadata with shared controls (#186) * feat(ui): autocomplete Focused library filters (#186)	2026-10-17 05:31:24 -07:00
Vito	ce82dfb912	fix: quiet routine console logging and prevent duplicate output (#183)	2026-10-16 09:58:05 -07:00
Vito	da322f8c94	Hardening: security fixes, queue-time run counting, background jobs, 85%+ test coverage (#153) ... * chore: valid packaging metadata, flake8 config file, ignore local config with secrets pyproject.toml carried requirements.txt comment lines as dependencies, which fails PEP 508 parsing. flake8 never read [tool.flake8] from pyproject, so the settings move to .flake8 and pre-commit runs the full rule set. config.json (holds the CivitAI API key and machine paths) and other local artifacts are now ignored. coverage joins the dev requirements. * ci: test on Linux, Windows and macOS with a coverage gate and lint job * refactor: drop validate_workflow_name, the column it validated no longer exists * chore: keep agent worktrees out of coverage measurement * fix: image routes serve only media files inside allowed directories serve_image and serve_output_image now reject anything whose extension is not in IMAGE_EXTENSIONS, fail closed when no output directory is configured, and answer 403 (not 404) for dot-dot, absolute and symlink-escaping paths. Containment is checked after realpath+normcase so it behaves the same on Windows, macOS and Linux. 500 responses use safe_error_message so OSError text no longer leaks absolute paths. * fix: bound page sizes on list endpoints /search, /recent and /images/recent share parse_page_params: limit is clamped to [1, MAX_PAGE_LIMIT=500], offset to >= 0, and non-integer values answer 400 instead of 500. /search now honours offset and all three return a pagination block with the effective limit and offset. * perf: thumbnail generation no longer blocks the event loop generate_thumbnails_with_progress is split into _thumbnail_targets (scan, executor), _generate_one (one PIL/ffmpeg job, executor) and an async driver that awaits each file via _run_in_executor, emits one progress frame per file and yields between files. Per-file failures are reported as file_error events (error stays fatal for the UI) and the loop continues. The wildcard Access-Control-Allow-Origin header is gone. The blocking POST variant reuses the same helpers. The scan never follows symlinks and is capped by MAX_SCAN_DEPTH / MAX_THUMBNAIL_FILES. * fix: cap every request-driven resource in the image routes - /images/recent, /images/all and /images/output parse limit/offset through parse_page_params on every path (absent, 0, negative, float strings), and the clamped values are what reach the DB. /images/all gets its own MAX_BULK_LIMIT ceiling instead of an unbounded query; /images/recent caps its fetch window at MAX_RECENT_IMAGES_WINDOW. - parse_page_params also clamps offset to MAX_PAGE_OFFSET so values past int64 no longer surface as a 500 from SQLite. - Gallery and thumbnail scans share _iter_media_files: no symlink following, MAX_SCAN_DEPTH, and MAX_GALLERY_FILES / MAX_THUMBNAIL_FILES caps. Thumbnail size comes only from named presets. - JSON bodies on /images/link and /images/generate-thumbnails are read in bounded chunks; over MAX_JSON_BODY_BYTES answers 413, malformed or non-object JSON answers 400. - /images/link only accepts media paths inside the allowed directories (403 otherwise), closing a path-existence oracle. * test: cover image and prompt routes Every route in py/api/images.py and py/api/prompts.py now has a success path and an error path test: save/update/delete/rate/tag/category/bulk endpoints, image list/link/unlink/delete/metadata/scan endpoints, the thumbnail SSE stream, clear-thumbnails, and the video thumbnail chain (fake cv2 success/failure, ffmpeg absent or failing, PIL placeholder). Combined statement+branch coverage: images.py 97.7%, prompts.py 97.4%. * fix: autotag endpoints no longer read arbitrary paths or run on GET * fix: CivitAI key is never returned or sent off-host * fix: autotag/single checks real paths and DB rows against output dirs * fix: CivitAI downloads never follow redirects * refactor: autotag model loading is injectable * test: cover autotag and lora integration * fix: saving LoRA settings without a key keeps the stored CivitAI key * refactor: share the internal error message in autotag routes * fix: never treat negative-only PromptManager nodes as the run prompt run_prompt_nodes fell back to every PromptManager node whenever no positive node was traced, including graphs that do have a sampler and whose only PromptManager node feeds its negative input. Fall back only when the graph has no recognisable sampler (new has_sampler helper). Samplers named like one are recognised even without a model link. Adversarial graphs (cycles, 10k-node fan-out, non-dict inputs) are covered. * fix: do not follow negative text inputs when tracing the positive prompt _TEXT_KEY matched input names such as text_negative, so a styler node feeding a sampler's positive input pulled its negative PromptManager node into the positive trace. Input names matching (^|_)neg(ative)?($|_) are now skipped (new follows_input helper). * fix: count prompt runs when ComfyUI dequeues the prompt, not when it is submitted The on-prompt hook runs before ComfyUI validates the request, so counting there bumped run_count for prompts that were rejected or deleted from the queue. The hook now only resolves the positive PromptManager texts, mints a UUID4 prompt_id when the client sent none, and stashes the hashes under that id (QueuedRuns, bounded to 1000 entries). PromptQueue.get is wrapped idempotently; when a prompt is dequeued for execution its stashed runs are counted (or remembered as pending first use). Servers without a prompt_queue fall back to counting at submit time with one warning. __init__ defines _global_db before the monitoring block and passes a factory that raises RuntimeError while the database is unavailable; the package is now imported under test with server and folder_paths stubbed. * fix: keep batch image queue aligned when unrelated workflows save images The metadata strategy returned None for images whose embedded workflow has no positive PromptManager node, so the handler popped the batch FIFO for them and every later batch image linked to the wrong prompt. It now returns a tri-state: linked (prompt found), foreign (no PromptManager prompt in the workflow, so the image is skipped and no fallback applies) or unknown (only then the queue, snapshot, tracker and recent-prompt fallbacks run). * fix: image monitor validates directories before creating the observer start_monitoring assigned self.observer before checking that any directory existed, so with no valid directory the monitor was stuck "already running" and stop_monitoring raised on join of a never-started observer. Directories are validated first and only a started observer is kept; stop_monitoring is safe to call at any time and always joins. New is_monitoring property. The per-image threading.Timer is replaced by one daemon worker: paths are deduplicated and bounded (MAX_PENDING_IMAGES), processed in creation order (batch images pop the prompt queue in order) after the processing delay and once the file size is unchanged across two reads. * refactor: one prompt hash implementation utils.hashing.generate_prompt_hash is now the only prompt hash: PromptManagerBase._generate_hash delegates to it and the inline hashlib.sha256 copies in the prompt tracker and image monitor are gone. Remove PromptManagerBase._open_web_interface (it targeted a web_interface folder that never existed) and the unused restart_gallery.py script. IS_CHANGED on PromptManager and PromptManagerText now includes category and tags, so editing either re-runs the node and updates the saved metadata. * fix: stop ComfyUI from loading the admin bundle into the canvas page WEB_DIRECTORY = "web" made ComfyUI inject every .js under web/ (admin.js, gallery.js, vendored Tailwind and ViewerJS) into the canvas page. The node extension moves to web/comfy/prompt_manager.js (content unchanged; its ../../scripts/app.js import resolves against the served URL, which is the same) and WEB_DIRECTORY points at that folder only. Admin and gallery assets are still served from web/ by the extension's own routes. tests/test_sort_contract.py still reads web/prompt_manager.js and must be updated to the new path by its owner. * fix: image monitor recent-prompt fallback reads the paginated result get_recent_prompts returns {"prompts": [...]} but _get_fallback_prompt indexed it like a list, so the last-resort link to the most recent prompt always failed silently. Accept both shapes. * test: cover prompt_manager_base, prompt_manager and prompt_search_list Node base: init wiring, metadata update on re-save, run counting, database error paths, tag parsing, search and recent API wrappers, gallery start failure, LoRA trigger-word injection (disabled, missing modules, enabled). PromptManager: missing CLIP error, encoding of the combined text with a fake CLIP, tracking failure tolerance, empty text. PromptManagerText: tracking failure tolerance. PromptSearchList: filters, multipart and LoRA-only skipping, newline collapsing, preview, empty and error results. * fix: diagnostics dependency check survives a watchdog without __version__ check_dependencies read watchdog.__version__ for its log line; recent watchdog releases have no such attribute, so the AttributeError escaped and took the whole diagnostics run down. Read it with a default. Also covers utils/diagnostics.py: database and images-table checks against a real temporary database, file system check, ComfyUI output detection (folder_paths, configured directories, relative fallback, nothing found), dependencies, the full run and the test image link. * test: cover utils/logging_config Isolated logger manager on a temporary log directory: memory buffer order, level filter and 1000-entry cap, rotation and backup listing, tail and whole file reads, path traversal rejection, truncation (including removal errors), level changes across prompt_manager loggers, handler rebuilds. * test: cover utils/comfyui_integration Singleton re-initialisation keeps registrations, latest prompt per thread, cross-thread fallback with the five-minute recency limit, global lookup for the current thread, and cleanup of old registrations. * test: cover __init__ Version parsing from pyproject (and the unknown fallback), and a server whose add_on_prompt_handler raises: nodes and monitoring still come up. * docs: point at the moved canvas extension under web/comfy * fix: give every thread its own sqlite connection PromptModel.get_connection() handed every thread the same check_same_thread=False connection, so a commit or rollback from the watchdog, executor or queue-hook thread could land on another thread's half-done write (sqlite3 raised 'bad parameter or other API misuse' under concurrent saves). Connections now live in threading.local, each with WAL, Row factory, foreign_keys and busy_timeout, and are tracked so they can be closed. PromptModel.close() / PromptDatabase.close() close the calling thread's connection so tests and restores can delete the file on Windows. * fix: saving an existing prompt concurrently returns its id Node execution, the queue hook and the image monitor all do get_prompt_by_hash() then save_prompt(). When two of them race on the same text the second INSERT failed on UNIQUE(hash) and surfaced an IntegrityError. save_prompt now catches it, re-fetches by hash and returns the existing id, so eight threads saving one prompt end with a single row and every record_prompt_use counted. * fix: backups include WAL data and restores are integrity-checked The database runs in WAL mode, so a shutil.copy2 of prompts.db silently dropped every committed row still in prompts.db-wal; the backup download and the pre-restore safety copy both did that. Restore also overwrote the live file with connections open, read the whole upload into memory before checking the 100 MB cap and never ran PRAGMA integrity_check. PromptModel.backup_database now uses the SQLite online backup API, verify_database_file opens a candidate read-only and checks header, integrity and the prompts table, and restore_from_file backs up the live database, closes every thread's connection, copies the file, removes stale -wal/-shm and re-runs migrations. The admin handlers stream the upload to a temp file with an early size cutoff, reject anything verify_database_file refuses with a 400 and keep the {success: ...} JSON shape. The schema-init connection is now closed instead of leaking. * fix: migrations are idempotent and schema init runs once per process Every PromptDatabase() (nodes, image monitor, API, diagnostics) re-ran table creation and all migrations. Schema init is now cached per normalised path (class-level set under a lock) and re-run only when the file disappeared, after a restore, or after reset_schema_cache(). The copy-and-swap migrations drop a stale *_new table left by an interrupted run, execute inside an explicit transaction with PRAGMA foreign_keys = OFF (DROP TABLE prompts used to cascade-delete every generated_images row), roll back cleanly and log and re-raise sqlite3.Error instead of swallowing it. * fix: image uniqueness by full path, escaped LIKE search, no usage stamp on save generated_images was UNIQUE(prompt_id, filename) on the basename, so ComfyUI's same-named files in different date folders were silently ignored by INSERT OR IGNORE, and the lastrowid == 0 branch after it never ran. The table now carries file_path (normcase/normpath/abspath of the image path) with UNIQUE(prompt_id, file_path); the migration collapses rows that normalise to one file and supersedes the old basename migration, which would otherwise undo it on every start. search_prompts and the tag search escaped nothing, so 100% matched '100 percent' and a_b matched aXb; user text now goes through escape_like with ESCAPE. save_prompt no longer stamps last_used_at, the usage backfill runs only on the upgrade that adds the columns, and the Recently Used / Most Used orders put never-run prompts (NULL) after run ones instead of first. * fix: escape LIKE wildcards in image prompt search search_images_by_prompt interpolated the user's text into LIKE unescaped, so '50%' also matched '50 percent'. It now goes through the same escape_like helper as search_prompts. Also drops an unused import and an unused cursor assignment flagged by pyflakes. * test: cover database operations Behaviour tests for export (json/csv/errors), duplicate detection and merging, image metadata storage and lookup, missing-file cleanup, statistics, bulk operations, orphan pruning, consistency checks, subfolder listing, tag queries and management edge cases, legacy tag column parsing, config-driven path resolution, model housekeeping and the TEXT -> INTEGER prompt_id migration. database/operations.py and database/models.py are both above 85% statement+branch coverage. * test: isolate the clock and log buffer from background threads of other tests * fix: gallery roots are restricted to ComfyUI directories A gallery root could be set to '/' (or 'C:\') through POST /prompt_manager/settings because the deny list only matched a few system prefixes. The root was persisted to config.json and fed into the image-serving containment check, which then allowed any file on disk to be read through /prompt_manager/images/serve/. - GalleryConfig.validate_gallery_root() accepts a directory only when its realpath lies inside a ComfyUI directory (folder_paths output/input/ temp/user) or a directory listed in PROMPT_MANAGER_EXTRA_GALLERY_ROOTS; filesystem roots, the home directory, files and missing paths are rejected. - save_settings returns 400 and persists nothing when any root fails. - _get_all_output_dirs() filters configured roots through the validator and never falls back to a rejected root. - PROMPT_MANAGER_CONFIG_PATH relocates config.json; load/save default to it. * fix: log config accepts only known keys POST /prompt_manager/logs/config forwarded the whole request body into PromptManagerLogger.update_config(), so any key could be injected into the logging configuration. The handler now accepts only LOG_CONFIG_KEYS (level, max_file_size, backup_count, console_logging, file_logging, buffer_size), type-checks each value (level name, non-negative int, bool) and answers 400 listing unknown keys. Malformed or non-object bodies are 400 instead of 500. * fix: no absolute server paths in API responses Settings, diagnostics, duplicate/output scans and the logging endpoints returned absolute filesystem paths, and several error envelopes echoed str(e) which for OSError carries the full path. - _public_path() renders a path relative to the ComfyUI base directory (folder_paths.base_path, else the output dir's parent) or to the parent of an opted-in extra gallery root, falling back to the basename; _public_error() reduces OSError to strerror + basename. - GET /settings returns gallery roots and monitored directories in that form; POST /settings resolves relative roots against the same anchors (GalleryConfig.resolve_gallery_root) so the GET output round-trips. - Diagnostics output_dirs, monitored_directories and the missing-DB message no longer carry absolute paths; the image monitor is reached through the package-or-top-level import fallback instead of a three-dot relative import that failed outside the package. - Duplicate scan 'path' is now relative to the output root and the delete endpoint accepts relative paths. - /logs/files 'path' and /logs/stats 'log_directory' use the public form; unexpected errors answer with a generic message. * perf: run duplicate and output scans off the event loop The duplicate scan walked the output tree and hashed every file on the aiohttp event loop, and the duplicate delete removed files inline; the output scan ran its per-file database work one executor hop at a time. - _find_duplicate_images_sync / _describe_media_file do the walk and hashing; find_duplicate_images() runs them via _run_in_executor. - _delete_duplicate_images_sync / _delete_one_duplicate do the removal (absolute or output-relative paths) off the loop. - The output scan is split into _collect_output_media_sync, _extract_batch_metadata_sync and _ingest_scan_batch_sync (one executor call per batch for all DB work) with a small SSE generator. - Media collection is shared and de-duplicates by normcase'd path. * refactor: settings reads the image monitor through its module get_settings located the ImageMonitor singleton by scanning sys.modules for any module with 'image_monitor' in its name, a workaround for the package being importable under two identities. It now uses the same try-package / except-top-level import as the rest of the API (_current_image_monitor) and falls back to the configured roots when no monitor is running. * fix: clamp the logs limit and reject non-integers GET /prompt_manager/logs accepted any limit up to 1000 and answered 500 when the value was not an integer. The limit is now clamped to [1, 500] and a non-integer value is a 400. * test: cover core API module and gzip middleware * refactor: split diagnostics, maintenance and HTML serving into helpers - run_diagnostics composes four module-level probes (_diagnose_database, _diagnose_dependencies, _diagnose_output_dirs, _diagnose_image_monitor). - run_maintenance is table-driven: _maintenance_runners maps each operation name to a callable and _run_maintenance_operations reports per-operation success or a public error message. - _read_json answers 400 for malformed or non-object JSON bodies in settings, duplicate delete, test-link and maintenance instead of 500. - test_image_link delegates to _link_test_image. - The four HTML page routes share _serve_html_page. * test: cover admin and core API routes Route tests for stats, cleanup, duplicate scan/delete, settings, diagnostics, test-link, maintenance (every operation, success and failure), the output scan internals, and contract-level tests for backup/restore (status codes and envelope only). * test: make admin, logging and diagnostics tests independent of test order The diagnostics message no longer carries the absolute path, the restore test closes its raw sqlite connections before the live file is replaced, the logs tests declare their own folder_paths base directory, and the isolated logger filters every handler to the test thread. * fix: truncating logs no longer rolls the main log over or pads it with zeros truncate_logs emptied prompt_manager.log through a second open(), leaving the rotating handler's stream at its old offset: the next record was written past the new end (zero padding on POSIX) and tell() still reported the old size, so the file rolled over and resurrected the backup that had just been deleted. It also logged once per file from inside the deletion loop, which could do the same with a small size limit. The main log is now truncated through the handler's own stream and a single summary line is logged afterwards. * fix: HTML escaping covers attribute context escapeHtml now escapes & < > " ' (shared web/js/html-escape.js, loaded by admin, gallery and metadata pages) instead of the textContent/innerHTML round-trip that left quotes intact, so a tag, category, checkpoint or file name containing a quote can no longer break out of a data-*, value or title attribute. Inline onclick handlers that interpolated server data now carry data-action and data-* attributes and are dispatched through one delegated listener per page (web/js/data-actions.js); the img onerror fallback uses data-fallback-src with a capturing error listener. Every remaining template value written into an attribute or text node (prompts, checkpoints, file paths, log lines, directory names, categories, suggestions) is escaped. metadata.html no longer builds an "explorer /select" shell command from the file name (Electron-only branch); the path is copied to the clipboard. * refactor: remove shadowed and dead frontend code admin.js defined parsePNGMetadata, extractComfyUIData, showFullPrompt, showWorkflowData, downloadWorkflowJSON and copyAllMetadata twice; the first definitions were unreachable because the later ones shadow them. updateMetadataPanel, showMetadataError, copyPrompt and tryFallbackMetadata only ever wrote to #metadataContent, an element no page creates, so they are gone too. gallery.js defined escapeHtml and showNotification twice. The admin keydown/resize handlers referenced closeImageViewer, previousImage, nextImage and applyImageSizing, none of which exist, and the imageViewMode state they used; only the Escape-closes-gallery branch remains. Debug console.log calls are removed; the ones that were the only statement of a catch block are console.warn so parse failures stay visible. * fix: stale responses, double submits and leaked listeners web/js/api-client.js wraps fetch with one failure path (ApiError for non-2xx, success:false and non-JSON bodies) and latestOnly(), which aborts the previous in-flight request and resolves superseded calls to STALE. The admin search and recent-page loads share one guard, the gallery page load has its own, so fast typing or clicking can no longer paint an older result over a newer one. In-place prompt editing used a blur listener with {once:true} plus a keydown listener added on every edit, which sent the PUT twice and stacked handlers. The list now has one keydown/focusout pair bound at construction and finishEdit() clears the edit state before touching the element, so a save is sent exactly once. Mutations re-fetch the page currently shown (refreshList) instead of calling search(), and delete, bulk delete, edit, restore and scan no longer reload the whole page. Pagination state is committed only after a successful fetch via the pure ListState.nextPageState(current, response) in both admin and gallery, so a failed or aborted page request leaves the current page intact. The gallery lightbox removed its keydown handlers on a non-existent 'remove' event; a MutationObserver now drops them when the modal leaves the document. web/js/sse-stream.js reads server-sent events over fetch so POST-only progress endpoints can stream. * fix: follow the POST-only autotag streams and the new LoRA and list contracts autotag/download and autotag/start are POST-only now; EventSource can only GET, so both pages stream their progress through SseStream.connect(url, {method: 'POST'}), which keeps the onmessage/onerror/close surface the handlers already use. autotag/single is called with image_id and the re-tag dialog shows the server's filename instead of splitting an absolute path. lora/status reports has_civitai_api_key instead of the key: the field shows a 'key is stored' placeholder, an empty field keeps the key on save and a 'Clear the stored key on save' checkbox sends clear_civitai_api_key. Thumbnail generation reports per-file failures as file_error events; both progress views count them (and show error_count from progress) without closing the stream. The auto-tag review follows pagination.has_more on the capped /images/all endpoint, and /search is paged like /recent so paging in search mode no longer switches the list back to recent prompts. * refactor: one PNG metadata parser admin.js, gallery.js and metadata.html each carried a copy of the PNG chunk walker that reads ComfyUI's tEXt/iTXt entries (admin.js had two until the shadowed one was removed). web/js/png-metadata.js is now the only parser: it checks the signature, bounds-checks every chunk so a truncated file or a bogus length cannot throw, decodes tEXt as Latin-1 and iTXt as UTF-8, skips compressed zTXt/iTXt payloads instead of decoding them as garbage, and stops at IEND. The three page-level parsePNGMetadata functions delegate to it. * fix: tags deep link renders and admin modals close admin.html loaded tags-page.js after admin.js, so opening the page at #/tags found no TagsPageManager and rendered nothing; the script order is now theme-bridge, html-escape, api-client, png-metadata, (list-state, sse-stream, data-actions), viewer, comfy-metadata, prompt-list-sort, view-router, tags-page, admin. Route resolution lives in the pure ViewRouter.resolveView(). The auto-tag modal's close buttons called a bare hideModal(), which only gallery.js defines; they call window.admin.hideModal(). PromptAdmin is constructed from startAdmin() on DOMContentLoaded (or immediately when the document is already parsed) instead of at script evaluation time. * test: cover frontend modules browser-globals.test.js loads every page module through vm with a fake window, the way the pages do, and asserts the global each one exposes (HtmlEscape/escapeHtml, DataActions, ApiClient, ListState, SseStream, PngMetadata, ViewRouter, PromptListSort, ComfyMetadata). sse-stream gains cases for a POST body, missing handlers and close() before or during delivery. Every pure module is above 85% line coverage under node --test --experimental-test-coverage. * fix: page image listings in SQL and drop three unused helpers get_recent_images and search_images_by_prompt take limit/offset so the recent and search image routes no longer over-fetch a 5000-row window and slice it. generate_content_hash, PromptModel.migrate_database and find_duplicates had no callers outside their own tests. The isolated logger tests re-apply their thread filter after update_config rebuilds the handlers. Long lines in the touched database and image modules are wrapped so the full flake8 hook passes. * fix: restore through SQLite's backup API, close_all for shared files, safer output scans restore_from_file copied the uploaded file over the live database and deleted its WAL while other PromptModel instances (nodes, image monitor, queue hook) still held connections, which corrupts on POSIX and fails on Windows. It now copies pages through the online backup API into the live connection so every open handle sees the new content. PromptDatabase.close_all() closes the connections of every thread, which tests need before deleting a database. Output scans skip symlinked files, filesystem entries get a stable digest id instead of a per-process hash(), and thumbnail streaming stops when the client disconnects. * style: wrap long lines in node modules Split tooltip, description and docstring strings that exceed 88 columns using implicit concatenation; string values are unchanged. Drop the unused typing imports from prompt_search_list and mark the deliberately late node imports in __init__ with noqa: E402. * style: wrap long lines in the API layer, autotag and config Split long f-string log messages, response messages, URL builders and docstrings; DEFAULT_PROMPT and SYSTEM_PROMPT are rewritten as implicit concatenations with identical values. Drop the unused shutil import in admin and the unused HFCacheInfo import in autotag; keep the hf_hub_download/snapshot_download availability probe with noqa: F401 and mark the deliberately late imports in config with noqa: E402. * style: wrap long lines and drop unused imports in utils Re-wrap module docstrings, comments and f-string log messages; remove the unused typing.List and PngInfo imports; mark the PIL availability probe in diagnostics with noqa: F401; turn two placeholder-less f-strings into plain strings; strip trailing whitespace inside the diagnostics SQL. * style: wrap long lines in tests Split long docstrings and SQL literals (values unchanged) and drop the unused os import from test_path_security. * chore: flake8 ignores the gitignored standalone tagger script * fix: escape image dimensions and workflow JSON before rendering openGalleryModal interpolated width, height and file_size (stored from a POST body, so possibly strings) straight into data-caption and the card text. showWorkflowData wrote JSON.stringify(workflow) raw into a blank same-origin window, so a workflow containing </pre><script> ran. Both now go through ImageHelpers (new pure module, node:test covered); a string file_size no longer reaches formatFileSize's toFixed either, and a blocked popup shows a notice instead of throwing. * fix: escape remaining server values rendered through innerHTML Maintenance and diagnostics results, review-tag errors, video info and metadata error messages, consistency issues, recent image filenames, output directory names, the prompt rating attribute, gallery media types and duplicate group headers were interpolated unescaped. The copy fallback modal also inlined the prompt text inside <textarea>, which a closing tag could break out of; it now sets textarea.value. * fix: address gallery auto-tag review images by path, not digest id The gallery review flow builds its list from /prompt_manager/images/output, whose id is a 16-hex path digest, but posted it as image_id to autotag/single, so the server looked up a database row and every request 404ed. autotagSingleBody (pure, tested) now sends path for output-folder entries and keeps image_id for database rows, which the admin review flow (/images/all) still uses. * fix: read thumbnail generation progress over POST with SseStream images/generate-thumbnails/progress is becoming POST-only, which the browser EventSource cannot request. Both thumbnail progress consumers in the gallery now use SseStream.connect(url, {method: 'POST'}) exactly as the autotag streams do. SseStream gains addEventListener/removeEventListener for named event: frames (tested) so the status, start, progress, file_error, complete and error listeners stay as they were, and an onclose guard rejects when the stream ends without a terminal frame. * fix: drop the unused copy-text data-action handler Nothing in the admin markup emits data-action="copy-text"; the prompt copy buttons call copyToClipboard directly. * fix(lora): confine LoraManager paths to custom_nodes and hide server paths - is_civitai_url also refuses URLs with userinfo or a non-443 port, so https://evil.com\@civitai.com/x and https://civitai.com:8443/x are rejected. - resolve_lora_manager_path / custom_nodes_directories: lora/enable and lora/scan only accept a LoraManager directory that is a direct child of ComfyUI's custom_nodes (folder_paths base_path or registered custom_nodes folders, else this package's parent) and whose name contains "lora", compared via realpath+normcase; relative public paths resolve against the API path anchors. Anything else is 400, so find_lora_directories can no longer widen the image allow-list with arbitrary trees. - lora/enable persists through PromptManagerConfig.save_to_file(), which honours PROMPT_MANAGER_CONFIG_PATH, instead of a hard-coded config.json. - detect/status/enable return path and detected_path through _public_path; every lora handler reports exceptions via _public_error, and lora/scan errors raised after the SSE stream opened become an error event. - Tests close the database before unlinking it. * fix(autotag): contain batch rows, require media extensions, bound the scan - The batch tagger runs every generated_images row through _resolve_allowed_image_path; rows that exist but lie outside the served output directories are skipped and counted in skipped_outside_roots on progress and complete events, and the engine receives the resolved path. - _resolve_allowed_image_path requires a media extension (.png .jpg .jpeg .webp .gif .bmp .tiff .tif), so autotag/single returns 403 for other files. - autotag/start holds a module-level lock; a concurrent start gets 409 {"success": false, "error": "Auto-tagging is already running"}. - scan_output_dir walks with a 50,000-file and 12-level cap, skips symlinked files and thumbnails, returns path through _public_path, relative_path in POSIX form, and a truncated flag. - Autotag handlers report exceptions via the shared _public_error; the local copy is removed. Tests close the database before unlinking it. * test: close every database before unlinking and anchor public paths in image tests Each owned test that opens a PromptDatabase now calls close_all() before removing the file, and temp directories holding a database use ignore_cleanup_errors, so the suite tears down cleanly on Windows. The image API fixture lays out a fake ComfyUI tree (<tmp>/output) and pins GalleryConfig.path_anchors to it so responses can be checked for root-relative paths. * fix: validate image file_info before it reaches the generated_images columns link_image_to_prompt stored size, dimensions and format straight from the request body, so a string such as '"><img src=x>' ended up in INTEGER columns and was echoed back to the gallery. Size and dimensions are now coerced with int() and bounded (size 0..10^12, width/height 0..65535), format is matched against a whitelist of media formats, and anything else is stored as NULL while the image still links. Non-dict metadata or file_info no longer aborts the link. * fix: clamp paging on tag listings and the page-derived recent offset tags/stats, tags/{tag}/prompts and tags/filter parsed limit/offset with a bare int(), so limit=999999 was passed straight to SQLite and a huge offset raised OverflowError (500). They now share parse_page_params (limit 1..500, offset 0..MAX_PAGE_OFFSET, 400 on non-integers), and /recent clamps the offset it derives from ?page= the same way. * fix: make the thumbnail progress stream POST-only GET /prompt_manager/images/generate-thumbnails/progress wrote thumbnails to disk, so any prefetch, link preview or <img src> could start a full output-directory scan. The route now accepts POST only (GET answers 405); quality still comes from the query string so the SSE client can keep the same URL shape. * fix: describe images relative to the ComfyUI tree in API responses Gallery and prompt responses carried absolute server paths: /images/output entries (path, root_dir), thumbnails_path, the images/prompt lookup, every image list (image_path plus its normalised file_path duplicate) and the preview images attached to prompt listings. They now go through _public_path: /images/output 'path' is relative to its root (what the delete and autotag endpoints resolve against), 'root_dir' and every other image_path are relative to the ComfyUI base, and file_path is dropped. recent/all/search image lists also gain url/thumbnail_url via the same enrichment the prompt-images route already had. Remaining str(e) error bodies in both modules use the basename-only error text. * fix: check thumbnail directory containment with a real path test clear_thumbnails compared resolved paths with str.startswith, so a thumbnails directory that resolved to a sibling with a shared prefix (out vs out2) passed the safety check and was emptied. It now uses the module's _is_within (realpath + normcase + Path.is_relative_to). * fix: decode tag names from the URL only once The tag lookup, rename and delete routes ran urllib.parse.unquote on match_info values that aiohttp had already percent-decoded, so a tag literally named '%41' (requested as %2541) was handled as 'A'. The second decode is dropped. * fix: validate tags on every tag mutation route add_prompt_tag, add_tags_to_prompt, bulk_add_tags, merge_tags and rename_tag accepted whatever the body carried; a non-string tag raised AttributeError (500) and over-long or control-character tags were stored. They now run utils.validators.validate_tags through a shared tags_error helper and answer 400 with the validator's message. Blank entries in add_tags_to_prompt are still skipped rather than rejected. * fix: export every prompt by paging instead of truncating at 10000 /prompt_manager/export fetched a single page of 10000 prompts and silently dropped the rest. It now walks the table in EXPORT_PAGE_SIZE pages (1000) inside one executor job until a short page is returned. * fix: gate the LoraManager serving roots and accept relative link paths A LoraManager path hand-edited into config.json went straight into find_lora_directories and so into the image-serving allow-list. When a path is configured it must now pass lora_utils.resolve_lora_manager_path (a custom_nodes child whose name contains 'lora'); otherwise, or when the resolver is unavailable, no LoRA directories are served. An empty path keeps the custom_nodes-only auto-detection. POST /images/link now also accepts the relative forms the API hands out (root-relative 'sub/a.png' and ComfyUI-relative 'output/sub/a.png'), resolving them against the allowed roots and anchors; '..' segments in a relative path are refused and unknown files are 404. * fix: review flow uses the served image url and the lora-dirs test pins its config Image paths in API responses are now relative to the ComfyUI tree, so the auto-tag review page can no longer derive a serve URL from image_path; the server always provides url. The lora-dirs serving test assumed an empty LoraManager path, which only held in a checkout without a local config.json. * test: stop leaking a mocked utils.comfyui_integration and mock the IS_CHANGED clock test_image_monitor_singleton replaced utils.comfyui_integration in sys.modules with a MagicMock and never restored it, so running it before test_comfyui_integration failed eight tests. The mock was unused; drop it and install the server stub with setdefault in every owned test module. The PromptSearchList IS_CHANGED test slept 10 ms between two time.time() reads; the Windows clock ticks every 15.6 ms, so it was flaky there. Mock the clock with an incrementing counter instead. * fix: resolve_text follows a node shared by two branches The cycle guard used one visited set for the whole walk, so a string node read twice (a diamond, or StringConcatenate with the same source on both inputs) made the second branch None and the prompt text unknowable. Cycle detection is now scoped to the current path; a separate visit counter keeps MAX_VISITS as the bound on total work. * fix: bound resolve_text on diamond chains with memoisation, depth and length caps A per-path visited set alone makes a chain of diamonds (node i reads node i+1 on both inputs) exponential in depth. Each node's text is now memoised so it is expanded once, every expansion is charged to the shared MAX_VISITS budget, chains deeper than MAX_DEPTH (64) are unknowable so recursion stays bounded, and text longer than MAX_TEXT_LENGTH (100k) is unknowable so StringConcatenate doubling cannot exhaust memory. * fix: static routes resolve under web/ with an extension allow-list /prompt_manager/lib/{filepath} and /js/{filepath} only rejected '..' and a leading '/'. On Windows os.path.join(root, 'C:/x') or a leading backslash re-anchors the path, so any file on the host could be read. Requests are now refused when the path is absolute on any platform (slash, backslash, drive letter, UNC prefix), carries an empty, '.' or '..' segment, has an extension outside the allow-list, or resolves (symlinks included) outside the static directory; the resolved real path is served with its MIME type. * feat: capped JSON body reader and single-flight lock for long admin jobs Add _read_json_body(request, max_bytes=1_000_000) to py/api: reads the body in chunks, answers 413 past the cap (declared or streamed) and 400 for invalid or non-object JSON. Every JSON POST in the admin and logging handlers goes through it; it is exposed as PromptManagerAPI._read_json_body for the other route mixins. Add _acquire_long_job(name) / _long_job_busy_response(label) on the API object: one asyncio.Lock per job family, handed out as an async context manager or None when busy, so a handler answers 409 instead of starting a second scan. The duplicate scan and delete share the 'duplicates' family. * fix: harden database restore and keep server paths out of admin responses Restore: verify_database_file and restore_from_file run through _run_in_executor; the upload is also opened read-only with PRAGMA trusted_schema=OFF and refused when sqlite_master lists a trigger or a view (a prompts database has neither, a crafted one could use them to run SQL against the live data); at most MAX_SAFETY_BACKUPS (10) '<db>.backup_*' files are kept next to the live database, oldest first. Responses: backup_created and the maintenance statistics database_path go through _public_path, and backup/restore failure messages through _public_error, so no absolute server path appears in an admin body. * fix: validate hand-edited gallery roots everywhere and bound output scans A root written straight into config.json skipped the containment check the settings endpoint applies. GalleryConfig.update_config (and so load_from_file) now drops entries that fail validate_gallery_root with a warning, _find_comfyui_output_dir validates the configured directory before using it, and ImageMonitor.start_monitoring validates every directory before scheduling the observer. The duplicate cleaner only deletes files with a media extension and never anything under a thumbnails directory. _collect_media_files walks with os.walk(followlinks=False), skips symlinked files and directories, prunes thumbnails, stops MAX_SCAN_DEPTH (12) levels down and after MAX_SCAN_FILES (50000) files. * fix: bound log file size and backup count in the logging config endpoint max_file_size must be between 1 MB and 1024 MB (bytes) and backup_count between 0 and 50; anything else is a 400. Also close every database connection in the logging test teardown. * fix: private config.json, merged settings save, synthetic test-link path PromptManagerConfig.save_to_file and the settings endpoint write config.json through write_private_json: created with mode 0600 (chmod on POSIX, best effort on Windows) because the file can hold an API key. _persist_settings merges web_ui and gallery.monitoring.directories into the existing file instead of overwriting it, so the integrations section and any other key survive a settings save. The test-link diagnostic no longer stores a client-supplied path; it records a marker file name under the output directory. * fix: image worker thread exits on shutdown and restarts cleanly ImageGenerationHandler.shutdown() clears the pending set, sets a stop event the worker's delay and settle waits listen to, and puts a None sentinel on the queue; the worker exits within the current wait. Each worker owns its queue and stop event so a draining worker never swallows an image scheduled after shutdown. ImageMonitor.stop_monitoring calls it. * test: close all database connections before deleting temp files Windows refuses to unlink an open SQLite file and executor threads keep their own connections, so every owned test that creates a PromptDatabase calls close_all() before cleanup; the diagnostics temp dir ignores cleanup errors. * fix: output scan runs as a background job that survives the browser going away Closing the dashboard tab or clicking outside the scan modal raised ClientConnectionResetError out of scan_images and abandoned the scan mid-batch, leaving a half-scanned database. Two overlapping scans could also run at once. - py/api/scan_job.py: ScanJob fans progress out to any number of SSE subscribers (latest snapshot first, then live events) - POST /prompt_manager/scan starts the scan as an asyncio task, or attaches to the one already running; a write to a dead socket ends that stream quietly while the scan continues - GET /prompt_manager/scan/status reports the running flag and last event - dashboard: dismissing the modal while a scan runs minimizes it to a progress pill, the page re-attaches to a running scan after a reload, a lost stream reconnects, and leaving the page mid-scan asks first * feat: worker-thread setting speeds up the output scan and thumbnail generation Both jobs processed one file at a time on a single core. Pillow decodes the whole image to reach trailing PNG text chunks and releases the GIL while it does, so a bounded thread pool scales almost linearly: on a 1 GB sample of 400 PNGs the metadata pass dropped from 18 s to 2.5 s at 8 threads, and 120 thumbnails from 4.6 s to 0.6 s. - utils/parallel.py: map_parallel(func, items, workers) keeps order, runs on the caller's thread when workers is 1, and caps the pool at the item count - PromptManagerConfig.WORKER_THREADS defaults to half the detected cores, is clamped to max_worker_threads() when loaded from config.json, and is persisted under "performance" - settings API returns worker_threads and cpu_count and validates saves; the settings modal gets a "Worker threads" slider capped at the core count - the scan reads each metadata batch on the configured threads; thumbnail generation processes batches of files per executor job, still emitting one progress event per file Threads rather than processes: this runs inside ComfyUI's server, where forking a CUDA-initialised process is unsafe and the spawn start method would re-import ComfyUI's main module in every child. * fix: scan modal ignores backdrop clicks so a focus click cannot dismiss it Only its own buttons dismiss it: Cancel before a scan starts, Hide (minimize to the progress pill) while one runs. * feat: scan reads prompts embedded in videos; unreadable files no longer log errors The output scan handed every .mp4 to Pillow and logged one ERROR per file. ComfyUI's video savers store the queued graph as JSON in the container's comment tag, so those files carry prompts worth linking. - utils/video_metadata.py reads the comment/description tag through ffprobe with a timeout, normalised to the PNG text-chunk shape so the existing parser handles both; without ffprobe videos are skipped and a single INFO notice is logged - _extract_comfyui_metadata routes videos there and logs unreadable images as warnings, since the scan carries on past them Test hygiene: every aiohttp test base class overrode tearDownAsync without calling super(), so no test client was ever closed. That produced thousands of ResourceWarnings, "Unclosed client session" errors from asyncio that broke log assertions, and doubled the suite's run time. * fix: thumbnail runs skip fresh thumbnails before the cap and report what remains The per-run cap of 10,000 applied to the directory walk itself, so a library with more files than that never had thumbnails generated for the rest, and a run that found 9,987 existing thumbnails spent its whole budget on skipping them. - _plan_thumbnails walks the whole tree (bounded like the gallery listing), counts files whose thumbnail is already newer as skipped without queuing them, and caps only the pending files; the leftover count is returned - start and complete payloads carry skipped and remaining; total_images counts every file considered and the processing rate uses the files actually worked on - the gallery page shows a warning naming the pending count instead of a success toast when a run stopped at the cap * feat(gallery): warn with the pending count when a thumbnail run stops at the cap * fix: thumbnails are written atomically and served under mtime-versioned urls Cards showed "Failed to load" for thumbnails that were valid on disk. The browser had fetched them while the thumbnail run was still writing the file and, because image responses are cached for an hour, kept the broken bytes. The card also had no fallback to the original. - image and video thumbnails are written to a hidden temp sibling and renamed into place, so a partial file is never visible at the final path - every thumbnail_url (gallery listing, prompt images, duplicates, autotag listing) carries ?v=<mtime>, so a regenerated thumbnail gets a new URL instead of the cached old one - a 404 from the image serve route is marked no-store; ComfyUI's cache middleware would otherwise let browsers cache the miss for an hour - image-helpers gains fallbackImageSource(): the original is tried once before a card gives up Test hygiene: the autotag tests now stub ComfyUI's server module like the other API test modules, so the module passes when run on its own. * fix(gallery): display settings apply at load, columns work, media info toggles Default View Mode, Items per Page and Grid Columns were only applied when Save was pressed, never when the page loaded; the column setting swapped a Tailwind class that was never compiled (only 3, 6 and 8 exist) and a wider breakpoint class overrode it anyway; Show Media Info was saved and never read. - gallery-settings.js validates what localStorage holds (view mode, limit option, column range, booleans) and falls back to defaults per value - settings are applied in the constructor before the first load; changing the page size reloads, toggling media info re-renders - the column count sets an explicit grid template through a CSS variable that wins on desktop widths - media info lines honour the toggle in grid and list views - image load failures are handled by one delegated listener that tries the original before showing the failed-to-load card * feat(gallery): duplicate scan runs as a background job with progress; infinite scrolling The duplicate scan was one blocking request with a spinner: no progress, a modal that could not be put away, and a result lost if the tab closed. - POST /prompt_manager/scan_duplicates/stream starts the scan as a background job (same ScanJob fan-out as the output scan) or attaches to the running one; GET /prompt_manager/scan_duplicates/status reports it. The job holds the duplicates lock, so deletes are refused while it runs. - hashing runs on the configured worker threads and reports progress about every percent - the gallery modal shows a progress bar, closing it minimizes to a pill that reopens it, results wait in the pill if the modal was closed, and a reload re-attaches to a running scan Infinite scrolling is a new Display Setting (off by default): the next page is appended when the viewport nears the bottom, pagination controls hide, and the load-more rule lives in list-state.js where it is unit tested. Thumb-size buttons and the column setting no longer override each other. * fix(gallery): Rescan Output Folder drops the server listing cache and rewalks The button only re-requested the listing, which the server answers from a 30-second in-memory cache, so a rescan showed exactly what was already on screen. - POST /prompt_manager/gallery/rescan invalidates the gallery cache, rewalks every output root and returns the file and root counts - the button calls it, closes the settings modal, reloads the folder tree and the first page, and reports what it found * feat: tag search box autocompletes, narrowed by the tags already typed - PromptDatabase.suggest_tags(prefix, with_tags, limit): tags starting with the prefix, counted over the prompts that carry every context tag, context tags excluded, ordered by count then name; LIKE wildcards in the prefix are escaped - GET /prompt_manager/tags/suggest?q=&with=&limit= exposes it (limit clamped to 1..50, context capped at 10 tags, registered before the {tag_name} routes) - tag-autocomplete.js splits the comma-separated input into committed tags and the one being typed, builds the query, applies a pick and handles wrap-around keyboard selection - the dashboard Tags box shows suggestions with counts on focus and while typing, arrow keys and Enter/Tab pick, Escape closes, and each pick immediately offers the next tag narrowed by the previous ones * feat(dashboard): infinite scrolling for the prompt list, saved default plus session toggle - PromptManagerConfig.INFINITE_SCROLL (web_ui.infinite_scroll) is reported and saved through the settings API; only booleans are accepted - Settings modal gains an "Infinite Scrolling" default; saving applies it at once - the results header gains an "Infinite scroll" checkbox that overrides the default for the current session without saving - when on, the next page is appended as the list nears its bottom (same load-more rule as the gallery), page controls hide, a short page keeps loading until the list fills, and a refresh after an edit restarts from the top * fix: first CI run on Windows and macOS; tests now enforce closed database files The first push of the branch ran the Tests matrix on all three operating systems. Every Python job failed; the causes were: - numpy missing in CI: the WD14 engine tests import it (requirements-dev) - macOS: temp directories resolve through /private; the admin API tests now use the real path like the gallery roots they compare against - Windows: the startup banner printed an emoji, which raises UnicodeEncodeError on a legacy-code-page console and aborted loading the whole node; the banner is ASCII now and a test loads the package under a cp1252 stdout - Windows: gallery subfolders came back with backslashes, which neither the folder tree nor the search filter understand; they are "/" joined on every platform. A relative DEFAULT_DB_PATH kept its forward slashes after being joined to the extension root; it is normalised now - Windows: sqlite connections opened with `with sqlite3.connect()` are not closed by the context manager and linger until garbage collection, which holds a file lock there. Production sites (vacuum, diagnostics, restore inspection) close explicitly; a restore that swaps the API's database object closes the previous one; PromptModel keeps a registry so a shutdown or a test can close every instance - Windows: served files were still open when their temp directory was removed (tests now read the body), a log download test compared text mode newlines, two tests compared paths with a hard-coded separator tests/open_handles.py makes the Linux run fail the way Windows would: every database test base checks, right before deleting its files, that nothing in the process still holds them open. * fix: Windows case-folded gallery roots in tests, "/" subfolders everywhere, longer busy timeout Second CI run on Windows: - gallery roots are stored resolved and case-folded there; the admin API tests now compare against that form instead of the mixed-case temp path - the subfolder fallback for images outside every root also uses "/", and the test expects it - a relative diagnostics db path is normalised after joining - "database is locked" under many writers on a slow disk: connections now wait up to 30 seconds (connect timeout and busy_timeout), long enough for a scan or thumbnail run while ComfyUI saves images * fix: serve every gallery video format, validate settings before applying, dedupe output dirs Review findings on #153 (Codex): - the image serve route allowed only three video types while the gallery lists seven, so .avi/.mkv/.m4v/.wmv cards opened to a 403; the serve allow-list now covers every gallery video format - a settings payload with one invalid field still applied the valid ones before returning 400; the whole payload is validated first and nothing changes on failure. webui_display_mode is validated too Third Windows CI run: - the same output directory spelled twice (different case or a link) was listed twice in diagnostics and served roots; both dedupe on the resolved, case-folded path - the root-less subfolder test expects the "/" form Code-quality bot: index definitions are (name, target) pairs instead of implicitly concatenated strings; redundant local asyncio imports and two trivial lambdas in test stubs removed. * docs: version 3.3.0, README changelog and refreshed sections Bump to 3.3.0: new features (worker threads, background scans, tag autocomplete, infinite scrolling, video prompt scanning) and API contract changes (POST-only side-effect routes, relative image paths, paginated search) go beyond a patch release. README: changelog entries for 3.2.4 and 3.3.0, refreshed bulk scanning, gallery settings, search, configuration and testing sections, and the roadmap's recently-completed list.	2026-10-08 18:53:11 -07:00
Vito	6c7e4d5b35	feat: release 3.2.4 — recently used sorting, run counts, positive-prompt image linking (#152) ... * chore: start 3.2.4 * feat: track prompt usage (run_count, last_used_at) with server-side sorting - Migration adds last_used_at and run_count; existing prompts are estimated from linked images (count, newest image time, else created_at). The backfill only touches NULL rows, so it self-heals rows written after a downgrade or an interrupted upgrade. - Every node run records a use, including re-runs of an existing prompt; a tracking failure is logged and never blocks generation. - search_prompts/get_recent_prompts accept a whitelisted sort key (last_used, created, run_count, rating, text); default stays newest first. Refs #90 * feat: sort param on /recent and /search; microsecond last_used_at - /prompt_manager/recent and /search accept ?sort= (whitelisted in the DB layer; unknown values fall back to newest first). - last_used_at is written with microseconds from Python so a re-run in the same millisecond as another save still sorts first; ordering stays correct against millisecond values from the backfill. Refs #90 * feat: server-side sort in admin UI with Recently Used / Most Used and run badges - New web/js/prompt-list-sort.js owns the sort options, validation and request URLs; admin.js fills the dropdown from it and re-fetches from the server on change, so every sort spans all pages (the old client-side sort only reordered the current page). - Default sort is Recently Used; prompt cards show a run-count badge with the last-used time on hover. - The node's Recent button now lists recently used prompts. - Contract test keeps the UI sort keys and the node's key in sync with the server whitelist. Refs #90 * fix: link images and count runs by the positive prompt, not node execution With a negative-prompt PromptManager node in the workflow, every executed PromptManager node pushed onto the image-linking queue, so images could be linked to the negative prompt or to a previous run. ComfyUI also skips unchanged nodes, so re-runs of the same prompt were never counted. - utils/prompt_graph.py finds the PromptManager nodes feeding a sampler's positive input (KSampler, CFG/Basic guiders, ControlNet and combine pass-throughs, PromptManagerText into encoders), falling back to all PromptManager nodes when none can be traced. - Runs are counted by a ComfyUI on-prompt hook when a workflow is queued; prompts not yet saved are counted when the node first saves them. - Nodes receive the queued graph (hidden PROMPT/UNIQUE_ID). Only the run's positive prompt becomes the current prompt; only batch items with linked text are pushed onto the FIFO queue. - The image monitor links from the image's own metadata first, using the positive node, and falls back to the queue for batch items. Refs #90 * fix: address review — count cached runs of linked text, keep repeated pending runs - Text from known pure string nodes (core PrimitiveString/StringConcatenate, WAS Text Concatenate/Multiline, pysssss ShowText) is resolved at queue time, so cached re-runs of such prompts are counted and their images link from metadata. Unknown nodes are never guessed; the node compares its real text with the queue-time resolution and falls back to counting and queueing itself on any mismatch. - A new prompt queued several times before its first run keeps every pending run; the first save records all of them. - Registration flag is a threading.Event; consistent unittest imports; logging instead of print in the init fallback. * refactor: unquote PendingFirstUse annotation so Tuple usage is visible	2026-10-07 13:52:09 -07:00
Vito	aa768f57dd	fix: release 3.2.3 — metadata parsing, null-safe saves, auto-hide, tag search (#151) ... * fix: release 3.2.3 — metadata parsing, null-safe saves, auto-hide, tag search - fix(#75): stop SaveImage patch from writing the last-run prompt into every PromptManager node (negative prompts were saved as copies of the positive) - fix(#75): replace four duplicated metadata parsers with a shared web/js/comfy-metadata.js that traces sampler links (KSampler, CFGGuider / SamplerCustomAdvanced, LoRA chains, ControlNet pass-through, any checkpoint loader) and recovers per-node text for images saved by older versions - fix(#143): treat null JSON body fields as empty in prompt API handlers - fix(#149): keep auto-hide timeout 0 (disabled) instead of falling back to the default; validate result_timeout on save - feat(#150): support tag:name filters in the node search box - docs(#142): scan dialog mentions A1111/Forge metadata support - docs(#144): fix ComfyUI-Lora-Manager links - ci: run JS tests with node --test * fix: bound metadata graph traversal to prevent tab freeze on crafted PNGs Link resolution tried every linked input recursively with only a depth cap, so a PNG whose prompt graph has cycles and fan-out could force ~inputs^25 paths and hang the gallery/metadata page. Each lookup now shares a visited set (each node expanded once) with a hard cap of 500 visits. * fix: read the matching output of multi-output settings nodes KSampler settings linked to a node like SamplerCombo all resolved to its first value, so steps, cfg and sampler showed the sampler name. Scalar resolution now prefers the linked node's input with the same field name. * fix: address review — trust API text, restore workflow-only parsing - Workflow widget text now only replaces API text for metadata showing the pre-3.2.3 corruption signature (2+ PromptManager nodes with identical API text but different widgets). Otherwise the API graph wins, so expanded dynamic prompts and linked text display what actually ran. - Images with only a UI workflow are converted to the API graph shape and traced the same way: prompts, KSamplerAdvanced, UNET/checkpoint loaders, KJNodes Set/Get, Reroute, bypassed and muted nodes.	2026-10-07 11:27:40 -07:00
Vito	8146250274	feat: PromptSearchList batch workflow support & image linking v3.2.2 (#139) ... * fix(search): PromptSearchList crash, filters, and batch output (#52) - Fix empty list crash (OUTPUT_IS_LIST requires at least one element) - Add partial tag matching (LIKE instead of exact) - Add preview and count outputs for batch visibility - Add skip_multipart filter for Clip_N video prompts - Add LoRA-only prompt filter - Collapse newlines for StringOutputList compatibility * feat(db): add tag_partial parameter for LIKE tag matching (#52) Allows search_prompts to use LIKE matching for tags instead of exact. Used by PromptSearchList for discovery-style search. Existing callers default to exact matching (unchanged behavior). * feat(tracker): add FIFO prompt queue for batch image linking (#52) Batch workflows encode all prompts first, then save all images later. The queue preserves encode order so each image links to the correct prompt by position (pop on save matches push on encode). * fix(monitor): multi-strategy image-to-prompt linking (#52) Previous approach relied on live prompt tracker state, which was always stale for batch workflows (all images linked to last prompt). New 5-strategy priority chain: 1. FIFO queue pop (batch-correct by position) 2. Metadata-based DB lookup (extracts prompt from PNG) 3. Prompt snapshot at file-creation time 4. Live prompt tracker 5. Most recent DB prompt fallback * test: add tests for prompt queue and search filters (#52) - 6 queue tests: FIFO ordering, batch simulation, exhaustion - 15 filter tests: newline collapse, Clip_ filter, LoRA-only filter - Fix _make_tracker helper to include queue fields * chore: bump version to 3.2.2 * fix: address code review — regex backtracking and queue expiry (#52) - Replace backtracking-prone LoRA-only regex with subtraction approach (re.sub removes tags, check if anything remains). Fixes CodeQL alert. - Add expiry check to pop_next_prompt — skips stale entries to prevent incorrect linking from accumulated queue entries across sessions. - Cleanup thread now also prunes expired queue entries.	2026-04-10 12:49:59 -07:00
Vito	2cf9f42e73	fix: diagnostics and monitor respect config, singleton lifecycle (#132) (#133) ... * fix: diagnostics, backup, and restore now respect config.json db path (#132) * test: add regression tests for config-aware diagnostics and backup (#132) * fix(test): use fresh event loop to avoid aiohttp test pollution * fix: don't kill singleton image monitor when node instance is garbage collected The __del__ method was calling stop_monitoring() on the shared singleton ImageMonitor, killing it for ALL nodes whenever any single node instance was garbage collected between workflow runs. This caused the monitor to restart on every execution and miss image save events due to race conditions. * test: add regression tests for image monitor singleton lifecycle Ensures cleanup/del never stops the shared monitor, singleton is thread-safe, and observer survives across node instance lifecycles. * style: address PR review — log suppressed exceptions, remove unused imports	2026-04-03 06:22:55 -07:00
Vito Sansevero	c9ca4be8b8	fix: custom image scan directory ignored due to wrong import (#108) ... start_monitoring() used an absolute import (from py.config) to read MONITORING_DIRECTORIES, which either failed with ImportError or loaded a separate module instance with empty defaults. The configured custom directory was never used, and auto-detection always kicked in. Fixed by consolidating into the single relative import (from ..py.config) that was already used for the MONITORING_ENABLED check.	2026-02-08 05:38:42 -08:00
Vito Sansevero	2737a4b1ef	style: apply Black formatter (line-length=88) to all Python files ... Automated formatting pass across 30 files to establish consistent code style enforced by CI. No logic changes.	2026-02-07 08:30:09 -08:00
Vito Sansevero	4f62066c63	fix: harden nodes, validators, and utility modules ... Phase 0-3 fixes from codebase audit: - Extract shared node logic into prompt_manager_base.py (DRY) - Add input validation guards to validators.py - Fix logging_config.py buffer management - Harden image_monitor.py against race conditions - Fix prompt_tracker.py cleanup edge cases - Fix diagnostics.py import path - Wire config.py server instance correctly	2026-02-07 07:02:10 -08:00
Vito Sansevero	6ef040b4b8	refactor(comfyui): remove class_type conversion logic	2026-02-06 14:32:55 -08:00
Vito Sansevero	f485825bfb	fix: resolve gallery crash when thumbnails exist and prevent thumbnail-as-image linking ... - Fix AttributeError: 'str' has no attribute 'as_posix' on thumbnail_rel_path in get_output_images and find_duplicates (thumbnail_rel_path is already a string from f-string construction, not a Path object) - Fix NameError: total_images undefined in generate_thumbnails (was defined as total_media, causing progress logging and response to fail) - Add URL encoding for paths in scan_output_dir for filenames with spaces - Exclude thumbnails directory from image monitor to prevent linking thumbnail files to prompts via fallback mechanism - Bump version to 3.0.31	2026-02-03 14:07:23 -08:00
Vito Sansevero	a7d842a51c	feat(settings): add configurable gallery scan directory ... Add ability to configure a custom image scan directory in Settings: - New "Image Scan Directory" field in Settings modal - "Currently Monitoring" display shows active directory path - Settings API now returns/saves gallery_root_path and monitored_directories - Image monitor checks GalleryConfig before auto-detecting - Restart notification when gallery path changes Closes #76	2026-02-02 15:58:54 -08:00
Vito Sansevero	c3aa41d679	feat: Add singleton management for PromptTracker	2026-02-02 15:09:58 -08:00
Vito Sansevero	c50a7292c7	refactor(image_monitor): use info log level instead of debug	2026-02-02 15:09:48 -08:00
Vito Sansevero	22593e8514	docs: add comprehensive docstrings to all Python modules ... - Add Google-style docstrings to main node files (prompt_manager.py, prompt_manager_text.py) - Enhance database module docstrings with detailed parameter and return documentation - Add comprehensive docstrings to all utils modules with usage examples - Document API endpoints and configuration classes thoroughly - Update module-level docstrings in all __init__.py files - Ensure consistent naming (ComfyUI_PromptManager) across all documentation - Follow Python best practices for docstring formatting	2025-08-12 06:51:36 -07:00
Vito Sansevero	e2eef54eb3	feat(utils): Add ComfyUI integration utilities	2025-07-25 14:03:49 -07:00
Vito Sansevero	685e44fde0	style: Change log level from info to debug	2025-06-19 13:06:18 -07:00
Vito Sansevero	ecbd2b4ca2	style: Change log level from info to debug	2025-06-19 13:06:09 -07:00
Vito Sansevero	299e74ebd5	style: Replace emojis with tags in diagnostics logs	2025-05-28 09:17:21 -07:00
Vito Sansevero	20d2483c3a	fix(logging): add safe encoding for Windows compatibility	2025-05-28 09:17:09 -07:00
Vito Sansevero	d255be3c99	refactor(diagnostics): Replace print with logger info	2025-05-28 08:28:26 -07:00
Vito Sansevero	1ea4ac7565	refactor(image_monitor): Replace print with logger	2025-05-28 08:28:18 -07:00
Vito Sansevero	367bc6c745	refactor(metadata_extractor): Replace print with logger	2025-05-28 08:28:09 -07:00
Vito Sansevero	226263495b	feat(prompt_tracker): integrate logging system	2025-05-28 08:27:58 -07:00
Vito Sansevero	c87d376c25	feat(logging): Add centralized logging configuration	2025-05-28 08:27:13 -07:00
Vito Sansevero	fb11ce5013	refactor(prompt_tracker): Avoid duplicate prompt saving Fixes: #3	2025-05-27 12:36:28 -07:00
Vito Sansevero	8b399e2d3e	refactor(prompt_tracker): add detailed logging for prompts, fixes #3	2025-05-27 11:10:31 -07:00
Vito Sansevero	777d5e6a6a	feat(image_monitor): add fallback prompt handling	2025-05-27 10:59:01 -07:00
Vito Sansevero	2de1596568	refactor(prompt_tracker): increase prompt timeout to 10m	2025-05-27 10:58:46 -07:00
Vito Sansevero	de1fe46563	feat(utils): add utility modules for diagnostics, hashing, image monitoring, metadata extraction, prompt tracking, and validation	2025-05-24 12:26:31 -07:00