The retired-owner projection tests park a history read at a barrier
while the test performs a full multipart restore, then release it. The
barrier gave up after 5 s and raised inside the route handler, so on a
slow Windows runner (a 694 s suite run) aiohttp answered with its
text/plain 500 and the test reported 'history route missing'.
Every wait already ends on an event; the ceiling now only stops a broken
test from hanging (60 s). With restore slowed by 5.5 s locally, all 8
subtests failed with text/plain before and pass after.
History writes deliberately give up after a bounded 250 ms wait so they
never stall ComfyUI; the existing bounded-timeout test still proves that.
The concurrent replay tests assert that every peer succeeds, which is a
serialization and first-capture property, so they now raise the budget
to the shared 30 s busy timeout while the first writer is held open.
The budget is one named constant, EXECUTION_BUSY_TIMEOUT_MS, shared by
the transaction helper and the background writer.
Before: 20/20 'database is locked' with the held writer. After: 0/20.
The concurrent replay tests expected every peer to succeed, but each peer
only waits 250 ms for BEGIN IMMEDIATE by design. On a slow Windows runner
three queued commits exceeded that and a peer raised 'database is
locked'. Holding the first writer's transaction open for 500 ms makes the
same failure deterministic on any host (20/20 locally).
Every managed connection now goes through configure_connection: WAL,
foreign keys, the 30 s busy timeout and, when WAL is active,
synchronous=NORMAL. Under FULL each commit flushed to disk while it held
SQLite's only write lock; on slow Windows disks a burst of writers (a
scan beside ComfyUI saves, or the concurrency tests) starved a polling
waiter past the busy timeout and it failed with 'database is locked'.
With a 60 ms emulated flush on Linux, 8 threads x 50 save+use calls went
from 49.6 s with a 32.1 s worst call (and 'database is locked' in the
unit test) to 0.7 s with a 0.4 s worst call. NORMAL in WAL mode keeps the
database consistent after an application crash; only an OS crash or
power loss can drop the most recent commits. In-memory or non-WAL
databases keep SQLite's FULL default.
Concurrent writers failed with 'database is locked' on Windows runners
despite the 30 s busy timeout: every WAL commit flushed to disk while it
held the write lock, so polling waiters starved. These tests pin the
shared per-connection settings, including synchronous=NORMAL in WAL mode.
* test(inspect): add synthetic inspection parity fixtures and legacy characterization
* test(inspect): pin test-time parity vectors and keep fixtures fully synthetic
* fix(inspect): bound resolver work instead of graph size
* fix(inspect): bound shared-node and stripped-text work in the inspection profile
Keep one memo per resolution whose entries carry their unfolded visit cost;
a memo hit charges that cost to the current candidate's allowance only.
Cache node validation and charge input keys, stripped characters and copied
provenance entries to a whole-resolution work budget before doing the work.
The default profile is unchanged.
* fix(inspect): keep memoized depth honest across inspection candidates
A memo entry now records its height below the reusing depth; a hit raises
depth-limit exactly where a fresh walk would, so each candidate's outcome
matches its anchored result and does not depend on trace or node order.
The default profile is unchanged.
* test(inspect): pin memo height propagation
Three samplers share one chain, each later one hanging below a memo hit.
The third candidate must report depth-limit in both trace orders and when
anchored; removing the memo-hit height propagation fails this test. The
provenance test now asserts a plain subset.
* fix(inspect): tolerate ComfyUI node metadata quirks in projections
Projections now take a kind. Each prompt node keeps exactly class_type and
inputs; _meta, is_changed and other node keys are validated and dropped, so
"is_changed": [NaN] no longer marks the whole prompt graph malformed. A
nonfinite value inside inputs, anywhere in a workflow, or in a retained
carrier member projects to null and is never reported as a number. The
carrier applies the prompt/workflow kinds to its members. Exact numbers are
unchanged (Decimal spelling, unsafe integers as strings) and duplicate keys
are still malformed. The 500-node gate is replaced by a 20,000-node backstop
(workflow count includes subgraph definitions). Raw records are untouched.
The f14 inspection vector's facts become known; default vectors are unchanged.
* fix(inspect): budget metadata per record so large workflows never hide prompts
PNG inspection no longer counts every text chunk against one shared 2 MiB
budget. Role records (prompt, parameters, the pair execution record) keep a
2 MiB budget together, encoded and decoded, and exceeding it still fails the
whole read. A workflow has its own 4 MiB budget: a chunk over it is skipped
by seek, and a compressed one stops inflating at budget + 1. Only the
workflow is then reported as limited (record format "limited", no raw text,
workflow_graph limited); prompts, facts and the prompt graph are unaffected.
Each text chunk's keyword is read first (at most 80 bytes). Chunks that are
not retained are skipped by length without being read or checksummed, so
memory stays bounded. Byte-identical duplicates of a retained record are
accepted and do not consume budget; differing duplicates still raise
"Duplicate prompt metadata", and a duplicate of a limited workflow stays
limited. The chunk-count limit is unchanged.
InspectionRead gains limited_records (empty by default). The reader is only
used by the inspection routes, so ingestion, scan and import are unchanged.
Vectors: f04-inspection (2.5 MB workflow, within the new workflow budget)
and f15-inspection (identical duplicate chunks) now read and resolve, with
the same outcome and facts as f05-inspection. Default vectors are unchanged.
* fix(inspect): keep prompt evidence longest under the response budget
* fix(inspect): bound identical duplicate chunk reads
* fix(inspect): fail closed when role duplicates exceed their budget
* fix(inspect): use the bounded inspection profile end to end
Inspection routes resolve with INSPECTION_PROFILE and expose reason_code
and node on the resolution; scan, live monitor and admin import keep the
default profile (pinned by spies over the real resolver on f03).
JS facts drop the entries and workflow node-count gates; per-lookup visit
sets and the server's node ceiling bound the work. The validator accepts
the textless `limited` workflow format, follows the workflow-first
response omission order, and checks the closed reason-code vocabulary.
The file inspector labels limited records and disables their workflow
download.
vectors.json: 12 inspection vectors gain their reason codes; f03 facts
become known and f01 facts ambiguous. Default vectors are unchanged. A
new parity test asserts vectors.json facts through the workspace JS.
* chore(tools): add read-only inspection corpus tool
tools/inspection_corpus.py runs the inspection route pipeline and the
workspace JS facts of a chosen code tree over a media folder, read-only,
and reports the #240 invariants H1 to H8 with aggregate counts. Rows hold
statuses and SHA-256 digests of resolved role texts, never file names or
prompt text unless --with-paths is given. Outputs inside the root or a code
tree are refused.
The facts-over-vectors test now fails instead of skipping when CI is set
and Node.js is missing.
* docs(testing): document bounded inspection work
* fix(tools): fail the corpus run when facts or inspection did not run
Rows whose facts were never computed (no or exiting Node.js) now fail H3,
and a new harness line fails on any tool exception or missing facts, so a
run where nothing was measured can no longer exit 0. Unreadable files stay
inspector outcomes. A missing --node binary is refused, an exited harness
is reaped, H8 has a 50 ms floor for tiny baselines, and JSONL rows are
sorted by id.
* docs(inspect): correct ceiling wording and bandit annotations
Describe the two 20,000-node ceilings (prompt entries, workflow UI plus
subgraph nodes) in TESTING.md, and use bare nosec ids so Bandit stops
warning about unparsed test names.
* test(inspect): make parity observation tuples explicit
* fix(library): close recipe editor follow-ups from the native editor slice
- After restored storage, Create text revision and Archive are disabled so
they cannot re-read an old numeric ID; only Reload Library remains.
- The storage-changed exit in Edit, revision and Add negative states that
Reload Library closes the dialog and discards the entries (the concept
has no discard confirmation, so the copy stays inline).
- When Save becomes disabled after an unconfirmed write or a conflict,
focus moves to the recovery action instead of falling to the body; the
archive confirmation does the same.
- A reuse toast only says the entered parent metadata was not applied when
the controller found it differs from the stored metadata.
- Prompt history opens on its first negative variant, as the concept does,
so the heading Send starts enabled.
- "1 linked image" is singular on cards, variant lanes and the embedded
gallery count.
* fix(library): treat a blank category as equal to a stored uncategorized one
A reuse that left the category blank sent "Uncategorized" and compared it
with the stored NULL, so the toast claimed the entered metadata was not
applied. Both sides now normalize blank and "Uncategorized" the same way
before comparing; a genuinely different category still discloses it.
* test(coverage): raise frontend coverage floors after editor follow-ups
* fix(library): singular counts for one item and honest discard copy
- One shared countOf/noun helper (web/js/workspace/plural.mjs) now words
linked images, saved negative variants (card chip and history count),
distinct recorded runs and the Images toolbar count in the singular for
exactly one; every other count keeps its existing wording.
- The restored-storage status says "Leaving this dialog discards your
entries." because Cancel, the close button and Escape discard the
draft too, not only Reload Library.
- The new helper gets its coverage floor; no other floor changes.
* fix(library): open every prompt history visit on its first negative
The concept resets to the first negative variant on every navigation to a
prompt (navigate: state.variant = 0) and selects another pair only right
after a save names it. The history no longer remembers a clicked variant
or an explicit All images choice across visits: the per-visit memory is
replaced by a one-shot saved selection that the next history mount (or the
same visit's reconciliation) consumes, and a verified pair outside the
loaded page is kept only for that saved selection. Within a visit, clicks
and All images behave as before.
* fix(maintenance): keep titled and history-referenced prompts when pruning
prune_orphaned_prompts now also keeps prompts with a prompt_library_state
row (titled or explicit Library parents, whose state would cascade away)
and prompts that are the currently valid navigation hint of a recorded
run (execution_run_contexts positive/negative_prompt_id in the current
storage epoch whose exact raw snapshot text still matches). Stale hints
that history reads already ignore do not block pruning.
Fixes#237
* fix(maintenance): mirror unique-text hint rule and compute live hints once
The prune exempted a hinted prompt even when another prompt shared its
exact raw text, although history reads treat such a hint as dead. The
live-hint set now applies the reader's rule (current storage epoch, exact
raw text matching exactly one prompt, which is the hinted one) and lives
beside _prompt_hint in execution_contexts as LIVE_HINT_CTES.
The set is materialized once per statement and excluded with NOT IN, so
the prune no longer scans execution_run_contexts once per prompt. No
schema or index change.
Refs #237
* feat(library): manage native editor drafts and recovery
* fix(library): fence pair archive retries against restored storage
* feat(library): add native recipe editor dialogs
* fix(library): read archive counts through the editor controller
* feat(library): reconcile editor saves and archived pairs
Wire the concept's heading actions (Library Export and + New prompt, Images New prompt, history ← Prompt library, Edit metadata and pair Send to ComfyUI) and the Negative variants + Add negative and Show archived controls. Saves navigate or reconcile in place through createLibraryDetail.accept, invalidate cached shelf state by write generation, browse and restore archived pairs, and offer an explicit Library reload when storage was restored.
* fix(library): refresh archived pairs and align editor outcomes
* test(library): enforce approved native editor presentation
* test(library): verify editor host and coverage compatibility
Adds the rejected connected-target host assertion, pins the stock host listing at 80 cases, documents the native editor, and keeps Save/Archive focus after a failed write.
* docs(testing): correct host case totals and cover archive focus
* fix(library): fence editor reloads after restore and settle outcome copy
* ci: cancel superseded PR runs and make the bandit job a real gate
No PR workflow had a concurrency group, so a new push left the previous
run occupying 16 Python matrix runners, the real ComfyUI job and the
three viewerjs jobs for up to 25 minutes. Add a group per workflow and
PR ref that cancels the older run. Pushes to main use the run id as
their group, so no main commit is ever cancelled or dropped as pending.
Remove the lint job from code-quality.yml. It ran black and flake8 a
second time, partly with --exit-zero, next to the protected "black and
flake8" job in test.yml.
The security job ran bandit with "|| true" and could never fail. At
medium severity it reports 74 findings today, so it now gates on high
severity only and prints the medium report without failing. The only
two high findings were SHA1 and MD5 used as a gallery entry id and a
LoRA preview cache filename; mark both usedforsecurity=False, which
leaves every hash value unchanged.
Closes#230.
* ci: verify superseded PR runs are cancelled
* ci: require the bandit high-severity check
Review on #231 pointed out that a failing bandit job did not block a
merge because its context was not required. Name the job
"bandit (high severity)" so the required context is unambiguous, and
add it to .github/branch-protection.json and the TESTING.md list of
required checks.
* ci: run Firefox and WebKit page workflows in parallel jobs
The viewerjs job ran the Chromium/touch coverage pass and then the
Firefox and WebKit page workflows serially on one runner. The suite
grew from 396 to 496 tests in #227 and the job passed its 25 minute
cap with every test green, which #227 papered over by raising the
budget to 40 minutes.
Split the workflow into a frontend-coverage job, a fail-fast: false
matrix with one runner per browser, and an aggregate viewerjs job that
needs both and fails unless each result is success. The aggregate keeps
the exact "viewerjs" context that branch protection requires, so
.github/branch-protection.json is unchanged. Browser projects, the
single Playwright worker and per-test timeouts are untouched. Coverage
keeps the frontend-test-reports artifact; Firefox and WebKit traces
move to browser-traces-<browser>.
Closes#228.
* ci: keep the frontend coverage job on a 25 minute budget
Merging main carried the 40 minute budget from #227 onto the new
frontend-coverage job. That job no longer runs the Firefox and WebKit
workflows and took 9m31s in run 39178111649 at 396 tests, so the
original 25 minute budget is the right one for all three jobs.
* feat(history): add bounded chronological read projections (#209)
* fix(history): validate internal continuation positions (#209)
* feat(history): expose fenced history windows and run details (#209)
* fix(history): release retired projection connections (#209)
* feat(history): resolve reported outputs through current authorization (#209)
* fix(history): reject invalid inspection targets (#209)
* feat(history): add scoped history state and current-file adapter (#209)
* fix(history): preserve slideshow and clear stale reentry actions (#209)
* feat(history): render recorded executions and frozen run details (#209)
* fix(history): recover receipts and refresh capture evidence (#209)
* test(history): verify chronological history across restore and host modes (#209)
* fix(history): enforce chronological marker visual parity (#209)
* fix(history): resolve final chronological review findings
Address #209 recovery, bounded visit restoration, exact receipt availability, and portable regression coverage.
* test(history): repair Windows fixtures and review feedback
Address #209 and PR #227 native path, cleanup, media and review-comment expectations. Document Windows portability preflight without changing production behavior.
* ci: raise the viewerjs job budget for the larger browser suite
The cross-browser workflows suite grew from 396 to 496 tests on this
branch, which pushed the whole viewerjs job to about 25.5 minutes
against the 25 minute cap set in #181. Two exact-head runs on this
branch timed out without any test failing: run 39173019283 was killed
on test 474 of 496, and run 39175125474 printed "496 passed (12.8m)"
and was then cancelled during Playwright shutdown.
Raise only the job budget. Browser projects, workers and per-test
timeouts are unchanged. Splitting the browsers into parallel jobs is
tracked separately.
* feat(inspector): expose bounded physical file evidence
* fix(inspector): distinguish ambiguous saved associations
* feat(inspector): derive conservative generation facts
* fix(inspector): guard fact ancestry and inspection state
* feat(inspector): share complete file details and exports
* fix(inspector): preserve fact states and touch targets
* feat(viewer): navigate the loaded media collection
Refs #216
* fix(viewer): refit after current stage geometry changes
Ref #216. Observe the current media stage after readiness and wrapped title changes without rebuilding focused controls or resetting transforms at unchanged dimensions.
* feat(viewer): add lifecycle-safe slideshow and media preferences
* fix(viewer): resume gallery continuation after close (#216)
* fix(images): guard source recovery and wrap viewer actions
Clear stale root and folder intent, cancel old pages, and wait for current source discovery before loading a refreshed collection. Preserve safe retry through failed, superseded, and disposed discovery.
Wrap narrow viewer footer actions and wait for measured gallery viewport settling in responsive checks. Refs #216; addresses PR #224 review.
* test(viewer): await gallery layout after viewport changes
Require actual inner, root client, and document widths to agree after each responsive-case viewport and CSS zoom transition. Keep the existing exact frame, overflow, focus, and coarse target assertions unchanged.
Observed PR #224 CI initial mobile resize at537px before pending card relayout settled to356px. Refs #216.
* fix: preserve gallery root identity across media and metadata
Fixes#173
* fix: ignore stale gallery metadata responses
Fixes#174
* test: use platform-valid gallery filenames on Windows
* get_image_prompt_info: include gi.parameters in SELECT and return value
The function selects workflow_data, prompt_metadata and generation_time from
generated_images but omits the parameters column, so the A1111/Forge
generation-parameters string (steps, sampler, CFG, seed, LoRA list) never
reaches the API even when present in the database. Add it to the SELECT and
include it in the returned dict.
* parse A1111/Forge parameters: multi-line prompts, structured settings
_parse_comfyui_prompt took lines[0] of the parameters chunk as the whole
positive prompt, truncating every multi-line prompt to its first line, and
matched 'negative prompt:' only as a full line start. Split on the trailing
'Steps: ...' settings line instead, keep the full multi-line positive prompt,
and extract Steps / Sampler / Schedule type / CFG scale / Seed as structured
fields alongside the raw string.
Together with the get_image_prompt_info SELECT fix (previous commit), the
full A1111/Forge generation recipe now flows from the database to the API.
* style: apply black to the A1111 parameters parser
CI's black --check flagged py/api/__init__.py (slice spacing and two long
lines in the settings extraction). Formatting only; the AST is unchanged.
---------
Co-authored-by: kai <kai@hermes.local>
- Fix Prompt Manager UI routing behind a ComfyUI proxy mount such as
SwarmUI's /ComfyBackendDirect/ (#164, thanks @ghosttigerllc-bit)
- Restore runtime minimums Pillow>=8.0.0 and watchdog>=2.1.0: nothing
requires the newer floors, and raising them forces upgrades in users'
shared ComfyUI environment
Vito Sansevero