The Settings -> Security toggles (Allow Remote Full Access, Allow HTTP Token Transport, Require Token For All Writes) were persisted in the DB but ignored by _check_write_access() and the bootstrap-token endpoint, which only read MAJOOR_* env vars. Remote LAN clients hit 'Write access is blocked' even with all toggles enabled.
- New security_prefs_snapshot module: thread-safe in-memory snapshot of persisted prefs, hydrated at ensure_security_bootstrap() and republished on every set_security_prefs(). Read synchronously by guards.
- security.py::_resolve_security_flag(pref_key, env_var, default): single read site, snapshot-first / env-fallback. Used for allow_remote_write, require_auth, allow_insecure_token_transport.
- _bootstrap_enabled() also returns True when allow_remote_write is set in the snapshot (UI consent for remote bootstrap).
- bootstrap-token / rotate-token accept plain HTTP transport when allow_insecure_token_transport is on.
- Friendlier defaults so first install works zero-config on LAN: allow_remote_write=True, allow_insecure_token_transport=True. Auto-generated API token still gates writes.
- Error messages updated to point users to Settings -> Security instead of only env vars.
- README rewritten to put the UI flow first; env vars as headless fallback.
- pyproject.toml: per-file ignore F401 for routes/core/security.py since it is the single import point that re-exports from sub-modules.
GitHub silently drops <video> tags in README files. Replace with a
clickable GIF thumbnail that links to the release MP4, which works
in all GitHub renderers. Also removed the duplicate standalone GIF
below the description that was made redundant by the thumbnail.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- nodes.py: MajoorSaveImage (PNG with generation_time_ms in text chunks) and MajoorSaveVideo (MP4 via PyAV, GIF, WebP with metadata persistence)
- extractors_png.py: read generation_time_ms from PNG text chunks
- extractors.py: extract generation_time_ms from merged EXIF data into metadata dict
- extractors_video.py: extract generation_time_ms from ffprobe format tags
- messageCenter.js: add generation-time-persistence tip and topbar MFV button announcement
- CHANGELOG.md: document topbar MFV button and custom nodes
- README.md: add Custom Nodes section with input tables
- docs/CUSTOM_NODES.md: full node reference and extraction pipeline docs
- docs/DOCUMENTATION_INDEX.md: add CUSTOM_NODES.md entry
- Multi-Pin references: toggle buttons A/B/C/D to pin up to 4 images
- Node Parameters sidebar: view/edit workflow node widgets inside MFV
- Run button in viewer toolbar for immediate re-queue
- Expandable text areas for long prompts
- Sidebar position setting (right/left/bottom) via Settings
- Toolbar layout: Run and Node Parameters pushed to far right
- Message Center: 2 new announcements for the features
- Docs: VIEWER_FEATURE_TUTORIAL, FLOATING_VIEWER_WORKFLOW_SIDEBAR
- CHANGELOG v2.4.5, README aligned
- Added `_activeVideoAssetId` to track the currently active video asset in `playerBarManager.js`.
- Updated sync logic to ensure controls are remounted only when the asset changes.
- Improved handling of video synchronization and FPS settings.
feat(sideBySide): sanitize prompts for display
- Introduced `sanitizePromptForDisplay` to clean up prompts before displaying.
- Updated `_extractGridGenInfo` to use the new sanitization function for prompts.
feat(sidebar): enhance workflow section with size options and stats
- Added size options for the minimap in `SidebarWorkflowSection.vue`.
- Implemented workflow statistics display, including nodes, links, and groups.
- Persisted size and label settings for the minimap.
fix(generation): prevent filepath prompts from being displayed
- Updated prompt handling in `generationSectionState.js` to sanitize prompts.
- Added tests to ensure filepath-like prompts do not affect UI behavior.
feat(gridLoader): implement adaptive paging for grid loader
- Introduced `getAdaptivePageLimit` to dynamically adjust page size based on empty append batches.
- Updated `useGridLoader` to utilize adaptive paging logic.
feat(vectorIndexer): add regex for path-like prompts
- Implemented `_looks_like_path_prompt` to identify and handle path-like prompts in `vector_indexer.py`.
test: add unit tests for prompt sanitization and grid loader
- Created tests for prompt sanitization logic in `generation_prompt_sanitization.vitest.mjs`.
- Added tests for adaptive paging behavior in `grid_loader_adaptive_paging.vitest.mjs`.
- Implemented tests for sidebar workflow section functionality in `sidebar_workflow_section.vitest.mjs`.
- Added tests for player bar FPS synchronization in `viewer_player_bar_fps_sync.vitest.mjs`.
docs: update user guide and add privacy/offline documentation
- Added a privacy and offline usage guide in `PRIVACY_OFFLINE.md`.
- Updated user guide to reference new privacy documentation.
- Add new API endpoints for route logging settings
- Implement new settings in the advanced settings page
- Update installation instructions to reflect the correct WinGet package ID for ExifTool
- Added StacksService to manage asset stacks, including CRUD operations and automatic stacking based on job_id and workflow_hash.
- Created API routes for stacks, including listing, retrieving by job_id, managing stack members, setting cover assets, dissolving stacks, merging stacks, and triggering automatic stacking.
- Introduced new ColorSpaces and Volume classes in the three.js addon for enhanced color management and volume rendering capabilities.
- Added new AI_FEATURES.md guide covering all AI-powered capabilities
- Updated DOCUMENTATION_INDEX.md to include new AI features guide
- Added AI Features section to README.md with overview and models used
- Improved backfill warning information in README.md
- Updated reset index / delete DB procedures in DB_MAINTENANCE.md
- Added configuration options for AI features in README.md
- Added versioning and last updated dates to multiple documentation files.
- Introduced new features in the Drag & Drop Guide, Hotkeys & Shortcuts Guide, Installation Guide, Ratings, Tags & Collections Guide, Search & Filtering Guide, Security Model & Environment Variables Guide, Settings & Configuration Guide, and Viewer Feature Tutorial.
- Enhanced the Hotkeys & Shortcuts Guide with new shortcuts for the Majoor Floating Viewer (MFV) and improved organization.
- Updated installation prerequisites to include full Linux support and clarified Python version compatibility.
- Improved the Testing documentation with detailed test coverage sections for both backend and frontend.
- Modified API client to ensure proper authentication token handling.
- Updated health route handlers to improve logging for token operations.
- Created a backup README file with comprehensive project information and installation instructions.
- Created package.json to manage project dependencies and scripts for testing.
- Added test_scan_flow_integration.py to test incremental scanning and file removal functionality.
- Added test_search_flow_integration.py to test indexing and searching capabilities.
- Introduced vitest.config.mjs for Vitest configuration to set up the testing environment.
refactor: Improve connection handling in Sqlite class with reset checks
feat: Enhance CSRF protection to accept forwarded host from trusted proxies
test: Add tests for CSRF handling with trusted proxies and incremental scan behavior
- Introduced `addManagedListener` function to handle event listeners with automatic cleanup.
- Updated event listeners for various filter controls to use the new management function.
- Added lifecycle signal support for event listeners to ensure proper disposal.
- Implemented cleanup logic to remove event listeners when no longer needed.
---
Update database schema handling to support async operations
- Changed `db.has_table` to `db.ahas_table` for async compatibility.
- Updated related database checks to use the new async method.
---
Refactor SQLite adapter to prioritize async operations
- Transitioned public API to expose async methods as primary.
- Removed synchronous methods and replaced them with async counterparts.
- Updated internal transaction handling to support async context management.
- Enhanced error handling and logging for async operations.
---
Add async support for FFProbe tool
- Implemented `aread` and `aread_batch` methods for asynchronous metadata reading.
- Utilized asyncio subprocess for non-blocking execution of ffprobe commands.
---
Enhance IndexScanner with I/O throttling
- Introduced `SCAN_IOPS_LIMIT` to control I/O operations during directory scans.
- Implemented pacing logic to manage scan I/O operations effectively.
---
Update MetadataService to utilize async reading methods
- Refactored methods to call async variants of exif and ffprobe reading.
- Improved error handling for async operations.
---
Implement path resolution checks in asset routes
- Added `_is_resolved_path_allowed` function to enforce allowed roots for file paths.
- Updated asset route handlers to validate resolved paths against allowed roots.
---
Refactor database maintenance routes for async handling
- Changed database close operations to use async `aclose` method.
- Updated error handling during database maintenance operations.
---
Update scan routes to utilize async database vacuuming
- Replaced synchronous database vacuum calls with async `avacuum` method.
---
Modify tests to support async database operations
- Updated test examples to use async context management for database interactions.
- Refactored integration tests to ensure proper async cleanup of database connections.
- Adjusted regression tests to count async transaction invocations correctly.
- Introduced fallback readers for metadata extraction when ExifTool/ffprobe are unavailable, utilizing Pillow and hachoir for images and media files respectively.
- Added settings for metadata fallback preferences, allowing users to toggle image and media fallback options.
- Implemented route collision logging to prevent overlapping API paths.
- Added middleware for authentication on sensitive routes, ensuring secure access.
- Updated API documentation to reflect new endpoints and settings.
- Enhanced unit tests for metadata handling, case sensitivity in file paths, and fallback mechanisms.
- Removed compatibility shims for shared modules, consolidating imports under mjr_am_shared.
- Implemented caching for tool availability and versions.
- Added functions to check for ExifTool and FFprobe availability.
- Included version satisfaction checks against minimum required versions.
- Created utility functions for parsing boolean and float values from environment variables.
- Introduced shared utilities for error message sanitization and logging with emoji indicators.
- Established a Result pattern for error handling without exceptions.
- Added scan throttling helpers to manage background scans efficiently.
- Implemented time utilities for timestamps and performance measurement.
- Defined shared types, enums, and constants for consistent error handling and file classification.
- Created version management utilities to retrieve version information from pyproject.toml.
- Developed installation script for runtime dependencies.
- Added tests for ExifTool batch processing and various configuration scenarios.
- Implemented tests for version route aliases and runtime output root configuration.
- Implement tests for audio classification supporting AIFF and AIF formats.
- Create a test to verify audio metadata extraction from EXIF and FFprobe data.
- Add tests for detecting T2A and A2A workflow types in geninfo parsing.
- Validate extraction of lyrics and sampler widget values in the ace step workflow.
- Added DuplicatesService for background duplicate analysis and similarity detection.
- Introduced endpoints for analyzing duplicates, checking status, and merging tags.
- Created utility functions for file hashing and perceptual hashing.
- Implemented watcher settings for runtime tuning of debounce and deduplication.
- Added database maintenance tools for resetting and deleting the database.
- Enhanced error handling with sanitization for client responses.
- Added tests for duplicates service and error handling.
- Updated ESLint configuration for better code quality checks.
- Introduced filename validation and logging utilities.
- Create js/components/buttons.js specific for shared UI elements
- Refactor toolbar.js and Viewer.js to use shared buttons
- Fix viewer overlay theme variable inheritance
- specific ignore patterns added to .gitignore
Ewald