Add native OpenAI Decisions and OpenRouter Decisions API routing to the image and text Decision Router nodes while keeping local in-process llama.cpp inference as the default.
Discover OpenRouter decision models by input modality and decision output capability, then enforce server profile image policy and optional model allowlists both in the UI model catalog and before inference. Keep credentials and endpoints in server-side profiles; apply profile input, image, and timeout limits; never fall back to chat-generated JSON.
Preserve saved workflow widget order, release any retained local model when switching to API mode, and normalize typed route choices, probabilities, and confidence into decision_json. Add API setup documentation and adapter/router/security regression coverage.
Validation: 240 tests passed across six test modules run individually in bundled ComfyUI Python 3.12; Python and JavaScript syntax checks, API catalog validation, version metadata checks, and git diff --check passed. Provider inference is covered with mocked responses; no authenticated live inference was run.
Add separate image and text Decision Router nodes with configurable system prompts, up to 52 user-defined routes, per-item decisions, normalized decision_json output, and native IMAGE/STRING route sockets.
Run Clef-Flash 9B, Clef 27B, and OpenJev 27B in-process through llama.cpp. Add decision-head, logits, MTMD vision, and dynamic CUDA backend capability checks before model downloads. Keep model weights and vision projectors out of the repository; do not launch a separate llama-server or upgrade PyTorch/Transformers.
Block inactive route outputs so unused downstream branches are skipped. Keep dynamic route names synchronized with connected outputs and preserve stable socket identities. Register the commercial UI variant while keeping non-commercial OpenJev unavailable in commercial builds.
Update all 3.0.0 package metadata, README, runtime and workflow guides, the illustrated router example, and the detailed update log. Refresh regression expectations for commercial router registration and the current provider model catalog.
Validation: all 220 tests pass in the bundled ComfyUI Python 3.12 runtime. Python compilation, JavaScript syntax, version metadata, README image, and staged diff checks pass. The Image Router was manually exercised with Clef-Flash 9B on fox, dog, cat, and none routes.
Coverage limits: full-weight inference for Clef 27B and OpenJev 27B, text-mode smoke tests, and clean installs across other OS/Python/CUDA combinations remain unverified. The documented Windows x64, CPython 3.12, CUDA 13.0 JamePeng runtime is the only verified build matrix.
* feat: full per-provider model lists with release-time auto-refresh and dedicated custom model field
* feat: add setup help widget to API node (Windows/Linux API key instructions)
* Add OpenAI-compatible API node
* Document OpenAI-compatible API node
* Harden API credentials with server-side profiles
* Ignore local API profile and env files
* Add server-side API profile example
* Document hardened server-side API profiles
* Add API profile security regression tests
* Make API security test loader standalone
* Use generic model ID in API profile example
* docs: expand secure API deployment and secret handling guide
* Harden API transport and request controls
* Fix Python booleans in hardened API node
* Expand API security regression tests
* Update secure API profile examples
* Ignore local API profile variants
* Document hardened API deployment and threat model
* Add CI for API security regressions
* Cap Qwen thinking budget and fail closed on invalid overrides
* Cover thinking budget and fail-closed profile overrides
* Document thinking-budget limits and fail-closed overrides
* Run API security CI for docs and policy changes
Marcel Hofer