Add native OpenAI Decisions and OpenRouter Decisions API routing to the image and text Decision Router nodes while keeping local in-process llama.cpp inference as the default.
Discover OpenRouter decision models by input modality and decision output capability, then enforce server profile image policy and optional model allowlists both in the UI model catalog and before inference. Keep credentials and endpoints in server-side profiles; apply profile input, image, and timeout limits; never fall back to chat-generated JSON.
Preserve saved workflow widget order, release any retained local model when switching to API mode, and normalize typed route choices, probabilities, and confidence into decision_json. Add API setup documentation and adapter/router/security regression coverage.
Validation: 240 tests passed across six test modules run individually in bundled ComfyUI Python 3.12; Python and JavaScript syntax checks, API catalog validation, version metadata checks, and git diff --check passed. Provider inference is covered with mocked responses; no authenticated live inference was run.
* feat: full per-provider model lists with release-time auto-refresh and dedicated custom model field
* feat: add setup help widget to API node (Windows/Linux API key instructions)
* Add OpenAI-compatible API node
* Document OpenAI-compatible API node
* Harden API credentials with server-side profiles
* Ignore local API profile and env files
* Add server-side API profile example
* Document hardened server-side API profiles
* Add API profile security regression tests
* Make API security test loader standalone
* Use generic model ID in API profile example
* docs: expand secure API deployment and secret handling guide
* Harden API transport and request controls
* Fix Python booleans in hardened API node
* Expand API security regression tests
* Update secure API profile examples
* Ignore local API profile variants
* Document hardened API deployment and threat model
* Add CI for API security regressions
* Cap Qwen thinking budget and fail closed on invalid overrides
* Cover thinking budget and fail-closed profile overrides
* Document thinking-budget limits and fail-closed overrides
* Run API security CI for docs and policy changes
Marcel Hofer