v2.51.0

Random AI prompt + image generator for the Stable Diffusion WebUI -- a CLI and a local web UI.

Pre-release software. Provided as-is under Apache-2.0.

What's new in this release

2026-07-07 — Pre-release hardening: preset-loader path-traversal fix + engine-module coverage (2.51.0)

SonarCloud (on the 2.51.0 release PR) flagged the new shared engine modules — fixed for real before
shipping rather than merging a red gate:

• Security (path traversal). engine/presets.js loadPreset(name) built a file path from name,
  which arrives from the /api/prompt request body — so a crafted preset with ../separators could
  read arbitrary *.json files. It now rejects anything but a plain preset name. Regression-tested.
• Coverage. The three new modules (promptRun.js / nodeEngine.js / presets.js) weren't in the
  Vitest coverage allowlist, so Sonar saw 0% on them. Added them + focused unit tests
  (tests/unit/{promptRun,presets,nodeEngine}.test.js) → ~100% lines each; global thresholds hold.
• False positive. Suppressed S2245 (Math.random) for promptRun.js's batch-seed mint — a creative
  prompt seed, never security-sensitive (same as the existing rng.js / random.js suppressions).
  Full gate green (419 web + the Node suite incl. the new specs).

2026-07-07 — New targets/comfyui/ target: ComfyUI prompt-engine nodes (2.51.0)

Added a ComfyUI custom-node target (targets/comfyui/) that brings the prompt engine into ComfyUI as
natural-language-first STRING sources for a CLIP Text Encode. Prompt-side only — ComfyUI already
owns image generation, upscaling, variations, and re-roll (its native seed widget), so the target adds
just the prompt half (the DPL processor, blocks, lists, presets).

• Thin Python wrappers, no re-ported engine logic. The nodes make HTTP calls to a running app's
  local backend (point-at-running-app; default http://localhost:4173, auto-detects a running app on
  localhost:4173/5173, override via a Settings field / RANDOM_AI_PROMPT_URL). Two new backend routes power it —
  POST /api/prompt and GET /api/prompt/catalog — reusing the shared engine/promptRun.js,
  engine/nodeEngine.js, and engine/presets.js (all extracted this session so nothing is duplicated;
  the CLI re-exports the same modules). Dependency-free (stdlib urllib).
• Nodes: a flagship natural-language RandomAIPromptGenerator (template + seed + nsfw + preset) plus
  helpers PromptList / PromptBlock / DPLExpand / PromptBatch (N variations as a list) /
  CombinePrompts (join wired pieces) / ShowPrompt (display + pass-through). Re-roll is the native seed
  widget (control_after_generate); presets come from engine/data/presets (+ user/presets). Every
  input/output carries a tooltip + each node a description; the generator is top-level, the helpers grouped
  under a submenu. (An AI-rewrite node was considered and dropped — calling a third-party API mid-graph is
  off-paradigm for ComfyUI, and the plugin now makes zero third-party calls.)
• Frontend extension (web/randomAiPrompt.js): the single Settings URL field (drives dropdowns and
  generation via a persisted /random_ai_prompt/config), LIVE dropdowns from the catalog (same-origin
  proxy routes, avoiding CORS), the app icon + brand colours on the nodes, the ShowPrompt text display,
  and a status sidebar. Plus a drag-in example_workflows/ starter and an Apache-2.0 LICENSE.
• Verify: the engine/backend side is covered by tests/integration/promptApi.test.js (generate, seed
  reproducibility, preset apply + unknown→400, catalog); the Python + ComfyUI-runtime JS are
  syntax-checked and must be validated in a running ComfyUI (manual — no CI runtime). Full gate green.
  New deep-dive systems/comfyui.md; credits + CLAUDE.md updated; legal pages
  re-checked (localhost only — no third-party data flow).

2026-07-07 — Dispose of the chaos knob; extract a shared engine-owned prompt-run (2.50.1)

Removed the chaos value for good. It was a pre-DPL knob for controlling randomization (scaling the
whole emphasis/editing/alternating envelope at once, with blocks meant to react to it) that predated the
DPL wrapper and was never liked; it was never an engine setting (engine/settings.js never had it), and
its UI control had already been unmounted on 2026-06-19. Deleted withChaos from the web facade
(targets/web/frontend/lib/promptEngine.js) and the CLI, dropped the CLI --chaos flag
(optionSpec.js), and swept the current-state docs (removed-pending-readd.md row deleted; status.md,
cli.md, dpl-language.md, prompt-dsl.md, next-steps.md, the Home.jsx comment). Left untouched:
Midjourney's own unrelated --chaos provider parameter, and the word "chaos" in the vocabulary lists /
block descriptions. Default prompt output is byte-identical (withChaos was a no-op at chaos = 1); the
snapshot + CLI reproducible-prompt tests confirm it.
In the same pass, extracted the duplicated seed/reroll prompt-run logic into a new engine-owned,
isomorphic module engine/promptRun.js (seedFor, forEngine, and a createPromptRun(engine)
factory). The web SPA facade and the CLI's promptRun.js now consume it instead of each carrying their
own copy — so the seed rules live in one place, and the upcoming ComfyUI backend prompt route can reuse
them rather than re-porting the logic a third time. No behavior change: 293 Node + 419 web tests, lint,
and doc-link checks all green.

2026-07-07 — New targets/cli/ target: the prompt command-line tool (2.50.0)

Added a command-line build target — a traditional args-and-flags CLI (prompt, package
@random-ai-prompt/cli) that generates prompts and runs them through image providers using the same
engine, providers, settings, and on-disk store as the web/desktop app (parity with both the engine
and the GUI, by default). No TUI/interactive mode — every capability is a subcommand with flags, a
--help page, colored output (picocolors; honors NO_COLOR/FORCE_COLOR), and completion for
bash, zsh, fish, and PowerShell.

• Commands: generate (default; every engine/settings.js field is a flag, plus provider/image/
  rewrite knobs, --seed/--random, --nsfw, --preset, --json), list
  (blocks/lists/providers/presets/dialects/samplers/settings), config, keys, rewrite, upscale,
  and completion.
• Reuse, not fork: a Node provider registry (src/lib/providers.js) replaces the SPA's Vite-glob
  registry (fs-discovers shared/<id>/config.js + _shared/settings/*.js); the CLI runs the real
  backend (apiHandler.js) in-process on an ephemeral port with a fetch shim, so every
  provider's own code/generate.js runs unchanged and images save to the shared output/ folder with
  the same sidecar the gallery reads. An ESM resolve hook (src/lib/jsonLoader.mjs) injects
  type: json so the providers' bare JSON imports load under Node.
• Shared state: CLI defaults persist to their own cli namespace (never clobbering the GUI's
  settings.json); BYOK keys are read from both stores, so keys are shared between the CLI and the app
  (or supplied per-run via PROMPT_KEY_<PROVIDERID>). An api provider is only called with --images,
  so a plain prompt -p openai "x" never spends credits.
• Wiring/tests: root postinstall installs the CLI; npm run cli runs it; the root ESLint gate
  now lints targets/cli (Node ESM) and CLI unit tests live in tests/cli/cli.test.js (14 tests, in
  the root Vitest gate). See systems/cli.md.

How to get it

Prefer not to build? Download a pre-built edition:

• Desktop app -- Windows .msi / .exe (or a portable .zip), macOS .dmg, Linux .AppImage / .deb (attached below). Self-contained; nothing to install first.
• random-ai-prompt-2.51.0-online.zip -- the online edition as static files; host it anywhere, or just use https://prompt.fairyfox.io.
• random-ai-prompt-2.51.0.tar.gz -- source tarball (run with Node 24: npm install then npm start).
• random-ai-prompt-2.51.0-docs.zip -- the generated documentation site.

What's Changed

• Release v2.51.0 — ComfyUI target + headless prompt routes by @junebug12851 in #47

Full Changelog: v2.49.6...v2.51.0