What's Changed
- v5.10.0 — The Capability Manifest: the bridge advertises, the sidebar renders by @JosephOIbrahim in #100
Full Changelog: v5.9.1...v5.10.0
Where each piece lives
The headline feature spans two surfaces that install differently — worth knowing before you upgrade.
From PyPI (pip install -U comfy-cozy, or uvx comfy-cozy): the cozy CLI and the agent package. This release adds the supporting layer there — live tool-registry introspection and loaded-build identity, including a fix that stops a failed optional layer from retrying its import on every tool dispatch, and a model-swap fix so a mid-conversation swap_model actually reaches the stream instead of silently continuing on the previous provider.
From the git checkout, symlinked into ComfyUI's custom_nodes (see the README): the GET /agent/capabilities route and the sidebar capability card / version chip. The ComfyUI-side node pack and web assets are not part of the wheel and never have been — the wheel ships agent and cognitive only. If you install from PyPI alone, you get the CLI and the plumbing, not the in-ComfyUI panel.
Security note
The manifest endpoint's relaxed gate keys on the Host header rather than the socket peer address. A read-only endpoint has to stay reachable by the sidebar's own fetch, which omits Origin on a same-origin GET — but a loopback peer proves nothing: a same-host reverse proxy makes every inbound request look local, and a DNS-rebound page is genuinely same-origin. This is hardening rather than a unique hole (a ComfyUI exposed that way already has larger unauthenticated surfaces in core), and it was caught by adversarial review before the route ever shipped.
