v1.0.0

ComfyUI-OpenClaw v1.0.0

Highlights

Secure Jobs API

• Replaced the placeholder jobs endpoint with an Admin-only, versioned jobs
  read model.
• Added bounded filtering, sorting, pagination, and normalized lifecycle states.
• Excluded raw prompts, workflows, errors, tracebacks, outputs, tenant data,
  reasoning, and internal content from job summaries.
• Added explicit empty, unsupported-host, and backend-unavailable responses.

Connector Jobs and Cancellation

• Added an Admin-only /jobs command with bounded counts and shortened job IDs.
• Kept raw jobs payloads out of connector chat LLM requests and error messages.
• Added targeted cancellation for /stop, /cancel, and /interrupt when job
  IDs are provided.
• Preserved explicit global interrupt behavior when no job ID is supplied.

Media and Output Improvements

• Added media-aware output handling for images, video, audio, 3D, and bounded
  text results.
• Added support for optional asset_hash and hash aliases while keeping
  filename-backed /view references first-class.
• Added explicit fallback links for HDR .exr and .hdr outputs.
• Added bounded previews for allowlisted file-backed text outputs.
• File previews enforce same-origin access, strict UTF-8 and MIME checks,
  a 64-KiB transfer limit, a 4,096-character display limit, and literal text
  rendering.
• Asset-service-only references remain explicit fallback states; direct
  /api/assets integration is not enabled automatically.

Host Compatibility

Updated compatibility references for:

• ComfyUI 1377a2f7
  (v0.27.0-47-g1377a2f7, project version 0.27.0).
• Standalone ComfyUI frontend 1.48.1.
• ComfyUI Desktop 0.9.4, with core 0.22.3 and embedded frontend 1.43.18.

Desktop remains tracked as a separate, intentionally lagging host surface.
Current sidebar APIs are preferred while compatibility fallbacks remain
available for older frontend bundles.

Model Manager and Workflow Compatibility

• Added current ComfyUI model folder aliases and managed model types.
• Preserved legacy folder names for older workflows and installations.
• Added stable ComfyUI usage-source attribution without overwriting
  caller-provided metadata.
• Preserved host-shaped, non-numeric node IDs and promoted-widget metadata in
  graph and Parameter Lab workflows.

Connector Media Security

• Added shared MIME-aware connector media responses.
• Dangerous SVG, HTML, JavaScript, CSS, and XML content now downloads with
  no-sniff protection instead of being rendered inline.
• Safe image delivery remains compatible with LINE and WhatsApp media flows.

Runtime and Tooling Reliability

• Clarified package, state-directory, runtime-cache, and sandbox ownership.
• Moved the default external-tool allowlist to the package-owned data directory.
• Added deterministic diagnostics for missing sandbox runtimes, executables,
  interpreters, timeouts, path violations, and process failures.
• Kept hardened external-tool execution fail-closed without adding unsafe
  fallback execution.
• Updated frontend test tooling to Vitest 4.1.

Documentation

• Added Atlas Cloud setup guidance through the existing OpenAI-compatible
  provider configuration.
• Updated API, connector, compatibility, frontend UX, threat model, release,
  and troubleshooting documentation.
• Documented jobs authorization, output preview limits, fallback behavior, and
  current host compatibility expectations.

Upgrade Notes

• The project version is now 1.0.0.
• Jobs API consumers must provide Admin authorization and consume jobs contract
  version 1.
• Connector /jobs requires an authorized Admin sender and
  OPENCLAW_CONNECTOR_ADMIN_TOKEN.
• HTTP 501 or 503 jobs responses must not be interpreted as an empty queue.
• No migration is required for existing workflows or file-backed previews.
• Existing /moltbot/* compatibility aliases remain available, but new
  integrations should use /openclaw/*.

Validation

• Complete backend, security, connector, compatibility, and regression suites
  passed.
• Supply-chain, secret-scanning, pre-commit, coverage, test-debt, and
  adversarial gates passed.
• Final Playwright suite passed 45/45.