# Frontend extension rules

These instructions apply to `web/`.

- ComfyUI auto-loads every JavaScript file below this directory through `WEB_DIRECTORY = "./web"`. A new file is a runtime feature, not passive documentation.
- Keep extensions idempotent: avoid duplicate buttons, listeners, styles, timers, and monkey patches after frontend reloads.
- Reuse ComfyUI's `app` and `api` modules through the existing relative import convention.
- Keep DOM IDs and extension names globally unique with the `o1key` prefix.
- Treat values received from workflows, API responses, filenames, and prompts as untrusted. Prefer `textContent`; sanitize before using `innerHTML`.
- Preserve old workflows through narrowly targeted rules in `js/migrateWorkflow.js`. A migration must be safe to run repeatedly.
- Do not introduce a bundler or external CDN dependency without an explicit architecture decision.
- When changing `js/o1keyImageGenerator.js`, run `node ../tests/test_o1key_image_generator_frontend.mjs`.
- Document new panels, server routes, or workflow migrations in `../docs/architecture.md` and `../docs/development.md`.