nai-aclab 1.0.1 → 1.0.3

package/README.md

@@ -121,6 +121,10 @@ override가 입력되어 있으면 모든 프리셋 조합에서 override 값을
 
 토큰을 넣기 전에는 목업 모드로 UI 흐름을 먼저 테스트할 수 있습니다.
 
+API 토큰은 `app_state.json`에 저장하거나 `/api/state` 응답으로 다시 내려보내지 않습니다. 한 번 입력한 토큰은 별도 secret store에 저장되어 다음 실행 때 자동으로 사용됩니다.
+
+생성 히스토리에는 이미지 표시와 작가 가중치 비교에 필요한 최소 정보만 저장합니다. 최종 프롬프트, 네거티브 프롬프트, UC 프롬프트, 생성 요청 JSON, 로컬 절대 경로는 별도로 저장하지 않습니다. 이전 버전에서 생성된 `*_request.json` 파일은 앱 시작 시 자동으로 제거됩니다.
+
 ## 저장 위치
 
 앱 상태, 생성 이미지, 요청 JSON은 아래 위치에 저장됩니다.

package/app.py

@@ -32,6 +32,7 @@ USER_DIR = Path(
 DATA_DIR = USER_DIR / "data"
 OUTPUT_DIR = USER_DIR / "outputs"
 STATE_PATH = DATA_DIR / "app_state.json"
+TOKEN_SECRET_PATH = DATA_DIR / ("api_token.dpapi" if os.name == "nt" else "api_token.secret")
 DEFAULT_USER_AGENT = (
     "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
     "AppleWebKit/537.36 (KHTML, like Gecko) "
@@ -44,6 +45,127 @@ def ensure_dirs() -> None:
     OUTPUT_DIR.mkdir(parents=True, exist_ok=True)
 
 
+def _windows_protect(data: bytes) -> bytes:
+    import ctypes
+    from ctypes import wintypes
+
+    class DataBlob(ctypes.Structure):
+        _fields_ = [("cbData", wintypes.DWORD), ("pbData", ctypes.POINTER(ctypes.c_byte))]
+
+    crypt32 = ctypes.windll.crypt32
+    kernel32 = ctypes.windll.kernel32
+    buffer = ctypes.create_string_buffer(data)
+    in_blob = DataBlob(len(data), ctypes.cast(buffer, ctypes.POINTER(ctypes.c_byte)))
+    out_blob = DataBlob()
+    if not crypt32.CryptProtectData(ctypes.byref(in_blob), None, None, None, None, 0, ctypes.byref(out_blob)):
+        raise OSError("Failed to protect API token with Windows DPAPI.")
+    try:
+        return ctypes.string_at(out_blob.pbData, out_blob.cbData)
+    finally:
+        kernel32.LocalFree(out_blob.pbData)
+
+
+def _windows_unprotect(data: bytes) -> bytes:
+    import ctypes
+    from ctypes import wintypes
+
+    class DataBlob(ctypes.Structure):
+        _fields_ = [("cbData", wintypes.DWORD), ("pbData", ctypes.POINTER(ctypes.c_byte))]
+
+    crypt32 = ctypes.windll.crypt32
+    kernel32 = ctypes.windll.kernel32
+    buffer = ctypes.create_string_buffer(data)
+    in_blob = DataBlob(len(data), ctypes.cast(buffer, ctypes.POINTER(ctypes.c_byte)))
+    out_blob = DataBlob()
+    if not crypt32.CryptUnprotectData(ctypes.byref(in_blob), None, None, None, None, 0, ctypes.byref(out_blob)):
+        raise OSError("Failed to unprotect API token with Windows DPAPI.")
+    try:
+        return ctypes.string_at(out_blob.pbData, out_blob.cbData)
+    finally:
+        kernel32.LocalFree(out_blob.pbData)
+
+
+def save_api_token(token: str) -> None:
+    token = token.strip()
+    if not token:
+        return
+    ensure_dirs()
+    raw = token.encode("utf-8")
+    payload = _windows_protect(raw) if os.name == "nt" else raw
+    TOKEN_SECRET_PATH.write_bytes(payload)
+    if os.name != "nt":
+        try:
+            TOKEN_SECRET_PATH.chmod(0o600)
+        except OSError:
+            pass
+
+
+def load_api_token() -> str:
+    try:
+        payload = TOKEN_SECRET_PATH.read_bytes()
+    except OSError:
+        return ""
+    try:
+        raw = _windows_unprotect(payload) if os.name == "nt" else payload
+        return raw.decode("utf-8")
+    except Exception:
+        return ""
+
+
+def has_saved_api_token() -> bool:
+    return bool(load_api_token().strip())
+
+
+def cleanup_saved_request_jsons() -> None:
+    try:
+        for path in OUTPUT_DIR.rglob("*_request.json"):
+            if path.is_file():
+                path.unlink()
+    except OSError:
+        pass
+
+
+def state_dict_without_secrets(state: AppState | dict) -> dict:
+    data = asdict(state) if not isinstance(state, dict) else dict(state)
+    api = dict(data.get("api", {}) or {})
+    api["token"] = ""
+    data["api"] = api
+    data["history"] = [sanitize_history_entry(item) for item in data.get("history", [])]
+    return data
+
+
+def output_ref(path_value: str) -> str:
+    raw = str(path_value or "").strip()
+    if not raw:
+        return ""
+    path = Path(raw)
+    try:
+        if path.is_absolute():
+            return str(path.resolve().relative_to(OUTPUT_DIR.resolve())).replace("\\", "/")
+    except (OSError, ValueError):
+        return path.name
+    return raw.replace("\\", "/")
+
+
+def sanitize_history_item(item: dict) -> dict:
+    clean = {
+        key: value
+        for key, value in dict(item or {}).items()
+        if key not in {"prompt", "negative_prompt", "uc_prompt", "request_path", "request_url"}
+    }
+    if "path" in clean:
+        clean["path"] = output_ref(clean.get("path", ""))
+    return clean
+
+
+def sanitize_history_entry(history: dict) -> dict:
+    clean = dict(history or {})
+    if "output_dir" in clean:
+        clean["output_dir"] = output_ref(clean.get("output_dir", ""))
+    clean["items"] = [sanitize_history_item(item) for item in clean.get("items", [])]
+    return clean
+
+
 def now_id() -> str:
     return time.strftime("%Y%m%d_%H%M%S")
 
@@ -223,8 +345,11 @@ def default_state() -> AppState:
 
 def load_state() -> AppState:
     ensure_dirs()
+    cleanup_saved_request_jsons()
     if not STATE_PATH.exists():
-        return default_state()
+        state = default_state()
+        state.api.token = load_api_token()
+        return state
     data = json.loads(STATE_PATH.read_text(encoding="utf-8"))
     base_data = data.get("base_presets", [])
     quality_override = data.get("quality_override_prompt", "")
@@ -237,9 +362,24 @@ def load_state() -> AppState:
             else next((item for item in base_data if item.get("quality_override_prompt")), None)
         )
         quality_override = (fallback_base or {}).get("quality_override_prompt", "")
-    api_data = data.get("api", {})
+    api_data = dict(data.get("api", {}) or {})
+    legacy_token = str(api_data.pop("token", "") or "").strip()
+    if legacy_token and not has_saved_api_token():
+        save_api_token(legacy_token)
+        data["api"] = api_data
+        STATE_PATH.write_text(
+            json.dumps(state_dict_without_secrets(data), ensure_ascii=False, indent=2),
+            encoding="utf-8",
+        )
     if api_data.get("user_agent") in (None, "", "NAIArtistCombination/0.1"):
         api_data["user_agent"] = DEFAULT_USER_AGENT
+    sanitized_data = state_dict_without_secrets(data)
+    if sanitized_data != data:
+        STATE_PATH.write_text(
+            json.dumps(sanitized_data, ensure_ascii=False, indent=2),
+            encoding="utf-8",
+        )
+    api_data["token"] = load_api_token()
     return AppState(
         categories=[Category(**item) for item in data.get("categories", [])],
         base_presets=[PromptPreset(**item) for item in base_data],
@@ -250,14 +390,14 @@ def load_state() -> AppState:
         api=ApiSettings(**api_data),
         generation=GenerationSettings(**data.get("generation", {})),
         batting_scenes=[BattingScene(**item) for item in data.get("batting_scenes", [])],
-        history=data.get("history", []),
+        history=[sanitize_history_entry(item) for item in data.get("history", [])],
     )
 
 
 def save_state(state: AppState) -> None:
     ensure_dirs()
     STATE_PATH.write_text(
-        json.dumps(asdict(state), ensure_ascii=False, indent=2),
+        json.dumps(state_dict_without_secrets(state), ensure_ascii=False, indent=2),
         encoding="utf-8",
     )
 
@@ -334,8 +474,6 @@ class NovelAIClient:
             return
 
         payload = self.build_payload(prompt, negative_prompt, uc_prompt)
-        request_path = output_path.with_name(output_path.stem + "_request.json")
-        request_path.write_text(json.dumps(payload, ensure_ascii=False, indent=2), encoding="utf-8")
         req = urllib.request.Request(
             self.settings.endpoint,
             data=json.dumps(payload).encode("utf-8"),
@@ -1133,11 +1271,7 @@ class App(tk.Tk if tk else object):
             prompt, negative, uc_prompt, artists = self.build_prompt()
             path = out_dir / f"image_{idx + 1:03}.png"
             metadata = {
-                "path": str(path),
-                "request_path": str(path.with_name(path.stem + "_request.json")),
-                "prompt": prompt,
-                "negative_prompt": negative,
-                "uc_prompt": uc_prompt,
+                "path": output_ref(str(path)),
                 "artists": artists,
                 "created_at": time.strftime("%Y-%m-%d %H:%M:%S"),
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nai-aclab",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Local web UI for experimenting with NovelAI artist tag weight combinations.",
   "license": "MIT",
   "type": "commonjs",

package/web/index.html

@@ -388,10 +388,6 @@
             <strong>작가 가중치</strong>
             <div id="modalArtists" class="artist-weight-list"></div>
           </div>
-          <div class="modal-section">
-            <strong>Prompt</strong>
-            <pre id="modalPrompt"></pre>
-          </div>
         </aside>
       </section>
     </div>

package/web/main.js

@@ -534,8 +534,13 @@ function renderSettings() {
     const wrap = document.createElement("label");
     wrap.innerHTML = `<span>${label}</span><input id="api_${key}" type="${type}" />`;
     form.appendChild(wrap);
-    $(`#api_${key}`).value = state.api[key] ?? "";
-    if (type === "number") $(`#api_${key}`).step = "any";
+    const input = $(`#api_${key}`);
+    input.value = key === "token" ? "" : state.api[key] ?? "";
+    if (key === "token") {
+      input.placeholder = state.api.token_saved ? "저장된 토큰을 사용합니다" : "API 토큰을 입력하세요";
+      input.autocomplete = "off";
+    }
+    if (type === "number") input.step = "any";
   }
   $("#mockMode").checked = !!state.api.mock_mode;
   $("#negativePrompt").value = state.negative_prompt || "";
@@ -834,7 +839,6 @@ function renderImageModalItem(item) {
   const position = modalItems.length > 1 ? ` (${modalIndex + 1} / ${modalItems.length})` : "";
   $("#modalTitle").textContent = `${item.source_label || item.created_at || "이미지"}${position}`;
   $("#modalSubtitle").textContent = [item.source_base_preset, item.source_character_preset].filter(Boolean).join(" + ");
-  $("#modalPrompt").textContent = item.prompt || "";
   const artistList = $("#modalArtists");
   artistList.innerHTML = "";
   for (const row of artistWeightRows(item.artists || [])) artistList.appendChild(row);
@@ -1431,6 +1435,14 @@ function deleteChar() {
 function bindAutosaveInputs(root = document) {
   root.querySelectorAll("input, textarea, select").forEach((node) => {
     if (node.id === "compareHistorySelect") return;
+    if (node.id === "api_token") {
+      node.oninput = null;
+      node.onchange = () => {
+        syncEditorsToState();
+        scheduleSave();
+      };
+      return;
+    }
     node.oninput = () => {
       syncEditorsToState();
       if (node.id === "catTags") renderRecognizedTags();

package/web_app.py

@@ -25,11 +25,17 @@ from app import (
     NovelAIClient,
     PromptPreset,
     float_range,
+    has_saved_api_token,
+    load_api_token,
     load_state,
     now_id,
+    output_ref,
     parse_artist_tags,
     safe_path_name,
+    save_api_token,
     save_state,
+    sanitize_history_entry,
+    sanitize_history_item,
     weight_tag,
 )
 
@@ -72,7 +78,9 @@ def state_from_dict(data: dict) -> AppState:
 
 def media_url(path: str) -> str:
     try:
-        rel = Path(path).resolve().relative_to(OUTPUT_DIR.resolve())
+        raw = str(path or "")
+        candidate = Path(raw)
+        rel = candidate.resolve().relative_to(OUTPUT_DIR.resolve()) if candidate.is_absolute() else Path(raw)
     except (ValueError, OSError):
         return ""
     return "/media/" + urllib.parse.quote(str(rel).replace("\\", "/"))
@@ -80,19 +88,20 @@ def media_url(path: str) -> str:
 
 def state_payload(state: AppState) -> dict:
     data = asdict(state)
+    data.setdefault("api", {})["token"] = ""
+    data["api"]["token_saved"] = has_saved_api_token()
+    data["history"] = [sanitize_history_entry(item) for item in data.get("history", [])]
     for category in data.get("categories", []):
         category["recognized_tags"] = parse_artist_tags(category.get("tags", []))
     for history in data.get("history", []):
         for item in history.get("items", []):
             item["image_url"] = media_url(item.get("path", ""))
-            item["request_url"] = media_url(item.get("request_path", ""))
     return data
 
 
 def item_payload(item: dict) -> dict:
-    data = dict(item)
+    data = sanitize_history_item(item)
     data["image_url"] = media_url(data.get("path", ""))
-    data["request_url"] = media_url(data.get("request_path", ""))
     return data
 
 
@@ -186,6 +195,12 @@ def build_prompt(state: AppState) -> tuple[str, str, str, list[dict]]:
 
 def save_incoming_state(data: dict) -> AppState:
     state = state_from_dict(data)
+    incoming_token = str((data.get("api", {}) or {}).get("token", "") or "").strip()
+    if incoming_token:
+        save_api_token(incoming_token)
+        state.api.token = incoming_token
+    else:
+        state.api.token = load_api_token()
     with STATE_LOCK:
         current = load_state()
         state.history = current.history
@@ -207,7 +222,8 @@ def delete_history_entries(ids: list[str], delete_files: bool) -> AppState:
             if not raw_dir:
                 continue
             try:
-                target = Path(raw_dir).resolve()
+                raw_path = Path(raw_dir)
+                target = raw_path.resolve() if raw_path.is_absolute() else (OUTPUT_DIR / raw_path).resolve()
             except OSError:
                 continue
             if target == output_root or output_root not in target.parents:
@@ -244,11 +260,7 @@ def run_generation(job_id: str, state: AppState) -> None:
         prompt, negative, uc_prompt, artists = build_prompt(state)
         path = out_dir / f"image_{idx + 1:03}.png"
         metadata = {
-            "path": str(path),
-            "request_path": str(path.with_name(path.stem + "_request.json")),
-            "prompt": prompt,
-            "negative_prompt": negative,
-            "uc_prompt": uc_prompt,
+            "path": output_ref(str(path)),
             "artists": artists,
             "created_at": time.strftime("%Y-%m-%d %H:%M:%S"),
         }
@@ -266,7 +278,7 @@ def run_generation(job_id: str, state: AppState) -> None:
         "base_preset": base.name if base else "",
         "character_preset": character.name if character else "",
         "created_at": time.strftime("%Y-%m-%d %H:%M:%S"),
-        "output_dir": str(out_dir),
+        "output_dir": output_ref(str(out_dir)),
         "items": items,
     }
     update = {
@@ -346,11 +358,7 @@ def run_batting_test(job_id: str, state: AppState) -> None:
             prompt, negative, uc_prompt, artists = build_prompt(current)
             path = scene_dir / f"image_{image_index + 1:03}.png"
             metadata = {
-                "path": str(path),
-                "request_path": str(path.with_name(path.stem + "_request.json")),
-                "prompt": prompt,
-                "negative_prompt": negative,
-                "uc_prompt": uc_prompt,
+                "path": output_ref(str(path)),
                 "artists": artists,
                 "scene_name": scene_name,
                 "scene_index": scene_index,
@@ -376,7 +384,7 @@ def run_batting_test(job_id: str, state: AppState) -> None:
         "base_preset": "타율 테스트",
         "character_preset": f"{len(scenes)}개 씬",
         "created_at": time.strftime("%Y-%m-%d %H:%M:%S"),
-        "output_dir": str(out_dir),
+        "output_dir": output_ref(str(out_dir)),
         "scenes": [asdict(scene) for scene in scenes],
         "items": items,
     }