BlueVenn6 · BlueVenn6 · Jul 21, 2026 · Jul 21, 2026
@@ -10,7 +10,7 @@ body:
     id: version
     attributes:
       label: Paneloom version or commit
-      placeholder: 0.1.0-beta.1 or a Git commit hash
+      placeholder: 0.1.0-beta.2 or a Git commit hash
     validations:
       required: true
   - type: input

@@ -2,6 +2,16 @@
 
 All notable changes to Paneloom are recorded here.
 
+## 0.1.0-beta.2 - 2026-07-21
+
+- Constrained project creation, opening, migration, backup, restore, image, and reference paths to approved local roots.
+- Added native desktop path authorization for user-selected locations and server-generated identifiers for new local resources.
+- Prevented absolute-path and traversal inputs from escaping project storage boundaries.
+- Hardened review-period file access, repository hygiene checks, GitHub Actions permissions, dependency review, and CodeQL scanning.
+- Added path-security regression tests while preserving existing self-contained project and desktop workflows.
+
+This is an unsigned security maintenance Beta. It supersedes `0.1.0-beta.1` for public testing but remains a pre-release and still requires an independent clean-machine test before a signed stable release.
+
 ## 0.1.0-beta.1 - 2026-07-18
 
 - Added a self-contained, movable local project structure with backup and restore.

@@ -29,7 +29,7 @@ Paneloom は、Windows ローカル優先・一人用の AI 漫画／アニメ
 
 ## 現在の状態
 
-`0.1.0-beta.1` は Windows ローカルデスクトップ Beta です。プロジェクトの移動、バックアップと復元、production-like pywebview/WebView2 起動、ランダムなループバックポート、正常終了を開発用 Windows 環境で検証済みです。無料のモデル利用枠は付属せず、互換性のあるテキスト／画像モデル API をユーザーが設定します。
+`0.1.0-beta.2` は Windows ローカルデスクトップ向けのセキュリティ保守 Beta です。プロジェクトの移動、バックアップと復元、production-like pywebview/WebView2 起動、ランダムなループバックポート、正常終了を維持しながら、プロジェクトパス、復元処理、ローカルファイルアクセス境界を強化しました。無料のモデル利用枠は付属せず、互換性のあるテキスト／画像モデル API をユーザーが設定します。
 
 現在のインストーラーは Authenticode 未署名で、独立したクリーンな Windows 10/11 環境での最終検証も未実施です。そのため、署名済み正式版として扱うことはできません。
 

@@ -29,7 +29,7 @@ Paneloom은 Windows 로컬 우선 방식으로 동작하는 1인 창작자용 AI
 
 ## 현재 상태
 
-`0.1.0-beta.1`은 Windows 로컬 데스크톱 Beta입니다. 프로젝트 이동, 백업과 복원, production-like pywebview/WebView2 실행, 임의 루프백 포트, 정상 종료를 개발용 Windows 환경에서 검증했습니다. 무료 모델 사용량은 포함되지 않으며 사용자가 호환되는 텍스트 및 이미지 모델 API를 직접 설정해야 합니다.
+`0.1.0-beta.2`는 Windows 로컬 데스크톱용 보안 유지보수 Beta입니다. 프로젝트 이동, 백업과 복원, production-like pywebview/WebView2 실행, 임의 루프백 포트, 정상 종료를 유지하면서 프로젝트 경로, 복원 처리, 로컬 파일 접근 경계를 강화했습니다. 무료 모델 사용량은 포함되지 않으며 사용자가 호환되는 텍스트 및 이미지 모델 API를 직접 설정해야 합니다.
 
 현재 설치 프로그램은 Authenticode 서명이 없고 독립적인 클린 Windows 10/11 환경에서 최종 검증하지 않았습니다. 따라서 서명된 정식 배포판으로 표현할 수 없습니다.
 

@@ -21,7 +21,7 @@ Licensed under the MIT License.
 
 Local desktop beta. Self-contained project folders, legacy migration, backup/restore, offline local editing, and the pywebview/WebView2 runtime are validated. A traceable unsigned Windows Beta installer has been built and exercised on the development Windows 11 machine. The binary is not committed to this repository and has not been validated on an independent clean Windows machine.
 
-The frozen business source is `v0.1.0-beta.1-functional-baseline`. The open-source release line adds only packaging and release-compliance material; `release-source.json` records both immutable source identities. WEBTOON/Tapas submission-package work belongs to a later feature branch and is not part of this release.
+The current security-maintenance source is frozen at `v0.1.0-beta.2-functional-baseline`. The release line adds only versioned packaging and release-compliance material after that point; `release-source.json` records the immutable source identities. WEBTOON/Tapas submission-package work belongs to a separate later feature branch and is not part of this release.
 
 ## What It Does
 

@@ -29,7 +29,7 @@ Paneloom 是一款 Windows 本地优先、面向单人创作者的 AI 漫画与
 
 ## 当前状态
 
-`0.1.0-beta.1` 是 Windows 本地桌面 Beta。项目可移动性、备份恢复、production-like pywebview/WebView2 启动、随机回环端口和干净退出已经完成本机验证。软件不附带免费模型额度，需要用户自行配置兼容的文本和图片模型 API。
+`0.1.0-beta.2` 是 Windows 本地桌面安全维护 Beta。它保留项目可移动性、备份恢复、production-like pywebview/WebView2 启动、随机回环端口和干净退出，并加强了项目路径、备份恢复和本地文件访问边界。软件不附带免费模型额度，需要用户自行配置兼容的文本和图片模型 API。
 
 当前安装器尚未进行 Authenticode 签名，也尚未在独立干净的 Windows 10/11 机器完成最终验证，因此不应描述为正式签名发行版。
 

@@ -1,7 +1,7 @@
 # Paneloom third-party license inventory
 
 This file is generated from the exact Python build environment and frontend lock file.
-Source commit: `d34d148152f63846bc42fec083b20b3cd29da563`
+Source commit: `bb191af22e55076fd6c09a04727d790ed7fa99ed`
 
 It is a distribution inventory, not legal advice. Package authors retain their rights.
 

@@ -1 +1 @@
-0.1.0-beta.1
+0.1.0-beta.2
@@ -1,6 +1,6 @@
 {
   "name": "paneloom-frontend",
-  "version": "0.1.0-beta.1",
+  "version": "0.1.0-beta.2",
   "private": true,
   "type": "module",
   "scripts": {

@@ -1,8 +1,10 @@
 # Windows packaging
 
 The installer is built only from a clean Git worktree. The application source
-must match the annotated `v0.1.0-beta.1-functional-baseline` tag; later changes
+must match the annotated `v0.1.0-beta.2-functional-baseline` tag; later changes
 are limited to the packaging files listed by `scripts/build_windows_installer.ps1`.
+The exact clean commit being packaged must also be tagged
+`v0.1.0-beta.2-open-source` before the build starts.
 
 Build from PowerShell:
 

@@ -17,7 +17,7 @@ Unicode true
   !error "WEBVIEW_BOOTSTRAPPER must point to the signed Microsoft bootstrapper."
 !endif
 !ifndef APP_VERSION
-  !define APP_VERSION "0.1.0-beta.1"
+  !define APP_VERSION "0.1.0-beta.2"
 !endif
 
 !define APP_REGISTRY_KEY "Software\Paneloom"
@@ -35,7 +35,7 @@ BrandingText "Paneloom"
 Icon "${SOURCE_ROOT}\desktop\resources\paneloom.ico"
 UninstallIcon "${SOURCE_ROOT}\desktop\resources\paneloom.ico"
 
-VIProductVersion "0.1.0.1"
+VIProductVersion "0.1.0.2"
 VIAddVersionKey /LANG=1033 "ProductName" "Paneloom"
 VIAddVersionKey /LANG=1033 "CompanyName" "Paneloom contributors"
 VIAddVersionKey /LANG=1033 "FileDescription" "Paneloom Windows installer"

@@ -1,7 +1,7 @@
 VSVersionInfo(
   ffi=FixedFileInfo(
-    filevers=(0, 1, 0, 1),
-    prodvers=(0, 1, 0, 1),
+    filevers=(0, 1, 0, 2),
+    prodvers=(0, 1, 0, 2),
     mask=0x3f,
     flags=0x0,
     OS=0x40004,
@@ -16,12 +16,12 @@ VSVersionInfo(
         [
           StringStruct(u'CompanyName', u'Paneloom contributors'),
           StringStruct(u'FileDescription', u'Paneloom local AI comic storyboard desktop tool'),
-          StringStruct(u'FileVersion', u'0.1.0-beta.1'),
+          StringStruct(u'FileVersion', u'0.1.0-beta.2'),
           StringStruct(u'InternalName', u'Paneloom'),
           StringStruct(u'LegalCopyright', u'Copyright (c) 2026 Paneloom contributors'),
           StringStruct(u'OriginalFilename', u'Paneloom.exe'),
           StringStruct(u'ProductName', u'Paneloom'),
-          StringStruct(u'ProductVersion', u'0.1.0-beta.1')
+          StringStruct(u'ProductVersion', u'0.1.0-beta.2')
         ]
       )
     ]),

@@ -1,8 +1,8 @@
 {
-  "version": "0.1.0-beta.1",
-  "frozen_business_tag": "v0.1.0-beta.1-functional-baseline",
-  "frozen_business_commit": "09fe927ffde5d1775adc0f7904da021932ecf143",
-  "packaging_source_commit": "d34d148152f63846bc42fec083b20b3cd29da563",
-  "packaging_source_tag": "v0.1.0-beta.1-packaging-source",
-  "open_source_tag": "v0.1.0-beta.1-open-source"
+  "version": "0.1.0-beta.2",
+  "frozen_business_tag": "v0.1.0-beta.2-functional-baseline",
+  "frozen_business_commit": "bb191af22e55076fd6c09a04727d790ed7fa99ed",
+  "packaging_source_commit": "bb191af22e55076fd6c09a04727d790ed7fa99ed",
+  "packaging_source_tag": "v0.1.0-beta.2-packaging-source",
+  "open_source_tag": "v0.1.0-beta.2-open-source"
 }
@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:18d7fd5b-55ba-40c2-87de-3e782c3d21e0",
+  "serialNumber": "urn:uuid:0b7782c1-a7d8-4b27-8e5e-36e8d3334dc1",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-20T06:22:11.288Z",
+    "timestamp": "2026-07-21T05:09:49.086Z",
     "lifecycles": [
       {
         "phase": "pre-build"
@@ -19,12 +19,12 @@
       }
     ],
     "component": {
-      "bom-ref": "paneloom-frontend@0.1.0-beta.1",
-      "type": "application",
+      "bom-ref": "paneloom-frontend@0.1.0-beta.2",
+      "type": "library",
       "name": "frontend",
-      "version": "0.1.0-beta.1",
+      "version": "0.1.0-beta.2",
       "scope": "required",
-      "purl": "pkg:npm/paneloom-frontend@0.1.0-beta.1",
+      "purl": "pkg:npm/paneloom-frontend@0.1.0-beta.2",
       "properties": [
         {
           "name": "cdx:npm:package:path",
@@ -6131,7 +6131,7 @@
   ],
   "dependencies": [
     {
-      "ref": "paneloom-frontend@0.1.0-beta.1",
+      "ref": "paneloom-frontend@0.1.0-beta.2",
       "dependsOn": [
         "lucide-react@1.14.0",
         "react@19.2.6",

@@ -2,24 +2,24 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f7de19aa-d579-5b7b-9e91-7433cd036b53",
+  "serialNumber": "urn:uuid:33495c6e-ddbb-51ea-bb3a-c666b3b447be",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-20T12:46:20+08:00",
+    "timestamp": "2026-07-21T12:11:36+08:00",
     "component": {
       "type": "application",
-      "bom-ref": "pkg:generic/paneloom@0.1.0-beta.1",
+      "bom-ref": "pkg:generic/paneloom@0.1.0-beta.2",
       "name": "Paneloom",
-      "version": "0.1.0-beta.1"
+      "version": "0.1.0-beta.2"
     },
     "properties": [
       {
         "name": "paneloom:source-commit",
-        "value": "d34d148152f63846bc42fec083b20b3cd29da563"
+        "value": "bb191af22e55076fd6c09a04727d790ed7fa99ed"
       },
       {
         "name": "paneloom:frozen-business-commit",
-        "value": "09fe927ffde5d1775adc0f7904da021932ecf143"
+        "value": "bb191af22e55076fd6c09a04727d790ed7fa99ed"
       },
       {
         "name": "paneloom:python-scope",
@@ -1617,7 +1617,7 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:generic/paneloom@0.1.0-beta.1",
+      "ref": "pkg:generic/paneloom@0.1.0-beta.2",
       "dependsOn": [
         "pkg:pypi/fastapi@0.139.2",
         "pkg:pypi/openpyxl@3.1.5",

@@ -2,24 +2,24 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:d8368f9a-3ab8-5cde-a39d-d32a92f632a9",
+  "serialNumber": "urn:uuid:3761bb18-7345-54a6-a099-471ab56c6c4b",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-20T12:46:20+08:00",
+    "timestamp": "2026-07-21T12:11:36+08:00",
     "component": {
       "type": "application",
-      "bom-ref": "pkg:generic/paneloom@0.1.0-beta.1",
+      "bom-ref": "pkg:generic/paneloom@0.1.0-beta.2",
       "name": "Paneloom",
-      "version": "0.1.0-beta.1"
+      "version": "0.1.0-beta.2"
     },
     "properties": [
       {
         "name": "paneloom:source-commit",
-        "value": "d34d148152f63846bc42fec083b20b3cd29da563"
+        "value": "bb191af22e55076fd6c09a04727d790ed7fa99ed"
       },
       {
         "name": "paneloom:frozen-business-commit",
-        "value": "09fe927ffde5d1775adc0f7904da021932ecf143"
+        "value": "bb191af22e55076fd6c09a04727d790ed7fa99ed"
       },
       {
         "name": "paneloom:python-scope",
@@ -863,7 +863,7 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:generic/paneloom@0.1.0-beta.1",
+      "ref": "pkg:generic/paneloom@0.1.0-beta.2",
       "dependsOn": [
         "pkg:pypi/fastapi@0.139.2",
         "pkg:pypi/openpyxl@3.1.5",

@@ -1,5 +1,5 @@
 param(
-  [string]$BaselineTag = "v0.1.0-beta.1-functional-baseline"
+  [string]$BaselineTag = "v0.1.0-beta.2-functional-baseline"
 )
 
 $ErrorActionPreference = "Stop"
@@ -60,6 +60,10 @@ if (-not $packagingSourceTagCommit -or
     $packagingSourceTagCommit -ne $releaseSource.packaging_source_commit) {
   throw "The packaging source tag does not match release-source.json."
 }
+$openSourceTagCommit = (git rev-list -n 1 $releaseSource.open_source_tag).Trim()
+if (-not $openSourceTagCommit -or $openSourceTagCommit -ne $packagingCommit) {
+  throw "The open-source release tag must point to the exact clean commit being packaged."
+}
 git merge-base --is-ancestor $releaseSource.packaging_source_commit $packagingCommit
 if ($LASTEXITCODE -ne 0) {
   throw "The recorded packaging source is not an ancestor of the current release commit."
@@ -68,8 +72,10 @@ if ($LASTEXITCODE -ne 0) {
 $allowedChanges = @(
   ".gitignore",
   ".github/CODEOWNERS",
+  ".github/ISSUE_TEMPLATE/bug_report.yml",
   ".github/workflows/ci.yml",
   "CHANGELOG.md",
+  "VERSION",
   "README.md",
   "README.en.md",
   "README.ja.md",
@@ -80,6 +86,8 @@ $allowedChanges = @(
   "docs/open_source_release_readiness_2026-07-20.md",
   "docs/screenshots/",
   "docs/windows_installer_validation_2026-07-20.md",
+  "frontend/package.json",
+  "frontend/package-lock.json",
   "packaging/",
   "release-source.json",
   "requirements-build.txt",