A generation plugin should return media, not control the timeline.

“Plugin” currently means a reviewed connector

The name can easily imply a marketplace where arbitrary packages are downloaded and executed at runtime. That is not what has shipped. The current implementation keeps manifests and adapters in the Timeline Studio source tree, registers them during the build and reviews them with the rest of the application. There is no third-party code loader, runtime permission prompt or compatibility negotiation yet.

That limitation is a security feature until those missing pieces exist. A generation connector can touch remote accounts, local AI servers and media bytes. Calling any JavaScript bundle a plugin before defining its permissions would turn an extension label into ambient authority. The development contract is explicit: today, adding a plugin means contributing a reviewed provider adapter to the repository.

A manifest declares capability; an adapter performs transport

Each provider has two deliberately different responsibilities. Its manifest describes stable identity, runtime class, authentication mode, capabilities, output types and default endpoint. Its adapter connects to the actual SDK or HTTP API, converts the shared request into provider-specific calls and returns normalized outputs. React state is not part of that transport layer.

The shared registry contains exactly three manifests. The hook looks up the corresponding adapter, coordinates connection and generation attempts with AbortController, and passes the result to the host. Adding a fourth provider therefore does not require another provider-specific network branch inside the shared hook.

manifest = identity + runtime + capabilities + auth
adapter  = connect() + generate() + optional disconnect()/cancel()
host     = check bytes + decode images + inspect video metadata + commit My assets
hook     = lifecycle + supersession + visible job state

The separation matters during failure. A malformed provider response should fail in its adapter or at the host boundary. It should not leave half-created React state, a guessed timeline object or a success message backed only by a URL.

Three providers, three real connection models

Puter.js owns a browser session and popup authorization flow. Connection waits for the provider's actual sign-in result instead of optimistically changing a badge. Image generation calls puter.ai.txt2img; video generation calls puter.ai.txt2vid. The adapter then resolves or downloads the returned media. The Grok image path uses a temporary provider file and removes it after the bytes have been read.

ComfyUI and Stable Diffusion WebUI are local services, but “local” is verified rather than assumed. Their endpoint parser accepts only localhost, 127.0.0.1 or ::1 over HTTP or HTTPS. ComfyUI checks /system_stats; WebUI checks /sdapi/v1/samplers. A network failure is translated into a message that tells the user to check whether the service is running and whether CORS permits the editor origin.

Once connected, ComfyUI submits a workflow to /prompt, polls /history/{prompt_id} and downloads every reported output through /view. WebUI calls either /sdapi/v1/txt2img or /sdapi/v1/img2img and decodes every returned base64 image. The adapter does not silently keep the first file when a provider returns a batch.

A temporary URL is not a completed asset

Generation APIs often return URLs that are signed, session-bound or short-lived. If an editor stores that URL as its result, the thumbnail may work during the session and disappear after a refresh—or expire before export. The development contract requires downloaded, usable media. At this reviewed snapshot, the host enforces nonempty bytes and image decoding, while the video path has the metadata gaps reproduced below.

For images, the host reads the file signature, reconciles the declared MIME type, creates an ImageBitmap and rejects a file with no dimensions. PNG, JPEG, WebP and AVIF signatures are recognized. For video, the host inspects metadata only when the output omits width or height. Metadata error or timeout resolves with fallback dimensions and duration rather than rejection. Object URLs used only for inspection are revoked.

The host builds asset entries and browser-local URLs while processing the batch, then prepends the batch to My assets after the loop completes. This is stronger than retaining a temporary URL alone, but the video fallback means “complete” does not establish successful decoding. A later invalid output prevents the library update; an earlier prepared URL remains registered until separate cleanup.

Generation is not permission to edit

The host commits results to My assets and selects the latest imported item. It does not create a clip, choose a track, move the playhead or infer how long a generated image should remain visible. Those are editorial decisions, even when the prompt was entered from inside an editor.

This boundary also makes batch results legible. If ComfyUI emits several images or videos, the complete batch becomes library assets only after every output is processed successfully. A user can compare them, reject them, rename them and deliberately insert the chosen media. Automatic placement would collapse generation and editing into one irreversible-looking action and make failure recovery harder.

Cancellation needs an honest verb

The shared hook creates an AbortController for each connection or generation attempt and checks whether callbacks belong to the active attempt. One job owns the shared inspector surface. Its cancel handler awaits an optional adapter cancel request before aborting the client controller and setting a cancelled state. These lifecycle paths are source-reviewed here; the offline experiment below does not execute the React hook.

ComfyUI has an /interrupt endpoint, and its adapter sends a cancellation request. At this snapshot it ignores HTTP failure status and catches network errors, so a resolved cancel call does not confirm a remote stop. Other adapters may only stop client-side work. The distinction belongs in user-facing language because remote compute may continue after the editor stops listening.

Progress follows the same discipline. A percentage is shown only when a provider supplies meaningful progress; otherwise the running state remains indeterminate. A polished progress animation is not evidence that an external system knows how much work remains.

What this architecture proves—and what it does not

The code establishes a source-integrated provider architecture: validated manifests, separate adapters, loopback restrictions, host-owned image validation and video metadata handling, lifecycle coordination and a My assets destination. The executable cases below identify where the implementation falls short of its intended media guarantees. It provides a repeatable place to add another generation provider without moving transport logic back into a monolithic hook.

It does not prove that every model is available in every region, that Puter account terms or model prices will remain unchanged, that a user's local ComfyUI workflow is safe, or that generated media is accurate or publishable. Provider availability, cost, browser support and content restrictions remain provider-specific. Local endpoints also remain software running on the user's machine and should not be exposed beyond loopback without a separate security design.

Most importantly, this is not yet a general plugin marketplace. Runtime installation would require signed or otherwise attributable packages, permission declarations, version negotiation, sandboxing, revocation and a review model. Until those controls exist, source integration is the honest name for what ships.