- tests/e2e/test_e2e_secgate_legacy_flags.py: 18 tests across 8 server
config fixtures proving both arms (allow/deny) of each flag against a
running ComfyUI legacy server, batch composite gating, transitive-pip
non-consultation, and denial-copy contract. Zero-install discipline:
the designated do-not-install sample for direct git-URL rows, a
synthetic nonexistent URL for batch unknown-URL rows.
- tests/e2e/test_e2e_pip_url_form.py: 4 tests proving the pip gate is
argument-content-agnostic with a URL-form pip spec — deny arm (403,
no install-scripts reservation, denial log names the flag) and
real-install arm (200 + reservation, executed at next restart, the
package importable in the isolated E2E venv, then fully self-cleaned).
Uses the owned purpose-built fixture
git+https://github.com/ltdrdata/pip-test1-do-not-install (public,
zero-dep, pure Python, seconds-fast) instead of an external
third-party repo, keeping the test's lifetime under our control.
Add two boolean config.ini [default] flags — allow_git_url_install and
allow_pip_install (both default false) — that fully REPLACE the
security_level term on the legacy install surfaces:
- POST /v2/customnode/install/git_url (S-A) and
POST /v2/customnode/install/pip (S-B) are now gated solely by their
dedicated flag AND the retained network-position invariant
(loopback listener OR network_mode=personal_cloud). security_level
no longer affects these two surfaces in either direction.
- The batch unknown-URL branch (S-C) routes through the same predicate;
the unknown-pip branch stays unconditionally blocked; the general
middle+ batch entry gate is unchanged.
- New pure predicate is_dedicated_install_allowed() in
common/manager_security.py (config-import-free; callers pass values
from their own reader). Both config readers (glob + legacy) register
the keys in read/write/fallback paths.
- Denial logs and frontend copy name the responsible flag instead of
the misleading security_level guidance. Public listeners remain
denied regardless of the flags (no exposure widening).
- README security policy updated: config keys documented, git-url/pip
removed from the security_level risky table, and a dedicated-flags
subsection (REPLACE semantics, network rule, batch behavior,
restart-only activation, weak/normal- opt-in migration note).
- Migration: existing weak/normal- users must opt in via the new flags
(CHANGELOG note; deliberate no auto-seed).
Includes the unit/config/guard test suites (88 tests): predicate truth
table, dual-reader config contract (missing/malformed keys read false,
round-trip, cache staleness), security_level-matrix freeze guards, and
suite-order-independent test stubs.
The command performs collect→compile→install (full pipeline),
not just compile. uv-sync better reflects the actual behavior.
The --uv-compile flag on other commands (install, reinstall,
update, fix, etc.) is intentionally kept as-is: it reads as
a mechanism descriptor ("use uv pip compile to resolve deps")
rather than a reference to the standalone command name.
- Add is_safe_path_target() and get_safe_file_path() utilities
- Validate history id and snapshot target parameters in API endpoints
- Sanitize config string values to prevent CRLF injection
- Add verbose config option to control CNR fetch logging
- Improve get_module_name with cnr_id/aux_id fallback via repo_cnr_map
- Fix is_valid_url misuse of try/finally that could cause runtime errors
- Move SSH_URL_PATTERN to module-level constant for performance
- Add aux_id format (author/repo) support in normalize_to_github_id()
- Fix get_module_name() to use URL normalization for unknown_active_nodes
- Use NormalizedKeyDict in reload() to maintain normalized key lookup
- Use --ff-only flag to detect non-fast-forward situations
- Create backup branch before resetting divergent local branch
- Reset to remote branch when fast-forward is not possible
- Add timestamp_utils.py for Mac datetime module compatibility
- Migrate all datetime usages to centralized utilities
- Bump version to 4.0.3b5
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Resolved merge conflict with PR #2297 by integrating:
- PDF Tools - Advanced PDF Processing & OCR (new entry)
- AAA Metadata System (updated with enhanced description and metadata)
- HYPIR Image Restoration (preserved from main branch)
All entries use consistent spacing and JSON formatting.
Dr.Lt.Data