wangbo/ComfyUI-Manager
1
0
Fork 0
mirror of https://github.com/Comfy-Org/ComfyUI-Manager.git synced 2026-07-27 10:37:31 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
4,802 Commits 30 Branches 146 Tags
b37f0bab9995c3b418710ccb096c9ef4ac9ee70e
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dr.Lt.Data b37f0bab99 bump version to v3.41 2026-06-16 03:08:23 +09:00
Dr.Lt.Data 4702128fb5 feat(security): add dedicated install flags decoupled from security_level 
Gate 'install via git URL' and 'install via pip' with dedicated opt-in
boolean flags (allow_git_url_install / allow_pip_install) in config.ini
[default], fully replacing the security_level term on those surfaces
(REPLACE, not AND — a strict level no longer denies when the flag is on;
a weak level no longer allows when the flag is off).

- glob/manager_server.py: pure predicate is_dedicated_install_allowed
  (flag AND loopback, request-time args.listen); REPLACE gates at
  /customnode/install/git_url and /customnode/install/pip; batch
  unknown-URL arm routes through the same full predicate at the risky
  position (loopback term is load-bearing — the middle entry gate has
  no network-position term; the entry gate itself stays in force);
  unknown-pip in batch stays unconditionally blocked; new
  SECURITY_MESSAGE_FLAG_* denial constants name the responsible flag;
  security_403_response gains flag_token (comfyui_outdated keeps precedence)
- glob/manager_core.py: register both keys (read via get_bool default-false,
  write list, exception fallback); "true"-only truthy; restart-only activation
- js/common.js: 403 dialog copy names the responsible flag at the two
  install call sites
- README.md: security-policy docs for both flags (per-surface scope incl.
  the batch entry-gate qualifier, REPLACE decoupling, loopback bound,
  opt-in config snippet, default-deny + migration note); stale tier lists
  corrected against the actual gates
- CHANGELOG.md: opt-in migration note + accepted residual risk (flags
  bypass the forced-strong outdated-ComfyUI hardening on loopback,
  opt-in only), decoupling claim qualified for the batch entry gate

Tests: unit suite (predicate truth table, REPLACE litmus both directions,
AST binding-proofs against live handlers, subprocess-isolated config
contract) plus a real-server E2E suite that mounts the Manager-under-test
via git worktree (exact-SHA pin, detached) against a real ComfyUI and
exercises both flag surfaces and both arms — deny arms (403 + flag-naming
body/log + no install artifact), git-URL allow arm (real clone), pip allow
arm as a two-phase reservation oracle — with zero-residual self-clean.
Module skips without E2E_COMFYUI_ROOT; unit suite unaffected.

The manager-v4 branch ships the identical policy (shared invariants +
config contract); this tree uses the degraded predicate 'flag AND
loopback' (no personal_cloud-equivalent mode here).
 2026-06-16 03:08:23 +09:00
Dr.Lt.Data 88a7c52410 update DB 2026-06-16 02:15:13 +09:00
Dr.Lt.Data 3772432847 update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-06-14 23:52:11 +09:00
Dr.Lt.Data d60e603467 update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-06-11 01:41:30 +09:00
Dr.Lt.Data 4a1c06b90a update DB
Python Linting / Run Ruff (push) Has been cancelled
Details
2026-06-07 02:51:09 +09:00
Dr.Lt.Data 395bb24427 update DB
Python Linting / Run Ruff (push) Has been cancelled
Details
2026-06-05 06:08:54 +09:00
Dr.Lt.Data 25c1cc0921 feat(node_db/dev): register 4 NAME CONFLICT candidates (verified SAFE) 2026-06-05 05:54:28 +09:00
Dr.Lt.Data 629ccba819 fix(custom-node-list:new): sync comfyui-daz-tools entry 2026-06-05 03:47:38 +09:00
Dr.Lt.Data 3d01524ee9 fix(custom-node-list): place comfyui-daz-tools entry after last git-clone block 2026-06-05 03:47:07 +09:00
Dr.Lt.Data 1aa6112c57 update DB 2026-06-05 03:44:10 +09:00
Dr.Lt.Data c571cf3ca9 update DB 2026-06-05 00:49:06 +09:00
Dr.Lt.Data 7ddad11d28 update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-06-04 03:05:11 +09:00
Dr.Lt.Data 142f4ce365 update DB 2026-06-04 01:59:12 +09:00
Dr.Lt.Data 3ec831a99b update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-06-03 07:27:35 +09:00
Dr.Lt.Data 2d373448be update DB
Python Linting / Run Ruff (push) Has been cancelled
Details
2026-06-01 20:16:09 +09:00
Dr.Lt.Data 56a54117ab update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-06-01 03:22:14 +09:00
Dr.Lt.Data dfa45a67e0 update DB 2026-06-01 03:16:10 +09:00
Dr.Lt.Data cb46064d25 update DB 2026-06-01 02:34:46 +09:00
Dr.Lt.Data a0f4d401ec update DB 2026-06-01 02:26:10 +09:00
Dr.Lt.Data d6f480c911 update DB
Python Linting / Run Ruff (push) Has been cancelled
Details
2026-05-30 03:25:33 +09:00
Dr.Lt.Data 7d611c051e update DB
Python Linting / Run Ruff (push) Has been cancelled
Details
2026-05-28 02:15:37 +09:00
Dr.Lt.Data 66617e061c update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-27 02:16:39 +09:00
Dr.Lt.Data c72bc4e171 update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-26 08:56:59 +09:00
Dr.Lt.Data ef470d0119 update DB 2026-05-26 07:50:12 +09:00
Dr.Lt.Data e633858794 update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-25 08:02:37 +09:00
Dr.Lt.Data 765e64ff1d update DB 2026-05-25 07:51:37 +09:00
Dr.Lt.Data 1bed21771f update DB 2026-05-25 07:41:09 +09:00
Dr.Lt.Data 36144e5608 update DB 2026-05-25 07:31:55 +09:00
Dr.Lt.Data 10f23c1d19 update DB 2026-05-25 07:28:47 +09:00
Dr.Lt.Data 8814191992 update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-24 21:12:10 +09:00
Dr.Lt.Data 4bab2faa5e update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-24 03:29:27 +09:00
Dr.Lt.Data bf5c346428 update DB
Python Linting / Run Ruff (push) Has been cancelled
Details
2026-05-21 05:53:45 +09:00
Dr.Lt.Data 928870f598 update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-20 08:39:29 +09:00
Dr.Lt.Data 7110ec1eaa update DB 2026-05-20 08:16:23 +09:00
Dr.Lt.Data 2483471541 fix(custom-node-list): dedup antimatter-nodes (#2891), keep PR entry with id field and enriched description 2026-05-20 08:15:42 +09:00
Dr.Lt.Data da873b5f3b update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-20 00:35:20 +09:00
Dr.Lt.Data 7cbd62c8bd update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-19 18:50:44 +09:00
Dr.Lt.Data d0cc0e4fe9 update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-19 13:01:16 +09:00
Dr.Lt.Data 9ad16c0188 update DB
Python Linting / Run Ruff (push) Has been cancelled
Details
2026-05-18 05:39:11 +09:00
Dr.Lt.Data a2c41a2a21 update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-17 10:10:59 +09:00
Dr.Lt.Data 9690eed4d1 fix(custom-node-list): place ComfyUI-Pixal3D entry after last git-clone block 2026-05-17 10:10:47 +09:00
Dr.Lt.Data 65789a6c9d update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-17 03:47:43 +09:00
Dr.Lt.Data 871a646fd7 update DB 2026-05-16 22:10:31 +09:00
Dr.Lt.Data 27f81a058e fix(custom-node-list): place PlagueKind-Nodes entry after last git-clone block 2026-05-16 22:10:16 +09:00
Dr.Lt.Data f59dd4bdc6 update DB 2026-05-16 21:42:09 +09:00
Dr.Lt.Data 90b87db05c fix(custom-node-list): dedup nicehero/comfyui-conditioning-saver (#2883), keep PR entry with id field and proper-case title 2026-05-16 21:41:10 +09:00
Dr.Lt.Data dcf04578b8 fix(custom-node-list): place ComfyUI-Magos-Nodes entry after last git-clone block 2026-05-16 21:39:55 +09:00
Dr.Lt.Data 2c0d665929 fix(custom-node-list): place BangtrixToolkit entry after last git-clone block 2026-05-16 21:38:56 +09:00
Dr.Lt.Data 350ff2d044 fix(custom-node-list): place XB_ToolBox entry after last git-clone block 2026-05-16 21:37:31 +09:00
Dr.Lt.Data 1958957d36 fix(custom-node-list): place ComfyUI-PuLID-Flux-Chroma entry after last git-clone block 2026-05-16 21:35:49 +09:00
Dr.Lt.Data 934fd2e091 update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-16 19:27:39 +09:00
Dr.Lt.Data 3ae1fe6ea6 update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-16 10:17:57 +09:00
Dr.Lt.Data 4f7f26da3b update DB
Python Linting / Run Ruff (push) Has been cancelled
Details
2026-05-14 04:21:55 +09:00
Dr.Lt.Data 3b2f6fd149 fix(custom-node-list): move locale-pending entries (ComfyUI-VolcEngine, comfyui-image-feeder) from default to dev channel pending English localization
Python Linting / Run Ruff (push) Has been cancelled
Details
2026-05-12 01:20:18 +09:00
Dr.Lt.Data c2a33d2efc fix(custom-node-list): place ComfyUI Image Feeder entry next to existing ketle-man author block 2026-05-11 20:40:26 +09:00
Dr.Lt.Data d9ac595785 update DB 2026-05-11 20:39:43 +09:00
Dr.Lt.Data b15c12ca4e update DB 2026-05-11 20:39:13 +09:00
Dr.Lt.Data dc0f66f042 update DB 2026-05-11 20:38:32 +09:00
Dr.Lt.Data 3d1210aa52 fix(custom-node-list): place ComfyUI-VolcEngine entry after last git-clone block 2026-05-11 20:37:52 +09:00
Dr.Lt.Data 1e409cdd11 fix(custom-node-list): place ComfyUI-MaskToTransparent entry next to existing nekodificador author block 2026-05-11 20:36:57 +09:00
Dr.Lt.Data 6cc7f3106b fix(custom-node-list): place ComfyUI-BodyRatioMapper entry after last git-clone block 2026-05-11 20:35:19 +09:00
Dr.Lt.Data 6c9dd4be42 fix(custom-node-list): place ComfyUI-DCW entry after last git-clone block 2026-05-11 20:34:18 +09:00
Dr.Lt.Data 02dcb1dd60 fix(custom-node-list): correct oath-studio files[0] to repo URL and place Claude CLI entry after last git-clone block 2026-05-11 20:32:34 +09:00
Dr.Lt.Data 72db8aed73 fix(custom-node-list): place oath-studio entries after last git-clone block 2026-05-11 20:29:56 +09:00
Dr.Lt.Data 2b7aa428b0 update DB 2026-05-11 20:14:16 +09:00
Dr.Lt.Data d61ef2eaba Merge branch 'main' of github.com:Comfy-Org/ComfyUI-Manager 2026-05-11 20:13:18 +09:00
Dr.Lt.Data fcc429e686 update DB 2026-05-11 20:13:11 +09:00
Dr.Lt.Data cba745327f update DB 2026-05-11 20:03:01 +09:00
Dr.Lt.Data 8079db221d update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-11 04:18:53 +09:00
Dr.Lt.Data 5727dc7c55 update DB 2026-05-11 03:59:36 +09:00
Dr.Lt.Data c06ff81821 fix(custom-node-list): restore xss + Image2Halftone entries and place comfymodeldownloader entry after last git-clone block 2026-05-11 03:58:07 +09:00
Dr.Lt.Data b824811bc7 fix(custom-node-list): place BizyAirPlus entry after last git-clone block 2026-05-11 03:56:29 +09:00
Dr.Lt.Data cb17d1c848 fix(custom-node-list): place ComfyUI-Styler-Pipeline entry next to existing andreszs author block 2026-05-11 03:55:40 +09:00
Dr.Lt.Data 49218fdb57 fix(custom-node-list): place OpenPose-Studio + Ultralytics-Studio entries next to existing andreszs author block 2026-05-11 03:54:53 +09:00
Dr.Lt.Data 96ae4e0c9f fix(custom-node-list): place ComfyUI-AnimaTool entry next to existing Moeblack author block 2026-05-11 03:53:55 +09:00
Dr.Lt.Data b4d5d972de update DB 2026-05-11 03:31:37 +09:00
Dr.Lt.Data 3d7f7d2439 fix(custom-node-list): place ComfyUI-MotifVideo2B entry after last git-clone block 2026-05-11 03:27:55 +09:00
Dr.Lt.Data 6ffead7ba9 fix(custom-node-list): place ComfyUI-Pixaroma entry after last git-clone block 2026-05-11 03:27:08 +09:00
Dr.Lt.Data 39dfa902d5 fix(custom-node-list): place Kai Civitai LoRA Loader entry after last git-clone block 2026-05-11 03:26:23 +09:00
Dr.Lt.Data d9f1ff34a7 fix(custom-node-list): place ComfyUI-SBTools entry after last git-clone block 2026-05-11 03:25:34 +09:00
Dr.Lt.Data 81605d31db fix(custom-node-list): remove trailing comma after last entry 2026-05-11 03:24:39 +09:00
Dr.Lt.Data bdd6111d9d fix(custom-node-list): place Z-Fuse entry after last git-clone block 2026-05-11 03:24:08 +09:00
Dr.Lt.Data 611532491f fix(custom-node-list): place ComfyUI-Workflow-Studio entry next to existing ketle-man author block
Python Linting / Run Ruff (push) Waiting to run
Details
2026-05-11 01:33:43 +09:00
Dr.Lt.Data 111e4d38f4 fix(custom-node-list): place ComfyUI-PulseOfMotion entry after last git-clone block 2026-05-11 01:32:43 +09:00
Dr.Lt.Data 0c8cdf9aa8 update DB 2026-05-11 01:15:02 +09:00
Dr.Lt.Data 8d2d37f1f7 fix(custom-node-list): place Happyhorse-Wrapper + Account-Manager entries next to existing magicwang1111 author block 2026-05-11 01:03:31 +09:00
Dr.Lt.Data 33d4b29422 update DB 2026-05-11 00:52:13 +09:00
Dr.Lt.Data 20d352c2b5 update DB 2026-05-11 00:16:15 +09:00
Dr.Lt.Data 7a8fc44f90 update DB
Python Linting / Run Ruff (push) Has been cancelled
Details
2026-05-08 19:07:12 +09:00
Dr.Lt.Data 8d5c12037f fix(custom-node-list): place DemonAlone-StyleSelector entry next to existing DemonAlone author block
Python Linting / Run Ruff (push) Has been cancelled
Details
2026-05-01 05:01:14 +09:00
Dr.Lt.Data e67e35795e fix(custom-node-list): place JH-PixelPro entry after last git-clone block 2026-05-01 05:00:29 +09:00
Dr.Lt.Data 113324728e fix(custom-node-list): place Emiewn-Nodes entry after last git-clone block 2026-05-01 04:59:31 +09:00
Dr.Lt.Data ec72d983ad update DB 2026-05-01 04:45:57 +09:00
Dr.Lt.Data 03272b1f70 update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-04-30 02:24:55 +09:00
Dr.Lt.Data 66108ccdbc update DB
Python Linting / Run Ruff (push) Has been cancelled
Details
2026-04-27 05:28:49 +09:00
Dr.Lt.Data d57c142019 update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-04-21 05:22:40 +09:00
Dr.Lt.Data 6a26409bcb update DB
Python Linting / Run Ruff (push) Waiting to run
Details
2026-04-20 02:54:48 +09:00
Dr.Lt.Data 22fc850853 update DB
Python Linting / Run Ruff (push) Has been cancelled
Details
2026-04-17 03:08:37 +09:00
Dr.Lt.Data f1863994f4 update DB 2026-04-17 02:49:19 +09:00