wangbo/ComfyUI-Manager
1
0
Fork 0
mirror of https://github.com/Comfy-Org/ComfyUI-Manager.git synced 2026-06-23 00:09:25 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
6288fb0e2a
ComfyUI-Manager/js
History
Dr.Lt.Data 6288fb0e2a feat(security): add dedicated install flags decoupled from security_level 
Gate 'install via git URL' and 'install via pip' with dedicated opt-in
boolean flags (allow_git_url_install / allow_pip_install) in config.ini
[default], fully replacing the security_level term on those surfaces
(REPLACE, not AND — a strict level no longer denies when the flag is on;
a weak level no longer allows when the flag is off).

- glob/manager_server.py: pure predicate is_dedicated_install_allowed
  (flag AND loopback, request-time args.listen); REPLACE gates at
  /customnode/install/git_url and /customnode/install/pip; batch
  unknown-URL arm routes through the same full predicate at the risky
  position (loopback term is load-bearing — the middle entry gate has
  no network-position term; the entry gate itself stays in force);
  unknown-pip in batch stays unconditionally blocked; new
  SECURITY_MESSAGE_FLAG_* denial constants name the responsible flag;
  security_403_response gains flag_token (comfyui_outdated keeps precedence)
- glob/manager_core.py: register both keys (read via get_bool default-false,
  write list, exception fallback); "true"-only truthy; restart-only activation
- js/common.js: 403 dialog copy names the responsible flag at the two
  install call sites
- README.md: security-policy docs for both flags (per-surface scope incl.
  the batch entry-gate qualifier, REPLACE decoupling, loopback bound,
  opt-in config snippet, default-deny + migration note); stale tier lists
  corrected against the actual gates
- CHANGELOG.md: opt-in migration note + accepted residual risk (flags
  bypass the forced-strong outdated-ComfyUI hardening on loopback,
  opt-in only), decoupling claim qualified for the batch entry gate

Tests: unit suite (predicate truth table, REPLACE litmus both directions,
AST binding-proofs against live handlers, subprocess-isolated config
contract) plus a real-server E2E suite that mounts the Manager-under-test
via git worktree (exact-SHA pin, detached) against a real ComfyUI and
exercises both flag surfaces and both arms — deny arms (403 + flag-naming
body/log + no install artifact), git-URL allow arm (real clone), pip allow
arm as a two-phase reservation oracle — with zero-residual self-clean.
Module skips without E2E_COMFYUI_ROOT; unit suite unaffected.

The manager-v4 branch ships the identical policy (shared invariants +
config contract); this tree uses the degraded predicate 'flag AND
loopback' (no personal_cloud-equivalent mode here).
2026-06-15 02:44:26 +09:00
..
cm-api.js fix(security): harden CSRF with Content-Type gate and OpenAPI sync (#2819) 2026-04-22 05:04:07 +09:00
comfyui-gui-builder.js Changed Main Dialog to match aesthetics and close button location as Original ComfyUI Interface (#2349) 2025-12-19 12:34:20 +09:00
comfyui-manager.js fix(security): harden CSRF with Content-Type gate and OpenAPI sync (#2819) 2026-04-22 05:04:07 +09:00
comfyui-share-common.js Merge branch 'main' into feat/cnr 2025-01-02 02:58:55 +09:00
comfyui-share-copus.js feat: change web icon (#2042) 2025-07-30 18:31:56 +09:00
comfyui-share-openart.js Merge branch 'main' into feat/cnr 2025-01-02 02:58:55 +09:00
comfyui-share-youml.js Merge branch 'main' into feat/cnr 2025-01-02 02:58:55 +09:00
common.js feat(security): add dedicated install flags decoupled from security_level 2026-06-15 02:44:26 +09:00
components-manager.js feat(security): add dedicated install flags decoupled from security_level 2026-06-15 02:44:26 +09:00
custom-nodes-manager.css Changed Main Dialog to match aesthetics and close button location as Original ComfyUI Interface (#2349) 2025-12-19 12:34:20 +09:00
custom-nodes-manager.js fix(security): harden CSRF with Content-Type gate and OpenAPI sync (#2819) 2026-04-22 05:04:07 +09:00
model-manager.css Changed Main Dialog to match aesthetics and close button location as Original ComfyUI Interface (#2349) 2025-12-19 12:34:20 +09:00
model-manager.js fix(security): harden CSRF with Content-Type gate and OpenAPI sync (#2819) 2026-04-22 05:04:07 +09:00
node_fixer.js Add workaround for delay in link connection (#1873) 2025-05-27 06:27:45 +09:00
popover-helper.js UI improvement (#1625) 2025-03-14 00:51:37 +09:00
README.md docs: fix typos and phrasing in README and docs (en/ko)\n\n- README: grammar, capitalization, option name (--skip-stat-update), double-click, macOS\n- js/README: Copus platform name\n- docs/en: Colab capitalization\n- docs/ko: spacing, wording, typos (예를, 명령, show를, etc.) (#2166) 2025-09-23 07:17:41 +09:00
snapshot.css Changed Main Dialog to match aesthetics and close button location as Original ComfyUI Interface (#2349) 2025-12-19 12:34:20 +09:00
snapshot.js fix(security): harden CSRF with Content-Type gate and OpenAPI sync (#2819) 2026-04-22 05:04:07 +09:00
turbogrid.esm.js Better model manager UI (#802) 2024-06-22 10:12:01 +09:00
workflow-metadata.js Update workflow-metadata.js 2025-04-23 17:24:07 -07:00

README.md

ComfyUI-Manager: Frontend (js)

This directory contains the JavaScript frontend implementation for ComfyUI-Manager, providing the user interface components that interact with the backend API.

Core Components

  • comfyui-manager.js: Main entry point that initializes the manager UI and integrates with ComfyUI.
  • custom-nodes-manager.js: Implements the UI for browsing, installing, and managing custom nodes.
  • model-manager.js: Handles the model management interface for downloading and organizing AI models.
  • components-manager.js: Manages reusable workflow components system.
  • snapshot.js: Implements the snapshot system for backing up and restoring installations.

Sharing Components

  • comfyui-share-common.js: Base functionality for workflow sharing features.
  • comfyui-share-copus.js: Integration with the ComfyUI Copus sharing platform.
  • comfyui-share-openart.js: Integration with the OpenArt sharing platform.
  • comfyui-share-youml.js: Integration with the YouML sharing platform.

Utility Components

  • cm-api.js: Client-side API wrapper for communication with the backend.
  • common.js: Shared utilities and helper functions used across the frontend.
  • node_fixer.js: Utilities for fixing disconnected links and repairing malformed nodes by recreating them while preserving connections.
  • popover-helper.js: UI component for popup tooltips and contextual information.
  • turbogrid.esm.js: Grid component library - https://github.com/cenfun/turbogrid
  • workflow-metadata.js: Handles workflow metadata parsing, validation and cross-repository compatibility including versioning, dependencies tracking, and resource management.

Architecture

The frontend follows a modular component-based architecture:

  1. Integration Layer: Connects with ComfyUI's existing UI system
  2. Manager Components: Individual functional UI components (node manager, model manager, etc.)
  3. Sharing Components: Platform-specific sharing implementations
  4. Utility Layer: Reusable UI components and helpers

Implementation Details

  • The frontend integrates directly with ComfyUI's UI system through app.js
  • Dialog-based UI for most manager functions to avoid cluttering the main interface
  • Asynchronous API calls to handle backend operations without blocking the UI

Styling

CSS files are included for specific components:

  • custom-nodes-manager.css: Styling for the node management UI
  • model-manager.css: Styling for the model management UI

This frontend implementation provides a comprehensive yet user-friendly interface for managing the ComfyUI ecosystem.