git_helper.py is spawned as a standalone subprocess on Windows
(manager_core.py:1342). The import of comfyui_manager.common.timestamp_utils
triggered comfyui_manager/__init__.py which imports from comfy.cli_args —
unavailable in the subprocess environment, causing ModuleNotFoundError.
Inline get_backup_branch_name() using only stdlib (time, uuid), preserving
the original collision-detection and UUID-fallback semantics. Add 9 tests
covering standalone subprocess loading, behavioral equivalence, edge cases
(repo.heads exception, 99-suffix exhaustion with UUID fallback).
Add `cm-cli update-cache` command that force-fetches all remote data
and populates local cache in blocking mode. Bypasses pip/offline guards
in get_data_by_mode and get_cnr_data by directly fetching channel JSON
files and calling reload('remote'). Solves permanent cold-start issue
where pip-installed cm-cli could never populate CNR cache without
running the web server first.
Add UnifiedManager.purge_node_state() to both glob and legacy packages
for reinstall categorization mismatch (e.g. unknown→nightly). Includes
path traversal protection via commonpath, root directory guard,
comfyui-manager self-protection, and finally-guarded dictionary cleanup.
Add NodeInstallError exception and batch failure tracking to
for_each_nodes: reinstall propagates install failures via
raise_on_fail, for_each_nodes catches NodeInstallError, tracks
failed nodes, reports aggregate summary, and exits non-zero.
Remove debug print in install_node.
Bump version to 4.1b5.
E2E verified:
- update-cache: empty cache (5 lines) → populated (7815 lines)
- reinstall batch: 2 packs, 1 failure → continues to 2nd → summary + exit 1
The command performs collect→compile→install (full pipeline),
not just compile. uv-sync better reflects the actual behavior.
The --uv-compile flag on other commands (install, reinstall,
update, fix, etc.) is intentionally kept as-is: it reads as
a mechanism descriptor ("use uv pip compile to resolve deps")
rather than a reference to the standalone command name.
* feat(cli): expand --uv-compile to all node management commands with conflict attribution
Add --uv-compile flag to reinstall, update, fix, restore-snapshot,
restore-dependencies, and install-deps commands. Each skips per-node
pip installs and runs batch uv pip compile after all operations.
Change CollectedDeps.sources type to dict[str, list[tuple[str, str]]]
to store (pack_path, pkg_spec) per requester. On resolution failure,
_run_unified_resolve() cross-references conflict packages with sources
using word-boundary regex and displays which node packs requested each
conflicting package.
Update EN/KO user docs and DESIGN/PRD developer docs to cover the
expanded commands and conflict attribution output. Strengthen unit
tests for sources tuple format and compile failure attribution.
Bump version to 4.1b3.
* refactor(cli): extract _finalize_resolve helper, add CNR nightly fallback and pydantic guard
- Extract `_finalize_resolve()` to eliminate 7x duplicated uv-compile
error handling blocks in cm_cli (~-85 lines)
- Move conflict attribution regex to `attribute_conflicts()` in
unified_dep_resolver.py for direct testability
- Update 4 attribution tests to call production function instead of
re-implementing regex
- Add CNR nightly fallback: when node is absent from nightly manifest,
fall back to cnr_map repository URL (glob + legacy)
- Add pydantic Union guard: use getattr for is_unknown in uninstall
and disable handlers to prevent Union type mismatch
- Add E2E test suites for endpoint install/uninstall and uv-compile
CLI commands (conflict + success cases)
- Add nightly CNR fallback regression tests
* feat(deps): add unified dependency resolver using uv pip compile
- Add UnifiedDepResolver module with 7 FRs: collect, compile, install pipeline
- Integrate startup batch resolution in prestartup_script.py (module scope)
- Skip per-node pip install in execute_install_script() when unified mode active
- Add use_unified_resolver config flag following use_uv pattern
- Input sanitization: reject -r, -e, --find-links, @ file://, path separators
- Handle --index-url/--extra-index-url separation with credential redaction
- Fallback to per-node pip on resolver failure or uv unavailability
- Add 98 unit tests across 20 test classes
- Add PRD and Design docs with cm_global integration marked as DEFERRED
* fix(deps): reset use_unified_resolver flag on startup fallback
When the unified resolver fails at startup (compile error, install
error, uv unavailable, or generic exception), the runtime flag was
not being reset to False. This caused subsequent runtime installs
to incorrectly defer pip dependencies instead of falling back to
per-node pip install.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test(deps): add manual test cases for unified dependency resolver
Add environment setup guide and 16 test cases covering:
- Normal batch resolution (TC-1), disabled state (TC-2)
- Fallback paths: uv unavailable (TC-3), compile fail (TC-4),
install fail (TC-5), generic exception (TC-16)
- install.py preservation (TC-6), runtime defer (TC-13)
- Input sanitization: dangerous patterns (TC-7), path separators
(TC-8), index-url separation (TC-9), credential redaction (TC-10)
- Disabled pack exclusion (TC-11), no-deps path (TC-12)
- Both unified resolver guard paths (TC-14), post-fallback (TC-15)
Includes API reference, traceability matrix, and out-of-scope items.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(deps): prevent read_config() from overriding resolver fallback state
read_config() in manager_core.py unconditionally re-read
use_unified_resolver from config.ini, undoing the False set by
prestartup_script.py on resolver fallback. This caused runtime
installs to still defer deps even after a startup batch failure.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(deps): support multiple index URLs per line and optimize downgrade check
- Rewrite _split_index_url() to handle multiple --index-url /
--extra-index-url options on a single requirements.txt line using
regex-based parsing instead of single split.
- Cache installed_packages snapshot in collect_requirements() to avoid
repeated subprocess calls during downgrade blacklist checks.
- Add unit tests for multi-URL lines and bare --index-url edge case.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test(deps): add E2E scripts and update test documentation
Add automated E2E test scripts for unified dependency resolver:
- setup_e2e_env.sh: idempotent environment setup (clone ComfyUI,
create venv, install deps, symlink Manager, write config.ini)
- start_comfyui.sh: foreground-blocking launcher using
tail -f | grep -q readiness detection
- stop_comfyui.sh: graceful SIGTERM → SIGKILL shutdown
Update test documentation reflecting E2E testing findings:
- TEST-environment-setup.md: add automated script usage, document
caveats (PYTHONPATH, config.ini path, Manager v4 /v2/ prefix,
Blocked by policy, bash ((var++)) trap, git+https:// rejection)
- TEST-unified-dep-resolver.md: add TC-17 (restart dependency
detection), TC-18 (real node pack integration), Validated
Behaviors section, normalize API port to 8199
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(deps): harden input sanitization, expand test coverage, bump version
Security:
- Add _INLINE_DANGEROUS_OPTIONS regex to catch pip options after package
names (--find-links, --constraint, --requirement, --editable, --trusted-host,
--global-option, --install-option and short forms)
- Stage index URLs in pending_urls, commit only after full line validation
to prevent URL injection from rejected lines
Tests:
- Add 50 new tests: inline sanitization, false-positive guards, parse
helpers (_parse_conflicts, _parse_install_output), exception paths
(91 → 141 total, all pass)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(cli): add uv-compile command and --uv-compile flag for batch dependency resolution
Add two CLI entry points for the unified dependency resolver:
- `cm_cli uv-compile`: standalone batch resolution of all installed
node pack dependencies via uv pip compile
- `cm_cli install --uv-compile`: skip per-node pip, batch-resolve all
deps after install completes (mutually exclusive with --no-deps)
Both use a shared `_run_unified_resolve()` helper that passes real
cm_global values (pip_blacklist, pip_overrides, pip_downgrade_blacklist)
and guarantees PIPFixer.fix_broken() runs via try/finally.
Update DESIGN, PRD, and TEST docs for consistency.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
- Move cm_cli from comfyui_manager/cm_cli/ to top-level cm_cli/ package
- Convert relative imports to absolute imports
- Remove non-functional cli-only-mode command (flag was never checked)
- Update docs: python cm-cli.py → cm-cli entrypoint
- Update prestartup snapshot restore to use -m cm_cli
- Version bump to 4.1b1
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
- Add is_safe_path_target() and get_safe_file_path() utilities
- Validate history id and snapshot target parameters in API endpoints
- Sanitize config string values to prevent CRLF injection
- Add verbose config option to control CNR fetch logging
- Improve get_module_name with cnr_id/aux_id fallback via repo_cnr_map
- Fix is_valid_url misuse of try/finally that could cause runtime errors
- Move SSH_URL_PATTERN to module-level constant for performance
* Started changing UI to match the rest of ComfyUI
Completed Main Container
* - Added layout formatting to components of the Manager dialog box
- Pulled name from select and put it into a label (eg "DB: Channel" now has a label of DB and a dropdown with channel, etc)
- Fixed incorrect z-index
* Removed this.close() I added before finding z-index issue.
* Matched buttons and drop downs to match style of ComfyUI interface while keeping the colours the same as OG ComfyUI Manager
* - Took gui building out and put into its own .js
- Applied theme to Nodes Manager
- Made theme respect user theme colors
* - Themed model manager and snapshot manager
- fixed incorrect id in gui builder
* Fix syntax error in color property
---------
Co-authored-by: Dr.Lt.Data <128333288+ltdrdata@users.noreply.github.com>
- Add aux_id format (author/repo) support in normalize_to_github_id()
- Fix get_module_name() to use URL normalization for unknown_active_nodes
- Use NormalizedKeyDict in reload() to maintain normalized key lookup
* Improve comfyui version listing
* Fix ComfyUI semver selection and stable update
* Fix nightly current detection on default branch
* Fix: use tag_ref.name explicitly and cache get_remote_name result
- Use tag_ref.name instead of tag_ref object for checkout
- Cache get_remote_name() result to avoid duplicate calls
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Dr.Lt.Data <dr.lt.data@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
- Use --ff-only flag to detect non-fast-forward situations
- Create backup branch before resetting divergent local branch
- Reset to remote branch when fast-forward is not possible
- Add timestamp_utils.py for Mac datetime module compatibility
- Migrate all datetime usages to centralized utilities
- Bump version to 4.0.3b5
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add Keybinding Extra custom node
Added a new custom node for Keybinding Extra with relevant details.
* Enhance description for Keybinding Extra
Updated the description for the Keybinding Extra to provide more detail about its functionality.
* Update custom-node-list.json
---------
Co-authored-by: Dr.Lt.Data <128333288+ltdrdata@users.noreply.github.com>
Resolved merge conflict with PR #2297 by integrating:
- PDF Tools - Advanced PDF Processing & OCR (new entry)
- AAA Metadata System (updated with enhanced description and metadata)
- HYPIR Image Restoration (preserved from main branch)
All entries use consistent spacing and JSON formatting.
