- Add core/network_utils.py with URL validation, public-IP enforcement,
redirect validation, and safe request_public_url/validate_public_http_url helpers
- Replace direct requests calls in downloader/type_utils/sources with
request_public_url so redirects are validated before follow-up
- Replace netloc string checks with host_matches_domain for CivitAI,
CivArchive, and HuggingFace host matching
- Add HuggingFace Xet download backend with progress reporting and
cancellation support via hf_xet/huggingface_hub
- Harden aria2 installer: reject symlinks/special files in archives,
restrict custom aria2c paths to the managed install, and update UI copy
- Normalize paths with realpath and enforce configured model roots in
local hash/metadata routes, plus remove caller-selected metadata_path
injection in sidecar writing
- Sanitize download/network errors to strip signed query strings before
logging or showing them to the user
- Introduce workflow-scoped download state keys so active downloads and progress are isolated per workflow tab/route.
- Add a transient 'cancelling' status path and a finalizeCancelledDownloadFrontend helper to avoid flicker and prevent stale progress responses from recreating completed/cancelled UI state.
- Guard active-download lookups by current workflow scope to reduce cross-workflow interference.
Keep path-specific Local Matches for active downloads during refreshes,
URN search, and missing-model display so late hash-only lookups do not
overwrite them.
Remove cancelled download matches from missing-model UI and cached
analysis when a download is cancelled.
core/path_templates.py: allow model alias tokens to match when suffixed
with a version string or plural form, reducing false negatives in
single-folder path resolution.
metadata/huggingface-author-index.json: update Comfy-Org index timestamp
and repository ordering.
- Adopt ComfyUI's ComfyExtension/comfy_entrypoint API in __init__.py when
available, falling back to legacy NODE_CLASS_MAPPINGS/DISPLAY_NAME_MAPPINGS
on older runtimes so the node loads across ComfyUI versions.
- Hook into beforeRegisterNodeDef, loadedGraphNode, and afterConfigureGraph
in web/resolver.js so marker nodes are patched during registration, graph
load, and initial render.
- Teach model_resolver.js to recognise the marker node by every known class
property shape, patch its type on creation, enforce a minimum size with
setSize() when present, and dirty the canvas so changes are reflected.
This change introduces a complete Local Metadata Builder feature in the resolver
options panel. It allows users to scan local model files, create or update
.metadata.json sidecars, fill missing SHA256 hashes from safetensors headers or
file hashing, and review run history with cancel/error handling.
Changes include:
- backend API: /model_resolver/metadata-build/{capabilities,start,progress/{id},cancel}
- backend worker: core/metadata_builder.py with parallel metadata generation
- frontend section: Local Metadata Builder tab in Options
- frontend polling UI: progress, worker breakdown, history table, status/notifications
The URL parser previously required the hostname to contain "civitai.com",
so CivitAI download links using the "civitai.red" domain were treated as
non-CivitAI URLs and rejected.
This extracts the host check into _is_civitai_host() and accepts both
"civitai.com" and "civitai.red" base domains, so resolve/parse flows
handle all CivitAI download links correctly.
Previously, identify_missing_models grouped missing entries only by filename,
which could merge unrelated models from different categories that happen to
share a filename. This change deduplicates by (category, filename) and tracks
all_node_refs with a reference_count so the frontend can preserve one
resolution per node reference instead of collapsing duplicates.
Frontend changes in resolve_download_methods.js iterate over all_node_refs,
and missing_browser_methods.js now shows '+ N refs' in the missing-model
label and clarifies the locate tooltip when multiple workflow references
share the same missing model.
Dariusz L