- Add core/network_utils.py with URL validation, public-IP enforcement,
redirect validation, and safe request_public_url/validate_public_http_url helpers
- Replace direct requests calls in downloader/type_utils/sources with
request_public_url so redirects are validated before follow-up
- Replace netloc string checks with host_matches_domain for CivitAI,
CivArchive, and HuggingFace host matching
- Add HuggingFace Xet download backend with progress reporting and
cancellation support via hf_xet/huggingface_hub
- Harden aria2 installer: reject symlinks/special files in archives,
restrict custom aria2c paths to the managed install, and update UI copy
- Normalize paths with realpath and enforce configured model roots in
local hash/metadata routes, plus remove caller-selected metadata_path
injection in sidecar writing
- Sanitize download/network errors to strip signed query strings before
logging or showing them to the user
- Introduce workflow-scoped download state keys so active downloads and progress are isolated per workflow tab/route.
- Add a transient 'cancelling' status path and a finalizeCancelledDownloadFrontend helper to avoid flicker and prevent stale progress responses from recreating completed/cancelled UI state.
- Guard active-download lookups by current workflow scope to reduce cross-workflow interference.
Keep path-specific Local Matches for active downloads during refreshes,
URN search, and missing-model display so late hash-only lookups do not
overwrite them.
Remove cancelled download matches from missing-model UI and cached
analysis when a download is cancelled.
core/path_templates.py: allow model alias tokens to match when suffixed
with a version string or plural form, reducing false negatives in
single-folder path resolution.
metadata/huggingface-author-index.json: update Comfy-Org index timestamp
and repository ordering.
- Adopt ComfyUI's ComfyExtension/comfy_entrypoint API in __init__.py when
available, falling back to legacy NODE_CLASS_MAPPINGS/DISPLAY_NAME_MAPPINGS
on older runtimes so the node loads across ComfyUI versions.
- Hook into beforeRegisterNodeDef, loadedGraphNode, and afterConfigureGraph
in web/resolver.js so marker nodes are patched during registration, graph
load, and initial render.
- Teach model_resolver.js to recognise the marker node by every known class
property shape, patch its type on creation, enforce a minimum size with
setSize() when present, and dirty the canvas so changes are reflected.
This change introduces a complete Local Metadata Builder feature in the resolver
options panel. It allows users to scan local model files, create or update
.metadata.json sidecars, fill missing SHA256 hashes from safetensors headers or
file hashing, and review run history with cancel/error handling.
Changes include:
- backend API: /model_resolver/metadata-build/{capabilities,start,progress/{id},cancel}
- backend worker: core/metadata_builder.py with parallel metadata generation
- frontend section: Local Metadata Builder tab in Options
- frontend polling UI: progress, worker breakdown, history table, status/notifications
Dariusz L