ComfyUI binds every comma-separated --listen entry, including empty ones,
so the gate no longer filters them: any empty entry makes the listener
non-local. The module docstring names the same-host reverse proxy as the
accepted limit of the token-less model, and the tests cover both.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Mirror ComfyUI-Manager's local mode: setting or deleting API keys,
installing LUTs and switching the LUT catalog channel are accepted only
when every ComfyUI listen address and the request's socket peer are
loopback addresses. Forwarded headers are ignored. Operators of a
--listen server opt in through admin_settings.json in BV's private
storage; that is a deliberate opening, not an authentication. Read
routes and the fixed-source catalog refresh stay open, and the provider
and LUT status responses report the management state for the UI.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
