fix(security): add litellm supply chain attack detection and improve pip matching (#2731)

- Add litellm==1.82.7 and litellm==1.82.8 to blacklist (PYSEC-2026-2)
- Add ultralytics==8.3.42 to blacklist
- Replace substring matching with exact version set matching
- Remove early break to detect multiple malicious packages

README.md

@@ -5,6 +5,7 @@
 ![menu](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/refs/heads/Main/ComfyUI-Manager/images/dialog.jpg)
 
 ## NOTICE
+* V3.38: **Security patch** - Manager data migrated to protected path. See [Migration Guide](docs/en/v3.38-userdata-security-migration.md).
 * V3.16: Support for `uv` has been added. Set `use_uv` in `config.ini`.
 * V3.10: `double-click feature` is removed
   * This feature has been moved to https://github.com/ltdrdata/comfyui-connection-helper
@@ -140,20 +141,27 @@ This repository provides Colab notebooks that allow you to install and use Comfy
 
 
 ## Paths
-In `ComfyUI-Manager` V3.0 and later, configuration files and dynamically generated files are located under `<USER_DIRECTORY>/default/ComfyUI-Manager/`.
+Starting from V3.38, Manager uses a protected system path for enhanced security.
 
-* <USER_DIRECTORY>  
-  * If executed without any options, the path defaults to ComfyUI/user.  
-  * It can be set using --user-directory <USER_DIRECTORY>.  
+* <USER_DIRECTORY>
+  * If executed without any options, the path defaults to ComfyUI/user.
+  * It can be set using --user-directory <USER_DIRECTORY>.
 
-* Basic config files: `<USER_DIRECTORY>/default/ComfyUI-Manager/config.ini`
-* Configurable channel lists: `<USER_DIRECTORY>/default/ComfyUI-Manager/channels.ini`
-* Configurable pip overrides: `<USER_DIRECTORY>/default/ComfyUI-Manager/pip_overrides.json`
-* Configurable pip blacklist: `<USER_DIRECTORY>/default/ComfyUI-Manager/pip_blacklist.list`
-* Configurable pip auto fix: `<USER_DIRECTORY>/default/ComfyUI-Manager/pip_auto_fix.list`
-* Saved snapshot files: `<USER_DIRECTORY>/default/ComfyUI-Manager/snapshots`
-* Startup script files: `<USER_DIRECTORY>/default/ComfyUI-Manager/startup-scripts`
-* Component files: `<USER_DIRECTORY>/default/ComfyUI-Manager/components`
+| ComfyUI Version | Manager Path |
+|-----------------|--------------|
+| v0.3.76+ (with System User API) | `<USER_DIRECTORY>/__manager/` |
+| Older versions | `<USER_DIRECTORY>/default/ComfyUI-Manager/` |
+
+* Basic config files: `config.ini`
+* Configurable channel lists: `channels.list`
+* Configurable pip overrides: `pip_overrides.json`
+* Configurable pip blacklist: `pip_blacklist.list`
+* Configurable pip auto fix: `pip_auto_fix.list`
+* Saved snapshot files: `snapshots/`
+* Startup script files: `startup-scripts/`
+* Component files: `components/`
+
+> **Note**: See [Migration Guide](docs/en/v3.38-userdata-security-migration.md) for upgrade details.
 
 
 ## `extra_model_paths.yaml` Configuration

docs/en/v3.38-userdata-security-migration.md

@@ -0,0 +1,230 @@
+# ComfyUI-Manager V3.38: Userdata Security Migration Guide
+
+## Introduction
+
+ComfyUI-Manager V3.38 introduces a **security patch** that migrates Manager's configuration and data to a protected system path. This change leverages ComfyUI's new System User Protection API (PR #10966) to provide enhanced security isolation.
+
+This guide explains what happens during the migration and how to handle various situations.
+
+---
+
+## What Changed
+
+### Finding Your Paths
+
+When ComfyUI starts, it displays the full paths in the terminal:
+
+```
+** User directory: /path/to/ComfyUI/user
+** ComfyUI-Manager config path: /path/to/ComfyUI/user/__manager/config.ini
+```
+
+Look for these lines in your startup log to find the exact location on your system. In this guide, paths are shown relative to the `user` directory.
+
+### Path Migration
+
+| Data | Legacy Path | New Path |
+|------|-------------|----------|
+| Configuration | `user/default/ComfyUI-Manager/` | `user/__manager/` |
+| Snapshots | `user/default/ComfyUI-Manager/snapshots/` | `user/__manager/snapshots/` |
+
+### Why This Change
+
+In older ComfyUI versions, the `default/` directory was **unprotected** and accessible via web APIs. If you ran ComfyUI with `--listen 0.0.0.0` or similar options to allow external connections, this data **may have been tampered with** by malicious actors.
+
+**Note:** If you only used ComfyUI locally (without `--listen` or with `--listen 127.0.0.1`), your data was not exposed to this vulnerability.
+
+The new `__manager` path uses ComfyUI's protected system directory, which:
+- **Cannot be accessed** from outside (protected by ComfyUI)
+- Isolates system settings from user data
+- Enables stricter security for remote access
+
+**This is why only `config.ini` is automatically migrated** - other files (snapshots) may have been compromised and should be manually verified before copying.
+
+---
+
+## Automatic Migration
+
+When you start ComfyUI with the new System User Protection API, Manager automatically handles the migration:
+
+### Step 1: Configuration Migration
+
+Only `config.ini` is migrated automatically.
+
+**Important**: Snapshots are **NOT** automatically migrated. You must copy them manually if needed.
+
+### Step 2: Security Level Check
+
+During migration, if your security level is below `normal` (i.e., `weak` or `normal-`), it will be automatically raised to `normal`. This is a safety measure because the security level setting itself may have been tampered with in the old version.
+
+```
+======================================================================
+[ComfyUI-Manager] WARNING: Security level adjusted
+  - Previous: 'weak' → New: 'normal'
+  - Raised to prevent unauthorized remote access.
+======================================================================
+```
+
+If you need a lower security level, you can manually edit the config after migration.
+
+### Step 3: Legacy Backup
+
+Your entire legacy directory is moved to a backup location:
+```
+user/__manager/.legacy-manager-backup/
+```
+
+This backup is preserved until you manually delete it.
+
+---
+
+## Persistent Backup Notification
+
+As long as the backup exists, Manager will remind you on **every startup**:
+
+```
+----------------------------------------------------------------------
+[ComfyUI-Manager] NOTICE: Legacy backup exists
+  - Your old Manager data was backed up to:
+      /path/to/ComfyUI/user/__manager/.legacy-manager-backup
+  - Please verify and remove it when no longer needed.
+----------------------------------------------------------------------
+```
+
+**To stop this notification**: Delete the `.legacy-manager-backup` folder inside `user/__manager/` after confirming you don't need any data from it.
+
+---
+
+## Recovering Old Data
+
+### Snapshots
+
+If you need your old snapshots, copy the contents of `.legacy-manager-backup/snapshots/` to `user/__manager/snapshots/`.
+
+---
+
+## Outdated ComfyUI Warning
+
+If you're running an older version of ComfyUI without the System User Protection API, Manager will:
+
+1. **Force security level to `strong`** - All installations are blocked
+2. **Display warning message**:
+
+```
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+[ComfyUI-Manager] ERROR: ComfyUI version is outdated!
+  - Most operations are blocked for security.
+  - ComfyUI update is still allowed.
+  - Please update ComfyUI to use Manager normally.
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+```
+
+**Solution**: Update ComfyUI to v0.3.76 or later.
+
+---
+
+## Security Levels
+
+| Level | What's Allowed |
+|-------|----------------|
+| `strong` | ComfyUI update only. All other installations blocked. |
+| `normal` | Install/update/remove registered custom nodes and models. |
+| `normal-` | Above + Install via Git URL or pip (localhost only). |
+| `weak` | All operations allowed, including from remote connections. |
+
+**Notes:**
+- `strong` is forced on outdated ComfyUI versions.
+- `normal` is the default and recommended for most users.
+- `normal-` is for developers who need to install unregistered nodes locally.
+- `weak` should only be used in isolated development environments.
+
+### Changing Security Level
+
+Edit `user/__manager/config.ini`:
+```ini
+[default]
+security_level = normal
+```
+
+---
+
+## Error Messages
+
+### "comfyui_outdated" (HTTP 403)
+
+This error appears when:
+- Your ComfyUI doesn't have the System User Protection API
+- All installations are blocked until you update ComfyUI
+
+**Solution**: Update ComfyUI to the latest version.
+
+### "security_level" (HTTP 403)
+
+This error appears when:
+- Your security level blocks the requested operation
+- For example, `strong` level blocks all installations
+
+**Solution**: Lower your security level in config.ini if appropriate for your use case.
+
+---
+
+## Security Warning: Suspicious Path
+
+If you see this error on an **older** ComfyUI:
+
+```
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+[ComfyUI-Manager] ERROR: Suspicious path detected!
+  - '__manager' exists with low security level: 'weak'
+  - Please verify manually:
+      /path/to/ComfyUI/user/__manager/config.ini
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+```
+
+On older ComfyUI versions, the `__manager` directory is not normally created. If this directory exists, it may have been created externally. For safety, manually verify the contents of this directory before updating ComfyUI.
+
+---
+
+## Troubleshooting
+
+### All my installations are blocked
+
+**Check 1**: Is your ComfyUI updated?
+- Old ComfyUI forces `security_level = strong`
+- Update ComfyUI to resolve
+
+**Check 2**: What's your security level?
+- Check `user/__manager/config.ini`
+- `security_level = strong` blocks all installations
+
+### My snapshots are missing
+
+Snapshots are not automatically migrated. You need to manually copy the `snapshots` folder from inside `.legacy-manager-backup` to the `user/__manager/` directory.
+
+### I keep seeing the backup notification
+
+Delete the `.legacy-manager-backup` folder inside `user/__manager/` after confirming you don't need any data from it.
+
+### Snapshot restore is blocked
+
+On old ComfyUI (without System User API), snapshot restore is blocked because security is forced to `strong`. Update ComfyUI to enable snapshot restore.
+
+---
+
+## File Structure Reference
+
+```
+user/
+└── __manager/
+    ├── config.ini              # Manager configuration
+    ├── channels.list           # Custom node channels
+    ├── snapshots/              # Environment snapshots
+    └── .legacy-manager-backup/ # Backup of old Manager data (temporary)
+```
+
+---
+
+## Requirements
+
+- **ComfyUI**: v0.3.76 or later (with System User Protection API)
+- **ComfyUI-Manager**: V3.38 or later

git_helper.py

@@ -2,6 +2,7 @@ import subprocess
 import sys
 import os
 import traceback
+import time
 
 import git
 import json
@@ -219,7 +220,14 @@ def gitpull(path):
             repo.close()
             return
 
-        remote.pull()
+        try:
+            repo.git.pull('--ff-only')
+        except git.GitCommandError:
+            backup_name = f'backup_{time.strftime("%Y%m%d_%H%M%S")}'
+            repo.create_head(backup_name)
+            print(f"[ComfyUI-Manager] Cannot fast-forward. Backup created: {backup_name}")
+            repo.git.reset('--hard', f'{remote_name}/{branch_name}')
+            print(f"[ComfyUI-Manager] Reset to {remote_name}/{branch_name}")
 
         repo.git.submodule('update', '--init', '--recursive')
         new_commit_hash = repo.head.commit.hexsha

glob/manager_core.py

@@ -40,10 +40,11 @@ import cnr_utils
 import manager_util
 import git_utils
 import manager_downloader
+import manager_migration
 from node_package import InstalledNodePackage
 
 
-version_code = [3, 37]
+version_code = [3, 39, 2]
 version_str = f"V{version_code[0]}.{version_code[1]}" + (f'.{version_code[2]}' if len(version_code) > 2 else '')
 
 
@@ -214,9 +215,10 @@ def update_user_directory(user_dir):
     global manager_pip_blacklist_path
     global manager_components_path
 
-    manager_files_path = os.path.abspath(os.path.join(user_dir, 'default', 'ComfyUI-Manager'))
+    manager_files_path = manager_migration.get_manager_path(user_dir)
     if not os.path.exists(manager_files_path):
         os.makedirs(manager_files_path)
+    manager_migration.run_migration_checks(user_dir, manager_files_path)
 
     manager_snapshot_path = os.path.join(manager_files_path, "snapshots")
     if not os.path.exists(manager_snapshot_path):
@@ -1699,6 +1701,11 @@ def write_config():
         'db_mode': get_config()['db_mode'],
     }
 
+    # Sanitize all string values to prevent CRLF injection attacks
+    for key, value in config['default'].items():
+        if isinstance(value, str):
+            config['default'][key] = value.replace('\r', '').replace('\n', '').replace('\x00', '')
+
     directory = os.path.dirname(manager_config_path)
     if not os.path.exists(directory):
         os.makedirs(directory)
@@ -1719,7 +1726,7 @@ def read_config():
         manager_util.use_uv = default_conf['use_uv'].lower() == 'true' if 'use_uv' in default_conf else False
         manager_util.bypass_ssl = get_bool('bypass_ssl', False)
 
-        return {
+        result = {
                     'http_channel_enabled': get_bool('http_channel_enabled', False),
                     'preview_method': default_conf.get('preview_method', manager_funcs.get_current_preview_method()).lower(),
                     'git_exe': default_conf.get('git_exe', ''),
@@ -1739,6 +1746,8 @@ def read_config():
                     'security_level': default_conf.get('security_level', 'normal').lower(),
                     'db_mode': default_conf.get('db_mode', 'cache').lower(),
                }
+        manager_migration.force_security_level_if_needed(result)
+        return result
 
     except Exception:
         import importlib.util
@@ -1746,7 +1755,7 @@ def read_config():
         manager_util.use_uv = importlib.util.find_spec("uv") is not None and platform.system() != "Windows"
         manager_util.bypass_ssl = False
 
-        return {
+        result = {
             'http_channel_enabled': False,
             'preview_method': manager_funcs.get_current_preview_method(),
             'git_exe': '',
@@ -1766,6 +1775,8 @@ def read_config():
             'security_level': 'normal', # strong | normal | normal- | weak
             'db_mode': 'cache',         # local | cache | remote
         }
+        manager_migration.force_security_level_if_needed(result)
+        return result
 
 
 def get_config():
@@ -2247,9 +2258,17 @@ def git_pull(path):
 
         current_branch = repo.active_branch
         remote_name = current_branch.tracking_branch().remote_name
-        remote = repo.remote(name=remote_name)
 
-        remote.pull()
+        try:
+            repo.git.pull('--ff-only')
+        except git.GitCommandError:
+            branch_name = current_branch.name
+            backup_name = f'backup_{time.strftime("%Y%m%d_%H%M%S")}'
+            repo.create_head(backup_name)
+            logging.info(f"[ComfyUI-Manager] Cannot fast-forward. Backup created: {backup_name}")
+            repo.git.reset('--hard', f'{remote_name}/{branch_name}')
+            logging.info(f"[ComfyUI-Manager] Reset to {remote_name}/{branch_name}")
+
         repo.git.submodule('update', '--init', '--recursive')
 
         repo.close()
@@ -2517,22 +2536,23 @@ def update_to_stable_comfyui(repo_path):
                 logging.error('\t'+branch.name)
             return "fail", None
 
-        versions, current_tag, _ = get_comfyui_versions(repo)
-        
-        if len(versions) == 0 or (len(versions) == 1 and versions[0] == 'nightly'):
+        versions, current_tag, latest_tag = get_comfyui_versions(repo)
+
+        if latest_tag is None:
             logging.info("[ComfyUI-Manager] Unable to update to the stable ComfyUI version.")
             return "fail", None
-            
-        if versions[0] == 'nightly':
-            latest_tag = versions[1]
-        else:
-            latest_tag = versions[0]
 
-        if current_tag == latest_tag:
+        tag_ref = next((t for t in repo.tags if t.name == latest_tag), None)
+        if tag_ref is None:
+            logging.info(f"[ComfyUI-Manager] Unable to locate tag '{latest_tag}' in repository.")
+            return "fail", None
+
+        if repo.head.commit == tag_ref.commit:
             return "skip", None
         else:
             logging.info(f"[ComfyUI-Manager] Updating ComfyUI: {current_tag} -> {latest_tag}")
-            repo.git.checkout(latest_tag)
+            repo.git.checkout(tag_ref.name)
+            execute_install_script("ComfyUI", repo_path, instant_execution=False, no_deps=False)
             return 'updated', latest_tag
     except:
         traceback.print_exc()
@@ -2664,9 +2684,13 @@ def check_state_of_git_node_pack_single(item, do_fetch=False, do_update_check=Tr
 
 
 def get_installed_pip_packages():
-    # extract pip package infos
-    cmd = manager_util.make_pip_cmd(['freeze'])
-    pips = subprocess.check_output(cmd, text=True).split('\n')
+    try:
+        # extract pip package infos
+        cmd = manager_util.make_pip_cmd(['freeze'])
+        pips = subprocess.check_output(cmd, text=True).split('\n')
+    except Exception as e:
+        logging.warning("[ComfyUI-Manager] Could not enumerate pip packages for snapshot: %s", e)
+        return {}
 
     res = {}
     for x in pips:
@@ -3351,36 +3375,80 @@ async def restore_snapshot(snapshot_path, git_helper_extras=None):
 
 
 def get_comfyui_versions(repo=None):
-    if repo is None:
-        repo = git.Repo(comfy_path)
+    repo = repo or git.Repo(comfy_path)
 
+    remote_name = None
     try:
-        remote = get_remote_name(repo)   
-        repo.remotes[remote].fetch()    
+        remote_name = get_remote_name(repo)
+        repo.remotes[remote_name].fetch()
     except:
         logging.error("[ComfyUI-Manager] Failed to fetch ComfyUI")
 
-    versions = [x.name for x in repo.tags if x.name.startswith('v')]
+    def parse_semver(tag_name):
+        match = re.match(r'^v(\d+)\.(\d+)\.(\d+)$', tag_name)
+        return tuple(int(x) for x in match.groups()) if match else None
 
-    # nearest tag
-    versions = sorted(versions, key=lambda v: repo.git.log('-1', '--format=%ct', v), reverse=True)
-    versions = versions[:4]
+    def normalize_describe(tag_name):
+        if not tag_name:
+            return None
+        base = tag_name.split('-', 1)[0]
+        return base if parse_semver(base) else None
 
-    current_tag = repo.git.describe('--tags')
+    # Collect semver tags and sort descending (highest first)
+    semver_tags = []
+    for tag in repo.tags:
+        semver = parse_semver(tag.name)
+        if semver:
+            semver_tags.append((semver, tag.name))
+    semver_tags.sort(key=lambda x: x[0], reverse=True)
+    semver_tags = [name for _, name in semver_tags]
 
-    if current_tag not in versions:
-        versions = sorted(versions + [current_tag], key=lambda v: repo.git.log('-1', '--format=%ct', v), reverse=True)
-        versions = versions[:4]
+    latest_tag = semver_tags[0] if semver_tags else None
 
-    main_branch = repo.heads.master
-    latest_commit = main_branch.commit
-    latest_tag = repo.git.describe('--tags', latest_commit.hexsha)
+    try:
+        described = repo.git.describe('--tags')
+    except Exception:
+        described = ''
 
-    if latest_tag != versions[0]:
-        versions.insert(0, 'nightly')
-    else:
-        versions[0] = 'nightly'
+    try:
+        exact_tag = repo.git.describe('--tags', '--exact-match')
+    except Exception:
+        exact_tag = ''
+
+    head_is_default = False
+    if remote_name:
+        try:
+            default_head_ref = repo.refs[f'{remote_name}/HEAD']
+            default_commit = default_head_ref.reference.commit
+            head_is_default = repo.head.commit == default_commit
+        except Exception:
+            head_is_default = False
+
+    nearest_semver = normalize_describe(described)
+    exact_semver = exact_tag if parse_semver(exact_tag) else None
+
+    if head_is_default and not exact_tag:
         current_tag = 'nightly'
+    else:
+        current_tag = exact_tag or described or 'nightly'
+
+    # Prepare semver list for display: top 4 plus the current/nearest semver if missing
+    display_semver_tags = semver_tags[:4]
+    if exact_semver and exact_semver not in display_semver_tags:
+        display_semver_tags.append(exact_semver)
+    elif nearest_semver and nearest_semver not in display_semver_tags:
+        display_semver_tags.append(nearest_semver)
+
+    versions = ['nightly']
+
+    if current_tag and not exact_semver and current_tag not in versions and current_tag not in display_semver_tags:
+        versions.append(current_tag)
+
+    for tag in display_semver_tags:
+        if tag not in versions:
+            versions.append(tag)
+
+    versions = versions[:6]
 
     return versions, current_tag, latest_tag
 

glob/manager_migration.py

@@ -0,0 +1,356 @@
+"""
+ComfyUI-Manager migration module.
+Handles migration from legacy paths to new __manager path structure.
+"""
+
+import os
+import sys
+import subprocess
+import configparser
+
+# Startup notices for notice board
+startup_notices = []  # List of (message, level) tuples
+
+
+def add_startup_notice(message, level='warning'):
+    """Add a notice to be displayed on Manager notice board.
+
+    Args:
+        message: HTML-formatted message string
+        level: 'warning', 'error', 'info'
+    """
+    global startup_notices
+    startup_notices.append((message, level))
+
+
+# Cache for API check (computed once per session)
+_cached_has_system_user_api = None
+
+
+def has_system_user_api():
+    """Check if ComfyUI has the System User Protection API (PR #10966).
+
+    Result is cached for performance.
+    """
+    global _cached_has_system_user_api
+    if _cached_has_system_user_api is None:
+        try:
+            import folder_paths
+            _cached_has_system_user_api = hasattr(folder_paths, 'get_system_user_directory')
+        except Exception:
+            _cached_has_system_user_api = False
+    return _cached_has_system_user_api
+
+
+def get_manager_path(user_dir):
+    """Get the appropriate manager files path based on ComfyUI version.
+
+    Returns:
+        str: manager_files_path
+    """
+    if has_system_user_api():
+        return os.path.abspath(os.path.join(user_dir, '__manager'))
+    else:
+        return os.path.abspath(os.path.join(user_dir, 'default', 'ComfyUI-Manager'))
+
+
+def run_migration_checks(user_dir, manager_files_path):
+    """Run all migration and security checks.
+
+    Call this after get_manager_path() to handle:
+    - Legacy config migration (new ComfyUI)
+    - Legacy backup notification (every startup)
+    - Suspicious directory detection (old ComfyUI)
+    - Outdated ComfyUI warning (old ComfyUI)
+    """
+    if has_system_user_api():
+        migrated = migrate_legacy_config(user_dir, manager_files_path)
+        # Only check for legacy backup if migration didn't just happen
+        # (migration already shows backup location in its message)
+        if not migrated:
+            check_legacy_backup(manager_files_path)
+    else:
+        check_suspicious_manager(user_dir)
+        warn_outdated_comfyui()
+
+
+def check_legacy_backup(manager_files_path):
+    """Check for legacy backup and notify user to verify and remove it.
+
+    This runs on every startup to remind users about pending legacy backup.
+    """
+    backup_dir = os.path.join(manager_files_path, '.legacy-manager-backup')
+    if not os.path.exists(backup_dir):
+        return
+
+    # Terminal output
+    print("\n" + "-"*70)
+    print("[ComfyUI-Manager] NOTICE: Legacy backup exists")
+    print("  - Your old Manager data was backed up to:")
+    print(f"      {backup_dir}")
+    print("  - Please verify and remove it when no longer needed.")
+    print("-"*70 + "\n")
+
+    # Notice board output
+    add_startup_notice(
+        "Legacy ComfyUI-Manager data backup exists. Please verify and remove when no longer needed. See terminal for details.",
+        level='info'
+    )
+
+
+def check_suspicious_manager(user_dir):
+    """Check for suspicious __manager directory on old ComfyUI.
+
+    On old ComfyUI without System User API, if __manager exists with low security,
+    warn the user to verify manually.
+
+    Returns:
+        bool: True if suspicious setup detected
+    """
+    if has_system_user_api():
+        return False  # Not suspicious on new ComfyUI
+
+    suspicious_path = os.path.abspath(os.path.join(user_dir, '__manager'))
+    if not os.path.exists(suspicious_path):
+        return False
+
+    config_path = os.path.join(suspicious_path, 'config.ini')
+    if not os.path.exists(config_path):
+        return False
+
+    config = configparser.ConfigParser()
+    config.read(config_path)
+    sec_level = config.get('default', 'security_level', fallback='normal').lower()
+
+    if sec_level in ['weak', 'normal-']:
+        # Terminal output
+        print("\n" + "!"*70)
+        print("[ComfyUI-Manager] ERROR: Suspicious path detected!")
+        print(f"  - '__manager' exists with low security level: '{sec_level}'")
+        print("  - Please verify manually:")
+        print(f"      {config_path}")
+        print("!"*70 + "\n")
+
+        # Notice board output
+        add_startup_notice(
+            "[Security Alert] Suspicious path detected. See terminal log for details.",
+            level='error'
+        )
+        return True
+
+    return False
+
+
+def warn_outdated_comfyui():
+    """Warn user about outdated ComfyUI without System User API."""
+    if has_system_user_api():
+        return
+
+    # Terminal output
+    print("\n" + "!"*70)
+    print("[ComfyUI-Manager] ERROR: ComfyUI version is outdated!")
+    print("  - Most operations are blocked for security.")
+    print("  - ComfyUI update is still allowed.")
+    print("  - Please update ComfyUI to use Manager normally.")
+    print("!"*70 + "\n")
+
+    # Notice board output
+    add_startup_notice(
+        "[Security Alert] ComfyUI outdated. Installations blocked (update allowed).<BR>"
+        "Update ComfyUI for normal operation.",
+        level='error'
+    )
+
+
+def migrate_legacy_config(user_dir, manager_files_path):
+    """Migrate ONLY config.ini to new __manager path if needed.
+
+    IMPORTANT: Only config.ini is migrated. Other files (snapshots, cache, etc.)
+    are NOT migrated - users must recreate them.
+
+    Scenarios:
+    1. Legacy exists, New doesn't exist → Migrate config.ini
+    2. Legacy exists, New exists → First update after upgrade
+       - Run ComfyUI dependency installation
+       - Rename legacy to .backup
+    3. Legacy doesn't exist → No migration needed
+
+    Returns:
+        bool: True if migration was performed
+    """
+    if not has_system_user_api():
+        return False
+
+    legacy_dir = os.path.join(user_dir, 'default', 'ComfyUI-Manager')
+    legacy_config = os.path.join(legacy_dir, 'config.ini')
+    new_config = os.path.join(manager_files_path, 'config.ini')
+
+    if not os.path.exists(legacy_dir):
+        return False  # No legacy directory, nothing to migrate
+
+    # IMPORTANT: Check for config.ini existence, not just directory
+    # (because makedirs() creates __manager before this function is called)
+
+    # Case: Both configs exist (first update after ComfyUI upgrade)
+    # This means user ran new ComfyUI at least once, creating __manager/config.ini
+    if os.path.exists(legacy_config) and os.path.exists(new_config):
+        _handle_first_update_migration(user_dir, legacy_dir, manager_files_path)
+        return True
+
+    # Case: Legacy config exists but new config doesn't (normal migration)
+    # This is the first run after ComfyUI upgrade
+    if os.path.exists(legacy_config) and not os.path.exists(new_config):
+        pass  # Continue with normal migration below
+    else:
+        return False
+
+    # Terminal output
+    print("\n" + "-"*70)
+    print("[ComfyUI-Manager] NOTICE: Legacy config.ini detected")
+    print(f"  - Old: {legacy_config}")
+    print(f"  - New: {new_config}")
+    print("  - Migrating config.ini only (other files are NOT migrated).")
+    print("  - Security level below 'normal' will be raised.")
+    print("-"*70 + "\n")
+
+    _migrate_config_with_security_check(legacy_config, new_config)
+
+    # Move legacy directory to backup
+    _move_legacy_to_backup(legacy_dir, manager_files_path)
+
+    return True
+
+
+def _handle_first_update_migration(user_dir, legacy_dir, manager_files_path):
+    """Handle first ComfyUI update when both legacy and new directories exist.
+
+    This scenario happens when:
+    - User was on old ComfyUI (using default/ComfyUI-Manager)
+    - ComfyUI was updated (now has System User API)
+    - Manager already created __manager on first new run
+    - But legacy directory still exists
+
+    Actions:
+    1. Run ComfyUI dependency installation
+    2. Move legacy to __manager/.legacy-manager-backup
+    """
+    # Terminal output
+    print("\n" + "-"*70)
+    print("[ComfyUI-Manager] NOTICE: First update after ComfyUI upgrade detected")
+    print("  - Both legacy and new directories exist.")
+    print("  - Running ComfyUI dependency installation...")
+    print("-"*70 + "\n")
+
+    # Run ComfyUI dependency installation
+    # Path: glob/manager_migration.py → glob → comfyui-manager → custom_nodes → ComfyUI
+    try:
+        comfyui_path = os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(__file__))))
+        requirements_path = os.path.join(comfyui_path, 'requirements.txt')
+        if os.path.exists(requirements_path):
+            subprocess.run([sys.executable, '-m', 'pip', 'install', '-r', requirements_path],
+                         capture_output=True, check=False)
+            print("[ComfyUI-Manager] ComfyUI dependencies installation completed.")
+    except Exception as e:
+        print(f"[ComfyUI-Manager] WARNING: Failed to install ComfyUI dependencies: {e}")
+
+    # Move legacy to backup inside __manager
+    _move_legacy_to_backup(legacy_dir, manager_files_path)
+
+
+def _move_legacy_to_backup(legacy_dir, manager_files_path):
+    """Move legacy directory to backup inside __manager.
+
+    Returns:
+        str: Path to backup directory if successful, None if failed
+    """
+    import shutil
+
+    backup_dir = os.path.join(manager_files_path, '.legacy-manager-backup')
+
+    try:
+        if os.path.exists(backup_dir):
+            shutil.rmtree(backup_dir)  # Remove old backup if exists
+        shutil.move(legacy_dir, backup_dir)
+
+        # Terminal output (full paths shown here only)
+        print("\n" + "-"*70)
+        print("[ComfyUI-Manager] NOTICE: Legacy settings migrated")
+        print(f"  - Old location: {legacy_dir}")
+        print(f"  - Backed up to: {backup_dir}")
+        print("  - Please verify and remove the backup when no longer needed.")
+        print("-"*70 + "\n")
+
+        # Notice board output (no full paths for security)
+        add_startup_notice(
+            "Legacy ComfyUI-Manager data migrated. See terminal for details.",
+            level='info'
+        )
+        return backup_dir
+    except Exception as e:
+        print(f"[ComfyUI-Manager] WARNING: Failed to backup legacy directory: {e}")
+        add_startup_notice(
+            f"[MIGRATION] Failed to backup legacy directory: {e}",
+            level='warning'
+        )
+        return None
+
+
+def _migrate_config_with_security_check(legacy_path, new_path):
+    """Migrate legacy config, raising security level only if below default."""
+    config = configparser.ConfigParser()
+    try:
+        config.read(legacy_path)
+    except Exception as e:
+        print(f"[ComfyUI-Manager] WARNING: Failed to parse config.ini: {e}")
+        print("  - Creating fresh config with default settings.")
+        add_startup_notice(
+            "[MIGRATION] Failed to parse legacy config. Using defaults.",
+            level='warning'
+        )
+        return  # Skip migration, let Manager create fresh config
+
+    # Security level hierarchy: strong > normal > normal- > weak
+    # Default is 'normal', only raise if below default
+    if 'default' in config:
+        current_level = config['default'].get('security_level', 'normal').lower()
+        below_default_levels = ['weak', 'normal-']
+
+        if current_level in below_default_levels:
+            config['default']['security_level'] = 'normal'
+
+            # Terminal output
+            print("\n" + "="*70)
+            print("[ComfyUI-Manager] WARNING: Security level adjusted")
+            print(f"  - Previous: '{current_level}' → New: 'normal'")
+            print("  - Raised to prevent unauthorized remote access.")
+            print("="*70 + "\n")
+
+            # Notice board output
+            add_startup_notice(
+                f"[MIGRATION] Security level raised: '{current_level}' → 'normal'.<BR>"
+                "To prevent unauthorized remote access.",
+                level='warning'
+            )
+        else:
+            print(f"  - Security level: '{current_level}' (no change needed)")
+
+    # Ensure directory exists
+    os.makedirs(os.path.dirname(new_path), exist_ok=True)
+
+    with open(new_path, 'w') as f:
+        config.write(f)
+
+
+def force_security_level_if_needed(config_dict):
+    """Force security level to 'strong' if on old ComfyUI.
+
+    Args:
+        config_dict: Configuration dictionary to modify in-place
+
+    Returns:
+        bool: True if security level was forced
+    """
+    if not has_system_user_api():
+        config_dict['security_level'] = 'strong'
+        return True
+    return False

glob/manager_server.py

@@ -22,6 +22,7 @@ import asyncio
 import queue
 
 import manager_downloader
+import manager_migration
 
 
 logging.info(f"### Loading: ComfyUI-Manager ({core.version_str})")
@@ -37,6 +38,25 @@ SECURITY_MESSAGE_NORMAL_MINUS_MODEL = "ERROR: Downloading models that are not in
 
 routes = PromptServer.instance.routes
 
+
+def has_per_queue_preview():
+    """
+    Check if ComfyUI PR #11261 (per-queue live preview override) is merged
+
+    Returns:
+        bool: True if ComfyUI has per-queue preview feature
+    """
+    try:
+        import latent_preview
+        return hasattr(latent_preview, 'set_preview_method')
+    except ImportError:
+        return False
+
+
+# Detect ComfyUI per-queue preview override feature (PR #11261)
+COMFYUI_HAS_PER_QUEUE_PREVIEW = has_per_queue_preview()
+
+
 def handle_stream(stream, prefix):
     stream.reconfigure(encoding=locale.getpreferredencoding(), errors='replace')
     for msg in stream:
@@ -181,10 +201,19 @@ def set_preview_method(method):
     core.get_config()['preview_method'] = method
 
 
-if args.preview_method == latent_preview.LatentPreviewMethod.NoPreviews:
+if COMFYUI_HAS_PER_QUEUE_PREVIEW:
+    logging.info(
+        "[ComfyUI-Manager] ComfyUI per-queue preview override detected (PR #11261). "
+        "Manager's preview method feature is disabled. "
+        "Use ComfyUI's --preview-method CLI option or 'Settings > Execution > Live preview method'."
+    )
+elif args.preview_method == latent_preview.LatentPreviewMethod.NoPreviews:
     set_preview_method(core.get_config()['preview_method'])
 else:
-    logging.warning("[ComfyUI-Manager] Since --preview-method is set, ComfyUI-Manager's preview method feature will be ignored.")
+    logging.warning(
+        "[ComfyUI-Manager] Since --preview-method is set, "
+        "ComfyUI-Manager's preview method feature will be ignored."
+    )
 
 
 def set_component_policy(mode):
@@ -276,6 +305,13 @@ import zipfile
 import urllib.request
 
 
+def security_403_response():
+    """Return appropriate 403 response based on ComfyUI version."""
+    if not manager_migration.has_system_user_api():
+        return web.json_response({"error": "comfyui_outdated"}, status=403)
+    return web.json_response({"error": "security_level"}, status=403)
+
+
 def get_model_dir(data, show_log=False):
     if 'download_model_base' in folder_paths.folder_names_and_paths:
         models_base = folder_paths.folder_names_and_paths['download_model_base'][0][0]
@@ -732,7 +768,7 @@ async def fetch_updates(request):
 async def update_all(request):
     if not is_allowed_security_level('middle'):
         logging.error(SECURITY_MESSAGE_MIDDLE_OR_BELOW)
-        return web.Response(status=403)
+        return security_403_response()
 
     with task_worker_lock:
         is_processing = task_worker_thread is not None and task_worker_thread.is_alive()
@@ -961,16 +997,29 @@ async def get_snapshot_list(request):
     return web.json_response({'items': items}, content_type='application/json')
 
 
+def get_safe_snapshot_path(target):
+    """
+    Safely construct a snapshot file path, preventing path traversal attacks.
+    """
+    if '/' in target or '\\' in target or '..' in target or '\x00' in target:
+        return None
+    return os.path.join(core.manager_snapshot_path, f"{target}.json")
+
+
 @routes.get("/snapshot/remove")
 async def remove_snapshot(request):
     if not is_allowed_security_level('middle'):
         logging.error(SECURITY_MESSAGE_MIDDLE_OR_BELOW)
-        return web.Response(status=403)
+        return security_403_response()
 
     try:
         target = request.rel_url.query["target"]
+        path = get_safe_snapshot_path(target)
+
+        if path is None:
+            logging.error(f"[ComfyUI-Manager] Invalid snapshot target: {target}")
+            return web.Response(text="Invalid snapshot target", status=400)
 
-        path = os.path.join(core.manager_snapshot_path, f"{target}.json")
         if os.path.exists(path):
             os.remove(path)
 
@@ -983,12 +1032,16 @@ async def remove_snapshot(request):
 async def restore_snapshot(request):
     if not is_allowed_security_level('middle'):
         logging.error(SECURITY_MESSAGE_MIDDLE_OR_BELOW)
-        return web.Response(status=403)
+        return security_403_response()
 
     try:
         target = request.rel_url.query["target"]
+        path = get_safe_snapshot_path(target)
+
+        if path is None:
+            logging.error(f"[ComfyUI-Manager] Invalid snapshot target: {target}")
+            return web.Response(text="Invalid snapshot target", status=400)
 
-        path = os.path.join(core.manager_snapshot_path, f"{target}.json")
         if os.path.exists(path):
             if not os.path.exists(core.manager_startup_script_path):
                 os.makedirs(core.manager_startup_script_path)
@@ -1302,7 +1355,7 @@ async def fix_custom_node(request):
 async def install_custom_node_git_url(request):
     if not is_allowed_security_level('high'):
         logging.error(SECURITY_MESSAGE_NORMAL_MINUS)
-        return web.Response(status=403)
+        return security_403_response()
 
     url = await request.text()
     res = await core.gitclone_install(url)
@@ -1322,7 +1375,7 @@ async def install_custom_node_git_url(request):
 async def install_custom_node_pip(request):
     if not is_allowed_security_level('high'):
         logging.error(SECURITY_MESSAGE_NORMAL_MINUS)
-        return web.Response(status=403)
+        return security_403_response()
 
     packages = await request.text()
     core.pip_install(packages.split(' '))
@@ -1474,13 +1527,25 @@ async def install_model(request):
 
 @routes.get("/manager/preview_method")
 async def preview_method(request):
+    # Setting change request
     if "value" in request.rel_url.query:
+        # Reject setting change if per-queue preview feature is available
+        if COMFYUI_HAS_PER_QUEUE_PREVIEW:
+            return web.Response(text="DISABLED", status=403)
+
+        # Process normally if not available
         set_preview_method(request.rel_url.query['value'])
         core.write_config()
-    else:
-        return web.Response(text=core.manager_funcs.get_current_preview_method(), status=200)
+        return web.Response(status=200)
 
-    return web.Response(status=200)
+    # Status query request
+    else:
+        # Return DISABLED if per-queue preview feature is available
+        if COMFYUI_HAS_PER_QUEUE_PREVIEW:
+            return web.Response(text="DISABLED", status=200)
+
+        # Return current value if not available
+        return web.Response(text=core.manager_funcs.get_current_preview_method(), status=200)
 
 
 @routes.get("/manager/db_mode")
@@ -1594,6 +1659,16 @@ async def get_notice(request):
                     except:
                         pass
 
+                    # Prepend startup notices from manager_migration
+                    for message, level in reversed(manager_migration.startup_notices):
+                        if level == 'error':
+                            style = 'color:red; background-color:white; font-weight:bold'
+                        elif level == 'warning':
+                            style = 'color:orange; background-color:white; font-weight:bold'
+                        else:
+                            style = 'color:blue; background-color:white'
+                        markdown_content = f'<P style="{style}">{message}</P>' + markdown_content
+
                     return web.Response(text=markdown_content, status=200)
                 else:
                     return web.Response(text="Unable to retrieve Notice", status=200)
@@ -1601,11 +1676,35 @@ async def get_notice(request):
                 return web.Response(text="Unable to retrieve Notice", status=200)
 
 
+@routes.get("/manager/startup_alerts")
+async def get_startup_alerts(request):
+    """Return startup alerts for customAlert display on page load.
+
+    Returns JSON array of alerts that should be shown to user immediately.
+    All startup notices (error, warning, info) are returned.
+    """
+    alerts = []
+
+    # Return all startup notices for alert display
+    for message, level in manager_migration.startup_notices:
+        # Convert HTML BR to newlines for customAlert
+        text = message.replace('<BR>', '\n').replace('<br>', '\n')
+        # Add [ComfyUI-Manager] prefix for customAlert (notice board shows in Manager UI anyway)
+        text = text.replace('[Security Alert]', '[ComfyUI-Manager] Security Alert:')
+        text = text.replace('[MIGRATION]', '[ComfyUI-Manager] Migration:')
+        alerts.append({
+            'message': text,
+            'level': level
+        })
+
+    return web.json_response(alerts)
+
+
 @routes.get("/manager/reboot")
 def restart(self):
     if not is_allowed_security_level('middle'):
         logging.error(SECURITY_MESSAGE_MIDDLE_OR_BELOW)
-        return web.Response(status=403)
+        return security_403_response()
 
     try:
         sys.stdout.close_log()

glob/manager_util.py

@@ -55,7 +55,7 @@ def get_pip_cmd(force_uv=False):
             subprocess.check_output(test_cmd, stderr=subprocess.DEVNULL, timeout=5)
             return [sys.executable] + (['-s'] if embedded else []) + ['-m', 'pip']
         except Exception:
-            logging.warning("[ComfyUI-Manager] python -m pip not available. Falling back to uv.")
+            logging.warning("[ComfyUI-Manager] `python -m pip` not available. Falling back to `uv`.")
 
     # Try uv (either forced or pip failed)
     import shutil
@@ -64,19 +64,19 @@ def get_pip_cmd(force_uv=False):
     try:
         test_cmd = [sys.executable] + (['-s'] if embedded else []) + ['-m', 'uv', '--version']
         subprocess.check_output(test_cmd, stderr=subprocess.DEVNULL, timeout=5)
-        logging.info("[ComfyUI-Manager] Using uv as Python module for pip operations.")
+        logging.info("[ComfyUI-Manager] Using `uv` as Python module for pip operations.")
         return [sys.executable] + (['-s'] if embedded else []) + ['-m', 'uv', 'pip']
     except Exception:
         pass
 
     # Try standalone uv
     if shutil.which('uv'):
-        logging.info("[ComfyUI-Manager] Using standalone uv for pip operations.")
+        logging.info("[ComfyUI-Manager] Using standalone `uv` for pip operations.")
         return ['uv', 'pip']
 
     # Nothing worked
-    logging.error("[ComfyUI-Manager] Neither python -m pip nor uv are available. Cannot proceed with package operations.")
-    raise Exception("Neither pip nor uv are available for package management")
+    logging.error("[ComfyUI-Manager] Neither `python -m pip` nor `uv` are available. Cannot proceed with package operations.")
+    raise Exception("Neither `pip` nor `uv` are available for package management")
 
 
 def make_pip_cmd(cmd):

glob/security_check.py

@@ -53,6 +53,40 @@ And kill and remove /tmp/ultralytics_runner
 
 The version 8.3.41 to 8.3.42 of the Ultralytics package you installed is compromised. Please uninstall that version and reinstall the latest version.
 https://blog.comfy.org/comfyui-statement-on-the-ultralytics-crypto-miner-situation/
+    """,
+    "litellm==1.82.7": f"""
+Execute following commands:
+    {sys.executable} -m pip uninstall litellm
+
+The litellm PyPI package versions 1.82.7 and 1.82.8 were compromised via a supply chain attack.
+Malicious code harvests SSH keys, environment variables, API keys, cloud credentials, and exfiltrates them to an attacker-controlled server.
+Version 1.82.8 also installs a .pth file that executes malware on ANY Python startup, even without importing litellm.
+
+1. Uninstall litellm immediately.
+2. Assume all credentials accessible to the litellm environment are compromised.
+3. Rotate all API keys, cloud credentials, SSH keys, and database passwords.
+4. Check site-packages for unexpected .pth files (e.g. litellm_init.pth) and remove them.
+5. Run a full malware scan.
+
+Details: https://github.com/BerriAI/litellm/issues/24518
+Advisory: PYSEC-2026-2
+    """,
+    "litellm==1.82.8": f"""
+Execute following commands:
+    {sys.executable} -m pip uninstall litellm
+
+The litellm PyPI package versions 1.82.7 and 1.82.8 were compromised via a supply chain attack.
+Malicious code harvests SSH keys, environment variables, API keys, cloud credentials, and exfiltrates them to an attacker-controlled server.
+Version 1.82.8 also installs a .pth file that executes malware on ANY Python startup, even without importing litellm.
+
+1. Uninstall litellm immediately.
+2. Assume all credentials accessible to the litellm environment are compromised.
+3. Rotate all API keys, cloud credentials, SSH keys, and database passwords.
+4. Check site-packages for unexpected .pth files (e.g. litellm_init.pth) and remove them.
+5. Run a full malware scan.
+
+Details: https://github.com/BerriAI/litellm/issues/24518
+Advisory: PYSEC-2026-2
     """
              }
 
@@ -60,7 +94,10 @@ https://blog.comfy.org/comfyui-statement-on-the-ultralytics-crypto-miner-situati
 
     pip_blacklist = {
         "AppleBotzz": "ComfyUI_LLMVISION",
-        "ultralytics==8.3.41": "ultralytics==8.3.41"
+        "ultralytics==8.3.41": "ultralytics==8.3.41",
+        "ultralytics==8.3.42": "ultralytics==8.3.42",
+        "litellm==1.82.7": "litellm==1.82.7",
+        "litellm==1.82.8": "litellm==1.82.8",
     }
 
     file_blacklist = {
@@ -93,10 +130,15 @@ https://blog.comfy.org/comfyui-statement-on-the-ultralytics-crypto-miner-situati
             print(f"[SECURITY ALERT] custom node '{k}' is dangerous.")
             detected.add(v)
 
+    installed_pip_set = set(installed_pips.strip().split('\n'))
+
     for k, v in pip_blacklist.items():
-        if k in installed_pips:
-            detected.add(v)
-            break
+        if '==' in k:
+            if k in installed_pip_set:
+                detected.add(v)
+        else:
+            if any(line.split('==')[0] == k for line in installed_pip_set):
+                detected.add(v)
 
     for k, v in file_blacklist.items():
         for x in v:
@@ -105,10 +147,14 @@ https://blog.comfy.org/comfyui-statement-on-the-ultralytics-crypto-miner-situati
                 break
 
     if len(detected) > 0:
-        for line in installed_pips.split('\n'):
+        for line in installed_pip_set:
             for k, v in pip_blacklist.items():
-                if k in line:
-                    print(f"[SECURITY ALERT] '{line}' is dangerous.")
+                if '==' in k:
+                    if line == k:
+                        print(f"[SECURITY ALERT] '{line}' is dangerous.")
+                else:
+                    if line.split('==')[0] == k:
+                        print(f"[SECURITY ALERT] '{line}' is dangerous.")
 
         print("\n########################################################################")
         print("   Malware has been detected, forcibly terminating ComfyUI execution.")

js/cm-api.js

@@ -1,6 +1,6 @@
 import { api } from "../../scripts/api.js";
 import { app } from "../../scripts/app.js";
-import { sleep, customConfirm, customAlert } from "./common.js";
+import { sleep, customConfirm, customAlert, handle403Response, show_message } from "./common.js";
 
 async function tryInstallCustomNode(event) {
 	let msg = '-= [ComfyUI Manager] extension installation request =-\n\n';
@@ -42,7 +42,7 @@ async function tryInstallCustomNode(event) {
 									});
 
 			if(response.status == 403) {
-				show_message('This action is not allowed with this security level configuration.');
+				await handle403Response(response);
 				return false;
 			}
 			else if(response.status == 400) {
@@ -54,7 +54,7 @@ async function tryInstallCustomNode(event) {
 
 		let response = await api.fetchApi("/manager/reboot");
 		if(response.status == 403) {
-			show_message('This action is not allowed with this security level configuration.');
+			await handle403Response(response);
 			return false;
 		}
 

js/comfyui-gui-builder.js

@@ -0,0 +1,227 @@
+import { $el } from "../../scripts/ui.js";
+
+function normalizeContent(content) {
+	const tmp = document.createElement('div');
+	if (typeof content === 'string') {
+		tmp.innerHTML = content;
+		return Array.from(tmp.childNodes);
+	}
+	if (content instanceof Node) {
+		return content;
+	}
+	return content;
+}
+
+export function createSettingsCombo(label, content) {
+	const settingItem = $el("div.setting-item", {}, [
+		$el("div.flex.flex-row.items-center.gap-2",[
+				$el("div.form-label.flex.grow.items-center", [
+					$el("span.text-muted", { textContent: label },)
+				]),
+				$el("div.form-input.flex.justify-end",
+					[content]
+				)
+			]
+		)
+	]);
+	return settingItem;
+}
+
+export function buildGuiFrame(dialogId, title, iconClass, content, owner) {
+	const dialog_mask = $el("div.p-dialog-mask.p-overlay-mask.p-overlay-mask-enter", {
+		parent: document.body,
+		style: {
+			position: "fixed",
+			height: "100%",
+			width: "100%",
+			left: "0px",
+			top: "0px",
+			display: "flex",
+			justifyContent: "center",
+			alignItems: "center",
+			pointerEvents: "auto",
+			zIndex: "1000"
+		},
+		onclick: (e) => {
+			if (e.target === dialog_mask) {
+				owner.close();
+			}
+		}
+		// data-pc-section="mask"
+	});
+
+	const header_actions = $el("div.p-dialog-header-actions", {
+			// [TODO]
+			// data-pc-section="headeractions"
+		}
+	);
+
+	const close_button = $el("button.p-button.p-component.p-button-icon-only.p-button-secondary.p-button-rounded.p-button-text.p-dialog-close-button", {
+			parent: header_actions,
+			type: "button",
+			ariaLabel: "Close",
+			onclick: () => owner.close(),
+			// "data-pc-name": "pcclosebutton",
+			// "data-p-disabled": "false",
+			// "data-p-severity": "secondary",
+			// "data-pc-group-section": "headericon",
+			// "data-pc-extend": "button",
+			// "data-pc-section": "root",
+			// [FIXME] Not sure how to do most of the SVG using $el
+			innerHTML: '<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg" class="p-icon p-button-icon" aria-hidden="true"><path d="M8.01186 7.00933L12.27 2.75116C12.341 2.68501 12.398 2.60524 12.4375 2.51661C12.4769 2.42798 12.4982 2.3323 12.4999 2.23529C12.5016 2.13827 12.4838 2.0419 12.4474 1.95194C12.4111 1.86197 12.357 1.78024 12.2884 1.71163C12.2198 1.64302 12.138 1.58893 12.0481 1.55259C11.9581 1.51625 11.8617 1.4984 11.7647 1.50011C11.6677 1.50182 11.572 1.52306 11.4834 1.56255C11.3948 1.60204 11.315 1.65898 11.2488 1.72997L6.99067 5.98814L2.7325 1.72997C2.59553 1.60234 2.41437 1.53286 2.22718 1.53616C2.03999 1.53946 1.8614 1.61529 1.72901 1.74767C1.59663 1.88006 1.5208 2.05865 1.5175 2.24584C1.5142 2.43303 1.58368 2.61419 1.71131 2.75116L5.96948 7.00933L1.71131 11.2675C1.576 11.403 1.5 11.5866 1.5 11.7781C1.5 11.9696 1.576 12.1532 1.71131 12.2887C1.84679 12.424 2.03043 12.5 2.2219 12.5C2.41338 12.5 2.59702 12.424 2.7325 12.2887L6.99067 8.03052L11.2488 12.2887C11.3843 12.424 11.568 12.5 11.7594 12.5C11.9509 12.5 12.1346 12.424 12.27 12.2887C12.4053 12.1532 12.4813 11.9696 12.4813 11.7781C12.4813 11.5866 12.4053 11.403 12.27 11.2675L8.01186 7.00933Z" fill="currentColor"></path></svg><span class="p-button-label" data-pc-section="label">&nbsp;</span><!---->'
+		}
+	);
+
+	const dialog_header = $el("div.p-dialog-header", 
+		[
+			$el("div", [
+				$el("div",
+					{
+						id: "frame-title-container",
+					},
+					[
+						$el("h2.px-4", [
+							$el(iconClass, {
+								style: {
+									"font-size": "1.25rem",
+									"margin-right": ".5rem"
+								}
+							}),
+							$el("span", { textContent: title })
+						])
+					]
+					)
+				]),
+			header_actions
+		]
+	);
+
+	const contentFrame = $el("div.p-dialog-content", {}, normalizeContent(content));
+	const manager_dialog = $el("div.p-dialog.p-component.global-dialog", {
+			id: dialogId,
+			parent: dialog_mask,
+			style: {
+				'display': 'flex',
+				'flex-direction': 'column',
+				'pointer-events': 'auto',
+				'margin': '0px',
+			},
+			role: 'dialog',
+			ariaModal: 'true',
+			// [TODO]
+			// ariaLabbelledby: 'cm-title',
+			// maximized: 'false',
+			// data-pc-name: 'dialog',
+			// data-pc-section: 'root',
+			// data-pd-focustrap: 'true'
+		},
+		[ dialog_header, contentFrame ]
+	);
+
+	const hidden_accessible = $el("span.p-hidden-accessible.p-hidden-focusable", {
+		parent: manager_dialog,
+		tabindex: "0",
+		role: "presentation",
+		ariaHidden: "true",
+		"data-p-hidden-accessible": "true",
+		"data-p-hidden-focusable": "true",
+		"data-pc-section": "firstfocusableelement"
+	});
+
+	return dialog_mask;
+}
+
+export function buildGuiFrameCustomHeader(dialogId, customHeader, content, owner) {
+	const dialog_mask = $el("div.p-dialog-mask.p-overlay-mask.p-overlay-mask-enter", {
+		parent: document.body,
+		style: {
+			position: "fixed",
+			height: "100%",
+			width: "100%",
+			left: "0px",
+			top: "0px",
+			display: "flex",
+			justifyContent: "center",
+			alignItems: "center",
+			pointerEvents: "auto",
+			zIndex: "1000"
+		},
+		onclick: (e) => {
+			if (e.target === dialog_mask) {
+				owner.close();
+			}
+		}
+		// data-pc-section="mask"
+	});
+
+	const header_actions = $el("div.p-dialog-header-actions", {
+			// [TODO]
+			// data-pc-section="headeractions"
+		}
+	);
+
+	const close_button = $el("button.p-button.p-component.p-button-icon-only.p-button-secondary.p-button-rounded.p-button-text.p-dialog-close-button", {
+			parent: header_actions,
+			type: "button",
+			ariaLabel: "Close",
+			onclick: () => owner.close(),
+			// "data-pc-name": "pcclosebutton",
+			// "data-p-disabled": "false",
+			// "data-p-severity": "secondary",
+			// "data-pc-group-section": "headericon",
+			// "data-pc-extend": "button",
+			// "data-pc-section": "root",
+			// [FIXME] Not sure how to do most of the SVG using $el
+			innerHTML: '<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg" class="p-icon p-button-icon" aria-hidden="true"><path d="M8.01186 7.00933L12.27 2.75116C12.341 2.68501 12.398 2.60524 12.4375 2.51661C12.4769 2.42798 12.4982 2.3323 12.4999 2.23529C12.5016 2.13827 12.4838 2.0419 12.4474 1.95194C12.4111 1.86197 12.357 1.78024 12.2884 1.71163C12.2198 1.64302 12.138 1.58893 12.0481 1.55259C11.9581 1.51625 11.8617 1.4984 11.7647 1.50011C11.6677 1.50182 11.572 1.52306 11.4834 1.56255C11.3948 1.60204 11.315 1.65898 11.2488 1.72997L6.99067 5.98814L2.7325 1.72997C2.59553 1.60234 2.41437 1.53286 2.22718 1.53616C2.03999 1.53946 1.8614 1.61529 1.72901 1.74767C1.59663 1.88006 1.5208 2.05865 1.5175 2.24584C1.5142 2.43303 1.58368 2.61419 1.71131 2.75116L5.96948 7.00933L1.71131 11.2675C1.576 11.403 1.5 11.5866 1.5 11.7781C1.5 11.9696 1.576 12.1532 1.71131 12.2887C1.84679 12.424 2.03043 12.5 2.2219 12.5C2.41338 12.5 2.59702 12.424 2.7325 12.2887L6.99067 8.03052L11.2488 12.2887C11.3843 12.424 11.568 12.5 11.7594 12.5C11.9509 12.5 12.1346 12.424 12.27 12.2887C12.4053 12.1532 12.4813 11.9696 12.4813 11.7781C12.4813 11.5866 12.4053 11.403 12.27 11.2675L8.01186 7.00933Z" fill="currentColor"></path></svg><span class="p-button-label" data-pc-section="label">&nbsp;</span><!---->'
+		}
+	);
+
+	const _customHeader = normalizeContent(customHeader);
+	const dialog_header = $el("div.p-dialog-header",
+		[
+			$el("div", [
+				$el("div",
+					{
+						id: "frame-title-container",
+					},
+					Array.isArray(_customHeader) ? _customHeader : [_customHeader]
+					)
+				]),
+			header_actions
+		]
+	);
+
+	const contentFrame = $el("div.p-dialog-content", {}, normalizeContent(content));
+	const manager_dialog = $el("div.p-dialog.p-component.global-dialog", {
+			id: dialogId,
+			parent: dialog_mask,
+			style: {
+				'display': 'flex',
+				'flex-direction': 'column',
+				'pointer-events': 'auto',
+				'margin': '0px',
+			},
+			role: 'dialog',
+			ariaModal: 'true',
+			// [TODO]
+			// ariaLabbelledby: 'cm-title',
+			// maximized: 'false',
+			// data-pc-name: 'dialog',
+			// data-pc-section: 'root',
+			// data-pd-focustrap: 'true'
+		},
+		[ dialog_header, contentFrame ]
+	);
+
+	const hidden_accessible = $el("span.p-hidden-accessible.p-hidden-focusable", {
+		parent: manager_dialog,
+		tabindex: "0",
+		role: "presentation",
+		ariaHidden: "true",
+		"data-p-hidden-accessible": "true",
+		"data-p-hidden-focusable": "true",
+		"data-pc-section": "firstfocusableelement"
+	});
+
+	return dialog_mask;
+}

js/comfyui-manager.js

@@ -14,12 +14,13 @@ import { OpenArtShareDialog } from "./comfyui-share-openart.js";
 import {
 	free_models, install_pip, install_via_git_url, manager_instance,
 	rebootAPI, setManagerInstance, show_message, customAlert, customPrompt,
-	infoToast, showTerminal, setNeedRestart
+	infoToast, showTerminal, setNeedRestart, handle403Response
 } from "./common.js";
 import { ComponentBuilderDialog, getPureName, load_components, set_component_policy } from "./components-manager.js";
 import { CustomNodesManager } from "./custom-nodes-manager.js";
 import { ModelManager } from "./model-manager.js";
 import { SnapshotManager } from "./snapshot.js";
+import { buildGuiFrame, createSettingsCombo } from "./comfyui-gui-builder.js";
 
 let manager_version = await getVersion();
 
@@ -44,12 +45,16 @@ docStyle.innerHTML = `
 
 #cm-manager-dialog {
 	width: 1000px;
-	height: 455px;
+	height: auto;
 	box-sizing: content-box;
 	z-index: 1000;
 	overflow-y: auto;
 }
 
+#cm-manager-dialog br {
+	margin-bottom: 1em;
+}
+
 .cb-widget {
 	width: 400px;
 	height: 25px;
@@ -80,6 +85,7 @@ docStyle.innerHTML = `
 }
 
 .cm-menu-container {
+	padding : calc(var(--spacing)*2);
 	column-gap: 20px;
 	display: flex;
 	flex-wrap: wrap;
@@ -140,8 +146,8 @@ docStyle.innerHTML = `
 }
 
 .cm-notice-board {
-	width: 290px;
-	height: 230px;
+	width: auto;
+	height: 280px;
 	overflow: auto;
 	color: var(--input-text);
 	border: 1px solid var(--descrip-text);
@@ -238,68 +244,50 @@ var is_updating = false;
 // copied style from https://github.com/pythongosssss/ComfyUI-Custom-Scripts
 const style = `
 #workflowgallery-button {
-	width: 310px;
-	height: 27px;
+	height: 50px;
 	padding: 0px !important;
-	position: relative;
-	overflow: hidden;
-	font-size: 17px !important;
 }
 #cm-nodeinfo-button {
-	width: 310px;
-	height: 27px;
-	padding: 0px !important;
-	position: relative;
-	overflow: hidden;
-	font-size: 17px !important;
+	
 }
 #cm-manual-button {
-	width: 310px;
-	height: 27px;
-	position: relative;
-	overflow: hidden;
+
 }
 
 .cm-button {
-	width: 310px;
-	height: 30px;
+	width: auto;
 	position: relative;
 	overflow: hidden;
-	font-size: 17px !important;
+	background-color: var(--comfy-menu-secondary-bg);
+	border-color: var(--border-color);
+	color: var(--input-text);
+}
+
+.cm-button:hover {
+	filter: brightness(125%);
 }
 
 .cm-button-red {
-	width: 310px;
-	height: 30px;
-	position: relative;
-	overflow: hidden;
-	font-size: 17px !important;
 	background-color: #500000 !important;
+	border-color: #88181b !important;
 	color: white !important;
 }
 
+.cm-button-red:hover {
+	background-color: #88181b !important;
+}
 
 .cm-button-orange {
-	width: 310px;
-	height: 30px;
-	position: relative;
-	overflow: hidden;
-	font-size: 17px !important;
 	font-weight: bold;
 	background-color: orange !important;
 	color: black !important;
 }
 
 .cm-experimental-button {
-	width: 290px;
-	height: 30px;
-	position: relative;
-	overflow: hidden;
-	font-size: 17px !important;
+	width: 100%;
 }
 
 .cm-experimental {
-	width: 310px;
 	border: 1px solid #555;
 	border-radius: 5px;
 	padding: 10px;
@@ -326,8 +314,14 @@ const style = `
 
 .cm-menu-combo {
 	cursor: pointer;
-	width: 310px;
-	box-sizing: border-box;
+	padding: 0.5em 0.5em;
+	border: 1px solid var(--border-color);
+	border-radius: 6px;
+	background: var(--comfy-menu-secondary-bg);
+}
+
+.cm-menu-combo:hover {
+	filter: brightness(125%);
 }
 
 .cm-small-button {
@@ -753,9 +747,9 @@ async function onQueueStatus(event) {
 
 		const rebootButton = document.getElementById('cm-reboot-button5');
 		rebootButton?.addEventListener("click",
-			function() {
-				if(rebootAPI()) {
-					manager_dialog.close();
+			async function() {
+				if(await rebootAPI()) {
+					manager_instance.close();
 				}
 			});
 	}
@@ -780,8 +774,13 @@ async function updateAll(update_comfyui) {
 
 	const response = await api.fetchApi(`/manager/queue/update_all?mode=${mode}`);
 
-	if (response.status == 401) {
+	if (response.status == 403) {
+		await handle403Response(response);
+		reset_action_buttons();
+	}
+	else if (response.status == 401) {
 		customAlert('Another task is already in progress. Please stop the ongoing task first.');
+		reset_action_buttons();
 	}
 	else if(response.status == 200) {
 		is_updating = true;
@@ -826,7 +825,7 @@ class ManagerMenuDialog extends ComfyDialog {
 		const isElectron = 'electronAPI' in window;
 		
 		update_comfyui_button =
-			$el("button.cm-button", {
+			$el("button.p-button.p-component.cm-button", {
 				type: "button",
 				textContent: "Update ComfyUI",
 				style: {
@@ -837,7 +836,7 @@ class ManagerMenuDialog extends ComfyDialog {
 			});
 
 		switch_comfyui_button =
-			$el("button.cm-button", {
+			$el("button.p-button.p-component.cm-button", {
 				type: "button",
 				textContent: "Switch ComfyUI",
 				style: {
@@ -848,7 +847,7 @@ class ManagerMenuDialog extends ComfyDialog {
 			});
 
 		restart_stop_button =
-			$el("button.cm-button-red", {
+			$el("button.p-button.p-component.cm-button-red", {
 				type: "button",
 				textContent: "Restart",
 				onclick: () => restartOrStop()
@@ -856,7 +855,7 @@ class ManagerMenuDialog extends ComfyDialog {
 
 		if(isElectron) {
 			update_all_button =
-				$el("button.cm-button", {
+				$el("button.p-button.p-component.cm-button", {
 					type: "button",
 					textContent: "Update All Custom Nodes",
 					onclick:
@@ -865,7 +864,7 @@ class ManagerMenuDialog extends ComfyDialog {
 		}
 		else {
 			update_all_button =
-				$el("button.cm-button", {
+				$el("button.p-button.p-component.cm-button", {
 					type: "button",
 					textContent: "Update All",
 					onclick:
@@ -875,7 +874,7 @@ class ManagerMenuDialog extends ComfyDialog {
 
 		const res =
 			[
-				$el("button.cm-button", {
+				$el("button.p-button.p-component.cm-button", {
 					type: "button",
 					textContent: "Custom Nodes Manager",
 					onclick:
@@ -887,7 +886,7 @@ class ManagerMenuDialog extends ComfyDialog {
 						}
 				}),
 
-				$el("button.cm-button", {
+				$el("button.p-button.p-component.cm-button", {
 					type: "button",
 					textContent: "Install Missing Custom Nodes",
 					onclick:
@@ -899,7 +898,7 @@ class ManagerMenuDialog extends ComfyDialog {
 						}
 				}),
 
-				$el("button.cm-button", {
+				$el("button.p-button.p-component.cm-button", {
 					type: "button",
 					textContent: "Custom Nodes In Workflow",
 					onclick:
@@ -911,8 +910,8 @@ class ManagerMenuDialog extends ComfyDialog {
 						}
 				}),
 				
-				$el("br", {}, []),
-				$el("button.cm-button", {
+				$el("div", {}, []),
+				$el("button.p-button.p-component.cm-button", {
 					type: "button",
 					textContent: "Model Manager",
 					onclick:
@@ -924,7 +923,7 @@ class ManagerMenuDialog extends ComfyDialog {
 						}
 				}),
 
-				$el("button.cm-button", {
+				$el("button.p-button.p-component.cm-button", {
 					type: "button",
 					textContent: "Install via Git URL",
 					onclick: async () => {
@@ -936,13 +935,13 @@ class ManagerMenuDialog extends ComfyDialog {
 					}
 				}),
 
-				$el("br", {}, []),
+				$el("div", {}, []),
 				update_all_button,
 				update_comfyui_button,
 				switch_comfyui_button,
 				// fetch_updates_button,
 
-				$el("br", {}, []),
+				$el("div", {}, []),
 				restart_stop_button,
 			];
 
@@ -955,12 +954,13 @@ class ManagerMenuDialog extends ComfyDialog {
 		let self = this;
 
 		// db mode
+
 		this.datasrc_combo = document.createElement("select");
 		this.datasrc_combo.setAttribute("title", "Configure where to retrieve node/model information. If set to 'local,' the channel is ignored, and if set to 'channel (remote),' it fetches the latest information each time the list is opened.");
-		this.datasrc_combo.className = "cm-menu-combo";
-		this.datasrc_combo.appendChild($el('option', { value: 'cache', text: 'DB: Channel (1day cache)' }, []));
-		this.datasrc_combo.appendChild($el('option', { value: 'local', text: 'DB: Local' }, []));
-		this.datasrc_combo.appendChild($el('option', { value: 'remote', text: 'DB: Channel (remote)' }, []));
+		this.datasrc_combo.className = "cm-menu-combo p-select p-component p-inputwrapper p-inputwrapper-filled ";
+		this.datasrc_combo.appendChild($el('option', { value: 'cache', text: 'Channel (1day cache)' }, []));
+		this.datasrc_combo.appendChild($el('option', { value: 'local', text: 'Local' }, []));
+		this.datasrc_combo.appendChild($el('option', { value: 'remote', text: 'Channel (remote)' }, []));
 
 		api.fetchApi('/manager/db_mode')
 			.then(response => response.text())
@@ -970,27 +970,110 @@ class ManagerMenuDialog extends ComfyDialog {
 			api.fetchApi(`/manager/db_mode?value=${event.target.value}`);
 		});
 
+		const dbRetrievalSetttingItem = createSettingsCombo("DB", this.datasrc_combo);
+
 		// preview method
 		let preview_combo = document.createElement("select");
 		preview_combo.setAttribute("title", "Configure how latent variables will be decoded during preview in the sampling process.");
-		preview_combo.className = "cm-menu-combo";
-		preview_combo.appendChild($el('option', { value: 'auto', text: 'Preview method: Auto' }, []));
-		preview_combo.appendChild($el('option', { value: 'taesd', text: 'Preview method: TAESD (slow)' }, []));
-		preview_combo.appendChild($el('option', { value: 'latent2rgb', text: 'Preview method: Latent2RGB (fast)' }, []));
-		preview_combo.appendChild($el('option', { value: 'none', text: 'Preview method: None (very fast)' }, []));
+		preview_combo.className = "cm-menu-combo p-select p-component p-inputwrapper p-inputwrapper-filled";
 
+		// Loading state to prevent flash of enabled state
+		preview_combo.appendChild($el('option', { value: '', text: 'Loading...', disabled: true }, []));
+		preview_combo.appendChild($el('option', { value: 'auto', text: 'Auto' }, []));
+		preview_combo.appendChild($el('option', { value: 'taesd', text: 'TAESD (slow)' }, []));
+		preview_combo.appendChild($el('option', { value: 'latent2rgb', text: 'Latent2RGB (fast)' }, []));
+		preview_combo.appendChild($el('option', { value: 'none', text: 'None (very fast)' }, []));
+
+		// Start disabled to prevent flash
+		preview_combo.disabled = true;
+		preview_combo.value = '';
+
+		// Fetch current state
 		api.fetchApi('/manager/preview_method')
 			.then(response => response.text())
-			.then(data => { preview_combo.value = data; });
+			.then(data => {
+				// Remove loading option
+				preview_combo.querySelector('option[value=""]')?.remove();
+
+				if (data === "DISABLED") {
+					// ComfyUI per-queue preview feature is active
+					preview_combo.disabled = true;
+					preview_combo.value = 'auto';
+
+					// Accessibility attributes
+					preview_combo.setAttribute("aria-disabled", "true");
+					preview_combo.setAttribute("aria-label",
+						"Preview method setting (disabled - managed by ComfyUI). " +
+						"Use Settings > Execution > Live preview method instead."
+					);
+
+					// Tooltip for mouse users
+					preview_combo.setAttribute("title",
+						"This feature is now provided natively by ComfyUI. " +
+						"Please use 'Settings > Execution > Live preview method' instead."
+					);
+
+					// Visual feedback
+					preview_combo.style.opacity = '0.6';
+					preview_combo.style.cursor = 'not-allowed';
+				} else {
+					// Manager feature is active
+					preview_combo.disabled = false;
+					preview_combo.value = data;
+
+					// Accessibility for enabled state
+					preview_combo.setAttribute("aria-label",
+						"Preview method setting. Select how latent variables are decoded during preview."
+					);
+				}
+			})
+			.catch(error => {
+				console.error('[ComfyUI-Manager] Failed to fetch preview method status:', error);
+				// Error recovery: fallback to enabled
+				preview_combo.querySelector('option[value=""]')?.remove();
+				preview_combo.disabled = false;
+				preview_combo.value = 'auto';
+			});
 
 		preview_combo.addEventListener('change', function (event) {
-			api.fetchApi(`/manager/preview_method?value=${event.target.value}`);
+			// Ignore if disabled
+			if (preview_combo.disabled) {
+				event.preventDefault();
+				return;
+			}
+
+			// Normal operation
+			api.fetchApi(`/manager/preview_method?value=${event.target.value}`)
+				.then(response => {
+					if (response.status === 403) {
+						// Feature transitioned to native
+						alert(
+							'This feature is now provided natively by ComfyUI.\n' +
+							'Please use \'Settings > Execution > Live preview method\' instead.'
+						);
+						preview_combo.disabled = true;
+						preview_combo.style.opacity = '0.6';
+						preview_combo.style.cursor = 'not-allowed';
+
+						// Update aria attributes
+						preview_combo.setAttribute("aria-disabled", "true");
+						preview_combo.setAttribute("aria-label",
+							"Preview method setting (disabled - managed by ComfyUI). " +
+							"Use Settings > Execution > Live preview method instead."
+						);
+					}
+				})
+				.catch(error => {
+					console.error('[ComfyUI-Manager] Preview method update failed:', error);
+				});
 		});
 
+		const previewSetttingItem = createSettingsCombo("Preview method", preview_combo);
+
 		// channel
 		let channel_combo = document.createElement("select");
 		channel_combo.setAttribute("title", "Configure the channel for retrieving data from the Custom Node list (including missing nodes) or the Model list.");
-		channel_combo.className = "cm-menu-combo";
+		channel_combo.className = "cm-menu-combo p-select p-component p-inputwrapper p-inputwrapper-filled";
 		api.fetchApi('/manager/channel_url_list')
 			.then(response => response.json())
 			.then(async data => {
@@ -999,7 +1082,7 @@ class ManagerMenuDialog extends ComfyDialog {
 					for (let i in urls) {
 						if (urls[i] != '') {
 							let name_url = urls[i].split('::');
-							channel_combo.appendChild($el('option', { value: name_url[0], text: `Channel: ${name_url[0]}` }, []));
+							channel_combo.appendChild($el('option', { value: name_url[0], text: `${name_url[0]}` }, []));
 						}
 					}
 
@@ -1014,11 +1097,13 @@ class ManagerMenuDialog extends ComfyDialog {
 				}
 			});
 
+		const channelSetttingItem = createSettingsCombo("Channel", channel_combo);
+
 
 		// share
 		let share_combo = document.createElement("select");
 		share_combo.setAttribute("title", "Hide the share button in the main menu or set the default action upon clicking it. Additionally, configure the default share site when sharing via the context menu's share button.");
-		share_combo.className = "cm-menu-combo";
+		share_combo.className = "cm-menu-combo p-select p-component p-inputwrapper p-inputwrapper-filled";
 		const share_options = [
 			['none', 'None'],
 			['openart', 'OpenArt AI'],
@@ -1029,7 +1114,7 @@ class ManagerMenuDialog extends ComfyDialog {
 			['all', 'All'],
 		];
 		for (const option of share_options) {
-			share_combo.appendChild($el('option', { value: option[0], text: `Share: ${option[1]}` }, []));
+			share_combo.appendChild($el('option', { value: option[0], text: `${option[1]}` }, []));
 		}
 
 		api.fetchApi('/manager/share_option')
@@ -1051,12 +1136,14 @@ class ManagerMenuDialog extends ComfyDialog {
 			}
 		});
 
+		const shareSetttingItem = createSettingsCombo("Share", share_combo);
+
 		let component_policy_combo = document.createElement("select");
 		component_policy_combo.setAttribute("title", "When loading the workflow, configure which version of the component to use.");
-		component_policy_combo.className = "cm-menu-combo";
-		component_policy_combo.appendChild($el('option', { value: 'workflow', text: 'Component: Use workflow version' }, []));
-		component_policy_combo.appendChild($el('option', { value: 'higher', text: 'Component: Use higher version' }, []));
-		component_policy_combo.appendChild($el('option', { value: 'mine', text: 'Component: Use my version' }, []));
+		component_policy_combo.className = "cm-menu-combo p-select p-component p-inputwrapper p-inputwrapper-filled";
+		component_policy_combo.appendChild($el('option', { value: 'workflow', text: 'Use workflow version' }, []));
+		component_policy_combo.appendChild($el('option', { value: 'higher', text: 'Use higher version' }, []));
+		component_policy_combo.appendChild($el('option', { value: 'mine', text: 'Use my version' }, []));
 		api.fetchApi('/manager/policy/component')
 			.then(response => response.text())
 			.then(data => {
@@ -1069,15 +1156,14 @@ class ManagerMenuDialog extends ComfyDialog {
 			set_component_policy(event.target.value);
 		});
 
-		update_policy_combo = document.createElement("select");
+		const componentSetttingItem = createSettingsCombo("Component", component_policy_combo);
 
-		if(isElectron)
-			update_policy_combo.style.display = 'none';
+		update_policy_combo = document.createElement("select");
 		
 		update_policy_combo.setAttribute("title", "Sets the policy to be applied when performing an update.");
-		update_policy_combo.className = "cm-menu-combo";
-		update_policy_combo.appendChild($el('option', { value: 'stable-comfyui', text: 'Update: ComfyUI Stable Version' }, []));
-		update_policy_combo.appendChild($el('option', { value: 'nightly-comfyui', text: 'Update: ComfyUI Nightly Version' }, []));
+		update_policy_combo.className = "cm-menu-combo p-select p-component p-inputwrapper p-inputwrapper-filled";
+		update_policy_combo.appendChild($el('option', { value: 'stable-comfyui', text: 'ComfyUI Stable Version' }, []));
+		update_policy_combo.appendChild($el('option', { value: 'nightly-comfyui', text: 'ComfyUI Nightly Version' }, []));
 		api.fetchApi('/manager/policy/update')
 			.then(response => response.text())
 			.then(data => {
@@ -1088,20 +1174,22 @@ class ManagerMenuDialog extends ComfyDialog {
 			api.fetchApi(`/manager/policy/update?value=${event.target.value}`);
 		});
 
-		return [
-			$el("br", {}, []),
-			this.datasrc_combo,
-			channel_combo,
-			preview_combo,
-			share_combo,
-			component_policy_combo,
-			update_policy_combo,
-			$el("br", {}, []),
+		const updateSetttingItem = createSettingsCombo("Update", update_policy_combo);
+		
+		if(isElectron)
+			updateSetttingItem.style.display = 'none';
 
-			$el("br", {}, []),
-			$el("filedset.cm-experimental", {}, [
+		return [
+			dbRetrievalSetttingItem,
+			channelSetttingItem,
+			previewSetttingItem,
+			shareSetttingItem,
+			componentSetttingItem,
+			updateSetttingItem,
+			//[TODO] replace mt-2 with wrapper div with flex column gap
+			$el("filedset.cm-experimental.mt-auto", {}, [
 					$el("legend.cm-experimental-legend", {}, ["EXPERIMENTAL"]),
-					$el("button.cm-experimental-button", {
+					$el("button.p-button.p-component.cm-button.cm-experimental-button", {
 						type: "button",
 						textContent: "Snapshot Manager",
 						onclick:
@@ -1111,7 +1199,7 @@ class ManagerMenuDialog extends ComfyDialog {
 								SnapshotManager.instance.show();
 							}
 					}),
-					$el("button.cm-experimental-button", {
+					$el("button.p-button.p-component.cm-button.cm-experimental-button.mt-2", {
 						type: "button",
 						textContent: "Install PIP packages",
 						onclick:
@@ -1129,7 +1217,7 @@ class ManagerMenuDialog extends ComfyDialog {
 
 	createControlsRight() {
 		const elts = [
-				$el("button.cm-button", {
+				$el("button.p-button.p-component.cm-button", {
 					id: 'cm-manual-button',
 					type: "button",
 					textContent: "Community Manual",
@@ -1180,11 +1268,11 @@ class ManagerMenuDialog extends ComfyDialog {
 					})
 				]),
 
-				$el("button", {
+				$el("button.p-button.p-component.cm-button", {
 					id: 'workflowgallery-button',
 					type: "button",
 					style: {
-						...(localStorage.getItem("wg_last_visited") ? {height: '50px'} : {})
+						// ...(localStorage.getItem("wg_last_visited") ? {height: '50px'} : {})
 					},
 					onclick: (e) => {
 						const last_visited_site = localStorage.getItem("wg_last_visited")
@@ -1207,7 +1295,7 @@ class ManagerMenuDialog extends ComfyDialog {
 					}, [
 						$el("p", {
 							id: 'workflowgallery-button-last-visited-label',
-							textContent: `(${localStorage.getItem("wg_last_visited") ? localStorage.getItem("wg_last_visited").split('/')[2] : ''})`,
+							textContent: `(${localStorage.getItem("wg_last_visited") ? localStorage.getItem("wg_last_visited").split('/')[2] : 'none selected'})`,
 							style: {
 								'text-align': 'center',
 								'color': 'var(--input-text)',
@@ -1223,13 +1311,12 @@ class ManagerMenuDialog extends ComfyDialog {
 					})
 				]),
 
-				$el("button.cm-button", {
+				$el("button.p-button.p-component.cm-button", {
 					id: 'cm-nodeinfo-button',
 					type: "button",
 					textContent: "Nodes Info",
 					onclick: () => { window.open("https://ltdrdata.github.io/", "comfyui-node-info"); }
 				}),
-				$el("br", {}, []),
 		];
 
 		var textarea = document.createElement("div");
@@ -1244,31 +1331,23 @@ class ManagerMenuDialog extends ComfyDialog {
 	constructor() {
 		super();
 
-		const close_button = $el("button", { id: "cm-close-button", type: "button", textContent: "Close", onclick: () => this.close() });
+		const content =	$el("div.cm-menu-container",
+			[
+				$el("div.cm-menu-column.gap-2", [...this.createControlsLeft()]),
+				$el("div.cm-menu-column.gap-2", [...this.createControlsMid()]),
+				$el("div.cm-menu-column.gap-2", [...this.createControlsRight()])
+			]
+		);
 
-		const content =
-				$el("div.comfy-modal-content",
-					[
-						$el("tr.cm-title", {}, [
-								$el("font", {size:6, color:"white"}, [`ComfyUI Manager ${manager_version}`])]
-							),
-						$el("br", {}, []),
-						$el("div.cm-menu-container",
-							[
-								$el("div.cm-menu-column", [...this.createControlsLeft()]),
-								$el("div.cm-menu-column", [...this.createControlsMid()]),
-								$el("div.cm-menu-column", [...this.createControlsRight()])
-							]),
+		const frame = buildGuiFrame(
+			'cm-manager-dialog', // dialog id
+			`ComfyUI Manager ${manager_version}`, // dialog title
+			"i.mdi.mdi-puzzle", // dialog icon class to show before title
+			content, // dialog content element
+			this
+		);	// send this so we can attach close functions
 
-						$el("br", {}, []),
-						close_button,
-					]
-				);
-
-		content.style.width = '100%';
-		content.style.height = '100%';
-
-		this.element = $el("div.comfy-modal", { id:'cm-manager-dialog', parent: document.body }, [ content ]);
+		this.element = frame;
 	}
 
 	get isVisible() {
@@ -1276,7 +1355,7 @@ class ManagerMenuDialog extends ComfyDialog {
 	}
 
 	show() {
-		this.element.style.display = "block";
+		this.element.style.display = "flex";
 	}
 
 	toggleVisibility() {
@@ -1453,6 +1532,31 @@ app.registerExtension({
 
 		load_components();
 
+		// Fetch and show startup alerts (critical errors like outdated ComfyUI)
+		// Poll until extensionManager.toast is ready (set in Vue onMounted)
+		const showStartupAlerts = async () => {
+			let toastWaitCount = 0;
+			const waitForToast = () => {
+				if (window['app']?.extensionManager?.toast) {
+					fetch('/manager/startup_alerts')
+						.then(response => response.ok ? response.json() : [])
+						.then(alerts => {
+							for (const alert of alerts) {
+								customAlert(alert.message);
+							}
+						})
+						.catch(e => console.warn('[ComfyUI-Manager] Failed to fetch startup alerts:', e));
+				} else if (toastWaitCount < 300) {  // Max 30 seconds (300 * 100ms)
+					toastWaitCount++;
+					setTimeout(waitForToast, 100);
+				} else {
+					console.warn('[ComfyUI-Manager] Timeout waiting for toast. Startup alerts skipped.');
+				}
+			};
+			waitForToast();
+		};
+		showStartupAlerts();
+
 		const menu = document.querySelector(".comfy-menu");
 		const separator = document.createElement("hr");
 

js/common.js

@@ -100,6 +100,19 @@ export function show_message(msg) {
 	app.ui.dialog.element.style.zIndex = 1100;
 }
 
+export async function handle403Response(res, defaultMessage) {
+	try {
+		const data = await res.json();
+		if(data.error === 'comfyui_outdated') {
+			show_message('ComfyUI version is outdated.<BR>Please update ComfyUI to use Manager normally.');
+		} else {
+			show_message(defaultMessage || 'This action is not allowed with this security level configuration.');
+		}
+	} catch {
+		show_message(defaultMessage || 'This action is not allowed with this security level configuration.');
+	}
+}
+
 export async function sleep(ms) {
 	return new Promise(resolve => setTimeout(resolve, ms));
 }
@@ -163,20 +176,23 @@ export async function customPrompt(title, message) {
 }
 
 
-export function rebootAPI() {
+export async function rebootAPI() {
 	if ('electronAPI' in window) {
 			window.electronAPI.restartApp();
 			return true;
 	}
 
-	customConfirm("Are you sure you'd like to reboot the server?").then((isConfirmed) => {
-		if (isConfirmed) {
-			try {
-				api.fetchApi("/manager/reboot");
+	const isConfirmed = await customConfirm("Are you sure you'd like to reboot the server?");
+	if (isConfirmed) {
+		try {
+			const response = await api.fetchApi("/manager/reboot");
+			if (response.status == 403) {
+				await handle403Response(response);
+				return false;
 			}
-			catch(exception) {}
 		}
-	});
+		catch(exception) {}
+	}
 
 	return false;
 }
@@ -216,7 +232,7 @@ export async function install_pip(packages) {
 	});
 
 	if(res.status == 403) {
-		show_message('This action is not allowed with this security level configuration.');
+		await handle403Response(res);
 		return;
 	}
 
@@ -251,7 +267,7 @@ export async function install_via_git_url(url, manager_dialog) {
 	});
 
 	if(res.status == 403) {
-		show_message('This action is not allowed with this security level configuration.');
+		await handle403Response(res);
 		return;
 	}
 
@@ -262,9 +278,9 @@ export async function install_via_git_url(url, manager_dialog) {
 		const self = this;
 
 		rebootButton.addEventListener("click",
-			function() {
-				if(rebootAPI()) {
-					manager_dialog.close();
+			async function() {
+				if(await rebootAPI()) {
+					manager_instance.close();
 				}
 			});
 	}

js/components-manager.js

@@ -678,7 +678,7 @@ export class ComponentBuilderDialog extends ComfyDialog {
 
 let orig_handleFile = app.handleFile;
 
-async function handleFile(file) {
+async function handleFile(file, ...args) {
 	if (file.name?.endsWith(".json") || file.name?.endsWith(".pack")) {
 		const reader = new FileReader();
 		reader.onload = async () => {
@@ -694,7 +694,7 @@ async function handleFile(file) {
 				await handle_import_components(jsonContent);
 			}
 			else {
-				orig_handleFile.call(app, file);
+				orig_handleFile.call(app, file, ...args);
 			}
 		};
 		reader.readAsText(file);
@@ -702,7 +702,7 @@ async function handleFile(file) {
 		return;
 	}
 
-	orig_handleFile.call(app, file);
+	orig_handleFile.call(app, file, ...args);
 }
 
 app.handleFile = handleFile;

js/custom-nodes-manager.css

@@ -1,8 +1,9 @@
 .cn-manager {
 	--grid-font: -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji";
 	z-index: 1099;
-	width: 80%;
-	height: 80%;
+	width: 80vw;
+	height: 75vh;
+	min-height: 30em;
 	display: flex;
 	flex-direction: column;
 	gap: 10px;
@@ -10,6 +11,7 @@
 	font-family: arial, sans-serif;
 	text-underline-offset: 3px;
 	outline: none;
+	margin: calc(var(--spacing)*2);
 }
 
 .cn-manager .cn-flex-auto {
@@ -17,17 +19,21 @@
 }
 
 .cn-manager button {
+	width: auto;
+	position: relative;
+	overflow: hidden;
 	font-size: 16px;
 	color: var(--input-text);
 	background-color: var(--comfy-input-bg);
-	border-radius: 8px;
 	border-color: var(--border-color);
-	border-style: solid;
 	margin: 0;
-	padding: 4px 8px;
 	min-width: 100px;
 }
 
+.cn-manager button:hover {
+	filter: brightness(125%);
+}
+
 .cn-manager button:disabled,
 .cn-manager input:disabled,
 .cn-manager select:disabled {
@@ -40,8 +46,13 @@
 
 .cn-manager .cn-manager-restart {
 	display: none;
-	background-color: #500000;
-	color: white;
+	background-color: #500000 !important;
+	border-color: #88181b !important;
+	color: white !important;
+}
+
+.cn-manager .cn-manager-restart:hover {
+	background-color: #88181b !important;
 }
 
 .cn-manager .cn-manager-stop {
@@ -79,7 +90,6 @@
 	flex-wrap: wrap;
 	gap: 5px;
 	align-items: center;
-	padding: 0 5px;
 }
 
 .cn-manager-header label {
@@ -91,16 +101,32 @@
 .cn-manager-filter {
 	height: 28px;
 	line-height: 28px;
+
+	cursor: pointer;
+	padding: 0.5em 0.5em;
+	border: 1px solid var(--border-color);
+	border-radius: 6px;
+	background: var(--comfy-input-bg);
+}
+
+.cn-manager-filter:hover {
+	filter: brightness(125%);
 }
 
 .cn-manager-keywords {
 	height: 28px;
 	line-height: 28px;
 	padding: 0 5px 0 26px;
+	background: var(--comfy-input-bg);
 	background-size: 16px;
 	background-position: 5px center;
 	background-repeat: no-repeat;
 	background-image: url("data:image/svg+xml;charset=utf8,%3Csvg%20viewBox%3D%220%200%2024%2024%22%20width%3D%22100%25%22%20height%3D%22100%25%22%20pointer-events%3D%22none%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cpath%20fill%3D%22none%22%20stroke%3D%22%23888%22%20stroke-linecap%3D%22round%22%20stroke-linejoin%3D%22round%22%20stroke-width%3D%222%22%20d%3D%22m21%2021-4.486-4.494M19%2010.5a8.5%208.5%200%201%201-17%200%208.5%208.5%200%200%201%2017%200%22%2F%3E%3C%2Fsvg%3E");
+
+	border: 1px solid var(--border-color);
+	border-radius: 6px;
+
+	outline-color: transparent;
 }
 
 .cn-manager-status {
@@ -588,6 +614,10 @@
 	height: 100%;
 }
 
+.cn-install-buttons button {
+	padding: 4px 8px;
+}
+
 .cn-selected-buttons {
 	display: flex;
 	gap: 5px;

js/custom-nodes-manager.js

@@ -1,13 +1,14 @@
 import { app } from "../../scripts/app.js";
 import { ComfyDialog, $el } from "../../scripts/ui.js";
 import { api } from "../../scripts/api.js";
+import { buildGuiFrameCustomHeader,  createSettingsCombo } from "./comfyui-gui-builder.js";
 
 import {
 	manager_instance, rebootAPI, install_via_git_url,
 	fetchData, md5, icons, show_message, customConfirm, customAlert, customPrompt,
 	sanitizeHTML, infoToast, showTerminal, setNeedRestart,
 	storeColumnWidth, restoreColumnWidth, getTimeAgo, copyText, loadCss,
-	showPopover, hidePopover
+	showPopover, hidePopover, handle403Response
 } from  "./common.js";
 
 // https://cenfun.github.io/turbogrid/api.html
@@ -18,32 +19,19 @@ loadCss("./custom-nodes-manager.css");
 const gridId = "node";
 
 const pageHtml = `
-<div class="cn-manager-header">
-	<label>Filter
-		<select class="cn-manager-filter"></select>
-	</label>
-	<input class="cn-manager-keywords" type="search" placeholder="Search" />
-	<div class="cn-manager-status"></div>
-	<div class="cn-flex-auto"></div>
-	<div class="cn-manager-channel"></div>
-</div>
-<div class="cn-manager-grid"></div>
-<div class="cn-manager-selection"></div>
-<div class="cn-manager-message"></div>
-<div class="cn-manager-footer">
-	<button class="cn-manager-back">
-		<svg class="arrow-icon" width="14" height="14" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
-			<path d="M2 8H18M2 8L8 2M2 8L8 14" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-		</svg>
-		Back
-	</button>
-	<button class="cn-manager-restart">Restart</button>
-	<button class="cn-manager-stop">Stop</button>
-	<div class="cn-flex-auto"></div>
-	<button class="cn-manager-used-in-workflow">Used In Workflow</button>
-	<button class="cn-manager-check-update">Check Update</button>
-	<button class="cn-manager-check-missing">Check Missing</button>
-	<button class="cn-manager-install-url">Install via Git URL</button>
+<div class="cn-manager cn-manager-dark">
+	<div class="cn-manager-grid"></div>
+	<div class="cn-manager-selection"></div>
+	<div class="cn-manager-message"></div>
+	<div class="cn-manager-footer">
+		<button class="cn-manager-restart p-button p-component">Restart</button>
+		<button class="cn-manager-stop p-button p-component">Stop</button>
+		<div class="cn-flex-auto"></div>
+		<button class="cn-manager-used-in-workflow p-button p-component">Used In Workflow</button>
+		<button class="cn-manager-check-update p-button p-component">Check Update</button>
+		<button class="cn-manager-check-missing p-button p-component">Check Missing</button>
+		<button class="cn-manager-install-url p-button p-component">Install via Git URL</button>
+	</div>
 </div>
 `;
 
@@ -89,11 +77,26 @@ export class CustomNodesManager {
 	}
 
 	init() {
-		this.element = $el("div", {
-			parent: document.body,
-			className: "comfy-modal cn-manager"
-		});
-		this.element.innerHTML = pageHtml;
+		const header = $el("div.cn-manager-header.px-2", {}, [
+			// $el("label", {}, [
+			// 	$el("span", { textContent: "Filter" }),
+			// 	$el("select.cn-manager-filter")
+			// ]),
+			createSettingsCombo("Filter", $el("select.cn-manager-filter")),
+			$el("input.cn-manager-keywords.p-inputtext.p-component", { type: "search", placeholder: "Search" }),
+			$el("div.cn-manager-status"),
+			$el("div.cn-flex-auto"),
+			$el("div.cn-manager-channel")
+		]);
+
+		const frame = buildGuiFrameCustomHeader(
+			'cn-manager-dialog', // dialog id
+			header, // custom header element
+			pageHtml, // dialog content element
+			this
+		);	// send this so we can attach close functions
+
+		this.element = frame;
 		this.element.setAttribute("tabindex", 0);
 		this.element.focus();
 
@@ -372,7 +375,7 @@ export class CustomNodesManager {
 
 		return list.map(id => {
 			const bt = buttons[id];
-			return `<button class="cn-btn-${id}" group="${action}" mode="${bt.mode}">${bt.label}</button>`;
+			return `<button class="cn-btn-${id} p-button p-component" group="${action}" mode="${bt.mode}">${bt.label}</button>`;
 		}).join("");
 	}
 
@@ -655,7 +658,6 @@ export class CustomNodesManager {
 	}
 
 	renderGrid() {
-
 		// update theme
 		const globalStyle = window.getComputedStyle(document.body);
 		this.colorVars = {
@@ -1528,7 +1530,16 @@ export class CustomNodesManager {
 				errorMsg = `'${item.title}': `;
 
 				if(res.status == 403) {
-					errorMsg += `This action is not allowed with this security level configuration.\n`;
+					try {
+						const data = await res.json();
+						if(data.error === 'comfyui_outdated') {
+							errorMsg += `ComfyUI version is outdated. Please update ComfyUI to use Manager normally.\n`;
+						} else {
+							errorMsg += `This action is not allowed with this security level configuration.\n`;
+						}
+					} catch {
+						errorMsg += `This action is not allowed with this security level configuration.\n`;
+					}
 				} else if(res.status == 404) {
 					errorMsg += `With the current security level configuration, only custom nodes from the <B>"default channel"</B> can be installed.\n`;
 				} else {

js/model-manager.css

@@ -1,13 +1,15 @@
 .cmm-manager {
 	--grid-font: -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji";
 	z-index: 1099;
-	width: 80%;
-	height: 80%;
+	width: 80vw;
+	height: 75vh;
+	min-height: 30em;
 	display: flex;
 	flex-direction: column;
 	gap: 10px;
 	color: var(--fg-color);
 	font-family: arial, sans-serif;
+	margin: calc(var(--spacing)*2);
 }
 
 .cmm-manager .cmm-flex-auto {
@@ -18,14 +20,15 @@
 	font-size: 16px;
 	color: var(--input-text);
     background-color: var(--comfy-input-bg);
-    border-radius: 8px;
     border-color: var(--border-color);
-    border-style: solid;
     margin: 0;
-	padding: 4px 8px;
 	min-width: 100px;
 }
 
+.cmm-manager button:hover {
+	filter: brightness(125%);
+}
+
 .cmm-manager button:disabled,
 .cmm-manager input:disabled,
 .cmm-manager select:disabled {
@@ -38,7 +41,7 @@
 
 .cmm-manager .cmm-manager-refresh {
 	display: none;
-	background-color: #000080;
+	background-color: #000080 !important;
 	color: white;
 }
 
@@ -53,7 +56,6 @@
 	flex-wrap: wrap;
 	gap: 5px;
 	align-items: center;
-	padding: 0 5px;
 }
 
 .cmm-manager-header label {
@@ -67,16 +69,34 @@
 .cmm-manager-filter {
 	height: 28px;
 	line-height: 28px;
+
+	cursor: pointer;
+	padding: 0.5em 0.5em;
+	border: 1px solid var(--border-color);
+	border-radius: 6px;
+	background: var(--comfy-input-bg);
+}
+
+.cmm-manager-type:hover,
+.cmm-manager-base:hover,
+.cmm-manager-filter:hover {
+	filter: brightness(125%);
 }
 
 .cmm-manager-keywords {
 	height: 28px;
 	line-height: 28px;
 	padding: 0 5px 0 26px;
+	background: var(--comfy-input-bg);
 	background-size: 16px;
 	background-position: 5px center;
 	background-repeat: no-repeat;
 	background-image: url("data:image/svg+xml;charset=utf8,%3Csvg%20viewBox%3D%220%200%2024%2024%22%20width%3D%22100%25%22%20height%3D%22100%25%22%20pointer-events%3D%22none%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cpath%20fill%3D%22none%22%20stroke%3D%22%23888%22%20stroke-linecap%3D%22round%22%20stroke-linejoin%3D%22round%22%20stroke-width%3D%222%22%20d%3D%22m21%2021-4.486-4.494M19%2010.5a8.5%208.5%200%201%201-17%200%208.5%208.5%200%200%201%2017%200%22%2F%3E%3C%2Fsvg%3E");
+
+	border: 1px solid var(--border-color);
+	border-radius: 6px;
+
+	outline-color: transparent;
 }
 
 .cmm-manager-status {
@@ -148,6 +168,10 @@
 	color: white;
 }
 
+.cmm-btn-install {
+	padding: 4px 8px;
+}
+
 .cmm-btn-download {
 	width: 18px;
 	height: 18px;

js/model-manager.js

@@ -1,47 +1,30 @@
 import { app } from "../../scripts/app.js";
 import { $el } from "../../scripts/ui.js";
-import { 
-	manager_instance, rebootAPI, 
+import {
+	manager_instance, rebootAPI,
 	fetchData, md5, icons, show_message, customAlert, infoToast, showTerminal,
-	storeColumnWidth, restoreColumnWidth, loadCss
+	storeColumnWidth, restoreColumnWidth, loadCss, handle403Response
 } from  "./common.js";
 import { api } from "../../scripts/api.js";
 
 // https://cenfun.github.io/turbogrid/api.html
 import TG from "./turbogrid.esm.js";
+import { buildGuiFrameCustomHeader,  createSettingsCombo } from "./comfyui-gui-builder.js";
 
 loadCss("./model-manager.css");
 
 const gridId = "model";
 
 const pageHtml = `
-<div class="cmm-manager-header">
-	<label>Filter
-		<select class="cmm-manager-filter"></select>
-	</label>
-	<label>Type
-		<select class="cmm-manager-type"></select>
-	</label>
-	<label>Base
-		<select class="cmm-manager-base"></select>
-	</label>
-	<input class="cmm-manager-keywords" type="search" placeholder="Search" />
-	<div class="cmm-manager-status"></div>
-	<div class="cmm-flex-auto"></div>
-</div>
-<div class="cmm-manager-grid"></div>
-<div class="cmm-manager-selection"></div>
-<div class="cmm-manager-message"></div>
-<div class="cmm-manager-footer">
-	<button class="cmm-manager-back">
-		<svg class="arrow-icon" width="14" height="14" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
-			<path d="M2 8H18M2 8L8 2M2 8L8 14" stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-		</svg>
-		Back
-	</button>
-	<button class="cmm-manager-refresh">Refresh</button>
-	<button class="cmm-manager-stop">Stop</button>
-	<div class="cmm-flex-auto"></div>
+<div class="cmm-manager cmm-manager-dark">
+	<div class="cmm-manager-grid"></div>
+	<div class="cmm-manager-selection"></div>
+	<div class="cmm-manager-message"></div>
+	<div class="cmm-manager-footer">
+		<button class="cmm-manager-refresh p-button p-component">Refresh</button>
+		<button class="cmm-manager-stop p-button p-component">Stop</button>
+		<div class="cmm-flex-auto"></div>
+	</div>
 </div>
 `;
 
@@ -64,11 +47,23 @@ export class ModelManager {
 	}
 
 	init() {
-		this.element = $el("div", {
-			parent: document.body,
-			className: "comfy-modal cmm-manager"
-		});
-		this.element.innerHTML = pageHtml;
+		const header = $el("div.cmm-manager-header", {}, [
+			createSettingsCombo("Filter", $el("select.cmm-manager-filter")),
+			createSettingsCombo("Type", $el("select.cmm-manager-type")),
+			createSettingsCombo("Base", $el("select.cmm-manager-base")),
+			$el("input.cmm-manager-keywords.p-inputtext.p-component", { type: "search", placeholder: "Search" }),
+			$el("div.cmm-manager-status"),
+			$el("div.cmm-flex-auto")
+		]);
+
+		const frame = buildGuiFrameCustomHeader(
+			'cmm-manager-dialog', // dialog id
+			header, // custom header element
+			pageHtml, // dialog content element
+			this
+		);	// send this so we can attach close functions
+
+		this.element = frame;
 		this.initFilter();
 		this.bindEvents();
 		this.initGrid();
@@ -347,7 +342,7 @@ export class ModelManager {
 				if (installed === "True") {
 					return `<div class="cmm-icon-passed">${icons.passed}</div>`;
 				}
-				return `<button class="cmm-btn-install" mode="install">Install</button>`;
+				return `<button class="cmm-btn-install p-button p-component" mode="install">Install</button>`;
 			}
 		}, {
 			id: 'url',
@@ -420,7 +415,7 @@ export class ModelManager {
 		}
 
 		this.selectedModels = selectedList;
-		this.showSelection(`<span>Selected <b>${selectedList.length}</b> models <button class="cmm-btn-install" mode="install">Install</button>`);
+		this.showSelection(`<span>Selected <b>${selectedList.length}</b> models <button class="cmm-btn-install p-button p-component" mode="install">Install</button>`);
 	}
 
 	focusInstall(item) {
@@ -477,7 +472,16 @@ export class ModelManager {
 				errorMsg = `'${item.name}': `;
 
 				if(res.status == 403) {
-					errorMsg += `This action is not allowed with this security level configuration.\n`;
+					try {
+						const data = await res.json();
+						if(data.error === 'comfyui_outdated') {
+							errorMsg += `ComfyUI version is outdated. Please update ComfyUI to use Manager normally.\n`;
+						} else {
+							errorMsg += `This action is not allowed with this security level configuration.\n`;
+						}
+					} catch {
+						errorMsg += `This action is not allowed with this security level configuration.\n`;
+					}
 				} else {
 					errorMsg += await res.text() + '\n';
 				}

js/snapshot.css

@@ -0,0 +1,65 @@
+.snapshot-manager {
+	--grid-font: -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji";
+	z-index: 1099;
+	width: 80vw;
+	height: 75vh;
+	min-height: 30em;
+	display: flex;
+	flex-direction: column;
+	gap: 10px;
+	color: var(--fg-color);
+	font-family: arial, sans-serif;
+	text-underline-offset: 3px;
+	outline: none;
+	margin: calc(var(--spacing)*2);
+}
+
+.snapshot-manager button {
+	width: auto;
+	position: relative;
+	overflow: hidden;
+	font-size: 16px;
+	color: var(--input-text);
+	background-color: var(--comfy-input-bg);
+	border-color: var(--border-color);
+	margin: 0;
+	min-width: 100px;
+	padding: 4px 8px;
+}
+
+.snapshot-manager .snapshot-restore-btn {
+	background-color: #00158f !important;
+	border-color: #2025b9 !important;
+	color: white !important;
+}
+
+.snapshot-manager .snapshot-remove-btn  {
+	background-color: #970000 !important;
+	border-color: #be2127 !important;
+	color: white !important;
+}
+
+.snapshot-manager button:hover {
+	filter: brightness(125%);
+}
+
+.snapshot-manager .data-btns {
+	display: flex;
+	flex-direction: column;
+	gap: calc(var(--spacing)*2);
+	padding: calc(var(--spacing)*2);
+	align-items: center;
+	justify-content: center;
+	height: 100%;
+}
+
+.snapshot-footer {
+	display: flex;
+	flex-wrap: wrap;
+	gap: 10px;
+	align-items: center;
+}
+
+.snapshot-manager .cn-flex-auto {
+	flex: auto;
+}

js/snapshot.js

@@ -1,8 +1,10 @@
 import { app } from "../../scripts/app.js";
 import { api } from "../../scripts/api.js"
 import { ComfyDialog, $el } from "../../scripts/ui.js";
-import { manager_instance, rebootAPI, show_message } from  "./common.js";
+import { manager_instance, rebootAPI, show_message, handle403Response, loadCss } from  "./common.js";
+import { buildGuiFrame } from "./comfyui-gui-builder.js";
 
+loadCss("./snapshot.css");
 
 async function restore_snapshot(target) {
 	if(SnapshotManager.instance) {
@@ -10,7 +12,7 @@ async function restore_snapshot(target) {
 			const response = await api.fetchApi(`/snapshot/restore?target=${target}`, { cache: "no-store" });
 
 			if(response.status == 403) {
-				show_message('This action is not allowed with this security level configuration.');
+				await handle403Response(response);
 				return false;
 			}
 
@@ -27,7 +29,7 @@ async function restore_snapshot(target) {
 		}
 		finally {
 			await SnapshotManager.instance.invalidateControl();
-			SnapshotManager.instance.updateMessage("<BR>To apply the snapshot, please <button id='cm-reboot-button2' class='cm-small-button'>RESTART</button> ComfyUI. And refresh browser.", 'cm-reboot-button2');
+			SnapshotManager.instance.updateMessage("<BR>To apply the snapshot, please <button id='cm-reboot-button2' class='p-button p-component'>RESTART</button> ComfyUI. And refresh browser.", 'cm-reboot-button2');
 		}
 	}
 }
@@ -38,7 +40,7 @@ async function remove_snapshot(target) {
 			const response = await api.fetchApi(`/snapshot/remove?target=${target}`, { cache: "no-store" });
 
 			if(response.status == 403) {
-				show_message('This action is not allowed with this security level configuration.');
+				await handle403Response(response);
 				return false;
 			}
 
@@ -88,6 +90,8 @@ export class SnapshotManager extends ComfyDialog {
 	message_box = null;
 	data = null;
 
+	content = $el("div.snapshot-manager");
+
 	clear() {
 		this.restore_buttons = [];
 		this.message_box = null;
@@ -96,9 +100,18 @@ export class SnapshotManager extends ComfyDialog {
 
 	constructor(app, manager_dialog) {
 		super();
-		this.manager_dialog = manager_dialog;
+		// this.manager_dialog = manager_dialog;
 		this.search_keyword = '';
-		this.element = $el("div.comfy-modal", { parent: document.body }, []);
+
+		const frame = buildGuiFrame(
+			'snapshot-manager-dialog', // dialog id
+			'Snapshot Manager', // title
+			'i.mdi.mdi-puzzle', // icon class
+			this.content, // dialog content element
+			this
+		);	// send this so we can attach close functions
+
+		this.element = frame;
 	}
 
 	async remove_item() {
@@ -109,7 +122,7 @@ export class SnapshotManager extends ComfyDialog {
 
 	createControls() {
 		return [
-			$el("button.cm-small-button", {
+			$el("button.p-button.p-component", {
 				type: "button",
 				textContent: "Close",
 				onclick: () => { this.close(); }
@@ -132,8 +145,8 @@ export class SnapshotManager extends ComfyDialog {
 		this.clear();
 		this.data = (await getSnapshotList()).items;
 
-		while (this.element.children.length) {
-			this.element.removeChild(this.element.children[0]);
+		while (this.content.children.length) {
+			this.content.removeChild(this.content.children[0]);
 		}
 
 		await this.createGrid();
@@ -145,8 +158,8 @@ export class SnapshotManager extends ComfyDialog {
 		if(btn_id) {
 			const rebootButton = document.getElementById(btn_id);
 			const self = this;
-			rebootButton.onclick = function() {
-				if(rebootAPI()) {
+			rebootButton.onclick = async function() {
+				if(await rebootAPI()) {
 					self.close();
 					self.manager_dialog.close();
 				}
@@ -204,20 +217,21 @@ export class SnapshotManager extends ComfyDialog {
 				data2.innerHTML = `&nbsp;${data}`;
 				var data_button = document.createElement('td');
 				data_button.style.textAlign = "center";
+				data_button.className = "data-btns";
 
 				var restoreBtn = document.createElement('button');
+				restoreBtn.className = "snapshot-restore-btn p-button p-component";
 				restoreBtn.innerHTML = 'Restore';
 				restoreBtn.style.width = "100px";
-				restoreBtn.style.backgroundColor = 'blue';
 
 				restoreBtn.addEventListener('click', function() {
 					restore_snapshot(data);
 				});
 
 				var removeBtn = document.createElement('button');
+				removeBtn.className = "snapshot-remove-btn p-button p-component";
 				removeBtn.innerHTML = 'Remove';
 				removeBtn.style.width = "100px";
-				removeBtn.style.backgroundColor = 'red';
 
 				removeBtn.addEventListener('click', function() {
 					remove_snapshot(data);
@@ -241,13 +255,14 @@ export class SnapshotManager extends ComfyDialog {
 		let self = this;
 		const panel = document.createElement('div');
 		panel.style.width = "100%";
+		panel.style.height = "100%";
 		panel.appendChild(grid);
 
 		function handleResize() {
 		  const parentHeight = self.element.clientHeight;
 		  const gridHeight = parentHeight - 200;
 
-		  grid.style.height = gridHeight + "px";
+		//   grid.style.height = gridHeight + "px";
 		}
 		window.addEventListener("resize", handleResize);
 
@@ -256,25 +271,17 @@ export class SnapshotManager extends ComfyDialog {
 		grid.style.width = "100%";
 		grid.style.height = "100%";
 		grid.style.overflowY = "scroll";
-		this.element.style.height = "85%";
-		this.element.style.width = "80%";
-		this.element.appendChild(panel);
+
+		this.content.appendChild(panel);
 
 		handleResize();
 	}
 
 	async createBottomControls() {
-		var close_button = document.createElement("button");
-		close_button.className = "cm-small-button";
-		close_button.innerHTML = "Close";
-		close_button.onclick = () => { this.close(); }
-		close_button.style.display = "inline-block";
-
 		var save_button = document.createElement("button");
-		save_button.className = "cm-small-button";
+		save_button.className = "p-button p-component";
 		save_button.innerHTML = "Save snapshot";
 		save_button.onclick = () => { save_current_snapshot(); }
-		save_button.style.display = "inline-block";
 		save_button.style.horizontalAlign = "right";
 		save_button.style.width = "170px";
 
@@ -282,15 +289,19 @@ export class SnapshotManager extends ComfyDialog {
 		this.message_box.style.height = '60px';
 		this.message_box.style.verticalAlign = 'middle';
 
-		this.element.appendChild(this.message_box);
-		this.element.appendChild(close_button);
-		this.element.appendChild(save_button);
+		const footer = $el("div.snapshot-footer");
+		const spacer = $el("div.cn-flex-auto");
+		footer.appendChild(spacer);
+		footer.appendChild(save_button);
+
+		this.content.appendChild(this.message_box);
+		this.content.appendChild(footer);
 	}
 
 	async show() {
 		try {
 			this.invalidateControl();
-			this.element.style.display = "block";
+			this.element.style.display = "flex";
 			this.element.style.zIndex = 1099;
 		}
 		catch(exception) {

json-checker.py

@@ -1,25 +1,264 @@
-import json
-import argparse
+#!/usr/bin/env python3
+"""JSON Entry Validator
 
-def check_json_syntax(file_path):
+Validates JSON entries based on content structure.
+
+Validation rules based on JSON content:
+- {"custom_nodes": [...]}: Validates required fields (author, title, reference, files, install_type, description)
+- {"models": [...]}: Validates JSON syntax only (no required fields)
+- Other JSON structures: Validates JSON syntax only
+
+Git repository URL validation (for custom_nodes):
+1. URLs must NOT end with .git
+2. URLs must follow format: https://github.com/{author}/{reponame}
+3. .py and .js files are exempt from this check
+
+Supported formats:
+- Array format: [{...}, {...}]
+- Object format: {"custom_nodes": [...]} or {"models": [...]}
+"""
+
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Dict, List, Tuple
+
+
+# Required fields for each entry type
+REQUIRED_FIELDS_CUSTOM_NODE = ['author', 'title', 'reference', 'files', 'install_type', 'description']
+REQUIRED_FIELDS_MODEL = []  # model-list.json doesn't require field validation
+
+# Pattern for valid GitHub repository URL (without .git suffix)
+GITHUB_REPO_PATTERN = re.compile(r'^https://github\.com/[^/]+/[^/]+$')
+
+
+def get_entry_context(entry: Dict) -> str:
+    """Get identifying information from entry for error messages
+
+    Args:
+        entry: JSON entry
+
+    Returns:
+        String with author and reference info
+    """
+    parts = []
+    if 'author' in entry:
+        parts.append(f"author={entry['author']}")
+    if 'reference' in entry:
+        parts.append(f"ref={entry['reference']}")
+    if 'title' in entry:
+        parts.append(f"title={entry['title']}")
+
+    if parts:
+        return " | ".join(parts)
+    else:
+        # No identifying info - show actual entry content (truncated)
+        import json
+        entry_str = json.dumps(entry, ensure_ascii=False)
+        if len(entry_str) > 100:
+            entry_str = entry_str[:100] + "..."
+        return f"content={entry_str}"
+
+
+def validate_required_fields(entry: Dict, entry_index: int, required_fields: List[str]) -> List[str]:
+    """Validate that all required fields are present
+
+    Args:
+        entry: JSON entry to validate
+        entry_index: Index of entry in array (for error reporting)
+        required_fields: List of required field names
+
+    Returns:
+        List of error descriptions (without entry prefix/context)
+    """
+    errors = []
+
+    for field in required_fields:
+        if field not in entry:
+            errors.append(f"Missing required field '{field}'")
+        elif entry[field] is None:
+            errors.append(f"Field '{field}' is null")
+        elif isinstance(entry[field], str) and not entry[field].strip():
+            errors.append(f"Field '{field}' is empty")
+        elif field == 'files' and not entry[field]:  # Empty array
+            errors.append("Field 'files' is empty array")
+
+    return errors
+
+
+def validate_git_repo_urls(entry: Dict, entry_index: int) -> List[str]:
+    """Validate git repository URLs in 'files' array
+
+    Requirements:
+    - Git repo URLs must NOT end with .git
+    - Must follow format: https://github.com/{author}/{reponame}
+    - .py and .js files are exempt
+
+    Args:
+        entry: JSON entry to validate
+        entry_index: Index of entry in array (for error reporting)
+
+    Returns:
+        List of error descriptions (without entry prefix/context)
+    """
+    errors = []
+
+    if 'files' not in entry or not isinstance(entry['files'], list):
+        return errors
+
+    for file_url in entry['files']:
+        if not isinstance(file_url, str):
+            continue
+
+        # Skip .py and .js files - they're exempt from git repo validation
+        if file_url.endswith('.py') or file_url.endswith('.js'):
+            continue
+
+        # Check if it's a GitHub URL (likely a git repo)
+        if 'github.com' in file_url:
+            # Error if URL ends with .git
+            if file_url.endswith('.git'):
+                errors.append(f"Git repo URL must NOT end with .git: {file_url}")
+                continue
+
+            # Validate format: https://github.com/{author}/{reponame}
+            if not GITHUB_REPO_PATTERN.match(file_url):
+                errors.append(f"Invalid git repo URL format (expected https://github.com/author/reponame): {file_url}")
+
+    return errors
+
+
+def validate_entry(entry: Dict, entry_index: int, required_fields: List[str]) -> List[str]:
+    """Validate a single JSON entry
+
+    Args:
+        entry: JSON entry to validate
+        entry_index: Index of entry in array (for error reporting)
+        required_fields: List of required field names
+
+    Returns:
+        List of error messages (empty if valid)
+    """
+    errors = []
+
+    # Check required fields
+    errors.extend(validate_required_fields(entry, entry_index, required_fields))
+
+    # Check git repository URLs
+    errors.extend(validate_git_repo_urls(entry, entry_index))
+
+    return errors
+
+
+def validate_json_file(file_path: str) -> Tuple[bool, List[str]]:
+    """Validate JSON file containing entries
+
+    Args:
+        file_path: Path to JSON file
+
+    Returns:
+        Tuple of (is_valid, error_messages)
+    """
+    errors = []
+
+    # Check file exists
+    path = Path(file_path)
+    if not path.exists():
+        return False, [f"File not found: {file_path}"]
+
+    # Load JSON
     try:
-        with open(file_path, 'r', encoding='utf-8') as file:
-            json_str = file.read()
-            json.loads(json_str)
-            print(f"[ OK ] {file_path}")
-    except UnicodeDecodeError as e:
-        print(f"Unicode decode error: {e}")
+        with open(path, 'r', encoding='utf-8') as f:
+            data = json.load(f)
     except json.JSONDecodeError as e:
-        print(f"[FAIL] {file_path}\n\n       {e}\n")
-    except FileNotFoundError:
-        print(f"[FAIL] {file_path}\n\n       File not found\n")
+        return False, [f"Invalid JSON: {e}"]
+    except Exception as e:
+        return False, [f"Error reading file: {e}"]
+
+    # Determine required fields based on JSON content
+    required_fields = []
+
+    # Validate structure - support both array and object formats
+    entries_to_validate = []
+
+    if isinstance(data, list):
+        # Direct array format: [{...}, {...}]
+        entries_to_validate = data
+    elif isinstance(data, dict):
+        # Object format: {"custom_nodes": [...]} or {"models": [...]}
+        # Determine validation based on keys
+        if 'custom_nodes' in data and isinstance(data['custom_nodes'], list):
+            required_fields = REQUIRED_FIELDS_CUSTOM_NODE
+            entries_to_validate = data['custom_nodes']
+        elif 'models' in data and isinstance(data['models'], list):
+            required_fields = REQUIRED_FIELDS_MODEL
+            entries_to_validate = data['models']
+        else:
+            # Other JSON structures (extension-node-map.json, etc.) - just validate JSON syntax
+            return True, []
+    else:
+        return False, ["JSON root must be either an array or an object containing arrays"]
+
+    # Validate each entry
+    for idx, entry in enumerate(entries_to_validate, start=1):
+        if not isinstance(entry, dict):
+            # Show actual value for type errors
+            entry_str = json.dumps(entry, ensure_ascii=False) if not isinstance(entry, str) else repr(entry)
+            if len(entry_str) > 150:
+                entry_str = entry_str[:150] + "..."
+            errors.append(f"\n❌ Entry #{idx}: Must be an object, got {type(entry).__name__}")
+            errors.append(f"   Actual value: {entry_str}")
+            continue
+
+        entry_errors = validate_entry(entry, idx, required_fields)
+        if entry_errors:
+            # Group errors by entry with context
+            context = get_entry_context(entry)
+            errors.append(f"\n❌ Entry #{idx} ({context}):")
+            for error in entry_errors:
+                errors.append(f"   - {error}")
+
+    is_valid = len(errors) == 0
+    return is_valid, errors
+
 
 def main():
-    parser = argparse.ArgumentParser(description="JSON File Syntax Checker")
-    parser.add_argument("file_path", type=str, help="Path to the JSON file for syntax checking")
+    """Main entry point"""
+    if len(sys.argv) < 2:
+        print("Usage: python json-checker.py <json-file>")
+        print("\nValidates JSON entries based on content:")
+        print("  - {\"custom_nodes\": [...]}: Validates required fields (author, title, reference, files, install_type, description)")
+        print("  - {\"models\": [...]}: Validates JSON syntax only (no required fields)")
+        print("  - Other JSON structures: Validates JSON syntax only")
+        print("\nGit repo URL validation (for custom_nodes):")
+        print("  - URLs must NOT end with .git")
+        print("  - URLs must follow: https://github.com/{author}/{reponame}")
+        sys.exit(1)
 
-    args = parser.parse_args()
-    check_json_syntax(args.file_path)
+    file_path = sys.argv[1]
 
-if __name__ == "__main__":
+    is_valid, errors = validate_json_file(file_path)
+
+    if is_valid:
+        print(f"✅ {file_path}: Validation passed")
+        sys.exit(0)
+    else:
+        print(f"Validating: {file_path}")
+        print("=" * 60)
+        print("❌ Validation failed!\n")
+        print("Errors:")
+        # Count actual errors (lines starting with "   -")
+        error_count = sum(1 for e in errors if e.strip().startswith('-'))
+        for error in errors:
+            # Don't add ❌ prefix to grouped entries (they already have it)
+            if error.strip().startswith('❌'):
+                print(error)
+            else:
+                print(error)
+        print(f"\nTotal errors: {error_count}")
+        sys.exit(1)
+
+
+if __name__ == '__main__':
     main()

model-list.json

@@ -5180,6 +5180,204 @@
       "size": "25.75GB"
     },
 
+    {
+      "name": "LTX-2 19B Dev FP8",
+      "type": "checkpoint",
+      "base": "LTX-2",
+      "save_path": "checkpoints/LTX-2",
+      "description": "LTX-2 19B Dev FP8 model.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2",
+      "filename": "ltx-2-19b-dev-fp8.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2/resolve/main/ltx-2-19b-dev-fp8.safetensors",
+      "size": "27.1GB"
+    },
+    {
+      "name": "LTX-2 19B Distilled FP8",
+      "type": "checkpoint",
+      "base": "LTX-2",
+      "save_path": "checkpoints/LTX-2",
+      "description": "LTX-2 19B Distilled FP8 model.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2",
+      "filename": "ltx-2-19b-distilled-fp8.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2/resolve/main/ltx-2-19b-distilled-fp8.safetensors",
+      "size": "27.1GB"
+    },
+    {
+      "name": "LTX-2 19B Dev",
+      "type": "checkpoint",
+      "base": "LTX-2",
+      "save_path": "checkpoints/LTX-2",
+      "description": "LTX-2 19B Dev model.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2",
+      "filename": "ltx-2-19b-dev.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2/resolve/main/ltx-2-19b-dev.safetensors",
+      "size": "43.3GB"
+    },
+    {
+      "name": "LTX-2 19B Distilled",
+      "type": "checkpoint",
+      "base": "LTX-2",
+      "save_path": "checkpoints/LTX-2",
+      "description": "LTX-2 19B Distilled model.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2",
+      "filename": "ltx-2-19b-distilled.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2/resolve/main/ltx-2-19b-distilled.safetensors",
+      "size": "43.3GB"
+    },
+    {
+      "name": "LTX-2 Spatial Upscaler",
+      "type": "upscale",
+      "base": "upscale",
+      "save_path": "default",
+      "description": "Spatial upscaler model for LTX-2. This model enhances the spatial resolution of generated videos.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2",
+      "filename": "ltx-2-spatial-upscaler-x2-1.0.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2/resolve/main/ltx-2-spatial-upscaler-x2-1.0.safetensors",
+      "size": "996MB"
+    },
+    {
+      "name": "LTX-2 Temporal Upscaler",
+      "type": "upscale",
+      "base": "upscale",
+      "save_path": "default",
+      "description": "Temporal upscaler model for LTX-2. This model enhances the temporal resolution of generated videos.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2",
+      "filename": "ltx-2-temporal-upscaler-x2-1.0.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2/resolve/main/ltx-2-temporal-upscaler-x2-1.0.safetensors",
+      "size": "262MB"
+    },
+    {
+      "name": "LTX-2 19B Distilled LoRA",
+      "type": "lora",
+      "base": "LTX-2",
+      "save_path": "loras",
+      "description": "A LoRA adapter that transforms the standard LTX-2 19B model into a distilled version when loaded.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2",
+      "filename": "ltx-2-19b-distilled-lora-384.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2/resolve/main/ltx-2-19b-distilled-lora-384.safetensors",
+      "size": "7.67GB"
+    },
+    {
+      "name": "LTX-2 19B IC LoRA - Canny Control",
+      "type": "lora",
+      "base": "LTX-2",
+      "save_path": "loras/LTX-2",
+      "description": "LoRA for canny control on LTX-2 19B IC model. Intended for advanced edge control and guided generation.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2-19b-IC-LoRA-Canny-Control",
+      "filename": "ltx-2-19b-ic-lora-canny-control.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2-19b-IC-LoRA-Canny-Control/resolve/main/ltx-2-19b-ic-lora-canny-control.safetensors",
+      "size": "654MB"
+    },
+    {
+      "name": "LTX-2 19B IC LoRA - Depth Control",
+      "type": "lora",
+      "base": "LTX-2",
+      "save_path": "loras/LTX-2",
+      "description": "LoRA for depth control on LTX-2 19B IC model. Adds depth-aware generation guidance.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2-19b-IC-LoRA-Depth-Control",
+      "filename": "ltx-2-19b-ic-lora-depth-control.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2-19b-IC-LoRA-Depth-Control/resolve/main/ltx-2-19b-ic-lora-depth-control.safetensors",
+      "size": "654MB"
+    },
+    {
+      "name": "LTX-2 19B IC LoRA - Detailer",
+      "type": "lora",
+      "base": "LTX-2",
+      "save_path": "loras/LTX-2",
+      "description": "LoRA detailer for LTX-2 19B IC. Improves fine details and sharpness in generated outputs.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2-19b-IC-LoRA-Detailer",
+      "filename": "ltx-2-19b-ic-lora-detailer.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2-19b-IC-LoRA-Detailer/resolve/main/ltx-2-19b-ic-lora-detailer.safetensors",
+      "size": "2.62GB"
+    },
+    {
+      "name": "LTX-2 19B IC LoRA - Pose Control",
+      "type": "lora",
+      "base": "LTX-2",
+      "save_path": "loras/LTX-2",
+      "description": "LoRA for pose control on LTX-2 19B IC model. Enables pose-guided image/video generation.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2-19b-IC-LoRA-Pose-Control",
+      "filename": "ltx-2-19b-ic-lora-pose-control.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2-19b-IC-LoRA-Pose-Control/resolve/main/ltx-2-19b-ic-lora-pose-control.safetensors",
+      "size": "654MB"
+    },
+    {
+      "name": "LTX-2 19B LoRA - Camera Control Dolly In",
+      "type": "lora",
+      "base": "LTX-2",
+      "save_path": "loras/LTX-2",
+      "description": "LoRA for dolly-in camera control with LTX-2 19B. Simulates camera moving closer to subject.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2-19b-LoRA-Camera-Control-Dolly-In",
+      "filename": "ltx-2-19b-lora-camera-control-dolly-in.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2-19b-LoRA-Camera-Control-Dolly-In/resolve/main/ltx-2-19b-lora-camera-control-dolly-in.safetensors",
+      "size": "327MB"
+    },
+    {
+      "name": "LTX-2 19B LoRA - Camera Control Dolly Left",
+      "type": "lora",
+      "base": "LTX-2",
+      "save_path": "loras/LTX-2",
+      "description": "LoRA for dolly-left camera control with LTX-2 19B. Simulates camera moving left.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2-19b-LoRA-Camera-Control-Dolly-Left",
+      "filename": "ltx-2-19b-lora-camera-control-dolly-left.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2-19b-LoRA-Camera-Control-Dolly-Left/resolve/main/ltx-2-19b-lora-camera-control-dolly-left.safetensors",
+      "size": "327MB"
+    },
+    {
+      "name": "LTX-2 19B LoRA - Camera Control Dolly Out",
+      "type": "lora",
+      "base": "LTX-2",
+      "save_path": "loras/LTX-2",
+      "description": "LoRA for dolly-out camera control with LTX-2 19B. Simulates camera moving away from subject.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2-19b-LoRA-Camera-Control-Dolly-Out",
+      "filename": "ltx-2-19b-lora-camera-control-dolly-out.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2-19b-LoRA-Camera-Control-Dolly-Out/resolve/main/ltx-2-19b-lora-camera-control-dolly-out.safetensors",
+      "size": "327MB"
+    },
+    {
+      "name": "LTX-2 19B LoRA - Camera Control Dolly Right",
+      "type": "lora",
+      "base": "LTX-2",
+      "save_path": "loras/LTX-2",
+      "description": "LoRA for dolly-right camera control with LTX-2 19B. Simulates camera moving right.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2-19b-LoRA-Camera-Control-Dolly-Right",
+      "filename": "ltx-2-19b-lora-camera-control-dolly-right.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2-19b-LoRA-Camera-Control-Dolly-Right/resolve/main/ltx-2-19b-lora-camera-control-dolly-right.safetensors",
+      "size": "327MB"
+    },
+    {
+      "name": "LTX-2 19B LoRA - Camera Control Jib Down",
+      "type": "lora",
+      "base": "LTX-2",
+      "save_path": "loras/LTX-2",
+      "description": "LoRA for jib-down camera control with LTX-2 19B. Simulates vertical camera movement downwards.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2-19b-LoRA-Camera-Control-Jib-Down",
+      "filename": "ltx-2-19b-lora-camera-control-jib-down.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2-19b-LoRA-Camera-Control-Jib-Down/resolve/main/ltx-2-19b-lora-camera-control-jib-down.safetensors",
+      "size": "2.21GB"
+    },
+    {
+      "name": "LTX-2 19B LoRA - Camera Control Jib Up",
+      "type": "lora",
+      "base": "LTX-2",
+      "save_path": "loras/LTX-2",
+      "description": "LoRA for jib-up camera control with LTX-2 19B. Simulates vertical camera movement upwards.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2-19b-LoRA-Camera-Control-Jib-Up",
+      "filename": "ltx-2-19b-lora-camera-control-jib-up.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2-19b-LoRA-Camera-Control-Jib-Up/resolve/main/ltx-2-19b-lora-camera-control-jib-up.safetensors",
+      "size": "2.21GB"
+    },
+    {
+      "name": "LTX-2 19B LoRA - Camera Control Static",
+      "type": "lora",
+      "base": "LTX-2",
+      "save_path": "loras/LTX-2",
+      "description": "LoRA for static camera control with LTX-2 19B. Simulates stationary/static camera view.",
+      "reference": "https://huggingface.co/Lightricks/LTX-2-19b-LoRA-Camera-Control-Static",
+      "filename": "ltx-2-19b-lora-camera-control-static.safetensors",
+      "url": "https://huggingface.co/Lightricks/LTX-2-19b-LoRA-Camera-Control-Static/resolve/main/ltx-2-19b-lora-camera-control-static.safetensors",
+      "size": "2.21GB"
+    },
     {
       "name": "LTX-Video Spatial Upscaler v0.9.7",
       "type": "upscale",

node_db/forked/custom-node-list.json

@@ -1,5 +1,15 @@
 {
     "custom_nodes": [
+        {
+            "author": "Fossiel",
+            "title": "ComfyUI-MultiGPU-Patched",
+            "reference": "https://github.com/Fossiel/ComfyUI-MultiGPU-Patched",
+            "files": [
+                "https://github.com/Fossiel/ComfyUI-MultiGPU-Patched"
+            ],
+            "install_type": "git-clone",
+            "description": "Patched fork of ComfyUI-MultiGPU providing universal .safetensors and GGUF multi-GPU distribution with DisTorch 2.0 engine, model-driven allocation options (bytes/ratio modes), WanVideoWrapper integration, and up to 10% faster GGUF inference. (Description by CC)"
+        },        
         {
             "author": "synchronicity-labs",
             "title": "ComfyUI Sync Lipsync Node",
@@ -169,6 +179,16 @@
             ],
             "install_type": "git-clone",
             "description": "A fork of KJNodes for ComfyUI.\nVarious quality of life -nodes for ComfyUI, mostly just visual stuff to improve usability"
+        },
+        {
+            "author": "huixingyun",
+            "title": "ComfyUI-SoundFlow",
+            "reference": "https://github.com/huixingyun/ComfyUI-SoundFlow",
+            "files": [
+                "https://github.com/huixingyun/ComfyUI-SoundFlow"
+            ],
+            "install_type": "git-clone",
+            "description": "forked from https://github.com/fredconex/ComfyUI-SoundFlow (removed)"
         }
     ]
 }

node_db/tutorial/custom-node-list.json

@@ -371,6 +371,16 @@
             ],
             "install_type": "git-clone",
             "description": "Complete ComfyUI development toolkit with 8 professional nodes including VAE tools, universal type testing, and comprehensive debugging infrastructure."
-        }
+        },
+        {
+            "author": "ganlvtech",
+            "title": "ComfyUI-CustomModelPatcher",
+            "reference": "https://github.com/ganlvtech/ComfyUI-CustomModelPatcher",
+            "files": [
+                "https://github.com/ganlvtech/ComfyUI-CustomModelPatcher"
+            ],
+            "install_type": "git-clone",
+            "description": "Demonstrates GPU memory management techniques for external models like onnxruntime and InsightFace in ComfyUI by pre-allocating VRAM. (Description by CC)"
+        }        
     ]
 }

prestartup_script.py

@@ -85,7 +85,15 @@ cm_global.register_api('cm.is_import_failed_extension', is_import_failed_extensi
 comfyui_manager_path = os.path.abspath(os.path.dirname(__file__))
 
 custom_nodes_base_path = folder_paths.get_folder_paths('custom_nodes')[0]
-manager_files_path = os.path.abspath(os.path.join(folder_paths.get_user_directory(), 'default', 'ComfyUI-Manager'))
+
+# Check for System User API availability (PR #10966)
+_has_system_user_api = hasattr(folder_paths, 'get_system_user_directory')
+
+if _has_system_user_api:
+    manager_files_path = os.path.abspath(os.path.join(folder_paths.get_user_directory(), '__manager'))
+else:
+    manager_files_path = os.path.abspath(os.path.join(folder_paths.get_user_directory(), 'default', 'ComfyUI-Manager'))
+
 manager_pip_overrides_path = os.path.join(manager_files_path, "pip_overrides.json")
 manager_pip_blacklist_path = os.path.join(manager_files_path, "pip_blacklist.list")
 restore_snapshot_path = os.path.join(manager_files_path, "startup-scripts", "restore-snapshot.json")
@@ -362,10 +370,13 @@ try:
                 pass
 
             with std_log_lock:
-                if self.is_stdout:
-                    original_stdout.flush()
-                else:
-                    original_stderr.flush()
+                try:
+                    if self.is_stdout:
+                        original_stdout.flush()
+                    else:
+                        original_stderr.flush()
+                except (OSError, ValueError):
+                    pass
 
         def close(self):
             self.flush()
@@ -516,7 +527,8 @@ check_bypass_ssl()
 
 # Perform install
 processed_install = set()
-script_list_path = os.path.join(folder_paths.user_directory, "default", "ComfyUI-Manager", "startup-scripts", "install-scripts.txt")
+# Use manager_files_path for consistency (fixes path inconsistency bug)
+script_list_path = os.path.join(manager_files_path, "startup-scripts", "install-scripts.txt")
 pip_fixer = manager_util.PIPFixer(manager_util.get_installed_packages(), comfy_path, manager_files_path)
 
 
@@ -793,7 +805,11 @@ def execute_startup_script():
 
 
 # Check if script_list_path exists
-if os.path.exists(script_list_path):
+# Block startup-scripts on old ComfyUI (security measure)
+if not _has_system_user_api:
+    if os.path.exists(script_list_path):
+        print("[ComfyUI-Manager] Startup scripts blocked on old ComfyUI version.")
+elif os.path.exists(script_list_path):
     execute_startup_script()
 
 

pyproject.toml

@@ -1,13 +1,13 @@
 [project]
 name = "comfyui-manager"
 description = "ComfyUI-Manager provides features to install and manage custom nodes for ComfyUI, as well as various functionalities to assist with ComfyUI."
-version = "3.37"
+version = "3.39.3"
 license = { file = "LICENSE.txt" }
 dependencies = ["GitPython", "PyGithub", "matrix-nio", "transformers", "huggingface-hub>0.20", "typer", "rich", "typing-extensions", "toml", "uv", "chardet"]
 
 [project.urls]
 Repository = "https://github.com/ltdrdata/ComfyUI-Manager"
-#  Used by Comfy Registry https://comfyregistry.org
+#  Used by Comfy Registry https://registry.comfy.org
 
 [tool.comfy]
 PublisherId = "drltdata"

scripts/install-comfyui-venv-linux.sh

@@ -4,7 +4,7 @@ git clone https://github.com/ltdrdata/ComfyUI-Manager comfyui-manager
 cd ..
 python -m venv venv
 source venv/bin/activate
-python -m pip install torch torchvision torchaudio --extra-index-url https://download.pytorch.org/whl/cu121
+python -m pip install torch torchvision torchaudio --extra-index-url https://download.pytorch.org/whl/cu130
 python -m pip install -r requirements.txt
 python -m pip install -r custom_nodes/comfyui-manager/requirements.txt
 cd ..

scripts/install-comfyui-venv-win.bat

@@ -4,7 +4,7 @@ git clone https://github.com/ltdrdata/ComfyUI-Manager comfyui-manager
 cd ..
 python -m venv venv
 call venv/Scripts/activate
-python -m pip install torch torchvision torchaudio --extra-index-url https://download.pytorch.org/whl/cu121
+python -m pip install torch torchvision torchaudio --extra-index-url https://download.pytorch.org/whl/cu130
 python -m pip install -r requirements.txt
 python -m pip install -r custom_nodes/comfyui-manager/requirements.txt
 cd ..