From 12b48b246cbd74daafdb1a105f78de613da07ace Mon Sep 17 00:00:00 2001
From: Vito Sansevero <vito.sansevero@gmail.com>
Date: Tue, 27 Oct 2026 00:45:26 -0700
Subject: [PATCH] fix(diagnostics): match the bare home folder name only inside
 paths

A home folder named like a word (/home/info) no longer removes the log
level INFO from the report; the name still goes when it is a part of a
path. Documents the accepted residual risk of another user's home. (#329)
---
 py/api/diagnostics_report.py         | 27 ++++++++++++++++++++-------
 tests/test_api_diagnostics_report.py |  7 +++++++
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/py/api/diagnostics_report.py b/py/api/diagnostics_report.py
index 7e70fa4..dc2de83 100644
--- a/py/api/diagnostics_report.py
+++ b/py/api/diagnostics_report.py
@@ -113,7 +113,12 @@ MIN_HOME_NAME = 3
 
 
 def _home_patterns():
-    """Patterns for the home folder: in full, without its root, and its name."""
+    """``(pattern, paths_only)`` for the home folder: in full, rootless, its name.
+
+    Accepted residual risk: only this process's own home folder is known, so
+    another user's home (an output folder under /home/<them> while ComfyUI
+    runs as a service account) can still be named by a report path.
+    """
     home = os.path.expanduser("~")
     if not home or home == "~" or len(home) < 4 or home in ("/", "\\"):
         return ()
@@ -122,13 +127,17 @@ def _home_patterns():
     for spelling in (relative, relative.replace("\\", "/")):
         if "/" in spelling or "\\" in spelling:
             spellings.add(spelling)
+    patterns = [
+        (re.compile(_PART.format(re.escape(spelling)), re.IGNORECASE), False)
+        for spelling in spellings
+    ]
     name = re.split(r"[\\/]", relative)[-1] if relative else ""
     if len(name) >= MIN_HOME_NAME:
-        spellings.add(name)
-    return tuple(
-        re.compile(_PART.format(re.escape(spelling)), re.IGNORECASE)
-        for spelling in spellings
-    )
+        # The bare name only inside a path ("info/x"), not a word ("INFO").
+        patterns.append(
+            (re.compile(_PART.format(re.escape(name)), re.IGNORECASE), True)
+        )
+    return tuple(patterns)
 
 
 def scrub(report, key):
@@ -143,7 +152,11 @@ def scrub(report, key):
             if (
                 _looks_absolute(value)
                 or (key and key in value)
-                or any(home.search(value) for home in homes)
+                or any(
+                    pattern.search(value)
+                    for pattern, paths_only in homes
+                    if not paths_only or "/" in value or "\\" in value
+                )
             ):
                 count += 1
                 return REMOVED
diff --git a/tests/test_api_diagnostics_report.py b/tests/test_api_diagnostics_report.py
index 41fdb90..f1422db 100644
--- a/tests/test_api_diagnostics_report.py
+++ b/tests/test_api_diagnostics_report.py
@@ -300,6 +300,13 @@ class TestReport(DiagnosticsReportTestCase):
             "output",
         )
 
+    def test_the_home_folder_name_is_removed_only_from_paths(self):
+        with mock.patch.object(
+            diagnostics_report.os.path, "expanduser", return_value="/home/info"
+        ):
+            cleaned = scrub({"level": "INFO", "p": "logs/info/x", "redacted": 0}, None)
+        self.assertEqual(cleaned, {"level": "INFO", "p": "[removed]", "redacted": 1})
+
     def test_scrub_removes_the_home_folder_name(self):
         with mock.patch.object(
             diagnostics_report.os.path, "expanduser", return_value="/home/someone"