- is_civitai_url also refuses URLs with userinfo or a non-443 port, so
https://evil.com\@civitai.com/x and https://civitai.com:8443/x are rejected.
- resolve_lora_manager_path / custom_nodes_directories: lora/enable and
lora/scan only accept a LoraManager directory that is a direct child of
ComfyUI's custom_nodes (folder_paths base_path or registered custom_nodes
folders, else this package's parent) and whose name contains "lora",
compared via realpath+normcase; relative public paths resolve against the
API path anchors. Anything else is 400, so find_lora_directories can no
longer widen the image allow-list with arbitrary trees.
- lora/enable persists through PromptManagerConfig.save_to_file(), which
honours PROMPT_MANAGER_CONFIG_PATH, instead of a hard-coded config.json.
- detect/status/enable return path and detected_path through _public_path;
every lora handler reports exceptions via _public_error, and lora/scan
errors raised after the SSE stream opened become an error event.
- Tests close the database before unlinking it.
Vito Sansevero