fix(lora): check the file Show in folder would open under a LoRA root (#355)

reveal_image resolved the requested path through the client-path
resolver, which can fall back to a path anchor; under a LoRA-linked root
the file that would open now passes the same recorded-media gate, so only
a linked file is ever revealed there.

.github/branch-protection.json

@@ -2,15 +2,18 @@
   "required_status_checks": {
     "strict": true,
     "contexts": [
+      "py3.10 on ubuntu-latest",
+      "py3.11 on ubuntu-latest",
       "py3.12 on ubuntu-latest",
       "py3.13 on ubuntu-latest",
-      "py3.14 on ubuntu-latest",
+      "py3.10 on windows-latest",
+      "py3.11 on windows-latest",
       "py3.12 on windows-latest",
       "py3.13 on windows-latest",
-      "py3.14 on windows-latest",
+      "py3.10 on macos-latest",
+      "py3.11 on macos-latest",
       "py3.12 on macos-latest",
       "py3.13 on macos-latest",
-      "py3.14 on macos-latest",
       "coverage gate (85%)",
       "black and flake8",
       "frontend modules",

.github/workflows/code-quality.yml

@@ -26,10 +26,10 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Set up Python 3.12
+      - name: Set up Python 3.10
         uses: actions/setup-python@v7
         with:
-          python-version: "3.12"
+          python-version: "3.10"
 
       - name: Install bandit
         run: pip install bandit[toml]

.github/workflows/test.yml

@@ -26,7 +26,6 @@ env:
 # Measured 2026-10-26 on runs 40257217681 (3be0ada), 40240706568 (fb9134f), 40228167328 (f9835aa):
 #   py matrix, slowest py3.10 on windows-latest: 12m43s / 15m54s / 14m53s -> 27 min
 #     (ubuntu 5m27s-6m27s, macos 6m14s-8m30s, windows 11m42s-15m54s)
-#     3.10 and 3.11 left the matrix and 3.14 joined it in #356; re-measure after three green main runs.
 #   real ComfyUI compatibility: 13m32s / 8m55s / 11m46s -> 24 min
 #   coverage gate (85%): 7m26s / 7m22s / 7m54s -> 15 min
 #   perf budget 30s / 29s / 27s, black and flake8 39s / 37s / 39s,
@@ -40,7 +39,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-        python-version: ["3.12", "3.13", "3.14"]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
 
     steps:
       - uses: actions/checkout@v7

README.md

@@ -1,7 +1,7 @@
 # ComfyUI Prompt Manager
 
 ![License](https://img.shields.io/badge/license-MIT-blue.svg)
-![Python](https://img.shields.io/badge/python-3.12%2B-blue.svg)
+![Python](https://img.shields.io/badge/python-3.10%2B-blue.svg)
 ![ComfyUI](https://img.shields.io/badge/ComfyUI-compatible-green.svg)
 ![Tests](https://github.com/ComfyAssets/ComfyUI_PromptManager/workflows/Tests/badge.svg)
 ![Code Quality](https://github.com/ComfyAssets/ComfyUI_PromptManager/workflows/Code%20Quality/badge.svg)
@@ -933,7 +933,7 @@ node --test tests/js/*.test.js                 # frontend pure modules
 python -m coverage run -m tests.run_suite && python -m coverage combine && python -m coverage report
 ```
 
-CI runs the suite on Linux, Windows and macOS for Python 3.12 to 3.14 with an 85% coverage gate. `python -m unittest discover -s tests` still works; see `TESTING.md` ("Time limits and hangs") for the watchdog. Tests that delete a database file first check that nothing in the process still holds it open (`tests/open_handles.py`), so a connection leak fails on Linux the way it would on Windows.
+CI runs the suite on Linux, Windows and macOS for Python 3.10 to 3.13 with an 85% coverage gate. `python -m unittest discover -s tests` still works; see `TESTING.md` ("Time limits and hangs") for the watchdog. Tests that delete a database file first check that nothing in the process still holds it open (`tests/open_handles.py`), so a connection leak fails on Linux the way it would on Windows.
 
 ### Code Style
 

TESTING.md

@@ -86,18 +86,6 @@ timer that "usually" covers a frame is a race on a loaded runner. Library
 virtualization specs settle with `libraryObservation.settled()` (two consecutive
 frames with no Library frame queued). To look for such races, repeat a spec under
 load (`--workers 8 --repeat-each 10`, and in the image with `--cpus=1` or `2`).
-CPU limits do not reproduce disk-bound timeouts (backup, restore). For those,
-throttle writes in the image: with rootful Docker on a host with cgroup v2, add
-`--device-write-iops /dev/<disk>:20` to the `docker run`, where `<disk>` is the
-whole disk (not a partition) holding Docker's data root, because the test server
-keeps its database in the container's `/tmp`. On a plain partition,
-`lsblk -no pkname "$(df --output=source "$(docker info -f '{{.DockerRootDir}}')" | tail -1)"`
-prints it; on LVM or LUKS, `lsblk -s` walks down to the disk. A spec that waits
-on a timer then fails at its 5 s expect. A spec that waits on the response can
-still fail at the 30 s test timeout when several workers share the throttled
-disk; that means the disk is too slow for the test budget, not that the spec is
-wrong.
-
 On unsupported Linux
 distributions, browser system dependencies may need manual installation. For a
 quick browser run, use `test:workflows -- --project chromium`.

pyproject.toml

@@ -3,7 +3,7 @@ name = "promptmanager"
 description = "A powerful ComfyUI custom node that extends the standard text encoder with persistent prompt storage, advanced search capabilities, and an automatic image gallery system using SQLite."
 version = "3.3.1"
 license = {file = "LICENSE"}
-requires-python = ">=3.12"
+requires-python = ">=3.10"
 dependencies = ["watchdog>=2.1.0", "Pillow>=8.0.0"]
 
 [build-system]

tests/browser/workflows.spec.mjs

@@ -257,18 +257,6 @@ async function chooseRestore(page, file) {
     await page.locator('#restoreFileInput').setInputFiles(file);
 }
 
-// Confirms the chosen restore and waits for the server's answer, not for a timer: a restore is disk-bound and can take
-// longer than an expect timeout on a slow runner (#359). The modal closes only after that answer.
-async function confirmRestoreAndWait(page) {
-    const restored = page.waitForResponse(response => response.url().endsWith('/prompt_manager/restore'));
-    await page.locator('#confirmRestore').click();
-    const response = await restored;
-    const body = await response.text();
-    expect(response.status(), body).toBe(200);
-    expect(JSON.parse(body)).toMatchObject({ success: true, prompt_count: 2, backup_created: expect.any(String) });
-    await expect(page.locator('#restoreModal')).toBeHidden();
-}
-
 function confirmNextDialog(page, accept, message) {
     page.once('dialog', async dialog => {
         expect(dialog.type()).toBe('confirm');
@@ -299,7 +287,12 @@ test('downloaded backup restores deleted prompts, tags, and image links through
     expect(await promptSnapshot(request)).not.toEqual(before);
     await chooseRestore(page, backup);
     confirmNextDialog(page, true, backup.name);
-    await confirmRestoreAndWait(page);
+    const restored = page.waitForResponse(response => response.url().endsWith('/prompt_manager/restore'));
+    await page.locator('#confirmRestore').click();
+    const response = await restored;
+    expect(response.ok()).toBe(true);
+    expect(await response.json()).toMatchObject({ success: true, prompt_count: 2, backup_created: expect.any(String) });
+    await expect(page.locator('#restoreModal')).toBeHidden();
     await expect(page.locator('.prompt-text')).toHaveCount(2);
     await page.reload();
     await expect(page.locator('.prompt-text').filter({ hasText: 'Cat portrait' })).toBeVisible();
@@ -342,7 +335,8 @@ test('restore validation and cancellation preserve live data and allow a valid r
     expect(await promptSnapshot(request)).toEqual(before);
     await page.locator('#restoreFileInput').setInputFiles(backup);
     confirmNextDialog(page, true, backup.name);
-    await confirmRestoreAndWait(page);
+    await page.locator('#confirmRestore').click();
+    await expect(page.locator('#restoreModal')).toBeHidden();
     expect(await promptSnapshot(request)).toEqual(before);
 });
 
@@ -362,7 +356,8 @@ test('backup and restore recover from interrupted network requests without losin
     await expect(page.locator('#restoreModal')).toBeVisible();
     expect(await promptSnapshot(request)).toEqual(before);
     confirmNextDialog(page, true, backup.name);
-    await confirmRestoreAndWait(page);
+    await page.locator('#confirmRestore').click();
+    await expect(page.locator('#restoreModal')).toBeHidden();
     expect(await promptSnapshot(request)).toEqual(before);
 });
 

tests/test_packaging.py

@@ -26,9 +26,27 @@ def _read(name):
 
 
 def _pyproject():
-    import tomllib
-
-    return tomllib.loads(_read("pyproject.toml"))
+    try:
+        import tomllib  # Python 3.11+
+    except ImportError:  # pragma: no cover - exercised on 3.10 only
+        tomllib = None
+    text = _read("pyproject.toml")
+    if tomllib is not None:
+        return tomllib.loads(text)
+    # Minimal fallback for 3.10: pull the dependency list out with a regex.
+    match = re.search(r"dependencies\s*=\s*\[(.*?)\]", text, re.S)
+    deps = re.findall(r'"([^"]*)"', match.group(1)) if match else []
+    return {
+        "project": {
+            "dependencies": deps,
+            "requires-python": (
+                re.search(r'requires-python\s*=\s*"([^"]+)"', text).group(1)
+                if "requires-python" in text
+                else None
+            ),
+        },
+        "build-system": {} if "[build-system]" in text else None,
+    }
 
 
 class PyprojectContract(unittest.TestCase):
@@ -47,8 +65,8 @@ class PyprojectContract(unittest.TestCase):
         }
         self.assertEqual(deps, wanted)
 
-    def test_requires_python_floor_is_3_12(self):
-        self.assertEqual(_pyproject()["project"]["requires-python"], ">=3.12")
+    def test_requires_python_floor_is_3_10(self):
+        self.assertEqual(_pyproject()["project"]["requires-python"], ">=3.10")
 
     def test_build_system_is_declared(self):
         self.assertIsNotNone(_pyproject().get("build-system"))