fix(models): import upload and Tidy moves only from this computer

PUT /anomalous/import/upload and POST /anomalous/placement/move wrote
into the model folders for any caller, while place and identify already
answered only the computer ComfyUI runs on. With ComfyUI started with
--listen, another device could upload model files or move models
between folders. Both now check mcp_server._is_local first and answer
403 not_local, which the import and Tidy screens already show.

Tests drive both routes through a proxy header and check nothing was
written or moved; they fail without the check. Full suite: structure
check, every tests/*.mjs and 234 Python tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018P2T2R7TFbJsc3C9maCD8B

tests/test_model_import.py

@@ -245,6 +245,18 @@ class ImportTests(unittest.TestCase):
         self.assertEqual((short_status, short_body["error"]), (400, "incomplete"))
         self.assertEqual(sorted(os.listdir(os.path.join(self.loras, "up"))), ["new.safetensors"])
 
+    def test_upload_only_from_this_computer(self):
+        async def run():
+            app = web.Application()
+            model_import.register_routes(app)
+            async with TestClient(TestServer(app)) as client:  # through a proxy: not this computer
+                resp = await client.put("/anomalous/import/upload", headers={"X-Forwarded-For": "192.168.1.20"},
+                                        params={"type": "loras", "root": "0", "rel": "far.safetensors", "size": str(len(self.data))},
+                                        data=self.data)
+                return resp.status, await resp.json()
+        self.assertEqual(asyncio.run(run()), (403, {"error": "not_local"}))
+        self.assertFalse(Path(self.loras, "far.safetensors").exists())
+
     def test_identify_reports_civitai_and_a_copy_already_there(self):
         path, mtime = self.dropped("cool.safetensors")
         token = model_import.inspect("cool.safetensors", len(self.data), mtime, b"", local=True)["token"]

tests/test_model_placement.py

@@ -1,5 +1,6 @@
 """The models page's Tidy check (api/model_placement.py): models in the wrong folder, identical
 copies, and moving a model with its covers and info. Files go to temporary folders."""
+import asyncio
 import hashlib
 import json
 import os
@@ -10,6 +11,9 @@ import unittest
 from pathlib import Path
 from unittest import mock
 
+from aiohttp import web
+from aiohttp.test_utils import TestClient, TestServer
+
 PLUGIN = Path(__file__).resolve().parents[1]
 sys.path[:0] = [str(PLUGIN), str(PLUGIN.parents[1])]
 
@@ -134,6 +138,19 @@ class PlacementTests(unittest.TestCase):
             self.assertEqual(refused.exception.code, code)
         self.assertTrue(Path(self.roots["checkpoints"][0], "m.safetensors").exists())
 
+    def test_move_only_from_this_computer(self):
+        self.put("checkpoints", "m.safetensors", ANIMA)
+        move = {"type": "checkpoints", "root": 0, "rel": "m.safetensors", "to_type": "loras", "to_root": 0, "to_rel": "m.safetensors"}
+
+        async def run():
+            app = web.Application()
+            model_placement.register_routes(app)
+            async with TestClient(TestServer(app)) as client:  # through a proxy: not this computer
+                resp = await client.post("/anomalous/placement/move", json=move, headers={"X-Forwarded-For": "192.168.1.20"})
+                return resp.status, await resp.json()
+        self.assertEqual(asyncio.run(run()), (403, {"error": "not_local"}))
+        self.assertTrue(Path(self.roots["checkpoints"][0], "m.safetensors").exists())
+
 
 if __name__ == "__main__":
     unittest.main()