PUT /anomalous/import/upload and POST /anomalous/placement/move wrote
into the model folders for any caller, while place and identify already
answered only the computer ComfyUI runs on. With ComfyUI started with
--listen, another device could upload model files or move models
between folders. Both now check mcp_server._is_local first and answer
403 not_local, which the import and Tidy screens already show.
Tests drive both routes through a proxy header and check nothing was
written or moved; they fail without the check. Full suite: structure
check, every tests/*.mjs and 234 Python tests pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018P2T2R7TFbJsc3C9maCD8B
- Models page: "+ Import" chip and model files dropped on the grid open an import
window. model_kind.py tells a file's type (LoRA, checkpoint, VAE, text encoder,
diffusion model, ControlNet, embedding, CLIP Vision, upscaler) and base model from
its safetensors / GGUF header only; .ckpt/.pt are never opened. api/model_import.py
finds the dropped file in Downloads/Desktop (name, size, time) and moves it, or
takes an upload; checks it against Civitai and the scanned models; never replaces
a file (" (2)"). New files are scanned after.
- Model cards show the Civitai version name (metadata version_name).
- Settings page in tabs (Look, Models, Workflows, Prompts, Backup, Help); the
download folder is a choice of ready-made folders or typed by hand; default is now
by base model ({base}).
- The scanner's offline base model uses model_kind (LoRAs, Qwen, Wan, Chroma...).
- AD-019: no Civitai browser inside the plugin.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
