DemonGatanjieuandClaude Opus 5.5
aa9c237f98
With ComfyUI started with --listen, other devices could use most of AMB's actions: delete and rename models, save and delete workflows and prompts, start downloads and scans, export a backup of all data, translate with the user's key, change settings, switch the plugin version. A probe of all routes as a LAN device found 9 of 112 refusing. api/local_guard.py is one middleware in front of every /anomalous/ route: anything but GET answers only this computer unless it is a read sent as POST (OPEN_POSTS); a GET is open unless it is more than a read (LOCAL_GETS: backup file, GitHub releases, local folders). Local = loopback peer, no proxy headers, loopback Host (DNS rebinding is refused too). Refusals are 403 local_only with a bilingual message; GET /anomalous/access lets the page show a "view only" chip (remote_view.js). AGENTS.md rule 4 now names it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
25 lines
1.0 KiB
JavaScript
25 lines
1.0 KiB
JavaScript
/**
|
|
* Opened from another device (ComfyUI started with --listen): a chip in the header says this
|
|
* window can look but not change anything (the server refuses changes from other devices,
|
|
* api/local_guard.py). Nothing shows on the computer ComfyUI runs on.
|
|
*/
|
|
|
|
import { translate as t } from './locales.js';
|
|
|
|
/** Asks the server once whether this page is on its computer; when not, marks the window and adds the chip to `group`. */
|
|
export async function markRemoteView(container, group) {
|
|
try {
|
|
const response = await fetch('/anomalous/access', { cache: 'no-store' });
|
|
const data = response.ok ? await response.json() : null;
|
|
if (!data || data.local !== false) return;
|
|
} catch {
|
|
return; // an older server without the route: nothing to say
|
|
}
|
|
container.classList.add('anomalous-remote-view');
|
|
const chip = document.createElement('span');
|
|
chip.className = 'anomalous-remote-chip';
|
|
chip.textContent = t('remoteViewChip');
|
|
chip.title = t('remoteViewHint');
|
|
group.append(chip);
|
|
}
|