With ComfyUI started with --listen, other devices could use most of AMB's actions: delete and rename models, save and delete workflows and prompts, start downloads and scans, export a backup of all data, translate with the user's key, change settings, switch the plugin version. A probe of all routes as a LAN device found 9 of 112 refusing. api/local_guard.py is one middleware in front of every /anomalous/ route: anything but GET answers only this computer unless it is a read sent as POST (OPEN_POSTS); a GET is open unless it is more than a read (LOCAL_GETS: backup file, GitHub releases, local folders). Local = loopback peer, no proxy headers, loopback Host (DNS rebinding is refused too). Refusals are 403 local_only with a bilingual message; GET /anomalous/access lets the page show a "view only" chip (remote_view.js). AGENTS.md rule 4 now names it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Architecture Topic Guide
Start with the repository-root ARCHITECTURE.md, then
open only the topic needed for the current task.
backend.md: Python routes, filesystem safety, persistence, scan state, model sidecars, and backend performance.frontend.md: extension bootstrap, UI ownership, localization, media lifecycle, panel state, and graph mutations.recipes.md: Workflow Recipes, packages, galleries, Parameter Notebooks, prompt roles, and recipe-to-model transitions.material-library.md: saved prompts and node values (material files), keeping an output image, and dragging prompts onto the canvas.recipe-model-lifecycle.md: authoritative model fields, Hash synchronization, local matching, partial append, and note privacy.model-resolution.md: model provenance, Model Check, hash injection, model scanning, and recovery policy.../decisions/README.md: concise records of product and architectural decisions that still explain current behavior.
These documents describe current contracts rather than implementation history.
For exact changes, use Git history. For user-visible releases, use
CHANGELOG.md. For recurring implementation traps, use
.agents/logs/ai_lessons.md.