release(v0.1.2): fix critical loader collision + 6 Gemini-review findings

Critical:
- rename nodes/ -> mp_nodes/, shared/ -> mp_shared/ to avoid shadowing
  ComfyUI core's nodes.py via sys.path injection (root cause of v0.1.1
  'nodes is not a package' startup failure)
- http_post now streams response and enforces 50MB cap mid-stream (DoS)
- AES key derivation: HKDF -> PBKDF2-HMAC-SHA256 600k iters + random salt
  (work factor against weak-key brute force; ciphertext format changed)
- fs_mkdir/copy/move/delete confined to ComfyUI input/output/temp + ~ by
  default; UTILITY_MEGAPACK_ALLOW_ARBITRARY_PATHS=1 to override

UX / correctness:
- combo settings now declare options array (themes dropdown was empty)
- LATENT default 1x4x8x8 zeros -> {} (avoids Flux/SD3 shape crashes)
- @op decorator rejects reserved widget names mode/theme at register time
- _pad_outputs docstring updated to match relaxed opaque-type behavior

This commit is contained in:

IxMxAMAR

2026-05-13 21:36:54 +05:30

parent fb7019d968

commit 15e4b0da4e

70 changed files with 290 additions and 98 deletions

									
										tests/unit/test_programming_data_struct.py
									
		+1
		-1
	
												View File
												
				@@ -2,7 +2,7 @@

				import pytest

				from nodes.programming import ProgrammingNode

				from mp_nodes.programming import ProgrammingNode

				def run(mode, **kwargs):