Widget values reach the loaders through ComfyUI's /prompt route, and
resolve_input_path and local_preview_allowed are what keep those reads
inside ComfyUI's input, output and temp folders. No test covered them:
removing the outside-the-input-folder check, the network-path check or
local path mode's network check passed every test.
tests/test_media_paths.py covers climbing out with "..", absolute paths,
links pointing outside, "[output]" names, network paths refused before
the path is touched (even when a ComfyUI folder itself sits on the
share), and local path mode. The guards need neither torch nor PyAV, so
the media module's heavy imports are stubbed when missing and the file
runs in CI. Each guard's removal fails at least two tests.
A VALIDATE_INPUTS that takes **kwargs makes ComfyUI skip its own range
and list checks for every input, and a failed check comes back once per
input: Image Crop + Rotate + Pad without a picture showed 20 copies of
"Select or upload a source file first". Each validator now names only
what it reads.
- Image Crop + Rotate + Pad, Load Video and LaMa Inpaint read one input
and report one error, on it. Video Crop + Rotate + Pad (Frame and
Clip) read the three that choose the source. LoRA Loader reads the
stack and on_missing; Save Image reads its two names and output_dir.
- Save Video has no validator any more: ComfyUI's own check holds a
typed fps to 0.01-240.
- Load Video and the Clip node check the trim window, force_rate and
Fixed frames as they run, where a wired bound has its value. They are
async, so ComfyUI starts them ahead of other nodes.
- The sources still skip ComfyUI's list check on purpose, so uploads,
subfolders, MaskEditor saves and a stale video choice in local path
mode keep working. The path checks behind them are unchanged.
- crop_aspect_ratio accepts any whole-number W:H, as the transform
always has, so a workflow made with someone else's presets still runs;
anything else is now refused before the run.
tests/test_validate_inputs.py pins what each validator names (runs in
CI) and, with ComfyUI, drives ComfyUI's own validation.
Video Crop + Rotate + Pad -> Frame had gained its four resize inputs as
required, so an API prompt saved before them stopped validating. They
are optional now; the widget order is unchanged.
tests/test_node_api.py loads the pack the way ComfyUI does and holds every
node to tests/fixtures/node_api.json: inputs and outputs may only be
appended, never renamed, reordered, removed or newly required. Its rule
tests need only the standard library and run in CI.
Bug reports ask for the ComfyUI, frontend and pack versions, the install
method, the node, the steps, expected and actual results, and a workflow
or screenshot; ideas start from the workflow problem; security reports
are pointed at the private policy. .gitattributes and .editorconfig pin
what the tree already holds (LF, UTF-8, spaces), and renormalizing
changed no file. Both stay out of the Registry archive.
The validate job gains a ten-minute timeout and three steps: the ten
Python test files that need only the standard library (the registry
status test now runs among them), a syntax check of every js/**/*.js
and .mjs file, and ruff 0.16.3 with the pyflakes and syntax-error
rules. Plain `node --check` exits 0 for a broken .js file that uses
import or export, so each file is piped in with --input-type=module.
The publish workflow uploaded on any pyproject.toml change reaching main,
so a keywords or description edit sent the same version to the Registry
again, a manual run could publish from any branch, and nothing required
validation to pass first. It now compares the version with the previous
commit, runs only on main, runs the offline checks, and publishes after
they pass.
- New node: Save Image - PNG or lossless JPEG XL (optional
pillow-jxl-plugin, the pack's new jxl extra), workflow embedding on or
off (honoring --disable-metadata), an exact_name mode that saves under
exactly that filename with no counter suffix, overwrite/skip/error
collision policy, output_dir up to absolute dataset paths, a caption
.txt sidecar sharing the basename, file_path and IMAGE passthrough
outputs, and always-re-run semantics so a deleted file re-saves.
- Image Resize now only invents pixels on an explicit width+height pad
request: scale-derived modes resolve divisible_by snaps with a
sub-half-step resize instead of padding a sliver; the tour workflow
switched to an explicit 512x512 letterbox so its mask lane demonstrates
real bars.
- Registry-facing metadata: the description now names every node family
(Manager search matches against it) and the keyword list grew to match.
- Release 1.2.0: version bump, frontend version constant synced,
changelog dated, and a publish workflow (Comfy-Org/publish-node-action)
that releases to the registry whenever pyproject.toml changes on main.
ausboss