Address PR feedback: lock parsing safety, token auth, and path refs

DECISIONS.md

@@ -2,15 +2,16 @@
 
 ## 2026-02-15 — Profile-first RunPod build flow
 - We use profile files as inputs and generate lock files as build/runtime truth.
-- Profile inputs:
-  - `Runpod_Comfy/profiles/runpod.<id>.yaml`
-  - `Runpod_Comfy/profiles/nodes.<id>.yaml`
-  - `Runpod_Comfy/profiles/models.<id>.yaml`
-  - Optional `Runpod_Comfy/profiles/urls.<id>.txt`
+- Profile/recipe inputs:
+  - `Runpod_Comfy/setup/recipes/<id>/runpod.yaml`
+  - `Runpod_Comfy/setup/recipes/<id>/nodes.yaml`
+  - `Runpod_Comfy/setup/recipes/<id>/models.yaml`
+  - Optional `Runpod_Comfy/setup/recipes/<id>/urls.txt`
 - Compiler output:
-  - `Runpod_Comfy/config/comfyui.lock`
-  - `Runpod_Comfy/config/custom_nodes.lock.json`
-  - `Runpod_Comfy/config/models.json`
+  - `Runpod_Comfy/image/builds/<id>/comfyui.lock`
+  - `Runpod_Comfy/image/builds/<id>/custom_nodes.lock.json`
+  - `Runpod_Comfy/image/builds/<id>/models.json`
+  - Activated to `Runpod_Comfy/image/active/*`
 - Docker base image is taken from generated `comfyui.lock` (`BASE_IMAGE` build arg).
 - Goal: normal updates (new node repo/model URL/version bumps) should require editing config files only, not Python/Docker logic.
 - Expected operator UX:

README.md

@@ -26,8 +26,8 @@ The code for the Easy Resize node is inspired by the Resize Image V2 node from C
 
 A dedicated RunPod setup scaffold is available in `Runpod_Comfy/`.
 
-- Entry guide: `Runpod_Comfy/README.md`
-- Deploy notes: `Runpod_Comfy/docs/DEPLOY_RUNPOD.md`
+- Entry guide: `Runpod_Comfy/setup/USER_README.md`
+- Deploy notes: `Runpod_Comfy/image/DEPLOY_RUNPOD.md`
 
 ## Release & Stability
 

Runpod_Comfy/core/docker/start.sh

@@ -9,12 +9,14 @@ JUPYTER_TOKEN="${JUPYTER_TOKEN:-runpod}"
 
 "$ROOT/core/scripts/bootstrap.sh"
 
-if [[ -f "$ROOT/image/active/comfyui.lock" ]]; then
-  # shellcheck disable=SC1091
-  source "$ROOT/image/active/comfyui.lock"
+LOCK="$ROOT/image/active/comfyui.lock"
+ENABLE_JUPYTER_LOCK="true"
+if [[ -f "$LOCK" ]]; then
+  ENABLE_JUPYTER_LOCK=$(grep -E '^ENABLE_JUPYTER=' "$LOCK" | head -n1 | cut -d= -f2-)
+  [[ -z "$ENABLE_JUPYTER_LOCK" ]] && ENABLE_JUPYTER_LOCK="true"
 fi
 
-if [[ "${ENABLE_JUPYTER:-true}" == "true" ]]; then
+if [[ "$ENABLE_JUPYTER_LOCK" == "true" ]]; then
   echo "[jupyter] starting on 0.0.0.0:${JUPYTER_PORT}"
   jupyter lab \
     --ip=0.0.0.0 \

Runpod_Comfy/core/scripts/bootstrap.sh

@@ -3,9 +3,21 @@ set -euo pipefail
 
 ROOT=/opt/bootstrap/Runpod_Comfy
 WORKDIR="${COMFYUI_WORKDIR:-/workspace/ComfyUI}"
+LOCK="$ROOT/image/active/comfyui.lock"
 mkdir -p "$WORKDIR"
 
-source "$ROOT/image/active/comfyui.lock"
+lock_get() {
+  local key="$1"
+  grep -E "^${key}=" "$LOCK" | head -n1 | cut -d= -f2-
+}
+
+COMFYUI_REPO="$(lock_get COMFYUI_REPO)"
+COMFYUI_REF="$(lock_get COMFYUI_REF)"
+
+if [[ -z "$COMFYUI_REPO" || -z "$COMFYUI_REF" ]]; then
+  echo "[bootstrap] invalid lock file: missing COMFYUI_REPO or COMFYUI_REF"
+  exit 1
+fi
 
 if [[ ! -f "$WORKDIR/main.py" ]]; then
   echo "[bootstrap] Cloning ComfyUI from $COMFYUI_REPO"

Runpod_Comfy/core/scripts/download_models.sh

@@ -29,7 +29,16 @@ for ((i=0; i<COUNT; i++)); do
   fi
 
   echo "[models] downloading: $NAME"
-  curl -L --fail "$URL" -o "$DEST"
+
+  CURL_ARGS=(-L --fail)
+  if [[ "$URL" == *"huggingface.co"* ]] && [[ -n "${HF_TOKEN:-}" ]]; then
+    CURL_ARGS+=(-H "Authorization: Bearer ${HF_TOKEN}")
+  fi
+  if [[ "$URL" == *"civitai.com"* ]] && [[ -n "${CIVITAI_TOKEN:-}" ]]; then
+    CURL_ARGS+=(-H "Authorization: Bearer ${CIVITAI_TOKEN}")
+  fi
+
+  curl "${CURL_ARGS[@]}" "$URL" -o "$DEST"
 
   if [[ -n "$SHA256" ]]; then
     echo "$SHA256  $DEST" | sha256sum -c -

TODO.md

@@ -1,13 +1,13 @@
 # TODO
 
 ## NOW
-- [ ] Fill real values for RunPod profile files (`Runpod_Comfy/profiles/*.example.yaml` copies)
+- [ ] Fill real values for RunPod recipe files (`Runpod_Comfy/setup/recipes/<id>/*.yaml`)
 - [ ] Compile selected profile and verify generated lock files
 - [ ] Build and push first RunPod image
 
 ## NEXT
 - [ ] Deploy image on RunPod and run smoke test workflow
-- [ ] Add helper script: `Runpod_Comfy/tools/build_from_lock.sh`
+- [ ] Add helper script: `Runpod_Comfy/setup/tools/build_from_lock.sh`
 - [ ] Add profile validation checks (schema-lite)
 
 ## BLOCKED