Audit against all 634 workflows ComfyUI ships (comfyui-workflow-templates). Found and fixed: a crash on list-valued widgets; widgets of nodes inside subgraphs losing seed/denoise; dynamic combos (resize, save format, sparse attention) shifting every later value; instance values mapped by the wrong inputs; Math expression / Batch images / Reference multi latent inputs refused; INT wires into FLOAT-or-INT widgets refused; the prompt not found when conditioning goes through BasicGuider (official H3 workflows); widgets an older export never had now take the node default; nodes no save or preview uses are left out as ComfyUI does. Autogrow sockets are now numbered as ComfyUI numbers them (R2V has 9/3/3/3, FunPack offered one extra of each).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WP6HMLLhRYcghAEXK4KLwK
Pieces B and C: Scene gains source_image (aspect-ratio reference only --
resolution itself stays a project.video setting, ImageTransformKJ's
"total_pixels" keep_proportion fits the picture's aspect into that budget)
and references (media ids, in order). Inspector's Scene tab gets pick/clear/
remove controls; picking routes through the existing Media bin via a small
pending-pick handshake in boot.js (one bin, one onPick, so "which field
asked" has to be tracked between the click that asked and the click that
answered).
References wire into MiniMaxH3ReferenceToVideo's ref_images autogrow input
dynamically, per run, only for what a scene actually has -- an unwired slot,
not an empty image, is what "not in use" means to that node. The target is
data on the role itself (wireTo), not a slot id boot.js would otherwise have
to know, keeping the "core never names an implementation" contract intact
one layer up into the app.
Verifying this exposed a second real core gap (after the MatchType one):
core/graph.py had no idea what an Autogrow (V3's io.Autogrow) input even
is -- "ref_images" reported as one opaque COMFY_AUTOGROW_V3 slot, its real
per-instance sockets (ref_image_0, ref_image_1, ...) invisible to
declared()/build(), so a wire naming one was refused as an input the node
does not have. Fixed generically in comfy_types.py (autogrow_instances())
and graph.py, confirmed against ComfyUI's own _io.py (finalize_prefix's
dotted join, build_nested_inputs's runtime un-nesting) -- not guessed, and
proven end to end with a real override()+build() test using the exact edit
boot.js makes.
Piece A of the H3 workflow port: the loader/SigmaShift/ImageTransformKJ/
R2V/sampler-at-CFG-1/decode/video-mux chain the H3 user runs by hand today,
offered as a preset (GET /api/pipeline/presets) loadable into the same
editable pipeline core/graph.py already supports -- not a second "default",
which module-load order would make ambiguous.
References are deliberately NOT pre-wired into R2V's ref_images autogrow;
an unwired optional slot is what "not in use" means to that node (absent
from its ref_images dict), not an empty image degrading its <Picture i>
numbering. boot.js wires them per-run based on what's actually picked --
next commit.
Building this against a real ComfyUI+KJNodes registration (not a fake
schema) surfaced a genuine core bug: core/graph.py's from_comfyui() had no
idea what to do with a V3 MatchType socket (ImageTransformKJ's own image
input) -- its bare type name "COMFY_MATCHTYPE_V3" matched nothing, so a
completely legal IMAGE wire into it was refused. Fixed generically in
comfy_types.py (match_type_union()) and graph.py, for any node using
MatchType, not special-cased to this one.
Pipeline wiring: core/graph.py gains wire()/unwire(), and the "Models and
pipeline" editor can now actually connect one node's output to another's
input -- sockets and widgets alike, which is what makes "linked inputs"
(several widgets sharing one Primitive node's value) buildable at all,
without a second mechanism. Three adversarial review rounds found and fixed
real bugs along the way: check()'s request builder silently dropped the
wire-specific fields; the widgets loop had no wiring UI at all despite the
backend supporting it, and a widget already holding a link rendered as an
editable box with the wrong (default) value; wiring an input that already
had an unsaved drafted value let the stale value silently win on Save. Also
fixed, found live rather than by review: the Add-node picker stacked two
disagreeing search boxes (an outer server search and filterList's own
redundant client-side one).
Updates window: "Restart ComfyUI" is now a plain, always-available button,
not just something offered when an update already landed. Rolling back or
switching branch on a dirty tree now auto-stashes instead of refusing --
updating still refuses, unchanged, since pulling new commits onto changes
in progress is not something to do without asking. Three review rounds
here too: stashing before reading the rollback target shifted what HEAD@{1}
meant (a real reflog hazard, not just reasoned about); a stash's disclosure
was lost if the step right after it failed; that fix was too narrow and
missed pull()'s own failures inside checkout(pull_after=True) -- the actual
default path -- and rollback()'s own reset failing; and finally, the
broadened fix still only caught GitUpdateError, missing subprocess-level
failures like a hung fetch timing out, which is the realistic failure mode
on a rented GPU box's network.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The prompt was a slot input on a CLIPTextEncode, reachable only by opening
the pipeline window and finding the node. A slot can now say that one of
its inputs belongs on the app's surface -- a place and a label -- and the
shell offers a region with that name or does not, exactly as a module's
panel works. Core validates that a role is names and nothing else.
Values for those inputs travel addressed by slot rather than as a whole
pipeline, so the window that owns the structure and a box that owns one
value cannot disagree about the slots between them. An address that is
not there is refused: a prompt typed into a box for a removed slot has
gone nowhere, and a run that starts anyway is not the run that was asked
for.
Region stand-ins are empty states now, taken down once something mounts --
'modules appear here' left above the modules that appeared explained
nothing to nobody.
Every module panel was decoration. The values lived in the browser and
nothing sent them, so a modifier switched on was one the run never heard
about. They now travel with the pipeline on every check, and core places
them wherever a module says they belong -- announced, not known, so the
node that carries them is not privileged.
Settings with nowhere to go are said beside Generate rather than
swallowed, and the warning survives the run it is about: the status line
is redrawn by every message, so a warning put there was gone the moment
the run said Queued.
Also: a settings row in a docked panel squeezed its label to one word per
line, because the control keeps a 140px floor and took it out of the
label. Below the width where they fit side by side, they stack.
ComfyUI refuses the WHOLE graph over one wrong value. v4 hit that with a LoRA
file that had been deleted: a feature that was switched off still stopped every
generation, and the message was "Prompt outputs failed validation" over a dozen
loaders. build() checked wiring and required-ness and never looked at a literal,
so check() called such a pipeline queueable.
A combo value that is not among the node choices, and a number outside the
bounds it declares, are now refused here -- naming the slot and the input.
No bounds means unknown, and unknown is not a refusal.
And when the queue does refuse one, its per-node reasons were captured by
run.js and never read: the status bar showed only the top-level string, because
describe() read `node` and the refusal path sets `nodes`.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ComfyUI spells a combo three ways -- a list where the type goes, the string
"COMBO" with the choices under options, and COMFY_DYNAMICCOMBO_V3. Only the
first was read, so every V3 node came back with no choices at all and the
window said "no files of this kind were found" over dropdowns holding seven
entries. A stock install here has 140 of the spelling that was missed.
A union type ("IMAGE,MASK") was compared as a whole string, so a MASK feeding
it was refused -- a legal wire refused, which is as bad as an illegal one
accepted. A MultiType wrapped around a number ("FLOAT,INT" with widgetType)
was read as a socket demanding a source for a field you type into.
graph.py and widgets.py had their own idea of what a type string means; both
now read comfy_types.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The source of every link was looked up in a dict rebuilt from the slot list on
each lookup, so validating a chain of N slots did N rebuilds: 20000 slots took
21 seconds. build() runs on the event loop, so that cost was paid by every
other request the server was holding, not only by the caller. Built once.
Round five, one finding, confirmed.
Round four, both findings confirmed against the code.
A cycle is the one wrong graph that passes a per-link check: every type
matches, every id exists, every required input is filled. build() returned it
as queueable, and ComfyUI caught it at execution instead -- a run accepted and
then killed from inside the executor, with the reason in a place the app has no
reason to be reading. Walked with an explicit stack: slots come from a request,
so a long chain must produce a refusal, not a RecursionError.
The window clamp measured size against the viewport and position against the
viewport minus a grabbable strip. Those are two budgets that do not add up, so
a 900px window remembered at x=1000 opened at x=720 of an 800px screen with its
close button and grip past the right edge -- while every "a strip is reachable"
assertion still passed. Dragging keeps the loose rule, because putting a window
half off the screen on purpose is ordinary; opening, restoring and a shrinking
viewport are not placements anybody made, so the window is placed whole when it
fits.
A malformed slots payload crashed the route with a TypeError and answered
500 in plain text. The round-two fix handled the ABSENCE of slots and not
their SHAPE, so reading slot["id"] off a string went straight through -- and
a refusal the app cannot parse is the failure this endpoint exists to avoid.
The shape check is its own function now, because a malformed REQUEST and an
unfinished PIPELINE are different things and get reported separately.
And a window could still be made unreachable, by resizing rather than
moving. Round two clamped position and said "a window can never be put
somewhere it cannot be recovered from"; size was never bounded, so a corner
drag grew it to 4937px in a 900px viewport and carried its own close and
maximise buttons off the screen, leaving Escape as the only way out.
Capping size to the viewport was not enough either: with x above zero the
right edge still left. Resizing is now capped to the room available from
where the window sits, which is a deliberately different rule from dragging
-- a window may be DRAGGED partly off, because a grabbable strip is
guaranteed and that is ordinary behaviour, but it may not be GROWN past the
edge it is anchored to.
Two rounds of fixes, two rounds of holes in those fixes. Both found only by
attacking the code as it stood after the previous fix rather than stopping
at the report that prompted it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Full control did half of what it said and never said which half. It disabled
the mid-run crash guard and left every value refusal in place, so the stated
purpose -- a one-step schedule, a width the model cannot use, let them and
warn -- did not work. Worse, a rejected value was quietly replaced by the
default, so asking for 999 gave 0.4 with a warning about 999.
Now one switch turns off both: the value is passed through, every problem is
said as a warning naming that the consequences are the user's, and a run made
without the guards is identifiable as one afterwards. A key NO module
declares is still never kept, whatever the setting -- nothing reads it, so
keeping it cannot honour the request, only disguise the typo.
core/graph.py was thoroughly tested and called from nowhere: the claim that
a built-in node can be replaced or removed was a property of a library
nothing invoked. It has routes now, and tests that drive them over a real
socket -- the modifiers node removed and the sampler rewired, the VAE loader
swapped for core's, and both refusals coming back as reasons.
Those routes separate two things the old shape conflated. "refused" means
the edit did not happen. "incomplete" means it did and the pipeline still is
not ready -- an unset file picker on a fresh install is the normal case, not
a failed edit, and showing them together would say the wrong thing about both.
And build() could not see a missing REQUIRED input at all, because the
schema lookup flattened required and optional into one dict. A slot with no
model file built clean and failed only once queued.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A module's OWN default could be NaN or infinite. The override path refused
one and the declaration path did not -- and a default is the value most runs
use, because a setting nobody names never reaches the override check at all.
So the fault this project has already been bitten by, `sigma > nan` false at
every step and a modifier silently doing nothing, was reachable through the
one door that was never checked. Bounds too: an infinite min or max makes the
range check meaningless in one direction.
And two slots could share an id. The check for what exists was a set, which
cannot see a duplicate, so building the prompt by id overwrote one slot with
the other: a node silently missing from the queued graph, or one left reading
its own output. Refused now, before anything else is reported, because ids
are how a link names what feeds it and every later check is meaningless while
two slots answer to one name.
Both were found by attacking the whole tree rather than the diff, and both
are in code that already had tests -- the tests exercised the neighbouring
door in each case.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
v4 could not remove a built-in node from the pipeline and the reason was
structural: the wiring lived in code as a CORE dict nobody could reach, so
"remove this" had nothing to delete and "use a different one" had nothing to
change. Code is not a thing a user can edit.
The pipeline is now data. Three operations over it, each refusing with a
reason rather than half-doing the job:
build turns slots into the prompt ComfyUI queues, checking every link's type
and refusing a graph that cannot work. replace points a slot at any node
producing what its consumers read -- the built-in ones have no special
standing, which is what makes them replaceable rather than merely present.
remove takes a slot out and rewires what it fed to what fed it, when the
node has exactly one input matching each CONSUMED output; v4 required one
for every output a class could produce, so a spare FLOAT nobody wired made a
node unremovable.
Demonstrated against real schemas: FunPack's VAE loader swapped for core's
VAELoader, the modifiers node removed with the sampler rewired to read the
model directly, and removing the empty latent refused because nothing
upstream could feed what it fed.
Then run for real. The default pipeline, with three loader slots replaced by
one checkpoint slot, built from data, accepted by ComfyUI's own
validate_prompt, and executed by its own engine to execution_success and a
picture. Every wiring and type validated on the first attempt; the only
things ComfyUI objected to in the untouched default were the three unset
file pickers, which is correct -- a fresh install cannot know which model
you own.
Added a checkpoint loader, because the split loaders are right for LTX and
H3 and cannot read an SD-family single file at all.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
