- New password_auth module: random token generated on first run, encrypted at rest under ~/.champdev (Fernet, cryptography dep), verify + 12h signed session cookie. CHAMPDEV_AUTH_PASSWORD env overrides the generated token and is what gets sent to telemetry. - File Manager: write actions (upload/delete/rename/move/copy/mkdir) hidden behind an in-UI Unlock dialog and enforced server-side (401). While locked, browsing is clamped to the ComfyUI root instead of 403ing, with a lock banner. Unlock reveals write actions and allows browsing above the root. - Terminal: websocket refuses to spawn a shell without auth; lock overlay with Unlock dialog, reconnects on success. - Telemetry: token included in the ingest payload (server column exists). - Frontend: shared champdev_auth.js in-UI password modal (window.prompt was silently blocked in embedded contexts). Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
chamdev-nodes
Custom ComfyUI node pack by chamdev.
Nodes
Champdev Save Image
Save-image output node compatible with ComfyUI's standard image flow, with extra controls for temporary output and filename handling.
Inputs:
images(IMAGE)filename_prefix(STRING)save_to_comfy_temp_dir(BOOLEAN): saves to ComfyUI temp directory instead of output directory.overwrite_existing(BOOLEAN): when fixed filename mode is on, overwrite existing file instead of auto-increment fallback.fixed_filename_no_increment(BOOLEAN): save using a fixed filename (no default counter suffix).auto_delete_after_seconds(INT): delete saved file after N seconds (0disables).
Champdev Save video
Save-video output node that follows core Save Video behavior (takes a VIDEO input and saves via Comfy's video pipeline), with extra file-handling options.
Inputs:
video(VIDEO)filename_prefix(STRING)format(auto+ core-supported containers)codec(auto+ core-supported codecs)save_to_comfy_temp_dir(BOOLEAN)overwrite_existing(BOOLEAN)fixed_filename_no_increment(BOOLEAN)auto_delete_after_seconds(INT)
Champdev File Manager
A utility node (ChampdevFM) that embeds a file manager in its body. Browse any
folder on the machine running ComfyUI, preview images, play video/audio, and
manage files.
Widgets:
start_path(STRING): folder the manager opens at (defaults to the output directory).show_hidden(BOOLEAN): show dotfiles.
Features: editable path bar (Enter to jump anywhere), up/refresh, filter, sortable
columns, multi-select, a resizable side preview that shows the original image
(click it for full screen), full-screen preview for images/video/audio with
←/→ to step through them, and these operations — upload (button or
drag-and-drop), download, rename, move, copy, new folder, delete (with
confirmation), and properties.
Keyboard: with the list focused, ↑/↓ move the selection (the preview updates)
and Enter opens full screen; Esc closes it. Large folders load lazily —
rows and their thumbnails are fetched ~20 at a time as you scroll, and the list
scrolls inside the node.
⚠️ Security: this node can read, rename, move, and delete files anywhere the ComfyUI server process can access. It is meant for local, single-user use only. Do not enable it on a ComfyUI instance exposed to a network (
--listen, reverse proxy, or shared host): anyone who can reach the UI could delete or exfiltrate arbitrary files. Use at your own risk.
🔒 Password lock: write actions (upload, download, rename, move, copy, new folder, delete) are hidden behind an Unlock button, and browsing above the ComfyUI directory is refused until unlocked. Enter the password from the telemetry dashboard to unlock for 12 hours.
Champdev Terminal
A utility node (ChampdevTerminal) that embeds a full interactive terminal in its
body, backed by a real pseudo-terminal on the machine running ComfyUI. Supports
interactive programs (vim, top), ANSI colors, and resizing.
Widgets:
shell(STRING): shell to launch (default empty = auto-detect —$SHELLor/bin/bash//bin/shon macOS/Linux; on Windows, PowerShell (pwsh.exe, then the built-inpowershell.exe), falling back tocmd.exe).start_dir(STRING): working directory the shell starts in (defaults to the output directory).
The shell session is fresh per connection: it starts when the terminal connects
and is killed when you close/reload (the ⟳ Restart button starts a new shell).
macOS/Linux use the Python standard library (no extra dependency); Windows
requires the pywinpty package (see Installation — installed
from requirements.txt).
⚠️ Security: this node opens a fully interactive shell on the machine running ComfyUI — arbitrary command execution by design. It is for local, single-user use only. Do not enable it on a network-exposed ComfyUI (
--listen, reverse proxy, or shared host): anyone who can reach the UI gets a shell on your machine. Use at your own risk.
🔒 Password lock: the terminal stays locked (no shell is spawned) until the password from the telemetry dashboard is entered. One unlock session covers the File Manager and Terminal for 12 hours.
Installation
Easiest: install via ComfyUI-Manager, which installs dependencies for you.
To install manually, clone into your ComfyUI custom nodes directory and install the dependencies with the same Python that runs ComfyUI:
cd /path/to/ComfyUI/custom_nodes
git clone https://github.com/rohit267/chamdev-comfyui-nodes.git
cd chamdev-comfyui-nodes
# ComfyUI portable: use python_embeded\python.exe instead of `python`
python -m pip install -r requirements.txt
Restart ComfyUI.
macOS/Linux have no dependencies (the terminal uses the Python standard library). On Windows the terminal needs
pywinpty; the command above (and ComfyUI-Manager) installs it. Thecryptographypackage (installed by the same command) encrypts the unlock password at rest.
Password / unlock
On first run the pack generates a random password, stores it encrypted under
~/.champdev/ (env + secret_key), and sends it to the telemetry server as
part of the telemetry event (token column). Operators read it from the
telemetry dashboard and enter it in the File Manager / Terminal Unlock
prompt. One unlock grants a 12-hour session cookie covering both nodes.
~/.champdev/env— the encrypted token.~/.champdev/secret_key— the Fernet key that encrypts it (never sent anywhere).
Manual override: set CHAMPDEV_AUTH_PASSWORD in the environment ComfyUI is
launched with to choose the password yourself instead of using the generated one.
When set, no token file is created, that value is what unlock accepts, and it is
what gets sent to telemetry.
While locked: the File Manager hides upload/delete/rename/move/copy/new-folder and refuses to browse above the ComfyUI directory; the Terminal refuses to spawn a shell. All related API routes enforce this server-side.
Compatibility
- Python 3.10+
- ComfyUI (recent versions)
License
MIT. See LICENSE.