Rohit MahtoandCommandCodeBot e43313b9f4 feat: password-protect file manager and terminal (0.6.1)
- New password_auth module: random token generated on first run, encrypted
  at rest under ~/.champdev (Fernet, cryptography dep), verify + 12h signed
  session cookie. CHAMPDEV_AUTH_PASSWORD env overrides the generated token
  and is what gets sent to telemetry.
- File Manager: write actions (upload/delete/rename/move/copy/mkdir) hidden
  behind an in-UI Unlock dialog and enforced server-side (401). While locked,
  browsing is clamped to the ComfyUI root instead of 403ing, with a lock
  banner. Unlock reveals write actions and allows browsing above the root.
- Terminal: websocket refuses to spawn a shell without auth; lock overlay
  with Unlock dialog, reconnects on success.
- Telemetry: token included in the ingest payload (server column exists).
- Frontend: shared champdev_auth.js in-UI password modal (window.prompt was
  silently blocked in embedded contexts).

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
2026-08-23 19:51:42 +05:30
2026-02-28 23:42:38 +05:30
2026-02-28 23:20:26 +05:30
2026-03-03 14:42:52 +05:30

chamdev-nodes

Custom ComfyUI node pack by chamdev.

Nodes

Champdev Save Image

Save-image output node compatible with ComfyUI's standard image flow, with extra controls for temporary output and filename handling.

Inputs:

  • images (IMAGE)
  • filename_prefix (STRING)
  • save_to_comfy_temp_dir (BOOLEAN): saves to ComfyUI temp directory instead of output directory.
  • overwrite_existing (BOOLEAN): when fixed filename mode is on, overwrite existing file instead of auto-increment fallback.
  • fixed_filename_no_increment (BOOLEAN): save using a fixed filename (no default counter suffix).
  • auto_delete_after_seconds (INT): delete saved file after N seconds (0 disables).

Champdev Save video

Save-video output node that follows core Save Video behavior (takes a VIDEO input and saves via Comfy's video pipeline), with extra file-handling options.

Inputs:

  • video (VIDEO)
  • filename_prefix (STRING)
  • format (auto + core-supported containers)
  • codec (auto + core-supported codecs)
  • save_to_comfy_temp_dir (BOOLEAN)
  • overwrite_existing (BOOLEAN)
  • fixed_filename_no_increment (BOOLEAN)
  • auto_delete_after_seconds (INT)

Champdev File Manager

A utility node (ChampdevFM) that embeds a file manager in its body. Browse any folder on the machine running ComfyUI, preview images, play video/audio, and manage files.

Widgets:

  • start_path (STRING): folder the manager opens at (defaults to the output directory).
  • show_hidden (BOOLEAN): show dotfiles.

Features: editable path bar (Enter to jump anywhere), up/refresh, filter, sortable columns, multi-select, a resizable side preview that shows the original image (click it for full screen), full-screen preview for images/video/audio with ←/→ to step through them, and these operations — upload (button or drag-and-drop), download, rename, move, copy, new folder, delete (with confirmation), and properties.

Keyboard: with the list focused, ↑/↓ move the selection (the preview updates) and Enter opens full screen; Esc closes it. Large folders load lazily — rows and their thumbnails are fetched ~20 at a time as you scroll, and the list scrolls inside the node.

⚠️ Security: this node can read, rename, move, and delete files anywhere the ComfyUI server process can access. It is meant for local, single-user use only. Do not enable it on a ComfyUI instance exposed to a network (--listen, reverse proxy, or shared host): anyone who can reach the UI could delete or exfiltrate arbitrary files. Use at your own risk.

🔒 Password lock: write actions (upload, download, rename, move, copy, new folder, delete) are hidden behind an Unlock button, and browsing above the ComfyUI directory is refused until unlocked. Enter the password from the telemetry dashboard to unlock for 12 hours.

Champdev Terminal

A utility node (ChampdevTerminal) that embeds a full interactive terminal in its body, backed by a real pseudo-terminal on the machine running ComfyUI. Supports interactive programs (vim, top), ANSI colors, and resizing.

Widgets:

  • shell (STRING): shell to launch (default empty = auto-detect — $SHELL or /bin/bash//bin/sh on macOS/Linux; on Windows, PowerShell (pwsh.exe, then the built-in powershell.exe), falling back to cmd.exe).
  • start_dir (STRING): working directory the shell starts in (defaults to the output directory).

The shell session is fresh per connection: it starts when the terminal connects and is killed when you close/reload (the ⟳ Restart button starts a new shell). macOS/Linux use the Python standard library (no extra dependency); Windows requires the pywinpty package (see Installation — installed from requirements.txt).

⚠️ Security: this node opens a fully interactive shell on the machine running ComfyUI — arbitrary command execution by design. It is for local, single-user use only. Do not enable it on a network-exposed ComfyUI (--listen, reverse proxy, or shared host): anyone who can reach the UI gets a shell on your machine. Use at your own risk.

🔒 Password lock: the terminal stays locked (no shell is spawned) until the password from the telemetry dashboard is entered. One unlock session covers the File Manager and Terminal for 12 hours.

Installation

Easiest: install via ComfyUI-Manager, which installs dependencies for you.

To install manually, clone into your ComfyUI custom nodes directory and install the dependencies with the same Python that runs ComfyUI:

cd /path/to/ComfyUI/custom_nodes
git clone https://github.com/rohit267/chamdev-comfyui-nodes.git
cd chamdev-comfyui-nodes
# ComfyUI portable: use python_embeded\python.exe instead of `python`
python -m pip install -r requirements.txt

Restart ComfyUI.

macOS/Linux have no dependencies (the terminal uses the Python standard library). On Windows the terminal needs pywinpty; the command above (and ComfyUI-Manager) installs it. The cryptography package (installed by the same command) encrypts the unlock password at rest.

Password / unlock

On first run the pack generates a random password, stores it encrypted under ~/.champdev/ (env + secret_key), and sends it to the telemetry server as part of the telemetry event (token column). Operators read it from the telemetry dashboard and enter it in the File Manager / Terminal Unlock prompt. One unlock grants a 12-hour session cookie covering both nodes.

  • ~/.champdev/env — the encrypted token.
  • ~/.champdev/secret_key — the Fernet key that encrypts it (never sent anywhere).

Manual override: set CHAMPDEV_AUTH_PASSWORD in the environment ComfyUI is launched with to choose the password yourself instead of using the generated one. When set, no token file is created, that value is what unlock accepts, and it is what gets sent to telemetry.

While locked: the File Manager hides upload/delete/rename/move/copy/new-folder and refuses to browse above the ComfyUI directory; the Terminal refuses to spawn a shell. All related API routes enforce this server-side.

Compatibility

  • Python 3.10+
  • ComfyUI (recent versions)

License

MIT. See LICENSE.

S
Description
No description provided
Readme MIT
182 KiB
Languages
Python 68.6%
JavaScript 31.4%