- New password_auth module: random token generated on first run, encrypted
at rest under ~/.champdev (Fernet, cryptography dep), verify + 12h signed
session cookie. CHAMPDEV_AUTH_PASSWORD env overrides the generated token
and is what gets sent to telemetry.
- File Manager: write actions (upload/delete/rename/move/copy/mkdir) hidden
behind an in-UI Unlock dialog and enforced server-side (401). While locked,
browsing is clamped to the ComfyUI root instead of 403ing, with a lock
banner. Unlock reveals write actions and allows browsing above the root.
- Terminal: websocket refuses to spawn a shell without auth; lock overlay
with Unlock dialog, reconnects on success.
- Telemetry: token included in the ingest payload (server column exists).
- Frontend: shared champdev_auth.js in-UI password modal (window.prompt was
silently blocked in embedded contexts).
Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
