Fix suggestions come from model output and can be steered by prompt
injection. Button labels and titles are now set as text, buttons are only
offered on assistant replies, node ids must match a live node exactly
(execution paths walk real subgraph hosts only), and suggested values are
parsed strictly per widget type (number range, toggle literals, combo
membership, bounded text) before anything is changed. Undo and highlight
use the resolved node instead of re-parsing the id.
Adds a Playwright spec that streams a hostile fix block through the chat
island and covers role gating, exact-id resolution and value rejection.
The analyze, chat, verify-key and model-list routes sent server-side
requests to a caller-supplied base URL guarded only by a pre-flight
denylist. Callers could choose arbitrary hosts and paths, reach shared
address space and metadata ranges, drive local LLM write APIs, and use
DNS rebinding to deliver server-held keys to loopback services.
Requests now select an entry of an immutable destination registry built
at startup from the built-in provider catalog, local Ollama/LM Studio,
and operator environment variables (DOCTOR_LLM_ALLOWED_BASE_URLS and the
existing base URL variables). Outbound URLs are built from the approved
entry, resolved addresses are checked at connect time inside the shared
connector, redirects are never followed or treated as success, and error
responses no longer reflect upstream bodies or network details. The UI
shows localized operator guidance, a static rule enforces disabled
redirects and policy-managed sessions, and .comfyignore keeps tests and
tooling out of the published archive.
rays