# Changelog

## 1.4.0 (2026-10-25)

Models can leave the GPU on their own once the server is idle.

### Added

- Admin option *Unload models after idle*: once nothing has run for that many minutes, RigShare unloads the models, as the *Unload models* button does, so the VRAM is free for other programs. Off by default (`auto_unload_minutes`: `0`). A run or a waiting prompt restarts the clock, and it unloads once per idle period
- With *Also clear the cache when unloading* (`auto_unload_cache`), it clears ComfyUI's cache too, like *Free models & cache*: RAM is freed as well, but the next run computes every node again

## 1.3.3 (2026-10-08)

Login and request hardening, mainly for servers behind a reverse proxy.

### Fixed

- A reverse proxy on the same machine (nginx, Caddy, a tunnel) made every visitor look like `127.0.0.1`, which is a trusted address by default, so login and API protection were skipped for everyone. Behind a trusted proxy, trust now follows the visitor's own address (the last `X-Forwarded-For` / `X-Real-IP` entry), and a `Forwarded` header RigShare cannot read means no trust
- Login throttling counted only the address, so users behind one proxy locked each other out, one account could be guessed from many addresses, and the counters never shrank. It now limits per visitor address (5 failures a minute) and per account (10 a minute across all addresses), answers with `Retry-After`, and forgets old entries. People already signed in are never affected. Failed logins are logged

### Added

- Requests that carry the session cookie and an `Origin` from another site are refused: writes and the live connection (hostnames compared, so a proxy that drops the port or sets `X-Forwarded-Host` still works). API clients without a cookie are not affected
- The login page is sent with `X-Frame-Options: DENY`, a `frame-ancestors 'none'` policy, `nosniff` and a same-origin referrer policy, so another site cannot frame it

## 1.3.2 (2026-10-08)

Access rules tightened, following the review of the ComfyUI Manager listing.

### Fixed

- Snapshots of a workflow could be listed and read by an account with no access to its folder whenever nobody had that workflow open. Snapshot access now follows the workflow's folder (private and restricted shared folders included), open or not
- Joining a live workflow seeded a new room from the caller's document before the access check. Access is checked first, and only someone who can edit the workflow can open a new room
- Windows path segments that end in a dot or space, or use an 8.3 short name, are now refused instead of being silently dropped, so a path can no longer be classified as a different folder than the one Windows opens
- After signing in, the login page only follows its `next` redirect when it resolves to the same origin

## 1.3.1 (2026-10-08)

Security hardening of the workspace folder routes, mainly for Windows servers.

### Fixed

- Folder rename, move, delete and create (and the workspace listing) could be pointed outside the workflows folder with a Windows drive prefix (`C:`), which let `rmtree` / `rename` act on folders such as models or custom_nodes. Every path is now checked before it touches the disk: segments with a colon, backslash tricks or `..` are refused, and the resolved path must stay inside the workflows folder
- On Windows, case and aliases of a path were not seen by the access checks: `Users/alice`, `users./alice` or `USERS~1/alice` opened Alice's private folder as if it were common, and `Shared/<restricted folder>` skipped its access list. Paths are now matched to the name on disk and trailing dots, spaces and 8.3 short names are dropped before any permission check
- New usernames and folder names can no longer end in a dot or space, start with a dot, or be a Windows device name (`CON`, `NUL`, `COM1`...). Usernames that differ only by case count as the same name, since they share one folder on Windows. Existing accounts and folders are untouched

### Added

- Tests for the JWT module, the server stats, and the folder routes refusing paths outside the workspace

## 1.3.0 (2026-10-04)

A Performance panel, a floating monitor that docks, and Manager in its own tab.

### Added

- **Performance** in the Server tab: the run in progress against an ETA (the average of the same workflow's last 5 successful runs), the last 5 runs with who launched them and how long they took, and a **History** window with every recorded run. Timings come from ComfyUI's own timestamps and are kept in `runs.json`, so they survive restarts
- Performance pops out as a floating card: just the timer, big, with the usual time of the workflow on screen when idle, and a button to clear that workflow's timings (after a confirmation; needs *Edit*). Docked cards sit side by side in the corner, Performance to the left of Server
- Floating server monitor: a magnet docks it in the bottom-right corner and keeps it there, beside the minimap in the graph, in the corner of the App view. Dragging it undocks it
- Floating server monitor: **Unload models** and **Free models & cache** buttons for admins, like ComfyUI Manager's
- Admin option *ComfyUI Manager in its own sidebar tab*: a **Manager** tab in the left bar (Open Manager, Custom Nodes Manager) replaces the top-bar button, for accounts with the *Manager* permission

### Changed

- Freeing models and cache (ComfyUI's `/free`) needs *Admin* instead of *Queue*: it affects everyone's runs
- Other plugins' top-bar buttons (rgthree-comfy, Crystools...) are hidden without the *Manager* permission, like ComfyUI Manager's. Their settings kept on the server, which apply to everyone, need *Manager* too
- Pixaroma's Workflows panel is hidden along with ComfyUI's Workflows and Apps tabs (admin setting now called *Hide other workflow browsers*), and its shortcut opens Files. Its server routes are refused to everyone but admins: they read the workflows folder straight from disk, private folders included

### Fixed

- Deleting a workflow (or a folder) from the Files tab now closes its open tabs; before, the tab stayed open as an orphan

## 1.2.3 (2026-09-27)

### Fixed

- The Files tab didn't show a workflow you had just saved into the folder on screen until you left the folder and came back. It now refreshes whenever workflows are saved, moved, renamed or deleted, or folders change, including by other people (each person is only told about folders they can open)
- When the session had ended (logged out elsewhere, expired, cookie cleared), a ComfyUI page that was already open showed "API key missing" errors instead of going back to the login screen. It now returns to the login screen as soon as a request says login is required, even if ComfyUI had not finished loading

## 1.2.2 (2026-09-26)

A Queue tab showing who launched what, and chat clean-up for admins.

### Added

- **Queue** tab: the run in progress and the ones waiting, each with the workflow's name, who queued it and when. Stop or remove your own runs from there; admins can do it for anyone's. The server enforces it too: stopping or removing someone else's prompt, or clearing the whole queue, needs *Admin*
- Admins can clear the whole chat history (*Admin → Chat*, or `DELETE /rigshare/api/chat`). Everyone's chat empties at once, followed by a notice saying who cleared it

### Changed

- Panel tabs in a new order: Live, Chat, People, Queue, Server, Admin
- A fuller description on the Comfy Registry

### Fixed

- Entering the App view closed an open RigShare or Files panel (going back to the graph kept it open). It now stays open both ways
- The Comfy Registry showed no changelog: the publish workflow now sends the matching `CHANGELOG.md` section
- The registry logo was a clipped render with only one rounded corner

## 1.2.1 (2026-09-26)

### Changed

- App mode: the **RigShare** and **Files** buttons open their tabs in ComfyUI's docked side panel, like Assets and Apps, instead of a floating drawer

### Fixed

- Switching between the App view and the graph with the RigShare or Files panel open left the panel blank

## 1.2.0 (2026-09-26)

ComfyUI's App mode works with RigShare, and every save keeps a snapshot.

### Added

- **App mode**: live workflows work in ComfyUI's App view. Each person keeps their own graph or App view through live edits, App inputs sync, and the app's layout (chosen inputs and outputs) syncs with the workflow. Cursors are off in the App view
- In the App view, where ComfyUI shows only its own sidebar tabs, **RigShare** and **Files** buttons join that sidebar, with the unread chat badge, and open the panels in a drawer beside it
- The Live tab and People show whether each person is in the node graph or the App view, with ComfyUI's own Graph and App icons
- Workflows with an App set up, and workflows saved as Apps (`.app.json`), show ComfyUI's App icon in Files and the Live list. Save keeps an App an App
- **A snapshot on every save**, named *Saved at* and the time (in each viewer's time zone). They rotate like automatic snapshots (`snapshot_keep`)
- Inside a shared folder you own, its 🔒 access button sits next to the new-folder button

### Changed

- ComfyUI's own Workflows and Apps sidebar tabs are hidden, since Files replaces them, and their shortcuts open Files. Admin setting `hide_comfy_file_tabs`, on by default. The server enforces file permissions either way
- Folder access is managed only in the Files tab. *This tab* in the Live tab still says whether the folder is restricted
- Smaller icons in folder lists

### Fixed

- In the Save and Move dialogs, **New folder** asked for the name in a prompt hidden behind the dialog
- Snapshots taken in the same second could be rotated out of order

## 1.1.0 (2026-09-26)

Workflows now live in folders, like a shared drive, and sharing follows them.

### Added

- **Workspace folders**: a private **My files** folder per account (`users/<name>/`), **Shared** folders owned by whoever creates them, and common workflows at the top level. The server enforces them on ComfyUI's own file API, and ComfyUI's workflow browser lists only what you can open
- **Files** sidebar tab with **My files**, **Shared** and, for admins, **All** (the whole workflows folder); new folders, rename, move and delete; a green dot on live files; **From computer**
- **Save asks where**: a name plus the same folder tabs, starting in My files or the last folder used
- **Open from RigShare…** in the Workflow menu (Ctrl+Alt+O)
- Folder access lists: a shared folder's owner or an admin can restrict it to chosen people, each with view or edit. For a live workflow in a folder you own, *This tab* shows **Folder access**
- Only admins delete common workflows; a shared folder's owner deletes in that folder; you delete in yours
- Whole chat history: stored in `chat.jsonl` with no limit (`chat_keep` trims it). The panel shows the latest 50 messages and loads older ones as you scroll up, with date dividers. The old `chat.json` is imported once
- Test suite: pytest unit and end-to-end tests against a real aiohttp server, Node tests for the client, and a GitHub Actions workflow

### Changed

- Sharing follows folders: every saved workflow outside a private folder is live while it is open, with nothing to share by hand. Unsaved tabs and files in My files stay private
- The **Live** tab lists the workflows someone has open right now, with their folder and who is in them. A private workflow's panel offers **Move to Shared…**
- Renaming or moving a workflow or folder keeps everyone's open tabs on it, under the new name. People who can't open the new location learn nothing about it and keep a private copy
- Deleting a live workflow closes it for the people who have it open, keeping a snapshot; moving one into a private folder takes it out of live sharing
- Who can open a workflow follows its folder only

### Fixed

- Opening a file could overwrite the shared workflow of the previous tab
- Switching straight between the RigShare and Files sidebar tabs could leave the previous tab's content on screen

### Removed

- Per-workflow access lists (restrict the folder instead). Lists set on individual workflows are dropped
- *Share this tab*, *Stop sharing*, the automatic-sharing settings and the admin 🗑 for idle rooms
- Live rooms for unsaved tabs (`tmp:`): save the workflow outside My files to work on it together

## 1.0.0

First release of RigShare, a rewrite of [ComfyUI-Nexus](https://github.com/daxcay/ComfyUI-Nexus) 1.0.2 for the current ComfyUI frontend.

### Added

- Login page before ComfyUI loads, with first-run creation of the admin account
- JWT sessions (HS256, 12 h, renewed while active), bound to revocable server-side sessions
- Personal API keys for scripts and other apps
- Every workflow shared as its own room: saved files automatically, unsaved tabs once edited
- Shared workflows list, *Share this tab*, *Stop sharing*, removal of idle rooms
- Per-workflow snapshots: automatic, named, restore for everyone, open as a copy
- Per-workflow access lists: restrict a workflow to chosen people, each with view or edit
- *Manager* permission: only accounts with it can use ComfyUI Manager (install, update, snapshots, restart). Enforced server-side; the Manager button is hidden without it
- Admin option to hide ComfyUI's Comfy.org account login (top-bar button and sign-in dialog)
- Admin option to hide templates that need paid API nodes from the template browser
- Conflict-free concurrent edits: links and groups merge by id, clashing node and link ids are renumbered, dangling links repaired
- Live cursors and selections, drawn above image previews and DOM widgets
- Follow mode that jumps to the other person's tab and view
- Chat with unread badge, blinking sidebar icon and sound
- Server monitor (CPU, RAM, per-GPU load, VRAM, temperature, power, queue) with a floating widget
- Execution progress and previews sent to everyone
- Admin panel: accounts, permissions, display names, usernames, passwords, server settings
- Server-side permission checks on ComfyUI's queue, interrupt, free and upload endpoints
- Warning when a reverse proxy drops WebSocket upgrades
- Login page that follows the ComfyUI palette last used in the browser

### Changed

- The sidebar panel replaces the floating chat window and keyboard shortcuts
- The server is authoritative: identity and permissions are checked on every message
- Graph sync uses the frontend's change tracker and per-node patches instead of patching litegraph

### Removed

- `/login`, `/logout` and `/nick` chat commands
- Plaintext `admins.json` and the shared default admin password
- Hiding ComfyUI's menus with CSS, and clearing the user's workflow on load