mirror of
https://github.com/rookiestar28/ComfyUI-OpenClaw.git
synced 2026-08-14 00:48:07 +00:00
docs(release): refresh host alignment notes
This commit is contained in:
rookiestar28
@@ -101,12 +101,14 @@ Deployment profiles and hardening references:
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>ComfyUI host compatibility, sidebar registration, model folders, and asset-output posture refreshed</strong></summary>
|
||||
<summary><strong>ComfyUI host compatibility, queue recovery, model folders, and asset-output posture refreshed</strong></summary>
|
||||
|
||||
- Refreshed the published compatibility baseline for current ComfyUI, standalone frontend, and Desktop hosts, while keeping desktop embedded-frontend lag explicit.
|
||||
- Refreshed the published compatibility baseline for ComfyUI `08e93a31` (post-`v0.22.3`), standalone frontend `1.46.6`, and Desktop `0.9.4` with core `0.22.3` plus embedded frontend `1.43.18`.
|
||||
- Reconciled active prompt state after backend or SSE reconnects so completed prompts are not left in the active queue lane after a host recovery.
|
||||
- Updated sidebar registration to prefer the current ComfyUI sidebar store API and keep the deprecated frontend facade as a compatibility fallback for older hosts.
|
||||
- Aligned Model Manager and preflight diagnostics with current ComfyUI model folder names such as `text_encoders` and `diffusion_models`, while retaining legacy aliases such as `clip` and `unet`.
|
||||
- Kept output previews on the bounded `/history` + `/view` contract; upstream asset-only identifiers remain explicit fallback states unless a future feature requires direct `/api/assets` use.
|
||||
- Aligned Model Manager and preflight diagnostics with current ComfyUI model folder names such as `text_encoders`, `diffusion_models`, `geometry_estimation`, and `detection`, while retaining legacy aliases such as `clip` and `unet`.
|
||||
- Kept output previews on the bounded `/history` + `/view` contract, including `asset_hash` and `hash` aliases for hash-backed previews; upstream asset-only identifiers remain explicit fallback states unless a future feature requires direct `/api/assets` use.
|
||||
- Updated public release/support/troubleshooting docs to match the refreshed host facts and avoid exposing maintainer-only planning paths or machine-local links.
|
||||
|
||||
</details>
|
||||
|
||||
@@ -384,7 +386,7 @@ New shell/tab wiring should use the shared text-safe DOM helpers in `web/opencla
|
||||
|
||||
Canonical DOM/class ownership is now centered on `openclaw-*`; legacy `moltbot-*` class compatibility is still supported through shared runtime aliasing instead of duplicated markup in each tab template.
|
||||
|
||||
The sidebar now also resolves and stamps its active host surface (`standalone_frontend` vs desktop-embedded host) at mount time so frontend-host drift is explicit and testable instead of inferred from runtime accidents.
|
||||
The sidebar now also resolves and stamps its active host surface (`standalone_frontend` vs desktop-embedded host) and reference metadata at mount time, so Desktop `0.9.4` embedded-frontend lag against standalone frontend `1.46.6` is explicit and testable instead of inferred from runtime accidents.
|
||||
|
||||
Sidebar registration prefers ComfyUI's current sidebar store API and falls back to the deprecated frontend facade when running on older host bundles. Hosts without either sidebar API use the legacy menu fallback instead of failing extension setup.
|
||||
|
||||
@@ -397,7 +399,7 @@ The OpenClaw sidebar includes these built-in tabs. Some tabs are capability-gate
|
||||
| Tab | What it does | Related docs |
|
||||
| --- | --- | --- |
|
||||
| `Settings` | Health/config/log visibility, provider/model setup, model connectivity checks, and optional localhost key storage. | [Quick Start](#quick-start-minimal), [API Overview](#api-overview), [Troubleshooting](#troubleshooting) |
|
||||
| `Jobs` | Tracks prompt IDs, consumes deterministic event/task cursor metadata for polling, and shows output previews for recent jobs across classic history refs and asset-backed output refs through the same `/view` contract; refs that only expose asset-service identifiers stay explicit as an operator-visible fallback state instead of silently upgrading to `/api/assets`. | [API Overview](#api-overview), [Remote Control (Connector)](#remote-control-connector) |
|
||||
| `Jobs` | Tracks prompt IDs, consumes deterministic event/task cursor metadata for polling, and shows output previews for recent jobs across classic history refs plus `asset_hash`/`hash`-backed output refs through the same `/view` contract; refs that only expose asset-service identifiers stay explicit as an operator-visible fallback state instead of silently upgrading to `/api/assets`. | [API Overview](#api-overview), [Remote Control (Connector)](#remote-control-connector) |
|
||||
| `Planner` | Uses assist endpoint to generate structured prompt plans (positive/negative/params). | [Configure an LLM key](#1-configure-an-llm-key-for-plannerrefinervision-helpers), [Nodes](#nodes) |
|
||||
| `Refiner` | Refines existing prompts with optional image context and issue/goal input. | [Configure an LLM key](#1-configure-an-llm-key-for-plannerrefinervision-helpers), [Nodes](#nodes) |
|
||||
| `Variants` | Local helper for generating batch variant parameter JSON (seed/range-style sweeps). | [Nodes](#nodes), [Operator UX Features](#operator-ux-features) |
|
||||
@@ -406,7 +408,7 @@ The OpenClaw sidebar includes these built-in tabs. Some tabs are capability-gate
|
||||
| `Explorer` | Inventory/preflight diagnostics and snapshot/checkpoint troubleshooting workflows, including snapshot-first inventory refresh state (`snapshot_ts`, `scan_state`, `stale`, `last_error`) and suppressed inactive-branch findings. | [Operator UX Features](#operator-ux-features), [Troubleshooting](#troubleshooting) |
|
||||
| `Packs` | Dedicated pack lifecycle tab for import/export/delete under admin boundary. | [API Overview](#api-overview) |
|
||||
| `PNG Info` | Inspects saved generation images through drag-and-drop, file picker, or scoped paste, parses A1111 infotext plus ComfyUI `prompt` / `workflow` metadata, shows extracted prompt and generation fields when recoverable, and keeps raw metadata visible for operator inspection. | [API Overview](#api-overview), [Troubleshooting](#troubleshooting) |
|
||||
| `Model Manager` | Searches model catalog/install records, queues managed downloads, monitors task lifecycle, and imports completed tasks into the managed install root with current ComfyUI folder-key normalization plus legacy type aliases. | [API Overview](#api-overview), [Troubleshooting](#troubleshooting) |
|
||||
| `Model Manager` | Searches model catalog/install records, queues managed downloads, monitors task lifecycle, and imports completed tasks into the managed install root with current ComfyUI folder-key normalization, including `geometry_estimation` and `detection`, plus legacy type aliases. | [API Overview](#api-overview), [Troubleshooting](#troubleshooting) |
|
||||
| `Parameter Lab` | Runs bounded sweep/compare experiments, stores history, and replays parameters back into the graph. | [Operator UX Features](#operator-ux-features) |
|
||||
|
||||
## Operator UX Features
|
||||
@@ -499,8 +501,8 @@ Key operational notes:
|
||||
|
||||
- Observability remains token-gated for remote access and redacts provider reasoning-like content plus marked internal maintenance/helper content by default.
|
||||
- Event/model-download polling and preflight inventory are snapshot/cursor-driven contracts; clients should consume `snapshot_ts`, `scan_state`, `stale`, and cursor metadata instead of assuming full-refresh polling.
|
||||
- Model Manager and preflight consumers should use current ComfyUI folder keys for model types where possible; compatibility aliases such as `clip`, `unet`, `ckpt`, and plural legacy names are normalized before lookup/import.
|
||||
- Output/history-facing consumers should keep using the bounded `/history` + `/view` contract; refs that only upstream asset services can resolve remain explicit `asset_api_required` compatibility states.
|
||||
- Model Manager and preflight consumers should use current ComfyUI folder keys for model types where possible, including `text_encoders`, `diffusion_models`, `geometry_estimation`, and `detection`; compatibility aliases such as `clip`, `unet`, `ckpt`, and plural legacy names are normalized before lookup/import.
|
||||
- Output/history-facing consumers should keep using the bounded `/history` + `/view` contract; `asset_hash` and `hash` values that map to `blake3:...` preview normally, while refs that only upstream asset services can resolve remain explicit `asset_api_required` compatibility states.
|
||||
- Connector diagnostics expose redacted token references only, and `/openclaw/connector/extraction-contract` is structural packaging metadata and static SecretRef policy rather than a live installation-health, environment, or token-status feed.
|
||||
|
||||
## Advanced Security and Runtime Setup
|
||||
|
||||
@@ -15,10 +15,11 @@
|
||||
- Current history/output-facing interop already accepts:
|
||||
- classic ComfyUI output refs (`filename`, `subfolder`, `type`)
|
||||
- asset-hash-backed refs that still resolve through `/view?filename=blake3:...`
|
||||
- Current ComfyUI `0.20.1` reference facts:
|
||||
- Current ComfyUI `08e93a31` / post-`v0.22.3` reference facts:
|
||||
- `/api/assets*` routes exist, but operational use is feature-gated behind `--enable-assets`
|
||||
- `/features` exposes the `assets` capability flag so hosts can report whether the asset system is enabled
|
||||
- frontend preview still resolves `blake3:...` asset hashes through `/view`, so hash-backed outputs do not require a direct `/api/assets` fetch
|
||||
- asset responses may expose `hash` alongside `asset_hash`; OpenClaw treats both as hash-backed preview aliases
|
||||
- Current operator/runtime surfaces in scope:
|
||||
- sidebar `Jobs`
|
||||
- callback delivery payloads
|
||||
|
||||
@@ -7,12 +7,13 @@ Newest entries appear first.
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>ComfyUI host compatibility, sidebar registration, model folders, and asset-output posture refreshed</strong></summary>
|
||||
<summary><strong>ComfyUI host compatibility, queue recovery, model folders, and asset-output posture refreshed</strong></summary>
|
||||
|
||||
- Refreshed the published compatibility baseline for current ComfyUI, standalone frontend, and Desktop hosts, while keeping desktop embedded-frontend lag explicit.
|
||||
- Refreshed the published compatibility baseline for ComfyUI `08e93a31` (post-`v0.22.3`), standalone frontend `1.46.6`, and Desktop `0.9.4` with core `0.22.3` plus embedded frontend `1.43.18`.
|
||||
- Reconciled active prompt state after backend or SSE reconnects so completed prompts are not left in the active queue lane after a host recovery.
|
||||
- Updated sidebar registration to prefer the current ComfyUI sidebar store API and keep the deprecated frontend facade as a compatibility fallback for older hosts.
|
||||
- Aligned Model Manager and preflight diagnostics with current ComfyUI model folder names such as `text_encoders` and `diffusion_models`, while retaining legacy aliases such as `clip` and `unet`.
|
||||
- Kept output previews on the bounded `/history` + `/view` contract; upstream asset-only identifiers remain explicit fallback states unless a future feature requires direct `/api/assets` use.
|
||||
- Aligned Model Manager and preflight diagnostics with current ComfyUI model folder names such as `text_encoders`, `diffusion_models`, `geometry_estimation`, and `detection`, while retaining legacy aliases such as `clip` and `unet`.
|
||||
- Kept output previews on the bounded `/history` + `/view` contract, including `asset_hash` and `hash` aliases for hash-backed previews; upstream asset-only identifiers remain explicit fallback states unless a future feature requires direct `/api/assets` use.
|
||||
|
||||
</details>
|
||||
|
||||
@@ -217,7 +218,7 @@ Newest entries appear first.
|
||||
|
||||
<summary><strong>Planning, startup/config hardening, compatibility governance, and frontend hotspot reduction batch</strong></summary>
|
||||
|
||||
- Normalized the active planning surface onto `.planning/roadmap.md` and clarified the docs-only test-flow exemption in the project SOP guidance.
|
||||
- Normalized the active maintainer planning surface and clarified the docs-only test-flow exemption in the project SOP guidance.
|
||||
- Hardened route/bootstrap registration around a declarative manifest and centralized validation seam so startup wiring is less fragile under delayed readiness and import-order edge cases.
|
||||
- Completed the next config-unification pass around one effective-config read facade, reducing precedence drift across backend and frontend-facing config consumers.
|
||||
- Centralized legacy compatibility handling for backend headers and frontend API/storage fallbacks so deprecation behavior is explicit, shared, and regression-covered.
|
||||
|
||||
@@ -1,27 +1,26 @@
|
||||
# Residual Security Execution Chain
|
||||
|
||||
Date: 2026-04-08
|
||||
Roadmap chain: `S88 -> S89 -> S90 -> S91`
|
||||
|
||||
## 1. Purpose
|
||||
|
||||
This document mirrors the active execution chain for the remaining GitHub Security findings after the first remediation wave and the initial residual follow-up fixes.
|
||||
This document summarizes the public security closeout status for the remaining GitHub Security findings after the first remediation wave and the initial residual follow-up fixes.
|
||||
|
||||
It is intended as a repo-visible planning reference in `docs/` and should stay aligned with `.planning/roadmap.md` and `.planning/roadmap/open/SECURITY_OPEN.md`.
|
||||
Maintainer-only execution records remain internal; this page is limited to public-facing status and remediation areas.
|
||||
|
||||
## 2. Active Item Order
|
||||
## 2. Remediation Areas
|
||||
|
||||
1. `S88`: GitHub Security residual alert verification, dismissal, and closure execution wave
|
||||
2. `S89`: Residual audit and bridge alert retirement sweep
|
||||
3. `S90`: Residual model-manager path-boundary false-positive retirement wave
|
||||
4. `S91`: GitHub code-scanning mode switch and final residual alert closure wave
|
||||
1. GitHub Security residual alert verification, dismissal, and closure execution wave.
|
||||
2. Residual audit and bridge alert retirement sweep.
|
||||
3. Residual model-manager path-boundary false-positive retirement wave.
|
||||
4. GitHub code-scanning mode switch and final residual alert closure wave.
|
||||
|
||||
## 3. Final State
|
||||
|
||||
- `S88` is completed. Authenticated GitHub verification confirmed the repaired findings retired or were closed with explicit rationale after the advanced CodeQL switch.
|
||||
- `S89` is completed. The audit and bridge identifier cleanup removed the true residual sinks and reduced the remaining audit findings to GitHub-managed false positives.
|
||||
- `S90` is completed. The model-manager path-boundary proof stayed fail-closed, and the remaining `py/path-injection` alerts were retired through authenticated false-positive dismissal after the advanced rescan.
|
||||
- `S91` is completed. GitHub code scanning default setup was switched off, the committed `.github/workflows/codeql.yml` run on `main` succeeded, the final residual CodeQL alerts were dismissed with recorded rationale, and the historical secret-scanning docs example was resolved.
|
||||
- Authenticated GitHub verification confirmed the repaired findings retired or were closed with explicit rationale after the advanced CodeQL switch.
|
||||
- The audit and bridge identifier cleanup removed the true residual sinks and reduced the remaining audit findings to GitHub-managed false positives.
|
||||
- The model-manager path-boundary proof stayed fail-closed, and the remaining `py/path-injection` alerts were retired through authenticated false-positive dismissal after the advanced rescan.
|
||||
- GitHub code scanning default setup was switched off, the committed `.github/workflows/codeql.yml` run on `main` succeeded, the final residual CodeQL alerts were dismissed with recorded rationale, and the historical secret-scanning docs example was resolved.
|
||||
|
||||
## 4. Execution Rules
|
||||
|
||||
|
||||
@@ -34,7 +34,7 @@
|
||||
|
||||
## Compatibility Anchor Policy
|
||||
|
||||
- The authoritative compatibility reference points are recorded in [`compatibility_matrix.md`](/mnt/c/Users/Ray/Documents/我的專案/ComfyUI-OpenClaw/docs/release/compatibility_matrix.md).
|
||||
- The authoritative compatibility reference points are recorded in [`compatibility_matrix.md`](compatibility_matrix.md).
|
||||
- `ComfyUI`, standalone `ComfyUI_frontend`, and `desktop` are tracked as separate host surfaces.
|
||||
- Desktop should not be assumed to match standalone frontend HEAD; the embedded frontend version may intentionally lag and must be evaluated against its own recorded bundle anchor.
|
||||
- Upstream reference refreshes should update the matrix anchors before being treated as the new default support baseline.
|
||||
|
||||
@@ -185,7 +185,7 @@ Example commands:
|
||||
|
||||
```bash
|
||||
python scripts/run_crypto_lifecycle_drills.py --pretty
|
||||
python scripts/run_crypto_lifecycle_drills.py --scenarios planned_rotation,emergency_revoke --output .planning/logs/crypto_drills.json --pretty
|
||||
python scripts/run_crypto_lifecycle_drills.py --scenarios planned_rotation,emergency_revoke --output crypto_drills.json --pretty
|
||||
```
|
||||
|
||||
Evidence bundle contract (JSON):
|
||||
|
||||
+1
-2
@@ -10,11 +10,10 @@
|
||||
- `docs/connector.md`
|
||||
- `docs/security_deployment_guide.md`
|
||||
- `docs/security_key_lifecycle_sop.md`
|
||||
- `.planning/roadmap.md` (latest implementation status and remaining work)
|
||||
|
||||
## Status Note
|
||||
|
||||
- Bridge APIs and connector runtime are available.
|
||||
- Connector/sidecar runtime remains an optional attached subsystem; the primary package artifact is the ComfyUI custom node pack.
|
||||
- Connector extraction remains a no-go-for-split-now decision until the shared installation/callback/delivery/reply-visibility/config seams are independently versioned; see `docs/adr/ADR-0003-connector-extraction-feasibility-and-seams.md`.
|
||||
- Standalone sidecar/gateway evolution is tracked in `.planning/roadmap.md`.
|
||||
- Standalone sidecar/gateway evolution is tracked in maintainer roadmap records.
|
||||
|
||||
@@ -72,7 +72,7 @@ If a result ref only exposes an upstream asset-service identifier and cannot be
|
||||
What this means:
|
||||
|
||||
- `asset_api_required` is a bounded compatibility state, not a generic parser failure.
|
||||
- Classic history refs and hash-backed refs that still map onto `/view` should continue to preview normally.
|
||||
- Classic history refs and hash-backed refs exposed as `asset_hash` or `hash` that still map onto `/view` should continue to preview normally.
|
||||
- If an operator workflow starts depending on direct asset-service identifiers, treat that as a contract gap and review [`docs/asset_api_adoption_decision.md`](asset_api_adoption_decision.md) before widening the runtime dependency.
|
||||
|
||||
## Verify audit-chain continuity after restart or rotation
|
||||
|
||||
Reference in New Issue
Block a user