Add ComfyUI-LeafFlow

[KOFiblto]

Summary

Adds ComfyUI-LeafFlow to the custom node list.

• Repository: https://github.com/KOFiblto/ComfyUI-LeafFlow
• Author: KOFiblto
• Category: Flow Control, Queue Management, Visual Loaders & Utilities
• Description: Essential workflow controls: mid-generation pause, persistent queue auto-recovery, visual LoRA/image loaders with Civitai/TMDB scraping, multiline prompt queue iterator, and interactive decision nodes with desktop notifications.
• Compatibility: Fully tested with ComfyUI Frontend V1 (LiteGraph) and Frontend V2 (Vue UI), across Windows, Linux, and macOS.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

💤 Files selected but had no reviewable changes (1)

• custom-node-list.json

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9cfc8400-b031-461f-b3a6-986cc814e1c9

📥 Commits

Reviewing files that changed from the base of the PR and between f39cbd5 and 367a753.

📒 Files selected for processing (1)

• custom-node-list.json

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ltdrdata]

This pack exposes network-reachable routes with no access control, including ones that shut down and restart the server, return files by absolute path, and overwrite settings/environment.

• queue_control.py:500-508 (shutdown/restart), image_loader.py:230 (file read), settings route (.env write)

Please remove the shutdown/restart/settings routes or make them local-only, and confine the file read to a fixed base directory. I'll re-evaluate once constrained.

[KOFiblto]

Thank you for the security audit and clear feedback @ltdrdata!

I have updated the codebase on \main\ to address all points:

1. Shutdown / Restart / Power Control Routes: Restricted strictly to local loopback requests (\127.0.0.1\ / ::1\ / \localhost), returning \403 Forbidden\ for any remote callers.
2. Image Loader & File Reading Endpoints: Made local-only and strictly confined to ComfyUI's approved base directories (\input, \output, and \ emp) with canonical path traversal checks (\is_safe_path\ / \os.path.commonpath).
3. Settings & .env\ Routes: Restricted to local loopback access only with strict input sanitization against newline injection.
4. Import-Time Subprocess Execution: Completely removed import-time \pip install\ subprocess calls.

Please let me know if any further adjustments are needed. Thank you!

[KOFiblto]

Hi @ltdrdata,

Following your initial review, I also did a full audit of the codebase against the official ComfyUI Registry and security guidelines and proactively fixed a few additional compliance items:

• Deleted legacy install.py & added requirements.txt: Removed runtime pip install subprocess execution and replaced it with a standard requirements.txt (Pillow, piexif, numpy, pystray).
• Cleaned pyproject.toml: Removed "torch" from project dependencies to prevent environment/CUDA conflicts on install.
• Secured /leafflow/decision & LoRA Loader endpoints: Added is_local_request loopback protection so interactive decision controls and LoRA endpoints cannot be triggered by remote network clients.
• Opt-in Scraping: Changed default preview metadata scraping to disabled by default (false) to ensure no background network requests occur without explicit user enablement.

Everything has been tested and pushed to main. Thanks again for taking the time to review and helping me abide by the rules! Hopefully I fixed everything, and if not I will obviously fix it.

KOFiblto