[GH-ISSUE #3128] Batch install/uninstall map every 404 to the "default channel" message, masking the real denial reason #1107

New issue

Closed

opened 2026-10-27 21:25:50 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-27 21:25:50 +00:00

Owner

Originally created by @plz12345 on GitHub (Aug 4, 2026).
Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3128

Version: ComfyUI-Manager 3.41, commit d404e623 (clean main, unmodified checkout)

Summary

Two denial-diagnostics defects that compound. A user blocked by the loopback term of allow_git_url_install is told their channel / security level is the problem, and the log line the dialog defers to tells them to enable a setting that is already enabled. Following both messages exactly leaves you stuck, with no indication of the actual gate.

This is about the messaging only — the loopback bound itself is intentional per #2991.

1. `/manager/queue/install` discards the server's 404 body

The server returns a distinguishable body (glob/manager_server.py:1498 and :1503):

return web.Response(status=404, text="A security error has occurred. Please check the terminal logs")

The client throws it away (js/custom-nodes-manager.js:1484):

} else if(res.status == 404) {
    errorMsg += `With the current security level configuration, only custom nodes from the <B>"default channel"</B> can be installed.\n`;
} else {
    errorMsg += await res.text() + '\n';
}

The else branch immediately below already does the right thing.

The substituted copy points at security_level and channel configuration, and neither can resolve this denial. The risky_level == 'high' arm routes through is_dedicated_install_allowed() and never consults security_level at all — setting security_level = weak changes nothing. That is a false lead users do follow.

The uninstall path has the same defect at js/common.js:667.

For contrast, the dedicated /customnode/install/git_url surface handles this correctly: 403, with js/common.js:274 naming the responsible flag. Only the batch path is affected.

2. `SECURITY_MESSAGE_FLAG_GIT_URL` omits the loopback requirement

glob/manager_server.py:40:

ERROR: This action requires 'allow_git_url_install = true' in config.ini ([default] section). This setting is independent of security_level.

But the predicate is flag AND loopback (glob/manager_server.py:90):

def is_dedicated_install_allowed(flag_value: bool, listen_address: str) -> bool:
    return bool(flag_value) and is_loopback(listen_address)

With allow_git_url_install = True and --listen 0.0.0.0, that message is emitted verbatim — instructing the user to set a value that is already true, and never mentioning the network-position requirement. SECURITY_MESSAGE_FLAG_PIP has the same omission. By comparison, SECURITY_MESSAGE_NORMAL_MINUS does spell out its --listen condition.

I suspect this accounts for a fair share of the traffic on #3023: many reports there are of the form "I set it to true and it still doesn't work", which is exactly what this message produces on a non-loopback listener.

Reproduction

user/__manager/config.ini:

[default]
security_level = normal
allow_git_url_install = True

Launch: python main.py --listen 0.0.0.0 --port 8188

Install any node pack whose repo URL is not in custom-node-list.json, from the Custom Nodes Manager UI.

Actual

Dialog: [Installation Errors] '<pack>': With the current security level configuration, only custom nodes from the "default channel" can be installed.
Log: ERROR: This action requires 'allow_git_url_install = true' in config.ini ([default] section). — while it is already True.

Expected

A message naming the gate that actually fired, e.g. "Install via git URL requires allow_git_url_install = true AND ComfyUI listening on a loopback address (currently: 0.0.0.0)."

Suggested fix

js/custom-nodes-manager.js:1484 and js/common.js:667: surface await res.text() for 404 as the else branch does, or give the two 404 arms distinct copy.
SECURITY_MESSAGE_FLAG_GIT_URL / SECURITY_MESSAGE_FLAG_PIP: state the loopback requirement alongside the flag, ideally including the current --listen value.

Originally created by @plz12345 on GitHub (Aug 4, 2026). Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3128 **Version:** ComfyUI-Manager 3.41, commit `d404e623` (clean `main`, unmodified checkout) ## Summary Two denial-diagnostics defects that compound. A user blocked by the loopback term of `allow_git_url_install` is told their **channel / security level** is the problem, and the log line the dialog defers to tells them to enable a setting that is **already enabled**. Following both messages exactly leaves you stuck, with no indication of the actual gate. This is about the messaging only — the loopback bound itself is intentional per #2991. ## 1. `/manager/queue/install` discards the server's 404 body The server returns a distinguishable body (`glob/manager_server.py:1498` and `:1503`): ```python return web.Response(status=404, text="A security error has occurred. Please check the terminal logs") ``` The client throws it away (`js/custom-nodes-manager.js:1484`): ```js } else if(res.status == 404) { errorMsg += `With the current security level configuration, only custom nodes from the <B>"default channel"</B> can be installed.\n`; } else { errorMsg += await res.text() + '\n'; } ``` The `else` branch immediately below already does the right thing. The substituted copy points at `security_level` and channel configuration, and **neither can resolve this denial**. The `risky_level == 'high'` arm routes through `is_dedicated_install_allowed()` and never consults `security_level` at all — setting `security_level = weak` changes nothing. That is a false lead users do follow. The uninstall path has the same defect at `js/common.js:667`. For contrast, the dedicated `/customnode/install/git_url` surface handles this correctly: 403, with `js/common.js:274` naming the responsible flag. Only the batch path is affected. ## 2. `SECURITY_MESSAGE_FLAG_GIT_URL` omits the loopback requirement `glob/manager_server.py:40`: > ERROR: This action requires 'allow_git_url_install = true' in config.ini ([default] section). This setting is independent of security_level. But the predicate is flag **AND** loopback (`glob/manager_server.py:90`): ```python def is_dedicated_install_allowed(flag_value: bool, listen_address: str) -> bool: return bool(flag_value) and is_loopback(listen_address) ``` With `allow_git_url_install = True` and `--listen 0.0.0.0`, that message is emitted verbatim — instructing the user to set a value that is already `true`, and never mentioning the network-position requirement. `SECURITY_MESSAGE_FLAG_PIP` has the same omission. By comparison, `SECURITY_MESSAGE_NORMAL_MINUS` does spell out its `--listen` condition. I suspect this accounts for a fair share of the traffic on #3023: many reports there are of the form "I set it to true and it still doesn't work", which is exactly what this message produces on a non-loopback listener. ## Reproduction `user/__manager/config.ini`: ```ini [default] security_level = normal allow_git_url_install = True ``` Launch: `python main.py --listen 0.0.0.0 --port 8188` Install any node pack whose repo URL is not in `custom-node-list.json`, from the Custom Nodes Manager UI. **Actual** - Dialog: `[Installation Errors] '<pack>': With the current security level configuration, only custom nodes from the "default channel" can be installed.` - Log: `ERROR: This action requires 'allow_git_url_install = true' in config.ini ([default] section).` — while it is already `True`. **Expected** A message naming the gate that actually fired, e.g. *"Install via git URL requires `allow_git_url_install = true` AND ComfyUI listening on a loopback address (currently: 0.0.0.0)."* ## Suggested fix - `js/custom-nodes-manager.js:1484` and `js/common.js:667`: surface `await res.text()` for 404 as the `else` branch does, or give the two 404 arms distinct copy. - `SECURITY_MESSAGE_FLAG_GIT_URL` / `SECURITY_MESSAGE_FLAG_PIP`: state the loopback requirement alongside the flag, ideally including the current `--listen` value.

bsakaguchi closed this issue

2026-10-27 21:25:50 +00:00

bsakaguchi commented

2026-10-27 21:25:51 +00:00

Author

Owner

@ltdrdata commented on GitHub (Aug 15, 2026):

Resolved by #3157 and #3161.

@ltdrdata commented on GitHub (Aug 15, 2026): Resolved by #3157 and #3161.

bsakaguchi referenced this issue

2026-10-28 21:03:34 +00:00

[PR #1107] [MERGED] Update custom-node-list.json #1712