fix: redact proxy credentials in startup log messages

Proxy URLs may contain userinfo (user:pass@host). Redact credentials
before logging to prevent them from appearing in the log stream that
is exposed via /internal/logs endpoints.

comfy/cli_args.py

@@ -231,6 +231,13 @@ parser.add_argument(
     help="Set the base URL for the ComfyUI API.  (default: https://api.comfy.org)",
 )
 
+parser.add_argument("--http-proxy", type=str, default=None, metavar="URL",
+    help="HTTP/HTTPS proxy URL (e.g. http://127.0.0.1:7890). Sets HTTP_PROXY and HTTPS_PROXY environment variables so all outbound traffic is routed through the proxy.")
+parser.add_argument("--https-proxy", type=str, default=None, metavar="URL",
+    help="HTTPS proxy URL. If not set, --http-proxy is used for both HTTP and HTTPS traffic.")
+parser.add_argument("--no-proxy", type=str, default=None, metavar="HOSTS",
+    help="Comma-separated list of hosts that should bypass the proxy (e.g. localhost,127.0.0.1,*.local).")
+
 database_default_path = os.path.abspath(
     os.path.join(os.path.dirname(__file__), "..", "user", "comfyui.db")
 )

main.py

@@ -22,13 +22,78 @@ from comfy_execution.utils import get_executing_context
 from comfy_api import feature_flags
 from app.database.db import init_db, dependencies_available
 
+def _apply_proxy_env_vars():
+    """Set proxy environment variables early so all HTTP libraries (aiohttp, requests,
+    urllib) and subprocesses (git, pip) automatically route through the proxy.
+
+    Priority: CLI args > settings file > existing environment variables.
+    """
+    import json as _json
+
+    http_proxy = args.http_proxy
+    https_proxy = args.https_proxy
+    no_proxy = args.no_proxy
+
+    # Fall back to settings file for any field not provided via CLI.
+    user_dir = args.user_directory or os.path.join(
+        args.base_directory or os.path.dirname(os.path.realpath(__file__)), "user"
+    )
+    settings_path = os.path.join(user_dir, "default", "comfy.settings.json")
+    if os.path.isfile(settings_path):
+        try:
+            with open(settings_path, "r") as f:
+                settings = _json.load(f)
+            http_proxy = http_proxy or settings.get("Comfy.Network.Proxy.HttpUrl") or ""
+            https_proxy = https_proxy or settings.get("Comfy.Network.Proxy.HttpsUrl") or ""
+            no_proxy = no_proxy or settings.get("Comfy.Network.Proxy.NoProxy") or ""
+        except Exception:
+            pass
+
+    def _set_proxy_var(name, value):
+        """Set env var, overriding inherited values when explicitly configured."""
+        os.environ[name] = value
+
+    if http_proxy:
+        _set_proxy_var('HTTP_PROXY', http_proxy)
+        _set_proxy_var('http_proxy', http_proxy)
+        # Use http_proxy for HTTPS too unless https_proxy is explicitly set
+        if not https_proxy:
+            _set_proxy_var('HTTPS_PROXY', http_proxy)
+            _set_proxy_var('https_proxy', http_proxy)
+    if https_proxy:
+        _set_proxy_var('HTTPS_PROXY', https_proxy)
+        _set_proxy_var('https_proxy', https_proxy)
+    if no_proxy:
+        _set_proxy_var('NO_PROXY', no_proxy)
+        _set_proxy_var('no_proxy', no_proxy)
+
+
 if __name__ == "__main__":
     #NOTE: These do not do anything on core ComfyUI, they are for custom nodes.
     os.environ['HF_HUB_DISABLE_TELEMETRY'] = '1'
     os.environ['DO_NOT_TRACK'] = '1'
 
+    _apply_proxy_env_vars()
+
 setup_logger(log_level=args.verbose, use_stdout=args.log_stdout)
 
+def _redact_proxy_url(url):
+    """Redact userinfo from proxy URL to avoid leaking credentials in logs."""
+    from urllib.parse import urlparse, urlunparse
+    try:
+        parsed = urlparse(url)
+        if parsed.username:
+            netloc = f"***:***@{parsed.hostname}" + (f":{parsed.port}" if parsed.port else "")
+            return urlunparse(parsed._replace(netloc=netloc))
+    except Exception:
+        pass
+    return url
+
+if os.environ.get('HTTP_PROXY'):
+    logging.info("HTTP proxy configured: %s", _redact_proxy_url(os.environ['HTTP_PROXY']))
+if os.environ.get('HTTPS_PROXY'):
+    logging.info("HTTPS proxy configured: %s", _redact_proxy_url(os.environ['HTTPS_PROXY']))
+
 faulthandler.enable(file=sys.stderr, all_threads=False)
 
 import comfy_aimdo.control