feat(security): add dedicated install flags decoupled from security_level

Gate 'install via git URL' and 'install via pip' with dedicated opt-in
boolean flags (allow_git_url_install / allow_pip_install) in config.ini
[default], fully replacing the security_level term on those surfaces
(REPLACE, not AND — a strict level no longer denies when the flag is on;
a weak level no longer allows when the flag is off).

- glob/manager_server.py: pure predicate is_dedicated_install_allowed
  (flag AND loopback, request-time args.listen); REPLACE gates at
  /customnode/install/git_url and /customnode/install/pip; batch
  unknown-URL arm routes through the same full predicate at the risky
  position (loopback term is load-bearing — the middle entry gate has
  no network-position term; the entry gate itself stays in force);
  unknown-pip in batch stays unconditionally blocked; new
  SECURITY_MESSAGE_FLAG_* denial constants name the responsible flag;
  security_403_response gains flag_token (comfyui_outdated keeps precedence)
- glob/manager_core.py: register both keys (read via get_bool default-false,
  write list, exception fallback); "true"-only truthy; restart-only activation
- js/common.js: 403 dialog copy names the responsible flag at the two
  install call sites
- README.md: security-policy docs for both flags (per-surface scope incl.
  the batch entry-gate qualifier, REPLACE decoupling, loopback bound,
  opt-in config snippet, default-deny + migration note); stale tier lists
  corrected against the actual gates
- CHANGELOG.md: opt-in migration note + accepted residual risk (flags
  bypass the forced-strong outdated-ComfyUI hardening on loopback,
  opt-in only), decoupling claim qualified for the batch entry gate

Tests: unit suite (predicate truth table, REPLACE litmus both directions,
AST binding-proofs against live handlers, subprocess-isolated config
contract) plus a real-server E2E suite that mounts the Manager-under-test
via git worktree (exact-SHA pin, detached) against a real ComfyUI and
exercises both flag surfaces and both arms — deny arms (403 + flag-naming
body/log + no install artifact), git-URL allow arm (real clone), pip allow
arm as a two-phase reservation oracle — with zero-residual self-clean.
Module skips without E2E_COMFYUI_ROOT; unit suite unaffected.

The manager-v4 branch ships the identical policy (shared invariants +
config contract); this tree uses the degraded predicate 'flag AND
loopback' (no personal_cloud-equivalent mode here).

Author: ltdrdata

CHANGELOG.md

@@ -0,0 +1,56 @@
+# Changelog
+
+## Unreleased
+
+### Security policy: dedicated install flags (`allow_git_url_install` / `allow_pip_install`)
+
+Two new boolean keys in `config.ini` (`[default]` section), both defaulting to
+`false`, now govern the arbitrary-install surfaces:
+
+| Flag | Governs |
+|------|---------|
+| `allow_git_url_install` | `POST /customnode/install/git_url` and the unknown-git-URL arm of `POST /manager/queue/install` (incl. reinstall delegation) — the entire install transaction, transitive dependency pip installs included. On the batch queue path the flag applies **in addition to** the queue's `security_level` entry gate (see below) |
+| `allow_pip_install` | `POST /customnode/install/pip` only |
+
+These surfaces additionally require a **loopback listener** (`--listen` on a
+local IP); the flags never open a non-loopback deployment. On the two
+**direct** endpoints (`POST /customnode/install/git_url` and
+`POST /customnode/install/pip`), the flags fully **decouple** the surface
+from `security_level`: it no longer has any effect in either direction — a
+strict level cannot deny them when the flag is `true`, and a weak level
+cannot allow them when the flag is `false`. On the **batch queue path**
+(`POST /manager/queue/install`), the flag is **necessary but not
+sufficient**: it gates the unknown-git-URL arm at the risky position, while
+the queue's normal `security_level` entry gate (`middle`) remains in force —
+at `security_level = strong`, batch unknown-URL installs stay denied even
+with the flag set to `true`. `security_level` continues to govern every
+other gated endpoint unchanged. Only the case-insensitive string `true`
+enables a flag; a missing or malformed key reads as `false`.
+
+#### Migration note (no auto-seed)
+
+There is **no automatic migration** from `security_level`. Users who
+previously relied on `security_level = weak` (or `normal-`) to use
+install-via-git-URL / install-pip must now **opt in explicitly** by adding to
+`config.ini`:
+
+```ini
+[default]
+allow_git_url_install = true
+allow_pip_install = true
+```
+
+Changes take effect after a **restart** (no hot reload).
+
+#### Residual-risk note — outdated ComfyUI behavior change
+
+On outdated ComfyUI versions (no system-user API), the manager previously
+forced `security_level = strong`, which unconditionally denied the
+git-URL/pip install surfaces. After this change those surfaces are governed
+by the new flags instead: an operator who explicitly sets a flag to `true`
+on a **loopback** listener can now perform installs on outdated ComfyUI
+where the forced-strong policy previously denied them. This is an accepted,
+deliberate trade-off: it requires explicit operator opt-in, remains bounded
+to loopback listeners, and the flag-deny path on outdated ComfyUI still
+surfaces the `comfyui_outdated` notice. If you operate an outdated ComfyUI
+deployment, leave both flags at their default `false` and update ComfyUI.

README.md

@@ -384,19 +384,79 @@ When you run the `scan.sh` script:
       * all feature is available
     
   * `high` level risky features
-    * `Install via git url`, `pip install`
-    * Installation of custom nodes registered not in the `default channel`.
-    * Fix custom nodes
+    * Downloading models that are not in `.safetensors` format and not
+      registered in the `default channel` model list
+    * NOTE: `Install via git url`, `pip install`, and installation of custom nodes
+      not registered in the `default channel` are **no longer governed by
+      `security_level`** — they are governed by the dedicated install flags
+      described below.
   
   * `middle` level risky features
     * Uninstall/Update
     * Installation of custom nodes registered in the `default channel`.
+    * Fix custom nodes
     * Restore/Remove Snapshot
     * Restart
   
   * `low` level risky features
     * Update ComfyUI
 
+### Dedicated install flags: `allow_git_url_install` / `allow_pip_install`
+
+The two arbitrary-install surfaces are governed by dedicated boolean keys in
+`config.ini` (`[default]` section), fully **decoupled** from `security_level`:
+
+  * `allow_git_url_install`
+    * governs `Install via Git URL` (`POST /customnode/install/git_url`) **and**
+      the unknown-git-URL arm of the batch install queue
+      (`POST /manager/queue/install`, including reinstall delegation) — i.e.
+      installing any custom node from a git URL that is not registered in the
+      `default channel` catalog
+    * on the **batch queue path**, the flag is **necessary but not
+      sufficient**: the queue's normal `security_level` entry gate (`middle`)
+      must ALSO pass — at `security_level = strong`, batch unknown-URL
+      installs stay denied even with the flag set to `true` (only the direct
+      `Install via Git URL` endpoint is fully independent of `security_level`)
+    * covers the **entire install transaction** it starts, including the
+      pack's transitive dependency pip installs
+  * `allow_pip_install`
+    * governs **only** the standalone `pip install` feature
+      (`POST /customnode/install/pip`)
+
+Key properties:
+
+  * **Decoupled from `security_level` (replace, not and)** — on the two
+    **direct endpoints** (`Install via Git URL` and `pip install`),
+    `security_level` no longer has any effect in either direction: a strict
+    level cannot deny them when the flag is `true`, and a weak level cannot
+    allow them when the flag is `false`. (The batch queue path keeps its
+    `security_level` entry gate in ADDITION to the flag — see the scope bullet
+    above.) Every other gated feature remains governed by `security_level` as
+    described above.
+  * **Loopback only** — the flags take effect **only** when the server listens
+    on a loopback address (e.g. `--listen 127.0.0.1`). On a non-loopback
+    listener these surfaces stay denied regardless of the flags; the flags
+    never widen the exposure of a public deployment.
+  * **Default deny / explicit opt-in** — both flags default to `false`. Only
+    the case-insensitive string `true` enables a flag; a missing or malformed
+    key reads as `false`.
+
+To opt in, edit `config.ini`:
+
+```ini
+[default]
+allow_git_url_install = true
+allow_pip_install = true
+```
+
+Changes take effect after a **restart** (no hot reload).
+
+> **Migration note**: there is no automatic migration from `security_level`.
+> If you previously relied on `security_level = weak` (or `normal-`) to use
+> install-via-git-URL / pip install, you must opt in explicitly with the flags
+> above. See `CHANGELOG.md` for details, including a behavior note for
+> outdated ComfyUI deployments.
+
 
 # Disclaimer
 

glob/manager_core.py

@@ -1699,6 +1699,8 @@ def write_config():
         'always_lazy_install': get_config()['always_lazy_install'],
         'network_mode': get_config()['network_mode'],
         'db_mode': get_config()['db_mode'],
+        'allow_git_url_install': get_config()['allow_git_url_install'],
+        'allow_pip_install': get_config()['allow_pip_install'],
     }
 
     # Sanitize all string values to prevent CRLF injection attacks
@@ -1745,6 +1747,8 @@ def get_bool(key, default_value):
                     'network_mode': default_conf.get('network_mode', 'public').lower(),
                     'security_level': default_conf.get('security_level', 'normal').lower(),
                     'db_mode': default_conf.get('db_mode', 'cache').lower(),
+                    'allow_git_url_install': get_bool('allow_git_url_install', False),
+                    'allow_pip_install': get_bool('allow_pip_install', False),
                }
         manager_migration.force_security_level_if_needed(result)
         return result
@@ -1774,6 +1778,8 @@ def get_bool(key, default_value):
             'network_mode': 'public',   # public | private | offline
             'security_level': 'normal', # strong | normal | normal- | weak
             'db_mode': 'cache',         # local | cache | remote
+            'allow_git_url_install': False,
+            'allow_pip_install': False,
         }
         manager_migration.force_security_level_if_needed(result)
         return result

glob/manager_server.py

@@ -35,6 +35,8 @@
 SECURITY_MESSAGE_NORMAL_MINUS = "ERROR: To use this feature, you must either set '--listen' to a local IP and set the security level to 'normal-' or lower, or set the security level to 'middle' or 'weak'. Please contact the administrator.\nReference: https://github.com/ltdrdata/ComfyUI-Manager#security-policy"
 SECURITY_MESSAGE_GENERAL = "ERROR: This installation is not allowed in this security_level. Please contact the administrator.\nReference: https://github.com/ltdrdata/ComfyUI-Manager#security-policy"
 SECURITY_MESSAGE_NORMAL_MINUS_MODEL = "ERROR: Downloading models that are not in '.safetensors' format is only allowed for models registered in the 'default' channel at this security level. If you want to download this model, set the security level to 'normal-' or lower."
+SECURITY_MESSAGE_FLAG_GIT_URL = "ERROR: This action requires 'allow_git_url_install = true' in config.ini ([default] section). This setting is independent of security_level. Reference: https://github.com/ltdrdata/ComfyUI-Manager#security-policy"
+SECURITY_MESSAGE_FLAG_PIP = "ERROR: This action requires 'allow_pip_install = true' in config.ini ([default] section). This setting is independent of security_level. Reference: https://github.com/ltdrdata/ComfyUI-Manager#security-policy"
 
 routes = PromptServer.instance.routes
 
@@ -82,6 +84,19 @@ def is_loopback(address):
     except ValueError:
         return False
 
+
+def is_dedicated_install_allowed(flag_value: bool, listen_address: str) -> bool:
+    """P-direct predicate (adopter-degraded form): flag AND loopback.
+
+    Pure helper for the dedicated install flags
+    (allow_git_url_install / allow_pip_install) — callers pass the
+    flag value from their own config read and the listener address
+    from the CLI arguments (request-time evaluation; the import-time
+    snapshot above is NOT consulted).
+    """
+    return bool(flag_value) and is_loopback(listen_address)
+
+
 is_local_mode = is_loopback(args.listen)
 
 
@@ -305,10 +320,18 @@ def setup_environment():
 import urllib.request
 
 
-def security_403_response():
-    """Return appropriate 403 response based on ComfyUI version."""
+def security_403_response(flag_token=None):
+    """Return appropriate 403 response based on ComfyUI version.
+
+    When `flag_token` is given (dedicated install flag denials), the
+    body names the responsible flag instead of "security_level". The
+    `comfyui_outdated` branch stays the FIRST check regardless, and
+    no-arg callers keep today's body byte-identical.
+    """
     if not manager_migration.has_system_user_api():
         return web.json_response({"error": "comfyui_outdated"}, status=403)
+    if flag_token is not None:
+        return web.json_response({"error": flag_token}, status=403)
     return web.json_response({"error": "security_level"}, status=403)
 
 
@@ -1384,7 +1407,17 @@ async def install_custom_node(request):
         else:
             return web.Response(status=404, text=f"Following node pack doesn't provide `nightly` version: ${git_url}")
 
-    if not is_allowed_security_level(risky_level):
+    if risky_level == 'high':
+        # unknown-URL arm: governed by the dedicated flag predicate
+        # (flag AND loopback, evaluated at request time). The loopback
+        # term is load-bearing here — the 'middle' entry gate above has
+        # no network-position term.
+        if not is_dedicated_install_allowed(core.get_config()['allow_git_url_install'], args.listen):
+            logging.error(SECURITY_MESSAGE_FLAG_GIT_URL)
+            return web.Response(status=404, text="A security error has occurred. Please check the terminal logs")
+    elif not is_allowed_security_level(risky_level):
+        # 'block' arm stays an unconditional deny (is_allowed_security_level
+        # returns False for 'block'); 'middle'/'low' arms unchanged.
         logging.error(SECURITY_MESSAGE_GENERAL)
         return web.Response(status=404, text="A security error has occurred. Please check the terminal logs")
 
@@ -1441,9 +1474,9 @@ async def fix_custom_node(request):
 
 @routes.post("/customnode/install/git_url")
 async def install_custom_node_git_url(request):
-    if not is_allowed_security_level('high'):
-        logging.error(SECURITY_MESSAGE_NORMAL_MINUS)
-        return security_403_response()
+    if not is_dedicated_install_allowed(core.get_config()['allow_git_url_install'], args.listen):
+        logging.error(SECURITY_MESSAGE_FLAG_GIT_URL)
+        return security_403_response(flag_token='allow_git_url_install')
 
     url = await request.text()
     res = await core.gitclone_install(url)
@@ -1461,9 +1494,9 @@ async def install_custom_node_git_url(request):
 
 @routes.post("/customnode/install/pip")
 async def install_custom_node_pip(request):
-    if not is_allowed_security_level('high'):
-        logging.error(SECURITY_MESSAGE_NORMAL_MINUS)
-        return security_403_response()
+    if not is_dedicated_install_allowed(core.get_config()['allow_pip_install'], args.listen):
+        logging.error(SECURITY_MESSAGE_FLAG_PIP)
+        return security_403_response(flag_token='allow_pip_install')
 
     packages = await request.text()
     core.pip_install(packages.split(' '))

js/common.js

@@ -232,7 +232,7 @@ export async function install_pip(packages) {
 	});
 
 	if(res.status == 403) {
-		await handle403Response(res);
+		await handle403Response(res, "To use this feature, set 'allow_pip_install = true' in config.ini ([default] section). This setting is independent of security_level.");
 		return;
 	}
 
@@ -267,7 +267,7 @@ export async function install_via_git_url(url, manager_dialog) {
 	});
 
 	if(res.status == 403) {
-		await handle403Response(res);
+		await handle403Response(res, "To use this feature, set 'allow_git_url_install = true' in config.ini ([default] section). This setting is independent of security_level.");
 		return;
 	}
 

tests/conftest.py

@@ -0,0 +1,41 @@
+"""Test-runner guard for the GOAL #32 tests/ modules.
+
+WHY THIS FILE EXISTS (collection hazard, not test logic):
+
+The repo root contains ``__init__.py`` — the ComfyUI plugin entrypoint —
+which at import time appends ``glob/`` to sys.path and imports
+``manager_server`` (which needs ``folder_paths`` / ``comfy.cli_args`` /
+a constructed ``PromptServer``). pytest 8 collects any ancestor
+directory that carries an ``__init__.py`` as a ``Package`` node and
+IMPORTS that ``__init__.py`` during test setup (observed module name:
+``__init__``). Outside a live ComfyUI process that import can never
+succeed, so EVERY test under tests/ errors at setup — including the
+pre-existing tests/test_csrf_content_type_helper.py — whenever pytest's
+rootdir ends up at or above the repo root (e.g. running inside a git
+worktree nested under the parent checkout).
+
+The guard below pre-seeds ``sys.modules`` with an inert stub whose
+``__file__`` matches the real path, so pytest's
+``import_path(<repo-root>/__init__.py)`` resolves to the stub without
+executing the plugin entrypoint. Conftest files load before the setup
+phase, so the stub is always in place in time. This does NOT touch
+production code and does NOT alter what the tests import themselves
+(they use AST-extraction / subprocess isolation per the
+tests/test_csrf_content_type_helper.py precedent — ``glob/`` is never
+added to the runner's sys.path).
+"""
+import sys
+import types
+from pathlib import Path
+
+_REPO_ROOT = Path(__file__).resolve().parent.parent
+_ROOT_INIT = _REPO_ROOT / "__init__.py"
+
+if _ROOT_INIT.exists() and "__init__" not in sys.modules:
+    _stub = types.ModuleType("__init__")
+    _stub.__file__ = str(_ROOT_INIT)
+    _stub.__doc__ = (
+        "Inert stand-in for the ComfyUI-Manager plugin entrypoint; "
+        "see tests/conftest.py for rationale."
+    )
+    sys.modules["__init__"] = _stub