Security

Workflow packages

cwf inspect <package> reads:

• package.json
• comfy.workflow.json
• workflow.ir.json

It does not execute package JavaScript. ir.build.ts is build-time authoring source, not consumer discovery code. This is regression-tested with a fixture whose entry throws on import.

That boundary is why third-party workflow packages can be listed without running them.

Custom nodes

Custom nodes are executable Python. Installing them is equivalent to running someone else's code inside Comfy.

• inspect / init / run never install
• Only cwf setup installs, after a printed plan
• Default confirmation is No
• --yes still refuses UNKNOWN, AMBIGUOUS, unverified, and version-unsatisfied packs
• No arbitrary git/pip from manifests
• No shell strings; Manager argv is an array
• repository is informational

rawNode

Names a class the type system does not know. The implementation still has to exist in Comfy. rawNode is not a download primitive.

Remote setup

--url without --comfy cannot apply installs. No remote shell.

Models

Not downloaded. Models

Custom-node guide