| # What NOT to upload to the Comfy registry. `comfy node publish` zips the | |
| # git-tracked tree and honours this file (comfy_cli/file_utils.py:zip_files, | |
| # gitignore syntax). Everything here stays in git and stays on GitHub -- this | |
| # only trims the published artifact. | |
| # | |
| # `tools/` is the development test harness. Nothing under it is imported at | |
| # runtime, and it is where two of the three findings that got 1.0.0 Flagged | |
| # live -- the process spawn in check_all.py and the dynamic import in | |
| # check_planner.py. The registry's YARA scan has no taint analysis, so a test | |
| # runner starting pytest reads the same as a node shelling out at load. Not | |
| # shipping a test harness to end users is right on its own terms; clearing two | |
| # false positives is the bonus. | |
| # | |
| # The trigger words are described here rather than quoted, because this file | |
| # ships. Quoting them put them in the published zip, where the scanner reads | |
| # them exactly as it would read code. tools/check_publish.py enforces that. | |
| tools/ | |
| # 2.3 MB of documentation screenshots that no code path opens. README.md and | |
| # pyproject both reference them by absolute media.githubusercontent.com URL, so | |
| # the rendered listing is unaffected -- see the .gitattributes note about | |
| # raw.githubusercontent serving the LFS pointer instead of the image. | |
| docs/img/ | |
| # Developer documentation. CLAUDE.md is instructions for an agent working on | |
| # this repo and DEVLOG.md is 2000+ lines of build history; neither is of any use | |
| # to someone installing the pack, and both are on GitHub for anyone who wants | |
| # them. They also discuss the registry's own scan patterns by name, and 1.0.2 | |
| # proved that a scan finding can be raised against a sentence in a markdown | |
| # file: docs/DEVLOG.md:1966 was Flagged for quoting a class name while | |
| # explaining why it had been Flagged. README.md and PROMPTING.md still ship -- | |
| # those are for users. | |
| CLAUDE.md | |
| docs/DEVLOG.md | |
| # Session documents. These were written for whoever picks the work up next -- | |
| # a handoff between agents, a GPU test protocol, a deferred-engineering memo -- | |
| # and they are useful on GitHub for exactly that reason. They must not be in | |
| # the published artifact, because they name THIS machine -- the pack's install | |
| # path, a user Desktop, the ComfyUI log, the venv interpreter, the reference | |
| # stills of one specific graph, and the filename of a voice take belonging to | |
| # somebody who is not the installer. A published pack that tells a stranger | |
| # where somebody's desktop is has leaked something whatever else it does right. | |
| # | |
| # The paths are DESCRIBED and not written out, for the reason the header of | |
| # this file gives about scanner tokens: this file ships, so anything quoted in | |
| # it lands in the zip. tools/check_publish.py enforces that, and caught this | |
| # very comment quoting them on its first run. | |
| # | |
| # BETA_NOTES.md is here for a duller reason: it describes 1.2.0-beta1, is | |
| # marked superseded, and is not 2.0.0 user material. | |
| docs/GROK_TO_CLAUDE.md | |
| docs/GROK_V2_HANDBACK.md | |
| docs/GROK_V2_GPU_TESTS.md | |
| docs/POST_V2.md | |
| BETA_NOTES.md | |