dsh-comfyui 0.4.0 → 0.5.0

package/lib/routes.js

@@ -2,6 +2,7 @@ import { errorMessage, readJsonBody, readRawBody, sameOrigin, sendJson } from '.
 import { analyzeWorkflowParameters, comboChildInfo, inputOptions, numberSpecOf, refreshParameterMetadata, uploadKindOf } from './params.js';
 import { collectMedia, historyErrorMessage, mediaProxyUrl } from './comfyui.js';
 import { MAX_ASSET_BYTES, SKILL_MAIN, SKILL_PRESET_DIRS, joinFrontmatter, splitFrontmatter } from './skillpack.js';
+import { MAX_IMPORT_BYTES, analyzeImportPackage, applyImportPackage, buildExportPackage } from './transfer.js';
 import { unlink } from 'node:fs/promises';
 import { spawn } from 'node:child_process';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
@@ -936,6 +937,186 @@ export function mountComfyUIRoutes(ctx, runtime) {
             sendJson(response, 200, { ok: true });
         }),
     }));
+    // ── Workflow preset transfer (export / import) ──────────────────────────
+    // Export bundles selected library workflows (API format) with their
+    // parameters and skill packs into one .zip download; import parses an
+    // uploaded package and then writes the selection back as NEW workflows.
+    // The packaging, validation and pack writes live in transfer.ts — these
+    // routes only shape HTTP (same-origin, body cap, content types).
+    //
+    // The export body comes in two shapes on purpose: JSON `{ ids }` from a
+    // fetch caller, and an urlencoded form (`ids` repeated) from the panel's
+    // hidden-form submit — the panel downloads natively so the browser, not
+    // JS blob plumbing, owns the whole transfer.
+    //
+    // The native form download means the panel never sees the response body,
+    // so the facts of the last package ride back through `export/last`: the
+    // panel reads it right after submitting and reports what was ACTUALLY
+    // packaged, not what the checkboxes believed.
+    let lastExport = null;
+    disposers.push(webServer.register({
+        kind: 'exact',
+        path: '/comfyui/workflows/export/last',
+        handler: withHint(async (request, response) => {
+            if (!methodIs(request, 'GET')) {
+                sendJson(response, 405, { error: 'method not allowed' });
+                return;
+            }
+            sendJson(response, 200, { last: lastExport });
+        }),
+    }));
+    disposers.push(webServer.register({
+        kind: 'exact',
+        path: '/comfyui/workflows/export',
+        handler: withHint(async (request, response) => {
+            if (!methodIs(request, 'POST')) {
+                sendJson(response, 405, { error: 'method not allowed' });
+                return;
+            }
+            let ids;
+            const contentType = String(request.headers['content-type'] ?? '');
+            if (contentType.includes('application/x-www-form-urlencoded')) {
+                if (!sameOrigin(request)) {
+                    sendJson(response, 403, { error: 'forbidden: same-origin requests only' });
+                    return;
+                }
+                const raw = await readRawBody(request);
+                ids = [...new URLSearchParams(raw.toString('utf8')).getAll('ids')];
+            }
+            else {
+                const body = await readSameOriginPost(request, response);
+                if (body === undefined)
+                    return;
+                ids = body.ids;
+            }
+            const result = await buildExportPackage(runtime, ids);
+            if (!result.ok) {
+                sendJson(response, 400, { error: result.error });
+                return;
+            }
+            // Audit trail on purpose: download managers dedupe by URL, so "which
+            // file is which" became a live user question — the log answers it with
+            // the exact packaged set per request, and the receipt the panel shows
+            // carries the file name + size so a stale download can't masquerade as
+            // this export.
+            lastExport = { at: new Date().toISOString(), count: result.count, names: result.names, warnings: result.warnings, filename: result.filename, size: result.bytes.length };
+            ctx.logger.info(`comfyui: 导出 ${result.count} 个工作流 → ${result.filename}（${result.names.join('、')}）${result.warnings.length > 0 ? ` 警告：${result.warnings.join('；')}` : ''}`);
+            response.writeHead(200, {
+                'content-type': 'application/zip',
+                'content-length': String(result.bytes.length),
+                'cache-control': 'no-store',
+                // ASCII file name on purpose: it rides a Content-Disposition header
+                // without RFC 5987 encoding and stays readable on every OS.
+                'content-disposition': `attachment; filename="${result.filename}"`,
+            });
+            response.end(result.bytes);
+        }),
+    }));
+    // Native GET download: the file name rides IN the URL path. A download
+    // manager that derives the saved name from the URL, or re-fetches the URL
+    // itself, still lands on the correct name — and because the export is a
+    // pure read, on the genuine bytes for exactly these ids. This is the
+    // antidote to the intercepted-POST downloads that kept saving stale or
+    // renamed files on one setup (skills "sometimes missing" was those files).
+    // Exact routes above win for `/export` and `/export/last`; this prefix only
+    // sees `/export/<filename>`.
+    disposers.push(webServer.register({
+        kind: 'prefix',
+        path: '/comfyui/workflows/export',
+        handler: withHint(async (request, response) => {
+            if (!methodIs(request, 'GET')) {
+                sendJson(response, 405, { error: 'method not allowed' });
+                return;
+            }
+            const url = new URL(request.url ?? '/', 'http://localhost');
+            const filename = decodeURIComponent(url.pathname.slice('/comfyui/workflows/export/'.length));
+            // The name is client-supplied but strictly patterned: it only ever
+            // feeds a header value and the receipt, never a filesystem path.
+            if (!/^dsh-comfyui-presets-[0-9A-Za-z-]+\.zip$/.test(filename)) {
+                sendJson(response, 400, { error: 'bad export file name' });
+                return;
+            }
+            const result = await buildExportPackage(runtime, url.searchParams.getAll('ids'));
+            if (!result.ok) {
+                sendJson(response, 400, { error: result.error });
+                return;
+            }
+            lastExport = { at: new Date().toISOString(), count: result.count, names: result.names, warnings: result.warnings, filename, size: result.bytes.length };
+            ctx.logger.info(`comfyui: 导出 ${result.count} 个工作流 → ${filename}（${result.names.join('、')}）${result.warnings.length > 0 ? ` 警告：${result.warnings.join('；')}` : ''}`);
+            response.writeHead(200, {
+                'content-type': 'application/zip',
+                'content-length': String(result.bytes.length),
+                'cache-control': 'no-store',
+                'content-disposition': `attachment; filename="${filename}"`,
+            });
+            response.end(result.bytes);
+        }),
+    }));
+    // Import is two-phase with zero server-side staging: analyze parses the
+    // uploaded bytes and lists what the package offers; apply re-reads the
+    // same bytes the client still holds and writes the selection. Selection
+    // travels by manifest index (stable, because the same bytes are parsed
+    // again), which avoids URL-encoding arbitrary package ids.
+    disposers.push(webServer.register({
+        kind: 'exact',
+        path: '/comfyui/workflows/import/analyze',
+        handler: withHint(async (request, response) => {
+            if (!methodIs(request, 'POST')) {
+                sendJson(response, 405, { error: 'method not allowed' });
+                return;
+            }
+            if (!sameOrigin(request)) {
+                sendJson(response, 403, { error: 'forbidden: same-origin requests only' });
+                return;
+            }
+            const raw = await readRawBody(request);
+            if (raw.length > MAX_IMPORT_BYTES) {
+                sendJson(response, 413, { error: `预设包不能超过 ${Math.floor(MAX_IMPORT_BYTES / 1024 / 1024)} MB` });
+                return;
+            }
+            const result = analyzeImportPackage(raw);
+            if (!result.ok) {
+                sendJson(response, 400, { error: result.error });
+                return;
+            }
+            sendJson(response, 200, result);
+        }),
+    }));
+    disposers.push(webServer.register({
+        kind: 'exact',
+        path: '/comfyui/workflows/import/apply',
+        handler: withHint(async (request, response) => {
+            if (!methodIs(request, 'POST')) {
+                sendJson(response, 405, { error: 'method not allowed' });
+                return;
+            }
+            if (!sameOrigin(request)) {
+                sendJson(response, 403, { error: 'forbidden: same-origin requests only' });
+                return;
+            }
+            const url = new URL(request.url ?? '/', 'http://localhost');
+            const selected = (url.searchParams.get('select') ?? '')
+                .split(',')
+                .map((part) => Number.parseInt(part, 10))
+                .filter((index) => Number.isInteger(index) && index >= 0);
+            const raw = await readRawBody(request);
+            if (raw.length > MAX_IMPORT_BYTES) {
+                sendJson(response, 413, { error: `预设包不能超过 ${Math.floor(MAX_IMPORT_BYTES / 1024 / 1024)} MB` });
+                return;
+            }
+            try {
+                const result = await applyImportPackage(runtime, raw, selected);
+                if (!result.ok) {
+                    sendJson(response, 400, { error: result.error });
+                    return;
+                }
+                sendJson(response, 200, result);
+            }
+            catch (error) {
+                sendJson(response, 500, { error: errorMessage(error) });
+            }
+        }),
+    }));
     disposers.push(webServer.register({
         kind: 'exact',
         path: '/comfyui/workflows/run',

package/lib/skill.js

@@ -148,5 +148,6 @@ TTS-Audio-Suite（\`{comfyuiDir}/custom_nodes/tts_audio_suite\`）的"🎭 Chara
 - 面板"ComfyUI 端保存"分区列出每个图工作流：未提取显示"未提取"，已提取显示派生出的运行工作流列表。
 - 点**提取**：单分量直接拆；多分量弹出选项（分析报告 + 整体/按分量/主流程）。也可点**查看**看节点清单和 JSON。
 - 用户也可以不经过图，直接在插件库"新建工作流"粘贴 API JSON（或选择 .json 文件）作为运行工作流导入。
+- 工具栏"导出预设 / 导入预设"：导出把选中的运行工作流连同参数与技能包打包成一个 .zip 预设包；导入选中包内的工作流后**创建为新工作流**（重名自动加"（导入）"后缀），不会覆盖库里已有的工作流，技能包一并还原（超限文件会跳过并提示）。用户要换机 / 备份 / 分享工作流时引导用这对按钮。
 `,
 };

package/lib/skillpack.d.ts

@@ -16,9 +16,18 @@ export declare const MAX_FILE_BYTES: number;
 /** Imported binaries live in `assets/` and never enter the prompt as text, so
  * they get a larger budget than the documents the model reads verbatim. */
 export declare const MAX_ASSET_BYTES: number;
-/** A pack is documentation, not storage — these caps keep it that way. */
-export declare const MAX_PACK_FILES = 100;
+/** A pack is documentation, not storage — these caps keep it that way. The
+ * byte cap is the real storage guard; the file count only stops pathological
+ * noise, so it sits well above real bulk-copied packs (a ComfyUI music
+ * template library lands at 1000+ small .txt files and MUST survive a
+ * preset export → import round trip). */
+export declare const MAX_PACK_FILES = 2000;
 export declare const MAX_PACK_BYTES: number;
+/** Per-file size budget by extension: binaries never enter the prompt as
+ * text, so they get the larger budget wherever they live. Exported because
+ * the preset importer pre-filters oversized files per file (skip + warning)
+ * before handing the batch to {@link SkillPackStore.writeMany}. */
+export declare function sizeLimitOf(file: string): number;
 /** One file inside a pack. */
 export interface SkillFileInfo {
     /** Path relative to the pack root, always forward-slashed (`references/styles.md`). */
@@ -152,6 +161,16 @@ export declare class SkillPackStore {
      * can never bypass a limit the editor honours.
      */
     writeBytes(slug: string, path: string, bytes: Buffer): Promise<SkillPackResult<SkillPackInfo>>;
+    /** Bulk write for preset restore: ONE limit check for the whole batch
+     * instead of per-file enumeration. Per-file checks re-count the entire
+     * pack on every write, so restoring a 1000-file pack that way is O(n²)
+     * filesystem calls — a frozen-looking import for minutes. Grammar and
+     * per-file size limits are still enforced here; the batch is refused
+     * whole (the caller reports which file tripped), never written partially. */
+    writeMany(slug: string, entries: ReadonlyArray<{
+        path: string;
+        bytes: Buffer;
+    }>): Promise<SkillPackResult<SkillPackInfo>>;
     /** Read one file as raw bytes (the panel's image preview and downloads). */
     readBytes(slug: string, path: string): Promise<SkillPackResult<Buffer>>;
     /** Rename one file; SKILL.md is fixed and both sides are validated. */
@@ -247,6 +266,14 @@ export interface WorkflowSkillPacks {
         path: string;
         pack: WorkflowSkillPack;
     }>>;
+    /** Bulk restore path: every entry's `path` is already bucket-qualified
+     * (`references/x.txt` or `SKILL.md`). One limit check for the whole batch —
+     * see {@link SkillPackStore.writeMany} for why per-file checks are not
+     * good enough at 1000-file scale. */
+    importFiles(id: string, entries: ReadonlyArray<{
+        path: string;
+        bytes: Buffer;
+    }>): Promise<SkillPackResult<WorkflowSkillPack>>;
     writeFile(id: string, path: string, content: string): Promise<SkillPackResult<WorkflowSkillPack>>;
     renameFile(id: string, from: string, to: string): Promise<SkillPackResult<WorkflowSkillPack>>;
     deleteFile(id: string, path: string): Promise<SkillPackResult<WorkflowSkillPack>>;

package/lib/skillpack.js

@@ -23,7 +23,7 @@
  * follows.
  */
 import { mkdir, readFile, readdir, rename, rm, stat, unlink, writeFile } from 'node:fs/promises';
-import { isAbsolute, join, relative, resolve } from 'node:path';
+import { isAbsolute, dirname, join, relative, resolve } from 'node:path';
 /**
  * Sub-directories offered by default. These are suggestions, not a whitelist:
  * a pack may hold any directory whose name matches {@link DIR_NAME}, so a user
@@ -49,11 +49,25 @@ export const MAX_FILE_BYTES = 256 * 1024;
 /** Imported binaries live in `assets/` and never enter the prompt as text, so
  * they get a larger budget than the documents the model reads verbatim. */
 export const MAX_ASSET_BYTES = 4 * 1024 * 1024;
-/** A pack is documentation, not storage — these caps keep it that way. */
-export const MAX_PACK_FILES = 100;
+/** A pack is documentation, not storage — these caps keep it that way. The
+ * byte cap is the real storage guard; the file count only stops pathological
+ * noise, so it sits well above real bulk-copied packs (a ComfyUI music
+ * template library lands at 1000+ small .txt files and MUST survive a
+ * preset export → import round trip). */
+export const MAX_PACK_FILES = 2000;
 export const MAX_PACK_BYTES = 20 * 1024 * 1024;
-/** File names: letters, digits, CJK, dot, dash, underscore. No separators, no leading dot. */
-const FILE_NAME = /^[A-Za-z0-9_一-龥][A-Za-z0-9._一-龥-]{0,63}$/;
+/** Per-file size budget by extension: binaries never enter the prompt as
+ * text, so they get the larger budget wherever they live. Exported because
+ * the preset importer pre-filters oversized files per file (skip + warning)
+ * before handing the batch to {@link SkillPackStore.writeMany}. */
+export function sizeLimitOf(file) {
+    return ASSET_EXTENSIONS.includes(extensionOf(file)) ? MAX_ASSET_BYTES : MAX_FILE_BYTES;
+}
+/** File names: letters, digits, CJK, dot, dash, underscore. No separators, no
+ * leading dot. 128 chars, not 64: bulk-copied packs carry long descriptive
+ * template names ("c-pop-guofeng-traditional-chinese-style-cinematic-ballad"),
+ * and a cap they fail makes those files silently invisible to info()/export. */
+const FILE_NAME = /^[A-Za-z0-9_一-龥][A-Za-z0-9._一-龥-]{0,127}$/;
 /** Directory names this module generates and later trusts only after re-validation. */
 const SLUG = /^[a-z0-9][a-z0-9-]{0,79}$/;
 /** Sub-directory names inside a pack: same shape as a file name, no dots. */
@@ -490,6 +504,54 @@ export class SkillPackStore {
         await writeFile(target.value, bytes);
         return this.info(slug);
     }
+    /** Bulk write for preset restore: ONE limit check for the whole batch
+     * instead of per-file enumeration. Per-file checks re-count the entire
+     * pack on every write, so restoring a 1000-file pack that way is O(n²)
+     * filesystem calls — a frozen-looking import for minutes. Grammar and
+     * per-file size limits are still enforced here; the batch is refused
+     * whole (the caller reports which file tripped), never written partially. */
+    async writeMany(slug, entries) {
+        if (entries.length === 0)
+            return this.info(slug);
+        const before = await this.info(slug);
+        if (!before.ok)
+            return before;
+        const existingByPath = new Map(before.value.files.map((file) => [file.path, file.size]));
+        let existingReplacedBytes = 0;
+        let incomingBytes = 0;
+        let newCount = 0;
+        const plan = [];
+        for (const entry of entries) {
+            const target = this.fileOf(slug, entry.path);
+            if (!target.ok)
+                return target;
+            const parsed = parseSkillPath(entry.path);
+            if (!parsed.ok)
+                return parsed;
+            const limit = ASSET_EXTENSIONS.includes(extensionOf(parsed.value.file)) ? MAX_ASSET_BYTES : MAX_FILE_BYTES;
+            if (entry.bytes.length > limit) {
+                return fail(`单个文件不能超过 ${Math.floor(limit / 1024)} KB（${entry.path} 当前 ${Math.ceil(entry.bytes.length / 1024)} KB）`);
+            }
+            const existingSize = existingByPath.get(entry.path);
+            if (existingSize === undefined)
+                newCount += 1;
+            else
+                existingReplacedBytes += existingSize;
+            incomingBytes += entry.bytes.length;
+            plan.push({ target: target.value, bytes: entry.bytes });
+        }
+        if (before.value.files.length + newCount > MAX_PACK_FILES) {
+            return fail(`一个技能包最多 ${MAX_PACK_FILES} 个文件`);
+        }
+        if (before.value.totalBytes - existingReplacedBytes + incomingBytes > MAX_PACK_BYTES) {
+            return fail(`一个技能包最多 ${Math.floor(MAX_PACK_BYTES / 1024 / 1024)} MB`);
+        }
+        for (const item of plan) {
+            await mkdir(dirname(item.target), { recursive: true });
+            await writeFile(item.target, item.bytes);
+        }
+        return this.info(slug);
+    }
     /** Read one file as raw bytes (the panel's image preview and downloads). */
     async readBytes(slug, path) {
         const target = this.fileOf(slug, path);
@@ -738,6 +800,12 @@ export function createWorkflowSkillPacks(host) {
                 return resolved;
             return afterMutation(id, packs.write(resolved.value.slug, path, content));
         },
+        async importFiles(id, entries) {
+            const resolved = await resolvePack(id);
+            if (!resolved.ok)
+                return resolved;
+            return afterMutation(id, packs.writeMany(resolved.value.slug, entries));
+        },
         async renameFile(id, from, to) {
             const resolved = await resolvePack(id);
             if (!resolved.ok)

package/lib/transfer.d.ts

@@ -0,0 +1,158 @@
+import type { WorkflowParameter } from './params.js';
+import { type StoredWorkflow } from './store.js';
+import { type SkillPackResult, type WorkflowSkillPack } from './skillpack.js';
+/** Marker plus layout version of the packages this module writes. */
+export declare const PRESET_FORMAT = "dsh-comfyui-workflow-preset";
+export declare const PRESET_VERSION = 1;
+/** Hard cap on the uploaded archive (route-level check before parsing). */
+export declare const MAX_IMPORT_BYTES: number;
+/** One workflow record inside preset.json. */
+export interface PresetWorkflow {
+    /** Id in the EXPORTING library; import mints a fresh one. */
+    id: string;
+    name: string;
+    description: string;
+    tags?: string[];
+    parameters?: WorkflowParameter[];
+    requireSkill?: boolean;
+    /** Skill-pack contents; null when the workflow has no pack (or it was unreadable). */
+    skill: PresetSkillRef | null;
+    workflow: Record<string, {
+        class_type: string;
+        inputs: Record<string, unknown>;
+    }>;
+}
+/** What the panel and tools need to know about one archived pack. */
+export interface PresetSkillRef {
+    files: Array<{
+        path: string;
+        size: number;
+    }>;
+    /** Sub-directories, kept so empty ones survive the round trip. */
+    dirs: string[];
+}
+/** The whole manifest. `count` mirrors `workflows.length` on export and is
+ * recomputed (not trusted) on import. */
+export interface PresetManifest {
+    format: string;
+    version: number;
+    exportedAt: string;
+    pluginVersion: string;
+    count: number;
+    workflows: PresetWorkflow[];
+}
+/** Structural slice of the runtime the transfer routes operate through. */
+export interface TransferHost {
+    listWorkflows(): Promise<StoredWorkflow[]>;
+    getWorkflow(id: string): Promise<StoredWorkflow | undefined>;
+    saveWorkflow(input: {
+        name: string;
+        description: string;
+        workflow: unknown;
+        parameters?: WorkflowParameter[];
+        tags?: string[];
+    }): Promise<{
+        ok: true;
+        workflow: StoredWorkflow;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    skillPacks: {
+        info(id: string): Promise<WorkflowSkillPack | undefined>;
+        readRaw(id: string, path: string): Promise<SkillPackResult<{
+            bytes: Buffer;
+            contentType: string;
+        }>>;
+        enable(id: string): Promise<SkillPackResult<WorkflowSkillPack>>;
+        disable(id: string): Promise<SkillPackResult<true>>;
+        writeFile(id: string, path: string, content: string): Promise<SkillPackResult<WorkflowSkillPack>>;
+        importFile(id: string, file: string, bytes: Buffer, bucket?: string): Promise<SkillPackResult<{
+            path: string;
+            pack: WorkflowSkillPack;
+        }>>;
+        importFiles(id: string, entries: ReadonlyArray<{
+            path: string;
+            bytes: Buffer;
+        }>): Promise<SkillPackResult<WorkflowSkillPack>>;
+        makeDir(id: string, name: string): Promise<SkillPackResult<WorkflowSkillPack>>;
+        setRequired(id: string, required: boolean): Promise<SkillPackResult<WorkflowSkillPack>>;
+    };
+}
+export type ExportResult = {
+    ok: true;
+    bytes: Uint8Array;
+    filename: string;
+    count: number;
+    names: string[];
+    warnings: string[];
+} | {
+    ok: false;
+    error: string;
+};
+/** One listed workflow inside an analyzed package. */
+export interface ImportCandidate {
+    /** Position in the manifest; the apply call selects by this index, which
+     * stays stable because the same bytes are parsed again. */
+    index: number;
+    id: string;
+    name: string;
+    description: string;
+    tags: string[];
+    paramCount: number;
+    skill: {
+        fileCount: number;
+        totalBytes: number;
+        required: boolean;
+    } | null;
+    /** Non-fatal problems already visible at analysis time. */
+    warnings: string[];
+}
+export interface ImportAnalysis {
+    version: number;
+    exportedAt: string;
+    pluginVersion: string;
+    workflows: ImportCandidate[];
+}
+/** Per-workflow result of an import; `ok` entries carry their new identity. */
+export interface ImportOutcome {
+    index: number;
+    name: string;
+    ok: boolean;
+    newName?: string;
+    newId?: string;
+    error?: string;
+    warnings: string[];
+}
+/**
+ * Build one preset package from the selected library workflows.
+ * @param host - the runtime face (workflow store + skill packs).
+ * @param ids - workflow ids to export; unknown ids are skipped with a warning.
+ */
+export declare function buildExportPackage(host: TransferHost, ids: unknown): Promise<ExportResult>;
+/**
+ * Analyze one uploaded package: list the workflows it offers, with per-item
+ * warnings for anything that would fail at apply time. No disk writes.
+ */
+export declare function analyzeImportPackage(bytes: Buffer): {
+    ok: true;
+    analysis: ImportAnalysis;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Import the selected workflows from one uploaded package. Every workflow
+ * becomes a NEW library record (fresh id, name suffixed on clash); skill
+ * packs land in freshly slugged directories, so nothing on disk is reused
+ * or overwritten.
+ * @param selected - manifest indexes to import (as listed by analyze).
+ */
+export declare function applyImportPackage(host: TransferHost, bytes: Buffer, selected: unknown): Promise<{
+    ok: true;
+    results: ImportOutcome[];
+    imported: number;
+} | {
+    ok: false;
+    error: string;
+}>;