Add Unbake

[syugoji]

Unbake rebuilds the ComfyUI workflow behind an image — a Civitai link, a PNG with
metadata, or ComfyUI's own output — reads the generation parameters, sorts the missing
models by how you would obtain them, and then runs a parameter sweep that refuses to
start if anything other than the axis you declared would move.

It adds one canvas node (UnbakeRecipeSource) plus a sidebar panel. GPL-3.0, no pip
dependencies. It is already on the registry as comfyui-unbake; this entry is so the
list carries the GitHub reference.

Repository: https://github.com/syugoji/ComfyUI-Unbake

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 67dcf27f-9e60-43c2-b9b8-e9d77bf2221f

📥 Commits

Reviewing files that changed from the base of the PR and between 934e203 and 2f530d3.

📒 Files selected for processing (1)

• custom-node-list.json

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The custom-node list now includes Unbake by syugoji. The entry references the ComfyUI-Unbake repository, uses git-clone installation, and describes workflow reconstruction and validated XY-plot functionality.

Changes

Unbake Custom Node

Layer / File(s)	Summary
Add Unbake registry entry custom-node-list.json	Adds Unbake by syugoji with its GitHub repository, git-clone installation type, and workflow description.

Merge Risk: ⚪ Minimal · up to 2f530

This localized registry change has no actionable merge-blocking risk remaining beyond normal checks and review.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

_{Comment @coderabbitai help to get the list of available commands.}

[ltdrdata]

The model-delete route deletes model files and is network-reachable, so any page the user visits can delete files.

• unbake/models.py:297

Please make this route local-only, or remove it. I'll re-evaluate once it is no longer network-reachable.

[syugoji]

Thanks — fixed in syugoji/ComfyUI-Unbake@3dae74a, and I found two more of the same shape.

You named model-delete, but record-delete and output-delete were reachable the same way, and there was no origin or locality check anywhere in the package. Rather than patch the three, the check now lives in one place (unbake/guard.py) and every POST route carries it. A test reads the source and fails if a POST route is added without it.

One note on the fix: local-only alone does not stop what you described. A malicious page runs in the user's own browser, so its request arrives from 127.0.0.1 like any other. The guard therefore requires all three of:

• the peer to be loopback — stops other machines on the network, since ComfyUI binds 0.0.0.0 by default;
• Origin, when present, to match the host — stops the cross-site case you described;
• Content-Type: application/json — forces a CORS preflight. Without it a text/plain body is a "simple request", skips the preflight, and walks past the origin check.

A request with no Origin is still allowed, since browsers always send one on a cross-origin POST and the loopback condition covers command-line callers. X-Forwarded-For is ignored on purpose — the sender picks its value, so trusting it would undo the loopback check. Requests through a reverse proxy or tunnel are now refused, which I took to be the intent.

Tests cover both the wiring (every POST route carries the guard) and the behaviour (each condition refuses on its own). I mutated each one to confirm the tests fail without it.

The route is no longer network-reachable. Happy to make any of it stricter if you would prefer.