Merge remote-tracking branch 'origin/main' into dante/resolve-pr-15403-20260821

Amp-Thread-ID: https://ampcode.com/threads/T-01a02479-3fb4-70b8-886b-39205e4a7c4d
Co-authored-by: Amp <amp@ampcode.com>

# Conflicts:
#	src/platform/cloud/subscription/composables/useBillingPolicyState.ts

Author: dante01yoon

.github/actions/setup-frontend/action.yaml

@@ -5,6 +5,10 @@ inputs:
     description: 'Include the build step to build the frontend. Set to true for workflows that need a built frontend'
     required: false
     default: 'false'
+  node_cache:
+    description: "Share the lockfile-keyed pnpm store cache. Set to 'false' in jobs that execute unreviewed third-party code: setup-node's post step writes the store AFTER the job body, and the same key is restored by the publish workflows, which hold NPM_TOKEN, PYPI_TOKEN and id-token: write."
+    required: false
+    default: 'true'
 runs:
   using: 'composite'
   steps:
@@ -18,7 +22,7 @@ runs:
       uses: actions/setup-node@v6
       with:
         node-version-file: '.nvmrc'
-        cache: 'pnpm'
+        cache: ${{ inputs.node_cache == 'true' && 'pnpm' || '' }}
         cache-dependency-path: './pnpm-lock.yaml'
 
     - name: Install dependencies

.github/workflows/ci-ecosystem-matrix.yaml

@@ -0,0 +1,91 @@
+# Bump the ecosystem matrix's corpus pins.
+#
+# Manual only, and that is the design. scripts/registry-census/corpus.pins.json
+# names the exact commit of every registry pack the matrix measures, so the
+# gate is a constant: a pack author pushing a bug cannot red an unrelated PR.
+# The cost of that is that pack breakage is invisible until someone bumps the
+# pins - so this workflow opens the PR where a whole month of ecosystem churn
+# lands at once, reviewed, by someone who expected it.
+#
+# A red on THAT pr means the ecosystem moved. A red anywhere else means the
+# diff did. Keeping those two apart is the entire point.
+name: 'Update corpus pins'
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  update-pins:
+    if: github.repository == 'Comfy-Org/ComfyUI_frontend'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.11'
+
+      - name: Report the pins being replaced
+        run: python3 scripts/registry-census/pins.py
+
+      - name: Refresh registry snapshot
+        run: python3 scripts/registry-census/refresh_registry.py
+
+      # git ls-remote, not the REST API: ~5,100 packs would exhaust the
+      # authenticated 5,000/hour REST budget in a single run.
+      - name: Resolve every pack to a commit
+        run: python3 scripts/registry-census/fetch_corpus.py --write-pins --workers 32
+
+      - name: Summarize the bump
+        id: summary
+        run: |
+          set -euo pipefail
+          python3 - <<'PY' >> "$GITHUB_STEP_SUMMARY"
+          import json, subprocess
+          path = 'scripts/registry-census/corpus.pins.json'
+          new = json.load(open(path))['packs']
+          old = json.loads(
+              subprocess.run(['git', 'show', f'HEAD:{path}'],
+                             capture_output=True, text=True).stdout or '{"packs":{}}'
+          )['packs']
+          moved = sorted(k for k in new.keys() & old.keys() if new[k] != old[k])
+          added = sorted(new.keys() - old.keys())
+          dropped = sorted(old.keys() - new.keys())
+          print(f'## Corpus pin bump\n')
+          print(f'- {len(new)} packs pinned')
+          print(f'- {len(moved)} moved, {len(added)} added, {len(dropped)} dropped\n')
+          if moved:
+              print('<details><summary>moved</summary>\n')
+              print('\n'.join(f'- `{k}` {old[k][:8]} -> {new[k][:8]}' for k in moved))
+              print('\n</details>')
+          PY
+
+      - name: Open the bump PR
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
+        with:
+          branch: chore/corpus-pins
+          commit-message: 'chore: bump ecosystem matrix corpus pins'
+          title: 'chore: bump ecosystem matrix corpus pins'
+          body: |
+            Regenerates `scripts/registry-census/corpus.pins.json`, which names the
+            exact commit of every registry pack the ecosystem matrix measures.
+
+            **A red `CI: Ecosystem Matrix` on this PR means the ecosystem moved, not
+            that this diff broke something.** That is what this PR is for. Read the
+            verdict's breached criterion and the per-pack signature drift, decide
+            whether it is real breakage worth an upstream issue or acceptable churn,
+            and merge either way — leaving the pins stale is strictly worse, because
+            it makes the gate measure an ecosystem that no longer exists.
+
+            See the step summary on the triggering run for the moved/added/dropped
+            breakdown.
+          add-paths: scripts/registry-census/corpus.pins.json

.github/workflows/update-corpus-pins.yaml

@@ -98,4 +98,10 @@ vitest.config.*.timestamp*
 # Weekly docs check output
 /output.txt
 
-.amp
+.amp
+# Registry census working tree (scripts/registry-census) - corpus, lockfile, results
+.census/
+# Ecosystem matrix fixture (scripts/registry-census/build_matrix.py) - generated per-pack specs
+src/__ecs_matrix__/
+# Per-pack result rows written by a local detection-proof run
+matrix-proof/

.gitignore

@@ -8,6 +8,9 @@
   "ignorePatterns": [
     "packages/registry-types/src/comfyRegistryTypes.ts",
     "public/materialdesignicons.min.css",
+    "scripts/registry-census/corpus.pins.json",
+    "scripts/registry-census/detection-proof/**",
+    "src/__ecs_matrix__/**",
     "src/types/generatedManagerTypes.ts",
     "src/locales/**/*.json",
     "**/__fixtures__/**/*.json",

.oxfmtrc.json

@@ -8,6 +8,8 @@
     "dist/*",
     "packages/registry-types/src/comfyRegistryTypes.ts",
     "playwright-report/*",
+    "scripts/registry-census/detection-proof/**",
+    "src/__ecs_matrix__/**",
     "src/extensions/core/*",
     "src/scripts/*",
     "src/types/generatedManagerTypes.ts",

.oxlintrc.json

@@ -13,6 +13,9 @@ export function createSubscriptionStatus(
     subscription_tier: 'FREE',
     has_funds: false,
     billing_rail: 'legacy_stripe',
+    max_seats: 0,
+    occupied_seats: 0,
+    team_credit_stop: null,
     ...overrides
   }
 }

browser_tests/fixtures/data/subscriptionFixtures.ts

@@ -121,7 +121,7 @@ export class CanvasHelper {
    */
   async mouseDblclickAt(position: Position): Promise<void> {
     const abs = await this.toAbsolute(position)
-    await this.page.mouse.dblclick(abs.x, abs.y)
+    await this.page.mouse.dblclick(abs.x, abs.y, { delay: 5 })
     await nextFrame(this.page)
   }
 

browser_tests/fixtures/helpers/CanvasHelper.ts

@@ -156,7 +156,11 @@ export class DragDropHelper {
 
   async dragAndDropFile(
     fileName: string,
-    options: { dropPosition?: Position; waitForUpload?: boolean } = {}
+    options: {
+      dropPosition?: Position
+      waitForUpload?: boolean
+      preserveNativePropagation?: boolean
+    } = {}
   ): Promise<void> {
     return this.dragAndDropExternalResource({ fileName, ...options })
   }

browser_tests/fixtures/helpers/DragDropHelper.ts

@@ -1,6 +1,6 @@
 import { readFileSync } from 'fs'
 
-import { test } from '@playwright/test'
+import { expect, test } from '@playwright/test'
 
 import type { AppMode } from '@/utils/appMode'
 import type {
@@ -118,7 +118,7 @@ export class WorkflowHelper {
     await this.comfyPage.workflowUploadInput.setInputFiles(
       assetPath(`${workflowName}.json`)
     )
-    await this.waitForWorkflowIdle()
+    await expect(this.comfyPage.workflowUploadInput).toHaveValue('')
     await this.comfyPage.nextFrame()
     if (test.info().tags.includes('@vue-nodes')) {
       await this.comfyPage.vueNodes.waitForNodes()