comfyui-mcp/dist/comfyui/upload-target.js

Local-first, agent-native control plane for ComfyUI — MCP server + autonomous sidebar agent that drives your live graph in natural language on ANY LLM: Claude/ChatGPT/Gemini on your subscription (no API key), free local models via Ollama (fully offline),

import { ValidationError } from "../utils/errors.js";
/**
 * Split an upload target into ComfyUI's two fields (#946).
 *
 * `filename` is the caller's whole intent — "clip.mp4" or "assets/clip.mp4" —
 * while ComfyUI's /upload/image wants a bare filename plus a separate
 * `subfolder`. Backslashes count as separators too: a caller on Windows
 * naturally writes "assets\clip.mp4".
 *
 * Traversal is REFUSED rather than sanitised. Silently rewriting "../../x.png"
 * into something safe would upload to a place the caller did not name and then
 * report the name they asked for — a wrong answer dressed as a right one. The
 * caller gets told instead.
 *
 * Lives in its own module because BOTH upload clients need it: client.ts (the
 * self-hosted /upload/image) and cloud-client.ts (the cloud twin) — and
 * cloud-client cannot import from client.ts without a circular import. The
 * one time this rule reached only one twin, the other kept the original #946
 * defect.
 */
export function splitUploadTarget(filename) {
    // A TRAILING separator has to be caught before the empty segments are filtered
    // out: "assets/" would otherwise leave ["assets"], and the directory would be
    // adopted as the filename — an upload to a name the caller never wrote.
    const endsInSeparator = /[/\\]\s*$/.test(filename);
    const parts = filename.split(/[/\\]+/).filter((p) => p !== "" && p !== ".");
    const name = endsInSeparator ? "" : (parts.pop() ?? "");
    if (name === "" || name === "..") {
        throw new ValidationError(`"${filename}" does not name a file to upload — it ends in a path separator or a "..". ` +
            `Pass a filename, optionally prefixed with a subfolder (e.g. "assets/clip.mp4").`);
    }
    if (parts.some((p) => p === "..")) {
        throw new ValidationError(`"${filename}" walks outside ComfyUI's input directory with "..". ` +
            `A subfolder prefix may only go downwards (e.g. "assets/clip.mp4").`);
    }
    return { subfolder: parts.join("/"), name };
}
//# sourceMappingURL=upload-target.js.map