Adopt extra model paths install scoped

.claude/skills/starter-templates/SKILL.md

@@ -0,0 +1,141 @@
+---
+name: starter-templates
+description: Change which starter templates the desktop install picker offers. Use when someone wants to swap, add, feature or refresh a starter template, or asks what the picker shows after install.
+argument-hint: '[what you want to change]'
+allowed-tools: Bash(node scripts/starter-templates.mjs *) Bash(git checkout *) Bash(git switch *) Bash(git add *) Bash(git commit *) Bash(git push *) Bash(gh pr create *) Read
+---
+
+# Starter templates
+
+Change the starter templates the desktop installer offers, then open a PR.
+
+The picker shows 4 templates in each of 4 tabs: `video`, `image`, `3d`, `audio`.
+The list is `assets/starter-templates.json`, which desktop reads from R2 at boot,
+so a merged change reaches users on their next launch with no app release.
+
+## Rules
+
+**Never edit the JSON directly.** Every command below regenerates the display
+fields from the live template index. Hand-editing puts stale titles and sizes in
+front of users and fails CI.
+
+**Only ever pass template ids.** Titles, descriptions, sizes and thumbnails are
+derived. If the user supplies them, ignore them and let the script fill them in.
+
+**Confirm the id before writing.** Run `list` first and show the user the
+matching titles. Ids differ by one character (`video_minimax_h3_t2v` vs
+`..._i2v`), so never infer one from a product name.
+
+**Never work around a rejection.** Read the message, fix the input, and tell the
+user what was wrong. Do not edit the JSON to get past it.
+
+## Steps
+
+### 1. Find the id
+
+```bash
+node scripts/starter-templates.mjs list --modality video --free
+```
+
+`--modality` is `video`, `image`, `3d` or `audio`. `--free` or `--paid` narrows
+it. Report the handful of relevant matches with titles and sizes, then confirm.
+
+### 2. Make the change
+
+Pick the command from what the user is changing.
+
+Swap the featured (auto-selected) pick:
+
+```bash
+node scripts/starter-templates.mjs set --modality video --id <id> --recommended
+```
+
+Swap the paid API-node pick:
+
+```bash
+node scripts/starter-templates.mjs set --modality video --id <id> --paid
+```
+
+Swap one specific card, leaving the others alone:
+
+```bash
+node scripts/starter-templates.mjs set --modality video --id <new_id> --replaces <old_id>
+```
+
+Rebuild every tab at once, for a seasonal refresh. Four ids per tab, `*` marks
+the featured card, `$` marks the paid one. Single-quote each list so the shell
+leaves `$` alone:
+
+```bash
+node scripts/starter-templates.mjs replace \
+  --video '*id_a,$api_id,id_c,id_d' \
+  --image '*id_a,$api_id,id_c,id_d' \
+  --3d '*id_a,$api_id,id_c,id_d' \
+  --audio '*id_a,$api_id,id_c,id_d'
+```
+
+Refresh titles and sizes for the ids already in the list, changing nothing else:
+
+```bash
+node scripts/starter-templates.mjs regenerate
+```
+
+Each tab holds 4 slots, so `set` replaces rather than appends. The script
+validates before writing, so a refusal leaves the file untouched.
+
+The spec pins the slot rule, not the exact order: every tab keeps its
+recommended pick in slot 1 and its paid card in slot 2, while slots 3 and 4
+may reorder freely. So a plain swap of the two free cards needs no spec
+change. The `TABS` fixture in `scripts/starter-templates.spec.mjs` only feeds
+the negative `replace` cases — its own order is never compared against the
+file — so leave it alone unless you add or drop an id there.
+
+### 3. Open a PR
+
+```bash
+git switch -c templates/<short-description>
+git add assets/starter-templates.json
+git commit -m "content(templates): <what changed and why>"
+git push -u origin HEAD
+gh pr create --title "content(templates): <what changed>" --body "<what and why>"
+```
+
+Name the old and new template in the PR body, and why it changed. A swap,
+feature or paid change touches only `assets/starter-templates.json`. Add
+`scripts/starter-templates.spec.mjs` to the commit only if you introduced or
+removed an id that the `TABS` fixture references. Nothing else should change;
+if `git status` shows more, you edited the JSON by hand instead of running the
+script.
+
+### 4. Report back
+
+Tell the user which template replaced which, and that it reaches users on their
+next app launch once the PR merges. Nothing ships before then.
+
+## What the script refuses
+
+These fail silently in the app, so they fail here instead.
+
+- Exactly 4 templates per tab.
+- Exactly 1 featured per tab, and it must be free.
+- Exactly 1 paid (API-node) template per tab.
+- Every id must exist in the live template index.
+- No duplicate ids anywhere, including across tabs.
+- Ids and text within the app's length caps.
+
+## If something fails
+
+`is not in the template index` — the id is wrong or was renamed upstream. Run
+`list` for that modality and pick from the output.
+
+`cannot be both --recommended and paid` — the featured card must be free. Ask
+which the user meant.
+
+`needs exactly 1 paid template` — a tab lost or gained its API-node card. Use
+`--replaces` to swap like for like.
+
+`could not read the template index` — the live index is unreachable. This is
+network, not input. Retry rather than changing the request.
+
+First run in a fresh clone: see [setup.md](setup.md). Needs Node 22 and
+`gh auth login`, no build step.

.claude/skills/starter-templates/setup.md

@@ -0,0 +1,67 @@
+# First-time setup
+
+Everything below is one-time. After it, changing a template is one sentence to
+Claude.
+
+## What you need
+
+**Node 22+** — check with `node --version`. If it's missing or older, install
+from [nodejs.org](https://nodejs.org) (take the LTS build).
+
+**The repo:**
+
+```bash
+git clone https://github.com/Comfy-Org/Comfy-Desktop.git
+cd Comfy-Desktop
+```
+
+You do **not** need to install dependencies or build the app. The template
+script runs on Node alone.
+
+**GitHub CLI**, so Claude can open the PR for you:
+
+```bash
+gh auth login
+```
+
+Pick GitHub.com, HTTPS, and authenticate in the browser.
+
+## Check it works
+
+```bash
+node scripts/starter-templates.mjs validate
+```
+
+Expected:
+
+```
+  ✓ 16 templates, 4 per tab, rules hold
+```
+
+If you see that, you are done.
+
+## Using it
+
+Open Claude Code in the repo folder and ask in plain English:
+
+> swap the recommended video template to Wan 2.2
+
+Claude finds the id, makes the change, validates it, and opens a PR for review.
+You can also run `/starter-templates` to invoke it directly.
+
+You never edit JSON by hand. You only ever choose which template goes where.
+
+## If something goes wrong
+
+**`node: command not found`** — Node is not installed, or the terminal needs
+reopening after installing it.
+
+**`could not read the template index`** — no internet, or GitHub is blocked.
+The script reads the live template list from raw.githubusercontent.com.
+
+**`"<id>" is not in the template index`** — that template id does not exist
+upstream. Run `node scripts/starter-templates.mjs list --modality video` to see
+what is available.
+
+**Anything else** — paste the error into Claude Code. The messages are written
+to say what to do next.

.gitattributes

@@ -1 +1,2 @@
+* text=auto eol=lf
 *.sh text eol=lf

.github/CODEOWNERS

@@ -0,0 +1,6 @@
+# Agent instructions
+**/AGENTS.md                                      @benceruleanlu @deepme987 @Kosinkadink
+# Root-anchored rule so the top-level AGENTS.md has an explicit DRI (a bare
+# `**/`-prefixed pattern doesn't match a repo-root file in every CODEOWNERS
+# reader).
+/AGENTS.md                                        @benceruleanlu @deepme987 @Kosinkadink

.github/scripts/check-gcs.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# Reports what the mirror service account can do. Uses the JSON API with the
+# token `google-github-actions/auth` exports, rather than the gcloud CLI.
+set -uo pipefail
+
+BUCKET=comfy-desktop-public
+PREFIX=standalone-environments
+KEY="$PREFIX/.credential-check-${GITHUB_RUN_ID:-local}.json"
+
+say() {
+  echo "$1"
+  [ -n "${GITHUB_STEP_SUMMARY:-}" ] && echo "$1" >> "$GITHUB_STEP_SUMMARY"
+  return 0
+}
+
+say "### GCS mirror"
+
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+
+CREDS="${GOOGLE_APPLICATION_CREDENTIALS:-}"
+if [ -z "$CREDS" ] || [ ! -f "$CREDS" ]; then
+  say "- **No credentials were exported by the auth step.**"
+  exit 1
+fi
+say "- Service account: \`$(jq -r '.client_email // "unknown"' "$CREDS")\`"
+say "- Project: \`$(jq -r '.project_id // "unknown"' "$CREDS")\`"
+
+# Mint an access token from the service-account key.
+TOKEN=$(python3 - "$CREDS" <<'PY'
+import base64, json, sys, time, urllib.parse, urllib.request
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import padding
+
+key = json.load(open(sys.argv[1]))
+b64 = lambda d: base64.urlsafe_b64encode(d).rstrip(b'=')
+now = int(time.time())
+claim = {
+    "iss": key["client_email"],
+    "scope": "https://www.googleapis.com/auth/devstorage.read_write",
+    "aud": key["token_uri"],
+    "iat": now,
+    "exp": now + 300,
+}
+signing_input = b64(json.dumps({"alg": "RS256", "typ": "JWT"}).encode()) + b"." + b64(json.dumps(claim).encode())
+signature = serialization.load_pem_private_key(key["private_key"].encode(), password=None).sign(
+    signing_input, padding.PKCS1v15(), hashes.SHA256()
+)
+assertion = (signing_input + b"." + b64(signature)).decode()
+body = urllib.parse.urlencode({
+    "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
+    "assertion": assertion,
+}).encode()
+try:
+    with urllib.request.urlopen(urllib.request.Request(key["token_uri"], data=body), timeout=30) as r:
+        print(json.load(r)["access_token"])
+except Exception as e:
+    print("", end="")
+    sys.stderr.write(f"token exchange failed: {e}\n")
+PY
+)
+
+if [ -z "$TOKEN" ]; then
+  say "- **Could not mint an access token from the key.** It may be disabled or malformed."
+  exit 1
+fi
+say "- Minted an access token"
+
+read_code=$(curl -sS --connect-timeout 10 --max-time 30 -o /dev/null -w '%{http_code}' \
+  "https://storage.googleapis.com/storage/v1/b/$BUCKET/o/$(printf %s "$PREFIX/starter-templates.json" | jq -sRr @uri)" \
+  -H "Authorization: Bearer $TOKEN")
+say "- Read the published file: HTTP $read_code (404 just means it is not there yet)"
+
+echo '{"check":true}' > "$TMP/check.json"
+write_code=$(curl -sS --connect-timeout 10 --max-time 30 -o "$TMP/gcs-write.json" -w '%{http_code}' -X POST \
+  "https://storage.googleapis.com/upload/storage/v1/b/$BUCKET/o?uploadType=media&name=$(printf %s "$KEY" | jq -sRr @uri)" \
+  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+  --data-binary @"$TMP/check.json")
+say "- Write a throwaway object: HTTP $write_code"
+
+if [ "$write_code" = "200" ]; then
+  # Publishing overwrites an existing object, which a create-only credential
+  # cannot do, so prove overwrite rather than just create.
+  again=$(curl -sS --connect-timeout 10 --max-time 30 -o /dev/null -w '%{http_code}' -X POST \
+    "https://storage.googleapis.com/upload/storage/v1/b/$BUCKET/o?uploadType=media&name=$(printf %s "$KEY" | jq -sRr @uri)" \
+    -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+    --data-binary @"$TMP/check.json")
+  say "- Overwrite the same object: HTTP $again"
+
+  del=$(curl -sS --connect-timeout 10 --max-time 30 -o /dev/null -w '%{http_code}' -X DELETE \
+    "https://storage.googleapis.com/storage/v1/b/$BUCKET/o/$(printf %s "$KEY" | jq -sRr @uri)" \
+    -H "Authorization: Bearer $TOKEN")
+  say "- Delete the throwaway object: HTTP $del"
+
+  if [ "$again" != "200" ]; then
+    say "- **Create works but overwrite does not, so publishing would fail.**"
+    say "- Ask for: Storage Object Admin on \`$BUCKET\`, not just object create."
+    exit 1
+  fi
+  if [ "$del" != "204" ] && [ "$del" != "200" ]; then
+    say "- Left \`$KEY\` behind; the credential cannot delete."
+  fi
+  say "- **Mirror is ready to publish.**"
+  exit 0
+fi
+
+say "- Refused: \`$(jq -c '.error.message' "$TMP/gcs-write.json" 2>/dev/null || cat "$TMP/gcs-write.json")\`"
+say "- **Ask for: Storage Object Admin on \`$BUCKET\` for this service account.**"
+exit 1