model download claims are per-workspace, so two workspaces sharing one model library can clobber each other

Aperta
  • Qualcosa non va?
#1,095 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@christian-byrne ci sta già lavorando.

Dal 2/11/2026.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
python
Ambito
cli

Direzione di ricerca

Start by reading _active_download_for and the claim-handling code in comfy_cli/command/models/models.py, alongside the claim helpers in comfy_cli/download_state.py. The issue calls for a design spike first: choose one of the three claim-store options and record the tradeoffs before implementation. Then use tests/comfy_cli/command/test_model_download_background.py to check the existing claim behavior; done means cross-workspace downloads to one destination refuse each other while preserving the listed cleanup, isolation, and in-workspace acceptance criteria.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

What happens

comfy model download refuses a second download into a destination another download already
claimed. The claim is a lock file under <workspace>/.comfy-downloads/claims/, so the refusal only
works between invocations that resolve the same workspace.

Two invocations in different workspaces aimed at one file therefore consult disjoint claim
directories, see no competitor, and both proceed. On the httpx path each streams into its own
randomly-named .part sibling and the later rename silently overwrites the earlier; with
--downloader aria2 both write straight to the destination and interleave.

Why it matters more than it used to

Until #1094 this needed an explicit --relative-path escaping the workspace, so it was something a
user had to opt into. #1094 makes a typed download with no --relative-path save into the folder
the running local ComfyUI scans — which on Comfy Desktop is a shared library outside any workspace.
Two workspaces on one machine can now converge on the same absolute destination by default.

#1094 narrows the window (the server's folder is only adopted when it already exists locally, and an
explicit --workspace is never overridden) but does not close it, and says so.

Where it is already written down

_active_download_for's docstring in comfy_cli/command/models/models.py records the residual and
that closing it is an unmade design call:

A destination can sit outside the workspace … so two invocations run against different
workspaces but aimed at the same file consult disjoint <workspace>/.comfy-downloads directories
and are invisible to each other — both claim, both win, both write. Closing it needs a claim that
lives next to the destination rather than next to the workspace, or a refusal of
workspace-escaping --relative-path; both are design calls with their own tradeoffs and neither
is made here.

What a fix has to deal with

The claim key is already global — _dest_key is normcase(realpath(dest)) — so only the
directory holding the claim is workspace-scoped. That makes the change small in principle and not in
practice:

  • _dest_claim_path resolves the claim under get_workspace(); download_state.claim_marker_for
    resolves the worker's from the state file's own parent, deliberately, because a worker is handed
    --state <file> and never re-resolves a workspace. A background worker has state.dest, so it
    can compute a destination-addressed claim — but both sides have to agree.
  • _spawn_gap_holder resolves a claim's download_id through download_state.read(get_workspace(), id). Across workspaces that lookup fails, which currently reads as "stale, steal it". A held lock
    still refuses correctly; the spawn-gap judgment needs rethinking.
  • A host-global store needs per-test isolation that does not exist: constants.DEFAULT_CONFIG is
    computed from ~ at import time and no fixture redirects it, so the suite would share one lock
    directory with the developer's machine.
  • Roughly 45 cases in tests/comfy_cli/command/test_model_download_background.py address claims as
    download_state.claim_path(workspace, key), most with destinations outside their workspace.

Options, none chosen

  1. Host-global claim store keyed by _dest_key, with a redirectable root for tests. Closes it
    for every destination, including the --relative-path case.
  2. Destination-addressed claim, next to the destination. Naturally shared, but puts a dot-file
    inside a user's models folder — which _dest_claim_path's docstring explicitly rejected — and may
    not be writable.
  3. Scope only the shared-library case, by recording on the download that its destination came
    from the server lookup and claiming those in a shared store. Narrowest, but adds a state field and
    leaves the --relative-path hole open.

Raised by CodeRabbit and the cursor-review panel on #1094
(https://github.com/Comfy-Org/comfy-cli/pull/1094#discussion_r4432563793,
https://github.com/Comfy-Org/comfy-cli/pull/1094#discussion_r4432602412) and deferred there rather
than fixed inside a destination-selection change.

Task Decomposition

Goal. Two comfy model download invocations in different workspaces aimed at the same absolute
destination refuse each other, exactly as two in one workspace already do.

Acceptance criteria.

  • Two concurrent downloads from different workspaces to one destination: one wins, the other gets
    model_download_in_flight. True for foreground-vs-foreground, foreground-vs-background, and
    background-vs-background.
  • A SIGKILLed holder still self-clears, and a dead holder's claim is stealable.
  • No test writes a claim outside its own temporary tree.
  • In-workspace behavior is unchanged: existing refusals, degradation to the advisory scan on a
    filesystem that cannot lock, and the owner-only mode on the claims directory.

Constraints. Must not change the destination-selection behavior added in #1094. Must not make a
download fail over bookkeeping — every degradation stays a warning plus the advisory scan.
DownloadState's on-disk shape is read by comfy model downloads / download-status, so a new
field needs a tolerant reader.

Existing context. comfy_cli/command/models/models.py (_dest_claim_path, _take_dest_claim,
_acquire_dest_claim, _spawn_gap_holder, _enforce_claim, _active_download_for),
comfy_cli/download_state.py (state_dir, claims_dir, claim_path, claim_marker_for,
lock_claim), tests/comfy_cli/command/test_model_download_background.py.

ID Sub-task Tier Est Depends Acceptance
1 Spike: pick between the three options above and record the call in the issue. Decides whether a DownloadState field is needed at all. deep 60m — One option chosen, in writing, with the rejected two and why
2 Add a redirectable root for host-global state (download_state.global_state_dir()), honoring an env override, owner-only, created lazily routine 30m 1 Unit test: the override redirects it; the directory is 0o700
3 Autouse fixture redirecting that root per test, so no case can touch the real one routine 30m 2 A test asserting the resolved root is under tmp_path; suite green
4 Move the claim path behind one resolver used by both the submitter and the worker (_dest_claim_path + claim_marker_for), so the two cannot disagree analytical 60m 2 Existing claim tests pass against the resolver; one test asserts both callers resolve the same path for one dest
5 Fix holder resolution across workspaces: _spawn_gap_holder must not read an unresolvable id as "stale, steal it" deep 60m 4 Test: a spawn-gap holder in another workspace is refused, not stolen
6 Cross-workspace refusal tests, all three kind-pairs, plus the SIGKILL self-clear case analytical 60m 4,5 Red before 4, green after; no flake over 20 runs
7 Migrate the ~45 claim_path(workspace, key) call sites in the background test file routine 30m 4 Full suite green on Linux, macOS, Windows
8 CHANGELOG entry naming the behavior change trivial 5m 6 Entry under Fixed

No circular dependencies. Task 1 is a genuine spike and nothing after it should start before it
lands — options 2 and 3 above change which files move, so decomposing past it now would be guessing.

Lingua principale
Python
Stelle
1k
Fork
176
Merge medio
1g 11h
PR unite (30g)
87

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Comfy-Org/comfy-cli

Tutte le issue di Comfy-Org/comfy-cli

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.