fix(git): handle divergent branches safely during pull

- Use --ff-only flag to detect non-fast-forward situations - Create backup branch before resetting divergent local branch - Reset to remote branch when fast-forward is not possible - Use time.strftime() instead of datetime for better compatibility - Bump version to 3.38.2
ruff fix
2025-12-12 12:22:42 +09:00 · 2025-12-12 12:11:52 +09:00 · 2025-12-12 05:34:33 +09:00 · 2025-12-12 05:23:14 +09:00 · 2025-12-12 05:11:37 +09:00 · 2025-12-12 04:53:07 +09:00
37 changed files with 74447 additions and 12663 deletions
--- a/README.md
+++ b/README.md
@@ -5,6 +5,7 @@
 ![menu](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/refs/heads/Main/ComfyUI-Manager/images/dialog.jpg)

 ## NOTICE
+* V3.38: **Security patch** - Manager data migrated to protected path. See [Migration Guide](docs/en/v3.38-userdata-security-migration.md).
 * V3.16: Support for `uv` has been added. Set `use_uv` in `config.ini`.
 * V3.10: `double-click feature` is removed
  * This feature has been moved to https://github.com/ltdrdata/comfyui-connection-helper
@@ -17,7 +18,7 @@

 To install ComfyUI-Manager in addition to an existing installation of ComfyUI, you can follow the following steps:

-1. goto `ComfyUI/custom_nodes` dir in terminal(cmd)
+1. Go to `ComfyUI/custom_nodes` dir in terminal (cmd)
 2. `git clone https://github.com/ltdrdata/ComfyUI-Manager comfyui-manager`
 3. Restart ComfyUI

@@ -28,8 +29,8 @@ To install ComfyUI-Manager in addition to an existing installation of ComfyUI, y
 - standalone version  
 - select option: use windows default console window
 2. Download [scripts/install-manager-for-portable-version.bat](https://github.com/ltdrdata/ComfyUI-Manager/raw/main/scripts/install-manager-for-portable-version.bat) into installed `"ComfyUI_windows_portable"` directory
- Don't click. Right click the link and use save as...
-3. double click `install-manager-for-portable-version.bat` batch file
+- Don't click. Right-click the link and choose 'Save As...'
+3. Double-click `install-manager-for-portable-version.bat` batch file

 ![portable-install](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/Main/ComfyUI-Manager/images/portable-install.jpg)

@@ -47,7 +48,7 @@ pip install comfy-cli
 comfy install
 ```

-Linux/OSX:
+Linux/macOS:
 ```commandline
 python -m venv venv
 . venv/bin/activate
@@ -57,13 +58,13 @@ comfy install
 * See also: https://github.com/Comfy-Org/comfy-cli


-### Installation[method4] (Installation for linux+venv: ComfyUI + ComfyUI-Manager)
+### Installation[method4] (Installation for Linux+venv: ComfyUI + ComfyUI-Manager)

 To install ComfyUI with ComfyUI-Manager on Linux using a venv environment, you can follow these steps:
 * **prerequisite: python-is-python3, python3-venv, git**

 1. Download [scripts/install-comfyui-venv-linux.sh](https://github.com/ltdrdata/ComfyUI-Manager/raw/main/scripts/install-comfyui-venv-linux.sh) into empty install directory
- Don't click. Right click the link and use save as...
+- Don't click. Right-click the link and choose 'Save As...'
 - ComfyUI will be installed in the subdirectory of the specified directory, and the directory will contain the generated executable script.
 2. `chmod +x install-comfyui-venv-linux.sh`
 3. `./install-comfyui-venv-linux.sh`
@@ -140,20 +141,27 @@ This repository provides Colab notebooks that allow you to install and use Comfy


 ## Paths
-In `ComfyUI-Manager` V3.0 and later, configuration files and dynamically generated files are located under `<USER_DIRECTORY>/default/ComfyUI-Manager/`.
+Starting from V3.38, Manager uses a protected system path for enhanced security.

-* <USER_DIRECTORY>  
-  * If executed without any options, the path defaults to ComfyUI/user.  
-  * It can be set using --user-directory <USER_DIRECTORY>.  
+* <USER_DIRECTORY>
+  * If executed without any options, the path defaults to ComfyUI/user.
+  * It can be set using --user-directory <USER_DIRECTORY>.

-* Basic config files: `<USER_DIRECTORY>/default/ComfyUI-Manager/config.ini`
-* Configurable channel lists: `<USER_DIRECTORY>/default/ComfyUI-Manager/channels.ini`
-* Configurable pip overrides: `<USER_DIRECTORY>/default/ComfyUI-Manager/pip_overrides.json`
-* Configurable pip blacklist: `<USER_DIRECTORY>/default/ComfyUI-Manager/pip_blacklist.list`
-* Configurable pip auto fix: `<USER_DIRECTORY>/default/ComfyUI-Manager/pip_auto_fix.list`
-* Saved snapshot files: `<USER_DIRECTORY>/default/ComfyUI-Manager/snapshots`
-* Startup script files: `<USER_DIRECTORY>/default/ComfyUI-Manager/startup-scripts`
-* Component files: `<USER_DIRECTORY>/default/ComfyUI-Manager/components`
+| ComfyUI Version | Manager Path |
+|-----------------|--------------|
+| v0.3.76+ (with System User API) | `<USER_DIRECTORY>/__manager/` |
+| Older versions | `<USER_DIRECTORY>/default/ComfyUI-Manager/` |
+
+* Basic config files: `config.ini`
+* Configurable channel lists: `channels.list`
+* Configurable pip overrides: `pip_overrides.json`
+* Configurable pip blacklist: `pip_blacklist.list`
+* Configurable pip auto fix: `pip_auto_fix.list`
+* Saved snapshot files: `snapshots/`
+* Startup script files: `startup-scripts/`
+* Component files: `components/`
+
+> **Note**: See [Migration Guide](docs/en/v3.38-userdata-security-migration.md) for upgrade details.


 ## `extra_model_paths.yaml` Configuration
@@ -176,7 +184,7 @@ The following settings are applied based on the section marked as `is_default`.
 ![model-install-dialog](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/Main/ComfyUI-Manager/images/snapshot.jpg)


-## cm-cli: command line tools for power user
+## cm-cli: command line tools for power users
 * A tool is provided that allows you to use the features of ComfyUI-Manager without running ComfyUI.
 * For more details, please refer to the [cm-cli documentation](docs/en/cm-cli.md).

@@ -222,7 +230,7 @@ The following settings are applied based on the section marked as `is_default`.
  * `<current timestamp>` Ensure that the timestamp is always unique.
    * "components" should have the same structure as the content of the file stored in `<USER_DIRECTORY>/default/ComfyUI-Manager/components`.
      * `<component name>`: The name should be in the format `<prefix>::<node name>`.
-        * `<compnent nodeata>`: In the nodedata of the group node.
+        * `<component node data>`: In the node data of the group node.
          * `<version>`: Only two formats are allowed: `major.minor.patch` or `major.minor`. (e.g. `1.0`, `2.2.1`)
          * `<datetime>`: Saved time
          * `<packname>`: If the packname is not empty, the category becomes packname/workflow, and it is saved in the <packname>.pack file in `<USER_DIRECTORY>/default/ComfyUI-Manager/components`.
@@ -240,7 +248,7 @@ The following settings are applied based on the section marked as `is_default`.
 * Dragging and dropping or pasting a single component will add a node. However, when adding multiple components, nodes will not be added.


-## Support of missing nodes installation
+## Support for installing missing nodes

 ![missing-menu](https://raw.githubusercontent.com/ltdrdata/ComfyUI-extension-tutorials/Main/ComfyUI-Manager/images/missing-menu.jpg)

@@ -279,10 +287,10 @@ The following settings are applied based on the section marked as `is_default`.
 * Logging to file feature
  * This feature is enabled by default and can be disabled by setting `file_logging = False` in the `config.ini`.

-* Fix node(recreate): When right-clicking on a node and selecting `Fix node (recreate)`, you can recreate the node. The widget's values are reset, while the connections maintain those with the same names.
+* Fix node (recreate): When right-clicking on a node and selecting `Fix node (recreate)`, you can recreate the node. The widget's values are reset, while the connections maintain those with the same names.
  * It is used to correct errors in nodes of old workflows created before, which are incompatible with the version changes of custom nodes.

-* Double-Click Node Title: You can set the double click behavior of nodes in the ComfyUI-Manager menu.
+* Double-Click Node Title: You can set the double-click behavior of nodes in the ComfyUI-Manager menu.
  * `Copy All Connections`, `Copy Input Connections`: Double-clicking a node copies the connections of the nearest node.
    * This action targets the nearest node within a straight-line distance of 1000 pixels from the center of the node.
    * In the case of `Copy All Connections`, it duplicates existing outputs, but since it does not allow duplicate connections, the existing output connections of the original node are disconnected.
@@ -348,7 +356,7 @@ When you run the `scan.sh` script:

 * It updates the `github-stats.json`.
  * This uses the GitHub API, so set your token with `export GITHUB_TOKEN=your_token_here` to avoid quickly reaching the rate limit and malfunctioning.
-  * To skip this step, add the `--skip-update-stat` option.
+  * To skip this step, add the `--skip-stat-update` option.

 * The `--skip-all` option applies both `--skip-update` and `--skip-stat-update`.

@@ -356,9 +364,9 @@ When you run the `scan.sh` script:
 ## Troubleshooting
 * If your `git.exe` is installed in a specific location other than system git, please install ComfyUI-Manager and run ComfyUI. Then, specify the path including the file name in `git_exe = ` in the `<USER_DIRECTORY>/default/ComfyUI-Manager/config.ini` file that is generated.
 * If updating ComfyUI-Manager itself fails, please go to the **ComfyUI-Manager** directory and execute the command `git update-ref refs/remotes/origin/main a361cc1 && git fetch --all && git pull`.
-* If you encounter the error message `Overlapped Object has pending operation at deallocation on Comfyui Manager load` under Windows
+* If you encounter the error message `Overlapped Object has pending operation at deallocation on ComfyUI Manager load` under Windows
  * Edit `config.ini` file: add `windows_selector_event_loop_policy = True`
-* if `SSL: CERTIFICATE_VERIFY_FAILED` error is occured.
+* If the `SSL: CERTIFICATE_VERIFY_FAILED` error occurs.
  * Edit `config.ini` file: add `bypass_ssl = True`


--- a/check.sh
+++ b/check.sh
@@ -37,7 +37,7 @@ find ~/.tmp/default -name "*.py" -print0 | xargs -0 grep -E "crypto|^_A="

 echo
 echo CHECK3
-find ~/.tmp/default -name "requirements.txt" | xargs grep "^\s*https\\?:"
-find ~/.tmp/default -name "requirements.txt" | xargs grep "\.whl"
+find ~/.tmp/default -name "requirements.txt" | xargs grep "^\s*[^#]*https\?:"
+find ~/.tmp/default -name "requirements.txt" | xargs grep "^\s*[^#].*\.whl"

 echo
--- a/custom-node-list.json
+++ b/custom-node-list.json
--- a/docs/en/cm-cli.md
+++ b/docs/en/cm-cli.md
@@ -139,9 +139,9 @@ You can set whether to use ComfyUI-Manager solely via CLI.
 `restore-dependencies`

 * This command can be used if custom nodes are installed under the `ComfyUI/custom_nodes` path but their dependencies are not installed.
-* It is useful when starting a new cloud instance, like colab, where dependencies need to be reinstalled and installation scripts re-executed.
+* It is useful when starting a new cloud instance, like Colab, where dependencies need to be reinstalled and installation scripts re-executed.
 * It can also be utilized if ComfyUI is reinstalled and only the custom_nodes path has been backed up and restored.

 ### 7. Clear

-In the GUI, installations, updates, or snapshot restorations are scheduled to execute the next time ComfyUI is launched. The `clear` command clears this scheduled state, ensuring no pre-execution actions are applied.
+In the GUI, installations, updates, or snapshot restorations are scheduled to execute the next time ComfyUI is launched. The `clear` command clears this scheduled state, ensuring no pre-execution actions are applied.
--- a/docs/en/v3.38-userdata-security-migration.md
+++ b/docs/en/v3.38-userdata-security-migration.md
@@ -0,0 +1,230 @@
+# ComfyUI-Manager V3.38: Userdata Security Migration Guide
+
+## Introduction
+
+ComfyUI-Manager V3.38 introduces a **security patch** that migrates Manager's configuration and data to a protected system path. This change leverages ComfyUI's new System User Protection API (PR #10966) to provide enhanced security isolation.
+
+This guide explains what happens during the migration and how to handle various situations.
+
+---
+
+## What Changed
+
+### Finding Your Paths
+
+When ComfyUI starts, it displays the full paths in the terminal:
+
+```
+** User directory: /path/to/ComfyUI/user
+** ComfyUI-Manager config path: /path/to/ComfyUI/user/__manager/config.ini
+```
+
+Look for these lines in your startup log to find the exact location on your system. In this guide, paths are shown relative to the `user` directory.
+
+### Path Migration
+
+| Data | Legacy Path | New Path |
+|------|-------------|----------|
+| Configuration | `user/default/ComfyUI-Manager/` | `user/__manager/` |
+| Snapshots | `user/default/ComfyUI-Manager/snapshots/` | `user/__manager/snapshots/` |
+
+### Why This Change
+
+In older ComfyUI versions, the `default/` directory was **unprotected** and accessible via web APIs. If you ran ComfyUI with `--listen 0.0.0.0` or similar options to allow external connections, this data **may have been tampered with** by malicious actors.
+
+**Note:** If you only used ComfyUI locally (without `--listen` or with `--listen 127.0.0.1`), your data was not exposed to this vulnerability.
+
+The new `__manager` path uses ComfyUI's protected system directory, which:
+- **Cannot be accessed** from outside (protected by ComfyUI)
+- Isolates system settings from user data
+- Enables stricter security for remote access
+
+**This is why only `config.ini` is automatically migrated** - other files (snapshots) may have been compromised and should be manually verified before copying.
+
+---
+
+## Automatic Migration
+
+When you start ComfyUI with the new System User Protection API, Manager automatically handles the migration:
+
+### Step 1: Configuration Migration
+
+Only `config.ini` is migrated automatically.
+
+**Important**: Snapshots are **NOT** automatically migrated. You must copy them manually if needed.
+
+### Step 2: Security Level Check
+
+During migration, if your security level is below `normal` (i.e., `weak` or `normal-`), it will be automatically raised to `normal`. This is a safety measure because the security level setting itself may have been tampered with in the old version.
+
+```
+======================================================================
+[ComfyUI-Manager] WARNING: Security level adjusted
+  - Previous: 'weak' → New: 'normal'
+  - Raised to prevent unauthorized remote access.
+======================================================================
+```
+
+If you need a lower security level, you can manually edit the config after migration.
+
+### Step 3: Legacy Backup
+
+Your entire legacy directory is moved to a backup location:
+```
+user/__manager/.legacy-manager-backup/
+```
+
+This backup is preserved until you manually delete it.
+
+---
+
+## Persistent Backup Notification
+
+As long as the backup exists, Manager will remind you on **every startup**:
+
+```
+----------------------------------------------------------------------
+[ComfyUI-Manager] NOTICE: Legacy backup exists
+  - Your old Manager data was backed up to:
+      /path/to/ComfyUI/user/__manager/.legacy-manager-backup
+  - Please verify and remove it when no longer needed.
+----------------------------------------------------------------------
+```
+
+**To stop this notification**: Delete the `.legacy-manager-backup` folder inside `user/__manager/` after confirming you don't need any data from it.
+
+---
+
+## Recovering Old Data
+
+### Snapshots
+
+If you need your old snapshots, copy the contents of `.legacy-manager-backup/snapshots/` to `user/__manager/snapshots/`.
+
+---
+
+## Outdated ComfyUI Warning
+
+If you're running an older version of ComfyUI without the System User Protection API, Manager will:
+
+1. **Force security level to `strong`** - All installations are blocked
+2. **Display warning message**:
+
+```
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+[ComfyUI-Manager] ERROR: ComfyUI version is outdated!
+  - Most operations are blocked for security.
+  - ComfyUI update is still allowed.
+  - Please update ComfyUI to use Manager normally.
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+```
+
+**Solution**: Update ComfyUI to v0.3.76 or later.
+
+---
+
+## Security Levels
+
+| Level | What's Allowed |
+|-------|----------------|
+| `strong` | ComfyUI update only. All other installations blocked. |
+| `normal` | Install/update/remove registered custom nodes and models. |
+| `normal-` | Above + Install via Git URL or pip (localhost only). |
+| `weak` | All operations allowed, including from remote connections. |
+
+**Notes:**
+- `strong` is forced on outdated ComfyUI versions.
+- `normal` is the default and recommended for most users.
+- `normal-` is for developers who need to install unregistered nodes locally.
+- `weak` should only be used in isolated development environments.
+
+### Changing Security Level
+
+Edit `user/__manager/config.ini`:
+```ini
+[default]
+security_level = normal
+```
+
+---
+
+## Error Messages
+
+### "comfyui_outdated" (HTTP 403)
+
+This error appears when:
+- Your ComfyUI doesn't have the System User Protection API
+- All installations are blocked until you update ComfyUI
+
+**Solution**: Update ComfyUI to the latest version.
+
+### "security_level" (HTTP 403)
+
+This error appears when:
+- Your security level blocks the requested operation
+- For example, `strong` level blocks all installations
+
+**Solution**: Lower your security level in config.ini if appropriate for your use case.
+
+---
+
+## Security Warning: Suspicious Path
+
+If you see this error on an **older** ComfyUI:
+
+```
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+[ComfyUI-Manager] ERROR: Suspicious path detected!
+  - '__manager' exists with low security level: 'weak'
+  - Please verify manually:
+      /path/to/ComfyUI/user/__manager/config.ini
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+```
+
+On older ComfyUI versions, the `__manager` directory is not normally created. If this directory exists, it may have been created externally. For safety, manually verify the contents of this directory before updating ComfyUI.
+
+---
+
+## Troubleshooting
+
+### All my installations are blocked
+
+**Check 1**: Is your ComfyUI updated?
+- Old ComfyUI forces `security_level = strong`
+- Update ComfyUI to resolve
+
+**Check 2**: What's your security level?
+- Check `user/__manager/config.ini`
+- `security_level = strong` blocks all installations
+
+### My snapshots are missing
+
+Snapshots are not automatically migrated. You need to manually copy the `snapshots` folder from inside `.legacy-manager-backup` to the `user/__manager/` directory.
+
+### I keep seeing the backup notification
+
+Delete the `.legacy-manager-backup` folder inside `user/__manager/` after confirming you don't need any data from it.
+
+### Snapshot restore is blocked
+
+On old ComfyUI (without System User API), snapshot restore is blocked because security is forced to `strong`. Update ComfyUI to enable snapshot restore.
+
+---
+
+## File Structure Reference
+
+```
+user/
+└── __manager/
+    ├── config.ini              # Manager configuration
+    ├── channels.list           # Custom node channels
+    ├── snapshots/              # Environment snapshots
+    └── .legacy-manager-backup/ # Backup of old Manager data (temporary)
+```
+
+---
+
+## Requirements
+
+- **ComfyUI**: v0.3.76 or later (with System User Protection API)
+- **ComfyUI-Manager**: V3.38 or later
--- a/docs/ko/cm-cli.md
+++ b/docs/ko/cm-cli.md
@@ -23,13 +23,13 @@ OPTIONS:
 ## How To Use?
 * `python cm-cli.py` 를 통해서 실행 시킬 수 있습니다.
 * 예를 들어 custom node를 모두 업데이트 하고 싶다면
-    * ComfyUI-Manager경로 에서 `python cm-cli.py update all` 를 command를 실행할 수 있습니다.
+    * ComfyUI-Manager 경로에서 `python cm-cli.py update all` 명령을 실행할 수 있습니다.
    * ComfyUI 경로에서 실행한다면, `python custom_nodes/ComfyUI-Manager/cm-cli.py update all` 와 같이 cm-cli.py 의 경로를 지정할 수도 있습니다.

 ## Prerequisite
 * ComfyUI 를 실행하는 python과 동일한 python 환경에서 실행해야 합니다.
    * venv를 사용할 경우 해당 venv를 activate 한 상태에서 실행해야 합니다.
-    * portable 버전을 사용할 경우 run_nvidia_gpu.bat 파일이 있는 경로인 경우, 다음과 같은 방식으로 코맨드를 실행해야 합니다.
+* portable 버전을 사용할 경우 run_nvidia_gpu.bat 파일이 있는 경로인 경우, 다음과 같은 방식으로 명령을 실행해야 합니다.
        `.\python_embeded\python.exe ComfyUI\custom_nodes\ComfyUI-Manager\cm-cli.py update all`
 * ComfyUI 의 경로는 COMFYUI_PATH 환경 변수로 설정할 수 있습니다. 만약 생략할 경우 다음과 같은 경고 메시지가 나타나며, ComfyUI-Manager가 설치된 경로를 기준으로 상대 경로로 설정됩니다.
        ```
@@ -40,8 +40,8 @@ OPTIONS:

 ### 1. --channel, --mode
 * 정보 보기 기능과 커스텀 노드 관리 기능의 경우는 --channel과 --mode를 통해 정보 DB를 설정할 수 있습니다.
-* 예들 들어 `python cm-cli.py update all --channel recent --mode remote`와 같은 command를 실행할 경우, 현재 ComfyUI-Manager repo에 내장된 로컬의 정보가 아닌 remote의 최신 정보를 기준으로 동작하며, recent channel에 있는 목록을 대상으로만 동작합니다.
-* --channel, --mode 는 `simple-show, show, install, uninstall, update, disable, enable, fix` command에서만 사용 가능합니다.
+* 예를 들어 `python cm-cli.py update all --channel recent --mode remote`와 같은 명령을 실행할 경우, 현재 ComfyUI-Manager repo에 내장된 로컬의 정보가 아닌 remote의 최신 정보를 기준으로 동작하며, recent channel에 있는 목록을 대상으로만 동작합니다.
+* --channel, --mode 는 `simple-show, show, install, uninstall, update, disable, enable, fix` 명령에서만 사용 가능합니다.

 ### 2. 관리 정보 보기

@@ -51,7 +51,7 @@ OPTIONS:
 * `[show|simple-show]` - `show`는 상세하게 정보를 보여주며, `simple-show`는 간단하게 정보를 보여줍니다.


-`python cm-cli.py show installed` 와 같은 코맨드를 실행하면 설치된 커스텀 노드의 정보를 상세하게 보여줍니다.
+`python cm-cli.py show installed` 와 같은 명령을 실행하면 설치된 커스텀 노드의 정보를 상세하게 보여줍니다.
 ```
 -= ComfyUI-Manager CLI (V2.24) =-

@@ -67,7 +67,7 @@ FETCH DATA from: https://raw.githubusercontent.com/ltdrdata/ComfyUI-Manager/main
 [    DISABLED   ]  ComfyUI-Loopchain                                 (author: Fannovel16)
 ```

-`python cm-cli.py simple-show installed` 와 같은 코맨드를 이용해서 설치된 커스텀 노드의 정보를 간단하게 보여줍니다.
+`python cm-cli.py simple-show installed` 와 같은 명령을 이용해서 설치된 커스텀 노드의 정보를 간단하게 보여줍니다.

 ```
 -= ComfyUI-Manager CLI (V2.24) =-
@@ -89,7 +89,7 @@ ComfyUI-Loopchain
    * `installed`: enable, disable 여부와 상관없이 설치된 모든 노드를 보여줍니다
    * `not-installed`: 설치되지 않은 커스텀 노드의 목록을 보여줍니다.
    * `all`: 모든 커스텀 노드의 목록을 보여줍니다.
-    * `snapshot`: 현재 설치된 커스텀 노드의 snapshot 정보를 보여줍니다. `show`롤 통해서 볼 경우는 json 출력 형태로  보여주며, `simple-show`를 통해서 볼 경우는 간단하게, 커밋 해시와 함께 보여줍니다.
+    * `snapshot`: 현재 설치된 커스텀 노드의 snapshot 정보를 보여줍니다. `show`를 통해서 볼 경우는 json 출력 형태로 보여주며, `simple-show`를 통해서 볼 경우는 간단하게, 커밋 해시와 함께 보여줍니다.
    * `snapshot-list`: ComfyUI-Manager/snapshots 에 저장된 snapshot 파일의 목록을 보여줍니다.

 ### 3. 커스텀 노드 관리 하기
@@ -98,7 +98,7 @@ ComfyUI-Loopchain

 * `python cm-cli.py install ComfyUI-Impact-Pack ComfyUI-Inspire-Pack ComfyUI_experiments` 와 같이 커스텀 노드의 이름을 나열해서 관리 기능을 적용할 수 있습니다.
 * 커스텀 노드의 이름은 `show`를 했을 때 보여주는 이름이며, git repository의 이름입니다. 
-(추후 nickname 을 사용가능하돌고 업데이트 할 예정입니다.)
+(추후 nickname을 사용 가능하도록 업데이트할 예정입니다.)

 `[update|disable|enable|fix] all ?[--channel <channel name>] ?[--mode [remote|local|cache]]`

@@ -124,7 +124,7 @@ ComfyUI-Loopchain
  * `--pip-non-local-url`: web URL에 등록된 pip 패키지들에 대해서 복구를 수행
  * `--pip-local-url`: local 경로를 지정하고 있는 pip 패키지들에 대해서 복구를 수행 
  * `--user-directory`: 사용자 디렉토리 설정
-  * `--restore-to`: 복구될 커스텀 노드가 설치될 경로. (이 옵션을 적용할 경우 오직 대상 경로에 설치된 custom nodes 만 설치된 것으로 인식함.)
+  * `--restore-to`: 복구될 커스텀 노드가 설치될 경로. (이 옵션을 적용할 경우 오직 대상 경로에 설치된 custom nodes만 설치된 것으로 인식함.)

 ### 5. CLI only mode

@@ -133,7 +133,7 @@ ComfyUI-Manager를 CLI로만 사용할 것인지를 설정할 수 있습니다.
 `cli-only-mode [enable|disable]`

 * security 혹은 policy 의 이유로 GUI 를 통한 ComfyUI-Manager 사용을 제한하고 싶은 경우 이 모드를 사용할 수 있습니다.
-    * CLI only mode를 적용할 경우 ComfyUI-Manager 가 매우 제한된 상태로 로드되어, 내부적으로 제공하는 web API가 비활성화 되며, 메인 메뉴에서도 Manager 버튼이 표시되지 않습니다.
+    * CLI only mode를 적용할 경우 ComfyUI-Manager 가 매우 제한된 상태로 로드되어, 내부적으로 제공하는 web API가 비활성화되며, 메인 메뉴에서도 Manager 버튼이 표시되지 않습니다.


 ### 6. 의존성 설치
@@ -141,10 +141,10 @@ ComfyUI-Manager를 CLI로만 사용할 것인지를 설정할 수 있습니다.
 `restore-dependencies`

 * `ComfyUI/custom_nodes` 하위 경로에 커스텀 노드들이 설치되어 있긴 하지만, 의존성이 설치되지 않은 경우 사용할 수 있습니다.
-* colab 과 같이 cloud instance를 새로 시작하는 경우 의존성 재설치 및 설치 스크립트가 재실행 되어야 하는 경우 사용합니다.
-* ComfyUI을 재설치할 경우, custom_nodes 경로만 백업했다가 재설치 할 경우 활용 가능합니다.
+* Colab과 같이 cloud instance를 새로 시작하는 경우 의존성 재설치 및 설치 스크립트가 재실행되어야 하는 경우 사용합니다.
+* ComfyUI를 재설치할 경우, custom_nodes 경로만 백업했다가 재설치할 경우 활용 가능합니다.


 ### 7. clear

-GUI에서 install, update를 하거나 snapshot 을 restore하는 경우 예약을 통해서 다음번 ComfyUI를 실행할 경우 실행되는 구조입니다. `clear` 는 이런 예약 상태를 clear해서, 아무런 사전 실행이 적용되지 않도록 합니다.
+GUI에서 install, update를 하거나 snapshot을 restore하는 경우 예약을 통해서 다음번 ComfyUI를 실행할 경우 실행되는 구조입니다. `clear` 는 이런 예약 상태를 clear해서, 아무런 사전 실행이 적용되지 않도록 합니다.
--- a/extension-node-map.json
+++ b/extension-node-map.json
--- a/git_helper.py
+++ b/git_helper.py
@@ -2,6 +2,7 @@ import subprocess
 import sys
 import os
 import traceback
+import time

 import git
 import json
@@ -219,7 +220,14 @@ def gitpull(path):
            repo.close()
            return

-        remote.pull()
+        try:
+            repo.git.pull('--ff-only')
+        except git.GitCommandError:
+            backup_name = f'backup_{time.strftime("%Y%m%d_%H%M%S")}'
+            repo.create_head(backup_name)
+            print(f"[ComfyUI-Manager] Cannot fast-forward. Backup created: {backup_name}")
+            repo.git.reset('--hard', f'{remote_name}/{branch_name}')
+            print(f"[ComfyUI-Manager] Reset to {remote_name}/{branch_name}")

        repo.git.submodule('update', '--init', '--recursive')
        new_commit_hash = repo.head.commit.hexsha
--- a/github-stats-cache.json
+++ b/github-stats-cache.json
--- a/github-stats.json
+++ b/github-stats.json
--- a/glob/manager_core.py
+++ b/glob/manager_core.py
@@ -40,10 +40,11 @@ import cnr_utils
 import manager_util
 import git_utils
 import manager_downloader
+import manager_migration
 from node_package import InstalledNodePackage


-version_code = [3, 36]
+version_code = [3, 38, 2]
 version_str = f"V{version_code[0]}.{version_code[1]}" + (f'.{version_code[2]}' if len(version_code) > 2 else '')


@@ -214,9 +215,10 @@ def update_user_directory(user_dir):
    global manager_pip_blacklist_path
    global manager_components_path

-    manager_files_path = os.path.abspath(os.path.join(user_dir, 'default', 'ComfyUI-Manager'))
+    manager_files_path = manager_migration.get_manager_path(user_dir)
    if not os.path.exists(manager_files_path):
        os.makedirs(manager_files_path)
+    manager_migration.run_migration_checks(user_dir, manager_files_path)

    manager_snapshot_path = os.path.join(manager_files_path, "snapshots")
    if not os.path.exists(manager_snapshot_path):
@@ -1484,6 +1486,7 @@ class UnifiedManager:
                return ManagedResult('skip')
            elif self.is_disabled(node_id):
                return self.unified_enable(node_id)
+
            else:
                version_spec = self.resolve_unspecified_version(node_id)

@@ -1718,7 +1721,7 @@ def read_config():
        manager_util.use_uv = default_conf['use_uv'].lower() == 'true' if 'use_uv' in default_conf else False
        manager_util.bypass_ssl = get_bool('bypass_ssl', False)

-        return {
+        result = {
                    'http_channel_enabled': get_bool('http_channel_enabled', False),
                    'preview_method': default_conf.get('preview_method', manager_funcs.get_current_preview_method()).lower(),
                    'git_exe': default_conf.get('git_exe', ''),
@@ -1738,6 +1741,8 @@ def read_config():
                    'security_level': default_conf.get('security_level', 'normal').lower(),
                    'db_mode': default_conf.get('db_mode', 'cache').lower(),
               }
+        manager_migration.force_security_level_if_needed(result)
+        return result

    except Exception:
        import importlib.util
@@ -1745,7 +1750,7 @@ def read_config():
        manager_util.use_uv = importlib.util.find_spec("uv") is not None and platform.system() != "Windows"
        manager_util.bypass_ssl = False

-        return {
+        result = {
            'http_channel_enabled': False,
            'preview_method': manager_funcs.get_current_preview_method(),
            'git_exe': '',
@@ -1765,6 +1770,8 @@ def read_config():
            'security_level': 'normal', # strong | normal | normal- | weak
            'db_mode': 'cache',         # local | cache | remote
        }
+        manager_migration.force_security_level_if_needed(result)
+        return result


 def get_config():
@@ -2246,9 +2253,17 @@ def git_pull(path):

        current_branch = repo.active_branch
        remote_name = current_branch.tracking_branch().remote_name
-        remote = repo.remote(name=remote_name)

-        remote.pull()
+        try:
+            repo.git.pull('--ff-only')
+        except git.GitCommandError:
+            branch_name = current_branch.name
+            backup_name = f'backup_{time.strftime("%Y%m%d_%H%M%S")}'
+            repo.create_head(backup_name)
+            logging.info(f"[ComfyUI-Manager] Cannot fast-forward. Backup created: {backup_name}")
+            repo.git.reset('--hard', f'{remote_name}/{branch_name}')
+            logging.info(f"[ComfyUI-Manager] Reset to {remote_name}/{branch_name}")
+
        repo.git.submodule('update', '--init', '--recursive')

        repo.close()
@@ -2532,6 +2547,7 @@ def update_to_stable_comfyui(repo_path):
        else:
            logging.info(f"[ComfyUI-Manager] Updating ComfyUI: {current_tag} -> {latest_tag}")
            repo.git.checkout(latest_tag)
+            execute_install_script("ComfyUI", repo_path, instant_execution=False, no_deps=False)
            return 'updated', latest_tag
    except:
        traceback.print_exc()
@@ -2663,9 +2679,13 @@ def check_state_of_git_node_pack_single(item, do_fetch=False, do_update_check=Tr


 def get_installed_pip_packages():
-    # extract pip package infos
-    cmd = manager_util.make_pip_cmd(['freeze'])
-    pips = subprocess.check_output(cmd, text=True).split('\n')
+    try:
+        # extract pip package infos
+        cmd = manager_util.make_pip_cmd(['freeze'])
+        pips = subprocess.check_output(cmd, text=True).split('\n')
+    except Exception as e:
+        logging.warning("[ComfyUI-Manager] Could not enumerate pip packages for snapshot: %s", e)
+        return {}

    res = {}
    for x in pips:
@@ -3354,8 +3374,8 @@ def get_comfyui_versions(repo=None):
        repo = git.Repo(comfy_path)

    try:
-        remote = get_remote_name(repo)   
-        repo.remotes[remote].fetch()    
+        remote = get_remote_name(repo)
+        repo.remotes[remote].fetch()
    except:
        logging.error("[ComfyUI-Manager] Failed to fetch ComfyUI")

--- a/glob/manager_migration.py
+++ b/glob/manager_migration.py
@@ -0,0 +1,356 @@
+"""
+ComfyUI-Manager migration module.
+Handles migration from legacy paths to new __manager path structure.
+"""
+
+import os
+import sys
+import subprocess
+import configparser
+
+# Startup notices for notice board
+startup_notices = []  # List of (message, level) tuples
+
+
+def add_startup_notice(message, level='warning'):
+    """Add a notice to be displayed on Manager notice board.
+
+    Args:
+        message: HTML-formatted message string
+        level: 'warning', 'error', 'info'
+    """
+    global startup_notices
+    startup_notices.append((message, level))
+
+
+# Cache for API check (computed once per session)
+_cached_has_system_user_api = None
+
+
+def has_system_user_api():
+    """Check if ComfyUI has the System User Protection API (PR #10966).
+
+    Result is cached for performance.
+    """
+    global _cached_has_system_user_api
+    if _cached_has_system_user_api is None:
+        try:
+            import folder_paths
+            _cached_has_system_user_api = hasattr(folder_paths, 'get_system_user_directory')
+        except Exception:
+            _cached_has_system_user_api = False
+    return _cached_has_system_user_api
+
+
+def get_manager_path(user_dir):
+    """Get the appropriate manager files path based on ComfyUI version.
+
+    Returns:
+        str: manager_files_path
+    """
+    if has_system_user_api():
+        return os.path.abspath(os.path.join(user_dir, '__manager'))
+    else:
+        return os.path.abspath(os.path.join(user_dir, 'default', 'ComfyUI-Manager'))
+
+
+def run_migration_checks(user_dir, manager_files_path):
+    """Run all migration and security checks.
+
+    Call this after get_manager_path() to handle:
+    - Legacy config migration (new ComfyUI)
+    - Legacy backup notification (every startup)
+    - Suspicious directory detection (old ComfyUI)
+    - Outdated ComfyUI warning (old ComfyUI)
+    """
+    if has_system_user_api():
+        migrated = migrate_legacy_config(user_dir, manager_files_path)
+        # Only check for legacy backup if migration didn't just happen
+        # (migration already shows backup location in its message)
+        if not migrated:
+            check_legacy_backup(manager_files_path)
+    else:
+        check_suspicious_manager(user_dir)
+        warn_outdated_comfyui()
+
+
+def check_legacy_backup(manager_files_path):
+    """Check for legacy backup and notify user to verify and remove it.
+
+    This runs on every startup to remind users about pending legacy backup.
+    """
+    backup_dir = os.path.join(manager_files_path, '.legacy-manager-backup')
+    if not os.path.exists(backup_dir):
+        return
+
+    # Terminal output
+    print("\n" + "-"*70)
+    print("[ComfyUI-Manager] NOTICE: Legacy backup exists")
+    print("  - Your old Manager data was backed up to:")
+    print(f"      {backup_dir}")
+    print("  - Please verify and remove it when no longer needed.")
+    print("-"*70 + "\n")
+
+    # Notice board output
+    add_startup_notice(
+        "Legacy ComfyUI-Manager data backup exists. Please verify and remove when no longer needed. See terminal for details.",
+        level='info'
+    )
+
+
+def check_suspicious_manager(user_dir):
+    """Check for suspicious __manager directory on old ComfyUI.
+
+    On old ComfyUI without System User API, if __manager exists with low security,
+    warn the user to verify manually.
+
+    Returns:
+        bool: True if suspicious setup detected
+    """
+    if has_system_user_api():
+        return False  # Not suspicious on new ComfyUI
+
+    suspicious_path = os.path.abspath(os.path.join(user_dir, '__manager'))
+    if not os.path.exists(suspicious_path):
+        return False
+
+    config_path = os.path.join(suspicious_path, 'config.ini')
+    if not os.path.exists(config_path):
+        return False
+
+    config = configparser.ConfigParser()
+    config.read(config_path)
+    sec_level = config.get('default', 'security_level', fallback='normal').lower()
+
+    if sec_level in ['weak', 'normal-']:
+        # Terminal output
+        print("\n" + "!"*70)
+        print("[ComfyUI-Manager] ERROR: Suspicious path detected!")
+        print(f"  - '__manager' exists with low security level: '{sec_level}'")
+        print("  - Please verify manually:")
+        print(f"      {config_path}")
+        print("!"*70 + "\n")
+
+        # Notice board output
+        add_startup_notice(
+            "[Security Alert] Suspicious path detected. See terminal log for details.",
+            level='error'
+        )
+        return True
+
+    return False
+
+
+def warn_outdated_comfyui():
+    """Warn user about outdated ComfyUI without System User API."""
+    if has_system_user_api():
+        return
+
+    # Terminal output
+    print("\n" + "!"*70)
+    print("[ComfyUI-Manager] ERROR: ComfyUI version is outdated!")
+    print("  - Most operations are blocked for security.")
+    print("  - ComfyUI update is still allowed.")
+    print("  - Please update ComfyUI to use Manager normally.")
+    print("!"*70 + "\n")
+
+    # Notice board output
+    add_startup_notice(
+        "[Security Alert] ComfyUI outdated. Installations blocked (update allowed).<BR>"
+        "Update ComfyUI for normal operation.",
+        level='error'
+    )
+
+
+def migrate_legacy_config(user_dir, manager_files_path):
+    """Migrate ONLY config.ini to new __manager path if needed.
+
+    IMPORTANT: Only config.ini is migrated. Other files (snapshots, cache, etc.)
+    are NOT migrated - users must recreate them.
+
+    Scenarios:
+    1. Legacy exists, New doesn't exist → Migrate config.ini
+    2. Legacy exists, New exists → First update after upgrade
+       - Run ComfyUI dependency installation
+       - Rename legacy to .backup
+    3. Legacy doesn't exist → No migration needed
+
+    Returns:
+        bool: True if migration was performed
+    """
+    if not has_system_user_api():
+        return False
+
+    legacy_dir = os.path.join(user_dir, 'default', 'ComfyUI-Manager')
+    legacy_config = os.path.join(legacy_dir, 'config.ini')
+    new_config = os.path.join(manager_files_path, 'config.ini')
+
+    if not os.path.exists(legacy_dir):
+        return False  # No legacy directory, nothing to migrate
+
+    # IMPORTANT: Check for config.ini existence, not just directory
+    # (because makedirs() creates __manager before this function is called)
+
+    # Case: Both configs exist (first update after ComfyUI upgrade)
+    # This means user ran new ComfyUI at least once, creating __manager/config.ini
+    if os.path.exists(legacy_config) and os.path.exists(new_config):
+        _handle_first_update_migration(user_dir, legacy_dir, manager_files_path)
+        return True
+
+    # Case: Legacy config exists but new config doesn't (normal migration)
+    # This is the first run after ComfyUI upgrade
+    if os.path.exists(legacy_config) and not os.path.exists(new_config):
+        pass  # Continue with normal migration below
+    else:
+        return False
+
+    # Terminal output
+    print("\n" + "-"*70)
+    print("[ComfyUI-Manager] NOTICE: Legacy config.ini detected")
+    print(f"  - Old: {legacy_config}")
+    print(f"  - New: {new_config}")
+    print("  - Migrating config.ini only (other files are NOT migrated).")
+    print("  - Security level below 'normal' will be raised.")
+    print("-"*70 + "\n")
+
+    _migrate_config_with_security_check(legacy_config, new_config)
+
+    # Move legacy directory to backup
+    _move_legacy_to_backup(legacy_dir, manager_files_path)
+
+    return True
+
+
+def _handle_first_update_migration(user_dir, legacy_dir, manager_files_path):
+    """Handle first ComfyUI update when both legacy and new directories exist.
+
+    This scenario happens when:
+    - User was on old ComfyUI (using default/ComfyUI-Manager)
+    - ComfyUI was updated (now has System User API)
+    - Manager already created __manager on first new run
+    - But legacy directory still exists
+
+    Actions:
+    1. Run ComfyUI dependency installation
+    2. Move legacy to __manager/.legacy-manager-backup
+    """
+    # Terminal output
+    print("\n" + "-"*70)
+    print("[ComfyUI-Manager] NOTICE: First update after ComfyUI upgrade detected")
+    print("  - Both legacy and new directories exist.")
+    print("  - Running ComfyUI dependency installation...")
+    print("-"*70 + "\n")
+
+    # Run ComfyUI dependency installation
+    # Path: glob/manager_migration.py → glob → comfyui-manager → custom_nodes → ComfyUI
+    try:
+        comfyui_path = os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(__file__))))
+        requirements_path = os.path.join(comfyui_path, 'requirements.txt')
+        if os.path.exists(requirements_path):
+            subprocess.run([sys.executable, '-m', 'pip', 'install', '-r', requirements_path],
+                         capture_output=True, check=False)
+            print("[ComfyUI-Manager] ComfyUI dependencies installation completed.")
+    except Exception as e:
+        print(f"[ComfyUI-Manager] WARNING: Failed to install ComfyUI dependencies: {e}")
+
+    # Move legacy to backup inside __manager
+    _move_legacy_to_backup(legacy_dir, manager_files_path)
+
+
+def _move_legacy_to_backup(legacy_dir, manager_files_path):
+    """Move legacy directory to backup inside __manager.
+
+    Returns:
+        str: Path to backup directory if successful, None if failed
+    """
+    import shutil
+
+    backup_dir = os.path.join(manager_files_path, '.legacy-manager-backup')
+
+    try:
+        if os.path.exists(backup_dir):
+            shutil.rmtree(backup_dir)  # Remove old backup if exists
+        shutil.move(legacy_dir, backup_dir)
+
+        # Terminal output (full paths shown here only)
+        print("\n" + "-"*70)
+        print("[ComfyUI-Manager] NOTICE: Legacy settings migrated")
+        print(f"  - Old location: {legacy_dir}")
+        print(f"  - Backed up to: {backup_dir}")
+        print("  - Please verify and remove the backup when no longer needed.")
+        print("-"*70 + "\n")
+
+        # Notice board output (no full paths for security)
+        add_startup_notice(
+            "Legacy ComfyUI-Manager data migrated. See terminal for details.",
+            level='info'
+        )
+        return backup_dir
+    except Exception as e:
+        print(f"[ComfyUI-Manager] WARNING: Failed to backup legacy directory: {e}")
+        add_startup_notice(
+            f"[MIGRATION] Failed to backup legacy directory: {e}",
+            level='warning'
+        )
+        return None
+
+
+def _migrate_config_with_security_check(legacy_path, new_path):
+    """Migrate legacy config, raising security level only if below default."""
+    config = configparser.ConfigParser()
+    try:
+        config.read(legacy_path)
+    except Exception as e:
+        print(f"[ComfyUI-Manager] WARNING: Failed to parse config.ini: {e}")
+        print("  - Creating fresh config with default settings.")
+        add_startup_notice(
+            "[MIGRATION] Failed to parse legacy config. Using defaults.",
+            level='warning'
+        )
+        return  # Skip migration, let Manager create fresh config
+
+    # Security level hierarchy: strong > normal > normal- > weak
+    # Default is 'normal', only raise if below default
+    if 'default' in config:
+        current_level = config['default'].get('security_level', 'normal').lower()
+        below_default_levels = ['weak', 'normal-']
+
+        if current_level in below_default_levels:
+            config['default']['security_level'] = 'normal'
+
+            # Terminal output
+            print("\n" + "="*70)
+            print("[ComfyUI-Manager] WARNING: Security level adjusted")
+            print(f"  - Previous: '{current_level}' → New: 'normal'")
+            print("  - Raised to prevent unauthorized remote access.")
+            print("="*70 + "\n")
+
+            # Notice board output
+            add_startup_notice(
+                f"[MIGRATION] Security level raised: '{current_level}' → 'normal'.<BR>"
+                "To prevent unauthorized remote access.",
+                level='warning'
+            )
+        else:
+            print(f"  - Security level: '{current_level}' (no change needed)")
+
+    # Ensure directory exists
+    os.makedirs(os.path.dirname(new_path), exist_ok=True)
+
+    with open(new_path, 'w') as f:
+        config.write(f)
+
+
+def force_security_level_if_needed(config_dict):
+    """Force security level to 'strong' if on old ComfyUI.
+
+    Args:
+        config_dict: Configuration dictionary to modify in-place
+
+    Returns:
+        bool: True if security level was forced
+    """
+    if not has_system_user_api():
+        config_dict['security_level'] = 'strong'
+        return True
+    return False
--- a/glob/manager_server.py
+++ b/glob/manager_server.py
@@ -22,6 +22,7 @@ import asyncio
 import queue

 import manager_downloader
+import manager_migration


 logging.info(f"### Loading: ComfyUI-Manager ({core.version_str})")
@@ -276,6 +277,13 @@ import zipfile
 import urllib.request


+def security_403_response():
+    """Return appropriate 403 response based on ComfyUI version."""
+    if not manager_migration.has_system_user_api():
+        return web.json_response({"error": "comfyui_outdated"}, status=403)
+    return web.json_response({"error": "security_level"}, status=403)
+
+
 def get_model_dir(data, show_log=False):
    if 'download_model_base' in folder_paths.folder_names_and_paths:
        models_base = folder_paths.folder_names_and_paths['download_model_base'][0][0]
@@ -732,7 +740,7 @@ async def fetch_updates(request):
 async def update_all(request):
    if not is_allowed_security_level('middle'):
        logging.error(SECURITY_MESSAGE_MIDDLE_OR_BELOW)
-        return web.Response(status=403)
+        return security_403_response()

    with task_worker_lock:
        is_processing = task_worker_thread is not None and task_worker_thread.is_alive()
@@ -965,7 +973,7 @@ async def get_snapshot_list(request):
 async def remove_snapshot(request):
    if not is_allowed_security_level('middle'):
        logging.error(SECURITY_MESSAGE_MIDDLE_OR_BELOW)
-        return web.Response(status=403)
+        return security_403_response()

    try:
        target = request.rel_url.query["target"]
@@ -983,7 +991,7 @@ async def remove_snapshot(request):
 async def restore_snapshot(request):
    if not is_allowed_security_level('middle'):
        logging.error(SECURITY_MESSAGE_MIDDLE_OR_BELOW)
-        return web.Response(status=403)
+        return security_403_response()

    try:
        target = request.rel_url.query["target"]
@@ -1302,7 +1310,7 @@ async def fix_custom_node(request):
 async def install_custom_node_git_url(request):
    if not is_allowed_security_level('high'):
        logging.error(SECURITY_MESSAGE_NORMAL_MINUS)
-        return web.Response(status=403)
+        return security_403_response()

    url = await request.text()
    res = await core.gitclone_install(url)
@@ -1322,7 +1330,7 @@ async def install_custom_node_git_url(request):
 async def install_custom_node_pip(request):
    if not is_allowed_security_level('high'):
        logging.error(SECURITY_MESSAGE_NORMAL_MINUS)
-        return web.Response(status=403)
+        return security_403_response()

    packages = await request.text()
    core.pip_install(packages.split(' '))
@@ -1594,6 +1602,16 @@ async def get_notice(request):
                    except:
                        pass

+                    # Prepend startup notices from manager_migration
+                    for message, level in reversed(manager_migration.startup_notices):
+                        if level == 'error':
+                            style = 'color:red; background-color:white; font-weight:bold'
+                        elif level == 'warning':
+                            style = 'color:orange; background-color:white; font-weight:bold'
+                        else:
+                            style = 'color:blue; background-color:white'
+                        markdown_content = f'<P style="{style}">{message}</P>' + markdown_content
+
                    return web.Response(text=markdown_content, status=200)
                else:
                    return web.Response(text="Unable to retrieve Notice", status=200)
@@ -1601,11 +1619,35 @@ async def get_notice(request):
                return web.Response(text="Unable to retrieve Notice", status=200)


+@routes.get("/manager/startup_alerts")
+async def get_startup_alerts(request):
+    """Return startup alerts for customAlert display on page load.
+
+    Returns JSON array of alerts that should be shown to user immediately.
+    All startup notices (error, warning, info) are returned.
+    """
+    alerts = []
+
+    # Return all startup notices for alert display
+    for message, level in manager_migration.startup_notices:
+        # Convert HTML BR to newlines for customAlert
+        text = message.replace('<BR>', '\n').replace('<br>', '\n')
+        # Add [ComfyUI-Manager] prefix for customAlert (notice board shows in Manager UI anyway)
+        text = text.replace('[Security Alert]', '[ComfyUI-Manager] Security Alert:')
+        text = text.replace('[MIGRATION]', '[ComfyUI-Manager] Migration:')
+        alerts.append({
+            'message': text,
+            'level': level
+        })
+
+    return web.json_response(alerts)
+
+
@routes.get("/manager/reboot")
 def restart(self):
    if not is_allowed_security_level('middle'):
        logging.error(SECURITY_MESSAGE_MIDDLE_OR_BELOW)
-        return web.Response(status=403)
+        return security_403_response()

    try:
        sys.stdout.close_log()
--- a/glob/manager_util.py
+++ b/glob/manager_util.py
@@ -15,6 +15,7 @@ import re
 import logging
 import platform
 import shlex
+from functools import lru_cache


 cache_lock = threading.Lock()
@@ -34,18 +35,64 @@ def add_python_path_to_env():
    os.environ['PATH'] = os.path.dirname(sys.executable)+sep+os.environ['PATH']


+@lru_cache(maxsize=2)
+def get_pip_cmd(force_uv=False):
+    """
+    Get the base pip command, with automatic fallback to uv if pip is unavailable.
+
+    Args:
+        force_uv (bool): If True, use uv directly without trying pip
+
+    Returns:
+        list: Base command for pip operations
+    """
+    embedded = 'python_embeded' in sys.executable
+
+    # Try pip first (unless forcing uv)
+    if not force_uv:
+        try:
+            test_cmd = [sys.executable] + (['-s'] if embedded else []) + ['-m', 'pip', '--version']
+            subprocess.check_output(test_cmd, stderr=subprocess.DEVNULL, timeout=5)
+            return [sys.executable] + (['-s'] if embedded else []) + ['-m', 'pip']
+        except Exception:
+            logging.warning("[ComfyUI-Manager] `python -m pip` not available. Falling back to `uv`.")
+
+    # Try uv (either forced or pip failed)
+    import shutil
+
+    # Try uv as Python module
+    try:
+        test_cmd = [sys.executable] + (['-s'] if embedded else []) + ['-m', 'uv', '--version']
+        subprocess.check_output(test_cmd, stderr=subprocess.DEVNULL, timeout=5)
+        logging.info("[ComfyUI-Manager] Using `uv` as Python module for pip operations.")
+        return [sys.executable] + (['-s'] if embedded else []) + ['-m', 'uv', 'pip']
+    except Exception:
+        pass
+
+    # Try standalone uv
+    if shutil.which('uv'):
+        logging.info("[ComfyUI-Manager] Using standalone `uv` for pip operations.")
+        return ['uv', 'pip']
+
+    # Nothing worked
+    logging.error("[ComfyUI-Manager] Neither `python -m pip` nor `uv` are available. Cannot proceed with package operations.")
+    raise Exception("Neither `pip` nor `uv` are available for package management")
+
+
 def make_pip_cmd(cmd):
-    if 'python_embeded' in sys.executable:
-        if use_uv:
-            return [sys.executable, '-s', '-m', 'uv', 'pip'] + cmd
-        else:
-            return [sys.executable, '-s', '-m', 'pip'] + cmd
-    else:
-        # FIXED: https://github.com/ltdrdata/ComfyUI-Manager/issues/1667
-        if use_uv:
-            return [sys.executable, '-m', 'uv', 'pip'] + cmd
-        else:
-            return [sys.executable, '-m', 'pip'] + cmd
+    """
+    Create a pip command by combining the cached base pip command with the given arguments.
+
+    Args:
+        cmd (list): List of pip command arguments (e.g., ['install', 'package'])
+
+    Returns:
+        list: Complete command list ready for subprocess execution
+    """
+    global use_uv
+    base_cmd = get_pip_cmd(force_uv=use_uv)
+    return base_cmd + cmd
+

 # DON'T USE StrictVersion - cannot handle pre_release version
 # try:
--- a/glob/share_3rdparty.py
+++ b/glob/share_3rdparty.py
@@ -335,8 +335,7 @@ async def share_art(request):
        content_type = assetFileType

        try:
-            from matrix_client.api import MatrixHttpApi
-            from matrix_client.client import MatrixClient
+            from nio import AsyncClient, LoginResponse, UploadResponse

            homeserver = 'matrix.org'
            if matrix_auth:
@@ -345,20 +344,35 @@ async def share_art(request):
            if not homeserver.startswith("https://"):
                homeserver = "https://" + homeserver

-            client = MatrixClient(homeserver)
-            try:
-                token = client.login(username=matrix_auth['username'], password=matrix_auth['password'])
-                if not token:
-                    return web.json_response({"error": "Invalid Matrix credentials."}, content_type='application/json', status=400)
-            except:
+            client = AsyncClient(homeserver, matrix_auth['username'])
+
+            # Login
+            login_resp = await client.login(matrix_auth['password'])
+            if not isinstance(login_resp, LoginResponse) or not login_resp.access_token:
+                await client.close()
                return web.json_response({"error": "Invalid Matrix credentials."}, content_type='application/json', status=400)

-            matrix = MatrixHttpApi(homeserver, token=token)
+            # Upload asset
            with open(asset_filepath, 'rb') as f:
-                mxc_url = matrix.media_upload(f.read(), content_type, filename=filename)['content_uri']
+                upload_resp, _maybe_keys = await client.upload(f, content_type=content_type, filename=filename)
+                asset_data = f.seek(0) or f.read()  # get size for info below
+            if not isinstance(upload_resp, UploadResponse) or not upload_resp.content_uri:
+                await client.close()
+                return web.json_response({"error": "Failed to upload asset to Matrix."}, content_type='application/json', status=500)
+            mxc_url = upload_resp.content_uri

-            workflow_json_mxc_url = matrix.media_upload(prompt['workflow'], 'application/json', filename='workflow.json')['content_uri']
+            # Upload workflow JSON
+            import io
+            workflow_json_bytes = json.dumps(prompt['workflow']).encode('utf-8')
+            workflow_io = io.BytesIO(workflow_json_bytes)
+            upload_workflow_resp, _maybe_keys = await client.upload(workflow_io, content_type='application/json', filename='workflow.json')
+            workflow_io.seek(0)
+            if not isinstance(upload_workflow_resp, UploadResponse) or not upload_workflow_resp.content_uri:
+                await client.close()
+                return web.json_response({"error": "Failed to upload workflow to Matrix."}, content_type='application/json', status=500)
+            workflow_json_mxc_url = upload_workflow_resp.content_uri

+            # Send text message
            text_content = ""
            if title:
                text_content += f"{title}\n"
@@ -366,9 +380,44 @@ async def share_art(request):
                text_content += f"{description}\n"
            if credits:
                text_content += f"\ncredits: {credits}\n"
-            matrix.send_message(comfyui_share_room_id, text_content)
-            matrix.send_content(comfyui_share_room_id, mxc_url, filename, 'm.image')
-            matrix.send_content(comfyui_share_room_id, workflow_json_mxc_url, 'workflow.json', 'm.file')
+            await client.room_send(
+                room_id=comfyui_share_room_id,
+                message_type="m.room.message",
+                content={"msgtype": "m.text", "body": text_content}
+            )
+
+            # Send image
+            await client.room_send(
+                room_id=comfyui_share_room_id,
+                message_type="m.room.message",
+                content={
+                    "msgtype": "m.image",
+                    "body": filename,
+                    "url": mxc_url,
+                    "info": {
+                        "mimetype": content_type,
+                        "size": len(asset_data)
+                    }
+                }
+            )
+
+            # Send workflow JSON file
+            await client.room_send(
+                room_id=comfyui_share_room_id,
+                message_type="m.room.message",
+                content={
+                    "msgtype": "m.file",
+                    "body": "workflow.json",
+                    "url": workflow_json_mxc_url,
+                    "info": {
+                        "mimetype": "application/json",
+                        "size": len(workflow_json_bytes)
+                    }
+                }
+            )
+
+            await client.close()
+
        except:
            import traceback
            traceback.print_exc()
--- a/js/README.md
+++ b/js/README.md
@@ -13,7 +13,7 @@ This directory contains the JavaScript frontend implementation for ComfyUI-Manag
 ## Sharing Components

 - **comfyui-share-common.js**: Base functionality for workflow sharing features.
- **comfyui-share-copus.js**: Integration with the ComfyUI Opus sharing platform.
+- **comfyui-share-copus.js**: Integration with the ComfyUI Copus sharing platform.
 - **comfyui-share-openart.js**: Integration with the OpenArt sharing platform.
 - **comfyui-share-youml.js**: Integration with the YouML sharing platform.

@@ -47,4 +47,4 @@ CSS files are included for specific components:
 - **custom-nodes-manager.css**: Styling for the node management UI
 - **model-manager.css**: Styling for the model management UI

-This frontend implementation provides a comprehensive yet user-friendly interface for managing the ComfyUI ecosystem.
+This frontend implementation provides a comprehensive yet user-friendly interface for managing the ComfyUI ecosystem.
--- a/js/cm-api.js
+++ b/js/cm-api.js
@@ -1,6 +1,6 @@
 import { api } from "../../scripts/api.js";
 import { app } from "../../scripts/app.js";
-import { sleep, customConfirm, customAlert } from "./common.js";
+import { sleep, customConfirm, customAlert, handle403Response, show_message } from "./common.js";

 async function tryInstallCustomNode(event) {
 	let msg = '-= [ComfyUI Manager] extension installation request =-\n\n';
@@ -42,7 +42,7 @@ async function tryInstallCustomNode(event) {
 									});

 			if(response.status == 403) {
-				show_message('This action is not allowed with this security level configuration.');
+				await handle403Response(response);
 				return false;
 			}
 			else if(response.status == 400) {
@@ -54,7 +54,7 @@ async function tryInstallCustomNode(event) {

 		let response = await api.fetchApi("/manager/reboot");
 		if(response.status == 403) {
-			show_message('This action is not allowed with this security level configuration.');
+			await handle403Response(response);
 			return false;
 		}

--- a/js/comfyui-manager.js
+++ b/js/comfyui-manager.js
@@ -14,7 +14,7 @@ import { OpenArtShareDialog } from "./comfyui-share-openart.js";
 import {
 	free_models, install_pip, install_via_git_url, manager_instance,
 	rebootAPI, setManagerInstance, show_message, customAlert, customPrompt,
-	infoToast, showTerminal, setNeedRestart
+	infoToast, showTerminal, setNeedRestart, handle403Response
 } from "./common.js";
 import { ComponentBuilderDialog, getPureName, load_components, set_component_policy } from "./components-manager.js";
 import { CustomNodesManager } from "./custom-nodes-manager.js";
@@ -753,9 +753,9 @@ async function onQueueStatus(event) {

 		const rebootButton = document.getElementById('cm-reboot-button5');
 		rebootButton?.addEventListener("click",
-			function() {
-				if(rebootAPI()) {
-					manager_dialog.close();
+			async function() {
+				if(await rebootAPI()) {
+					manager_instance.close();
 				}
 			});
 	}
@@ -780,8 +780,13 @@ async function updateAll(update_comfyui) {

 	const response = await api.fetchApi(`/manager/queue/update_all?mode=${mode}`);

-	if (response.status == 401) {
+	if (response.status == 403) {
+		await handle403Response(response);
+		reset_action_buttons();
+	}
+	else if (response.status == 401) {
 		customAlert('Another task is already in progress. Please stop the ongoing task first.');
+		reset_action_buttons();
 	}
 	else if(response.status == 200) {
 		is_updating = true;
@@ -1453,6 +1458,31 @@ app.registerExtension({

 		load_components();

+		// Fetch and show startup alerts (critical errors like outdated ComfyUI)
+		// Poll until extensionManager.toast is ready (set in Vue onMounted)
+		const showStartupAlerts = async () => {
+			let toastWaitCount = 0;
+			const waitForToast = () => {
+				if (window['app']?.extensionManager?.toast) {
+					fetch('/manager/startup_alerts')
+						.then(response => response.ok ? response.json() : [])
+						.then(alerts => {
+							for (const alert of alerts) {
+								customAlert(alert.message);
+							}
+						})
+						.catch(e => console.warn('[ComfyUI-Manager] Failed to fetch startup alerts:', e));
+				} else if (toastWaitCount < 300) {  // Max 30 seconds (300 * 100ms)
+					toastWaitCount++;
+					setTimeout(waitForToast, 100);
+				} else {
+					console.warn('[ComfyUI-Manager] Timeout waiting for toast. Startup alerts skipped.');
+				}
+			};
+			waitForToast();
+		};
+		showStartupAlerts();
+
 		const menu = document.querySelector(".comfy-menu");
 		const separator = document.createElement("hr");

--- a/js/common.js
+++ b/js/common.js
@@ -100,6 +100,19 @@ export function show_message(msg) {
 	app.ui.dialog.element.style.zIndex = 1100;
 }

+export async function handle403Response(res, defaultMessage) {
+	try {
+		const data = await res.json();
+		if(data.error === 'comfyui_outdated') {
+			show_message('ComfyUI version is outdated.<BR>Please update ComfyUI to use Manager normally.');
+		} else {
+			show_message(defaultMessage || 'This action is not allowed with this security level configuration.');
+		}
+	} catch {
+		show_message(defaultMessage || 'This action is not allowed with this security level configuration.');
+	}
+}
+
 export async function sleep(ms) {
 	return new Promise(resolve => setTimeout(resolve, ms));
 }
@@ -163,20 +176,23 @@ export async function customPrompt(title, message) {
 }


-export function rebootAPI() {
+export async function rebootAPI() {
 	if ('electronAPI' in window) {
 			window.electronAPI.restartApp();
 			return true;
 	}

-	customConfirm("Are you sure you'd like to reboot the server?").then((isConfirmed) => {
-		if (isConfirmed) {
-			try {
-				api.fetchApi("/manager/reboot");
+	const isConfirmed = await customConfirm("Are you sure you'd like to reboot the server?");
+	if (isConfirmed) {
+		try {
+			const response = await api.fetchApi("/manager/reboot");
+			if (response.status == 403) {
+				await handle403Response(response);
+				return false;
 			}
-			catch(exception) {}
 		}
-	});
+		catch(exception) {}
+	}

 	return false;
 }
@@ -216,7 +232,7 @@ export async function install_pip(packages) {
 	});

 	if(res.status == 403) {
-		show_message('This action is not allowed with this security level configuration.');
+		await handle403Response(res);
 		return;
 	}

@@ -251,7 +267,7 @@ export async function install_via_git_url(url, manager_dialog) {
 	});

 	if(res.status == 403) {
-		show_message('This action is not allowed with this security level configuration.');
+		await handle403Response(res);
 		return;
 	}

@@ -262,9 +278,9 @@ export async function install_via_git_url(url, manager_dialog) {
 		const self = this;

 		rebootButton.addEventListener("click",
-			function() {
-				if(rebootAPI()) {
-					manager_dialog.close();
+			async function() {
+				if(await rebootAPI()) {
+					manager_instance.close();
 				}
 			});
 	}
--- a/js/custom-nodes-manager.css
+++ b/js/custom-nodes-manager.css
@@ -1,5 +1,5 @@
 .cn-manager {
-	--grid-font: -apple-system, BlinkMacSystemFont, "Segue UI", "Noto Sans", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji";
+	--grid-font: -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji";
 	z-index: 1099;
 	width: 80%;
 	height: 80%;
--- a/js/custom-nodes-manager.js
+++ b/js/custom-nodes-manager.js
@@ -7,7 +7,7 @@ import {
 	fetchData, md5, icons, show_message, customConfirm, customAlert, customPrompt,
 	sanitizeHTML, infoToast, showTerminal, setNeedRestart,
 	storeColumnWidth, restoreColumnWidth, getTimeAgo, copyText, loadCss,
-	showPopover, hidePopover
+	showPopover, hidePopover, handle403Response
 } from  "./common.js";

 // https://cenfun.github.io/turbogrid/api.html
@@ -1528,7 +1528,16 @@ export class CustomNodesManager {
 				errorMsg = `'${item.title}': `;

 				if(res.status == 403) {
-					errorMsg += `This action is not allowed with this security level configuration.\n`;
+					try {
+						const data = await res.json();
+						if(data.error === 'comfyui_outdated') {
+							errorMsg += `ComfyUI version is outdated. Please update ComfyUI to use Manager normally.\n`;
+						} else {
+							errorMsg += `This action is not allowed with this security level configuration.\n`;
+						}
+					} catch {
+						errorMsg += `This action is not allowed with this security level configuration.\n`;
+					}
 				} else if(res.status == 404) {
 					errorMsg += `With the current security level configuration, only custom nodes from the <B>"default channel"</B> can be installed.\n`;
 				} else {
--- a/js/model-manager.js
+++ b/js/model-manager.js
@@ -1,9 +1,9 @@
 import { app } from "../../scripts/app.js";
 import { $el } from "../../scripts/ui.js";
-import { 
-	manager_instance, rebootAPI, 
+import {
+	manager_instance, rebootAPI,
 	fetchData, md5, icons, show_message, customAlert, infoToast, showTerminal,
-	storeColumnWidth, restoreColumnWidth, loadCss
+	storeColumnWidth, restoreColumnWidth, loadCss, handle403Response
 } from  "./common.js";
 import { api } from "../../scripts/api.js";

@@ -477,7 +477,16 @@ export class ModelManager {
 				errorMsg = `'${item.name}': `;

 				if(res.status == 403) {
-					errorMsg += `This action is not allowed with this security level configuration.\n`;
+					try {
+						const data = await res.json();
+						if(data.error === 'comfyui_outdated') {
+							errorMsg += `ComfyUI version is outdated. Please update ComfyUI to use Manager normally.\n`;
+						} else {
+							errorMsg += `This action is not allowed with this security level configuration.\n`;
+						}
+					} catch {
+						errorMsg += `This action is not allowed with this security level configuration.\n`;
+					}
 				} else {
 					errorMsg += await res.text() + '\n';
 				}
--- a/js/snapshot.js
+++ b/js/snapshot.js
@@ -1,7 +1,7 @@
 import { app } from "../../scripts/app.js";
 import { api } from "../../scripts/api.js"
 import { ComfyDialog, $el } from "../../scripts/ui.js";
-import { manager_instance, rebootAPI, show_message } from  "./common.js";
+import { manager_instance, rebootAPI, show_message, handle403Response } from  "./common.js";


 async function restore_snapshot(target) {
@@ -10,7 +10,7 @@ async function restore_snapshot(target) {
 			const response = await api.fetchApi(`/snapshot/restore?target=${target}`, { cache: "no-store" });

 			if(response.status == 403) {
-				show_message('This action is not allowed with this security level configuration.');
+				await handle403Response(response);
 				return false;
 			}

@@ -38,7 +38,7 @@ async function remove_snapshot(target) {
 			const response = await api.fetchApi(`/snapshot/remove?target=${target}`, { cache: "no-store" });

 			if(response.status == 403) {
-				show_message('This action is not allowed with this security level configuration.');
+				await handle403Response(response);
 				return false;
 			}

@@ -145,8 +145,8 @@ export class SnapshotManager extends ComfyDialog {
 		if(btn_id) {
 			const rebootButton = document.getElementById(btn_id);
 			const self = this;
-			rebootButton.onclick = function() {
-				if(rebootAPI()) {
+			rebootButton.onclick = async function() {
+				if(await rebootAPI()) {
 					self.close();
 					self.manager_dialog.close();
 				}
--- a/json-checker.py
+++ b/json-checker.py
@@ -1,25 +1,264 @@
-import json
-import argparse
+#!/usr/bin/env python3
+"""JSON Entry Validator

-def check_json_syntax(file_path):
+Validates JSON entries based on content structure.
+
+Validation rules based on JSON content:
+- {"custom_nodes": [...]}: Validates required fields (author, title, reference, files, install_type, description)
+- {"models": [...]}: Validates JSON syntax only (no required fields)
+- Other JSON structures: Validates JSON syntax only
+
+Git repository URL validation (for custom_nodes):
+1. URLs must NOT end with .git
+2. URLs must follow format: https://github.com/{author}/{reponame}
+3. .py and .js files are exempt from this check
+
+Supported formats:
+- Array format: [{...}, {...}]
+- Object format: {"custom_nodes": [...]} or {"models": [...]}
+"""
+
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Dict, List, Tuple
+
+
+# Required fields for each entry type
+REQUIRED_FIELDS_CUSTOM_NODE = ['author', 'title', 'reference', 'files', 'install_type', 'description']
+REQUIRED_FIELDS_MODEL = []  # model-list.json doesn't require field validation
+
+# Pattern for valid GitHub repository URL (without .git suffix)
+GITHUB_REPO_PATTERN = re.compile(r'^https://github\.com/[^/]+/[^/]+$')
+
+
+def get_entry_context(entry: Dict) -> str:
+    """Get identifying information from entry for error messages
+
+    Args:
+        entry: JSON entry
+
+    Returns:
+        String with author and reference info
+    """
+    parts = []
+    if 'author' in entry:
+        parts.append(f"author={entry['author']}")
+    if 'reference' in entry:
+        parts.append(f"ref={entry['reference']}")
+    if 'title' in entry:
+        parts.append(f"title={entry['title']}")
+
+    if parts:
+        return " | ".join(parts)
+    else:
+        # No identifying info - show actual entry content (truncated)
+        import json
+        entry_str = json.dumps(entry, ensure_ascii=False)
+        if len(entry_str) > 100:
+            entry_str = entry_str[:100] + "..."
+        return f"content={entry_str}"
+
+
+def validate_required_fields(entry: Dict, entry_index: int, required_fields: List[str]) -> List[str]:
+    """Validate that all required fields are present
+
+    Args:
+        entry: JSON entry to validate
+        entry_index: Index of entry in array (for error reporting)
+        required_fields: List of required field names
+
+    Returns:
+        List of error descriptions (without entry prefix/context)
+    """
+    errors = []
+
+    for field in required_fields:
+        if field not in entry:
+            errors.append(f"Missing required field '{field}'")
+        elif entry[field] is None:
+            errors.append(f"Field '{field}' is null")
+        elif isinstance(entry[field], str) and not entry[field].strip():
+            errors.append(f"Field '{field}' is empty")
+        elif field == 'files' and not entry[field]:  # Empty array
+            errors.append("Field 'files' is empty array")
+
+    return errors
+
+
+def validate_git_repo_urls(entry: Dict, entry_index: int) -> List[str]:
+    """Validate git repository URLs in 'files' array
+
+    Requirements:
+    - Git repo URLs must NOT end with .git
+    - Must follow format: https://github.com/{author}/{reponame}
+    - .py and .js files are exempt
+
+    Args:
+        entry: JSON entry to validate
+        entry_index: Index of entry in array (for error reporting)
+
+    Returns:
+        List of error descriptions (without entry prefix/context)
+    """
+    errors = []
+
+    if 'files' not in entry or not isinstance(entry['files'], list):
+        return errors
+
+    for file_url in entry['files']:
+        if not isinstance(file_url, str):
+            continue
+
+        # Skip .py and .js files - they're exempt from git repo validation
+        if file_url.endswith('.py') or file_url.endswith('.js'):
+            continue
+
+        # Check if it's a GitHub URL (likely a git repo)
+        if 'github.com' in file_url:
+            # Error if URL ends with .git
+            if file_url.endswith('.git'):
+                errors.append(f"Git repo URL must NOT end with .git: {file_url}")
+                continue
+
+            # Validate format: https://github.com/{author}/{reponame}
+            if not GITHUB_REPO_PATTERN.match(file_url):
+                errors.append(f"Invalid git repo URL format (expected https://github.com/author/reponame): {file_url}")
+
+    return errors
+
+
+def validate_entry(entry: Dict, entry_index: int, required_fields: List[str]) -> List[str]:
+    """Validate a single JSON entry
+
+    Args:
+        entry: JSON entry to validate
+        entry_index: Index of entry in array (for error reporting)
+        required_fields: List of required field names
+
+    Returns:
+        List of error messages (empty if valid)
+    """
+    errors = []
+
+    # Check required fields
+    errors.extend(validate_required_fields(entry, entry_index, required_fields))
+
+    # Check git repository URLs
+    errors.extend(validate_git_repo_urls(entry, entry_index))
+
+    return errors
+
+
+def validate_json_file(file_path: str) -> Tuple[bool, List[str]]:
+    """Validate JSON file containing entries
+
+    Args:
+        file_path: Path to JSON file
+
+    Returns:
+        Tuple of (is_valid, error_messages)
+    """
+    errors = []
+
+    # Check file exists
+    path = Path(file_path)
+    if not path.exists():
+        return False, [f"File not found: {file_path}"]
+
+    # Load JSON
    try:
-        with open(file_path, 'r', encoding='utf-8') as file:
-            json_str = file.read()
-            json.loads(json_str)
-            print(f"[ OK ] {file_path}")
-    except UnicodeDecodeError as e:
-        print(f"Unicode decode error: {e}")
+        with open(path, 'r', encoding='utf-8') as f:
+            data = json.load(f)
    except json.JSONDecodeError as e:
-        print(f"[FAIL] {file_path}\n\n       {e}\n")
-    except FileNotFoundError:
-        print(f"[FAIL] {file_path}\n\n       File not found\n")
+        return False, [f"Invalid JSON: {e}"]
+    except Exception as e:
+        return False, [f"Error reading file: {e}"]
+
+    # Determine required fields based on JSON content
+    required_fields = []
+
+    # Validate structure - support both array and object formats
+    entries_to_validate = []
+
+    if isinstance(data, list):
+        # Direct array format: [{...}, {...}]
+        entries_to_validate = data
+    elif isinstance(data, dict):
+        # Object format: {"custom_nodes": [...]} or {"models": [...]}
+        # Determine validation based on keys
+        if 'custom_nodes' in data and isinstance(data['custom_nodes'], list):
+            required_fields = REQUIRED_FIELDS_CUSTOM_NODE
+            entries_to_validate = data['custom_nodes']
+        elif 'models' in data and isinstance(data['models'], list):
+            required_fields = REQUIRED_FIELDS_MODEL
+            entries_to_validate = data['models']
+        else:
+            # Other JSON structures (extension-node-map.json, etc.) - just validate JSON syntax
+            return True, []
+    else:
+        return False, ["JSON root must be either an array or an object containing arrays"]
+
+    # Validate each entry
+    for idx, entry in enumerate(entries_to_validate, start=1):
+        if not isinstance(entry, dict):
+            # Show actual value for type errors
+            entry_str = json.dumps(entry, ensure_ascii=False) if not isinstance(entry, str) else repr(entry)
+            if len(entry_str) > 150:
+                entry_str = entry_str[:150] + "..."
+            errors.append(f"\n❌ Entry #{idx}: Must be an object, got {type(entry).__name__}")
+            errors.append(f"   Actual value: {entry_str}")
+            continue
+
+        entry_errors = validate_entry(entry, idx, required_fields)
+        if entry_errors:
+            # Group errors by entry with context
+            context = get_entry_context(entry)
+            errors.append(f"\n❌ Entry #{idx} ({context}):")
+            for error in entry_errors:
+                errors.append(f"   - {error}")
+
+    is_valid = len(errors) == 0
+    return is_valid, errors
+

 def main():
-    parser = argparse.ArgumentParser(description="JSON File Syntax Checker")
-    parser.add_argument("file_path", type=str, help="Path to the JSON file for syntax checking")
+    """Main entry point"""
+    if len(sys.argv) < 2:
+        print("Usage: python json-checker.py <json-file>")
+        print("\nValidates JSON entries based on content:")
+        print("  - {\"custom_nodes\": [...]}: Validates required fields (author, title, reference, files, install_type, description)")
+        print("  - {\"models\": [...]}: Validates JSON syntax only (no required fields)")
+        print("  - Other JSON structures: Validates JSON syntax only")
+        print("\nGit repo URL validation (for custom_nodes):")
+        print("  - URLs must NOT end with .git")
+        print("  - URLs must follow: https://github.com/{author}/{reponame}")
+        sys.exit(1)

-    args = parser.parse_args()
-    check_json_syntax(args.file_path)
+    file_path = sys.argv[1]

-if __name__ == "__main__":
+    is_valid, errors = validate_json_file(file_path)
+
+    if is_valid:
+        print(f"✅ {file_path}: Validation passed")
+        sys.exit(0)
+    else:
+        print(f"Validating: {file_path}")
+        print("=" * 60)
+        print("❌ Validation failed!\n")
+        print("Errors:")
+        # Count actual errors (lines starting with "   -")
+        error_count = sum(1 for e in errors if e.strip().startswith('-'))
+        for error in errors:
+            # Don't add ❌ prefix to grouped entries (they already have it)
+            if error.strip().startswith('❌'):
+                print(error)
+            else:
+                print(error)
+        print(f"\nTotal errors: {error_count}")
+        sys.exit(1)
+
+
+if __name__ == '__main__':
    main()
--- a/model-list.json
+++ b/model-list.json
@@ -5355,6 +5355,317 @@
      "filename": "LBM_relighting.safetensors",
      "url": "https://huggingface.co/jasperai/LBM_relighting/resolve/main/model.safetensors",
      "size": "5.02GB"
+    },
+    {
+      "name": "Qwen-Image VAE",
+      "type": "VAE",
+      "base": "Qwen-Image",
+      "save_path": "vae/qwen-image",
+      "description": "VAE model for Qwen-Image",
+      "reference": "https://huggingface.co/Comfy-Org/Qwen-Image_ComfyUI",
+      "filename": "qwen_image_vae.safetensors",
+      "url": "https://huggingface.co/Comfy-Org/Qwen-Image_ComfyUI/resolve/main/split_files/vae/qwen_image_vae.safetensors",
+      "size": "335MB"
+    },
+    {
+      "name": "Qwen 2.5 VL 7B Text Encoder (fp8_scaled)",
+      "type": "clip",
+      "base": "Qwen-2.5-VL",
+      "save_path": "text_encoders/qwen",
+      "description": "Qwen 2.5 VL 7B text encoder model (fp8_scaled)",
+      "reference": "https://huggingface.co/Comfy-Org/Qwen-Image_ComfyUI",
+      "filename": "qwen_2.5_vl_7b_fp8_scaled.safetensors",
+      "url": "https://huggingface.co/Comfy-Org/Qwen-Image_ComfyUI/resolve/main/split_files/text_encoders/qwen_2.5_vl_7b_fp8_scaled.safetensors",
+      "size": "3.75GB"
+    },
+    {
+      "name": "Qwen 2.5 VL 7B Text Encoder",
+      "type": "clip",
+      "base": "Qwen-2.5-VL",
+      "save_path": "text_encoders/qwen",
+      "description": "Qwen 2.5 VL 7B text encoder model",
+      "reference": "https://huggingface.co/Comfy-Org/Qwen-Image_ComfyUI",
+      "filename": "qwen_2.5_vl_7b.safetensors",
+      "url": "https://huggingface.co/Comfy-Org/Qwen-Image_ComfyUI/resolve/main/split_files/text_encoders/qwen_2.5_vl_7b.safetensors",
+      "size": "7.51GB"
+    },
+    {
+      "name": "Qwen-Image Diffusion Model (fp8_e4m3fn)",
+      "type": "diffusion_model",
+      "base": "Qwen-Image",
+      "save_path": "diffusion_models/qwen-image",
+      "description": "Qwen-Image diffusion model (fp8_e4m3fn)",
+      "reference": "https://huggingface.co/Comfy-Org/Qwen-Image_ComfyUI",
+      "filename": "qwen_image_fp8_e4m3fn.safetensors",
+      "url": "https://huggingface.co/Comfy-Org/Qwen-Image_ComfyUI/resolve/main/split_files/diffusion_models/qwen_image_fp8_e4m3fn.safetensors",
+      "size": "4.89GB"
+    },
+    {
+      "name": "Qwen-Image Diffusion Model (bf16)",
+      "type": "diffusion_model",
+      "base": "Qwen-Image",
+      "save_path": "diffusion_models/qwen-image",
+      "description": "Qwen-Image diffusion model (bf16)",
+      "reference": "https://huggingface.co/Comfy-Org/Qwen-Image_ComfyUI",
+      "filename": "qwen_image_bf16.safetensors",
+      "url": "https://huggingface.co/Comfy-Org/Qwen-Image_ComfyUI/resolve/main/split_files/diffusion_models/qwen_image_bf16.safetensors",
+      "size": "9.78GB"
+    },
+    {
+      "name": "Qwen-Image-Edit 2509 Diffusion Model (fp8_e4m3fn)",
+      "type": "diffusion_model",
+      "base": "Qwen-Image-Edit",
+      "save_path": "diffusion_models/qwen-image-edit",
+      "description": "Qwen-Image-Edit 2509 diffusion model (fp8_e4m3fn)",
+      "reference": "https://huggingface.co/Comfy-Org/Qwen-Image-Edit_ComfyUI",
+      "filename": "qwen_image_edit_2509_fp8_e4m3fn.safetensors",
+      "url": "https://huggingface.co/Comfy-Org/Qwen-Image-Edit_ComfyUI/resolve/main/split_files/diffusion_models/qwen_image_edit_2509_fp8_e4m3fn.safetensors",
+      "size": "4.89GB"
+    },
+
+    {
+      "name": "Qwen-Image-Edit 2509 Diffusion Model (bf16)",
+      "type": "diffusion_model",
+      "base": "Qwen-Image-Edit",
+      "save_path": "diffusion_models/qwen-image-edit",
+      "description": "Qwen-Image-Edit 2509 diffusion model (bf16)",
+      "reference": "https://huggingface.co/Comfy-Org/Qwen-Image-Edit_ComfyUI",
+      "filename": "qwen_image_edit_2509_bf16.safetensors",
+      "url": "https://huggingface.co/Comfy-Org/Qwen-Image-Edit_ComfyUI/resolve/main/split_files/diffusion_models/qwen_image_edit_2509_bf16.safetensors",
+      "size": "9.78GB"
+    },
+
+    {
+      "name": "Qwen-Image-Edit Diffusion Model (fp8_e4m3fn)",
+      "type": "diffusion_model",
+      "base": "Qwen-Image-Edit",
+      "save_path": "diffusion_models/qwen-image-edit",
+      "description": "Qwen-Image-Edit diffusion model (fp8_e4m3fn)",
+      "reference": "https://huggingface.co/Comfy-Org/Qwen-Image-Edit_ComfyUI",
+      "filename": "qwen_image_edit_fp8_e4m3fn.safetensors",
+      "url": "https://huggingface.co/Comfy-Org/Qwen-Image-Edit_ComfyUI/resolve/main/split_files/diffusion_models/qwen_image_edit_fp8_e4m3fn.safetensors",
+      "size": "4.89GB"
+    },
+
+    {
+      "name": "Qwen-Image-Edit Diffusion Model (bf16)",
+      "type": "diffusion_model",
+      "base": "Qwen-Image-Edit",
+      "save_path": "diffusion_models/qwen-image-edit",
+      "description": "Qwen-Image-Edit diffusion model (bf16)",
+      "reference": "https://huggingface.co/Comfy-Org/Qwen-Image-Edit_ComfyUI",
+      "filename": "qwen_image_edit_bf16.safetensors",
+      "url": "https://huggingface.co/Comfy-Org/Qwen-Image-Edit_ComfyUI/resolve/main/split_files/diffusion_models/qwen_image_edit_bf16.safetensors",
+      "size": "9.78GB"
+    },
+    {
+      "name": "Qwen-Image-Lightning 8steps V1.0",
+      "type": "lora",
+      "base": "Qwen-Image",
+      "save_path": "loras/qwen-image-lightning",
+      "description": "Qwen-Image-Lightning 8-step LoRA model V1.0",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Lightning-8steps-V1.0.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Lightning-8steps-V1.0.safetensors",
+      "size": "9.78GB"
+    },
+    {
+      "name": "Qwen-Image-Lightning 4steps V1.0",
+      "type": "lora",
+      "base": "Qwen-Image",
+      "save_path": "loras/qwen-image-lightning",
+      "description": "Qwen-Image-Lightning 4-step LoRA model V1.0",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Lightning-4steps-V1.0.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Lightning-4steps-V1.0.safetensors",
+      "size": "9.78GB"
+    },
+    {
+      "name": "Qwen-Image-Lightning 4steps V1.0 (bf16)",
+      "type": "lora",
+      "base": "Qwen-Image",
+      "save_path": "loras/qwen-image-lightning",
+      "description": "Qwen-Image-Lightning 4-step LoRA model V1.0 (bf16)",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Lightning-4steps-V1.0-bf16.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Lightning-4steps-V1.0-bf16.safetensors",
+      "size": "19.6GB"
+    },
+    {
+      "name": "Qwen-Image-Lightning 4steps V2.0",
+      "type": "lora",
+      "base": "Qwen-Image",
+      "save_path": "loras/qwen-image-lightning",
+      "description": "Qwen-Image-Lightning 4-step LoRA model V2.0",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Lightning-4steps-V2.0.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Lightning-4steps-V2.0.safetensors",
+      "size": "9.78GB"
+    },
+    {
+      "name": "Qwen-Image-Lightning 4steps V2.0 (bf16)",
+      "type": "lora",
+      "base": "Qwen-Image",
+      "save_path": "loras/qwen-image-lightning",
+      "description": "Qwen-Image-Lightning 4-step LoRA model V2.0 (bf16)",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Lightning-4steps-V2.0-bf16.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Lightning-4steps-V2.0-bf16.safetensors",
+      "size": "19.6GB"
+    },
+    {
+      "name": "Qwen-Image-Lightning 8steps V1.1",
+      "type": "lora",
+      "base": "Qwen-Image",
+      "save_path": "loras/qwen-image-lightning",
+      "description": "Qwen-Image-Lightning 8-step LoRA model V1.1",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Lightning-8steps-V1.1.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Lightning-8steps-V1.1.safetensors",
+      "size": "9.78GB"
+    },
+    {
+      "name": "Qwen-Image-Lightning 8steps V1.1 (bf16)",
+      "type": "lora",
+      "base": "Qwen-Image",
+      "save_path": "loras/qwen-image-lightning",
+      "description": "Qwen-Image-Lightning 8-step LoRA model V1.1 (bf16)",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Lightning-8steps-V1.1-bf16.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Lightning-8steps-V1.1-bf16.safetensors",
+      "size": "19.6GB"
+    },
+    {
+      "name": "Qwen-Image-Lightning 8steps V2.0",
+      "type": "lora",
+      "base": "Qwen-Image",
+      "save_path": "loras/qwen-image-lightning",
+      "description": "Qwen-Image-Lightning 8-step LoRA model V2.0",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Lightning-8steps-V2.0.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Lightning-8steps-V2.0.safetensors",
+      "size": "9.78GB"
+    },
+    {
+      "name": "Qwen-Image-Lightning 8steps V2.0 (bf16)",
+      "type": "lora",
+      "base": "Qwen-Image",
+      "save_path": "loras/qwen-image-lightning",
+      "description": "Qwen-Image-Lightning 8-step LoRA model V2.0 (bf16)",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Lightning-8steps-V2.0-bf16.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Lightning-8steps-V2.0-bf16.safetensors",
+      "size": "19.6GB"
+    },
+    {
+      "name": "Qwen-Image-Edit-Lightning 4steps V1.0",
+      "type": "lora",
+      "base": "Qwen-Image-Edit",
+      "save_path": "loras/qwen-image-edit-lightning",
+      "description": "Qwen-Image-Edit-Lightning 4-step LoRA model V1.0",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Edit-Lightning-4steps-V1.0.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Edit-Lightning-4steps-V1.0.safetensors",
+      "size": "9.78GB"
+    },
+    {
+      "name": "Qwen-Image-Edit-Lightning 4steps V1.0 (bf16)",
+      "type": "lora",
+      "base": "Qwen-Image-Edit",
+      "save_path": "loras/qwen-image-edit-lightning",
+      "description": "Qwen-Image-Edit-Lightning 4-step LoRA model V1.0 (bf16)",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Edit-Lightning-4steps-V1.0-bf16.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Edit-Lightning-4steps-V1.0-bf16.safetensors",
+      "size": "19.6GB"
+    },
+    {
+      "name": "Qwen-Image-Edit-Lightning 8steps V1.0",
+      "type": "lora",
+      "base": "Qwen-Image-Edit",
+      "save_path": "loras/qwen-image-edit-lightning",
+      "description": "Qwen-Image-Edit-Lightning 8-step LoRA model V1.0",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Edit-Lightning-8steps-V1.0.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Edit-Lightning-8steps-V1.0.safetensors",
+      "size": "9.78GB"
+    },
+    {
+      "name": "Qwen-Image-Edit-Lightning 8steps V1.0 (bf16)",
+      "type": "lora",
+      "base": "Qwen-Image-Edit",
+      "save_path": "loras/qwen-image-edit-lightning",
+      "description": "Qwen-Image-Edit-Lightning 8-step LoRA model V1.0 (bf16)",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Edit-Lightning-8steps-V1.0-bf16.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Edit-Lightning-8steps-V1.0-bf16.safetensors",
+      "size": "19.6GB"
+    },
+    {
+      "name": "Qwen-Image-Edit-2509-Lightning 4steps V1.0 (bf16)",
+      "type": "lora",
+      "base": "Qwen-Image-Edit",
+      "save_path": "loras/qwen-image-edit-lightning",
+      "description": "Qwen-Image-Edit-2509-Lightning 4-step LoRA model V1.0 (bf16)",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Edit-2509-Lightning-4steps-V1.0-bf16.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Edit-2509/Qwen-Image-Edit-2509-Lightning-4steps-V1.0-bf16.safetensors",
+      "size": "19.6GB"
+    },
+    {
+      "name": "Qwen-Image-Edit-2509-Lightning 4steps V1.0 (fp32)",
+      "type": "lora",
+      "base": "Qwen-Image-Edit",
+      "save_path": "loras/qwen-image-edit-lightning",
+      "description": "Qwen-Image-Edit-2509-Lightning 4-step LoRA model V1.0 (fp32)",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Edit-2509-Lightning-4steps-V1.0-fp32.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Edit-2509/Qwen-Image-Edit-2509-Lightning-4steps-V1.0-fp32.safetensors",
+      "size": "39.1GB"
+    },
+    {
+      "name": "Qwen-Image-Edit-2509-Lightning 8steps V1.0 (bf16)",
+      "type": "lora",
+      "base": "Qwen-Image-Edit",
+      "save_path": "loras/qwen-image-edit-lightning",
+      "description": "Qwen-Image-Edit-2509-Lightning 8-step LoRA model V1.0 (bf16)",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Edit-2509-Lightning-8steps-V1.0-bf16.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Edit-2509/Qwen-Image-Edit-2509-Lightning-8steps-V1.0-bf16.safetensors",
+      "size": "19.6GB"
+    },
+    {
+      "name": "Qwen-Image-Edit-2509-Lightning 8steps V1.0 (fp32)",
+      "type": "lora",
+      "base": "Qwen-Image-Edit",
+      "save_path": "loras/qwen-image-edit-lightning",
+      "description": "Qwen-Image-Edit-2509-Lightning 8-step LoRA model V1.0 (fp32)",
+      "reference": "https://huggingface.co/lightx2v/Qwen-Image-Lightning",
+      "filename": "Qwen-Image-Edit-2509-Lightning-8steps-V1.0-fp32.safetensors",
+      "url": "https://huggingface.co/lightx2v/Qwen-Image-Lightning/resolve/main/Qwen-Image-Edit-2509/Qwen-Image-Edit-2509-Lightning-8steps-V1.0-fp32.safetensors",
+      "size": "39.1GB"
+    },
+    {
+      "name": "Qwen-Image InstantX ControlNet Union",
+      "type": "controlnet",
+      "base": "Qwen-Image",
+      "save_path": "controlnet/qwen-image/instantx",
+      "description": "Qwen-Image InstantX ControlNet Union model",
+      "reference": "https://huggingface.co/Comfy-Org/Qwen-Image-InstantX-ControlNets",
+      "filename": "Qwen-Image-InstantX-ControlNet-Union.safetensors",
+      "url": "https://huggingface.co/Comfy-Org/Qwen-Image-InstantX-ControlNets/resolve/main/split_files/controlnet/Qwen-Image-InstantX-ControlNet-Union.safetensors",
+      "size": "2.54GB"
+    },
+    {
+      "name": "Qwen-Image InstantX ControlNet Inpainting",
+      "type": "controlnet",
+      "base": "Qwen-Image",
+      "save_path": "controlnet/qwen-image/instantx",
+      "description": "Qwen-Image InstantX ControlNet Inpainting model",
+      "reference": "https://huggingface.co/Comfy-Org/Qwen-Image-InstantX-ControlNets",
+      "filename": "Qwen-Image-InstantX-ControlNet-Inpainting.safetensors",
+      "url": "https://huggingface.co/Comfy-Org/Qwen-Image-InstantX-ControlNets/resolve/main/split_files/controlnet/Qwen-Image-InstantX-ControlNet-Inpainting.safetensors",
+      "size": "2.54GB"
    }
  ]
-}
+}
--- a/node_db/dev/custom-node-list.json
+++ b/node_db/dev/custom-node-list.json
--- a/node_db/dev/extension-node-map.json
+++ b/node_db/dev/extension-node-map.json
--- a/node_db/dev/github-stats.json
+++ b/node_db/dev/github-stats.json
--- a/node_db/forked/custom-node-list.json
+++ b/node_db/forked/custom-node-list.json
@@ -169,6 +169,16 @@
            ],
            "install_type": "git-clone",
            "description": "A fork of KJNodes for ComfyUI.\nVarious quality of life -nodes for ComfyUI, mostly just visual stuff to improve usability"
+        },
+        {
+            "author": "huixingyun",
+            "title": "ComfyUI-SoundFlow",
+            "reference": "https://github.com/huixingyun/ComfyUI-SoundFlow",
+            "files": [
+                "https://github.com/huixingyun/ComfyUI-SoundFlow"
+            ],
+            "install_type": "git-clone",
+            "description": "forked from https://github.com/fredconex/ComfyUI-SoundFlow (removed)"
        }
    ]
 }
--- a/node_db/legacy/custom-node-list.json
+++ b/node_db/legacy/custom-node-list.json
--- a/node_db/new/custom-node-list.json
+++ b/node_db/new/custom-node-list.json
--- a/node_db/new/extension-node-map.json
+++ b/node_db/new/extension-node-map.json
--- a/node_db/tutorial/custom-node-list.json
+++ b/node_db/tutorial/custom-node-list.json
@@ -10,6 +10,16 @@
            "install_type": "git-clone",
            "description": "A minimal template for creating React/TypeScript frontend extensions for ComfyUI, with complete boilerplate setup including internationalization and unit testing."
        },
+        {
+            "author": "comfyui-wiki",
+            "title": "ComfyUI-i18n-demo",
+            "reference": "https://github.com/comfyui-wiki/ComfyUI-i18n-demo",
+            "files": [
+                "https://github.com/comfyui-wiki/ComfyUI-i18n-demo"
+            ],
+            "install_type": "git-clone",
+            "description": "ComfyUI custom node develop i18n support demo "
+        },
        {
            "author": "Suzie1",
            "title": "Guide To Making Custom Nodes in ComfyUI",
@@ -351,6 +361,16 @@
            ],
            "install_type": "git-clone",
            "description": "Vibe Coded ComfyUI Custom Nodes"
+        },
+        {
+            "author": "aiforhumans",
+            "title": "XDev Nodes - Complete Toolkit",
+            "reference": "https://github.com/aiforhumans/comfyui-xdev-nodes",
+            "files": [
+                "https://github.com/aiforhumans/comfyui-xdev-nodes"
+            ],
+            "install_type": "git-clone",
+            "description": "Complete ComfyUI development toolkit with 8 professional nodes including VAE tools, universal type testing, and comprehensive debugging infrastructure."
        }
    ]
 }
--- a/prestartup_script.py
+++ b/prestartup_script.py
@@ -85,7 +85,15 @@ cm_global.register_api('cm.is_import_failed_extension', is_import_failed_extensi
 comfyui_manager_path = os.path.abspath(os.path.dirname(__file__))

 custom_nodes_base_path = folder_paths.get_folder_paths('custom_nodes')[0]
-manager_files_path = os.path.abspath(os.path.join(folder_paths.get_user_directory(), 'default', 'ComfyUI-Manager'))
+
+# Check for System User API availability (PR #10966)
+_has_system_user_api = hasattr(folder_paths, 'get_system_user_directory')
+
+if _has_system_user_api:
+    manager_files_path = os.path.abspath(os.path.join(folder_paths.get_user_directory(), '__manager'))
+else:
+    manager_files_path = os.path.abspath(os.path.join(folder_paths.get_user_directory(), 'default', 'ComfyUI-Manager'))
+
 manager_pip_overrides_path = os.path.join(manager_files_path, "pip_overrides.json")
 manager_pip_blacklist_path = os.path.join(manager_files_path, "pip_blacklist.list")
 restore_snapshot_path = os.path.join(manager_files_path, "startup-scripts", "restore-snapshot.json")
@@ -516,7 +524,8 @@ check_bypass_ssl()

 # Perform install
 processed_install = set()
-script_list_path = os.path.join(folder_paths.user_directory, "default", "ComfyUI-Manager", "startup-scripts", "install-scripts.txt")
+# Use manager_files_path for consistency (fixes path inconsistency bug)
+script_list_path = os.path.join(manager_files_path, "startup-scripts", "install-scripts.txt")
 pip_fixer = manager_util.PIPFixer(manager_util.get_installed_packages(), comfy_path, manager_files_path)


@@ -793,7 +802,11 @@ def execute_startup_script():


 # Check if script_list_path exists
-if os.path.exists(script_list_path):
+# Block startup-scripts on old ComfyUI (security measure)
+if not _has_system_user_api:
+    if os.path.exists(script_list_path):
+        print("[ComfyUI-Manager] Startup scripts blocked on old ComfyUI version.")
+elif os.path.exists(script_list_path):
    execute_startup_script()


--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,9 +1,9 @@
 [project]
 name = "comfyui-manager"
 description = "ComfyUI-Manager provides features to install and manage custom nodes for ComfyUI, as well as various functionalities to assist with ComfyUI."
-version = "3.36"
+version = "3.38.2"
 license = { file = "LICENSE.txt" }
-dependencies = ["GitPython", "PyGithub", "matrix-client==0.4.0", "transformers", "huggingface-hub>0.20", "typer", "rich", "typing-extensions", "toml", "uv", "chardet"]
+dependencies = ["GitPython", "PyGithub", "matrix-nio", "transformers", "huggingface-hub>0.20", "typer", "rich", "typing-extensions", "toml", "uv", "chardet"]

 [project.urls]
 Repository = "https://github.com/ltdrdata/ComfyUI-Manager"
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,8 +1,8 @@
 GitPython
 PyGithub
-matrix-client==0.4.0
+matrix-nio
 transformers
-huggingface-hub>0.20
+huggingface-hub
 typer
 rich
 typing-extensions
--- a/scanner.py
+++ b/scanner.py