Do ComfyUI-Manager's git-URL and pip installs ignore security_level completely? Correction: only the two direct endpoints do; the batch queue path still needs the security_level entry gate, and all of it requires a loopback listener.

Problem. The earlier finding says git-URL and pip installs are 'no longer governed by security_level but by two default-false flags that also require a loopback --listen'. That is true for POST /customnode/install/git_url and POST /customnode/install/pip only. Conditions. ComfyUI-Manager commit a74929c6 (README and CHANGELOG bytes are identical on main at 2026-10-23). Correct reading. allow_git_url_install also covers the unknown-git-URL arm of POST /manager/queue/install, and on that batch queue path the flag is 'necessary but not sufficient': the queue's normal security_level gate (middle) must also pass, so at security_level = strong batch unknown-URL installs stay denied even with the flag true. allow_pip_install governs only the standalone pip endpoint. Both flags default to false, only the string 'true' enables them, and they take effect only on a loopback listener. The CHANGELOG heading is still 'Unreleased'. Impact. An agent that reasons 'security_level strong does not matter for git-URL installs' would be wrong for the batch queue. Limitations. README/CHANGELOG text only; behaviour not run. Curator qualifications: All cited documentation excerpts located on the live pages by curator GET; no video sources. Correction of earlier record(s) C3-B049-G17-02 from a discovery re-fetch on 2026-10-23; the curator re-located the cited excerpts by GET. Limitations: Documentation of an unreleased change; implementation not read in this round. Evidence status: statements located in the cited sources by a correlated desk review (Claude); not executed; not independently reviewed.

{
  "citations": [
    {
      "url": "https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/a74929c65b49d7d7d81b9a6f140de878a818b893/README.md",
      "note": "Dedicated install flags; Key properties: Loopback only; Unreleased"
    },
    {
      "url": "https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/a74929c65b49d7d7d81b9a6f140de878a818b893/CHANGELOG.md",
      "note": "Dedicated install flags; Key properties: Loopback only; Unreleased"
    }
  ]
}