Conversation
Amp-Thread-ID: https://ampcode.com/threads/T-019bfd7d-3879-74bc-a347-1f0ac268a3b2 Co-authored-by: Amp <amp@ampcode.com>
Contributor
📝 WalkthroughWalkthroughThe pull request adds support for Hugging Face as an asset source. The UI component now displays a Hugging Face logo when the source is identified as Hugging Face, and the metadata utility function prioritizes the Changes
Suggested reviewers
✨ Finishing touches
Comment |
🎭 Playwright Tests:
|
🎨 Storybook Build Status✅ Build completed successfully! ⏰ Completed at: 01/27/2026, 03:30:57 AM UTC 🔗 Links🎉 Your Storybook is ready for review! |
Bundle Size ReportSummary
Category Glance Per-category breakdownApp Entry Points — 22.8 kB (baseline 22.8 kB) • ⚪ 0 BMain entry bundles and manifests
Status: 1 added / 1 removed Graph Workspace — 960 kB (baseline 960 kB) • ⚪ 0 BGraph editor runtime, canvas, workflow orchestration
Status: 1 added / 1 removed Views & Navigation — 80.7 kB (baseline 80.7 kB) • ⚪ 0 BTop-level views, pages, and routed surfaces
Status: 9 added / 9 removed Panels & Settings — 466 kB (baseline 466 kB) • 🟢 -8 BConfiguration panels, inspectors, and settings screens
Status: 12 added / 12 removed User & Accounts — 3.94 kB (baseline 3.94 kB) • ⚪ 0 BAuthentication, profile, and account management bundles
Status: 3 added / 3 removed Editors & Dialogs — 2.83 kB (baseline 2.83 kB) • ⚪ 0 BModals, dialogs, drawers, and in-app editors
Status: 2 added / 2 removed UI Components — 33.7 kB (baseline 33.7 kB) • ⚪ 0 BReusable component library chunks
Status: 5 added / 5 removed Data & Services — 3.19 MB (baseline 3.19 MB) • 🔴 +450 BStores, services, APIs, and repositories
Status: 8 added / 8 removed Utilities & Hooks — 25.2 kB (baseline 25.2 kB) • ⚪ 0 BHelpers, composables, and utility bundles
Status: 7 added / 7 removed Vendor & Third-Party — 10.7 MB (baseline 10.7 MB) • ⚪ 0 BExternal libraries and shared vendor chunks
Other — 6.49 MB (baseline 6.49 MB) • 🟢 -192 BBundles that do not match a named category
Status: 34 added / 34 removed |
dosubot
bot
added
the
size:XS
coderabbitai
bot
requested review from
KarryCharon,
PabloWiedemann and
snomiao
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@src/platform/assets/utils/assetMetadataUtils.ts`:
- Around line 75-77: The current early return of asset.metadata.repo_url in
assetMetadataUtils.ts is unsafe; validate the repo_url before returning by
parsing it and ensuring its scheme is http or https (and optionally enforce an
allowlist of hosts), and only then return it from the function; if validation
fails, fall back to the existing source_arn parsing logic (the same code path
used when repo_url is absent) so that no javascript: or other unsafe schemes are
ever returned for rendering in an <a href>.
Comment on lines
+75
to
+77
| if (typeof asset.metadata?.repo_url === 'string') { | ||
| return asset.metadata.repo_url | ||
| } |
Contributor
There was a problem hiding this comment.
Validate repo_url before returning to avoid unsafe schemes.
repo_url can be user-controlled and is rendered as an <a href>. Without protocol validation, javascript: or other unsafe schemes can slip through and execute on click. Please enforce http/https (and optionally allowlist hosts) before returning; otherwise fall back to source_arn parsing.
🔒️ Proposed fix (validate and safely fall through)
export function getAssetSourceUrl(asset: AssetItem): string | null {
- if (typeof asset.metadata?.repo_url === 'string') {
- return asset.metadata.repo_url
- }
+ const repoUrl = asset.metadata?.repo_url
+ if (typeof repoUrl === 'string') {
+ const trimmed = repoUrl.trim()
+ if (trimmed) {
+ try {
+ const parsed = new URL(trimmed)
+ if (parsed.protocol === 'http:' || parsed.protocol === 'https:') {
+ return trimmed
+ }
+ } catch {
+ // fall through to source_arn
+ }
+ }
+ }
// Note: Reversed priority for backwards compatibility
const sourceArn =
asset.metadata?.source_arn ?? asset.user_metadata?.source_arn📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| if (typeof asset.metadata?.repo_url === 'string') { | |
| return asset.metadata.repo_url | |
| } | |
| export function getAssetSourceUrl(asset: AssetItem): string | null { | |
| const repoUrl = asset.metadata?.repo_url | |
| if (typeof repoUrl === 'string') { | |
| const trimmed = repoUrl.trim() | |
| if (trimmed) { | |
| try { | |
| const parsed = new URL(trimmed) | |
| if (parsed.protocol === 'http:' || parsed.protocol === 'https:') { | |
| return trimmed | |
| } | |
| } catch { | |
| // fall through to source_arn | |
| } | |
| } | |
| } | |
| // Note: Reversed priority for backwards compatibility | |
| const sourceArn = | |
| asset.metadata?.source_arn ?? asset.user_metadata?.source_arn |
🤖 Prompt for AI Agents
In `@src/platform/assets/utils/assetMetadataUtils.ts` around lines 75 - 77, The
current early return of asset.metadata.repo_url in assetMetadataUtils.ts is
unsafe; validate the repo_url before returning by parsing it and ensuring its
scheme is http or https (and optionally enforce an allowlist of hosts), and only
then return it from the function; if validation fails, fall back to the existing
source_arn parsing logic (the same code path used when repo_url is absent) so
that no javascript: or other unsafe schemes are ever returned for rendering in
an <a href>.
| class="size-4 shrink-0" | ||
| /> | ||
| <img | ||
| v-else-if="sourceName === 'Hugging Face'" |
Contributor
There was a problem hiding this comment.
consider using a enum here
Contributor
Author
There was a problem hiding this comment.
Once we add a third source, definitely 🫡
Member
There was a problem hiding this comment.
If this comes up again, it might be nice to extract the img src into a computed using switch/case
luke-mino-altherr
approved these changes
Jan 27, 2026
viva-jinyi
approved these changes
Jan 27, 2026
| class="size-4 shrink-0" | ||
| /> | ||
| <img | ||
| v-else-if="sourceName === 'Hugging Face'" |
Member
There was a problem hiding this comment.
If this comes up again, it might be nice to extract the img src into a computed using switch/case
DrJKL
added
needs-backport
github-actions bot
pushed a commit
that referenced
this pull request
Jan 27, 2026
Add support for Hugging Face as a model source in the Model Info Panel. - Display HF logo for Hugging Face sources - Extract source URL from `repo_url` metadata field ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8330-feat-add-Hugging-Face-model-source-support-2f56d73d3650816b8a01d903411ee3a1) by [Unito](https://www.unito.io) Co-authored-by: Amp <amp@ampcode.com>
Member
github-actions
bot
removed
the
needs-backport
DrJKL
added a commit
that referenced
this pull request
Jan 27, 2026
) Backport of #8330 to `cloud/1.37` Automatically created by backport workflow. ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8331-backport-cloud-1-37-feat-add-Hugging-Face-model-source-support-2f56d73d365081708413c99c384c0806) by [Unito](https://www.unito.io) Co-authored-by: Alexander Brown <drjkl@comfy.org> Co-authored-by: Amp <amp@ampcode.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add support for Hugging Face as a model source in the Model Info Panel.
repo_urlmetadata field┆Issue is synchronized with this Notion page by Unito