feat: return crop preview data from Crop By Bounding Boxes

[jtydhr88]

Send the first source frame and its bounding boxes in the node UI output so the frontend can preview the crop region. Cropping behavior is unchanged.

FE: Comfy-Org/ComfyUI_frontend#20772

Screenshot:

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: Comfy-Org/ComfyUI/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c3c35567-616b-40ea-bd7d-044320c5f5b4

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between 7f7fd91 and 47e4a90.

---

---

📒 Files selected for processing (1)

• comfy_extras/nodes_sdpose.py

---

---

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• Comfy-Org/ComfyUI_frontend (manual)
• Comfy-Org/comfy-kitchen (manual)

---

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

---

📜 Recent review details

⏰ Context from checks skipped due to timeout. (8)

• GitHub Check: test
• GitHub Check: test (macos-latest)
• GitHub Check: test (windows-2022)
• GitHub Check: test (ubuntu-latest)
• GitHub Check: test (macos-latest)
• GitHub Check: test (windows-latest)
• GitHub Check: test (ubuntu-latest)
• GitHub Check: Run Pylint

---

---

🧰 Additional context used

📚 Code guidelines (1)

AGENTS.md — configured

---

📓 Path-based instructions (3)

Community-contributed extra nodes.

⚙️ CodeRabbit configuration file

Files:

• comfy_extras/nodes_sdpose.py

---

IMPORTANT: Only comment on issues directly introduced by this PR's code changes.

⚙️ CodeRabbit configuration file

Files:

• comfy_extras/nodes_sdpose.py

---

Source excerpt: Keep changes small and direct.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• comfy_extras/nodes_sdpose.py

---

🔀 Multi-repo context Comfy-Org/ComfyUI_frontend, Comfy-Org/comfy-kitchen

Linked repositories findings

Comfy-Org/ComfyUI_frontend

• Execution outputs use a passthrough schema (zOutputs.passthrough()), so additional UI metadata keys will not be rejected by the frontend wire schema. [::Comfy-Org/ComfyUI_frontend::] src/platform/remote/comfyui/execution/types.ts:zOutputs
• The app stores the complete execution output and invokes node.onExecuted, but no frontend implementation references CropByBBoxes beyond localized node definitions. Therefore, the new source-image/bounding-box metadata will be retained but will not currently render a crop overlay; a coordinated FE implementation is still required. [::Comfy-Org/ComfyUI_frontend::] src/scripts/app.ts:addApiUpdateHandlers, src/locales/en/nodeDefs.json:CropByBBoxes
• Existing node-specific metadata, such as compositor bounding boxes, is handled through a dedicated extension (src/extensions/core/imageCompositor.ts). The new node has no equivalent consumer yet. [::Comfy-Org/ComfyUI_frontend::]

Comfy-Org/comfy-kitchen

• No direct references to CropByBBoxes, bounding-box cropping, or related UI metadata were found in the repository. [::Comfy-Org/comfy-kitchen::]

---

---

---

🔇 Additional comments (1)

comfy_extras/nodes_sdpose.py (1)

5-5: LGTM!

Also applies to: 388-388, 414-421, 475-475, 478-478

---

---

---

---

📝 Walkthrough

📝 Walkthrough

Walkthrough

CropByBBoxes enables intermediate output. It builds UI metadata from the first source image and the first bounding-box list. Both the no-crops fallback and the cropped-image return now include this metadata.

---

---

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 47e4a

The change adds preview metadata to the covered CropByBBoxes output paths. No concrete regression requiring a merge-blocking fix is established.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 47e4a

The node now saves and exposes the entire first source frame, including pixels outside the crop. On shared installations, clients with access to the server may retrieve that preview. Failures after saving can also leave source data behind pending broader temporary-file cleanup. The default local-only listener limits exposure.

Retained concerns

• Medium · security · inferred: CropByBBoxes now persists the entire first source frame and publishes its retrievable temp-file reference, rather than exposing only crop results. Clients able to access shared history and image retrieval can obtain pixels outside the crop without a prompt-owner check on those routes. The serving behavior is pre-existing; the additional source-data exposure is introduced by this PR and depends on installation access controls.
• Low · security · inferred: The source PNG is written before bbox conversion and crop execution. A subsequent exception or interruption can leave that uncropped image on disk without a successfully returned UI reference or node-owned rollback. Bulk lifecycle cleanup exists, but it is not compensation for an individual failed execution, extending source-data retention beyond successful previews.

Security review details

Security Blast Radius

• inferred — The exposure is bounded to source previews created by this node on one installation: one full first frame per preview-producing execution. A client permitted to reach shared history and image retrieval can discover and fetch these images. Internet-wide reachability, cross-installation access and production tenant isolation are not established.

Security Findings and Attack Paths

• inferred — For an image not already available to another client, a successful crop execution now exposes an additional path: shared history reveals source_images, and ordinary temp-image retrieval returns the uncropped PNG. Existing uploaded-image visibility or installation-level access restrictions can reduce the incremental impact. No retained Security finding was supplied; this is a source-supported architecture concern, not a demonstrated production compromise.

Trust Boundaries and Controls

• observed — Save-path containment, image-view traversal checks, randomized preview suffixes and browser-origin protections are existing controls. They do not bind a valid ordinary temp filename to its producing prompt or user. The separate asset-hash identity gate is not used by the new filename descriptor.

Resilience and Maintainability Implications

• inferred — Failure after preview creation can retain source data even without successful UI publication. Bulk startup and shutdown cleanup functions provide recovery mechanisms, so indefinite retention is not established. Per-execution cleanup, exact retention duration and crash/deployment recovery remain only partially covered.

Hardening Proposals

• proposed — Make full-source persistence an explicit preview policy, use owner-scoped retrieval where installations serve multiple users, and give preview creation a defined retention and compensating-cleanup contract for unsuccessful execution.

---

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly identifies the main change: returning crop preview data from Crop By Bounding Boxes.
Description check		The description directly explains the UI metadata change, frontend preview purpose, and unchanged cropping behavior.

---

• Fix all pre-merge checks with AI

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}