feat: add read-only comfy outdated verb (core + node pack versions vs latest) (BE-3396)

[mattmillerai]

ELI-5

Your ComfyUI install can quietly fall behind — an old core or an old node pack
can silently degrade agents (BE-3352). This adds a new read-only command,
comfy outdated, that tells you, at a glance, whether your ComfyUI core and
each custom node pack is up to date with the latest release. It never
changes anything — it just reads git metadata / pyproject.toml and asks the
GitHub + Comfy registry APIs what "latest" is.

$ comfy outdated
┏━━━━━━━━━━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━┓
┃ component      ┃ installed ┃ latest  ┃ status   ┃
┡━━━━━━━━━━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━┩
│ ComfyUI (core) │ v0.3.40   │ v0.3.41 │ outdated │
│ my-cool-pack   │ 1.0.0     │ 1.2.0   │ outdated │
└────────────────┴───────────┴─────────┴──────────┘

comfy outdated --json emits the standard envelope for agents. Latest-version
lookups are cached for 1h under ~/.cache/comfy-cli/outdated.json; --refresh
bypasses the cache.

What & how

• New top-level comfy outdated (comfy_cli/cmdline.py, beside update) —
  read-only, resolves the workspace via workspace_manager.workspace_path (same
  as update), renders via the existing get_renderer().emit (pretty table /
  JSON envelope).
• Core: git describe --tags --always + short HEAD for a git checkout,
  falling back to comfyui_version.py's __version__ then pyproject.toml.
  Latest = GitHub releases/latest, reusing install.get_latest_release
  (rate-limit-aware, honors GITHUB_TOKEN).
• Packs: walk <workspace>/custom_nodes/*; a pack whose pyproject.toml
  carries a registry id+version is a registry pack (latest via the
  comfy_cli.registry client); a bare git clone is a git pack (git ls-remote HEAD vs local HEAD).
• Output: {core:{installed,commit,latest,outdated}, packs:[{name,source,installed,latest,outdated}], checked_at}.
  Registered a JSON schema (comfy_cli/schemas/outdated.json) and wired it into
  discovery.COMMAND_SCHEMAS (the schema-registration ratchet test enforces this).
• Cache 1h; --refresh bypasses. Any network failure degrades to
  latest: null + a warning and exit 0 — a report that can't reach the
  network is still useful.

Tests

tests/comfy_cli/command/test_outdated.py builds a real fixture workspace
(git-checkout core + one registry pack + one git pack, the git pack cloned from
a local bare remote so it's fully offline) with mocked GitHub/registry HTTP.
Covers: stale-install verdicts, up-to-date, network-failure → latest: null +
exit 0, the 1h warm cache (serves latest even when the network is down),
--refresh bypass, the JSON envelope contract (single clean line on stdout),
and schema validation. Ran ruff check + ruff format (clean on new files)
and the full tests/comfy_cli/command + tests/comfy_cli/output suites green.

Judgment calls / deviations from the ticket

• Reused install.get_latest_release for core latest instead of hand-rolling
  a GitHub call. Its timeout is 5s (ticket suggested 10s) — reusing the
  rate-limit-aware fetcher is worth the smaller budget, and warm-cache calls are
  ~0.8s regardless. Acceptance (<5s warm cache) is met.
• Registry latest via RegistryAPI.install_node(id) (the client's
  latest-version accessor, hits /nodes/{id}/install) rather than a raw
  /nodes/{id} call — honors "reuse the registry client rather than hand-rolling."
• Added two fields beyond the ticket's shape (additive, non-breaking): core
  commit (short HEAD) and each pack's source (registry/git/unknown).
• Self-review fix: a shallow / no-tag core checkout resolves via git describe --always to a bare SHA. Comparing a SHA to a version tag is
  incomparable, so _is_outdated returns False there (rather than a false
  "outdated") while still treating SHA-vs-SHA differences (git packs) as behind.
  Regression-tested.
• Parser side-warnings from the shared extract_node_configuration (e.g. a pack
  with no license) are routed to stderr so they never corrupt the single JSON
  envelope on stdout.

Not a capability-denial change (no dead-end / "not supported" path) — it's a
purely additive read-only report, so the negative-claim falsification gate
doesn't apply.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 44 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fd7d6a86-7eff-4d28-9170-e98177f68a6f

📥 Commits

Reviewing files that changed from the base of the PR and between a732f5c and fa69a6a.

📒 Files selected for processing (6)

• comfy_cli/cmdline.py
• comfy_cli/command/outdated.py
• comfy_cli/discovery.py
• comfy_cli/registry/api.py
• comfy_cli/schemas/outdated.json
• tests/comfy_cli/command/test_outdated.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch matt/be-3396-outdated-verb

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch matt/be-3396-outdated-verb

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Cursor Review — Consolidated panel

Triggered by @mattmillerai.

Found 10 finding(s).

Severity	Count
🔴 Critical	1
🟠 High	3
🟡 Medium	3
🟢 Low	3

Panel: 6/8 reviewers contributed findings.

Reviewers that did not contribute: kimi-k2.5:adversarial (empty), kimi-k2.5:edge-case (empty)