[perfectmodelslab]

The comment above _SENSITIVE_EXACT states the contract: every path-valued option typed str must be named there, because _scrub_value returns a bare path verbatim by design. workflow, from_snapshot and from_ are in; three newer options joined their commands without joining the set:

• comfy node restore-snapshot <path> — restore_snapshot(path: str)
• comfy node install-deps --deps <file> — install_deps(deps: str)
• comfy node save-snapshot --output <file> and deps-in-workflow --output — output: str

So for example comfy node restore-snapshot D:\home\priv\snap.json shipped "path": "D:\home\priv\snap.json" — the user's home directory and install layout, verbatim, to Mixpanel and PostHog, against the module's own policy.

They now redact to <redacted> like their siblings, keeping only "the option was supplied". A test pins the whole family at once. 149 tracking tests pass.

Summary by CodeRabbit

• Privacy
  • Values provided for path, deps, and output options are now redacted in tracked command properties.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Comfy-Org/comfy-cli
• Branch: main
• File: .coderabbit.yaml
• Commit: 81ef083
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: b5465e4e-300c-422f-907b-755de0d7c0f1

Commits

Reviewing files that changed from the base of the PR and between 81ef083 and f5224c1.

Files selected for processing: 2

• comfy_cli/tracking.py
• tests/comfy_cli/test_tracking.py

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 2 remain after this review.

Walkthrough

The tracking filter now redacts non-None values for path, deps, and output. A new test checks redaction for path-valued options and verifies tracking-event counts.

Changes: Tracking redaction

Layer / File(s)	Summary
Redaction filter and test comfy_cli/tracking.py, tests/comfy_cli/test_tracking.py	The filter treats path, deps, and output as sensitive exact-match names. The test checks redaction for five path-valued options, confirms private path fragments are absent, and checks tracking-event counts.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Possibly related PRs

• Comfy-Org/comfy-cli#1059: Adds path-valued logging options that may need the same redaction.

Suggested reviewers: mattmillerai

Merge Risk: Minimal · up to f5224

The change is mergeable with minimal risk based on the supplied implementation and test coverage.

Pre-merge checks: 5 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "tracking: redact the path-valued options path, deps, output" matches the main change. The PR adds path, deps, and output to the sensitive exact-match names in filter_command_kwargs in comfy…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Architecture Decision Compliance		The diff only extends the existing telemetry redaction set with path, deps, and output and adds coverage for that behavior. The change does not conflict with any Accepted ADR: AUTOMATION-0003 co…

Full details: Title check

Explanation

The title "tracking: redact the path-valued options path, deps, output" matches the main change. The PR adds path, deps, and output to the sensitive exact-match names in filter_command_kwargs in comfy_cli/tracking.py, so their non-None values are redacted to "<redacted>" before tracking. A test covering these options was added. The title is short, specific, and free of noise.

Full details: Architecture Decision Compliance

Explanation

The diff only extends the existing telemetry redaction set with path, deps, and output and adds coverage for that behavior. The change does not conflict with any Accepted ADR: AUTOMATION-0003 concerns machine-output format, DEPENDENCIES-0001 concerns dependency-resolution ownership, and OPERATIONS-0002 concerns structured workflow operations. No new architectural boundary, dependency choice, or compatibility contract is introduced; this is a reversible implementation detail.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}