[Bug] Desktop listen address 0.0.0.0 causes is_local_mode=False, blocking all installations

[sunkai174634]

Bug Description

On ComfyUI Desktop (macOS), the Manager's security check rejects all custom node installations with HTTP 403, even for local users.

Root Cause

In legacy/manager_server.py, is_local_mode is determined by whether the --listen argument is a loopback address:

is_local_mode = is_loopback(args.listen)

ComfyUI Desktop sets listen = "0.0.0.0" (all interfaces), which makes is_loopback() return False.

Combined with network_mode = public and security_level = normal (defaults), the security check:

elif level == 'middle+':
    if is_local_mode or is_personal_cloud:
        return security_level in ['weak', 'normal', 'normal-']
    else:
        return False  # ← Always returns False for Desktop users!

...returns False, rejecting the install request before any git/pip operation runs.

Symptom

• Install button returns instantly (~0ms) with result: "failed" and error_message: null in batch_history JSON
• No visible error message in the Manager UI
• security_level = weak is a workaround, but not ideal

Affected Users

ComfyUI Desktop users (all platforms) who run with default settings. Remote/Web/Server users are unaffected.

Suggested Fix

1. Fix the logic: is_local_mode should detect if the connection is from localhost, not just if the server is bound to a loopback address. Check request.client IP instead of args.listen.
2. Or document the workaround: Add listen = 127.0.0.1 to the Manager config.ini as a recommended Desktop setting.
3. Or detect ComfyUI Desktop: Check if running in desktop mode and auto-enable local mode security.

Environment

• ComfyUI Desktop 0.8.36
• macOS
• Manager latest (via pip/uv)