Add a password-gated private instance mode for xaigen.

Keep Authentik on aigen, isolate library data per instance, and purge Comfy outputs from the desktop after they are saved on the server.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/utils/comfy.ts

@@ -180,3 +180,54 @@ export async function probeComfy() {
     return { ok: false, host: comfyBase() }
   }
 }
+
+export function comfyFilenamePrefix() {
+  return String(useRuntimeConfig().comfyFilenamePrefix || process.env.COMFY_FILENAME_PREFIX || 'video/MiniMax_H3')
+}
+
+export function isOurComfyVideo(video: { filename: string; subfolder: string }) {
+  const prefix = comfyFilenamePrefix().replace(/\/$/, '')
+  const parts = prefix.split('/')
+  const namePrefix = parts[parts.length - 1]
+  const sub = parts.length > 1 ? parts.slice(0, -1).join('/') : 'video'
+  const nameOk = video.filename.startsWith(namePrefix)
+  const subOk = !video.subfolder || video.subfolder === sub
+  return nameOk && subOk
+}
+
+export function purgeComfyEnabled() {
+  return Boolean(useRuntimeConfig().purgeComfyOutputs)
+}
+
+export async function purgeComfyArtifacts(opts: {
+  video?: { filename: string; subfolder: string; type: string }
+  imageName?: string
+  promptId?: string
+}) {
+  if (!purgeComfyEnabled()) return
+  const files: { filename: string; subfolder: string; type: string }[] = []
+  if (opts.video?.filename) files.push(opts.video)
+  if (opts.imageName) files.push({ filename: opts.imageName, subfolder: '', type: 'input' })
+  for (const file of files) {
+    try {
+      await comfyFetch('/aigen/purge', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(file)
+      })
+    } catch {
+      // Comfy may not have the purge route loaded yet; never fail the saved clip.
+    }
+  }
+  if (opts.promptId) {
+    try {
+      await comfyFetch('/history', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ delete: [opts.promptId] })
+      })
+    } catch {
+      // ignore
+    }
+  }
+}