install-service: grant venv base interpreter (pyvenv.cfg home) outside COMFY_DIR

internal/service/venv.go

@@ -0,0 +1,38 @@
+package service
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// comfyVenvHome returns the base interpreter directory of the Python venv at
+// <comfyDir>/.venv when that directory lives outside comfyDir, "" otherwise.
+// uv-created venvs (Comfy-Desktop) ship a redirector python.exe whose real
+// interpreter is the pyvenv.cfg "home" tree — typically a sibling of
+// COMFY_DIR, which a sandbox/ACL covering COMFY_DIR alone does not reach.
+func comfyVenvHome(comfyDir string) string {
+	data, err := os.ReadFile(filepath.Join(comfyDir, ".venv", "pyvenv.cfg"))
+	if err != nil {
+		return ""
+	}
+	for _, line := range strings.Split(string(data), "\n") {
+		k, v, ok := strings.Cut(line, "=")
+		if !ok || strings.TrimSpace(k) != "home" {
+			continue
+		}
+		home := strings.TrimSpace(v)
+		if home == "" {
+			return ""
+		}
+		if st, err := os.Stat(home); err != nil || !st.IsDir() {
+			return ""
+		}
+		rel, err := filepath.Rel(comfyDir, home)
+		if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+			return home
+		}
+		return "" // inside comfyDir: already covered by the COMFY_DIR grant
+	}
+	return ""
+}