- Add VideoReportNode to nodename_pattern. It is a new node class in the
plugin, so without it Manager's node detection would not find it.
- Describe the actual file-access model: paths are resolved with realpath and
confirmed with commonpath against the input/output directories, and absolute
paths, ".." traversal and outside symlinks are rejected.
- State where files come from and go (input directory via drag-and-drop or the
upload button, output directory under a relative prefix), since the previous
"absolute path" wording no longer applies.
- Drop the duplicated bilingual description; the UI is English by default with a
Simplified Chinese translation.
Register artttaku/ComfyUI-BatchVideoLoader (#3179),
rattskr/ComfyUI_CivitaiAdvanceLoader (#3218),
Winlensky/comfyui_compvis_ldm (#3229) and two entropicnoise MiniMax-H3
packs (#3185, #3202) at the end of the git-clone body, above the
copy/unzip tail zone. Relocate the already-merged ethanfel H3 Prompt IDE
(#3186) from array head to the ethanfel author group. Sync all six into
node_db/new. All six passed verify-security (SAFE), locale (English UI),
and quality gates.
Base carried the scanner-abbreviated title 'h3_sage_amd' and a one-line
description; replace with the author's canonical title and description
from PR #3144 in both the root list and node_db/new.
Post-registration full re-verify (§14.7) found an unauthenticated CSRF-reachable
arbitrary-directory delete: DatasetProject.make(reset=True) runs shutil.rmtree on an
uncontained os.path.join(output_dir, dataset_name) (nodes/common.py:169-173) — an
absolute or ..-containing name escapes the output dir. Removed from default + node_db/new,
added to node_db/dev with [SECURITY ISSUE] suffix (reversible install-block, §4.7-H mechanic).
Restore to default on author fix (realpath+commonpath containment) + re-verify pass.
PR conflicted on the list tail; manually registered. Deep-verify SAFE (unauth routes are inference/model-load only, no side-effect sink), Non-English PASS.
jesse890423