The registry scan report on 1.1.4 listed exactly three findings, all of them
the folder-dialog process launches in __init__.py (yara rule
python_command_injection_risk, severity "info"), and no path-traversal
findings at all: the 1.1.4 containment guard did its job. An admin escalated
1.1.2, 1.1.3 and 1.1.4 from Flagged to Banned on those three hits anyway.
The pattern itself is not against the rules (Pixaroma ships an identical
PowerShell/osascript picker and stays listed), but arguing that point does not
make the package installable, so the surface is gone instead:
- __init__.py registers no HTTP route and launches no process. The Browse
button and POST /craftkit/browse_folder are removed.
- Folder approval moved to ComfyUI's own settings store under
CraftKit.AllowedFolders. The node button writes it through the frontend
settings API; Python only ever reads the file.
- craftkit_folder_guard.py drops remember_folder/dialog_available and the
allow_any flag, so containment can no longer be disabled at all. The legacy
allowed_folders.json is still read so folders approved with the old dialog
keep working.
- Comments avoid naming the module and call form the scanner matches, since
the scan reads source text.
Verified against a simulated install (10/10 cases) and end to end in ComfyUI:
button approves, Python accepts the folder and its subfolders, pre-update
approvals still work, system folders and .. traversal still refused.
Simplifies the preset-chip picker (Smart Resize / Smart Batch Resize)
to a single canvas implementation - drops the dual DOM-widget path,
so chips stay positioned correctly under "Longest side (px)" in both
classic and Nodes 2.0 rendering instead of jumping to the bottom of
the node.
Adds a shared setWidgetVisible() helper so dynamic show/hide (Counter
start, the hidden customtext output on every node) actually works
under Nodes 2.0's Vue reactivity - it previously only worked in
classic canvas mode.
Fixes two silent Nodes 2.0 rendering bugs: widgets only repaint via
their own triggerDraw(), not setDirtyCanvas(), so the active preset
chip and status-box text were going visually stale after an update
even though the underlying value was correct. And Nodes 2.0's
WidgetLegacy bridge permanently stamps a widget.width that classic
mode's own click hit-test then reads forever after - once a node had
ever rendered under Nodes 2.0, classic mode silently lost clicks on
the right side of a wide node. Both fixed by keeping widget state in
sync on every draw() instead of trusting it to survive across
renderer switches.
Also centers section-divider labels with flanking lines (was
label-left/line-right) and brightens the line color, which had
become nearly invisible under Nodes 2.0's extra canvas scaling.
README: reorders node sections into actual pipeline order (Prompt
Controller -> Profile Switch -> Resize -> Resolution Multiplier ->
Batch Resize, standalone tool last instead of mid-list), adds a
Nodes 2.0 compatibility screenshot, and refreshes the Smart Batch
Resize screenshot to match its current UI.
- Add section-header dividers (Resize/Filename/Output Location/Output
Format/Options) to js/smart_batch_resize.js — the node grew to ~19
widgets after the review fixes and needed grouping to stay scannable
- Move `delimiter` next to the other filename-building fields, and
reorder Output Location/Output Format/Options into a more logical
flow. This changes the node's widget order — workflows saved before
this change will need the node re-placed once (values shift on load)
- Update README: new screenshot, full input table rewritten to match
the new field order and the alpha_mode/output_format/quality/
preview_limit/upscale_if_smaller additions, "Why these nodes?" bullet
on the transparency handling
- move all node screenshots above the description text, full-width (100%)
- note that Longest side accepts a typed custom value, not just the presets
- clarify Smart Batch Resize works standalone (no wiring needed, just folder + Run Batch)
- rename Smart Category Config → Smart Profile Switch 🧩 (code, JS, locales, demo workflow)
- add banner.svg and embed it at the top of README
- replace fragile OpenFileDialog folder-browse hack with native IFileDialog/FOS_PICKFOLDERS picker — fixes wrong-folder bug on single-click select
- flip Smart Resize's upscale_if_smaller default to true — node now resizes to target by default, as the name implies
- add width/height source tooltip to Smart Resolution Multiplier's image input
- fix stale widgets_values in smart_batch_resize_demo.json (10 fields → 13 after prefix/counter fields were added)
- full README rewrite: correct inputs/defaults/outputs for all 5 nodes, new Smart Profile Switch section, Example workflows section, expanded "Why these nodes?"
- add new example workflow (seedvr2_smartresize_demo.json), updated screenshots
- add assets/*.ai to .gitignore
- bump version to 1.0.2
- Revised README to clarify node functionalities and typical use cases.
- Changed category for SmartResize, SmartBatchResize, and SmartSizeMultiplier nodes to "Craftopia".
rubz