Image Crop + Rotate + Pad, Load Image + Pad and Load Video refused a
picture named the way ComfyUI names a generated file
("photo.png [output]", "[temp]") with "The selected source is outside
ComfyUI's input folder." Core Load Image takes those names.
resolve_input_path now reads the name the same way the video nodes'
Outputs list already does (resolve_server_file): the tag picks the
input, output or temp folder, and the rest is a name below it. A whole
path, "~", "." and "..", and a network path are refused from the text
alone; a link that leads out of the folder is refused once resolved.
Both functions share that code. A whole path inside the input folder,
accepted before, is now refused too, as the security rule asks.
Load Video's player and the shared upstream preview stripped the tag
and asked /view for the input folder; they now keep the folder.
Tests cover input, [input], [output] and [temp] names through the
resolver and through ComfyUI's own validation next to core Load Image,
and the refused escapes. Help pages, SECURITY.md and CHANGELOG say so.
32 of the ? help pages checked against the code and corrected.
Wrong claims fixed: Stitch Inpaint's empty-area check (20/255), what a
new video keeps on both Video Crop + Rotate + Pad pages, Load Video's
frame picker and player height, where Run Timer lists earlier runs,
inpainting on the Krea 2 Outpaint Model Patch page, Workflow Note's
banner layout and pack detection, Image Resize's pad bars and mask,
Save Image's path preview and tags, Free Memory's steps, and Latent
Size's sockets.
Image Crop + Rotate + Pad now follows the node from top to bottom; the
saved values no row shows moved under Technical details.
Controls are named the way the node shows them, with the input name
beside. Pages that opened with jargon now open with what the node does
and when to use it. LoRA Loader gained the Civitai lookup, suggested
strength and the gear options it did not name.
Picking a frame writes IN. With the frame at or after OUT the node held a start after its end, and the next run stopped with "Load Video needs start_seconds smaller than end_seconds" until a handle was moved.
A native select draws its option list itself, so hovering a name gave
nothing to go on: you picked by filename alone. Load Image + Pad, Load
Video and the crop / rotate / pad editors now open a list that shows the
hovered picture, or plays the hovered clip muted with its size and
length, and filters as you type; arrow keys, Enter and Escape work.
The picker (js/shared/media_picker.mjs) only reads the combo widget's
options and writes the chosen value back, so saved workflows, undo and
the API are unchanged. Pure parts live in media_list.mjs with tests.
Help pages named the raw widget (divisible_by, max_frames, color_match)
where the card shows a label (Multiple, Limit, Tone match), so a reader
could not find the control. Each such control now reads as the visible
label with the widget name beside it, and option values show the text
on the segment (match a, hist, cover, guided).
- New nodes: Image Resize plus the Utility group (Text, Integer, Float,
Show Text, Math Expression, Select Every Nth, Split Batch, Merge
Batches, Free Memory) - the dependency-free gaps that let shared
workflows drop heavy packs.
- Replace with AusBoss nodes (prototype): preview-then-confirm graph
rewrite swapping known third-party nodes for pack equivalents, with a
tested translation map, per-node opt-out, and refuse-with-reason for
nodes the pack cannot stand in for.
- Load Video: single-frame FRAME picker, an honest "what will load"
label from the probed source rate, drop-a-video-to-restore. Save
Video: format-aware widgets and a file_path output. Stitch Inpaint
gained a blend_mask output, Select Frame negative from-the-end
indexing, Image Size a batch count - all appended, saved workflows
load unchanged.
- LoRA Loader: drag-to-reorder rows, hover thumbnails on rows, file
size and date in the info card.
- Appearance: flagship scheme deepened to slate-teal; the retired
bright-teal pair upgrades automatically via LEGACY_SCHEME_PAIRS.
Optional queue-completion chime, off by default.
- Image Resize invariant: pixels are only invented on an explicit
width+height pad request - scale-derived modes resolve divisible_by
snaps with a sub-half-step resize, never bars.
- Docs refreshed for six stale pages, stale text and metadata fixed
across the pack, the panel-height rule codified in AGENTS.md and the
brand skill, and ausboss_node_tour.json added - a model-free example
exercising 17 node types in one graph.
Validated: scripts/validate_nodes.py (24 files), 300 JS tests, all
Python suites under the ComfyUI embedded interpreter.
ausboss