feat(custom-node-list): add MiniMax H3 Novel node for continuity-awar…

[yuyuki]

Add custom nodes "MiniMax H3 Novel"

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: c8a0878e-3975-46db-9362-a6d02aa2cccb

📥 Commits

Reviewing files that changed from the base of the PR and between e2aa035 and 60a165d.

📒 Files selected for processing (1)

• custom-node-list.json

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The custom-node registry adds a Git-installable MiniMax H3 Novel Pipeline entry for yuyuki. The entry includes the repository reference and a description of its continuity-aware novel-to-prompt nodes.

Changes

Custom node registration

Layer / File(s)	Summary
Add MiniMax H3 Novel metadata custom-node-list.json	Adds the MiniMax H3 Novel Pipeline entry for yuyuki, with its repository reference, Git-clone installation method, and description.

Merge Risk: ⚪ Minimal · up to 60a16

This adds a registry entry for the MiniMax H3 Novel Pipeline. The installation reference is consistent with the registry contract, and no current merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

_{Comment @coderabbitai help to get the list of available commands.}

[ltdrdata]

1. The pack registers open routes with no access control — POST /minimax_h3_novel/upload writes uploaded bytes to disk, DELETE /minimax_h3_novel/chapters unlinks files, and POST /minimax_h3_novel/lmstudio-settings writes the API-key config — so any remote caller can trigger these writes and deletes.
   • comfyui_plugins/minimax_h3_novel/init.py:55-145
2. The api_url widget lets a graph point the LM Studio client at an arbitrary host while the operator's API key is attached as a bearer credential, so a server-side secret can be sent to an attacker-chosen host.
   • comfyui_plugins/minimax_h3_novel/lmstudio_config.py:26 (api_url), generate_h3_prompts.py:56 (client)
3. The out_dir widget is used as a write destination and chapter_paths as a read source with no confinement (absolute and .. accepted), so files can be written outside the output root and arbitrary files read — the read content is exposed through the node output.
   • pipeline_step3_generate.py:1317 (write), generate_h3_prompts.py:48-75 -> util.py:44-52 (read)
4. The node UI strings are in French — the LMStudioConfiguration node DESCRIPTION and every widget tooltip.
   • comfyui_plugins/minimax_h3_novel/lmstudio_config.py:12-66

Please make the upload / delete / settings routes local-only or remove them, pin the LM Studio endpoint to an allow-list (and do not send the API key to a widget-supplied host), confine out_dir and chapter_paths to a fixed base directory, and write the UI strings in English. For multilingual support, refer to the locale feature: Comfy-Org/ComfyUI#6558

I'll re-evaluate once these are addressed.

[yuyuki]

Hello @ltdrdata ,

I made some change.

I fixed the registration, the path and now it's only english. I will introduce multilangual later.

Thank you for your feedback