Add ValiTools node pack

[vangel76]

Adds the ValiTools node collection to custom-node-list.json.

The pack is published on the Comfy Registry but is not in this list yet, so it shows up without stars or last-update information in the Manager.

Nodes

• VSmartPrompt — Dynamic Prompts with a rich-text editor: combinations with weights, wildcards, reusable variables (rolled once, constant everywhere), switcher conditions, chaining inputs, and post-run highlighting of the branches that were actually selected
• VFileRandom — random image loader that never repeats until every image in the folder has been drawn
• VRandomSelector — lazy random passthrough of N same-type inputs; only the selected branch executes
• VWaitForVRAM — holds execution until the GPU has a minimum amount of free VRAM

Repository: https://github.com/vangel76/comfyui-ValiTools
Registry: https://registry.comfy.org/publishers/vangel/nodes/valitools
License: Apache-2.0

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 1c3690dd-776e-434a-b1fa-20a19f12f9a7

📥 Commits

Reviewing files that changed from the base of the PR and between b75fc66 and 8dfd535.

📒 Files selected for processing (1)

• custom-node-list.json

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The custom node catalog adds ValiTools by Valentin Klein. The entry defines its GitHub source, git-clone installation method, file URL, and descriptions for four nodes.

Changes

ValiTools catalog integration

Layer / File(s)	Summary
Add ValiTools catalog entry custom-node-list.json	Adds ValiTools to custom_nodes with its GitHub reference, git-clone install type, file URL, and descriptions for VSmartPrompt, VFileRandom, VRandomSelector, and VWaitForVRAM.

Suggested reviewers: ltdrdata, teflon358, ethanfel

Merge Risk: ⚪ Minimal · up to 8dfd5

ValiTools is added to the custom-node catalog with its source and installation metadata. No current merge-readiness risk is identified.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

_{Comment @coderabbitai help to get the list of available commands.}

[ltdrdata]

1. The wildcard routes resolve their containment root from a client-supplied wildcard_dir field in the request body instead of a fixed base directory, so the is_relative_to() check runs against an attacker-chosen root and confines nothing — these open routes with no access control can then read any .txt file and write attacker content to any .txt path (both also creating parent directories on the way).
   • nodes.py:1619-1645 (root resolution), nodes.py:1680-1708 (save_wildcard write), plus read_wildcard / get_wildcard_files / validate_wildcards
2. The VFileRandom folder widget and the VSmartPrompt wildcard_directory widget are read from an unconfined path, and VSmartPrompt exposes the read content through its output.

Please resolve every route path against a fixed base directory (realpath + commonpath against a constant wildcard root, rejecting absolute and .. paths), ignore the client-supplied directory field, and confine the two widget reads the same way. I'll re-evaluate once the paths are contained.