Add MSCH Nodes as one unified custom-node pack - #3247

Merge Risk: 🟠 High · up to 9c2ce

The catalog entry would install unrelated repositories instead of the unified MSCH pack, so users would not receive the advertised nodes. The repository references must be corrected before merge.

_{Comment @coderabbitai help to get the list of available commands.}

Thanks for the contribution! A few issues need addressing before this can be registered:

1. Several nodes take a full-path STRING widget and use it verbatim when absolute (only is_file/is_dir checks), so a shared workflow can read or write files anywhere on the host:
   • components/puppet_face/nodes.py:456 (write via cv2.VideoWriter), 402 (read via cv2.VideoCapture)
   • components/typort/nodes.py:55, components/slideshow/nodes.py:234 and 34, components/slideshow/advanced_nodes.py:21, components/a2v/mscha2v/nodes/_common.py:10
     Please resolve these against a fixed base directory (realpath + commonpath, rejecting absolute and ..).
2. components/lyric_sync/aligner.py:40 takes a whisperx_exe widget and runs it as an executable if the path exists — an arbitrary-executable launch. Please pin this to a known binary / PATH lookup rather than an arbitrary caller-supplied path.
3. components/typort/audio_analysis.py:80 calls torch.load(..., weights_only=False) (an unsafe pickle deserializer) and is reachable from the open POST /mariotyport/analyze-audio route, so a crafted checkpoint executes code on load. Please load with weights_only=True (or a safetensors path).

I'll re-evaluate once these are addressed.

Thanks @ltdrdata. All three issues are addressed and pushed in f59c2d4.

1. File paths: all the listed PuppetFace, Typort, Slideshow and A2V entry points now use a shared resolver with realpath + commonpath. Reads are confined to ComfyUI/input and PuppetFace writes to ComfyUI/output. Absolute paths, Windows drive/UNC paths, .. components and symlink escapes are rejected. Cache checks use the same validation, and Slideshow checks individual image entries as well as the directory. Related soundtrack/font inputs and the Typort audio route are also constrained. Tooltips and migration documentation explain the new input-relative paths.
2. WhisperX: executable selection now uses only the fixed whisperx command on the host PATH or the known installation fallback. The legacy whisperx_exe widget is ignored, including at the subprocess runner, so existing workflows cannot override the executable.
3. Demucs: checkpoint loading now uses weights_only=True, with only the fixed metadata types required by the official artifact allowlisted. The pinned SHA-256 is checked against the same in-memory bytes that are deserialized; there is no unsafe fallback. Tests confirm that a crafted pickle is rejected and that the official model still reconstructs successfully.

GitHub Actions passed, including all 24 loader/security tests on Linux (with the symlink cases and official checkpoint) and all 108 A2V tests. Locally, all 17 Typort and 28 Slideshow tests also passed. The actual ComfyUI loader registered all 35 nodes across 15 components; browser asset checks and a typography render passed.

Ready for re-evaluation. Thanks for identifying these issues.