Manual review request for flagged node version: minimax-director 0.17.4

### Registry entry

- Node: https://registry.comfy.org/publishers/imbutus/nodes/minimax-director
- Repository: https://github.com/imbutus/ComfyUI-MiniMaxDirector
- Version to review: **0.17.4** (published 2026-08-28)

### What happened

`0.17.4` went from `NodeVersionStatusPending` to `NodeVersionStatusFlagged` within about an
hour of upload. The two earlier versions, `0.16.0` and `0.1.0`, are flagged as well, so all
three versions the publisher has ever uploaded are in that state. The node itself is
`NodeStatusActive` with an empty `status_detail`, and the version records the public API
returns carry a `status` and no reason, so there is nothing on our side to act on.

### What the package contains

One node pack: a timeline editor for MiniMax H3 prompts. Pure Python plus a browser UI, MIT
licensed.

- **No dependencies at all** — `project.dependencies` is `[]`.
- No `subprocess`, `os.system`, `eval`, `exec`, `pickle`, `__import__`, `urllib`,
`requests`, `socket` or `http.client` anywhere in the shipped Python. I checked the
published zip itself (`https://cdn.comfy.org/imbutus/minimax-director/0.17.4/node.zip`),
not just the working tree.
- No obfuscated or generated code; no downloads, no model fetching, no telemetry.
- The browser code reaches the network in four places, all of them ComfyUI's own
same-origin endpoints: `POST /upload/image` (the user picking a file), `GET /view`
(drawing a thumbnail or a waveform), `HEAD /view` (checking whether a named file is still
in the input folder), and one endpoint the pack registers itself,
`POST /minimax_director/compile`, which compiles the timeline into a prompt string. No
other host is contacted from anywhere in the package.

### The one thing I can see that a scanner might read as command execution

The zip includes two development shell scripts that are of no use to an installed pack:

- `tools/release.sh` — the maintainer's release script (`git commit`, `git tag`, `git push`).
- `tools/loadcheck.sh` — a pre-commit check that copies `web/` to a temp directory and runs
`node --input-type=module -e "…"` against it. It contains `rm -rf "$T"` on that temp
directory.

Neither is imported or invoked by the pack; nothing in `__init__.py` or `src/` runs a shell
at all. They are in the archive only because `comfy node publish` zips every git-tracked
file. I will add a `.comfyignore` so `tools/` and `tests/` are left out of the next release.

### The request

Please take a manual look at `0.17.4` and, if it is a false positive, clear it. I am happy
to make any change to the package that helps — including republishing without the shell
scripts first, if you would rather review a package that has none.

Inspect the published 0.17.4 node.zip, especially tools/release.sh, tools/loadcheck.sh, __init__.py, and src/. Verify whether the flagged status is caused by the tracked shell scripts or any package behavior, then compare the findings with the registry status; done means the false positive is cleared or a specific package change is identified.

Written by the indexing model from the issue text.