comfyui_queue_manager 0.1.1 release stuck with NodeVersionStatusFlagged status - file-manager commands, SQLite, and React false positives

Hi team,

Please review **ComfyUI Queue Manager 0.1.1**, published September 14, 2026, currently marked `NodeVersionStatusFlagged`. The extension manages queued jobs, completed results, and generated files. Its securoty scan report contains seven findings, all with top-level severity `info`.

- Publisher: `edgerunner`
- Node: `comfyui_queue_manager`
- [Registry page](https://registry.comfy.org/publishers/edgerunner/nodes/comfyui_queue_manager)
- [Source repository](https://github.com/QuietNoise/comfyui_queue_manager)
- [Full scan reports](https://api.comfy.org/nodes/comfyui_queue_manager/versions?include_status_reason=true) — see version `0.1.1`.

Below are my responses to flags from the scanner:

**1–3. Open image location — `src/comfyui_queue_manager/helpers.py`, lines 31, 33, 36**

```python
subprocess.run(["explorer", "/select,", path]) # Windows: select file in Explorer
subprocess.run(["open", "-R", path]) # macOS: reveal file in Finder
subprocess.run(["xdg-open", folder]) # Linux: open containing folder
```

These are separate OS-specific branches supporting the gallery's **Open image location** button. Only the relevant branch runs. Launching the system file manager is necessary for this implementation of the feature.

All three trigger `python_command_injection_risk`. They use fixed command names and separate arguments, without `shell=True`. Before calling the helper, the code checks that the filename and subfolder match a recorded output for the selected job, builds the path from ComfyUI's output directory, and converts it to an absolute path.

**4–5. Local database — `src/comfyui_queue_manager/qm_db.py`, line 10**

```python
_local.conn = sqlite3.connect(DB_PATH, check_same_thread=False)
```

This opens `data/qm-queue.db` within the extension directory. The database stores jobs, status, options, and output metadata, supporting persistence between restarts and paginated results.

The same line triggers both `python_database_connections` and `python_network_operations`. The database detection is expected, but the network classification appears incorrect: this is local SQLite file access. The network rule matches the generic `.connect(` substring. `check_same_thread=False` concerns Python thread access, not networking.

**6. React function binding — `web/.gui/assets/index.js`**

The `python_network_operations` rule matches ten `.bind(` calls in JavaScript. The source map identifies their source as React's `react-dom-client.production.js`. JavaScript minification is disabled to make these locations readable.

These appear to be hard false positives.

**7. Dependency lockfile — `src/gui/package-lock.json`, line 1**

This is just a lock file for build of the extension's React frontend.

I also wonder if I should request these reviews with every release of my plugin or is the review something you do anyway? If anything I would like to make the process as smooth as possible for you.

Start with the version 0.1.1 scan report and the cited locations in src/comfyui_queue_manager/helpers.py, src/comfyui_queue_manager/qm_db.py, web/.gui/assets/index.js, and src/gui/package-lock.json. Compare each finding with the source and its stated execution context; done means the team has confirmed which findings are expected versus false positives and recorded the review outcome.

Written by the indexing model from the issue text.