No actionable comments were generated in the recent review. 🎉

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Before this can be merged, several issues need to be addressed:

1. Path traversal (arbitrary MP4 write via download nodes) — SeedanceI2V / SeedanceT2V (seedance_node.py:58-60, 144-146) declare project / episode / shot_label as free STRING inputs and pass them into shared.output_dir(project, episode) (shared.py:57-65) + shared.download_video(...) (shared.py:39-46), which reaches open(save_path, "wb") with attacker-controlled bytes from video_url. A crafted project="../../../tmp" (or similar values in episode/shot_label) writes the downloaded MP4 outside the intended output tree.

2. Path traversal (playground download) — SeedancePlayground (playground_node.py:70-71, 146-168) has the same primitive via label_prefix, which flows into save_path = PLAYGROUND_OUT / f"{label_prefix}_s{seed}_{task_id}.mp4" → open("wb") with no containment.

3. Path traversal (asset writer) — CastSaver.save() (cast_manager.py:349-360) uses free-form STRING name and project unmodified to build COMFY_ROOT/output/seedance/<project>/assets/<kind>/<name>, then mkdir(parents=True) + PIL.Image.save(folder/"portrait.png"). project="../../../etc" (or name containing ..) escapes the output directory.

Root fix for 1–3: canonicalize the intended output base (base_resolved = Path(base).resolve()), then either (a) sanitize each STRING with os.path.basename before joining, or (b) reject any resulting path whose Path(final).resolve().is_relative_to(base_resolved) is False. Apply this in shared.output_dir / shared.download_video and in CastSaver.save before mkdir and the write sink.

4. Non-English UI strings — several NODE_DISPLAY_NAME_MAPPINGS values mix English with Chinese in parentheses (cast_manager.py:372-375, prompt_builder.py:142-143, playground_node.py:207), the provider display name is "Seedance 2.0 (火山引擎)" (providers/seedance.py:19), and the INPUT_TYPES placeholders contain Chinese sample text (cast_manager.py:145, 242, 331). Please write the UI strings in English. For multilingual support, refer to the locale feature: [i18n] Add /i18n endpoint to provide all custom node translations ComfyUI#6558

I'll re-evaluate once the path-traversal chain is contained on all three write sinks and the UI strings are English by default.

Thanks for the submission! A pre-registration review found two things to resolve before this can be added to the default channel.

1. Path containment (security). Several nodes join free-text inputs onto the output directory without containment, so crafted values can make writes/reads land outside ComfyUI's output/ tree:

• CastSaver / CastLoader — name and project flow into the asset path (_asset_root(project)/kind/name) with no sanitization (write and image-read).
• SeedanceI2V / SeedanceT2V — project, episode, shot_label flow into the download target before open(save_path, "wb").
• SeedancePlayground — label_prefix flows into the output filename.

ComfyUI's built-in save nodes avoid this by routing user path segments through folder_paths.get_save_image_path(), which strips traversal and confines to the output tree. Suggested fix: sanitize every user-supplied path segment (name, project, episode, shot_label, label_prefix) with os.path.basename() and/or a commonpath containment check against your intended base (output/seedance/…) — the places to fix are _asset_root(), shared.output_dir(), and the playground output builder.

2. Localization. Please write the node UI strings in English (currently the node display names — e.g. 资产扫描, 双层资产加载, 保存到资产库 — and STRING input placeholders — e.g. 女主 / 反派 / 咖啡馆, 日系校园 / 悬疑暗黑 — are in Chinese).

For multilingual support, refer to the locale feature:
Comfy-Org/ComfyUI#6558

Once updated, reply here and we'll re-review. Holding the PR open in the meantime — thanks!