Shortcut Launcher (TJ)

The node that opens your folders for you

Shortcut Launcher (TJ) is a pure workflow QoL node: it puts a set of buttons on the canvas that open folders, files, or URLs on your machine - no wires, no inputs, no outputs. Think "launch the output folder," "open the GitHub repo," "jump to the Civitai upload page" - the navigation you do a dozen times a session while iterating on a workflow, now one click from the graph instead of a trip through the file explorer.

It's an output node with zero ports, so it won't participate in your data flow at all. You drop it somewhere out of the way, configure your shortcuts once, and it just sits there being useful. It's the kind of node you roll your eyes at until you've used it for a week and then can't live without it.

How it works

All the behavior lives in a small API surface plus frontend UI. The node itself does nothing on execute (run() returns nothing) - the buttons are pure UI. Clicking one calls the pack's /tj/shortcut/open endpoint, which decides how to launch based on the target:

• URLs (http(s)://...) → opened in your browser.
• Paths → opened with the OS opener: os.startfile on Windows, open on macOS, xdg-open on Linux.

There's a browse helper (/tj/shortcut/browse) that pops a folder picker so you don't hand-type paths. Shortcuts can be imported/exported as JSON (nice for moving between machines), and there are tooltips plus a color preset so you can visually group "render output" vs "docs" buttons.

The one thing to know before you use it

The /tj/shortcut/open endpoint is exactly the kind of "runs local programs from a web request" feature that custom-node security incidents are made of - and it got fixed for precisely that reason. In v2.9.2 the author locked it down to loopback (localhost) + same-origin requests only, after a changelog entry acknowledged remote/CSRF requests could previously trigger local files or programs. Practical implications:

• Update the pack before relying on this. If you're on an old version, this node is a remote-code-execution vector when your ComfyUI port is exposed.
• Don't expose your ComfyUI to the internet at all - the whole ecosystem runs untrusted third-party code with your user account (see the LLMVISION incident), and a launcher that executes paths is the kind of node you want loopback-gated.
• If a click silently fails, the first suspects are a stale pack version or a path that no longer exists (the API returns a 404 not_found for missing paths).

Install it

Standard TJ_NODE install - no Python dependencies beyond the pack:

cd ComfyUI/custom_nodes
git clone https://github.com/designloves2/ComfyUI-TJ_NODE.git

Or ComfyUI Manager → search TJ_NODE, restart, and it's under ✨ TJ_Node/Utility.

Worth repeating given the security history: keep this pack updated. The launcher is genuinely handy, but the reason it's only allowed to run localhost requests now is that it used to be exploitable, and that fix only exists in recent versions.