Add comfyui-studio plugin: zero-dependency ComfyUI 8188 toolkit (4 Skills + 6 preset workflows)

[antianqi]

What this PR adds

A zero-dependency toolkit for driving a local ComfyUI 8188 server, packaged as a MiniMax Code
Plugin under plugins/antianqi/comfyui-studio/. Two parts in one Plugin:

• Part A — Natural-language control: submit any ComfyUI workflow JSON, poll the queue,
  download outputs. Two equivalent entry points (Python CLI + stdio MCP server), both
  zero-dependency.
• Part B — 6 preset workflows, numbered by the user's trigger scenario:
  1. 生图 (generate) — selfie-text-to-image.json
  2. 模仿 (mimic) — selfie-mimicry.json
  3. 改图 (edit) — flux2-klein-image-edit.json
  4. 融合 (fuse) — flux2-klein-image-edit-dual.json
  5. 首帧 (drama first frame) — drama-first-frame.json
  6. 出片 (image to video) — drama-image-to-video.json

Problem it solves

Driving a local ComfyUI server from an agent requires either hand-rolling HTTP boilerplate per
workflow, or adopting a heavyweight MCP server that pulls in 50+ MB of native dependencies and
runs an install hook on first use. The first is tedious; the second is incompatible with the
hosted-Plugin policy ("no native binaries, no installers").

This Plugin does the first without paying the second cost. The same three primitives
(submit_prompt, check_queue, get_image) are exposed through both a tiny Python CLI and a
~200-line stdio MCP server, so the user picks whichever entry point fits their host agent.

What's included

• Four Skills for agent-driven automation:
  • comfyui-studio — routing layer, reads the user's intent and picks the right sibling
  • comfyui-workflow — submit any workflow, poll queue, download outputs (the basic transport
    every other Skill uses)
  • comfyui-character — scenarios 1, 2, 3, 4 (selfie + mimicry + Flux.2 Klein edits)
  • comfyui-drama — scenarios 5, 6 + the 7-stage short-drama pipeline around them
• A dependency-free stdio MCP server (server.mjs, ~200 lines, pure Node stdlib) exposing
  three tools: submit_prompt, check_queue, get_image. Mirrors the Python CLI.
• A dependency-free Python CLI (submit_workflow.py, stdlib only) for hosts that prefer
  scripts over MCP. Handles __PROMPT__ / __TRIGGER__ / __IMAGE1__ / __IMAGE2__ markers
  so the user does not have to rewrite the workflow JSON for every run.
• Six preset workflow JSONs (see the numbered table above) wired with the marker
  conventions.
• Complete documentation: README (Part A vs Part B framing, 6-scenario index, model
  boundary), examples/minimal-run.md (5-minute end-to-end walkthrough), per-scenario recipes
  in each Skill's SKILL.md, docs/security-notes.md, docs/troubleshooting.md, plus a
  BETA.md covering the standalone beta test channel.

Model boundary

The Plugin draws a clean line between public generation models and user-supplied LoRAs:

• Public generation models (checkpoints, VAE, CLIP, ControlNet, video models, vision LLMs)
  are referenced by the actual filenames on disk in the reference ComfyUI install that built
  this Plugin. The intent is "this is the model we ran, this is the field you may want to
  edit." The JSON is the source of truth and the user can edit any loader node to point at
  their own file.
• LoRAs are referenced by generic placeholders (your_face_lora.safetensors,
  your_style_lora.safetensors, character_a_lora.safetensors, character_b_lora.safetensors,
  any_motion_lora.safetensors). LoRAs are user-trained identity assets; the Plugin does not
  bundle or name anyone's private LoRAs. The user edits the LoraLoader*.lora_name field to
  point at their own file.

This boundary keeps the Plugin shareable while letting users adapt the workflows to their own
environment.

Beta test channel

While this PR is open and waiting for review, the standalone single-plugin beta repo is at
antianqi/comfyui-studio, tagged
v0.2.0-beta.1.
The mcode internal beta group can install from there following BETA.md and report issues
back so we can fix them before the official merge. This fork
(MiniMax-Code-Plugins-1) is only kept alive so this PR can be force-pushed; the install
instructions in BETA.md all point at the standalone repo.

Verified

• All six preset workflow JSONs POST successfully to a real ComfyUI 8188 server (the two
  selfie + the two Klein presets verified end-to-end on the reference install; the two drama
  presets verified at the JSON / submission layer).
• npm run check reports OK plugin antianqi/comfyui-studio.
• All four Skills have valid YAML frontmatter and parse as expected.
• The Python CLI and the stdio MCP server both work on Node 18+ / Python 3.10+.
• All six workflow JSONs parse cleanly under strict JSON parsers (ConvertFrom-Json /
  JSON.parse / json.loads all OK).

What the Plugin does not do

• It does not train LoRAs. Training is its own project; this Plugin only consumes a LoRA the
  user already has.
• It does not bundle or distribute any LoRA, model, face embedding, voice sample, or any other
  identity asset. Every character and voice is user-supplied.
• It does not install packages, run post-install hooks, or download native binaries.
• It does not call any cloud service or third-party API.
• It does not run TTS, edit spreadsheets, burn subtitles, or assemble audio/video — the
  comfyui-drama Skill documents the full 7-stage pipeline but only ships ComfyUI workflow
  templates for the two image-side stages (scenarios 5 and 6); the other stages are user
  pipeline steps that the Plugin deliberately does not assume.

[hetaoBackend]

Review result: do not approve / do not merge yet.

The repository check passes (27 tests), but the runtime and bundled workflows have blocking defects:

• MCP image corruption: server.mjs:86-90 decodes every response as UTF-8 text, then server.mjs:152-161 reconstructs it as binary. A local mock returned different base64 for bytes containing values >= 0x80. Use a Buffer-preserving HTTP path.
• Python auth redirect leak: submit_workflow.py:41-78 uses urllib.request.urlopen, which follows redirects while retaining the bearer header. A redirected endpoint can receive COMFYUI_API_TOKEN, contradicting docs/security-notes.md:18-23. Disable redirects or enforce same-origin and never forward Authorization across origins.
• The docs promise __TRIGGER__, __IMAGE1__, __IMAGE2__ and --trigger, --filename, --filename2 substitutions (README.md:77-84, skills/comfyui-character/SKILL.md:118-129), but the CLI only implements exact __PROMPT__ replacement (submit_workflow.py:81-103,219-227).
• Scenario 3 puts its image marker on an unused node while the connected loader is blank; scenario 4 has connected blank loaders and no image markers (workflows/flux2-klein-image-edit*.json).
• Output paths are not constrained: submit_workflow.py:138-145,195-205 joins server/user filenames directly, so absolute or ../ names can escape --output-dir.

Please fix binary handling, redirect/token handling, marker/flag implementation and workflow wiring, and enforce output-directory containment before requesting another review.