comfyui-mcp 0.24.4 → 0.25.0

package/README.md

@@ -574,6 +574,8 @@ npx -y comfyui-mcp@latest --comfyui-url http://localhost:8188 --force-remote
 | `COMFYUI_PORT` | *(auto-detect)* | ComfyUI server port (tries 8188, then 8000) |
 | `COMFYUI_PATH` | *(auto-detect)* | Path to ComfyUI data directory. Auto-detection suppressed in remote/cloud modes. |
 | `COMFYUI_PYTHON` | `python` | Python interpreter for cm-cli subprocess operations (`useCmCli`, `sync_node_dependencies`) — point it at your ComfyUI venv's python. cm-cli needs the local filesystem, so these are **local-mode only**; on remote targets use the Manager HTTP path (the default). |
+| `COMFYUI_MCP_BRIDGE_HOST` | `127.0.0.1` | Panel-bridge bind host. Set `0.0.0.0` (or a LAN IP) to run the orchestrator on a 24/7 server and connect panels from other machines — **requires a token** (below); the orchestrator prints a ready-to-paste `ws://…/?token=…` Bridge URL. |
+| `COMFYUI_MCP_BRIDGE_TOKEN` | *(generated when needed)* | Shared secret gating every bridge connection (checked constant-time on the WS upgrade). Mandatory for a non-loopback `COMFYUI_MCP_BRIDGE_HOST`; pin it so the Bridge URL survives restarts. Never logged beyond the startup banner. |
 | `COMFYUI_MCP_DATA_DIR` | `~/.comfyui-mcp` | Base dir for per-instance data (the `generations.db` used by `suggest_settings`) when there's no local `COMFYUI_PATH` (remote/cloud/undetected). Scoped per target under `instances/<host_port>/`. |
 | `COMFYUI_API_KEY` | | Comfy Cloud API key. When set, **cloud mode** is active and the server talks to `cloud.comfy.org`. Never logged. |
 | `COMFYUI_CLOUD_URL` | `https://cloud.comfy.org` | Override the Comfy Cloud endpoint (testing/staging). |

package/dist/orchestrator/backend-readiness.js

@@ -90,6 +90,13 @@ export function backendReadiness(backend, opts) {
         const cli = ollamaInstalled(home);
         return { backend: "ollama", cli, auth: cli ? true : null, ready: cli };
     }
+    if (b === "openrouter") {
+        // Hosted — no CLI. Readiness = an OpenRouter API key in the orchestrator's
+        // env (OPENROUTER_API_KEY, or the shared COMFYUI_MCP_OLLAMA_API_KEY). A bad
+        // key still surfaces via the connect ack's model probe (degraded).
+        const key = !!(process.env.OPENROUTER_API_KEY || process.env.COMFYUI_MCP_OLLAMA_API_KEY);
+        return { backend: "openrouter", cli: key, auth: key ? true : false, ready: key };
+    }
     return { backend: b, cli: false, auth: false, ready: false };
 }
 /** Readiness for every known backend, plus a rolled-up any_ready. */

package/dist/orchestrator/backend-readiness.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend-readiness.js","sourceRoot":"","sources":["../../src/orchestrator/backend-readiness.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,qEAAqE;AACrE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,iFAAiF;AACjF,kFAAkF;AAClF,2EAA2E;AAC3E,mCAAmC;AAEnC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAYjC,gFAAgF;AAChF,qEAAqE;AACrE,MAAM,SAAS,GAA6B;IAC1C,KAAK,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC;IAC1C,MAAM,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC;IAC9C,MAAM,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;CACjC,CAAC;AAEF;;qDAEqD;AACrD,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChF,OAAO,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,UAAU,CAAC,uBAAuB,CAAC,IAAI,UAAU,CAAC,0BAA0B,CAAC,CAAC;AACvF,CAAC;AAED,yDAAyD;AACzD,SAAS,MAAM,CAAC,KAAe;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAG,KAAe;IACpC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,IAAwB;IACxE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,OAAO,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,4EAA4E;QAC5E,iCAAiC;QACjC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC;QACvD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CACjC,QAA0B,EAC1B,IAAwB;IAKxB,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AAClE,CAAC"}
+{"version":3,"file":"backend-readiness.js","sourceRoot":"","sources":["../../src/orchestrator/backend-readiness.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,qEAAqE;AACrE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,iFAAiF;AACjF,kFAAkF;AAClF,2EAA2E;AAC3E,mCAAmC;AAEnC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAYjC,gFAAgF;AAChF,qEAAqE;AACrE,MAAM,SAAS,GAA6B;IAC1C,KAAK,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC;IAC1C,MAAM,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC;IAC9C,MAAM,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;CACjC,CAAC;AAEF;;qDAEqD;AACrD,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChF,OAAO,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,UAAU,CAAC,uBAAuB,CAAC,IAAI,UAAU,CAAC,0BAA0B,CAAC,CAAC;AACvF,CAAC;AAED,yDAAyD;AACzD,SAAS,MAAM,CAAC,KAAe;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAG,KAAe;IACpC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,IAAwB;IACxE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,OAAO,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,4EAA4E;QAC5E,iCAAiC;QACjC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC;QACvD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC;QACvB,2EAA2E;QAC3E,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACzF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CACjC,QAA0B,EAC1B,IAAwB;IAKxB,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AAClE,CAAC"}

package/dist/orchestrator/index.js

@@ -10,12 +10,12 @@
 // key. See docs/design/panel-orchestrator.md.
 import { existsSync, writeFileSync, unlinkSync, readFileSync, readdirSync } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { tmpdir } from "node:os";
+import { tmpdir, networkInterfaces } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { randomBytes } from "node:crypto";
 import readline from "node:readline";
-import { startUiBridge } from "../services/ui-bridge.js";
+import { startUiBridge, isLoopbackBindHost } from "../services/ui-bridge.js";
 import { setupSecureBridge } from "../services/secure-bridge.js";
 import { detectInstallMode } from "../services/self-update.js";
 import { SessionStore } from "./session-store.js";
@@ -24,7 +24,7 @@ import { PanelAgentManager, fetchSupportedModels, fetchSupportedCommands, isEffo
 import { createPanelMcpServer } from "./panel-tools.js";
 import { readUserMcpServers } from "../services/user-mcp-config.js";
 import { isForceRemoteFlagSet, isLoopbackHost } from "../config.js";
-import { buildComfyuiMcpEnv, comfyuiSecretKeys, onComfyuiSecretsChanged, } from "../services/panel-secrets.js";
+import { buildComfyuiMcpEnv, comfyuiSecretKeys, onComfyuiSecretsChanged, hydrateAgentSecretsIntoEnv, onAgentSecretsChanged, setAgentSecret, } from "../services/panel-secrets.js";
 import { CodexBackend } from "./codex-backend.js";
 import { GeminiBackend, GEMINI_DEFAULT_MODEL } from "./gemini-backend.js";
 import { OllamaBackend } from "./ollama-backend.js";
@@ -32,6 +32,7 @@ import { allBackendReadiness } from "./backend-readiness.js";
 import { startPanelMcpHttpServer } from "./panel-mcp-http.js";
 import { readComfyuiCrashLog, formatCrashNote } from "../services/crash-log.js";
 import { QueueMonitor } from "../services/queue-monitor.js";
+import { getAgentSettings, setAgentSettings } from "../services/panel-settings.js";
 import { gatherEnvCapabilities, buildPanelSystemAppend, } from "../services/env-capabilities.js";
 const PANEL_SYSTEM_APPEND = `You are the autonomous assistant embedded directly in a ComfyUI sidebar panel. The person is working in ComfyUI and talks to you through that panel: their messages arrive as your prompts, and everything you write is shown to them in the panel chat. Write for that reader — lead with the result, keep replies short and concrete, and don't narrate routine internal steps.
 
@@ -402,6 +403,17 @@ export async function runPanelOrchestrator() {
     // Subscription lane: the background agent must authenticate against the user's
     // claude.ai login, never an API key. Unset the key for the SDK subprocess.
     delete process.env.ANTHROPIC_API_KEY;
+    // First non-internal IPv4 — display-only, for the LAN-bridge banner when the
+    // bind host is 0.0.0.0/:: (the real reachable address depends on the network).
+    const firstLanIPv4 = () => {
+        for (const addrs of Object.values(networkInterfaces())) {
+            for (const a of addrs ?? []) {
+                if (!a.internal && a.family === "IPv4")
+                    return a.address;
+            }
+        }
+        return undefined;
+    };
     // Secure bridge: when driving a REMOTE https ComfyUI (a pod), the pod's HTTPS
     // panel page can't reach a plain ws:// loopback bridge (mixed-content / Private
     // Network Access), so auto-upgrade to a token-gated wss:// exposed via a
@@ -410,11 +422,42 @@ export async function runPanelOrchestrator() {
     const insecureBridge = process.env.COMFYUI_MCP_INSECURE_BRIDGE === "1" ||
         process.env.COMFYUI_MCP_INSECURE_BRIDGE === "true";
     const wantSecureBridge = !insecureBridge && isRemoteHttpsUrl(process.env.COMFYUI_URL ?? "");
-    const bridgeToken = wantSecureBridge ? randomBytes(24).toString("hex") : null;
-    // Dedicated PANEL bridge port (default 9180). Token-gated only in secure mode.
+    // LAN bridge (panel #54 — the 24/7 server / standalone OpenClaw topology):
+    // COMFYUI_MCP_BRIDGE_HOST binds the bridge on a non-loopback interface so
+    // browsers on OTHER machines can connect. Non-loopback ALWAYS token-gates the
+    // WS upgrade — the token comes from COMFYUI_MCP_BRIDGE_TOKEN (pin it for
+    // stable reconnects across restarts) or is generated fresh and printed below.
+    const bridgeHost = (process.env.COMFYUI_MCP_BRIDGE_HOST ?? "127.0.0.1").trim() || "127.0.0.1";
+    const lanBridge = !isLoopbackBindHost(bridgeHost);
+    const envBridgeToken = process.env.COMFYUI_MCP_BRIDGE_TOKEN?.trim() || null;
+    const bridgeToken = envBridgeToken ?? (wantSecureBridge || lanBridge ? randomBytes(24).toString("hex") : null);
+    // Dedicated PANEL bridge port (default 9180). Token-gated in secure/LAN mode.
     const lockPort = Number(process.env.COMFYUI_MCP_BRIDGE_PORT) || 9180;
     const lockPath = orchLockPath(lockPort);
-    const bridge = startUiBridge(lockPort, bridgeToken);
+    const bridge = startUiBridge(lockPort, bridgeToken, bridgeHost);
+    if (lanBridge) {
+        // Ready-to-paste connection info: the panel's Settings → Advanced →
+        // Bridge URL takes the full URL incl. ?token= verbatim.
+        const displayHost = bridgeHost === "0.0.0.0" || bridgeHost === "::"
+            ? (firstLanIPv4() ?? "<this-machine-ip>")
+            : bridgeHost;
+        process.stderr.write([
+            "",
+            "════════════════════════════════════════════════════════════════════",
+            " ComfyUI MCP — panel bridge exposed on the LAN (token-gated)",
+            "════════════════════════════════════════════════════════════════════",
+            ` Bridge URL : ws://${displayHost}:${lockPort}/?token=${bridgeToken}`,
+            "",
+            " In the panel: Settings → Advanced → Bridge URL → paste the URL above,",
+            " then click Connect. Anyone with this URL can drive the agent — treat",
+            " it like a password.",
+            envBridgeToken
+                ? " Token source: COMFYUI_MCP_BRIDGE_TOKEN (stable across restarts)."
+                : " Token was GENERATED for this run — set COMFYUI_MCP_BRIDGE_TOKEN to keep the same URL across restarts.",
+            "════════════════════════════════════════════════════════════════════",
+            "",
+        ].join("\n") + "\n");
+    }
     // Owning the bridge port is the orchestrator's whole job — if another process
     // holds it, fail loudly instead of running uselessly. (This also avoids the
     // case where a failed bind leaves the process with no live handles and it
@@ -570,19 +613,54 @@ export async function runPanelOrchestrator() {
     // applied PER REQUEST — switching live is free. Default = the LLM Arena's best
     // performer (scripts/llm-arena.mjs): gemma4:e4b, 9/10 with the cleanest runs
     // (first-try tool dispatch, no nudges) and multimodal headroom for vision.
-    const ollamaModel = process.env.COMFYUI_MCP_OLLAMA_MODEL ?? "gemma4:e4b";
+    //
+    // Config precedence: env (escape hatch, always wins) → persisted user settings
+    // (~/.comfyui-mcp/panel-settings.json, edited from the panel Settings dialog
+    // via set_config) → built-in default. Mutable (`let`) because set_config can
+    // retarget them live; API keys stay env-only and never touch the settings file.
+    // Copy any panel-stored provider keys (OPENROUTER_API_KEY) into env BEFORE we
+    // read them below, so a key set on a prior run enables its provider on boot.
+    const hydratedSecrets = hydrateAgentSecretsIntoEnv();
+    if (hydratedSecrets.length) {
+        logger.info(`[panel-orchestrator] hydrated agent secrets from store: ${hydratedSecrets.join(", ")}`);
+    }
+    const persistedAgent = getAgentSettings();
+    let ollamaModel = process.env.COMFYUI_MCP_OLLAMA_MODEL ?? persistedAgent.ollama?.model ?? "gemma4:e4b";
     // The same backend also speaks any OpenAI-compatible endpoint (OpenRouter,
     // DeepSeek, vLLM, LM Studio): COMFYUI_MCP_OLLAMA_API=openai +
     // COMFYUI_MCP_OLLAMA_BASE_URL (incl. /v1) + COMFYUI_MCP_OLLAMA_API_KEY
     // (falls back to OPENROUTER_API_KEY). The chip stays "Ollama (local)".
-    const ollamaApi = process.env.COMFYUI_MCP_OLLAMA_API === "openai" ? "openai" : "ollama";
-    const ollamaBaseUrl = process.env.COMFYUI_MCP_OLLAMA_BASE_URL;
+    let ollamaApi = (process.env.COMFYUI_MCP_OLLAMA_API
+        ? process.env.COMFYUI_MCP_OLLAMA_API === "openai"
+        : persistedAgent.ollama?.api === "openai")
+        ? "openai"
+        : "ollama";
+    let ollamaBaseUrl = process.env.COMFYUI_MCP_OLLAMA_BASE_URL ?? persistedAgent.ollama?.baseUrl;
     const ollamaApiKey = process.env.COMFYUI_MCP_OLLAMA_API_KEY || process.env.OPENROUTER_API_KEY;
     const ollamaDeps = () => ({
         api: ollamaApi,
         ...(ollamaBaseUrl ? { host: ollamaBaseUrl } : {}),
         ...(ollamaApi === "openai" && ollamaApiKey ? { apiKey: ollamaApiKey } : {}),
     });
+    // OpenRouter is a first-class provider = the Ollama backend hard-wired to
+    // OpenRouter's OpenAI-compatible endpoint, so its picker leads with the
+    // curated arena-winning models (RECOMMENDED_OPENROUTER_MODELS, MiMo/MiniMax
+    // tagged 1M · SOTA). Key comes from OPENROUTER_API_KEY (or the shared ollama
+    // key). Default model = the arena's top open-weight, MiMo v2.5.
+    const OPENROUTER_BASE_URL = "https://openrouter.ai/api/v1";
+    let openrouterModel = process.env.COMFYUI_MCP_OPENROUTER_MODEL ?? "xiaomi/mimo-v2.5";
+    // Read the key FRESH each call (not a startup const) so a key the user sets
+    // later via the panel — setAgentSecret hydrates it into env — takes effect on
+    // the next backend build without an orchestrator restart.
+    const openrouterApiKey = () => process.env.OPENROUTER_API_KEY || process.env.COMFYUI_MCP_OLLAMA_API_KEY;
+    const openrouterDeps = () => {
+        const key = openrouterApiKey();
+        return {
+            api: "openai",
+            host: OPENROUTER_BASE_URL,
+            ...(key ? { apiKey: key } : {}),
+        };
+    };
     // ── Per-tab backend (single-port multi-provider) ──────────────────────────
     // ONE orchestrator on ONE bridge port serves ALL providers; the panel picks a
     // provider per tab via the `hello`/`set_backend` handshake, instead of the node
@@ -592,7 +670,7 @@ export async function runPanelOrchestrator() {
     // provider (the panel replays the transcript to seed it) while a same-provider
     // reconnect RESUMES. `backendId`/`codexModel`/`geminiModel` above are the
     // DEFAULT + per-provider model config; the process is no longer pinned to one.
-    const KNOWN_BACKENDS = new Set(["claude", "codex", "gemini", "ollama"]);
+    const KNOWN_BACKENDS = new Set(["claude", "codex", "gemini", "ollama", "openrouter"]);
     const defaultBackend = KNOWN_BACKENDS.has(backendId) ? backendId : "claude";
     const AGENT_KEY_SEP = "::";
     const tabBackends = new Map(); // panel tabId -> selected backend
@@ -739,6 +817,16 @@ export async function runPanelOrchestrator() {
                 ...ollamaDeps(),
             });
         }
+        if (backend === "openrouter") {
+            return new OllamaBackend({
+                cwd: comfyuiPath ?? process.cwd(),
+                model: openrouterModel,
+                systemAppend: panelSystemAppend,
+                comfyuiUrl,
+                mcpServers: makeHttpBackendMcpServers(panelTabId),
+                ...openrouterDeps(),
+            });
+        }
         return undefined; // claude → built-in ClaudeBackend
     };
     logger.info(`[panel-orchestrator] single-port multi-provider: default backend=${defaultBackend}; ` +
@@ -759,7 +847,9 @@ export async function runPanelOrchestrator() {
                     ? new CodexBackend({ cwd: comfyuiPath ?? process.cwd(), model: codexModel })
                     : backend === "ollama"
                         ? new OllamaBackend({ cwd: comfyuiPath ?? process.cwd(), model: ollamaModel, ...ollamaDeps() })
-                        : new GeminiBackend({ cwd: comfyuiPath ?? process.cwd(), model: geminiModel });
+                        : backend === "openrouter"
+                            ? new OllamaBackend({ cwd: comfyuiPath ?? process.cwd(), model: openrouterModel, ...openrouterDeps() })
+                            : new GeminiBackend({ cwd: comfyuiPath ?? process.cwd(), model: geminiModel });
             probeBackends.set(backend, pb);
         }
         return pb;
@@ -914,6 +1004,24 @@ export async function runPanelOrchestrator() {
         manager.restartAllForMcpEnv("🔑 The API token you just provided is now active for the comfyui tools — retry the action that needed it (e.g. the download that returned 401).");
         logger.info(`[panel-orchestrator] tool secret saved → comfyui MCP env updated + agents respawn on idle (keys: ${comfyuiSecretKeys().join(", ") || "none"})`);
     });
+    // An agent-provider secret changed (e.g. the OpenRouter API key set from the
+    // panel). Hydrate it into env, drop the cached openrouter probe/model list so
+    // the next probe uses the new key, and re-push readiness + models to every
+    // live tab so the OpenRouter provider flips to "ready" and lists its models
+    // without a reconnect.
+    const unsubscribeAgentSecrets = onAgentSecretsChanged(() => {
+        hydrateAgentSecretsIntoEnv();
+        modelsByBackend.delete("openrouter");
+        const pb = probeBackends.get("openrouter");
+        if (pb?.close)
+            void pb.close().catch(() => { });
+        probeBackends.delete("openrouter");
+        for (const tabId of tabBackends.keys()) {
+            pushReadiness(tabId);
+            pushModels(tabId);
+        }
+        logger.info("[panel-orchestrator] OpenRouter key saved → provider readiness + models refreshed");
+    });
     // Debounce the connect ack: the panel re-sends `hello` on reconnect and on
     // workflow-title changes, which would otherwise stack duplicate greetings.
     const lastAckAt = new Map();
@@ -950,7 +1058,23 @@ export async function runPanelOrchestrator() {
                 : fetchSupportedModels(model);
             p = probe.then((list) => {
                 if (!list.length)
-                    modelsByBackend.delete(backend); // don't cache a failure
+                    modelsByBackend.delete(backend); // don't cache a failed probe
+                // User-curated preferred models (panel Settings → set_config) pin to the
+                // top of the ollama picker, ahead of the discovered catalog. Read fresh
+                // on every probe; set_config evicts the cache so edits apply live.
+                if (backend === "ollama") {
+                    const preferred = getAgentSettings().preferredModels ?? [];
+                    if (preferred.length) {
+                        const discovered = new Map(list.map((m) => [m.value, m]));
+                        list = [
+                            ...preferred.map((id) => (discovered.get(id) ?? {
+                                value: id,
+                                displayName: `${id} ★`,
+                            })),
+                            ...list.filter((m) => !preferred.includes(m.value)),
+                        ];
+                    }
+                }
                 return list;
             });
             modelsByBackend.set(backend, p);
@@ -967,6 +1091,8 @@ export async function runPanelOrchestrator() {
             return geminiModel;
         if (backend === "ollama")
             return ollamaModel;
+        if (backend === "openrouter")
+            return openrouterModel;
         return model;
     }
     function pushModels(panelTabId) {
@@ -1088,9 +1214,24 @@ export async function runPanelOrchestrator() {
             const isCx = backend === "codex";
             const isGm = backend === "gemini";
             const isOl = backend === "ollama";
+            const isOr = backend === "openrouter";
             // TRUTHFUL "connected": only claim ready after PROVING the SELECTED backend
             // can run, by probing its model list. If the probe fails — the "connected
             // but dead" wedge — send a degraded ack so the panel shows the real state.
+            // OpenRouter needs an explicit key check FIRST: its /models endpoint is
+            // PUBLIC, so the probe "succeeds" keyless and the tab would greet ready —
+            // then 401 on the first real message. Degrade up front instead.
+            if (isOr && !openrouterApiKey()) {
+                bridge.push({
+                    type: "say",
+                    text: "⚠️ OpenRouter has no API key — the connection would fail on your first message. " +
+                        "Set it in Settings → OpenRouter → “Set API key…” (masked, stored by the orchestrator — takes effect immediately, no reconnect needed), " +
+                        "or set the OPENROUTER_API_KEY environment variable and restart the orchestrator. Keys: https://openrouter.ai/keys",
+                }, panelTab);
+                bridge.push({ type: "ack", ok: false, kind: "degraded" }, panelTab);
+                logger.warn(`[panel-orchestrator] tab ${panelTab.slice(0, 8)} connected (openrouter) but no API key — degraded ack`);
+                return;
+            }
             void ensureModels(backend)
                 .then((models) => {
                 if (models.length) {
@@ -1100,7 +1241,9 @@ export async function runPanelOrchestrator() {
                             ? (geminiModel ?? models[0].value ?? "Gemini")
                             : isOl
                                 ? (ollamaModel ?? models[0].value ?? "Ollama")
-                                : model;
+                                : isOr
+                                    ? (openrouterModel ?? models[0].value ?? "OpenRouter")
+                                    : model;
                     // Greet only on a FRESH session (a resume/reconnect already has the thread).
                     if (!resume) {
                         const readyText = isCx
@@ -1109,7 +1252,9 @@ export async function runPanelOrchestrator() {
                                 ? `🟢 comfyui-mcp agent ready — ${agentLabel} on your Google account (Gemini Code Assist). Ask away.`
                                 : isOl
                                     ? `🟢 comfyui-mcp agent ready — ${agentLabel} running locally via Ollama (no account, no API key). Small local models are slower and simpler than frontier ones — expect fewer frills. Ask away.`
-                                    : `🟢 comfyui-mcp agent ready — ${agentLabel} on your Claude subscription. Ask away.`;
+                                    : isOr
+                                        ? `🟢 comfyui-mcp agent ready — ${agentLabel} via OpenRouter (hosted API, your OPENROUTER_API_KEY). Ask away.`
+                                        : `🟢 comfyui-mcp agent ready — ${agentLabel} on your Claude subscription. Ask away.`;
                         bridge.push({ type: "say", text: readyText }, panelTab);
                     }
                     bridge.push({ type: "ack", ok: true, kind: "ready", agent: agentLabel, backend }, panelTab);
@@ -1157,17 +1302,89 @@ export async function runPanelOrchestrator() {
             logger.info(`[panel-orchestrator] tab ${panelTab.slice(0, 8)} switched backend ${prev} → ${reqBackend}`);
             return;
         }
-        // Live panel config (currently just the render-stall threshold). Applied
-        // immediately, no reconnect — the next turn's watchdog check uses the new
-        // value. Sent by the panel on connect and whenever the setting changes.
+        // Live panel config: render-stall threshold, plus the user's agent-model
+        // preferences (preferred_models list + ollama endpoint config), persisted to
+        // ~/.comfyui-mcp/panel-settings.json. Sent by the panel on connect and
+        // whenever a setting changes. Model-list changes apply live (cache evicted,
+        // fresh `models` frame pushed); an endpoint change retargets NEW sessions —
+        // live ollama sessions keep their connection until restarted.
         if (event.type === "set_config" && event.tab_id) {
             if ("stall_seconds" in event) {
                 setLiveStallSeconds(event.stall_seconds);
                 logger.info(`[panel-orchestrator] live stall threshold → ${liveStallSeconds ?? "default"}s`);
             }
+            const cfg = event;
+            let ollamaChanged = false;
+            if (Array.isArray(cfg.preferred_models)) {
+                const ids = cfg.preferred_models.filter((m) => typeof m === "string");
+                setAgentSettings({ preferredModels: ids });
+                ollamaChanged = true;
+                logger.info(`[panel-orchestrator] preferred models → [${ids.join(", ")}]`);
+            }
+            if (cfg.ollama && typeof cfg.ollama === "object") {
+                const o = cfg.ollama;
+                const patch = {};
+                if (typeof o.model === "string" && o.model.trim()) {
+                    patch.model = o.model.trim();
+                    if (!process.env.COMFYUI_MCP_OLLAMA_MODEL)
+                        ollamaModel = patch.model;
+                }
+                if (o.api === "openai" || o.api === "ollama") {
+                    patch.api = o.api;
+                    if (!process.env.COMFYUI_MCP_OLLAMA_API)
+                        ollamaApi = o.api;
+                }
+                if (typeof o.base_url === "string") {
+                    patch.baseUrl = o.base_url.trim();
+                    if (!process.env.COMFYUI_MCP_OLLAMA_BASE_URL)
+                        ollamaBaseUrl = patch.baseUrl || undefined;
+                }
+                if (Object.keys(patch).length) {
+                    setAgentSettings({ ollama: patch });
+                    ollamaChanged = true;
+                    // Endpoint may have moved — drop the cached probe backend so the next
+                    // readiness/model probe hits the NEW host/api with fresh deps.
+                    const pb = probeBackends.get("ollama");
+                    if (pb?.close)
+                        void pb.close().catch(() => { });
+                    probeBackends.delete("ollama");
+                    logger.info(`[panel-orchestrator] ollama config → model=${ollamaModel} api=${ollamaApi} host=${ollamaBaseUrl ?? "(default)"}`);
+                }
+            }
+            if (ollamaChanged) {
+                modelsByBackend.delete("ollama");
+                pushModels(event.tab_id);
+            }
             bridge.push({ type: "ack", ok: true, kind: "config" }, event.tab_id);
             return;
         }
+        // Panel-initiated provider secret (Settings › "Set API key…") — NO agent, no
+        // chat: the panel paints its own masked input and ships the value here
+        // directly, over the same loopback/token-gated bridge the agent-initiated
+        // request_secret reply already rides. setAgentSecret enforces the allowlist
+        // (OPENROUTER_API_KEY), persists 0600, and hydrates process.env immediately,
+        // so the refreshed readiness frame flips the provider picker live — a user
+        // can enable OpenRouter before ANY backend is ready (no chicken-and-egg).
+        if (event.type === "set_secret" && event.tab_id) {
+            const rawKey = event.key;
+            const rawValue = event.value;
+            const key = typeof rawKey === "string" ? rawKey : "";
+            const value = typeof rawValue === "string" ? rawValue : "";
+            let error;
+            try {
+                if (!value.trim())
+                    throw new Error("No token entered — nothing was saved.");
+                setAgentSecret(key, value.trim());
+                logger.info(`[panel-orchestrator] provider secret set from panel Settings: ${key} (redacted)`);
+            }
+            catch (err) {
+                error = err instanceof Error ? err.message : String(err);
+            }
+            bridge.push({ type: "secret_saved", key, ok: !error, ...(error ? { error } : {}) }, event.tab_id);
+            if (!error)
+                pushReadiness(event.tab_id);
+            return;
+        }
         // Model / effort picker: apply and confirm. Model switches live; an effort
         // change restarts the session (resumed) so the conversation carries over.
         if (event.type === "set_options" && event.tab_id) {
@@ -1447,6 +1664,7 @@ export async function runPanelOrchestrator() {
         clearInterval(downloadTimer);
         QueueMonitor.stop();
         unsubscribeSecrets();
+        unsubscribeAgentSecrets();
         await manager.stopAll();
         // Dispose the readiness-probe backends (kills each Codex/Gemini CLI child).
         for (const pb of probeBackends.values()) {