comfyui-mcp 0.46.0 → 0.48.0

package/dist/orchestrator/index.js

@@ -595,10 +595,21 @@ const CALL_TOOL_WHITELIST = new Set([
     // Read-only.
     "diagnose_run",
     // Read-only training surface: flow/model discovery + progress polling +
-    // docker/GPU/image preflight for the panel/mobile Training tab.
+    // docker/GPU/image preflight for the panel/mobile Training tab, and the
+    // dataset/job-config/file readers behind its Jobs/Datasets views.
     "train_list_flows",
     "train_status",
     "train_doctor",
+    "train_list_datasets",
+    "train_dataset_detail",
+    "train_job_config",
+    "train_file",
+    "train_preview_config",
+    "train_dataset_update",
+    "train_dataset_delete",
+    "train_caption_image",
+    "train_caption_dataset",
+    "train_delete_job",
     // User-initiated training ops (panel/mobile Training wizard): stage a dataset,
     // launch a GPU-container training run, cancel one. All validation lives in the
     // tools themselves (dataset checks, docker/image preflight, liveness-verified
@@ -638,6 +649,18 @@ const CALL_TOOL_WHITELIST = new Set([
     // download_model (already whitelisted): writes a local app bundle, no
     // model/system mutation. Deps install stays a separate consented action.
     "apps_import",
+    // App dependency side-panel (Explore/detail): the ✓/download panel reads what
+    // an app needs vs what's installed and offers per-item fetches. Reads are safe
+    // (missing-model detection + candidate resolution, node-pack presence); model
+    // downloads reuse the already-whitelisted download_civitai_model/download_model.
+    // install_custom_node is a MUTATION that runs the pack's code on install —
+    // reachable for the panel's "install missing node" button, gated behind an
+    // explicit themed confirm client-side. (Revisit if a canvas-less/foreign tab
+    // must not be able to trigger a node install.)
+    "resolve_missing_models",
+    "extract_workflow_dependencies",
+    "list_installed_nodes",
+    "install_custom_node",
 ]);
 /** Lazily build ONE in-process MCP client wired to the full comfyui tool surface,
  *  reused across call_tool requests. Reuses the exact tool implementations (same
@@ -946,7 +969,7 @@ export async function runPanelOrchestrator() {
     const forceRemoteEnv = () => isForceRemoteFlagSet() || !isLoopbackUrl(comfyuiUrl)
         ? { COMFYUI_MCP_FORCE_REMOTE: "1" }
         : {};
-    const model = process.env.COMFYUI_MCP_PANEL_MODEL ?? "claude-opus-4-8";
+    const model = process.env.COMFYUI_MCP_PANEL_MODEL ?? "claude-opus-5";
     const envEffort = process.env.COMFYUI_MCP_PANEL_EFFORT;
     const effort = isEffort(envEffort) ? envEffort : undefined;
     // Single-port multi-provider: ONE orchestrator on ONE bridge port (default
@@ -1037,7 +1060,7 @@ export async function runPanelOrchestrator() {
     // declared to the app-server alongside the headless comfyui (stdio) MCP. Claude
     // keeps its in-process SDK panel server unchanged.
     const backendId = (process.env.PANEL_AGENT_BACKEND ?? "claude").toLowerCase();
-    // The panel's `model` is a Claude id (e.g. claude-opus-4-8) and is NOT a valid
+    // The panel's `model` is a Claude id (e.g. claude-opus-5) and is NOT a valid
     // Codex model — so for codex we only pass a model when COMFYUI_MCP_CODEX_MODEL
     // is set explicitly; otherwise Codex uses the account's default (e.g. gpt-5.5).
     const codexModel = process.env.COMFYUI_MCP_CODEX_MODEL;
@@ -2077,8 +2100,23 @@ export async function runPanelOrchestrator() {
         if (event.type === "hello" && event.tab_id) {
             const panelTab = event.tab_id;
             // Retarget ComfyUI to the URL the browser was served from (window.location),
-            // BEFORE the readiness probe so the "ready" ack reflects the right instance.
-            applyComfyuiUrl(event.comfyui_url);
+            // BEFORE the readiness probe so the "ready" ack reflects the right instance —
+            // but a hello can arrive from a STALE browser tab on a DEAD instance (E2E
+            // finding: a zombie :8189 tab kept retargeting the orchestrator to a corpse
+            // and silently breaking every tool that probes the target). Probe
+            // loopback/LAN hellos first; RunPod proxies skip the probe (booting pods
+            // answer late — readiness is the connector's job).
+            const helloUrl = event.comfyui_url;
+            void (async () => {
+                if (typeof helloUrl === "string" && !/\.proxy\.runpod\.net/i.test(helloUrl)) {
+                    const base = helloUrl.trim().replace(/\/+$/, "");
+                    if (base && !(await probeOk(`${base}/system_stats`, 3_000))) {
+                        logger.warn(`[panel-orchestrator] ignoring hello retarget to unreachable ${base} (stale tab on a dead instance?) — keeping ${comfyuiUrl}`);
+                        return;
+                    }
+                }
+                applyComfyuiUrl(helloUrl);
+            })();
             // Re-advertise the secure bridge on EVERY hello, not just when the URL
             // changes: advertiseBridge's own retries are short (~3s) and can race a
             // pod-side ComfyUI restart, permanently leaving the pod's stored bridge
@@ -3525,6 +3563,16 @@ export async function runPanelOrchestrator() {
         },
         idleStopMinutes: runpodIdleStopMinutes,
     });
+    // Boot re-watch (#269 r2): a restart rebuilds the watcher EMPTY — a pod that
+    // stayed the ACTIVE target across the restart (its proxy URL is still the
+    // configured target) would otherwise get no more heartbeats and self-stop
+    // ~20min later even though renders keep flowing. Re-watch it immediately:
+    // beats + live status resume, and its dead-man watchdog stays fed.
+    const bootPodMatch = getComfyUIBaseUrl().match(/^https:\/\/([a-z0-9]+)-\d+\.proxy\.runpod\.net/i);
+    if (bootPodMatch) {
+        logger.info(`[panel-orchestrator] re-watching active RunPod target ${bootPodMatch[1]} after restart`);
+        getRunpodWatcher()?.watch(bootPodMatch[1]);
+    }
     // Money guard (codex #263): the idle predicate above trusts persisted
     // training records blindly (hasActiveTrainingJob is a probe-free file scan),
     // and owner-death reconciliation otherwise only runs via getJob/listJobs —