comfyui-mcp 0.48.19 → 0.48.20

package/dist/orchestrator/panel-tools.js

@@ -37,6 +37,8 @@ import { getNsfwConsent, setNsfwConsent } from "../services/panel-settings.js";
 import { QueueMonitor } from "../services/queue-monitor.js";
 import { getObjectInfo, backfillObjectInfo, resetClient, resetObjectInfoCache, } from "../comfyui/client.js";
 import { convertUiToApi, collectNodeTypes } from "../services/workflow-converter.js";
+import { restartComfyUI } from "../services/process-control.js";
+import { isRemoteMode } from "../config.js";
 import { sliceWorkflow } from "../services/workflow-slicer.js";
 import { validateA2UISpecServer } from "../services/a2ui-spec.js";
 /** Treat these as an affirmative answer to the adult-content consent card. */
@@ -103,6 +105,30 @@ export function rebootDropped(res) {
     // unrelated tab reconnection makes readiness pass. Those return verbatim.
     return /disconnected mid-command|OUTCOME UNKNOWN|ECONNRESET|socket hang up|premature close|other side closed|ECONNABORTED|EPIPE/i.test(text);
 }
+/**
+ * True when a comfy_reboot ToolResult is a NON-error, NON-fired refusal whose
+ * cause is that the panel could reach NO ComfyUI-Manager reboot endpoint — i.e.
+ * every Manager reboot route answered 404/405 (the classic legacy Manager 3.x
+ * symptom: `POST /v2/manager/reboot → 405; GET /manager/reboot → 404`,
+ * panel #253/#266 and this repo #425). This is distinct from:
+ *   - a busy-guard refusal (a generation is running) — its text speaks to the
+ *     queue/generation, never to a "reboot endpoint", so it does NOT match; and
+ *   - a Manager-security 403 refusal — that speaks to "security"/"forbidden".
+ * Only a no-endpoint refusal is safe to retry through the headless managed
+ * restart (kill + relaunch), and only for a LOCAL, process-controllable target.
+ */
+export function rebootNoEndpoint(res) {
+    if (res?.isError)
+        return false;
+    const text = res?.content?.find((c) => c.type === "text")?.text ?? "";
+    // A busy-guard / security refusal must never be treated as "no endpoint" — a
+    // kill+relaunch fallback would abort a running render or defeat the security
+    // gate. Require the reboot-endpoint signature AND the absence of those.
+    if (/busy|in progress|generation|queue is|running|security|forbidden|403/i.test(text)) {
+        return false;
+    }
+    return /reboot endpoint|reboot route|was NOT restarted|no reachable .*reboot/i.test(text);
+}
 let panelRebootTimingOverride = null;
 function parsePositiveNumberEnv(name, fallback) {
     const raw = process.env[name];
@@ -130,10 +156,71 @@ export const __panelToolsTestHooks = {
     setPanelRebootTiming(timing) {
         panelRebootTimingOverride = timing;
     },
+    /** Zero out the post-drop retry settle so retry-once tests don't sleep. */
+    setRetrySettleMs(ms) {
+        retrySettleMsOverride = ms;
+    },
+    isRetrySafeCmd,
+    isTransientReconnectError,
 };
 function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }
+// ── Post-reconnect retry-once for idempotent panel commands ──────────────────
+// A tool-triggered ComfyUI reboot (#278/#481), a panel_free_vram (#310), or a
+// Manager-backed call racing a post-restart reconnect (#332) can drop the panel
+// tab's transport the instant AFTER a command was dispatched — or replace the
+// tab under a BRAND-NEW socket/tab id with no migration alias, orphaning this
+// session. The bridge's own mid-command resume only helps when the SAME tab id
+// re-hellos; when the id changed, the in-flight command surfaces a bare
+// "no connected tab" / "disconnected mid-command … genuinely gone" / "Failed to
+// fetch" and the agent is told to hand-call panel_set_workflow_target(current).
+//
+// For commands that are SAFE to re-issue (idempotent reads, plus idempotent
+// UI-state writes like set_todo that fully REPLACE state), we transparently
+// rebind onto the now-live tab (ensureReachable) and retry ONCE after a short
+// settle. Mutating graph edits (add_node/connect/set_widget/…) are deliberately
+// EXCLUDED — re-issuing them could double-apply — so they keep surfacing the
+// bridge's honest OUTCOME-UNKNOWN error.
+const RETRY_SAFE_CMDS = new Set([
+    // Idempotent reads (mirror UiBridge.READONLY_CMDS + list/status probes).
+    "graph_serialize",
+    "graph_outline",
+    "graph_get_errors",
+    "graph_get_subgraph",
+    "graph_prompt_director_audit",
+    "graph_query",
+    "get_todo",
+    "workflow_list",
+    "nodes_list",
+    "nodes_queue_status",
+    "node_queue_status",
+    // Idempotent full-replace UI state — re-sending the same list is a no-op (#481).
+    "set_todo",
+]);
+/** A command whose result is unchanged by being re-issued after a reconnect —
+ *  so it is safe to transparently retry once when the transport dropped. */
+function isRetrySafeCmd(cmd) {
+    const name = typeof cmd.cmd === "string" ? cmd.cmd : "";
+    return RETRY_SAFE_CMDS.has(name);
+}
+/** True when an error is a TRANSIENT transport/reconnect drop (the tab went away
+ *  or was replaced), NOT a genuine command error or a live-but-frozen reply
+ *  timeout. Deliberately EXCLUDES "did not reply within N ms" (a backgrounded/
+ *  frozen tab — retrying just double-waits, #334) and "OUTCOME UNKNOWN" (a
+ *  mutating command that may already have applied). */
+function isTransientReconnectError(err) {
+    const msg = err instanceof Error ? err.message : String(err ?? "");
+    return /no connected tab|genuinely gone|is not open|Failed to fetch|Panel not reachable|ECONNRESET|socket hang up|premature close|other side closed|ECONNABORTED|EPIPE/i.test(msg);
+}
+let retrySettleMsOverride = null;
+/** Short pause before the single post-drop retry, letting the replacement tab
+ *  finish its reconnect hello so ensureReachable can resolve it. Test-overridable. */
+function retrySettleMs() {
+    if (retrySettleMsOverride != null)
+        return retrySettleMsOverride;
+    return Math.round(parsePositiveNumberEnv("COMFYUI_PANEL_RETRY_SETTLE_S", 0.4) * 1000);
+}
 /**
  * Poll the panel bridge until ComfyUI is reachable again after a reboot. Each probe
  * is a lightweight `nodes_queue_status` round-trip (via ctx.call, which never
@@ -309,6 +396,44 @@ async function openWorkflowWithVerify(path, ctx) {
     // is a REAL failure. Return the original bridge timeout error unchanged.
     return res;
 }
+/**
+ * Resolve a caller-supplied pin `path` (path / filename / key, any form) to the
+ * AUTHORITATIVE open-workflow record from a fresh `workflow_list` — the single
+ * source of truth for which tabs exist and their canonical `key` (#259). Returns:
+ *  - the matched record when the workflow IS open (so the pin can be canonicalized
+ *    to its stable key and bound to the exact frontend tab identity);
+ *  - `null` when workflow_list is unreachable/empty or carries no `workflows`
+ *    array (indeterminate — caller should fall back to the raw path, NOT fail);
+ *  - the sentinel `NOT_OPEN` when the list IS known but the target is absent, so
+ *    the caller can FAIL CLOSED instead of letting the panel silently route the
+ *    pin to some other open tab.
+ */
+const NOT_OPEN = Symbol("workflow-not-open");
+async function resolveOpenWorkflow(ctx, path) {
+    let parsed = null;
+    try {
+        parsed = parseToolResultJson(await ctx.call({ cmd: "workflow_list" }, 6000));
+    }
+    catch {
+        return null; // transport error — indeterminate, don't fail the pin
+    }
+    if (!parsed)
+        return null;
+    const rawList = parsed.workflows;
+    if (!Array.isArray(rawList) || rawList.length === 0) {
+        // No enumerable tab list (older panel / stub) — can't verify, don't fail closed.
+        return null;
+    }
+    for (const wf of rawList) {
+        if (activeMatchesTarget(wf, path))
+            return wf;
+    }
+    // The active object is authoritative too, in case it isn't mirrored in the array.
+    if (activeMatchesTarget(parsed.active, path)) {
+        return parsed.active;
+    }
+    return NOT_OPEN;
+}
 export const __openWorkflowTestHooks = {
     /** Inject fast open-verify timing so tests don't wait the real ~6s budget. */
     setOpenVerifyTiming(timing) {
@@ -316,6 +441,7 @@ export const __openWorkflowTestHooks = {
     },
     isAckTimeout,
     activeMatchesTarget,
+    resolveOpenWorkflow,
 };
 const slotRef = z.union([z.string(), z.number().int().min(0)]);
 // CivitAI browsing-level bitmask values: PG=1, PG-13=2, R=4, X=8, XXX=16.
@@ -517,11 +643,14 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets) {
     // CONSERVATIVE by construction (must not weaken multi-tab routing):
     //  - fires ONLY when the current tab is genuinely unreachable (canReach false);
     //    a healthy session — including a healthy MULTI-tab one — is never touched;
-    //  - uses the SAME resolveActiveTabId the explicit rebind uses, which THROWS on
-    //    ambiguity (2+ live tabs, no last-active) and when nothing is connected, so
-    //    an orphaned session is never silently hijacked onto an arbitrary tab —
-    //    the throw is swallowed and the command falls through to the bridge's clear
-    //    `no connected tab` / `Multiple panel tabs` error;
+    //  - STRICT-SINGLE: only silently rebinds when there is EXACTLY ONE connected
+    //    tab. With 2+ live tabs the bridge's no-tabId resolution would fall back to
+    //    `lastActiveTabId` — which can be an UNRELATED workflow (codex) — so the
+    //    silent path refuses to guess and instead lets the command surface the
+    //    bridge's clear `no connected tab` error. The user then re-binds with the
+    //    EXPLICIT panel_set_workflow_target({mode:"current"}) signal, which DOES
+    //    accept the last-active tab because it is a deliberate "use what's live now"
+    //    consent — silent auto-heal must be stricter than an explicit rebind;
     //  - PINNED sessions are left strict: a session pinned to a specific workflow
     //    keeps requiring the explicit rebind consent signal. Only "current"-mode
     //    (follow-the-active-tab) sessions self-heal, which is faithful to what that
@@ -535,6 +664,14 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets) {
             return;
         if (workflowTargets?.get(ctx.tabId)?.mode === "pinned")
             return; // stay strict
+        // Strict-single: never silently pick among multiple live tabs (would risk the
+        // real bridge's last-active fallback routing to an unrelated workflow). When
+        // the bridge can enumerate its tabs and there is more than one, do NOT rebind.
+        if (typeof bridge.tabs === "function") {
+            const live = bridge.tabs();
+            if (Array.isArray(live) && live.length > 1)
+                return;
+        }
         try {
             rebindToActiveTab();
         }
@@ -543,14 +680,40 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets) {
             // command surface the bridge's own clear, tab-listing error.
         }
     };
+    const sendRouted = async (cmd, timeoutMs) => {
+        const target = workflowTargets?.get(ctx.tabId);
+        const routed = target ? withWorkflowTarget(cmd, target) : cmd;
+        return bridge.send(routed, { tabId: ctx.tabId, timeoutMs });
+    };
     const call = async (cmd, timeoutMs) => {
         try {
             ensureReachable();
-            const target = workflowTargets?.get(ctx.tabId);
-            const routed = target ? withWorkflowTarget(cmd, target) : cmd;
-            return ok(await bridge.send(routed, { tabId: ctx.tabId, timeoutMs }));
+            return ok(await sendRouted(cmd, timeoutMs));
         }
         catch (err) {
+            // Post-reconnect retry-once: a reboot/free_vram/reconnect can drop the tab's
+            // transport (or replace it under a new tab id) the instant after we dispatch.
+            // For idempotent commands, settle briefly, rebind onto the now-live tab, and
+            // retry ONE time before surfacing an error (#278/#310/#332/#481). Mutating
+            // edits are excluded from RETRY_SAFE_CMDS, so they never double-apply.
+            if (isRetrySafeCmd(cmd) && isTransientReconnectError(err)) {
+                try {
+                    await sleep(retrySettleMs());
+                    ensureReachable(); // rebinds a current-mode session onto the reconnected tab
+                    return ok(await sendRouted(cmd, timeoutMs));
+                }
+                catch (err2) {
+                    // The retry also failed — surface an actionable reconnecting status rather
+                    // than a bare transport error (#332), while still failing honestly.
+                    if (isTransientReconnectError(err2)) {
+                        const name = typeof cmd.cmd === "string" ? cmd.cmd : "panel command";
+                        return fail(`${name} could not reach the ComfyUI panel — it is still reconnecting after a ` +
+                            `restart/reload. Wait a moment and retry; if it persists, rebind with ` +
+                            `panel_set_workflow_target({mode:"current"}). (${err2 instanceof Error ? err2.message : String(err2)})`);
+                    }
+                    return fail(err2);
+                }
+            }
             return fail(err);
         }
     };
@@ -624,7 +787,15 @@ async function resolveWorkflowInput(args, ctx) {
     let reply;
     try {
         ctx.ensureReachable?.();
-        reply = await ctx.bridge.send({ cmd: "graph_serialize" }, {
+        // Route to the SAME authoritative target as ctx.call: when the session is
+        // pinned, inject the pinned workflow_path so the live-canvas capture serializes
+        // the PINNED workflow, not whatever tab is visible (codex — this direct send
+        // otherwise bypasses withWorkflowTarget and reads the wrong graph).
+        const target = ctx.workflowTarget?.get(ctx.tabId);
+        const cmd = target
+            ? withWorkflowTarget({ cmd: "graph_serialize" }, target)
+            : { cmd: "graph_serialize" };
+        reply = await ctx.bridge.send(cmd, {
             tabId: ctx.tabId,
             timeoutMs: 30000,
         });
@@ -1075,6 +1246,17 @@ export function buildPanelToolDefs() {
             // session is left untouched; an ambiguous multi-tab case surfaces a clear
             // error rather than guessing.
             if (ctx.rebindToActiveTab) {
+                // Strict-single: if this session's tab is orphaned AND 2+ tabs are live,
+                // do NOT guess (the bridge would fall back to last-active, possibly an
+                // unrelated tab) — surface a clear error so the user picks, honoring the
+                // documented "ambiguous multi-tab surfaces a clear error" promise (codex).
+                const orphaned = typeof ctx.bridge.canReach === "function" && !ctx.bridge.canReach(ctx.tabId);
+                const live = typeof ctx.bridge.tabs === "function" ? ctx.bridge.tabs() : undefined;
+                if (orphaned && Array.isArray(live) && live.length > 1) {
+                    return fail("This session's ComfyUI tab was replaced and multiple tabs are now open — " +
+                        "can't safely pick one. Switch to the tab you want, then call " +
+                        'panel_set_workflow_target({mode:"current"}) before panel_reload.');
+                }
                 try {
                     ctx.rebindToActiveTab();
                 }
@@ -1492,7 +1674,32 @@ export function buildPanelToolDefs() {
                     return fail(err);
                 }
             }
-            const target = ctx.workflowTarget.set(ctx.tabId, { mode, path, filename });
+            // PIN: bind to the EXACT open-workflow identity from the authoritative
+            // workflow_list, canonicalizing to its stable `key` and FAILING CLOSED when
+            // the requested workflow isn't actually open — instead of letting the panel
+            // silently route the pin to another tab (#259). Indeterminate lists (older
+            // panel / no `workflows` array) fall back to the raw path (unchanged).
+            let pinPath = path;
+            let pinFilename = filename;
+            if (mode === "pinned" && path) {
+                const resolved = await resolveOpenWorkflow(ctx, path);
+                if (resolved === NOT_OPEN) {
+                    return fail(`Cannot pin to "${path}" — it is not open in ComfyUI. Open it first ` +
+                        `(panel_open_workflow) or pick an open workflow from panel_list_workflows, ` +
+                        `then pin. (Refusing to pin to a workflow that isn't open so graph edits ` +
+                        `never land on the wrong tab.)`);
+                }
+                if (resolved) {
+                    // Canonicalize to the stable key so routing survives rename/reconnect.
+                    pinPath = resolved.key ?? resolved.path ?? path;
+                    pinFilename = filename ?? resolved.filename ?? resolved.path;
+                }
+            }
+            const target = ctx.workflowTarget.set(ctx.tabId, {
+                mode,
+                path: pinPath,
+                filename: pinFilename,
+            });
             ctx.bridge.push({ type: "workflow_target", target }, ctx.tabId);
             const hint = target.mode === "pinned"
                 ? `Pinned to "${target.filename ?? target.path}". Graph tools will target that workflow without switching the user's view.`
@@ -1619,7 +1826,15 @@ export function buildPanelToolDefs() {
         })),
         def("panel_screenshot", "Render the workflow the user is currently viewing (root graph, or the open subgraph) to a PNG and return it as an IMAGE so you can SEE the layout. It frames the whole graph (nodes + groups), captures, then restores the user's view. Use this to visually verify a layout you just built — overlaps, alignment, rails, colors, group bands — instead of reasoning from coordinates alone.", { padding: z.number().optional().describe("Margin around the graph in px (default 60).") }, async (args, ctx) => {
             try {
-                const res = (await ctx.bridge.send({ cmd: "graph_screenshot", padding: args.padding }, { tabId: ctx.tabId }));
+                ctx.ensureReachable?.();
+                // Route to the same authoritative target as ctx.call: a pinned session
+                // screenshots the PINNED workflow (via injected workflow_path), not just
+                // whatever tab is visible (codex — graph_* must carry the pin).
+                const target = ctx.workflowTarget?.get(ctx.tabId);
+                const cmd = withWorkflowTarget({ cmd: "graph_screenshot", padding: args.padding }, target ?? { mode: "current" });
+                const res = (await ctx.bridge.send(cmd, {
+                    tabId: ctx.tabId,
+                }));
                 if (!res?.image)
                     return fail("screenshot returned no image");
                 return { content: [{ type: "image", data: res.image, mimeType: res.mimeType ?? "image/png" }] };
@@ -1696,6 +1911,50 @@ export function buildPanelToolDefs() {
             const fired = rebootConfirmed(res);
             const dropped = !fired && rebootDropped(res);
             if (!fired && !dropped) {
+                // The panel could not fire a Manager reboot. If the SOLE reason is that
+                // NO Manager reboot endpoint answered (legacy Manager 3.x: v2 route 405s,
+                // legacy route 404s — #425, panel #253/#266) AND the target is a LOCAL,
+                // process-controllable ComfyUI, fall back to the headless managed restart
+                // (kill + relaunch) — the same mechanism as the `restart_comfyui` tool.
+                // A busy-guard or security refusal is deliberately NOT eligible
+                // (rebootNoEndpoint excludes those), so this never aborts a running
+                // render or bypasses Manager's security gate.
+                if (!isRemoteMode() && rebootNoEndpoint(res)) {
+                    let restart;
+                    try {
+                        restart = await restartComfyUI();
+                    }
+                    catch (err) {
+                        return fail("The built-in Manager exposed no reboot endpoint (legacy Manager 3.x), " +
+                            "and the headless managed restart also failed: " +
+                            (err instanceof Error ? err.message : String(err)) +
+                            " — restart ComfyUI on the host, then reconnect.");
+                    }
+                    if (!restart.started) {
+                        return fail("The built-in Manager exposed no reboot endpoint (legacy Manager 3.x). " +
+                            "Tried the headless managed restart (kill + relaunch) as a fallback, but it " +
+                            `could not restart ComfyUI: ${restart.message} ` +
+                            "Restart ComfyUI on the host, then reconnect.");
+                    }
+                    // A managed kill+relaunch restarts ComfyUI out-of-band from the WS
+                    // client, so drop the memoized caches exactly as the Manager-reboot
+                    // path does before waiting for the panel to reconnect.
+                    resetClient();
+                    resetObjectInfoCache();
+                    const timing = getPanelRebootTiming();
+                    const recovery = await waitForPanelReady(ctx, timing);
+                    return ok({
+                        rebooting: true,
+                        ready: recovery.ready,
+                        recovered_ms: recovery.waited_ms,
+                        probes: recovery.attempts,
+                        via: "headless-managed-restart",
+                        note: "ComfyUI-Manager (legacy 3.x) had no reboot endpoint; restarted ComfyUI " +
+                            `via the headless managed restart (kill + relaunch)${recovery.ready
+                                ? ` and it came back ready in ${(recovery.waited_ms / 1000).toFixed(1)}s.`
+                                : " but the panel did not reconnect within the readiness budget — verify with panel_node_queue_status."}`,
+                    });
+                }
                 // Genuine refusal (or an unrelated error) — do NOT poll or reset caches.
                 // Resetting on a refusal would close the shared client mid-generation
                 // (codex WS-3 finding #2).