comfyui-mcp 0.48.21 → 0.48.23

package/dist/orchestrator/index.js

@@ -16,7 +16,7 @@ import { fileURLToPath } from "node:url";
 import { randomBytes } from "node:crypto";
 import readline from "node:readline";
 import { startUiBridge, isLoopbackBindHost } from "../services/ui-bridge.js";
-import { setupSecureBridge } from "../services/secure-bridge.js";
+import { setupSecureBridge, resolveComfyuiPathForTarget } from "../services/secure-bridge.js";
 import { startQuickTunnel } from "../services/tunnel.js";
 import { detectInstallMode } from "../services/self-update.js";
 import { SelfRestarter } from "../services/self-restart.js";
@@ -26,7 +26,7 @@ import { uploadImageHttp, resetClient } from "../comfyui/client.js";
 import { logger } from "../utils/logger.js";
 import { PanelAgentManager, fetchSupportedModels, fetchSupportedCommands, isEffort, } from "./panel-agent.js";
 import { promptText } from "./error-text.js";
-import { createPanelMcpServer } from "./panel-tools.js";
+import { createPanelMcpServer, makePanelToolCtx, resolvePinTarget } from "./panel-tools.js";
 import { optionsAckFrame, optionsErrorAckFrame, optionsRequestMeta, } from "./options-ack.js";
 import { readUserMcpServers } from "../services/user-mcp-config.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -50,6 +50,7 @@ import { resolvePrompt, registerPrompt, onPromptsChanged } from "../services/pro
 import { allBackendReadiness } from "./backend-readiness.js";
 import { handleOAuthBegin, handleOAuthStatus, handleOAuthSignout } from "./oauth-bridge.js";
 import { buildStartFailureNotice } from "./start-failure-notice.js";
+import { readyBannerText, bannerCorrection } from "./ready-banner.js";
 import { OAUTH_PROVIDERS } from "../services/oauth-flow.js";
 import { startPanelMcpHttpServer } from "./panel-mcp-http.js";
 import { startPanelConsoleHttpServer } from "./panel-console-http.js";
@@ -64,7 +65,7 @@ import { unloadAllOllama, warmOllama, resolveOllamaHost } from "../services/olla
 import { isLocalLmstudio, startLmstudioServer, unloadAllLmstudio, warmLmstudio, } from "../services/lmstudio-lifecycle.js";
 import { llamacppProps, llamacppToolsReady } from "../services/llamacpp-probe.js";
 import { getAgentSettings, setAgentSettings, normalizePreferredModels } from "../services/panel-settings.js";
-import { gatherEnvCapabilities, buildPanelSystemAppend, } from "../services/env-capabilities.js";
+import { gatherEnvCapabilities, buildPanelSystemAppend, resolveBackends, } from "../services/env-capabilities.js";
 import { WorkflowTargetStore } from "../services/workflow-target-store.js";
 const PANEL_SYSTEM_APPEND = `You are the autonomous assistant embedded directly in a ComfyUI sidebar panel. The person is working in ComfyUI and talks to you through that panel: their messages arrive as your prompts, and everything you write is shown to them in the panel chat. Write for that reader — lead with the result, keep replies short and concrete, and don't narrate routine internal steps.
 
@@ -80,11 +81,11 @@ If a workflow needs a custom node the user doesn't have, don't silently skip it
 
 CRASH RECOVERY — when a custom node BREAKS or CRASHED ComfyUI, fix it before giving up. If your turn begins with a "⚠️ ComfyUI crashed …" note (it names the fatal log block and the most likely culprit custom node + file:line), or a run dies with a node-level error you can pin to one pack, do NOT just re-run the same graph — ESCALATE to actually fix that node, narrating each step to the user as you go: (a) UPDATE it to the latest code — call panel_update_node with the culprit's id (or the comfyui MCP update_custom_node / fix_custom_node). Try version 'nightly' to grab a just-landed upstream fix. Poll panel_node_queue_status, then panel_restart_comfyui → you resume and RETRY the action to see if the crash is gone. (b) If updating doesn't fix it, reach into COMFYUI_PATH/custom_nodes/<NodeDir> with your shell (Bash): if it's a git repo (a .git dir), run git fetch && git pull (or check out the nightly branch) to force the latest, reinstall its requirements if needed, then restart + retry. (c) If there's no git or it's still broken, attempt a TARGETED source patch of the crashing file:line, then VERIFY the fix actually resolves the crash (restart + retry the same action — confirm it no longer faults). Once verified, OFFER to suggest the fix upstream to the repo owner (open an issue or PR describing the crash + your patch) — describe it and ask the user first; do NOT auto-file anything. Combine this cleanly with the normal install→restart→continue flow above: a fresh install that crashes on first use is the same loop (update/patch the just-installed node, don't abandon it).
 
-REPORT OUR OWN BUGS (we're in beta — bias HARD toward filing) — distinct from the third-party case above. Whenever YOU hit a defect in comfyui-mcp or the sidebar panel ITSELF — a tool/panel/orchestrator call that errors, crashes ComfyUI, returns wrong/misleading/empty output, fails silently, or a limitation that forced you into an awkward workaround/retry — invoke the report-bug skill (read_skill "report-bug") to autonomously file a via-panel report, EVEN IF you already recovered or worked around it. You do NOT need to be blocked, and it does NOT need to be fatal — the workaround itself is the signal. The skill scrubs secrets and files through our intake Worker (which dedupes server-side, so over-reporting is cheap); then just drop the user a one-line note. Do NOT ask permission for OUR bugs — file them autonomously (unlike third-party/custom-node bugs above, where you OFFER and ask first). Ordinary generation errors (OOM, missing model, bad params, user mistakes) are NOT bug reports — those stay troubleshooting.
+REPORT OUR OWN BUGS (we're in beta — bias HARD toward filing) — distinct from the third-party case above. Whenever YOU hit a defect in comfyui-mcp or the sidebar panel ITSELF — a tool/panel/orchestrator call that errors, crashes ComfyUI, returns wrong/misleading/empty output, fails silently, or a limitation that forced you into an awkward workaround/retry — invoke the report-bug skill (read_skill "report-bug") to autonomously file a via-panel report, EVEN IF you already recovered or worked around it. You do NOT need to be blocked, and it does NOT need to be fatal — the workaround itself is the signal. AND report the FIX, not just the failure: any time a defect in comfyui-mcp or the panel gets fixed or patched during the session — you edited/worked around the code, changed a setting, or otherwise made a broken thing work — and the user confirms it's working (they're happy with the fix), file the report RIGHT THEN, capturing BOTH the original bug AND the fix that worked, so it can be fixed upstream at the source (a confirmed working fix is the most valuable thing to send upstream). File it immediately and autonomously — do NOT wait, and do NOT ask. The skill scrubs secrets and files through our intake Worker (which dedupes server-side, so over-reporting is cheap); then just drop the user a one-line note. Do NOT ask permission for OUR bugs — file them autonomously (unlike third-party/custom-node bugs above, where you OFFER and ask first). Ordinary generation errors (OOM, missing model, bad params, user mistakes) are NOT bug reports — those stay troubleshooting.
 
 WEDGED RENDER / OOM / VRAM PINNED — when a generation is stuck or hits CUDA out-of-memory, or a cancel didn't actually free GPU memory (models still resident, VRAM pinned, the next run still OOMs), call panel_free_vram to UNLOAD all models and free VRAM before retrying — it does NOT restart ComfyUI, so it's the cheap first move. Escalation ladder: cancel the run → panel_free_vram (unload + free) → retry; only as a LAST RESORT panel_restart_comfyui (which refuses mid-render and guards the running generation). Reach for panel_free_vram before a restart whenever a cancel left memory pinned.
 
-WORKFLOW TARGETING — by default your panel_* graph edits follow whichever workflow tab the user is currently viewing. If the user wants you to work on a DIFFERENT open workflow while they browse another tab, call panel_set_workflow_target(mode:"pinned", path:<from panel_list_workflows>) to pin edits to that workflow; panel_get_workflow_target shows the current binding. Set mode:"current" to follow the user's active tab again. Pinning does NOT switch what the user sees — it only routes your graph tools. When pinned, still use panel_open_workflow only when you intentionally want to switch the user's view.
+WORKFLOW TARGETING — by default your panel_* graph edits follow whichever workflow tab the user is currently viewing. The panel can only read or edit the workflow currently IN VIEW, so to work on a specific open workflow, make it the active canvas first with panel_open_workflow, then call panel_set_workflow_target(mode:"pinned", path:<from panel_list_workflows>) to bind your edits to it; panel_get_workflow_target shows the current binding. Pinning to a background (open but not active) workflow is REJECTED at pin time — it cannot route edits to a tab that isn't in view. A pin does NOT switch what the user sees; it binds your edits to that workflow so that if the user later switches away, your next graph call fails loudly instead of silently editing the wrong graph. Set mode:"current" to follow the user's active tab again.
 
 CRITICAL — never destroy the user's work. When they ask for a "new workflow", a "fresh canvas", or to "start over for a new project", call panel_new_workflow (it opens a NEW TAB and leaves their current workflow intact). NEVER use panel_clear for that — panel_clear wipes the CURRENTLY OPEN graph and is ONLY for an explicit "clear/reset this canvas". You can manage tabs with panel_list_workflows / panel_open_workflow / panel_rename_workflow / panel_close_workflow, and group nodes with panel_select_nodes / panel_create_subgraph. To label a node by its purpose, use panel_set_node_title. To read or edit nodes INSIDE a subgraph, call panel_enter_subgraph(node_id) first — then panel_query_graph / panel_graph_outline and the panel_* edit tools operate on the subgraph's inner nodes — and panel_exit_subgraph when you're done.
 
@@ -94,7 +95,7 @@ MERGE / COMPOSE WORKFLOWS — to bring nodes from ONE workflow into ANOTHER (com
 
 REUSE SUBGRAPHS via the blueprint library — when the user builds a useful subgraph and wants to reuse it (now or in other workflows), SAVE it: panel_create_subgraph to group the nodes (if not already a subgraph), then panel_save_subgraph(node_id, name) publishes it to their library programmatically (no dialog). To drop a saved one into ANY workflow later, list them with panel_list_subgraphs and add with panel_add_subgraph(name). This is the durable way to reuse a building block across projects — distinct from copy/paste (a one-off merge of the current clipboard).
 
-PREFER READY EXPERTISE OVER HAND-BUILDING. When the user asks you to "set up", "build", or "make" a workflow for a specific model FAMILY (krea2, wan, flux, qwen, ltx, z-image, ideogram, anima, ernie, etc.), do NOT immediately hand-build a generic graph from scratch. FIRST, in order: (a) consult the matching SKILL for that family. If you already have a skill for it loaded in your context, use it. If you do NOT have its full guidance in front of you, do NOT guess from memory — actually CALL the comfyui MCP's list_skills to see what's bundled, then read_skill(name) to load the real family expertise (model slots, the node graph, settings, gotchas) before you build; (b) check the installer PACKS by CALLING list_packs (each packs/<name>/ has a ready manifest.yaml AND a ready workflow.json). If a pack matches the family, PREFER it: apply_manifest --path <its manifest_path> installs the right custom nodes + model weights, and the pack's workflow.json is the expert graph — CALL read_pack_workflow(name) to get that ready graph and recreate it on the live canvas via panel_add_node/panel_connect/panel_set_widget so the user watches it build (or enqueue it headlessly when they don't need it on-canvas), instead of inventing your own. Don't claim a skill or pack exists unless a tool result confirmed it; (c) check the official ComfyUI workflow Templates — call list_workflow_templates (it lists the server's bundled comfyui-workflow-templates + custom-node templates) for a matching starter, and point the user at it in the frontend's Templates browser. Only build from scratch if NOTHING matches — and when you do, briefly say what you checked (skill, packs, templates) so the user knows you didn't reinvent the wheel. And never wipe the user's current canvas (no panel_clear) until the replacement is actually ready to drop in. To load a ready pack graph onto the live canvas in one shot (instead of recreating it node-by-node), use panel_load_workflow(pack:<name>) — the pack's UI workflow.json is read server-side and dropped onto the canvas, undoable.
+PREFER READY EXPERTISE OVER HAND-BUILDING. When the user asks you to "set up", "build", or "make" a workflow for a specific model FAMILY (krea2, wan, flux, qwen, ltx, z-image, ideogram, anima, ernie, etc.), do NOT immediately hand-build a generic graph from scratch. FIRST, in order: (a) consult the matching SKILL for that family. If you already have a skill for it loaded in your context, use it. If you do NOT have its full guidance in front of you, do NOT guess from memory — actually CALL the comfyui MCP's list_skills to see what's bundled, then read_skill(name) to load the real family expertise (model slots, the node graph, settings, gotchas) before you build; (b) check the installer PACKS by CALLING list_packs (each packs/<name>/ has a ready manifest.yaml AND a ready workflow.json). If a pack matches the family, PREFER it: apply_manifest --path <its manifest_path> installs the right custom nodes + model weights, and the pack's workflow.json is the expert graph — CALL read_pack_workflow(name) to get that ready graph and recreate it on the live canvas via panel_add_node/panel_connect/panel_set_widget so the user watches it build (or enqueue it headlessly when they don't need it on-canvas), instead of inventing your own. Don't claim a skill or pack exists unless a tool result confirmed it; (c) check the ComfyUI workflow Templates — call list_workflow_templates (it lists CUSTOM-NODE-contributed templates from the server's /api/workflow_templates index; it does NOT enumerate ComfyUI's own core bundled templates, which are served separately) for a matching starter, and ALSO point the user at the frontend's Templates browser directly, since core templates only appear there. Only build from scratch if NOTHING matches — and when you do, briefly say what you checked (skill, packs, templates) so the user knows you didn't reinvent the wheel. And never wipe the user's current canvas (no panel_clear) until the replacement is actually ready to drop in. To load a ready pack graph onto the live canvas in one shot (instead of recreating it node-by-node), use panel_load_workflow(pack:<name>) — the pack's UI workflow.json is read server-side and dropped onto the canvas, undoable.
 
 OPENING A STAGED / DOWNLOADED WORKFLOW. When you've saved or downloaded a workflow .json into the user's ComfyUI workflows folder (e.g. an example you fetched), open it with panel_open_workflow(path:<name-or-path>) — it now REFRESHES the frontend's (cached) workflow list before searching, so a just-staged file is found and opened natively in its own tab. For a workflow .json that lives OUTSIDE the workflows folder (any absolute path on the ComfyUI machine, or a downloaded example you didn't move into workflows/), load it directly onto the live canvas with panel_load_workflow(path:<file>) — the orchestrator reads + parses the JSON server-side and drops it on the canvas in one shot, so even a large (100KB+) workflow never has to shuttle through this chat. Prefer panel_load_workflow(path:<file>) over pasting a big workflow JSON inline as the graph arg.
 
@@ -965,7 +966,26 @@ export async function runPanelOrchestrator() {
     // local install — the spawn env builders prefer COMFYUI_PATH over the
     // force-remote flag, so a leaked path would silently defeat --force-remote.
     const localPathForTarget = (url) => !isForceRemoteFlagSet() && isLoopbackUrl(url) ? localComfyuiPath : undefined;
-    let comfyuiPath = localPathForTarget(comfyuiUrl);
+    // #296: an embedded LOCAL sidebar session with NO CLI-configured workspace
+    // (COMFYUI_PATH unset AND auto-detect empty) would otherwise spawn path-less —
+    // its comfyui MCP stuck in a degraded "local but path-less" state (no
+    // download_model/apply_manifest/model-scan LOCAL surface, panel_load_workflow's
+    // local fallback blind). The panel already KNOWS where ComfyUI lives and serves
+    // it at GET /comfyui_mcp_panel/status (base_path). resolveComfyuiPathForTarget
+    // consumes it as a last-resort fallback for a loopback, non-force-remote target
+    // (adopting only a path that actually exists on THIS machine). Awaited here so
+    // the recovered path is in place BEFORE the MCP-env builders / manager below
+    // capture it. Best-effort — a failed/absent status route leaves us path-less.
+    let comfyuiPath = await resolveComfyuiPathForTarget({
+        target: comfyuiUrl,
+        localPath: localComfyuiPath,
+        forceRemote: isForceRemoteFlagSet(),
+        isLoopback: isLoopbackUrl(comfyuiUrl),
+    });
+    if (comfyuiPath && comfyuiPath !== localPathForTarget(comfyuiUrl)) {
+        logger.info(`[panel-orchestrator] no COMFYUI_PATH/default workspace; adopted ComfyUI ` +
+            `base_path from the panel status route: ${comfyuiPath} (#296).`);
+    }
     // Force the child remote only when opted in (--force-remote) or the target is
     // non-loopback; a default loopback panel user with no COMFYUI_PATH is left to
     // auto-detect its local install (keeps download_model/apply_manifest/scans).
@@ -1214,8 +1234,30 @@ export async function runPanelOrchestrator() {
     const defaultBackend = KNOWN_BACKENDS.has(backendId) ? backendId : "claude";
     const AGENT_KEY_SEP = "::";
     const tabBackends = new Map(); // panel tabId -> selected backend
+    // #376: the model label advertised in a tab's ready banner (sent at hello, before
+    // the SDK reports the real model). onSession re-sends a corrected banner when the
+    // resolved model differs from what's stored here. A tab with NO entry never got a
+    // greeting (a resume/reconnect), so it must never be "corrected".
+    const advertisedBannerModel = new Map();
+    // The SDK-resolved model per tab, learned from the session/init event. Kept so a
+    // greeting emitted AFTER the model is already known (the onSession-before-greeting
+    // race) can label itself correctly instead of showing the pre-init default.
+    const resolvedModelByTab = new Map();
     const headlessTabs = new Set(); // tabs with no ComfyUI canvas (mobile/remote) — deliver renders in-turn
+    // #570: for an UNSAVED workflow the panel tab id is an ephemeral tmp:<uuid>,
+    // regenerated on every reload, so the tab-keyed session store can't survive an
+    // orchestrator restart that also reloads the panel. Map each such tab to a STABLE
+    // resume key (origin + title + backend) computed at hello, so onSession can also
+    // persist under it and a reloaded tab can resume it. tmp: tabs only.
+    const tabStableKey = new Map();
     const workflowTargets = new WorkflowTargetStore();
+    // Monotonic per-tab sequence for set_workflow_target events. A pinned target is
+    // validated asynchronously (resolvePinTarget queries workflow_list), so a later event
+    // (another pin, or a synchronous mode:"current") can arrive before the async pin
+    // commits. Each event bumps the tab's sequence; a pinned resolution only commits/acks if
+    // its captured sequence is still the latest — otherwise a stale pin would clobber the
+    // user's newer selection (codex race).
+    const workflowTargetSeq = new Map();
     const backendForTab = (panelTabId) => tabBackends.get(panelTabId) ?? defaultBackend;
     const agentKeyFor = (panelTabId) => panelTabId + AGENT_KEY_SEP + backendForTab(panelTabId);
     // A panel tab id never contains "::"; backend names never do — so split on the
@@ -1272,11 +1314,32 @@ export async function runPanelOrchestrator() {
             if (gen !== envRefreshGen)
                 return; // superseded — let the newer refresh own the prompt
             // Belt-and-suspenders: gather is internally guarded, but never let a stray
-            // throw break the prompt — fall back to the static append.
+            // throw break the prompt — fall back to the static append. Also DROP any
+            // previously-gathered envCaps so systemAppendForBackend() falls back to the
+            // same static append for EVERY backend (not just the default) — otherwise a
+            // non-default backend would rebuild a stale env block off the old caps,
+            // disagreeing with the reset panelSystemAppend (#358 wiring).
+            envCaps = undefined;
             panelSystemAppend = resolvePrompt("panel.persona", PANEL_SYSTEM_APPEND);
             logger.debug(`[panel-orchestrator] env-capabilities probe failed (using static prompt): ${err instanceof Error ? err.message : String(err)}`);
         }
     }
+    // The ENVIRONMENT block's `Backend:` line must name the provider running THIS
+    // tab's turn, not the process default (#358). Backends are per-tab now, so the
+    // single `panelSystemAppend` (built with the default backend id) would tell a
+    // Grok tab it's Claude. Rebuild the block per-tab-backend: same env facts, but
+    // the backend label recomputed from the tab's actual backend id. Falls back to
+    // the shared append when the env probe produced nothing (envCaps undefined).
+    const systemAppendForBackend = (bId) => {
+        if (!envCaps)
+            return panelSystemAppend;
+        const { backend, otherBackendAvailable } = resolveBackends(bId);
+        // Already the default's label → reuse the shared string (no rebuild).
+        if (envCaps.backend === backend && envCaps.otherBackendAvailable === otherBackendAvailable) {
+            return panelSystemAppend;
+        }
+        return buildPanelSystemAppend(resolvePrompt("panel.persona", PANEL_SYSTEM_APPEND), { ...envCaps, backend, otherBackendAvailable });
+    };
     // Build it before any agent could spawn. Guarded so a probe stall can't block
     // orchestrator startup beyond the probes' own (short) timeouts.
     await refreshEnvCapabilities();
@@ -1425,12 +1488,14 @@ export async function runPanelOrchestrator() {
     const makeBackend = (key) => {
         const backend = backendOf(key);
         const panelTabId = panelTabOf(key);
+        // The ENVIRONMENT block's `Backend:` line must name THIS backend (#358).
+        const sysAppend = systemAppendForBackend(backend);
         try {
             if (backend === "codex") {
                 return new CodexBackend({
                     cwd: comfyuiPath ?? process.cwd(),
                     model: codexModel,
-                    systemAppend: panelSystemAppend,
+                    systemAppend: sysAppend,
                     comfyuiUrl,
                     mcpServers: makeHttpBackendMcpServers(panelTabId),
                 });
@@ -1439,7 +1504,7 @@ export async function runPanelOrchestrator() {
                 return new GeminiBackend({
                     cwd: comfyuiPath ?? process.cwd(),
                     model: geminiModel,
-                    systemAppend: panelSystemAppend,
+                    systemAppend: sysAppend,
                     comfyuiUrl,
                     mcpServers: makeHttpBackendMcpServers(panelTabId),
                 });
@@ -1448,7 +1513,7 @@ export async function runPanelOrchestrator() {
                 return new AntigravityBackend({
                     cwd: comfyuiPath ?? process.cwd(),
                     ...(antigravityModel ? { model: antigravityModel } : {}),
-                    systemAppend: panelSystemAppend,
+                    systemAppend: sysAppend,
                     mcpServers: makeHttpBackendMcpServers(panelTabId),
                 });
             }
@@ -1456,7 +1521,7 @@ export async function runPanelOrchestrator() {
                 return new GrokBackend({
                     cwd: comfyuiPath ?? process.cwd(),
                     model: grokModel,
-                    systemAppend: panelSystemAppend,
+                    systemAppend: sysAppend,
                     comfyuiUrl,
                     mcpServers: makeHttpBackendMcpServers(panelTabId),
                 });
@@ -1465,7 +1530,7 @@ export async function runPanelOrchestrator() {
                 return new OllamaBackend({
                     cwd: comfyuiPath ?? process.cwd(),
                     model: ollamaModel,
-                    systemAppend: panelSystemAppend,
+                    systemAppend: sysAppend,
                     comfyuiUrl,
                     mcpServers: makeHttpBackendMcpServers(panelTabId),
                     ...ollamaDeps(),
@@ -1475,7 +1540,7 @@ export async function runPanelOrchestrator() {
                 return new OllamaBackend({
                     cwd: comfyuiPath ?? process.cwd(),
                     model: openrouterModel,
-                    systemAppend: panelSystemAppend,
+                    systemAppend: sysAppend,
                     comfyuiUrl,
                     mcpServers: makeHttpBackendMcpServers(panelTabId),
                     ...openrouterDeps(),
@@ -1485,7 +1550,7 @@ export async function runPanelOrchestrator() {
                 return new OllamaBackend({
                     cwd: comfyuiPath ?? process.cwd(),
                     model: lmstudioModel,
-                    systemAppend: panelSystemAppend,
+                    systemAppend: sysAppend,
                     comfyuiUrl,
                     mcpServers: makeHttpBackendMcpServers(panelTabId),
                     ...lmstudioDeps(),
@@ -1495,7 +1560,7 @@ export async function runPanelOrchestrator() {
                 return new OllamaBackend({
                     cwd: comfyuiPath ?? process.cwd(),
                     model: llamacppModel,
-                    systemAppend: panelSystemAppend,
+                    systemAppend: sysAppend,
                     comfyuiUrl,
                     mcpServers: makeHttpBackendMcpServers(panelTabId),
                     ...llamacppDeps(),
@@ -1505,7 +1570,7 @@ export async function runPanelOrchestrator() {
                 return new OllamaBackend({
                     cwd: comfyuiPath ?? process.cwd(),
                     model: customModel,
-                    systemAppend: panelSystemAppend,
+                    systemAppend: sysAppend,
                     comfyuiUrl,
                     mcpServers: makeHttpBackendMcpServers(panelTabId),
                     ...customDeps(),
@@ -1515,7 +1580,7 @@ export async function runPanelOrchestrator() {
                 return new ChatGptOAuthBackend({
                     cwd: comfyuiPath ?? process.cwd(),
                     model: chatgptModel,
-                    systemAppend: panelSystemAppend,
+                    systemAppend: sysAppend,
                     comfyuiUrl,
                     mcpServers: makeHttpBackendMcpServers(panelTabId),
                 });
@@ -1524,7 +1589,7 @@ export async function runPanelOrchestrator() {
             if (simpleKeyReg) {
                 // glm/moonshot (and any future simple api-key provider) share one factory.
                 return makeOpenAiKeyBackend(simpleKeyReg, {
-                    systemAppend: panelSystemAppend,
+                    systemAppend: sysAppend,
                     comfyuiUrl,
                     mcpServers: makeHttpBackendMcpServers(panelTabId),
                 });
@@ -1533,7 +1598,7 @@ export async function runPanelOrchestrator() {
                 return new KimiBackend({
                     cwd: comfyuiPath ?? process.cwd(),
                     model: kimiModel,
-                    systemAppend: panelSystemAppend,
+                    systemAppend: sysAppend,
                     comfyuiUrl,
                     mcpServers: makeHttpBackendMcpServers(panelTabId),
                 });
@@ -1546,7 +1611,7 @@ export async function runPanelOrchestrator() {
                 return new CopilotBackend({
                     cwd: comfyuiPath ?? process.cwd(),
                     model: copilotModel,
-                    systemAppend: panelSystemAppend,
+                    systemAppend: sysAppend,
                     comfyuiUrl,
                     mcpServers: makeHttpBackendMcpServers(panelTabId),
                 });
@@ -1635,6 +1700,10 @@ export async function runPanelOrchestrator() {
                 COMFYUI_URL: comfyuiUrl,
                 // Where download_model writes live progress for the panel tray.
                 COMFYUI_MCP_PROGRESS_DIR: progressDir,
+                // Self-scope this tab's downloads so the orchestrator can wake EXACTLY
+                // this tab's agent when a download settles (#547) — the child stamps its
+                // own COMFYUI_MCP_TAB into each progress row, mirroring COMFYUI_MCP_BLIND.
+                ...(panelTab ? { COMFYUI_MCP_TAB: panelTab } : {}),
                 // Local mode → enables download_model, apply_manifest (installer packs),
                 // and model scans so the agent installs the right way instead of curl.
                 ...(comfyuiPath ? { COMFYUI_PATH: comfyuiPath } : forceRemoteEnv()),
@@ -1649,6 +1718,10 @@ export async function runPanelOrchestrator() {
         makeBackend,
         comfyuiUrl, // for fetching image bytes to inline into agent turns
         systemAppend: panelSystemAppend,
+        // Per-KEY env block so the CLAUDE path (makeBackend returns undefined) still
+        // gets the tab's actual backend on its `Backend:` line (#358). Non-claude
+        // tabs get it via makeBackend's sysAppend; this covers the built-in default.
+        makeSystemAppend: (key) => systemAppendForBackend(backendOf(key)),
         pluginPath: pluginAvailable ? pluginPath : undefined,
         // In-process live-graph MCP for CLAUDE keys only (codex/gemini drive the
         // canvas through the loopback HTTP MCP instead). Bound to the PANEL tab so
@@ -1675,9 +1748,34 @@ export async function runPanelOrchestrator() {
         // Per-response usage → the panel's context/usage meter (updates live).
         onStatus: (key, status) => pushStatus(panelTabOf(key), status),
         // Report the SDK session id so the panel can persist it and resume on reload.
-        onSession: (key, sessionId) => {
-            bridge.push({ type: "session", session_id: sessionId }, panelTabOf(key));
+        onSession: (key, sessionId, model) => {
+            const panelTab = panelTabOf(key);
+            // #570: also persist under the tab's STABLE resume key (unsaved workflows),
+            // so a panel reload that regenerates the tmp:<uuid> can still resume this
+            // conversation. The manager already persisted under the exact tab key.
+            const skey = tabStableKey.get(panelTab);
+            if (skey)
+                sessionStore.setStable(skey, sessionId, panelTab);
+            bridge.push({ type: "session", session_id: sessionId }, panelTab);
             bridge.broadcastTabList(); // a session started/changed → refresh mirror pickers
+            // #376: the ready banner was sent at hello with the PRE-init default model.
+            // Now the SDK reports the ACTUALLY-resolved model — remember it, then re-send
+            // a corrected banner IFF a banner was actually advertised for this tab AND the
+            // resolved model differs (bannerCorrection returns null otherwise, so a resume
+            // with no prior greeting is never "corrected" and a correct banner never
+            // duplicates).
+            if (typeof model === "string" && model.trim())
+                resolvedModelByTab.set(panelTab, model);
+            const corrected = bannerCorrection({
+                backend: backendForTab(panelTab),
+                advertisedLabel: advertisedBannerModel.get(panelTab),
+                resolvedModel: model,
+                customBaseUrl,
+            });
+            if (corrected) {
+                advertisedBannerModel.set(panelTab, model);
+                bridge.push({ type: "say", text: corrected }, panelTab);
+            }
         },
         // Per-turn rewind anchor (assistant UUID) → the panel stores it so a later
         // "rewind conversation to here" can fork the session at that point.
@@ -1856,6 +1954,38 @@ export async function runPanelOrchestrator() {
         // (hello, runpod tools, watcher auto-stop/vanish), so they can't drift
         // split-brained again (#269).
         logger.info(`[panel-orchestrator] retargeted ComfyUI ${prev} → ${comfyuiUrl} (${isLoopbackUrl(next) ? "local" : "remote"} mode) from panel hello`);
+        // #296: the synchronous `localPathForTarget(next)` above can't see the NEWLY
+        // targeted panel's base_path, so a retarget to a loopback ComfyUI with no
+        // env/auto-detected path lands path-less even though that panel serves it. Kick
+        // off a best-effort recovery from the NEW target's status route (fire-and-forget
+        // so the retarget stays synchronous). On success — and only if a newer retarget
+        // hasn't superseded us mid-fetch — adopt the path and rebuild the comfyui MCP
+        // spawn env so each tab's child respawns in LOCAL mode. Skipped entirely when a
+        // local path is already set (the common case does no I/O).
+        if (!comfyuiPath) {
+            void (async () => {
+                const recovered = await resolveComfyuiPathForTarget({
+                    target: next,
+                    localPath: localComfyuiPath,
+                    forceRemote: isForceRemoteFlagSet(),
+                    isLoopback: isLoopbackUrl(next),
+                });
+                if (!recovered)
+                    return;
+                // Superseded by a newer retarget while we fetched — do nothing.
+                if (canonTargetUrl(comfyuiUrl) !== canonTargetUrl(next))
+                    return;
+                if (comfyuiPath === recovered)
+                    return;
+                comfyuiPath = recovered;
+                logger.info(`[panel-orchestrator] recovered ComfyUI base_path from panel status route ` +
+                    `after retarget: ${recovered} (#296).`);
+                // Rebuild the comfyui MCP spawn env (now carrying COMFYUI_PATH) and respawn
+                // each tab's agent at its next idle so the LIVE child runs in LOCAL mode.
+                manager.setMcpServers(buildMcpServers());
+                manager.restartAllForMcpEnv();
+            })();
+        }
         // Advertising itself happens unconditionally on every hello (see below) —
         // a retarget doesn't need its own advertise call here.
         return true;
@@ -1868,10 +1998,23 @@ export async function runPanelOrchestrator() {
     // idle so the LIVE comfyui MCP subprocess is recreated WITH the new env, and
     // nudge it to retry the action the secret unblocked. No process restart, no
     // reload fight. The value is never logged — only the env-var KEYS.
-    const unsubscribeSecrets = onComfyuiSecretsChanged(() => {
+    const SECRET_RETRY_NUDGE = "🔑 The API token you just provided is now active for the comfyui tools — retry the action that needed it (e.g. the download that returned 401).";
+    const unsubscribeSecrets = onComfyuiSecretsChanged((change) => {
         manager.setMcpServers(buildMcpServers());
-        manager.restartAllForMcpEnv("🔑 The API token you just provided is now active for the comfyui tools — retry the action that needed it (e.g. the download that returned 401).");
-        logger.info(`[panel-orchestrator] tool secret saved → comfyui MCP env updated + agents respawn on idle (keys: ${comfyuiSecretKeys().join(", ") || "none"})`);
+        // EVERY tab's comfyui child needs the new/removed env, so respawn each at its
+        // next idle — but SILENTLY (no nudge). The env rebuild is shared; the "retry
+        // the action" nudge is not, so it must never broadcast to unrelated tabs.
+        // restartAllForMcpEnv() is nudge-preserving, so this can't erase a per-request
+        // nudge already queued on another tab (#164).
+        manager.restartAllForMcpEnv();
+        // NUDGE only the tab whose panel_request_secret this change answers — a
+        // Settings slot save, a background token (re)load, or a revoke leaves
+        // `requested` false and nudges nothing. The per-tab pending-restart map
+        // coalesces, so a repeat event for the same tab can't double-inject (#164).
+        const nudgedTab = change.requested && change.tabId ? change.tabId : null;
+        if (nudgedTab)
+            manager.restartForMcpEnv(agentKeyFor(nudgedTab), SECRET_RETRY_NUDGE);
+        logger.info(`[panel-orchestrator] tool secret ${change.requested ? "saved (requested)" : "changed"} → comfyui MCP env updated + agents respawn on idle${nudgedTab ? ` + retry nudge → tab ${nudgedTab.slice(0, 8)}` : ""} (keys: ${comfyuiSecretKeys().join(", ") || "none"})`);
     });
     // An agent-provider secret changed (e.g. the OpenRouter API key set from the
     // panel). Hydrate it into env, drop the cached openrouter probe/model list so
@@ -2206,6 +2349,12 @@ export async function runPanelOrchestrator() {
                 tabBackends.delete(migratedFrom);
                 headlessTabs.delete(migratedFrom);
                 workflowTargets.clear(migratedFrom);
+                // Invalidate any in-flight set_workflow_target(pinned) resolution captured under
+                // the retired id: dropping its sequence makes isCurrent() false, so a late async
+                // pin can no longer write a stale target / emit a late ack that the bridge's
+                // migration map would deliver to the new tab (codex race, tab-id migration edge).
+                workflowTargetSeq.delete(migratedFrom);
+                tabStableKey.delete(migratedFrom); // recomputed for the new id below (#570)
             }
             // Blind content mode rides the hello (issue #90) so the FIRST agent spawn
             // already carries the right tool-server env. A CHANGE against a live
@@ -2251,6 +2400,53 @@ export async function runPanelOrchestrator() {
             const resume = typeof event.resume === "string" ? event.resume : undefined;
             if (resume && (!prev || prev === backend))
                 manager.setResume(key, resume);
+            // #570: an UNSAVED workflow's tab id is an ephemeral tmp:<uuid>, regenerated
+            // on every panel reload — so on an orchestrator restart that also reloads the
+            // panel, the tab returns under a never-stored id and forgets everything
+            // (neither our tab-keyed store nor the panel's tab-keyed hello.resume can hit).
+            // Anchor a STABLE resume key on what DOES survive that tab's reload — the
+            // ComfyUI origin + workflow title + backend — and seed it as a fallback.
+            // Saved workflows (wf:<path>) already key stably, so this is tmp:-only.
+            if (panelTab.startsWith("tmp:")) {
+                const origin = (typeof helloUrl === "string" && helloUrl.trim() ? helloUrl.trim() : undefined) ??
+                    bridge.tabOrigin(panelTab) ??
+                    "";
+                const title = typeof event.title === "string" ? event.title : "";
+                const skey = `tmp::${origin}::${title}::${backend}`;
+                tabStableKey.set(panelTab, skey);
+                // Seed the resume fallback ONLY when the panel supplied none and no live
+                // agent owns the key. spawn() prefers the exact-tab store hit over this
+                // pendingResume, so the precise path is never overridden — this only
+                // rescues the churned tmp: id. setResume() no-ops if a live agent exists.
+                //
+                // COLLISION GUARD: origin+title+backend is NOT unique — two unsaved tabs
+                // with the same (default) title collide. Seed only when THIS tab is the sole
+                // connected holder of the key, so a fresh sibling tab can never resume
+                // another CONCURRENTLY-live unsaved tab's conversation (the cross-tab hijack
+                // the migration path also refuses; setStable poisons a key the moment two
+                // live tabs write distinct sessions to it). When ambiguous we surface fresh —
+                // a lost resume is a mild miss; resuming the WRONG conversation is not.
+                //
+                // The SEQUENTIAL same-title case (tab A closed, a later tab B opens with the
+                // same origin+title+backend) intentionally resumes A: by the only identity
+                // that survives a reload — the workflow identity the issue itself names as the
+                // key — B *is* the same workspace. This is bounded by the GC TTL (an abandoned
+                // session ages out) and always yields to the exact-tab store and the panel's
+                // own hello.resume. A truly-unique panel per-instance id (referenced in #568/
+                // #570's thread) would let us tighten even this — a clean future upgrade.
+                if (!resume && !manager.hasLiveAgent(key) && sessionStore.get(key) === undefined) {
+                    let sameKeyTabs = 0;
+                    for (const t of bridge.tabs()) {
+                        if (tabStableKey.get(t.tab_id) === skey)
+                            sameKeyTabs += 1;
+                    }
+                    if (sameKeyTabs <= 1) {
+                        const stableSid = sessionStore.getStable(skey);
+                        if (stableSid)
+                            manager.setResume(key, stableSid);
+                    }
+                }
+            }
             // Live model list for the picker; SDK slash commands are Claude-only.
             pushModels(panelTab);
             // Truthful provider readiness (this machine runs the agents), so the
@@ -2383,32 +2579,13 @@ export async function runPanelOrchestrator() {
                     }
                     // Greet only on a FRESH session (a resume/reconnect already has the thread).
                     if (!resume) {
-                        const readyText = reg
-                            ? reg.readyMessage(agentLabel)
-                            : isCx
-                                ? `🟢 comfyui-mcp agent ready — ${agentLabel} on your Codex (ChatGPT) account. Ask away.`
-                                : isCg
-                                    ? `🟢 comfyui-mcp agent ready — ${agentLabel} on your ChatGPT subscription (direct OAuth). Ask away.`
-                                    : isGm
-                                        ? `🟢 comfyui-mcp agent ready — ${agentLabel} on your Google account (Gemini Code Assist). Ask away.`
-                                        : isAg
-                                            ? `🟢 comfyui-mcp agent ready — ${agentLabel} on your Google AI subscription via Antigravity CLI. Note: agy turns show final answers only (no live tool progress). Ask away.`
-                                            : isGk
-                                                ? `🟢 comfyui-mcp agent ready — ${agentLabel} on your Grok (xAI) account. Ask away.`
-                                                : isOl
-                                                    ? `🟢 comfyui-mcp agent ready — ${agentLabel} running locally via Ollama (no account, no API key). Small local models are slower and simpler than frontier ones — expect fewer frills. Ask away.`
-                                                    : isLs
-                                                        ? `🟢 comfyui-mcp agent ready — ${agentLabel} running locally via LM Studio (no account, no API key). Small local models are slower and simpler than frontier ones — expect fewer frills. Ask away.`
-                                                        : isLc
-                                                            ? `🟢 comfyui-mcp agent ready — ${agentLabel} running locally via llama.cpp (no account, no API key). Small local models are slower and simpler than frontier ones — expect fewer frills. Ask away.`
-                                                            : isCu
-                                                                ? `🟢 comfyui-mcp agent ready — ${agentLabel} via your custom endpoint (${customBaseUrl}). Ask away.`
-                                                                : isOr
-                                                                    ? `🟢 comfyui-mcp agent ready — ${agentLabel} via OpenRouter (hosted API, your OPENROUTER_API_KEY). Ask away.`
-                                                                    : isCp
-                                                                        ? `🟢 comfyui-mcp agent ready — ${agentLabel} on your GitHub Copilot subscription (⚠️ experimental, ToS risk — you opted in). Ask away.`
-                                                                        : `🟢 comfyui-mcp agent ready — ${agentLabel} on your Claude subscription. Ask away.`;
-                        bridge.push({ type: "say", text: readyText }, panelTab);
+                        // Prefer an ALREADY-resolved model if the SDK init raced ahead of this
+                        // greeting (#376) — otherwise the pre-init label. Remember what we
+                        // advertised so the onSession correction re-sends only on a real
+                        // mismatch.
+                        const bannerLabel = resolvedModelByTab.get(panelTab) ?? agentLabel;
+                        advertisedBannerModel.set(panelTab, bannerLabel);
+                        bridge.push({ type: "say", text: readyBannerText(backend, bannerLabel, customBaseUrl) }, panelTab);
                     }
                     bridge.push({ type: "ack", ok: true, kind: "ready", agent: agentLabel, backend }, panelTab);
                     logger.debug(`[panel-orchestrator] tab ${panelTab.slice(0, 8)} connected (${backend}) — agent healthy, ready ack`);
@@ -2506,10 +2683,48 @@ export async function runPanelOrchestrator() {
                 bridge.push({ type: "ack", ok: false, kind: "workflow_target", message: "path required when pinning" }, panelTab);
                 return;
             }
-            const target = workflowTargets.set(panelTab, { mode, path, filename });
-            bridge.push({ type: "ack", ok: true, kind: "workflow_target", target }, panelTab);
-            bridge.push({ type: "workflow_target", target }, panelTab);
-            logger.info(`[panel-orchestrator] tab ${panelTab.slice(0, 8)} workflow target → ${target.mode}${target.path ? ` (${target.path})` : ""}`);
+            // Every target event bumps the tab's sequence so a later selection always wins over
+            // an in-flight (async) pin resolution.
+            const seq = (workflowTargetSeq.get(panelTab) ?? 0) + 1;
+            workflowTargetSeq.set(panelTab, seq);
+            const isCurrent = () => workflowTargetSeq.get(panelTab) === seq;
+            const ackTarget = (t) => {
+                bridge.push({ type: "ack", ok: true, kind: "workflow_target", target: t }, panelTab);
+                bridge.push({ type: "workflow_target", target: t }, panelTab);
+                logger.info(`[panel-orchestrator] tab ${panelTab.slice(0, 8)} workflow target → ${t.mode}${t.path ? ` (${t.path})` : ""}`);
+            };
+            // A PINNED target must clear the SAME validation as the MCP tool
+            // (panel_set_workflow_target) — otherwise this panel-driven event path would be a
+            // bypass that re-admits #556/#571 (background pin) and #259 (not-open pin). Resolve
+            // async through the shared helper, failing at pin time before the store is written.
+            if (mode === "pinned") {
+                void (async () => {
+                    const ctx = makePanelToolCtx(bridge, panelTab, workflowTargets);
+                    const res = await resolvePinTarget(ctx, String(path), filename);
+                    // Superseded by a newer target event while we were validating — drop silently
+                    // (no write, no late ack) so the newer selection is never clobbered.
+                    if (!isCurrent())
+                        return;
+                    if (!res.ok) {
+                        bridge.push({ type: "ack", ok: false, kind: "workflow_target", message: res.error }, panelTab);
+                        return;
+                    }
+                    ackTarget(workflowTargets.set(panelTab, { mode: "pinned", path: res.pinPath, filename: res.pinFilename }));
+                })().catch((err) => {
+                    if (!isCurrent())
+                        return;
+                    bridge.push({
+                        type: "ack",
+                        ok: false,
+                        kind: "workflow_target",
+                        message: `Could not pin workflow: ${err instanceof Error ? err.message : String(err)}`,
+                    }, panelTab);
+                });
+                return;
+            }
+            // mode === "current" — no target to validate; follow the active tab. Writes
+            // synchronously and is the latest sequence, so it wins over any in-flight pin.
+            ackTarget(workflowTargets.set(panelTab, { mode, path, filename }));
             return;
         }
         // Live panel config: render-stall threshold, plus the user's agent-model
@@ -2966,6 +3181,12 @@ export async function runPanelOrchestrator() {
             // reset() is synchronous (map cleared now), so no concurrent send() can
             // spawn an agent before we report the cleared session.
             manager.reset(agentKeyFor(tabId));
+            // reset() clears the exact-tab store; the stable resume index (#570) is the
+            // manager's blind spot, so drop it here too — a deliberate NEW chat must not
+            // be resurrected by the unsaved-workflow fallback on the next reload.
+            const sk = tabStableKey.get(tabId);
+            if (sk)
+                sessionStore.clearStable(sk);
             bridge.push({ type: "session", session_id: null }, tabId);
             bridge.push({ type: "ack", ok: true, kind: "new_session" }, tabId);
             bridge.broadcastTabList(); // session cleared → mirror pickers' green dot off
@@ -3208,6 +3429,37 @@ export async function runPanelOrchestrator() {
     // a downloading row that stops updating for 60s is treated as a dead writer.
     const DOWNLOAD_LINGER_MS = 8000;
     const downloadRemoveAt = new Map();
+    // Download-completion agent events (#547). A finished render already wakes the
+    // agent (manager.injectEvent kind:"executed"); a finished DOWNLOAD had no
+    // equivalent, so a "download then use the model" task stalled until the user
+    // poked it. We observe the SAME first-terminal transition the tray-prune timer
+    // uses and inject a completion event to the tab's agent — but COALESCED: an
+    // apply_manifest that pulls many files would otherwise fire one turn per file,
+    // so completions accumulate per agent for a short window and flush as ONE event.
+    const DOWNLOAD_DONE_DEBOUNCE_MS = 1500;
+    // agentKey → { download identity → {name, terminal status} } accumulated since
+    // the last flush, plus the epoch-ms deadline (extended by each new completion)
+    // at which we emit. Keyed by download IDENTITY (row.id), not display name, so
+    // two distinct downloads sharing a filename in one batch don't overwrite each
+    // other and hide a failure (codex).
+    const downloadDonePending = new Map();
+    // Resolve which agent to wake for a settled download row: the stamped tab's
+    // agent when it's still live; else the SINGLE live agent (pre-fix/in-process
+    // rows carry no tab, AND a tab-id migration/backend change can leave the
+    // stamped tab's key no longer resolving to the live agent — codex); else none —
+    // never fan out to unrelated tabs (#547).
+    const resolveDownloadAgentKey = (row) => {
+        const tab = typeof row.tab === "string" ? row.tab.trim() : "";
+        if (tab) {
+            const key = agentKeyFor(tab);
+            if (manager.hasLiveAgent(key))
+                return key;
+            // Stamped tab's agent is gone (migration/backend switch) — fall through to
+            // the single-live-agent fallback rather than silently dropping the event.
+        }
+        const live = manager.liveKeys();
+        return live.length === 1 ? live[0] : null;
+    };
     /** Boolean URL probe with a timeout — readiness checks for pending pod connects. */
     const probeOk = async (url, timeoutMs = 8_000) => {
         const ctl = new AbortController();
@@ -3316,6 +3568,19 @@ export async function runPanelOrchestrator() {
                 const due = downloadRemoveAt.get(full);
                 if (due == null) {
                     downloadRemoveAt.set(full, now + DOWNLOAD_LINGER_MS); // start the linger
+                    // FIRST terminal observation of this download (due was unset) — the
+                    // exact once-per-download moment. Wake the tab's agent with the result
+                    // (#547), coalesced via downloadDonePending so a many-file manifest is
+                    // one turn, not N.
+                    const key = resolveDownloadAgentKey(row);
+                    if (key && manager.hasLiveAgent(key)) {
+                        const bucket = downloadDonePending.get(key) ??
+                            { downloads: new Map(), flushAt: 0 };
+                        const idKey = String(row.id ?? full);
+                        bucket.downloads.set(idKey, { name: String(row.name ?? row.id ?? "model"), status: String(status) });
+                        bucket.flushAt = now + DOWNLOAD_DONE_DEBOUNCE_MS;
+                        downloadDonePending.set(key, bucket);
+                    }
                 }
                 else if (now >= due) {
                     try {
@@ -3349,6 +3614,16 @@ export async function runPanelOrchestrator() {
             lastDownloadSnapshot = snapshot;
             bridge.push({ type: "download_progress", downloads }); // broadcast to all tabs
         }
+        // Flush any download-completion buckets whose debounce window has elapsed —
+        // ONE agent event per tab per batch of settled downloads (#547). Runs every
+        // tick (700ms) so a flush always fires shortly after the last file settles.
+        for (const [key, bucket] of [...downloadDonePending]) {
+            if (now < bucket.flushAt)
+                continue;
+            downloadDonePending.delete(key);
+            const settled = [...bucket.downloads.values()];
+            manager.injectEvent(key, { kind: "download_done", downloads: settled });
+        }
         // MCP-child control channel (#269): runpod_* tools that ran in spawned
         // agent children ask the orchestrator to retarget / watch / unwatch /
         // auto-connect here — through the SAME applyComfyuiUrl fan-out as a panel