comfyui-mcp 0.50.30 → 0.50.32

package/dist/orchestrator/fence-refusal.js

@@ -0,0 +1,59 @@
+// WHY the fence-adoption validator refused, in words the caller can act on.
+//
+// Extracted from the validator callback in index.ts so it is reachable by tests:
+// while it lived inline, the only way to assert the wording was to build a fake
+// bridge and check that it returned what the fake was told to return — a
+// tautology that would have passed with the logic deleted.
+//
+// #1077 — the validator has three gates and all of them used to return a bare
+// `false`, so a permanently-wedged session was told only "the adoption was
+// REFUSED". Naming the gate is the fix; naming it WRONGLY is worse than not
+// naming it, which is what the first version of this did.
+//
+// `canReach()` and `tabServerOrigin()` both swallow whatever `resolveTarget`
+// throws, so a turn issued from SEVERAL workflows at once (routing ambiguity,
+// #1001) is indistinguishable at those call sites from a dead tab and from a
+// connection carrying no Origin. It therefore inherited the structural
+// no-Origin story: "refreshing will not help, stop using the relay backend".
+// For an ambiguous turn that is wrong on every count — the tabs are connected,
+// the Origin exists, nothing is structural, and it clears on the next
+// single-origin message. The cause is typed and was simply being discarded.
+/** The turn's target is ambiguous — say so, and say it is self-clearing. */
+function ambiguousTurn(tabId, what) {
+    return (`this turn was issued from SEVERAL workflows at once, so ${what} for "${tabId}" — the tabs ` +
+        `are connected and fine. This clears itself: target a workflow explicitly ` +
+        `(panel_set_workflow_target with a path, or panel_open_workflow), or let the next ` +
+        `single-origin message settle it. Do NOT reconnect or refresh.`);
+}
+/** Gate 1: the routed tab did not resolve at all. */
+export function unreachableReason(tabId, failure) {
+    if (failure === "ambiguous")
+        return ambiguousTurn(tabId, "there is no single target to fence");
+    return `the routed tab (${tabId}) is no longer reachable, so there is nothing to fence`;
+}
+/** Gate 2: it resolved, but not to a live panel tab. */
+export function noPanelTabReason(tabId) {
+    return `${tabId} does not resolve to a live panel tab (a scope address whose tab has gone away)`;
+}
+/**
+ * Gate 3: the workflow identity did not validate.
+ *
+ * ORDER MATTERS. An ambiguous turn also yields no origin, so it must be checked
+ * BEFORE the structural no-Origin case, or it borrows a remedy that cannot help
+ * it and is told its problem is permanent.
+ */
+export function identityReason(tabId, origin, workflowUuid, failure) {
+    if (!origin && failure === "ambiguous") {
+        return ambiguousTurn(tabId, "no single tab's identity could be read");
+    }
+    if (!origin) {
+        return (`this tab's connection carries no server-observed Origin, and the workflow identity is ` +
+            `bound to one — so the fence can never be adopted for it. This is structural, not ` +
+            `transient: refreshing the tab will not change it. Relay-backend connections ` +
+            `(COMFYUI_MCP_TUNNEL_BACKEND=relay) are the known case, because the relay protocol does ` +
+            `not forward the browser's handshake Origin.`);
+    }
+    return (`the workflow identity did not validate (uuid ${String(workflowUuid)} against origin ` +
+        `${origin}) — a malformed uuid, or one bound to a different origin.`);
+}
+//# sourceMappingURL=fence-refusal.js.map

package/dist/orchestrator/fence-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fence-refusal.js","sourceRoot":"","sources":["../../src/orchestrator/fence-refusal.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,yEAAyE;AACzE,2DAA2D;AAC3D,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,+EAA+E;AAC/E,sEAAsE;AACtE,4EAA4E;AAM5E,4EAA4E;AAC5E,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,OAAO,CACL,2DAA2D,IAAI,SAAS,KAAK,eAAe;QAC5F,2EAA2E;QAC3E,mFAAmF;QACnF,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,OAAuB;IACtE,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IAC/F,OAAO,mBAAmB,KAAK,wDAAwD,CAAC;AAC1F,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,GAAG,KAAK,iFAAiF,CAAC;AACnG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,MAA0B,EAC1B,YAAqB,EACrB,OAAuB;IAEvB,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,aAAa,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CACL,wFAAwF;YACxF,mFAAmF;YACnF,8EAA8E;YAC9E,yFAAyF;YACzF,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,CACL,gDAAgD,MAAM,CAAC,YAAY,CAAC,kBAAkB;QACtF,GAAG,MAAM,2DAA2D,CACrE,CAAC;AACJ,CAAC"}

package/dist/orchestrator/index.js

@@ -27,6 +27,7 @@ import { isPanelAutoInstallDisabled } from "../services/panel-installer.js";
 import { SelfRestarter, canSelfRestart } from "../services/self-restart.js";
 import { pairUrlDurability } from "./pair-durability.js";
 import { SessionStore, workflowIdentityParts } from "./session-store.js";
+import { unreachableReason, noPanelTabReason, identityReason } from "./fence-refusal.js";
 import { SHARED_SESSION_SCOPE, isScopeAddress, conversationTabs, shouldRetireSharedAgent, messageOrigin, normalizeHelloBackend, workflowOriginNote, } from "../services/session-scope.js";
 import { TurnOriginTracker, makeScopeRepinHandler, makeScopeTargetResolver, } from "./turn-origins.js";
 import { listSessions, loadTranscript } from "./history.js";
@@ -2541,11 +2542,12 @@ export async function runPanelOrchestrator() {
         // log to fall back on. One of these is structurally unsatisfiable for a
         // relay-backend session, and that is invisible without this.
         try {
+            // #1077 — an AMBIGUOUS turn is not a dead tab. Both fail canReach, and
+            // calling the first the second sent the caller to reconnect a panel that
+            // was never disconnected. The wording lives in fence-refusal.ts so it is
+            // testable without standing up the orchestrator.
             if (!bridge.canReach(tabId))
-                return {
-                    ok: false,
-                    reason: `the routed tab (${tabId}) is no longer reachable, so there is nothing to fence`,
-                };
+                return { ok: false, reason: unreachableReason(tabId, bridge.resolveFailure?.(tabId)) };
         }
         catch (err) {
             return {
@@ -2555,25 +2557,13 @@ export async function runPanelOrchestrator() {
         }
         const panelTab = scopeToRealTab(tabId);
         if (!panelTab)
-            return {
-                ok: false,
-                reason: `${tabId} does not resolve to a live panel tab (a scope address whose tab has gone away)`,
-            };
+            return { ok: false, reason: noPanelTabReason(tabId) };
         const origin = bridge.tabServerOrigin(tabId);
         const identity = workflowIdentityParts({ workflowUuid, origin });
         if (!identity)
             return {
                 ok: false,
-                reason: !origin
-                    ? // The relay case, and the one worth naming precisely: this is not
-                        // transient and no amount of refreshing fixes it.
-                        `this tab's connection carries no server-observed Origin, and the workflow ` +
-                            `identity is bound to one — so the fence can never be adopted for it. This is ` +
-                            `structural, not transient: refreshing the tab will not change it. Relay-backend ` +
-                            `connections (COMFYUI_MCP_TUNNEL_BACKEND=relay) are the known case, because the ` +
-                            `relay protocol does not forward the browser's handshake Origin`
-                    : `the workflow identity did not validate (uuid ${String(workflowUuid)} against ` +
-                        `origin ${origin}) — a malformed uuid, or one bound to a different origin`,
+                reason: identityReason(tabId, origin, workflowUuid, bridge.resolveFailure?.(tabId)),
             };
         tabCommandWorkflowUuid.set(panelTab, identity.uuid);
         // #716/#884 — an explicit, VALIDATED open/re-pin from the shared agent is