comfyui-mcp 0.50.33 → 0.50.35

package/dist/orchestrator/index.js

@@ -26,6 +26,7 @@ import { panelRecoveryContext } from "../services/panel-recovery.js";
 import { isPanelAutoInstallDisabled } from "../services/panel-installer.js";
 import { SelfRestarter, canSelfRestart } from "../services/self-restart.js";
 import { pairUrlDurability } from "./pair-durability.js";
+import { loadOrCreatePairToken } from "./pair-token-store.js";
 import { SessionStore, workflowIdentityParts } from "./session-store.js";
 import { unreachableReason, noPanelTabReason, identityReason } from "./fence-refusal.js";
 import { SHARED_SESSION_SCOPE, isScopeAddress, conversationTabs, shouldRetireSharedAgent, messageOrigin, normalizeHelloBackend, workflowOriginNote, } from "../services/session-scope.js";
@@ -912,9 +913,32 @@ export async function runPanelOrchestrator() {
     let pairToken = envPairToken;
     let pairListenerStarted = false;
     let pairTunnel = null;
+    /**
+     * #875 — is a phone paired over a TUNNEL right now?
+     *
+     * Gates the self-restarter (see its allIdle below). A tunnel URL cannot survive
+     * a restart: cloudflared mints a fresh quick-tunnel hostname per run and there
+     * is no way to pin it, so restarting under a live tunnel breaks a phone that is
+     * connected at that moment. A LAN URL is fine — the token persists now — which
+     * is why this is narrowed to the tunnel rather than to pairing in general.
+     */
+    // Requires BOTH: a tunnel exists AND a client is connected through it right
+    // now. `pairTunnel` alone is not liveness — nothing stops the tunnel until the
+    // process exits, so gating on it would postpone every future update after a
+    // single pairing, rather than deferring to the next disconnect as intended.
+    const tunnelPairingLive = () => pairTunnel !== null && bridge.hasLiveHeadlessClient();
+    // #875 — the token is PERSISTED, not per-session. It used to be minted fresh on
+    // every run, so a self-restart (on by default, hourly npm check) invalidated the
+    // URL the phone had saved. The reporter experienced that as "updating the npm
+    // version bricks my communication with the agent" and asked to pin the version;
+    // the version was never the cause. An explicit COMFYUI_MCP_PAIR_TOKEN still wins.
+    let pairTokenPersisted = envPairToken !== null;
     const ensurePairListener = async () => {
-        if (!pairToken)
-            pairToken = randomBytes(24).toString("hex");
+        if (!pairToken) {
+            const loaded = loadOrCreatePairToken();
+            pairToken = loaded.token;
+            pairTokenPersisted = loaded.persisted;
+        }
         if (!pairListenerStarted) {
             await bridge.addListener("0.0.0.0", pairPort, pairToken);
             pairListenerStarted = true;
@@ -3966,7 +3990,7 @@ export async function runPanelOrchestrator() {
                 // cause, and nothing here had told them.
                 const durability = pairUrlDurability({
                     mode,
-                    pinnedToken: envPairToken !== null,
+                    stableToken: envPairToken !== null || pairTokenPersisted,
                     autoRestart: canSelfRestart(),
                 });
                 logger.info(`[panel-orchestrator] pairing URL minted (${mode}) — ` +
@@ -5545,7 +5569,20 @@ export async function runPanelOrchestrator() {
             // …and the same for an ask answer the user actually gave that has not
             // reached the agent yet (#486). Restarting would destroy it silently.
             !AskAnswers.hasOutstanding() &&
-            !QueueMonitor.isBusy(),
+            !QueueMonitor.isBusy() &&
+            // #875 — a LIVE TUNNEL PAIRING SESSION defers the restart to the next
+            // disconnect. The token now persists, so a LAN URL survives a restart; a
+            // tunnel URL cannot, because cloudflared mints a fresh quick-tunnel
+            // hostname every run and there is no way to pin it. Restarting under a live
+            // tunnel therefore breaks a phone that is connected RIGHT NOW, to install
+            // an update nobody asked for at that moment — which is what the reporter
+            // experienced and (reasonably) blamed on the npm version.
+            //
+            // Deferral, not cancellation: the update check still runs and the restart
+            // stays armed, so it fires as soon as the tunnel goes away. The cost is
+            // that a tunnel left up indefinitely postpones updates indefinitely, which
+            // is why noteTunnelDeferral announces it rather than doing it silently.
+            !tunnelPairingLive(),
         announce: (text) => void bridge.push({ type: "say", text }),
         teardown: teardownCore,
     });