comfyui-mcp 0.50.65 → 0.50.67

package/README.md

@@ -797,7 +797,6 @@ src/
     model-resolver.ts      # HuggingFace search, local models, downloads
     generation-tracker.ts  # SQLite generation log, settings dedup, stats
     file-hasher.ts         # SHA256 hashing of .safetensors with cache
-    civitai-lookup.ts      # CivitAI API lookup by content hash
     workflow-settings-extractor.ts  # Extract settings from workflow JSON
     process-control.ts     # Stop, start, restart ComfyUI process
     registry-client.ts     # ComfyUI Registry API

package/dist/orchestrator/fence-refusal.js

@@ -47,11 +47,16 @@ export function identityReason(tabId, origin, workflowUuid, failure) {
         return ambiguousTurn(tabId, "no single tab's identity could be read");
     }
     if (!origin) {
+        // The relay case USED to land here and was told, correctly at the time, that
+        // its problem was permanent. It no longer is: the relay path now supplies the
+        // origin it already knows from COMFYUI_URL, so a relay session adopts fences
+        // like any other. Naming a fixed cause as the "known case" would send a
+        // reader to change a backend that is no longer the reason (#1077).
         return (`this tab's connection carries no server-observed Origin, and the workflow identity is ` +
-            `bound to one — so the fence can never be adopted for it. This is structural, not ` +
-            `transient: refreshing the tab will not change it. Relay-backend connections ` +
-            `(COMFYUI_MCP_TUNNEL_BACKEND=relay) are the known case, because the relay protocol does ` +
-            `not forward the browser's handshake Origin.`);
+            `bound to one — so the fence cannot be adopted for it. Refreshing the tab will not ` +
+            `change it. This means the connection reached the orchestrator by a path that neither ` +
+            `observed nor was told the panel's origin; if COMFYUI_URL is unset or unparseable for ` +
+            `this session, setting it to the URL the panel is served from is what supplies it.`);
     }
     return (`the workflow identity did not validate (uuid ${String(workflowUuid)} against origin ` +
         `${origin}) — a malformed uuid, or one bound to a different origin.`);

package/dist/orchestrator/fence-refusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"fence-refusal.js","sourceRoot":"","sources":["../../src/orchestrator/fence-refusal.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,yEAAyE;AACzE,2DAA2D;AAC3D,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,+EAA+E;AAC/E,sEAAsE;AACtE,4EAA4E;AAM5E,4EAA4E;AAC5E,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,OAAO,CACL,2DAA2D,IAAI,SAAS,KAAK,eAAe;QAC5F,2EAA2E;QAC3E,mFAAmF;QACnF,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,OAAuB;IACtE,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IAC/F,OAAO,mBAAmB,KAAK,wDAAwD,CAAC;AAC1F,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,GAAG,KAAK,iFAAiF,CAAC;AACnG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,MAA0B,EAC1B,YAAqB,EACrB,OAAuB;IAEvB,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,aAAa,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CACL,wFAAwF;YACxF,mFAAmF;YACnF,8EAA8E;YAC9E,yFAAyF;YACzF,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,CACL,gDAAgD,MAAM,CAAC,YAAY,CAAC,kBAAkB;QACtF,GAAG,MAAM,2DAA2D,CACrE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"fence-refusal.js","sourceRoot":"","sources":["../../src/orchestrator/fence-refusal.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,yEAAyE;AACzE,2DAA2D;AAC3D,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,+EAA+E;AAC/E,sEAAsE;AACtE,4EAA4E;AAM5E,4EAA4E;AAC5E,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,OAAO,CACL,2DAA2D,IAAI,SAAS,KAAK,eAAe;QAC5F,2EAA2E;QAC3E,mFAAmF;QACnF,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,OAAuB;IACtE,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IAC/F,OAAO,mBAAmB,KAAK,wDAAwD,CAAC;AAC1F,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,GAAG,KAAK,iFAAiF,CAAC;AACnG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,MAA0B,EAC1B,YAAqB,EACrB,OAAuB;IAEvB,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,aAAa,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,6EAA6E;QAC7E,8EAA8E;QAC9E,6EAA6E;QAC7E,wEAAwE;QACxE,mEAAmE;QACnE,OAAO,CACL,wFAAwF;YACxF,oFAAoF;YACpF,uFAAuF;YACvF,uFAAuF;YACvF,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,CACL,gDAAgD,MAAM,CAAC,YAAY,CAAC,kBAAkB;QACtF,GAAG,MAAM,2DAA2D,CACrE,CAAC;AACJ,CAAC"}

package/dist/orchestrator/panel-tools.js

@@ -714,7 +714,10 @@ function isLoopbackHostName(host) {
 }
 /** The scheme://host:port origin of a URL (default ports made explicit), or null if
  *  unparseable. Loopback hosts canonicalize to their FAMILY loopback (v4 → 127.0.0.1,
- *  v6 → ::1) — so localhost/127.0.0.1/0.0.0.0 compare equal, and ::1/:: compare equal,
+ *  v6 → ::1) — so 127.0.0.1/0.0.0.0 compare equal, and ::1/:: compare equal. NOTE:
+ *  `localhost` is deliberately NOT folded (loopbackFamily returns null for it), so it
+ *  compares UNEQUAL to a concrete literal — callers that would harm a user by treating
+ *  that as proof of difference must degrade it to "unknown" themselves (#1233),
  *  but a v4 host and a v6 host DIFFER (they may be different instances). Ports differ. */
 function httpOriginOf(rawUrl) {
     try {
@@ -1002,14 +1005,50 @@ async function probeDeclineRecovery(base, windowMs, intervalMs, probeTimeoutMs,
  *
  * Pure, so the three-way decision is testable without a live panel.
  */
-export function restartTimeoutFallbackAdvice({ headlessBase, panelBase, }) {
+export function restartTimeoutFallbackAdvice({ headlessBase, panelBase, observedOrigin = null, }) {
     if (panelBase != null && sameHttpBase(headlessBase, panelBase)) {
         return "or use restart_comfyui to restart the server directly without a panel card.";
     }
-    if (panelBase != null) {
+    // Proven different: either the proof resolved a base that differs, or the observed
+    // origin — which the browser sets and page JS cannot forge — differs outright.
+    // ORIGIN-only compare for the raw Origin, deliberately. `tabServerOrigin` is pathless
+    // (scheme+host+port — the browser sends no path on a WS upgrade), while `headlessBase`
+    // may carry a basePath mount such as :8188/comfy. A path-AWARE compare therefore reads
+    // a correctly-mounted install as a mismatch and fires the strong warning at a server
+    // that IS the right one — the cry-wolf failure this branch exists to avoid, which is
+    // how it was found. A pathless Origin can prove a different host:port; it cannot prove
+    // a different path, so it is only ever used for the claim it can actually support.
+    // (captureRebootHealthBase fails closed on the same ambiguity for the same reason.)
+    // #1233 (codex) — a DNS-ambiguous `localhost` on EITHER side is NOT proof of a
+    // different server. loopbackFamily() deliberately excludes it (a coordinator P0: it
+    // can resolve to either family, or to something else entirely), so `localhost:8188`
+    // vs `127.0.0.1:8188` canonicalizes unequal and would fire the strong warning at what
+    // is very likely the same instance. Absence of proof is not proof of difference, so
+    // an ambiguous host degrades to UNPROVEN — the same direction captureRebootHealthBase
+    // takes for the same input.
+    const dnsAmbiguous = (u) => {
+        if (!u)
+            return false;
+        try {
+            return new URL(u).hostname.toLowerCase().replace(/^\[|\]$/g, "") === "localhost";
+        }
+        catch {
+            return false;
+        }
+    };
+    const originMismatch = observedOrigin != null &&
+        !dnsAmbiguous(observedOrigin) &&
+        !dnsAmbiguous(headlessBase) &&
+        !sameHttpOrigin(headlessBase, observedOrigin)
+        ? observedOrigin
+        : null;
+    const proven = panelBase ?? originMismatch;
+    if (proven != null) {
         return (`Do NOT reach for restart_comfyui here without checking: it targets ${headlessBase}, ` +
-            `while this panel is running inside ${panelBase}. Restarting the first would hit a ` +
-            "different server than the one you have been working on — and may find nothing there at all.");
+            `while this panel is running inside ${proven}. Restarting the first would hit a ` +
+            "different server than the one you have been working on. That may find nothing there " +
+            "at all — or it may SUCCEED and take down a ComfyUI you did not mean to touch, which " +
+            "on a shared instance is the worse outcome.");
     }
     return (`or use restart_comfyui, which restarts ${headlessBase} directly without a panel ` +
         "card — check that this is the same ComfyUI you have been working on, since I " +
@@ -8100,6 +8139,9 @@ export function buildPanelToolDefs() {
                 const fallback = restartTimeoutFallbackAdvice({
                     headlessBase: getComfyUIBaseUrl(),
                     panelBase: captureRebootHealthBase(ctx),
+                    // #1233 — the raw observed origin, so a CONFIRMED mismatch is not lost inside
+                    // the proof's null. Server-observed on the WS upgrade; page JS cannot forge it.
+                    observedOrigin: ctx.bridge?.tabServerOrigin?.(ctx.tabId) ?? null,
                 });
                 return ok(`No confirmation received within ${Math.round(confirmBudget / 1000)}s, so I did NOT ` +
                     "restart ComfyUI. The panel tab may be backgrounded or still reconnecting after a " +