comfyui-mcp 0.50.82 → 0.50.83

package/dist/orchestrator/panel-tools.js

@@ -960,51 +960,13 @@ async function probeDeclineRecovery(base, windowMs, intervalMs, probeTimeoutMs,
         waited_ms: Date.now() - start,
     };
 }
-/**
- * The FIXED ComfyUI base URL to health-probe during a reboot readiness wait, or
- * null when we must fall back to the panel round-trip (as before #509). Captured by
- * the handler BEFORE it dispatches comfy_reboot and held for the whole wait.
- *
- * SECURITY (coordinator codex P1): the probe TARGET is the orchestrator's own
- * PROCESS-START local ComfyUI endpoint (getBootLocalComfyUIBaseUrl) — captured at
- * boot and IMMUTABLE. It is deliberately NOT getComfyUIBaseUrl(): that reflects the
- * mutable runtime config a panel `hello` can retarget (applyComfyuiUrl →
- * setComfyuiTarget), so a client could steer it. And it is NEVER the client-advertised
- * `hello.comfyui_url` (spoofable; comfyuiFetch would leak the configured ComfyUI auth
- * headers to an attacker-chosen origin). The tab origin is used ONLY as a gate, and the
- * gate reads the SERVER-OBSERVED handshake Origin (tabServerOrigin) — which the browser
- * sets and blocks page JS from forging — NOT the spoofable hello.comfyui_url: we
- * self-probe our OWN boot endpoint solely when the rebooted tab PROVABLY (by its
- * handshake) fronts THAT SAME instance, so a socket that merely CLAIMS the boot URL can't
- * ride an unrelated boot-instance cycle to a false certification (codex High). Null
- * (→ honest dispatched-unconfirmed) when:
- *   - cloud OR remote mode; or
- *   - the orchestrator didn't boot against a LOCAL loopback ComfyUI; or
- *   - the tab isn't SERVER-TRUSTED-local (tabIsLocal — arrived on the token-less
- *     loopback primary listener; relay/tunnel/LAN/pairing → false); or
- *   - the tab's HANDSHAKE origin is absent, ambiguous (`localhost`), or does NOT match our
- *     boot endpoint by scheme+host+port (concrete-family loopback-canonicalized) — i.e. it
- *     drives a DIFFERENT instance / family, or one we can't verify; AND, because a handshake
- *     Origin carries NO path, a boot target mounted under a basePath fails path-aware
- *     identity and is (soundly) fail-closed to dispatched-unconfirmed.
- */
-/**
- * #851 — what to tell the caller about `restart_comfyui` when the panel's confirmation
- * card timed out.
- *
- * The old text recommended it unconditionally. It targets COMFYUI_URL, not the ComfyUI
- * the panel runs inside, so a reporter who followed that advice aimed a restart at a
- * different server than the one they had been working on — and got "No ComfyUI process
- * found on port 8188" while the panel was working fine on the live canvas.
- *
- * `panelBase` comes from captureRebootHealthBase(), which is a PROOF rather than a
- * comparison: null in remote/cloud mode, and whenever the tab's origin cannot be shown
- * to front the local boot instance. "Unproven" is deliberately NOT folded into
- * "different" — that would fire the warning on ordinary remote installs where the two
- * ARE the same server, trading a wrong recommendation for a wrong alarm.
- *
- * Pure, so the three-way decision is testable without a live panel.
- */
+export function classifyTabReconnect({ serverReady, baselineCaptured, tabBack, }) {
+    if (tabBack === true)
+        return true; // a newer hello from the same tab was seen
+    if (!serverReady)
+        return "unknown"; // never watched — the server never came back
+    return baselineCaptured ? false : "unknown";
+}
 export function restartTimeoutFallbackAdvice({ headlessBase, panelBase, observedOrigin = null, }) {
     if (panelBase != null && sameHttpBase(headlessBase, panelBase)) {
         return "or use restart_comfyui to restart the server directly without a panel card.";
@@ -9036,12 +8998,20 @@ export function buildPanelToolDefs() {
                                 : true
                         : false;
                     const graphToolsReady = tabBack && (ctx.tabCanMutateGraph ? ctx.tabCanMutateGraph() : true);
+                    // #654 — `ready`/`graph_tools_ready` still come from the BOOLEAN, so an
+                    // undetermined reconnect withholds graph tools exactly as before. Only
+                    // the reported observation changes.
+                    const tabReconnect = classifyTabReconnect({
+                        serverReady: recovery.ready,
+                        baselineCaptured: preRestartPanelIdentity != null,
+                        tabBack,
+                    });
                     return ok({
                         rebooting: true,
                         ready: graphToolsReady,
                         graph_tools_ready: graphToolsReady,
                         server_ready: recovery.ready,
-                        panel_tab_reconnected: tabBack,
+                        panel_tab_reconnected: tabReconnect,
                         confirmed_cycle: observed, // true = we directly observed the down→up cycle
                         recovered_ms: recovery.waited_ms,
                         probes: recovery.attempts,
@@ -9051,8 +9021,20 @@ export function buildPanelToolDefs() {
                             ? "ComfyUI-Manager (legacy 3.x) had no reboot endpoint; the headless managed restart " +
                                 `came back healthy in ${(recovery.waited_ms / 1000).toFixed(1)}s, but ` +
                                 (!tabBack
-                                    ? "the panel tab has NOT reconnected yet (ready:false). Wait a moment then retry, or " +
-                                        'rebind with panel_set_workflow_target({mode:"current"}) before issuing graph tools.'
+                                    ? tabReconnect === "unknown"
+                                        ? "whether the panel tab reconnected could NOT be determined — no pre-restart " +
+                                            "baseline was captured for it, so nothing was watched. WHY is not established " +
+                                            "here, and it is one of: the tab's socket was not open at the instant the " +
+                                            "restart was dispatched; the panel advertised no tab session id (an older " +
+                                            "build, or its browser-tab lease was refused because a duplicate tab holds " +
+                                            "it); or the tab did not resolve at all. The tab may well be back. Graph " +
+                                            "tools are withheld (ready:false) because that is unproven, NOT because the " +
+                                            'tab is known to be gone: call panel_list_workflows or panel_set_workflow_target({mode:"current"}) ' +
+                                            "to find out, and only refresh the browser if those also fail. If this " +
+                                            "repeats on every restart, the panel is probably too old to advertise a tab " +
+                                            "session id — update it."
+                                        : "the panel tab has NOT reconnected yet (ready:false). Wait a moment then retry, or " +
+                                            'rebind with panel_set_workflow_target({mode:"current"}) before issuing graph tools.'
                                     : "the panel tab reconnected but cannot safely run graph mutations (ready:false), usually " +
                                         "because it is still running a stale panel bundle. Hard-refresh the ComfyUI browser tab " +
                                         "(Ctrl+Shift+R) before issuing graph tools; if that does not restore it, update the panel " +
@@ -9171,6 +9153,14 @@ export function buildPanelToolDefs() {
             // Old/lightweight contexts have no capability accessor, so preserve their historical
             // contract rather than claiming a production tab passed a check it never ran.
             const graphToolsReady = tabBack && (ctx.tabCanMutateGraph ? ctx.tabCanMutateGraph() : true);
+            // #654 — same split as the legacy path above. The gate is unchanged:
+            // `ready`/`graph_tools_ready` still key off the boolean, so an undetermined
+            // reconnect still withholds graph tools. Only the reported observation changes.
+            const tabReconnect = classifyTabReconnect({
+                serverReady: true, // this branch only runs on a confirmed healthy cycle
+                baselineCaptured: preRestartPanelIdentity != null,
+                tabBack,
+            });
             // #848: WHAT THIS RESTART DID NOT DO. "It came back healthy" answers a
             // different question from "did it come back with the launch arguments I just
             // configured?", and a user who had edited ComfyUI Desktop's saved launch args
@@ -9207,7 +9197,7 @@ export function buildPanelToolDefs() {
                 probes: recovery.attempts,
                 saw_down: recovery.sawDown,
                 via: recovery.via,
-                panel_tab_reconnected: tabBack,
+                panel_tab_reconnected: tabReconnect,
                 note: (tabBack && !graphToolsReady
                     ? `ComfyUI restart accepted and it is healthy again in ${(recovery.waited_ms / 1000).toFixed(1)}s` +
                         " (observed it go down then come back); the panel tab reconnected but cannot safely run " +
@@ -9219,9 +9209,20 @@ export function buildPanelToolDefs() {
                         (dropped ? "; connection dropped as expected while it went down" : "") +
                         (tabBack
                             ? "; the panel tab reconnected — graph tools are ready."
-                            : "; ComfyUI is back but the panel tab has NOT reconnected yet (ready:false) — " +
-                                'wait a moment then retry, or rebind with panel_set_workflow_target({mode:"current"}) ' +
-                                "before issuing graph tools.") +
+                            : tabReconnect === "unknown"
+                                ? "; ComfyUI is back, but whether the panel tab reconnected could NOT be determined — no " +
+                                    "pre-restart baseline was captured for it, so nothing was watched. WHY is not " +
+                                    "established here, and it is one of: its socket was not open at the instant the " +
+                                    "restart was dispatched; the panel advertised no tab session id (an older build, or " +
+                                    "a refused browser-tab lease); or the tab did not resolve at all. The tab may well " +
+                                    "be back. Graph tools are withheld (ready:false) because that is UNPROVEN, not " +
+                                    "because the tab is known to be gone: call panel_list_workflows or " +
+                                    'panel_set_workflow_target({mode:"current"}) to find out, and refresh the browser only ' +
+                                    "if those also fail. If this repeats on every restart, the panel is probably too old " +
+                                    "to advertise a tab session id — update it."
+                                : "; ComfyUI is back but the panel tab has NOT reconnected yet (ready:false) — " +
+                                    'wait a moment then retry, or rebind with panel_set_workflow_target({mode:"current"}) ' +
+                                    "before issuing graph tools.") +
                         ".") + argvNote,
             });
         }),