comfyui-mcp 0.50.82 → 0.50.84

package/dist/orchestrator/panel-tools.js

@@ -960,51 +960,13 @@ async function probeDeclineRecovery(base, windowMs, intervalMs, probeTimeoutMs,
         waited_ms: Date.now() - start,
     };
 }
-/**
- * The FIXED ComfyUI base URL to health-probe during a reboot readiness wait, or
- * null when we must fall back to the panel round-trip (as before #509). Captured by
- * the handler BEFORE it dispatches comfy_reboot and held for the whole wait.
- *
- * SECURITY (coordinator codex P1): the probe TARGET is the orchestrator's own
- * PROCESS-START local ComfyUI endpoint (getBootLocalComfyUIBaseUrl) — captured at
- * boot and IMMUTABLE. It is deliberately NOT getComfyUIBaseUrl(): that reflects the
- * mutable runtime config a panel `hello` can retarget (applyComfyuiUrl →
- * setComfyuiTarget), so a client could steer it. And it is NEVER the client-advertised
- * `hello.comfyui_url` (spoofable; comfyuiFetch would leak the configured ComfyUI auth
- * headers to an attacker-chosen origin). The tab origin is used ONLY as a gate, and the
- * gate reads the SERVER-OBSERVED handshake Origin (tabServerOrigin) — which the browser
- * sets and blocks page JS from forging — NOT the spoofable hello.comfyui_url: we
- * self-probe our OWN boot endpoint solely when the rebooted tab PROVABLY (by its
- * handshake) fronts THAT SAME instance, so a socket that merely CLAIMS the boot URL can't
- * ride an unrelated boot-instance cycle to a false certification (codex High). Null
- * (→ honest dispatched-unconfirmed) when:
- *   - cloud OR remote mode; or
- *   - the orchestrator didn't boot against a LOCAL loopback ComfyUI; or
- *   - the tab isn't SERVER-TRUSTED-local (tabIsLocal — arrived on the token-less
- *     loopback primary listener; relay/tunnel/LAN/pairing → false); or
- *   - the tab's HANDSHAKE origin is absent, ambiguous (`localhost`), or does NOT match our
- *     boot endpoint by scheme+host+port (concrete-family loopback-canonicalized) — i.e. it
- *     drives a DIFFERENT instance / family, or one we can't verify; AND, because a handshake
- *     Origin carries NO path, a boot target mounted under a basePath fails path-aware
- *     identity and is (soundly) fail-closed to dispatched-unconfirmed.
- */
-/**
- * #851 — what to tell the caller about `restart_comfyui` when the panel's confirmation
- * card timed out.
- *
- * The old text recommended it unconditionally. It targets COMFYUI_URL, not the ComfyUI
- * the panel runs inside, so a reporter who followed that advice aimed a restart at a
- * different server than the one they had been working on — and got "No ComfyUI process
- * found on port 8188" while the panel was working fine on the live canvas.
- *
- * `panelBase` comes from captureRebootHealthBase(), which is a PROOF rather than a
- * comparison: null in remote/cloud mode, and whenever the tab's origin cannot be shown
- * to front the local boot instance. "Unproven" is deliberately NOT folded into
- * "different" — that would fire the warning on ordinary remote installs where the two
- * ARE the same server, trading a wrong recommendation for a wrong alarm.
- *
- * Pure, so the three-way decision is testable without a live panel.
- */
+export function classifyTabReconnect({ serverReady, baselineCaptured, tabBack, }) {
+    if (tabBack === true)
+        return true; // a newer hello from the same tab was seen
+    if (!serverReady)
+        return "unknown"; // never watched — the server never came back
+    return baselineCaptured ? false : "unknown";
+}
 export function restartTimeoutFallbackAdvice({ headlessBase, panelBase, observedOrigin = null, }) {
     if (panelBase != null && sameHttpBase(headlessBase, panelBase)) {
         return "or use restart_comfyui to restart the server directly without a panel card.";
@@ -2615,27 +2577,53 @@ function currentWorkflowFence(ctx) {
 function corroborateActiveForFence(parsed) {
     const active = parsed.active;
     if (!active || typeof active !== "object") {
-        return { ok: false, why: "the reply carried no active-workflow record" };
+        // SETTLES: mid-restore the frontend genuinely has no active workflow yet —
+        // that is #1184's finding in this reply's terms, and it is the window here.
+        return { ok: false, why: "the reply carried no active-workflow record", settles: true };
     }
     // #514: the panel says so itself when its active record is not confirmed. An
     // explicit `false` is the panel telling us the value is untrustworthy — never
     // adopt through that. (Absent = an older panel that cannot say; the list
     // corroboration below then has to carry the whole weight.)
     if (parsed.active_confirmed === false) {
-        return { ok: false, why: "the panel reported its active workflow as UNCONFIRMED" };
+        // SETTLES: this is the reported window itself — the panel says "not yet",
+        // and a moment later it says otherwise (#1292).
+        return {
+            ok: false,
+            why: "the panel reported its active workflow as UNCONFIRMED",
+            settles: true,
+        };
     }
     const list = parsed.workflows;
-    if (!Array.isArray(list) || list.length === 0) {
+    // TWO DIFFERENT FACTS, and #1292 made the difference cost real time. An ABSENT
+    // `workflows` field is a property of the installed build — it will not appear
+    // by waiting — while an EMPTY list is a snapshot of what is open right now,
+    // which a mid-restore panel reports before its tabs come back. Folding them
+    // would make every recovery on an older panel 2.9s slower for nothing.
+    if (!Array.isArray(list)) {
         return {
             ok: false,
             why: "the reply carried no open-workflow list to corroborate the active record against",
+            settles: false,
+        };
+    }
+    if (list.length === 0) {
+        return {
+            ok: false,
+            why: "the reply's open-workflow list was empty, so nothing corroborates the active record",
+            settles: true,
         };
     }
     // Only an AFFIRMATIVE per-record flag can nominate the corroborating entry;
     // inferring it from the active object would be circular.
     const flaggedActive = list.filter((w) => !!w && typeof w === "object" && w.active === true);
     if (flaggedActive.length === 0) {
-        return { ok: false, why: "no entry in the open-workflow list is marked active" };
+        // SETTLES: a snapshot taken before the panel re-flagged its active tab.
+        return {
+            ok: false,
+            why: "no entry in the open-workflow list is marked active",
+            settles: true,
+        };
     }
     if (flaggedActive.length > 1) {
         // A mixed/partial snapshot. Exactly the shape that would let another canvas's
@@ -2643,6 +2631,8 @@ function corroborateActiveForFence(parsed) {
         return {
             ok: false,
             why: `${flaggedActive.length} entries in the open-workflow list are marked active (a mixed reply)`,
+            // SETTLES: "mixed" IS the half-reconciled state, by definition.
+            settles: true,
         };
     }
     // Same tri-state primitive the pin path uses. `false` = they name DIFFERENT
@@ -2653,12 +2643,17 @@ function corroborateActiveForFence(parsed) {
         return {
             ok: false,
             why: "the active record and the entry marked active in the open-workflow list name DIFFERENT workflows (a stale or mixed reply)",
+            // SETTLES: a stale half of the snapshot catches up.
+            settles: true,
         };
     }
     if (verdict !== true) {
         return {
             ok: false,
             why: "the active record and the open-workflow list share no comparable identity field, so nothing corroborates it",
+            // DOES NOT SETTLE: a field the records do not carry will not appear by
+            // waiting — that is the reply's SHAPE, not its timing.
+            settles: false,
         };
     }
     return { ok: true, active: active };
@@ -2725,6 +2720,36 @@ WHY THIS READ WAS NEEDED AT ALL: this session's panel is ${v.version}, and a ` +
         return "";
     }
 }
+/**
+ * #1292 — THE RECONCILIATION WINDOW IS OURS TO ABSORB, NOT THE CALLER'S TO WAIT OUT.
+ *
+ * Right after `panel_restart_comfyui` and the tab's reconnect, the panel is
+ * briefly mid-reconciliation: it answers `workflow_list`, but its active record
+ * is marked UNCONFIRMED (or the list is momentarily mixed). Corroboration
+ * correctly refuses — and the caller got a hard failure for a state that fixes
+ * itself, with the remedy "call this again in a moment". The reporter did, and
+ * the identical call returned `already_current`.
+ *
+ * A recovery operation that tells you to retry it is one that has not finished
+ * recovering. So this path rechecks with a FRESH read, three times over ~2.9s.
+ *
+ * WHY THESE AND NOT A LONGER BUDGET: this runs only when the rebind has already
+ * failed, so the cost is paid on a path that was going to fail anyway — but it is
+ * still latency added to a tool call, and the window this covers is a local
+ * process reconnecting. The reporter's five seconds is an upper bound with a
+ * human in it, not a measurement of the settle.
+ *
+ * WHY ONLY `uncorroborated`: the sibling failure `no_uuid` means the installed
+ * panel exposes no workflow identity at all. Rechecking a build that will never
+ * answer differently just makes the same error slower — the distinction the
+ * status already draws, now with teeth.
+ *
+ * The corroboration rule itself does NOT move. It still fails closed on every
+ * attempt; a recheck buys a fresh snapshot to judge, never a lower bar. What
+ * would be unsafe is arbitrating a mixed reply, and that is exactly what is not
+ * happening here.
+ */
+const FENCE_CORROBORATION_RECHECK_STEPS_MS = [400, 900, 1600];
 async function rebindWorkflowFence(ctx) {
     const tabAtStart = ctx.tabId;
     let before = currentWorkflowFence(ctx);
@@ -2738,29 +2763,68 @@ async function rebindWorkflowFence(ctx) {
         if (ctx.tabId !== tabAtStart)
             before = currentWorkflowFence(ctx);
     };
-    let parsed = null;
-    try {
-        const res = await ctx.call({ cmd: "workflow_list" }, 6000);
-        syncFenceToCurrentTab();
-        if (res?.isError) {
-            return await unreadableOrHealed(ctx, before, toolResultText(res));
+    // One read + corroboration. Returns null when the READ failed in a way that is
+    // its own status (`unreadable`/`healed_by_panel`) — those are not the transient
+    // window this rechecks, and the settle inside unreadableOrHealed already covers
+    // the case where the refusal itself repaired the fence.
+    const readAndCorroborate = async () => {
+        let parsed = null;
+        try {
+            const res = await ctx.call({ cmd: "workflow_list" }, 6000);
+            syncFenceToCurrentTab();
+            if (res?.isError) {
+                return { done: await unreadableOrHealed(ctx, before, toolResultText(res)) };
+            }
+            parsed = parseToolResultJson(res);
         }
-        parsed = parseToolResultJson(res);
-    }
-    catch (err) {
-        syncFenceToCurrentTab();
-        return await unreadableOrHealed(ctx, before, err instanceof Error ? err.message : String(err ?? "unknown error"));
-    }
-    if (!parsed) {
-        return await unreadableOrHealed(ctx, before, "the panel's workflow_list reply was not readable as JSON");
+        catch (err) {
+            syncFenceToCurrentTab();
+            return {
+                done: await unreadableOrHealed(ctx, before, err instanceof Error ? err.message : String(err ?? "unknown error")),
+            };
+        }
+        if (!parsed) {
+            return {
+                done: await unreadableOrHealed(ctx, before, "the panel's workflow_list reply was not readable as JSON"),
+            };
+        }
+        // CORROBORATE before adopting. The uuid must come from a record the panel's own
+        // open-workflow list agrees is the live canvas — otherwise a stale or mixed
+        // reply's uuid (valid in shape, belonging to ANOTHER canvas) would overwrite
+        // this tab's stamp and be reported as a successful rebind.
+        return { corroborated: corroborateActiveForFence(parsed) };
+    };
+    const first = await readAndCorroborate();
+    if ("done" in first)
+        return first.done;
+    let corroborated = first.corroborated;
+    let attempts = 1;
+    let waitedMs = 0;
+    // #1292 — recheck the RECONCILIATION WINDOW with a fresh read, never a lower bar.
+    // Only a failure that CAN settle is worth re-reading (codex review, P2): a reply
+    // whose SHAPE is wrong — an older build that sends no `workflows` array, records
+    // sharing no comparable identity field — will say exactly the same thing 2.9s
+    // later, so retrying it just makes the identical error slower. That is the same
+    // reasoning that keeps `no_uuid` out of this loop, applied one level down.
+    for (const waitMs of FENCE_CORROBORATION_RECHECK_STEPS_MS) {
+        if (corroborated.ok || !corroborated.settles)
+            break;
+        await sleep(waitMs);
+        waitedMs += waitMs;
+        attempts++;
+        const next = await readAndCorroborate();
+        if ("done" in next)
+            return next.done;
+        corroborated = next.corroborated;
     }
-    // CORROBORATE before adopting. The uuid must come from a record the panel's own
-    // open-workflow list agrees is the live canvas — otherwise a stale or mixed
-    // reply's uuid (valid in shape, belonging to ANOTHER canvas) would overwrite
-    // this tab's stamp and be reported as a successful rebind.
-    const corroborated = corroborateActiveForFence(parsed);
     if (!corroborated.ok) {
-        return { status: "no_identity", before, kind: "uncorroborated", why: corroborated.why };
+        return {
+            status: "no_identity",
+            before,
+            kind: "uncorroborated",
+            why: corroborated.why,
+            rechecks: { attempts, waitedMs, settles: corroborated.settles },
+        };
     }
     const active = corroborated.active;
     const uuid = responseWorkflowUuid(active);
@@ -3100,9 +3164,28 @@ panelGapNote = "") {
                         `plain reload can serve the same cached bundle again; only a hard refresh replaces ` +
                         `it. If a hard refresh does not help, the installed pack itself predates the ` +
                         `per-workflow identity and must be UPDATED — no rebind can add it.`
-                    : `\n\nWHAT TO DO: call this again in a moment. A stale or mixed workflow list is ` +
-                        `usually transient — it settles once the panel finishes reconciling its tabs. If ` +
-                        `it persists across a few attempts: ${RELOAD_TAB_REMEDY}`;
+                    : // #1292 — DO NOT PRESCRIBE WHAT WE JUST DID. This path now rechecks
+                        // with fresh reads before failing, so "call this again in a moment"
+                        // would be advice the tool already took on the caller's behalf — and
+                        // taking it a fourth time is the least likely thing left to work.
+                        // When the rechecks ran, say so and move on to the remedy that has
+                        // not been tried.
+                        (r.rechecks && !r.rechecks.settles
+                            ? // Waiting cannot fix a reply whose SHAPE is wrong, so do not
+                                // prescribe waiting. This said "call this again in a moment" to
+                                // a caller whose panel will answer identically forever.
+                                `\n\nWHY RETRYING WILL NOT HELP: this is the shape of the panel's reply, not a ` +
+                                    `moment in its reconciliation — a later read answers the same way. ` +
+                                    `${RELOAD_TAB_REMEDY} If it survives a hard refresh, the installed pack is too ` +
+                                    `old to corroborate its own active workflow and must be UPDATED.`
+                            : r.rechecks && r.rechecks.attempts > 1
+                                ? `\n\nALREADY TRIED: the panel was re-read ${r.rechecks.attempts} times over ` +
+                                    `~${(r.rechecks.waitedMs / 1000).toFixed(1)}s and never corroborated. That window ` +
+                                    `covers the usual post-restart reconciliation, so this is probably NOT the ` +
+                                    `transient case.\n\nWHAT TO DO: ${RELOAD_TAB_REMEDY}`
+                                : `\n\nWHAT TO DO: call this again in a moment. A stale or mixed workflow list is ` +
+                                    `usually transient — it settles once the panel finishes reconciling its tabs. ` +
+                                    `If it persists across a few attempts: ${RELOAD_TAB_REMEDY}`);
                 if (!r.before.known) {
                     return {
                         binding: "unverified",
@@ -9036,12 +9119,20 @@ export function buildPanelToolDefs() {
                                 : true
                         : false;
                     const graphToolsReady = tabBack && (ctx.tabCanMutateGraph ? ctx.tabCanMutateGraph() : true);
+                    // #654 — `ready`/`graph_tools_ready` still come from the BOOLEAN, so an
+                    // undetermined reconnect withholds graph tools exactly as before. Only
+                    // the reported observation changes.
+                    const tabReconnect = classifyTabReconnect({
+                        serverReady: recovery.ready,
+                        baselineCaptured: preRestartPanelIdentity != null,
+                        tabBack,
+                    });
                     return ok({
                         rebooting: true,
                         ready: graphToolsReady,
                         graph_tools_ready: graphToolsReady,
                         server_ready: recovery.ready,
-                        panel_tab_reconnected: tabBack,
+                        panel_tab_reconnected: tabReconnect,
                         confirmed_cycle: observed, // true = we directly observed the down→up cycle
                         recovered_ms: recovery.waited_ms,
                         probes: recovery.attempts,
@@ -9051,8 +9142,20 @@ export function buildPanelToolDefs() {
                             ? "ComfyUI-Manager (legacy 3.x) had no reboot endpoint; the headless managed restart " +
                                 `came back healthy in ${(recovery.waited_ms / 1000).toFixed(1)}s, but ` +
                                 (!tabBack
-                                    ? "the panel tab has NOT reconnected yet (ready:false). Wait a moment then retry, or " +
-                                        'rebind with panel_set_workflow_target({mode:"current"}) before issuing graph tools.'
+                                    ? tabReconnect === "unknown"
+                                        ? "whether the panel tab reconnected could NOT be determined — no pre-restart " +
+                                            "baseline was captured for it, so nothing was watched. WHY is not established " +
+                                            "here, and it is one of: the tab's socket was not open at the instant the " +
+                                            "restart was dispatched; the panel advertised no tab session id (an older " +
+                                            "build, or its browser-tab lease was refused because a duplicate tab holds " +
+                                            "it); or the tab did not resolve at all. The tab may well be back. Graph " +
+                                            "tools are withheld (ready:false) because that is unproven, NOT because the " +
+                                            'tab is known to be gone: call panel_list_workflows or panel_set_workflow_target({mode:"current"}) ' +
+                                            "to find out, and only refresh the browser if those also fail. If this " +
+                                            "repeats on every restart, the panel is probably too old to advertise a tab " +
+                                            "session id — update it."
+                                        : "the panel tab has NOT reconnected yet (ready:false). Wait a moment then retry, or " +
+                                            'rebind with panel_set_workflow_target({mode:"current"}) before issuing graph tools.'
                                     : "the panel tab reconnected but cannot safely run graph mutations (ready:false), usually " +
                                         "because it is still running a stale panel bundle. Hard-refresh the ComfyUI browser tab " +
                                         "(Ctrl+Shift+R) before issuing graph tools; if that does not restore it, update the panel " +
@@ -9171,6 +9274,14 @@ export function buildPanelToolDefs() {
             // Old/lightweight contexts have no capability accessor, so preserve their historical
             // contract rather than claiming a production tab passed a check it never ran.
             const graphToolsReady = tabBack && (ctx.tabCanMutateGraph ? ctx.tabCanMutateGraph() : true);
+            // #654 — same split as the legacy path above. The gate is unchanged:
+            // `ready`/`graph_tools_ready` still key off the boolean, so an undetermined
+            // reconnect still withholds graph tools. Only the reported observation changes.
+            const tabReconnect = classifyTabReconnect({
+                serverReady: true, // this branch only runs on a confirmed healthy cycle
+                baselineCaptured: preRestartPanelIdentity != null,
+                tabBack,
+            });
             // #848: WHAT THIS RESTART DID NOT DO. "It came back healthy" answers a
             // different question from "did it come back with the launch arguments I just
             // configured?", and a user who had edited ComfyUI Desktop's saved launch args
@@ -9207,7 +9318,7 @@ export function buildPanelToolDefs() {
                 probes: recovery.attempts,
                 saw_down: recovery.sawDown,
                 via: recovery.via,
-                panel_tab_reconnected: tabBack,
+                panel_tab_reconnected: tabReconnect,
                 note: (tabBack && !graphToolsReady
                     ? `ComfyUI restart accepted and it is healthy again in ${(recovery.waited_ms / 1000).toFixed(1)}s` +
                         " (observed it go down then come back); the panel tab reconnected but cannot safely run " +
@@ -9219,9 +9330,20 @@ export function buildPanelToolDefs() {
                         (dropped ? "; connection dropped as expected while it went down" : "") +
                         (tabBack
                             ? "; the panel tab reconnected — graph tools are ready."
-                            : "; ComfyUI is back but the panel tab has NOT reconnected yet (ready:false) — " +
-                                'wait a moment then retry, or rebind with panel_set_workflow_target({mode:"current"}) ' +
-                                "before issuing graph tools.") +
+                            : tabReconnect === "unknown"
+                                ? "; ComfyUI is back, but whether the panel tab reconnected could NOT be determined — no " +
+                                    "pre-restart baseline was captured for it, so nothing was watched. WHY is not " +
+                                    "established here, and it is one of: its socket was not open at the instant the " +
+                                    "restart was dispatched; the panel advertised no tab session id (an older build, or " +
+                                    "a refused browser-tab lease); or the tab did not resolve at all. The tab may well " +
+                                    "be back. Graph tools are withheld (ready:false) because that is UNPROVEN, not " +
+                                    "because the tab is known to be gone: call panel_list_workflows or " +
+                                    'panel_set_workflow_target({mode:"current"}) to find out, and refresh the browser only ' +
+                                    "if those also fail. If this repeats on every restart, the panel is probably too old " +
+                                    "to advertise a tab session id — update it."
+                                : "; ComfyUI is back but the panel tab has NOT reconnected yet (ready:false) — " +
+                                    'wait a moment then retry, or rebind with panel_set_workflow_target({mode:"current"}) ' +
+                                    "before issuing graph tools.") +
                         ".") + argvNote,
             });
         }),