comfyui-mcp 0.50.97 → 0.50.99

package/dist/orchestrator/panel-tools.js

@@ -697,6 +697,40 @@ function isWorkflowSwitchGuardRefusal(err) {
     const msg = err instanceof Error ? err.message : String(err ?? "");
     return /panel is switching\/refreshing|panel is switching or reloading/i.test(msg);
 }
+/**
+ * #1330 — the panel's workflow-instance fence refused this command.
+ *
+ * Distinct from every other refusal here in one way that matters: the panel checks the
+ * fence BEFORE the handler runs, so "Nothing was applied" is structural, not a claim.
+ * That is what makes it safe to tell a caller to retry — and it is why this is worth
+ * separating from the transport failures around it, where the outcome is unknown.
+ *
+ * Matched on the leading token the panel preserves deliberately for exactly this
+ * purpose (see workflowInstanceMismatchMessage: "the leading `workflow instance
+ * mismatch:` token is preserved deliberately").
+ */
+function isWorkflowInstanceMismatch(err) {
+    const msg = err instanceof Error ? err.message : String(err ?? "");
+    return /workflow instance mismatch/i.test(msg);
+}
+/**
+ * #1331 — the bridge refused a mutation because the active workflow has no identity to
+ * fence against (ui-bridge's `no trusted identity` branch).
+ *
+ * A DIFFERENT refusal from the one above, and the pair is easy to conflate: that one is
+ * two identities disagreeing, this one is there being no identity at all. They also need
+ * different handling — a mismatch may clear by itself, this never does.
+ *
+ * Kept separate from the capability refusal beside it because those need opposite
+ * advice: a capability gap needs a panel UPDATE, this needs the workflow re-opened. What
+ * they share is that the generic "retry / rebind with mode:current" wrapper can clear
+ * NEITHER, and appending it sent the reporter of #1331 through four calls to reach a
+ * state the panel already believed it was in.
+ */
+function isNoTrustedIdentityRefusal(err) {
+    const msg = err instanceof Error ? err.message : String(err ?? "");
+    return /no trusted identity/i.test(msg);
+}
 let retrySettleMsOverride = null;
 /** Short pause before the single post-drop retry, letting the replacement tab
  *  finish its reconnect hello so ensureReachable can resolve it. Test-overridable. */
@@ -4916,6 +4950,115 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets) {
             // sent agents into a futile retry/rebind loop that contradicted the embedded
             // guidance. Key on the TYPED marker and surface the cause verbatim instead; it
             // already names the real recovery (update + restart + browser hard-refresh).
+            // #1331 — DECIDE WHICH "no trusted identity" THIS IS, instead of asserting one.
+            //
+            // The reporter was told to "retry in a moment, or rebind with
+            // panel_set_workflow_target({mode:"current"})", followed it, and it did not work:
+            // recovery took panel_open_workflow on the workflow that was ALREADY active —
+            // four calls to reach a state the panel already believed it was in.
+            //
+            // But that advice is NOT always wrong, and my first attempt at this deleted it
+            // outright — which #709's test caught. Two different states produce the identical
+            // bridge message, and they need opposite remedies:
+            //
+            //   session bound to a STALE tab, live canvas HAS an identity
+            //        → rebinding genuinely re-resolves it (#709). The advice is correct.
+            //   the LIVE canvas itself has no identity
+            //        → the rebind READS an identity to adopt and finds none, so it reports
+            //          success while every mutation keeps failing (#1331).
+            //
+            // The bridge cannot tell them apart — from its side both are "no identity". The
+            // orchestrator can, with the same read-only re-derivation the documented recovery
+            // performs. So it is measured, once, and the answer names the remedy that fits.
+            if (isNoTrustedIdentityRefusal(err) && isMutatingGraphCmd(cmd)) {
+                const raw = err instanceof Error ? err.message : String(err);
+                try {
+                    const rebind = await rebindWorkflowFence(ctx);
+                    if (rebind.status === "no_identity") {
+                        return fail(`${raw}\n\nCHECKED, so this is not a guess: the live canvas was re-read and it ` +
+                            `carries no workflow identity either (${rebind.why}). ` +
+                            `panel_set_workflow_target({mode:"current"}) will NOT clear this — it chooses ` +
+                            `WHICH workflow to fence against and cannot mint an identity for one that has ` +
+                            `none, so it reports success while every mutation keeps failing. RECOVERY: ` +
+                            `panel_open_workflow(<path>) on this same workflow; re-opening it is what gives ` +
+                            `it an identity. If it has never been saved there is no path to re-open — save ` +
+                            `it first with panel_save_workflow, which also gives it a stable identity.`);
+                    }
+                    if (rebind.status === "refreshed" || rebind.status === "already_current") {
+                        return fail(`${raw}\n\nCHECKED: the live canvas DOES carry an identity (${rebind.uuid}) and ` +
+                            `this session's fence has been re-derived onto it. RETRY THIS EXACT CALL ONCE — ` +
+                            `nothing was applied, so a retry cannot double-apply.`);
+                    }
+                    // unreadable / uncorroborated — say so rather than picking a remedy.
+                    return fail(`${raw}\n\nCHECKED, and the answer is UNKNOWN: the live canvas could not be re-read ` +
+                        `well enough to say whether it has an identity. Try ` +
+                        `panel_open_workflow(<path>) on the workflow you mean — it is the only recovery ` +
+                        `that works in BOTH states, because it gives the workflow an identity rather than ` +
+                        `adopting one that may not exist.`);
+                }
+                catch {
+                    // The diagnosis must never change how the call failed.
+                    return fail(raw);
+                }
+            }
+            // #1330 — CORROBORATE A FENCE MISMATCH INSTEAD OF LETTING IT REPEAT.
+            //
+            // The reporter built 12 nodes successfully, then EVERY panel_connect was refused
+            // on an instance mismatch. Calling panel_set_workflow_target({mode:"current"})
+            // straight afterwards reported `already_current` naming the SAME uuid the command
+            // had been issued for, and the retried connects all succeeded. So the mismatch was
+            // transient and self-correcting, and the caller paid 14 refusals to find that out —
+            // because nothing in the refusal distinguishes "the canvas really is a different
+            // workflow" from "the identity flipped for a moment while you were building".
+            //
+            // The fence is NOT weakened and nothing is auto-applied. This performs the same
+            // read-only re-derivation the documented recovery performs, then says which of the
+            // two states was found. One informed retry replaces fourteen blind ones.
+            //
+            // Safe to recommend a retry because a fence refusal is checked BEFORE the handler
+            // runs — "Nothing was applied" is structural here, not an echoed claim.
+            if (isWorkflowInstanceMismatch(err) && isMutatingGraphCmd(cmd)) {
+                const name = typeof cmd.cmd === "string" ? cmd.cmd : "panel command";
+                const raw = err instanceof Error ? err.message : String(err);
+                // The uuid the command CARRIED, read from the panel's own refusal rather than
+                // from `cmd`: the stamp is applied downstream of here, so `cmd.workflow_uuid`
+                // is undefined at this point and keying on it silently disabled the transient
+                // branch — the one case this whole block exists for. The panel states both
+                // sides of the comparison it performed, which is the authoritative record of
+                // what was compared.
+                const stamped = /issued for workflow instance ([0-9a-f-]{36})/i.exec(err instanceof Error ? err.message : String(err))?.[1] ?? null;
+                let verdict;
+                try {
+                    const rebind = await rebindWorkflowFence(ctx);
+                    verdict =
+                        rebind.status === "already_current" && stamped && rebind.uuid === stamped
+                            ? `\n\nAUTO-REBIND: ATTEMPTED, and the live canvas now reports the SAME workflow ` +
+                                `instance this command carried (${stamped}) — nothing needed repairing. The ` +
+                                `mismatch was TRANSIENT: the identity flipped and settled back, which happens ` +
+                                `while a new unsaved workflow is still materialising. RETRY THIS EXACT CALL ONCE. ` +
+                                `Nothing was applied, so a retry cannot double-apply, and re-issuing the whole ` +
+                                `build would duplicate the work that already succeeded.`
+                            : rebind.status === "already_current"
+                                ? `\n\nAUTO-REBIND: ATTEMPTED; the fence already named the live canvas ` +
+                                    `(${rebind.uuid}), so it was not the stale side. Retry once — if it refuses ` +
+                                    `again with the same pair, the two identities are genuinely disagreeing and ` +
+                                    `panel_open_workflow is the way to settle which one you mean.`
+                                : rebind.status === "refreshed"
+                                    ? `\n\nAUTO-REBIND: ATTEMPTED and the fence was RE-DERIVED onto the live canvas ` +
+                                        `(now ${rebind.uuid}). Retry once. If you meant the EARLIER workflow, re-select ` +
+                                        `it with panel_open_workflow first — this session now points at the live one.`
+                                    : `\n\nAUTO-REBIND: ATTEMPTED and did NOT succeed (${rebind.status}), so the fence ` +
+                                        `is unchanged and a bare retry will fail the same way. Re-select the workflow ` +
+                                        `you mean with panel_open_workflow, then retry.`;
+                }
+                catch (rebindErr) {
+                    // Never let the diagnosis fail the call differently than it already failed.
+                    verdict =
+                        `\n\nAUTO-REBIND: ATTEMPTED and threw, so the fence state is UNKNOWN — this refusal ` +
+                            `stands on its own terms. (${rebindErr instanceof Error ? rebindErr.message : String(rebindErr)})`;
+                }
+                return fail(`${name} was NOT applied — nothing changed. ${raw}${verdict}`);
+            }
             if (isCapabilityRefusal(err)) {
                 return fail(err instanceof Error ? err.message : String(err));
             }