comfyui-mcp 0.50.98 → 0.50.100

package/dist/orchestrator/panel-tools.js

@@ -713,6 +713,24 @@ function isWorkflowInstanceMismatch(err) {
     const msg = err instanceof Error ? err.message : String(err ?? "");
     return /workflow instance mismatch/i.test(msg);
 }
+/**
+ * #1331 — the bridge refused a mutation because the active workflow has no identity to
+ * fence against (ui-bridge's `no trusted identity` branch).
+ *
+ * A DIFFERENT refusal from the one above, and the pair is easy to conflate: that one is
+ * two identities disagreeing, this one is there being no identity at all. They also need
+ * different handling — a mismatch may clear by itself, this never does.
+ *
+ * Kept separate from the capability refusal beside it because those need opposite
+ * advice: a capability gap needs a panel UPDATE, this needs the workflow re-opened. What
+ * they share is that the generic "retry / rebind with mode:current" wrapper can clear
+ * NEITHER, and appending it sent the reporter of #1331 through four calls to reach a
+ * state the panel already believed it was in.
+ */
+function isNoTrustedIdentityRefusal(err) {
+    const msg = err instanceof Error ? err.message : String(err ?? "");
+    return /no trusted identity/i.test(msg);
+}
 let retrySettleMsOverride = null;
 /** Short pause before the single post-drop retry, letting the replacement tab
  *  finish its reconnect hello so ensureReachable can resolve it. Test-overridable. */
@@ -4932,6 +4950,57 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets) {
             // sent agents into a futile retry/rebind loop that contradicted the embedded
             // guidance. Key on the TYPED marker and surface the cause verbatim instead; it
             // already names the real recovery (update + restart + browser hard-refresh).
+            // #1331 — DECIDE WHICH "no trusted identity" THIS IS, instead of asserting one.
+            //
+            // The reporter was told to "retry in a moment, or rebind with
+            // panel_set_workflow_target({mode:"current"})", followed it, and it did not work:
+            // recovery took panel_open_workflow on the workflow that was ALREADY active —
+            // four calls to reach a state the panel already believed it was in.
+            //
+            // But that advice is NOT always wrong, and my first attempt at this deleted it
+            // outright — which #709's test caught. Two different states produce the identical
+            // bridge message, and they need opposite remedies:
+            //
+            //   session bound to a STALE tab, live canvas HAS an identity
+            //        → rebinding genuinely re-resolves it (#709). The advice is correct.
+            //   the LIVE canvas itself has no identity
+            //        → the rebind READS an identity to adopt and finds none, so it reports
+            //          success while every mutation keeps failing (#1331).
+            //
+            // The bridge cannot tell them apart — from its side both are "no identity". The
+            // orchestrator can, with the same read-only re-derivation the documented recovery
+            // performs. So it is measured, once, and the answer names the remedy that fits.
+            if (isNoTrustedIdentityRefusal(err) && isMutatingGraphCmd(cmd)) {
+                const raw = err instanceof Error ? err.message : String(err);
+                try {
+                    const rebind = await rebindWorkflowFence(ctx);
+                    if (rebind.status === "no_identity") {
+                        return fail(`${raw}\n\nCHECKED, so this is not a guess: the live canvas was re-read and it ` +
+                            `carries no workflow identity either (${rebind.why}). ` +
+                            `panel_set_workflow_target({mode:"current"}) will NOT clear this — it chooses ` +
+                            `WHICH workflow to fence against and cannot mint an identity for one that has ` +
+                            `none, so it reports success while every mutation keeps failing. RECOVERY: ` +
+                            `panel_open_workflow(<path>) on this same workflow; re-opening it is what gives ` +
+                            `it an identity. If it has never been saved there is no path to re-open — save ` +
+                            `it first with panel_save_workflow, which also gives it a stable identity.`);
+                    }
+                    if (rebind.status === "refreshed" || rebind.status === "already_current") {
+                        return fail(`${raw}\n\nCHECKED: the live canvas DOES carry an identity (${rebind.uuid}) and ` +
+                            `this session's fence has been re-derived onto it. RETRY THIS EXACT CALL ONCE — ` +
+                            `nothing was applied, so a retry cannot double-apply.`);
+                    }
+                    // unreadable / uncorroborated — say so rather than picking a remedy.
+                    return fail(`${raw}\n\nCHECKED, and the answer is UNKNOWN: the live canvas could not be re-read ` +
+                        `well enough to say whether it has an identity. Try ` +
+                        `panel_open_workflow(<path>) on the workflow you mean — it is the only recovery ` +
+                        `that works in BOTH states, because it gives the workflow an identity rather than ` +
+                        `adopting one that may not exist.`);
+                }
+                catch {
+                    // The diagnosis must never change how the call failed.
+                    return fail(raw);
+                }
+            }
             // #1330 — CORROBORATE A FENCE MISMATCH INSTEAD OF LETTING IT REPEAT.
             //
             // The reporter built 12 nodes successfully, then EVERY panel_connect was refused
@@ -5099,15 +5168,17 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets) {
         catch (err) {
             // Only a card-reply TIMEOUT is recoverable/honest-as-timeout: poll the late
             // buffer, then report "timeout" if still unanswered. Any other error (no
-            // panel, transport failure) → "no" so the destructive op is SKIPPED, exactly
-            // as the previous catch-all did.
+            // panel, transport failure) still SKIPS the destructive op — but it is reported
+            // as `unreachable`, not `no` (#1332). The user did not decline; we never got to
+            // ask them, and a caller that says "cancelled" on this is describing a decision
+            // nobody made.
             if (isReplyTimeoutError(err)) {
                 const late = await pollLateAskReply(bridge, askId, timing, budgetEnd);
                 if (late !== undefined)
                     return isAffirmative(late) ? "yes" : "no";
                 return "timeout";
             }
-            return "no";
+            return "unreachable";
         }
     };
     // EXPLICIT self-heal — see PanelToolCtx.rebindToActiveTab. Only rebinds when
@@ -6617,6 +6688,14 @@ export function buildPanelToolDefs() {
                 return ok("Timed out waiting for your confirmation, so I left the canvas as-is. " +
                     "Tell me to clear it again when you're ready.");
             }
+            if (decision === "unreachable") {
+                // #1332 — the canvas is still untouched, which is the part that matters, but
+                // the user never saw the question. Saying "cancelled" would credit them with
+                // a decision they were never offered.
+                return ok("The canvas was left as-is — but NOT because it was declined: the panel could " +
+                    "not be reached to ask, so the question never appeared. Nothing was cleared. " +
+                    "Check the panel tab is connected, then ask again.");
+            }
             if (decision !== "yes") {
                 return ok("Cancelled — the canvas was left as-is.");
             }
@@ -8809,7 +8888,26 @@ export function buildPanelToolDefs() {
                         : "Cancelled — no new restart was dispatched. ComfyUI was briefly " +
                             "unreachable but is healthy again.");
                 }
-                return ok("Cancelled — ComfyUI was not restarted.");
+                // #1332 — the reporter's exact string, and it was FALSE. They accepted the
+                // restart, ComfyUI restarted (a fresh startup in the server log), and this
+                // said it had not — because the restart dropped the socket the answer had to
+                // travel back on, and a transport failure used to arrive here as "no".
+                //
+                // The probes above already refuse to claim "not restarted" while the server
+                // is DOWN. This is the remaining case: the server is HEALTHY, which is
+                // equally true of "nothing happened" and of "it restarted and came back".
+                // With an explicit decline we know which; without one we do not, and the
+                // sentence must stop asserting it.
+                return ok(decision === "unreachable"
+                    ? "This call did NOT dispatch a restart. Whether ComfyUI restarted for some " +
+                        "other reason cannot be told from here: the panel could not be reached to " +
+                        "ask for confirmation — the question never appeared — so no decision was " +
+                        "made either way, and the server is reachable now, which looks the same " +
+                        "whether it never went down or went down and came back. If you asked for a " +
+                        "restart and one has already happened, this is that transport loss, not a " +
+                        "cancellation. Check the ComfyUI log for a fresh startup line before " +
+                        "restarting again."
+                    : "Cancelled — ComfyUI was not restarted.");
             }
             // Heal an orphaned session onto the live tab FIRST, then bind the reboot dispatch
             // to that ONE tab id (no await between capture and dispatch, so JS run-to-