comfyui-mcp 0.51.10 → 0.51.11

package/dist/orchestrator/fence-refusal.js

@@ -42,6 +42,42 @@ export function noPanelTabReason(tabId) {
  * BEFORE the structural no-Origin case, or it borrows a remedy that cannot help
  * it and is told its problem is permanent.
  */
+/**
+ * The remedy for "this connection has no server-observed Origin" (panel#1065).
+ *
+ * Shared, because it was NOT shared and the two copies drifted. #1077/#1240 gave
+ * the relay path the origin it already knows from COMFYUI_URL, and updated the
+ * refusal below to say so. The OTHER surface rendering this same refusal — the
+ * `rejected` branch of describeFenceRebind in panel-tools.ts — kept the pre-fix
+ * text, which told the user to abandon the relay backend and to "report it: the
+ * relay protocol has to forward the browser's handshake Origin for this path to
+ * work at all".
+ *
+ * A user on 0.50.114 — a version that HAS the fix — followed that instruction and
+ * filed panel#1065 quoting it back. The stale sentence manufactured its own bug
+ * report, and told someone to downgrade a working setup on the way.
+ */
+export const NO_ORIGIN_REMEDY = 
+// The gate's OWN semantics come first, because they dissolve the fear the old
+// wording created and the reporter's stated obstacle at once. Measured, not
+// assumed: workflowIdentityParts requires an origin to EXIST, both call sites
+// take only `.uuid`, and `identity.origin` is never read again — so the value
+// is a scope, not a claim to be checked against the browser.
+`What this gate checks is PRESENCE, not agreement: the identity needs SOME origin to be ` +
+    `scoped to, and nothing ever compares it against the browser's — so the value does not have ` +
+    `to match where the panel is served from. ` +
+    // Two causes, named separately (codex review, P1). The predicate that selects this
+    // remedy is generic, and a blanket "set COMFYUI_URL" sends a direct/LAN/pairing or
+    // non-browser caller to a change that CANNOT add a handshake origin, leaving them
+    // fenced with nothing left to try.
+    `On a RELAY connection the origin is derived from COMFYUI_URL, so an unset or unparseable ` +
+    `COMFYUI_URL is the usual cause and setting it to any valid URL supplies one; you do not have ` +
+    `to leave the relay backend, which has supplied its own origin since 0.50.67. ` +
+    `On any other path the connection never presented an Origin header at all — a non-browser ` +
+    `client, or a proxy that strips it — and what fixes that is reaching the orchestrator from the ` +
+    `browser panel itself. ` +
+    `Refreshing the tab will not change either case. Reads and non-graph tools keep working ` +
+    `meanwhile — they do not need the fence.`;
 export function identityReason(tabId, origin, workflowUuid, failure) {
     if (!origin && failure === "ambiguous") {
         return ambiguousTurn(tabId, "no single tab's identity could be read");
@@ -53,10 +89,9 @@ export function identityReason(tabId, origin, workflowUuid, failure) {
         // like any other. Naming a fixed cause as the "known case" would send a
         // reader to change a backend that is no longer the reason (#1077).
         return (`this tab's connection carries no server-observed Origin, and the workflow identity is ` +
-            `bound to one — so the fence cannot be adopted for it. Refreshing the tab will not ` +
-            `change it. This means the connection reached the orchestrator by a path that neither ` +
-            `observed nor was told the panel's origin; if COMFYUI_URL is unset or unparseable for ` +
-            `this session, setting it to the URL the panel is served from is what supplies it.`);
+            `bound to one — so the fence cannot be adopted for it. This means the connection reached ` +
+            `the orchestrator by a path that neither observed nor was told the panel's origin. ` +
+            NO_ORIGIN_REMEDY);
     }
     // #1255 — this used to end "a malformed uuid, or one bound to a different
     // origin", which describes a comparison the code does not perform.

package/dist/orchestrator/fence-refusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"fence-refusal.js","sourceRoot":"","sources":["../../src/orchestrator/fence-refusal.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,yEAAyE;AACzE,2DAA2D;AAC3D,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,+EAA+E;AAC/E,sEAAsE;AACtE,4EAA4E;AAM5E,4EAA4E;AAC5E,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,OAAO,CACL,2DAA2D,IAAI,SAAS,KAAK,eAAe;QAC5F,2EAA2E;QAC3E,mFAAmF;QACnF,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,OAAuB;IACtE,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IAC/F,OAAO,mBAAmB,KAAK,wDAAwD,CAAC;AAC1F,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,GAAG,KAAK,iFAAiF,CAAC;AACnG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,MAA0B,EAC1B,YAAqB,EACrB,OAAuB;IAEvB,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,aAAa,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,6EAA6E;QAC7E,8EAA8E;QAC9E,6EAA6E;QAC7E,wEAAwE;QACxE,mEAAmE;QACnE,OAAO,CACL,wFAAwF;YACxF,oFAAoF;YACpF,uFAAuF;YACvF,uFAAuF;YACvF,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,mEAAmE;IACnE,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,0BAA0B;IAC1B,EAAE;IACF,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,yBAAyB;IACzB,OAAO,CACL,oDAAoD,MAAM,CAAC,YAAY,CAAC,YAAY;QACpF,0CAA0C,MAAM,yCAAyC;QACzF,sFAAsF,CACvF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"fence-refusal.js","sourceRoot":"","sources":["../../src/orchestrator/fence-refusal.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,yEAAyE;AACzE,2DAA2D;AAC3D,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,+EAA+E;AAC/E,sEAAsE;AACtE,4EAA4E;AAM5E,4EAA4E;AAC5E,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,OAAO,CACL,2DAA2D,IAAI,SAAS,KAAK,eAAe;QAC5F,2EAA2E;QAC3E,mFAAmF;QACnF,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,OAAuB;IACtE,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IAC/F,OAAO,mBAAmB,KAAK,wDAAwD,CAAC;AAC1F,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,GAAG,KAAK,iFAAiF,CAAC;AACnG,CAAC;AAED;;;;;;GAMG;AACH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,gBAAgB;AAC3B,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,6DAA6D;AAC7D,yFAAyF;IACzF,6FAA6F;IAC7F,2CAA2C;IAC3C,mFAAmF;IACnF,mFAAmF;IACnF,kFAAkF;IAClF,mCAAmC;IACnC,2FAA2F;IAC3F,+FAA+F;IAC/F,+EAA+E;IAC/E,2FAA2F;IAC3F,gGAAgG;IAChG,wBAAwB;IACxB,yFAAyF;IACzF,yCAAyC,CAAC;AAE5C,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,MAA0B,EAC1B,YAAqB,EACrB,OAAuB;IAEvB,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,aAAa,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,6EAA6E;QAC7E,8EAA8E;QAC9E,6EAA6E;QAC7E,wEAAwE;QACxE,mEAAmE;QACnE,OAAO,CACL,wFAAwF;YACxF,0FAA0F;YAC1F,oFAAoF;YACpF,gBAAgB,CACjB,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,mEAAmE;IACnE,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,0BAA0B;IAC1B,EAAE;IACF,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,yBAAyB;IACzB,OAAO,CACL,oDAAoD,MAAM,CAAC,YAAY,CAAC,YAAY;QACpF,0CAA0C,MAAM,yCAAyC;QACzF,sFAAsF,CACvF,CAAC;AACJ,CAAC"}

package/dist/orchestrator/panel-tools.js

@@ -38,6 +38,7 @@ import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
 import { parse as parseYaml } from "yaml";
 import { conversationOfScopeAddress, isScopeAddress, shortTabId } from "../services/session-scope.js";
 import { NODE_ID_MESSAGE, NODE_ID_PATTERN, normalizeNodeId } from "./node-id.js";
+import { NO_ORIGIN_REMEDY } from "./fence-refusal.js";
 /** #884 — journal TICKETS (run completions #468, ask answers #486) must be
  *  keyed by the REAL tab a run/card was routed to: the panel reports back under
  *  that tab id, and a ticket keyed by the shared scope address a tool ctx is
@@ -3446,11 +3447,12 @@ panelGapNote = "") {
                     // the tab" — the reporter did that repeatedly, including closing and
                     // reopening it, and it could never have worked.
                     r.refusalReason && /no server-observed Origin/i.test(r.refusalReason)
-                        ? `Refreshing the tab will NOT help — this one is structural. Reconnect over a ` +
-                            `direct/loopback or cloudflared link rather than the relay backend (unset ` +
-                            `COMFYUI_MCP_TUNNEL_BACKEND=relay), or continue with reads and non-graph tools, ` +
-                            `which do not need the fence. Please also report it: the relay protocol has to ` +
-                            `forward the browser's handshake Origin for this path to work at all.`
+                        ? // panel#1065 — SHARED with fence-refusal.ts, because this copy went stale.
+                            // It still described the world before #1240 gave the relay path its
+                            // origin: it told the user to abandon the relay backend and to report
+                            // a protocol gap that had already been closed. Someone did exactly
+                            // that, on a version that had the fix.
+                            NO_ORIGIN_REMEDY
                         : RELOAD_TAB_REMEDY}`,
             };
         case "adopt_error":