comfyui-mcp 0.51.10 → 0.51.12

package/dist/orchestrator/fence-refusal.js

@@ -42,6 +42,42 @@ export function noPanelTabReason(tabId) {
  * BEFORE the structural no-Origin case, or it borrows a remedy that cannot help
  * it and is told its problem is permanent.
  */
+/**
+ * The remedy for "this connection has no server-observed Origin" (panel#1065).
+ *
+ * Shared, because it was NOT shared and the two copies drifted. #1077/#1240 gave
+ * the relay path the origin it already knows from COMFYUI_URL, and updated the
+ * refusal below to say so. The OTHER surface rendering this same refusal — the
+ * `rejected` branch of describeFenceRebind in panel-tools.ts — kept the pre-fix
+ * text, which told the user to abandon the relay backend and to "report it: the
+ * relay protocol has to forward the browser's handshake Origin for this path to
+ * work at all".
+ *
+ * A user on 0.50.114 — a version that HAS the fix — followed that instruction and
+ * filed panel#1065 quoting it back. The stale sentence manufactured its own bug
+ * report, and told someone to downgrade a working setup on the way.
+ */
+export const NO_ORIGIN_REMEDY = 
+// The gate's OWN semantics come first, because they dissolve the fear the old
+// wording created and the reporter's stated obstacle at once. Measured, not
+// assumed: workflowIdentityParts requires an origin to EXIST, both call sites
+// take only `.uuid`, and `identity.origin` is never read again — so the value
+// is a scope, not a claim to be checked against the browser.
+`What this gate checks is PRESENCE, not agreement: the identity needs SOME origin to be ` +
+    `scoped to, and nothing ever compares it against the browser's — so the value does not have ` +
+    `to match where the panel is served from. ` +
+    // Two causes, named separately (codex review, P1). The predicate that selects this
+    // remedy is generic, and a blanket "set COMFYUI_URL" sends a direct/LAN/pairing or
+    // non-browser caller to a change that CANNOT add a handshake origin, leaving them
+    // fenced with nothing left to try.
+    `On a RELAY connection the origin is derived from COMFYUI_URL, so an unset or unparseable ` +
+    `COMFYUI_URL is the usual cause and setting it to any valid URL supplies one; you do not have ` +
+    `to leave the relay backend, which has supplied its own origin since 0.50.67. ` +
+    `On any other path the connection never presented an Origin header at all — a non-browser ` +
+    `client, or a proxy that strips it — and what fixes that is reaching the orchestrator from the ` +
+    `browser panel itself. ` +
+    `Refreshing the tab will not change either case. Reads and non-graph tools keep working ` +
+    `meanwhile — they do not need the fence.`;
 export function identityReason(tabId, origin, workflowUuid, failure) {
     if (!origin && failure === "ambiguous") {
         return ambiguousTurn(tabId, "no single tab's identity could be read");
@@ -53,10 +89,9 @@ export function identityReason(tabId, origin, workflowUuid, failure) {
         // like any other. Naming a fixed cause as the "known case" would send a
         // reader to change a backend that is no longer the reason (#1077).
         return (`this tab's connection carries no server-observed Origin, and the workflow identity is ` +
-            `bound to one — so the fence cannot be adopted for it. Refreshing the tab will not ` +
-            `change it. This means the connection reached the orchestrator by a path that neither ` +
-            `observed nor was told the panel's origin; if COMFYUI_URL is unset or unparseable for ` +
-            `this session, setting it to the URL the panel is served from is what supplies it.`);
+            `bound to one — so the fence cannot be adopted for it. This means the connection reached ` +
+            `the orchestrator by a path that neither observed nor was told the panel's origin. ` +
+            NO_ORIGIN_REMEDY);
     }
     // #1255 — this used to end "a malformed uuid, or one bound to a different
     // origin", which describes a comparison the code does not perform.

package/dist/orchestrator/fence-refusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"fence-refusal.js","sourceRoot":"","sources":["../../src/orchestrator/fence-refusal.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,yEAAyE;AACzE,2DAA2D;AAC3D,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,+EAA+E;AAC/E,sEAAsE;AACtE,4EAA4E;AAM5E,4EAA4E;AAC5E,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,OAAO,CACL,2DAA2D,IAAI,SAAS,KAAK,eAAe;QAC5F,2EAA2E;QAC3E,mFAAmF;QACnF,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,OAAuB;IACtE,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IAC/F,OAAO,mBAAmB,KAAK,wDAAwD,CAAC;AAC1F,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,GAAG,KAAK,iFAAiF,CAAC;AACnG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,MAA0B,EAC1B,YAAqB,EACrB,OAAuB;IAEvB,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,aAAa,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,6EAA6E;QAC7E,8EAA8E;QAC9E,6EAA6E;QAC7E,wEAAwE;QACxE,mEAAmE;QACnE,OAAO,CACL,wFAAwF;YACxF,oFAAoF;YACpF,uFAAuF;YACvF,uFAAuF;YACvF,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,mEAAmE;IACnE,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,0BAA0B;IAC1B,EAAE;IACF,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,yBAAyB;IACzB,OAAO,CACL,oDAAoD,MAAM,CAAC,YAAY,CAAC,YAAY;QACpF,0CAA0C,MAAM,yCAAyC;QACzF,sFAAsF,CACvF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"fence-refusal.js","sourceRoot":"","sources":["../../src/orchestrator/fence-refusal.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,yEAAyE;AACzE,2DAA2D;AAC3D,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,+EAA+E;AAC/E,sEAAsE;AACtE,4EAA4E;AAM5E,4EAA4E;AAC5E,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,OAAO,CACL,2DAA2D,IAAI,SAAS,KAAK,eAAe;QAC5F,2EAA2E;QAC3E,mFAAmF;QACnF,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,OAAuB;IACtE,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IAC/F,OAAO,mBAAmB,KAAK,wDAAwD,CAAC;AAC1F,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,GAAG,KAAK,iFAAiF,CAAC;AACnG,CAAC;AAED;;;;;;GAMG;AACH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,gBAAgB;AAC3B,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,6DAA6D;AAC7D,yFAAyF;IACzF,6FAA6F;IAC7F,2CAA2C;IAC3C,mFAAmF;IACnF,mFAAmF;IACnF,kFAAkF;IAClF,mCAAmC;IACnC,2FAA2F;IAC3F,+FAA+F;IAC/F,+EAA+E;IAC/E,2FAA2F;IAC3F,gGAAgG;IAChG,wBAAwB;IACxB,yFAAyF;IACzF,yCAAyC,CAAC;AAE5C,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,MAA0B,EAC1B,YAAqB,EACrB,OAAuB;IAEvB,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,aAAa,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,6EAA6E;QAC7E,8EAA8E;QAC9E,6EAA6E;QAC7E,wEAAwE;QACxE,mEAAmE;QACnE,OAAO,CACL,wFAAwF;YACxF,0FAA0F;YAC1F,oFAAoF;YACpF,gBAAgB,CACjB,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,mEAAmE;IACnE,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,0BAA0B;IAC1B,EAAE;IACF,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,yBAAyB;IACzB,OAAO,CACL,oDAAoD,MAAM,CAAC,YAAY,CAAC,YAAY;QACpF,0CAA0C,MAAM,yCAAyC;QACzF,sFAAsF,CACvF,CAAC;AACJ,CAAC"}

package/dist/orchestrator/panel-tools.js

@@ -38,6 +38,8 @@ import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
 import { parse as parseYaml } from "yaml";
 import { conversationOfScopeAddress, isScopeAddress, shortTabId } from "../services/session-scope.js";
 import { NODE_ID_MESSAGE, NODE_ID_PATTERN, normalizeNodeId } from "./node-id.js";
+import { clearSwitchHold, describeSwitchHold, recordSwitchHold, successProvesSwitchCleared, } from "./switch-hold.js";
+import { NO_ORIGIN_REMEDY } from "./fence-refusal.js";
 /** #884 — journal TICKETS (run completions #468, ask answers #486) must be
  *  keyed by the REAL tab a run/card was routed to: the panel reports back under
  *  that tab id, and a ticket keyed by the shared scope address a tool ctx is
@@ -3446,11 +3448,12 @@ panelGapNote = "") {
                     // the tab" — the reporter did that repeatedly, including closing and
                     // reopening it, and it could never have worked.
                     r.refusalReason && /no server-observed Origin/i.test(r.refusalReason)
-                        ? `Refreshing the tab will NOT help — this one is structural. Reconnect over a ` +
-                            `direct/loopback or cloudflared link rather than the relay backend (unset ` +
-                            `COMFYUI_MCP_TUNNEL_BACKEND=relay), or continue with reads and non-graph tools, ` +
-                            `which do not need the fence. Please also report it: the relay protocol has to ` +
-                            `forward the browser's handshake Origin for this path to work at all.`
+                        ? // panel#1065 — SHARED with fence-refusal.ts, because this copy went stale.
+                            // It still described the world before #1240 gave the relay path its
+                            // origin: it told the user to abandon the relay backend and to report
+                            // a protocol gap that had already been closed. Someone did exactly
+                            // that, on a version that had the fix.
+                            NO_ORIGIN_REMEDY
                         : RELOAD_TAB_REMEDY}`,
             };
         case "adopt_error":
@@ -5232,7 +5235,14 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets) {
                 await awaitReachable();
             }
             ensureReachable();
-            return ok(await sendRouted(cmd, timeoutMs, observeRid));
+            const firstTry = ok(await sendRouted(cmd, timeoutMs, observeRid));
+            // panel#1097 — a guard-domain command that SUCCEEDS is the evidence that the
+            // switch is over, whichever attempt lands it. Without this an ordinary
+            // first-attempt success left the old run in place, and a later unrelated
+            // switch inherited its age and was announced as stuck at once (codex r4).
+            if (successProvesSwitchCleared(cmd.cmd))
+                clearSwitchHold(ctx.tabId);
+            return firstTry;
         }
         catch (err) {
             // Post-reconnect retry-once: a reboot/free_vram/reconnect can drop the tab's
@@ -5246,10 +5256,30 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets) {
             // is what retrySettleMs already waits. Still gated on RETRY-SAFE commands,
             // so a mutation is never re-issued on our own initiative.
             if (isRetrySafeCmd(cmd) && (isTransientReconnectError(err) || isWorkflowSwitchGuardRefusal(err))) {
+                // panel#1097 — declared out here so the refusal branch below can see it,
+                // and REASSIGNED after ensureReachable so it names the tab the command is
+                // actually dispatched on. Reading it before the rebind attributed a refusal
+                // from B to A; reading it after the await let a later rebind move it again
+                // (codex rounds 1 and 2).
+                let holdTab = ctx.tabId;
                 try {
                     await sleep(retrySettleMs());
                     ensureReachable(); // rebinds a current-mode session onto the reconnected tab
-                    return ok(await sendRouted(cmd, timeoutMs, observeRid));
+                    holdTab = ctx.tabId;
+                    const retried = ok(await sendRouted(cmd, timeoutMs, observeRid));
+                    // Cleared HERE and nowhere else, and only when the failure this retried
+                    // was a SWITCH refusal. Clearing on every routed success let an unguarded
+                    // status read wipe the evidence while graph commands stayed refused
+                    // (codex round 2); clearing after a transient-reconnect retry does the
+                    // same thing one step removed, because reconnecting proves nothing about
+                    // whether the switch cleared (codex round 3).
+                    // Same rule on the retry path. A transient-RECONNECT retry that succeeds
+                    // proves nothing about the switch (codex r3), so the command still has to
+                    // be one the guard would have refused.
+                    if (isWorkflowSwitchGuardRefusal(err) && successProvesSwitchCleared(cmd.cmd)) {
+                        clearSwitchHold(holdTab);
+                    }
+                    return retried;
                 }
                 catch (err2) {
                     // #1027 — a switch STILL in progress is not a reconnect, and saying so
@@ -5257,13 +5287,18 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets) {
                     // it is simply mid-switch. Name the actual state and the actual wait.
                     if (isWorkflowSwitchGuardRefusal(err2)) {
                         const name = typeof cmd.cmd === "string" ? cmd.cmd : "panel command";
+                        // panel#1097 — time the RUN of these refusals. "Simply retry" is right
+                        // for the fraction of a second this normally lasts and wrong for a
+                        // switch held open by a dialog, and the two were indistinguishable.
+                        const held = describeSwitchHold(recordSwitchHold(holdTab));
                         return fail(`${name} was NOT applied — nothing changed. The panel is still switching or ` +
                             `reloading the workflow on the canvas, which it refuses commands during so a ` +
                             `command cannot land on the wrong graph. The tab is connected and this is not a ` +
                             `reconnect: it normally clears in well under a second, so simply retry. If a ` +
                             `switch appears stuck, check the canvas — a load dialog or an unsaved-changes ` +
                             `prompt can hold it open awaiting the user. ` +
-                            `(${err2 instanceof Error ? err2.message : String(err2)})`);
+                            `(${err2 instanceof Error ? err2.message : String(err2)})` +
+                            held);
                     }
                     // The retry also failed — surface an actionable reconnecting status rather
                     // than a bare transport error (#332), while still failing honestly.