comfyui-mcp 0.52.0 → 0.52.2

package/dist/orchestrator/mcp-session-health.js

@@ -20,10 +20,12 @@
 // panel server (Claude lane) and the stdio `comfyui` child. `route()` already reads
 // that message for the session id and throws the rest away.
 //
-// This module is only the comparison. It says what was observed and nothing more:
-// it does not diagnose WHY a server is missing (still unknown for #1524, and the
-// two candidate causes need different fixes), and it does not promise a restart
-// would help.
+// This module is the comparison and the wording. The comparison says what was
+// observed and nothing more: it does not diagnose WHY a server is missing
+// (still open for #1524, and the two candidate causes need different fixes).
+// The wording carries the recovery story the same way: a reconnect attempt is
+// reported as attempted, its outcome as whatever the re-read status poll said —
+// never as a promise that a restart or reconnect would help.
 /**
  * Compare the MCP servers we handed the session against the ones it reports.
  *
@@ -84,6 +86,21 @@ export function inspectMcpServers(configured, reported) {
  * sessions their tools are gone.
  */
 const FAILED_STATUSES = new Set(["failed", "needs-auth", "disabled", "error"]);
+/**
+ * Whether an automatic reconnect is worth attempting for a degraded status.
+ *
+ * `failed` / `error` / absent-from-the-report are DROP shapes — re-running the
+ * connection can bring the server back. `needs-auth` waits on the user
+ * completing an auth flow and `disabled` is a deliberate off switch: an
+ * automatic retry of the first claims effort that cannot land, and of the
+ * second overrides intent — so neither is retried, only reported.
+ */
+export function reconnectableMcpStatus(status) {
+    if (status === null)
+        return true;
+    const s = status.trim().toLowerCase();
+    return s === "failed" || s === "error";
+}
 /**
  * The line the user sees when a session starts without a server it was given.
  *
@@ -102,9 +119,73 @@ export function degradedMcpNotice(degraded) {
     const plural = degraded.length > 1 ? "servers" : "server";
     const theirTools = degraded.length > 1 ? "Their tools are" : "Its tools are";
     return (`This session started without ${degraded.length} of its MCP ${plural}: ${named}. ` +
-        `${theirTools} not available to the agent for the rest of this session, ` +
+        `${theirTools} not available to the agent until the server connects, ` +
         `so anything that needs them will fail or be worked around silently. ` +
-        `Starting a new session (Disconnect → Connect) is what re-runs the connection; ` +
-        `whether it succeeds depends on why this one did not, which this message does not know.`);
+        `A reconnect is attempted at the next turn boundary for any of them that can be retried, ` +
+        `and the outcome is reported; starting a new session (Disconnect → Connect) ` +
+        `re-runs the connection from scratch. ` +
+        `Whether either succeeds depends on why this one did not, which this message does not know.`);
+}
+/** Format a degraded-server list the way every notice in this module does. */
+function namedDegraded(degraded) {
+    return degraded
+        .map((d) => (d.status === null ? `\`${d.name}\` (not reported)` : `\`${d.name}\` (${d.status})`))
+        .join(", ");
+}
+/**
+ * The line the user sees when a server is down and STAYS down past the
+ * recovery this session can offer (#1524). `why` names exactly which situation
+ * the session is in — the one thing the reader must not have to guess:
+ *
+ *  - `reconnect-failed`: an automatic reconnect was tried and the re-read still
+ *    reports the server down;
+ *  - `unverified`: an automatic reconnect was tried but the status re-read that
+ *    would judge it could not be read — so the outcome is not claimed either
+ *    way ("did not come back" would be a claim nobody checked);
+ *  - `not-retriable`: the status (`needs-auth`, `disabled`) is not one an
+ *    automatic reconnect can clear — nothing was attempted;
+ *  - `unsupported`: the harness exposes no reconnect to ask for — nothing
+ *    could be attempted.
+ *
+ * Like `degradedMcpNotice`, it stops at the observation: it does not diagnose
+ * why the server is down and does not promise a new session fixes it.
+ */
+export function unrecoveredMcpNotice(degraded, why) {
+    if (degraded.length === 0)
+        return "";
+    const plural = degraded.length > 1;
+    const reason = why === "reconnect-failed"
+        ? `the automatic reconnect did not bring ${plural ? "them" : "it"} back`
+        : why === "unverified"
+            ? "an automatic reconnect was attempted, but its outcome could not be read back"
+            : why === "not-retriable"
+                ? "an automatic reconnect cannot clear this status, so none was attempted"
+                : "this harness offers no reconnect to ask for";
+    return (`MCP ${plural ? "servers" : "server"} ${namedDegraded(degraded)} ${plural ? "are" : "is"} ` +
+        `unavailable to the agent — ${reason}. ` +
+        `Anything that needs ${plural ? "their" : "its"} tools will fail or be worked around ` +
+        `silently for the rest of this session. ` +
+        `Starting a new session (Disconnect → Connect) re-runs the connection; ` +
+        `whether it succeeds depends on why the server is down, which this message does not know.`);
+}
+/**
+ * The line the user sees when a down server reads CONNECTED again (#1524).
+ * `byReconnect` distinguishes the two honest shapes: the session's own
+ * reconnect attempt landed, or the harness's supervision brought the server
+ * back on its own (the reporter watched `comfyui` do exactly this while
+ * `panel` stayed down). The claim is only ever what a status poll reported —
+ * never that the tools were exercised.
+ */
+export function recoveredMcpNotice(names, byReconnect) {
+    if (names.length === 0)
+        return "";
+    const named = names.map((n) => `\`${n}\``).join(", ");
+    const plural = names.length > 1;
+    const how = byReconnect
+        ? `the automatic reconnect brought ${plural ? "them" : "it"} back`
+        : `${plural ? "they are" : "it is"} connected again`;
+    return (`MCP ${plural ? "servers" : "server"} ${named}: ${how} — ` +
+        `${plural ? "their" : "its"} tools are available to the agent. ` +
+        `Anything the agent reported as unreachable while the server was down may be worth another try.`);
 }
 //# sourceMappingURL=mcp-session-health.js.map

package/dist/orchestrator/mcp-session-health.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-session-health.js","sourceRoot":"","sources":["../../src/orchestrator/mcp-session-health.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kCAAkC;AAClC,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,8EAA8E;AAC9E,iFAAiF;AACjF,6EAA6E;AAC7E,6BAA6B;AAC7B,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,cAAc;AACd,EAAE;AACF,mFAAmF;AACnF,EAAE;AACF,qFAAqF;AACrF,oFAAoF;AACpF,4DAA4D;AAC5D,EAAE;AACF,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAChF,cAAc;AAoCd;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAA6B,EAC7B,QAAkD;IAElD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACxC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAsC;IACtE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAChG,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC;IAC7E,OAAO,CACL,gCAAgC,QAAQ,CAAC,MAAM,eAAe,MAAM,KAAK,KAAK,IAAI;QAClF,GAAG,UAAU,4DAA4D;QACzE,sEAAsE;QACtE,gFAAgF;QAChF,wFAAwF,CACzF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mcp-session-health.js","sourceRoot":"","sources":["../../src/orchestrator/mcp-session-health.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kCAAkC;AAClC,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,8EAA8E;AAC9E,iFAAiF;AACjF,6EAA6E;AAC7E,6BAA6B;AAC7B,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,cAAc;AACd,EAAE;AACF,mFAAmF;AACnF,EAAE;AACF,qFAAqF;AACrF,oFAAoF;AACpF,4DAA4D;AAC5D,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,6DAA6D;AAoC7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAA6B,EAC7B,QAAkD;IAElD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACxC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAqB;IAC1D,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAsC;IACtE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAChG,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC;IAC7E,OAAO,CACL,gCAAgC,QAAQ,CAAC,MAAM,eAAe,MAAM,KAAK,KAAK,IAAI;QAClF,GAAG,UAAU,yDAAyD;QACtE,sEAAsE;QACtE,0FAA0F;QAC1F,6EAA6E;QAC7E,uCAAuC;QACvC,4FAA4F,CAC7F,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,QAAsC;IAC3D,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAChG,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAsC,EACtC,GAAwE;IAExE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GACV,GAAG,KAAK,kBAAkB;QACxB,CAAC,CAAC,yCAAyC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO;QACxE,CAAC,CAAC,GAAG,KAAK,YAAY;YACpB,CAAC,CAAC,8EAA8E;YAChF,CAAC,CAAC,GAAG,KAAK,eAAe;gBACvB,CAAC,CAAC,wEAAwE;gBAC1E,CAAC,CAAC,6CAA6C,CAAC;IACxD,OAAO,CACL,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG;QAC3F,8BAA8B,MAAM,IAAI;QACxC,uBAAuB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,uCAAuC;QACtF,yCAAyC;QACzC,wEAAwE;QACxE,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAwB,EAAE,WAAoB;IAC/E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,WAAW;QACrB,CAAC,CAAC,mCAAmC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO;QAClE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,kBAAkB,CAAC;IACvD,OAAO,CACL,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,KAAK,GAAG,KAAK;QAC1D,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,qCAAqC;QAChE,gGAAgG,CACjG,CAAC;AACJ,CAAC"}

package/dist/orchestrator/panel-agent.js

@@ -20,6 +20,7 @@ import { COMPLETION_DISAGREEMENT_NOTE } from "./download-done-guard.js";
 import { downloadsAtRiskOfRespawn } from "../services/download-jobs.js";
 import { orphanedByDeferredRespawnNote } from "../services/panel-secrets.js";
 import { errorText, promptText } from "./error-text.js";
+import { MAX_SESSION_PREVIEW_ATTACHMENTS, MAX_SESSION_PREVIEW_BYTES, previewByteBudgetLabel, } from "./preview-budget.js";
 import { dedupeAudioRefs, noAudioPartText } from "./audio-attachment.js";
 import { runErrorNotice } from "./cli-remedy.js";
 import { runCompletionDirective } from "./todo-state.js";
@@ -305,6 +306,23 @@ export class PanelAgent {
     pendingRewind = null;
     /** Captured from the session's init message; enables resume across restarts. */
     sessionId = null;
+    /** #1516 — cumulative AUTOMATIC previews committed to turns of the CURRENT
+     *  provider conversation (charged at the drain, the point of fact). Reset
+     *  whenever the session id changes: a fresh conversation starts at zero. */
+    previewImagesCharged = 0;
+    /** #1516 — the byte half of the ledger ADOPTED from the durable store (see
+     *  initialPreviewLedger). Live bytes come from the backend; the total is
+     *  previewBytesBase + backend.automaticPreviewBytes(). */
+    previewBytesBase = 0;
+    /** #1516 — automatic previews composed but NOT delivered, accounted where the
+     *  withholding was decided (session budget at inject, either budget at the
+     *  drain trim). Diagnostics; each was named in an agent-visible note. */
+    previewWithheldSession = 0;
+    /** #1516 — the session id the charged ledger belongs to; reconciled lazily. */
+    previewLedgerSid = null;
+    /** #1516 — durable ledger awaiting adoption once the live session id proves
+     *  to be the conversation it was recorded against (never applied blindly). */
+    pendingPreviewLedger = null;
     /** Id of the assistant message currently streaming (from message_start), so
      *  stream deltas and the final committed `say` share one bubble id. */
     streamMsgId = null;
@@ -334,6 +352,7 @@ export class PanelAgent {
         this.deps = deps;
         this.model = deps.model;
         this.effort = deps.effort;
+        this.pendingPreviewLedger = deps.initialPreviewLedger ?? null;
         // Default to the Claude adapter; injectable so a future toggle can swap it.
         this.backend =
             backend ??
@@ -343,6 +362,7 @@ export class PanelAgent {
                     systemAppend: deps.systemAppend,
                     panelServer: deps.panelServer,
                     pluginPath: deps.pluginPath,
+                    isBlind: deps.isBlind,
                 });
     }
     short() {
@@ -478,6 +498,78 @@ export class PanelAgent {
     queuedPreviewImageCount() {
         return this.queue.reduce((n, it) => n + (it.completionOnly ? (it.images?.length ?? 0) : 0), 0);
     }
+    /** #1516 — keep the cumulative preview ledger attached to the conversation it
+     *  measures. The session id only becomes known at the init event and can
+     *  change under us (fresh fork, resume-miss restart, provider switch), so
+     *  this runs lazily at every budget decision: a new id resets the ledger to
+     *  zero, and the durable pending ledger is adopted ONLY when the live id is
+     *  exactly the one it was recorded against — a ledger applied to the wrong
+     *  conversation would either starve a fresh one or un-bound an old one. */
+    reconcilePreviewLedger() {
+        if (this.sessionId === this.previewLedgerSid)
+            return;
+        this.previewLedgerSid = this.sessionId;
+        this.previewImagesCharged = 0;
+        this.previewBytesBase = 0;
+        this.previewWithheldSession = 0;
+        if (this.sessionId && this.pendingPreviewLedger) {
+            if (this.pendingPreviewLedger.sid === this.sessionId) {
+                this.previewImagesCharged = this.pendingPreviewLedger.images;
+                this.previewBytesBase = this.pendingPreviewLedger.bytes;
+            }
+            this.pendingPreviewLedger = null;
+        }
+    }
+    /** #1516 — cumulative delivered automatic-preview BYTES for the current
+     *  conversation: the durable base (pre-restart) plus what this process's
+     *  backend actually fetched. Backends that do not report bytes contribute
+     *  zero and are bounded by the image count alone. */
+    sessionPreviewBytes() {
+        return this.previewBytesBase + (this.backend.automaticPreviewBytes?.() ?? 0);
+    }
+    /** #1516 — how many automatic previews this conversation may still receive:
+     *  the tighter of the remaining COUNT and the remaining BYTES. Bytes
+     *  delivered so far is what is knowable here — the in-flight turn's fetches
+     *  have not happened yet — so the byte gate can overshoot by at most one
+     *  turn's worth; the backend enforces the same budget at fetch time, which
+     *  is the bound of record (see codex-backend's image loop). */
+    sessionPreviewBudgetLeft() {
+        this.reconcilePreviewLedger();
+        if (this.sessionPreviewBytes() >= MAX_SESSION_PREVIEW_BYTES)
+            return 0;
+        return Math.max(0, MAX_SESSION_PREVIEW_ATTACHMENTS - this.previewImagesCharged);
+    }
+    /** #1516 — the cumulative automatic-preview ledger, for diagnostics: what was
+     *  delivered to the current provider conversation, what was withheld at the
+     *  session budget, and the budget itself. */
+    previewBudgetStatus() {
+        this.reconcilePreviewLedger();
+        return {
+            images: this.previewImagesCharged,
+            bytes: this.sessionPreviewBytes(),
+            withheld: this.previewWithheldSession,
+            budgetImages: MAX_SESSION_PREVIEW_ATTACHMENTS,
+            budgetBytes: MAX_SESSION_PREVIEW_BYTES,
+        };
+    }
+    /** #1516 — persist the ledger through the manager so an orchestrator restart
+     *  does not reset a budget the still-living provider conversation keeps
+     *  accumulating against. Bytes are read NOW (the in-flight turn's fetches
+     *  lag), so the stored value is a lower bound — disclosed, and refreshed on
+     *  every later change. */
+    reportPreviewLedger() {
+        if (!this.deps.onPreviewLedger)
+            return;
+        try {
+            this.deps.onPreviewLedger(this.tabId, {
+                images: this.previewImagesCharged,
+                bytes: this.sessionPreviewBytes(),
+            });
+        }
+        catch (err) {
+            logger.debug(`[panel-agent ${this.short()}] preview-ledger report failed: ${msgOf(err)}`);
+        }
+    }
     /** Drop a still-queued message (the user cancelled/edited it before the agent
      *  got to it). Returns true if it was found and removed; false if it was
      *  already dequeued (the turn started — too late to cancel). */
@@ -536,10 +628,29 @@ export class PanelAgent {
             // this one, which is why the drain corrects the count rather than trusting
             // it (see MAX_RUN_COMPLETION_IMAGE_ATTACHMENTS).
             const previewBudgetLeft = Math.max(0, MAX_RUN_COMPLETION_IMAGE_ATTACHMENTS - this.queuedPreviewImageCount());
+            // #1516 — ...AND what is left of the CONVERSATION's cumulative budget.
+            // The per-turn bound above stops one turn from going unbounded; this one
+            // stops N turns from accumulating 8N inline images into a Codex rollout
+            // that compaction then recopies without a media-aware bound. Queued
+            // previews are charged against the session budget HERE too (they drain
+            // into this conversation), so a burst queueing behind a busy turn cannot
+            // over-commit it. `sessionBound` remembers WHICH budget spoke, so the
+            // notice below names the bound that actually fired.
+            const sessionBudgetLeft = Math.max(0, this.sessionPreviewBudgetLeft() - this.queuedPreviewImageCount());
+            const sessionBound = sessionBudgetLeft < previewBudgetLeft;
+            const effectiveBudget = sessionBound ? sessionBudgetLeft : previewBudgetLeft;
             const attachedImgs = correlationIsUntrusted
                 ? []
-                : attachableImgs.slice(0, previewBudgetLeft);
+                : attachableImgs.slice(0, effectiveBudget);
             const omittedImgs = attachableImgs.length - attachedImgs.length;
+            // #1516 — account for what the SESSION budget withheld (diagnostics +
+            // durable ledger). Only the session-bound case counts here: a per-turn
+            // trim is the pre-existing turn budget doing its job, and an untrusted
+            // correlation never had pixels to withhold.
+            if (sessionBound && !correlationIsUntrusted && omittedImgs > 0) {
+                this.previewWithheldSession += omittedImgs;
+                this.reportPreviewLedger();
+            }
             // The unnamed remainder. Every sentence below counts outputs with
             // `imgs.length` but attaches and names from `attachableImgs`, so on a MIXED
             // event — one output with a filename, one without — the two disagree and
@@ -614,9 +725,13 @@ export class PanelAgent {
                                     attachableImgs.length === 0
                                         ? `The panel reported no usable filename for ${imgs.length === 1 ? "it" : "them"}, so ${imgs.length === 1 ? "it is" : "they are"} NOT attached to this agent turn and cannot be fetched by name — check get_history (action:"list") if you need to see what this run produced. `
                                         : attachedImgs.length === 0
-                                            ? `NONE of these outputs are attached to this agent turn: earlier completion(s) in this same turn already spent its ${MAX_RUN_COMPLETION_IMAGE_ATTACHMENTS}-image preview budget. All ${imgs.length} are shown to the user in the panel — fetch one with get_image action:"get" if you need to look: ${withheldRefs}. `
+                                            ? sessionBound
+                                                ? `NONE of these outputs are attached to this agent turn: this conversation's cumulative automatic-preview budget (${MAX_SESSION_PREVIEW_ATTACHMENTS} images / ~${previewByteBudgetLabel()}) is spent — the bound that keeps a long session from accumulating unbounded inline media the provider retains and recopies at compaction. All ${imgs.length} are shown to the user in the panel — fetch one with get_image action:"get" if you need to look: ${withheldRefs}. `
+                                                : `NONE of these outputs are attached to this agent turn: earlier completion(s) in this same turn already spent its ${MAX_RUN_COMPLETION_IMAGE_ATTACHMENTS}-image preview budget. All ${imgs.length} are shown to the user in the panel — fetch one with get_image action:"get" if you need to look: ${withheldRefs}. `
                                             : omittedImgs > 0
-                                                ? `The first ${attachedImgs.length} image(s) are attached below; all ${imgs.length} outputs are already shown to the user in the panel. ${omittedImgs} further preview(s) were omitted to keep this TURN's image context bounded — fetch one with get_image action:"get" if you need it: ${withheldRefs}. `
+                                                ? sessionBound
+                                                    ? `The first ${attachedImgs.length} image(s) are attached below; all ${imgs.length} outputs are already shown to the user in the panel. ${omittedImgs} further preview(s) were omitted because this conversation's cumulative automatic-preview budget (${MAX_SESSION_PREVIEW_ATTACHMENTS} images / ~${previewByteBudgetLabel()}) is nearly spent — fetch one with get_image action:"get" if you need it: ${withheldRefs}. `
+                                                    : `The first ${attachedImgs.length} image(s) are attached below; all ${imgs.length} outputs are already shown to the user in the panel. ${omittedImgs} further preview(s) were omitted to keep this TURN's image context bounded — fetch one with get_image action:"get" if you need it: ${withheldRefs}. `
                                                 : `The image(s) are attached below and already shown to the user in the panel. `
                             : `You cannot view images on this provider, but they are already shown to the user in the panel. `
                         : ``) +
@@ -647,7 +762,10 @@ export class PanelAgent {
             // up to the bound above. Past it (or for an UNDETERMINED origin) the text
             // says so and points at get_image, so a fetch is needed but never a guess.
             if (this.backend.capabilities.vision) {
-                images = attachedImgs.map((i) => ({ ...i, type: i.type ?? "output" }));
+                // `automatic` is what the backend's cumulative byte ledger keys on —
+                // a user's explicit attachment never carries it and never spends the
+                // session preview budget (#1516).
+                images = attachedImgs.map((i) => ({ ...i, type: i.type ?? "output", automatic: true }));
             }
         }
         else if (ev.kind === "ask_answer") {
@@ -1155,17 +1273,34 @@ export class PanelAgent {
             // corrects the notices instead of assuming they agree with the outcome.
             // A user's own attachment is never touched — only `completionOnly` items,
             // which are the injected panel events.
-            let previewBudget = MAX_RUN_COMPLETION_IMAGE_ATTACHMENTS;
+            // The drain is also where the CUMULATIVE session budget (#1516) meets the
+            // fact of the turn: the ceiling is the tighter of the per-turn 8 and what
+            // the conversation has left. injectEvent already charged queued previews
+            // against its estimate, so an in-flight batch (invisible there) is the
+            // divergence this line absorbs — same estimate/fact split as the per-turn
+            // budget above.
+            let previewBudget = Math.min(MAX_RUN_COMPLETION_IMAGE_ATTACHMENTS, this.sessionPreviewBudgetLeft());
             const trimmedPreviews = [];
+            let deliveredPreviews = 0;
             let images = batch.flatMap((it) => {
                 const refs = it.images ?? [];
                 if (!it.completionOnly)
                     return refs;
                 const take = refs.slice(0, Math.max(0, previewBudget));
                 previewBudget -= take.length;
+                deliveredPreviews += take.length;
                 trimmedPreviews.push(...refs.slice(take.length));
                 return take;
             });
+            // Charge the conversation for what THIS turn actually carries, and persist
+            // the ledger so a restart does not reset the budget of a conversation that
+            // lives on. A replayed (interrupted-then-requeued) batch charges AGAIN —
+            // deliberately: the replay really does write those pixels into the
+            // provider thread a second time, which is the accumulation being bounded.
+            if (deliveredPreviews > 0) {
+                this.previewImagesCharged += deliveredPreviews;
+                this.reportPreviewLedger();
+            }
             // A trim here means a notice ABOVE is now wrong: it was composed when its
             // images were going to ride this turn, and they are not. Measured sequence
             // — 8 previews in flight, a second completion queued behind them (its own
@@ -1182,9 +1317,13 @@ export class PanelAgent {
             if (trimmedPreviews.length && this.backend.capabilities.vision) {
                 text +=
                     `\n\n[panel note: ${trimmedPreviews.length} automatic preview image(s) were NOT attached to this turn. ` +
-                        `Several run completions were merged into one turn and they SHARE a single ${MAX_RUN_COMPLETION_IMAGE_ATTACHMENTS}-image budget, ` +
+                        `Several run completions were merged into one turn and they SHARE one bounded automatic-preview budget (at most ${MAX_RUN_COMPLETION_IMAGE_ATTACHMENTS} per turn, and a cumulative per-conversation ceiling of ${MAX_SESSION_PREVIEW_ATTACHMENTS} images / ~${previewByteBudgetLabel()}), ` +
                         `so a notice above may say its images are "attached below" when they are not — where they disagree, THIS note is the accurate one. ` +
                         `They are outputs on the ComfyUI side that this turn does not carry — fetch any of them with get_image action:"get" — ${describeImageRefs(trimmedPreviews)}.]`;
+                // These previews are withheld from the conversation for good (the note
+                // redirects to get_image), so the diagnostics counter accounts them.
+                this.previewWithheldSession += trimmedPreviews.length;
+                this.reportPreviewLedger();
                 logger.info(`[panel-agent ${this.short()}] trimmed ${trimmedPreviews.length} automatic preview image(s) at the drain ` +
                     `(completions merged into one turn); the turn says so and names them (#1516)`);
             }
@@ -1985,6 +2124,19 @@ export class PanelAgentManager {
                 this.opts.sessionStore?.set(id, sid, this.opts.identityForKey?.(id));
                 this.opts.onSession?.(id, sid, model);
             },
+            // #1516 — persist the cumulative preview ledger beside the session id it
+            // belongs to. setPreviewLedger REFUSES a session mismatch, so a ledger is
+            // only ever stored against the exact conversation it measures — a stale
+            // report for a since-replaced session is dropped, not misfiled.
+            onPreviewLedger: (id, ledger) => {
+                const sid = this.agents.get(id)?.sessionId;
+                if (sid)
+                    this.opts.sessionStore?.setPreviewLedger(id, sid, ledger);
+            },
+            // #1516 — hand the freshly-spawned agent the durable ledger of the
+            // conversation it is expected to resume; the agent adopts it only when
+            // the live session id proves to be that exact conversation.
+            initialPreviewLedger: this.opts.sessionStore?.previewLedger(tabId),
             onTurnAnchor: this.opts.onTurnAnchor,
             // Wrap onTurn so the manager learns when a turn ends — the safe point to
             // apply a deferred, session-restarting effort change.
@@ -2004,6 +2156,7 @@ export class PanelAgentManager {
             onEventUndelivered: this.opts.onEventUndelivered,
             panelServer: this.opts.makePanelServer?.(tabId),
             pluginPath: this.opts.pluginPath,
+            isBlind: this.opts.isBlind,
         }, backend);
     }
     /** Update the system-prompt append used for NEWLY-spawned agents. Lets the