comfyui-mcp 0.52.129 → 0.52.130

package/dist/services/download-cache.js

@@ -985,10 +985,7 @@ function cacheIdentity(url, headers, storageAuth) {
     return id;
 }
 function cachePathForUrl(url, headers = {}, storageAuth) {
-    const hash = createHash("sha256")
-        .update(cacheIdentity(url, headers, storageAuth))
-        .digest("hex")
-        .slice(0, HASH_CHARS);
+    const hash = cacheIdentityKey(url, headers, storageAuth);
     let extension = "";
     try {
         extension = extname(basename(new URL(url).pathname));
@@ -999,6 +996,139 @@ function cachePathForUrl(url, headers = {}, storageAuth) {
     }
     return join(cacheDir(), `${hash}${extension}`);
 }
+/**
+ * Claim the deterministic cache identity before reading, truncating, appending,
+ * or renaming its staged files. The persisted-job scan is intentionally only a
+ * liveness/adoption hint; it is not atomic. This O_EXCL claim closes the remaining
+ * cross-process overlap window for the shared `.partial` and refuses on any
+ * unclassified/live owner rather than guessing that an observed snapshot is safe.
+ */
+async function acquireStagedWriterLock(partialPath, logUrl) {
+    const lockPath = `${partialPath}.lock`;
+    const token = randomBytes(16).toString("hex");
+    const body = JSON.stringify({ pid: process.pid, token, updated: Date.now() });
+    for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+            await writeFile(lockPath, body, { flag: "wx", mode: 0o600 });
+            return {
+                release: async () => {
+                    try {
+                        const current = JSON.parse(await readFile(lockPath, "utf8"));
+                        // Never remove a successor's claim if a cleanup race replaced this one.
+                        if (current.token === token)
+                            await rm(lockPath, { force: true });
+                    }
+                    catch {
+                        // Best effort. A failed cleanup leaves a visible claim; the next caller
+                        // will probe its pid and either reclaim a dead owner or refuse safely.
+                    }
+                },
+            };
+        }
+        catch (err) {
+            if (err?.code !== "EEXIST")
+                throw err;
+            let observedRaw;
+            let owner;
+            try {
+                observedRaw = await readFile(lockPath);
+                owner = JSON.parse(observedRaw.toString("utf8"));
+            }
+            catch {
+                throw interferenceError("the staged writer lock exists but its owner identity could not be read", "before starting", logUrl);
+            }
+            const pid = owner.pid;
+            // Keep this in the range Node accepts for process.kill. A positive integer
+            // outside signed 32-bit range is still an invalid syscall argument (for
+            // example 999999999999 produces ERR_INVALID_ARG_TYPE), not proof of a dead
+            // owner. Treat every such shape as an ownership refusal.
+            if (typeof pid !== "number" ||
+                !Number.isSafeInteger(pid) ||
+                pid <= 0 ||
+                pid > 0x7fff_ffff) {
+                throw interferenceError("the staged writer lock has no valid owner identity", "before starting", logUrl);
+            }
+            let ownerGone = false;
+            try {
+                process.kill(pid, 0);
+            }
+            catch (probeErr) {
+                // An existing process, including this process, means a live claim. Only
+                // ESRCH is proof that the lock owner is gone; EPERM/other errors are
+                // inconclusive and must remain ModelError refusals so callers cannot
+                // fall through to an unlocked direct download.
+                const code = probeErr?.code;
+                if (code !== "ESRCH") {
+                    throw interferenceError(`the staged writer owner's process could not be verified (PID probe failed with ${code ?? "an unknown error"})`, "before starting", logUrl);
+                }
+                ownerGone = true;
+            }
+            if (!ownerGone) {
+                throw interferenceError(`the staged writer lock is held by process ${pid}`, "before starting", logUrl);
+            }
+            // The recorded owner is proven gone. Move the exact path aside atomically,
+            // then compare the moved bytes with the observation. A contender that got
+            // here after another contender installed a replacement will move THAT live
+            // claim instead; the comparison catches it before anything is deleted.
+            //
+            // Restore a changed claim with an O_EXCL hard link, never rename: rename can
+            // overwrite a successor that landed while the aside copy was being checked.
+            // `link` is supported on the local filesystems supported by this cache and
+            // fails with EEXIST if another contender already restored/replaced the path.
+            const claimPath = `${lockPath}.stale-${randomBytes(16).toString("hex")}`;
+            try {
+                await downloadCacheFs.rename(lockPath, claimPath);
+            }
+            catch (err) {
+                if (err?.code === "ENOENT")
+                    continue;
+                throw interferenceError("the staged writer lock changed before its stale claim could be moved", "before starting", logUrl);
+            }
+            let movedRaw;
+            try {
+                movedRaw = await readFile(claimPath);
+            }
+            catch {
+                try {
+                    await downloadCacheFs.link(claimPath, lockPath);
+                    await downloadCacheFs.rm(claimPath, { force: true });
+                }
+                catch {
+                    // Preserve the aside copy when restoration loses to a successor or
+                    // the filesystem refuses the non-overwriting restore operation.
+                }
+                throw interferenceError("the stale writer claim could not be re-read after its atomic move", "before starting", logUrl);
+            }
+            if (!movedRaw.equals(observedRaw)) {
+                try {
+                    await downloadCacheFs.link(claimPath, lockPath);
+                    await downloadCacheFs.rm(claimPath, { force: true });
+                }
+                catch {
+                    // EEXIST means a successor already occupies the canonical path; any
+                    // other failure leaves the aside copy intact for diagnosis. In neither
+                    // case may this contender remove bytes it did not create.
+                }
+                throw interferenceError("the staged writer lock changed while its stale claim was being reclaimed", "before starting", logUrl);
+            }
+            // The exact dead claim was moved, so removing only its private aside copy
+            // cannot affect a successor that may already have claimed lockPath.
+            await downloadCacheFs.rm(claimPath, { force: true }).catch(() => undefined);
+        }
+    }
+    throw interferenceError("another writer won the staged identity claim", "before starting", logUrl);
+}
+function cacheIdentityKey(url, headers, storageAuth) {
+    return createHash("sha256")
+        .update(cacheIdentity(url, headers, storageAuth))
+        .digest("hex")
+        .slice(0, HASH_CHARS);
+}
+export function downloadCacheIdentity(url, headers = {}, storageAuth) {
+    const cacheKey = cacheIdentityKey(url, headers, storageAuth);
+    const cachePath = cachePathForUrl(url, headers, storageAuth);
+    return { cacheKey, cachePath, partialPath: stagedPartialPathForTarget(cachePath) };
+}
 async function touch(path) {
     const now = new Date();
     await downloadCacheFs.utimes(path, now, now);
@@ -2106,7 +2236,9 @@ fetchImpl = downloadFetch) {
     // Representation-aware identity (#467): a same-URL download with different HTTP
     // auth headers OR different cloud (S3/Azure) credentials gets its OWN cache file,
     // partial and in-flight slot — never coalesced onto another caller's stream.
-    const target = cachePathForUrl(url, headers, storageAuth);
+    const identity = downloadCacheIdentity(url, headers, storageAuth);
+    const target = identity.cachePath;
+    const partial = stagedPartialPathForTarget(target);
     const key = target;
     const existing = inflight.get(key);
     // A job COALESCING onto an in-flight physical download gets no resume decision
@@ -2130,8 +2262,15 @@ fetchImpl = downloadFetch) {
     // can ever false-complete or be corrupted by another's cancel.
     if (existing)
         return existing;
+    // `inflight` deduplicates callers in THIS process. The atomic staged claim is
+    // the cross-process gate: a second session must refuse before it can observe,
+    // truncate, append, or rename the shared partial. The claim is acquired inside
+    // the promise, after that promise is published, so same-process callers coalesce
+    // before either one reaches the filesystem.
+    let stagedLock;
     const promise = (async () => {
         await downloadCacheFs.mkdir(cacheDir(), { recursive: true });
+        stagedLock = await acquireStagedWriterLock(partial, logUrl ?? redactUrlForLogs(url));
         try {
             const info = await downloadCacheFs.stat(target);
             if (info.isFile()) {
@@ -2159,7 +2298,6 @@ fetchImpl = downloadFetch) {
         // resumes from the byte it left off on the next call, rather than
         // restarting from zero. (See streamUrlToFile for the Range + flags
         // handshake.) Cleanup on terminal failure stays unchanged.
-        const partial = stagedPartialPathForTarget(target);
         const rejectedMarker = `${partial}.rejected`;
         /**
          * The byte offset THIS attempt may resume from, re-derived from disk every
@@ -2600,6 +2738,7 @@ fetchImpl = downloadFetch) {
     }
     finally {
         inflight.delete(key);
+        await stagedLock?.release();
     }
 }
 /** A cryptographically-random, unguessable temp path next to `base`. NOT a
@@ -3036,7 +3175,50 @@ export function stagedPartialPathForTarget(target) {
  * name", never "none exists" — and the caller must not upgrade it to the latter.
  */
 export function stagedPartialPathForUrl(url) {
-    return stagedPartialPathForTarget(cachePathForUrl(url));
+    return downloadCacheIdentity(url).partialPath;
+}
+/** Read a staged partial at the exact path selected by the local writer. */
+export async function observeStagedPartialAtPath(path) {
+    if (typeof path !== "string" || !path.trim()) {
+        return { state: "unavailable", path: "" };
+    }
+    // Preserve the writer's exact path. The cache root may legitimately contain
+    // whitespace, and trimming here would silently inspect a different identity.
+    const candidate = path;
+    try {
+        const st = await stat(candidate);
+        if (!st.isFile())
+            return { state: "unavailable", path: candidate };
+        // A real zero-byte staged file carries no bytes that a re-issued download
+        // can resume. Preserve the prior bytes > 0 contract by treating it as
+        // non-resumable/absent rather than a present durable partial.
+        if (st.size <= 0)
+            return { state: "absent", path: candidate };
+        return { state: "present", path: candidate, bytes: st.size, modifiedMs: st.mtimeMs };
+    }
+    catch (err) {
+        // ENOENT is a useful observation: no resumable file exists yet. Permission,
+        // sharing, and other stat failures are deliberately kept distinct so status
+        // cannot turn an unreadable file into "0 bytes" or "absent".
+        if (err?.code === "ENOENT") {
+            return { state: "absent", path: candidate };
+        }
+        return { state: "unavailable", path: candidate };
+    }
+}
+/** Read the staged partial that the local downloader would use for `url`. */
+export async function observeStagedPartial(url, headers = {}, storageAuth) {
+    if (typeof url !== "string" || !url.trim()) {
+        return { state: "unavailable", path: "" };
+    }
+    let partialPath;
+    try {
+        partialPath = downloadCacheIdentity(url.trim(), headers, storageAuth).partialPath;
+    }
+    catch {
+        return { state: "unavailable", path: "" };
+    }
+    return observeStagedPartialAtPath(partialPath);
 }
 /**
  * Stat the staged `.partial` for a URL. Returns null when there is nothing usable there.
@@ -3054,23 +3236,10 @@ export function stagedPartialPathForUrl(url) {
  * the historical bare-URL behaviour, whose scope the note on `stagedPartialPathForUrl`
  * states. A miss still means "none found under this identity", never "none exists".
  */
-export async function findResumablePartial(url, headers = {}) {
-    if (typeof url !== "string" || !url.trim())
-        return null;
-    let candidate;
-    try {
-        candidate = stagedPartialPathForTarget(cachePathForUrl(url.trim(), headers));
-    }
-    catch {
-        return null;
-    }
-    try {
-        const st = await stat(candidate);
-        if (st.isFile() && st.size > 0)
-            return { path: candidate, bytes: st.size };
-    }
-    catch {
-        // ENOENT is the common, expected answer.
+export async function findResumablePartial(url, headers = {}, storageAuth) {
+    const observed = await observeStagedPartial(url, headers, storageAuth);
+    if (observed.state === "present" && observed.bytes > 0) {
+        return { path: observed.path, bytes: observed.bytes };
     }
     return null;
 }