comfyui-mcp 0.52.138 → 0.52.140

package/dist/orchestrator/panel-tools.js

@@ -34,6 +34,7 @@ import { fileURLToPath } from "node:url";
 import { comfyuiFetch } from "../comfyui/fetch.js";
 import { assertPanelNotTargetedUnverifiable } from "../services/panel-pin-guard.js";
 import { findPackOnDisk, nodesInstallCommandArgs, } from "../services/node-management.js";
+import { getModelInventoryDisclosure, } from "../services/model-inventory-disclosure.js";
 import { sanitizePanelUpdateNodeResult } from "../services/manager-update-error.js";
 import { formatQueueStatusPartialNote, getManifestPartialLeftover, } from "../services/manifest-partial.js";
 import { searchPanelNodes } from "../services/manager-node-search.js";
@@ -4452,6 +4453,25 @@ function withSaveAsNameConflictNote(res) {
         return res;
     return appendToolResultText(res, SAVE_AS_NAME_CONFLICT_NOTE);
 }
+/**
+ * #2414 — a live `/models/<category>` hit does not reconcile the panel's
+ * `/object_info` combo cache. Add the distinction only when both sides are
+ * positively observed; an unavailable listing remains an ordinary refusal.
+ */
+async function withModelInventoryDisclosure(res, widget, value, ctx) {
+    if (!res.isError)
+        return res;
+    const probe = ctx.modelInventoryDisclosure ?? getModelInventoryDisclosure;
+    try {
+        const disclosure = await probe(widget, value, textOfToolResult(res));
+        return disclosure ? appendToolResultText(res, disclosure) : res;
+    }
+    catch {
+        // The disclosure is advisory. Preserve the original panel refusal if its
+        // read-only corroboration fails for any reason.
+        return res;
+    }
+}
 // ---- #1695: bound the panel_set_widget previous/new echo --------------------
 //
 // Code-mode clients (Codex `functions.exec`) batch several panel_set_widget
@@ -5181,11 +5201,41 @@ function promotedEnvelopeCarriesEvidence(payload) {
 /** The shipped panel's only definitive non-promoted result is its own
  * `Node <id> (<type>) is not a subgraph` refusal. Every other graph_get_subgraph
  * error is an indeterminate read: a disconnect, stale route, old panel, or
- * transport failure can all leave a promoted container unresolved. */
+ * transport failure can all leave a promoted container unresolved.
+ *
+ * #2394 — the parenthesised segment is the node TYPE, and a node type may itself
+ * contain parentheses: rgthree names every node that way (`Power Lora Loader
+ * (rgthree)`), as do several other packs (`KSampler (Efficient)`). A `[^)]*`
+ * body stops at the FIRST `)`, so `Node 82 (Power Lora Loader (rgthree)) is not
+ * a subgraph` did not match its own definitive message. The read was then
+ * treated as indeterminate and the write refused with "graph_get_subgraph could
+ * not determine whether the addressed node is a promoted container" — the exact
+ * refusal #2394 reported, on a node that is provably ordinary.
+ *
+ * The type body is matched as a BALANCED group (plain text, or text containing
+ * one parenthesised group) UNIONED with the original `[^)]*` branch. Both halves
+ * of that union are load-bearing, and each was added because a simpler edit
+ * regressed a case that already worked (both caught by the codex gate):
+ *
+ *  - Widening to `.*` looks equivalent but is not: `.` does not cross a newline
+ *    and `[^)]*` did, so a node type carrying a newline stopped matching.
+ *  - The balanced branch alone rejects an UNMATCHED `(` — a type like
+ *    `Power (rgthree` yields `Node 82 (Power (rgthree) is not a subgraph`, which
+ *    the original matched by stopping at the first `)`.
+ *
+ * Keeping the original branch in the union makes the accept set a strict
+ * superset of the original's, so no message that was definitive before can
+ * become indeterminate now. The reject set is unchanged: still anchored at
+ * `^Error: Node `, still requiring the literal ` is not a subgraph` tail. A type
+ * nesting parentheses more than one level deep still does not match and is
+ * refused as indeterminate — the fail-closed direction, which is the correct
+ * default for a predicate whose `true` authorizes an ordinary write. The
+ * `[canvas-root-divergence]` diagnosis never begins with `Error: Node `, so it
+ * cannot collide. */
 function isDefinitiveNonPromotedSubgraphRead(res) {
     if (!res.isError)
         return false;
-    return /^Error:\s*Node\s+\S+(?:\s+\([^)]*\))?\s+is not a subgraph\b/i.test(textOfToolResult(res));
+    return /^Error:\s*Node\s+\S+(?:\s+\((?:(?:[^()]|\([^()]*\))*|[^)]*)\))?\s+is not a subgraph\b/i.test(textOfToolResult(res));
 }
 /**
  * panel#1869 — the panel's `[canvas-root-divergence]` refusal is a DIAGNOSIS,
@@ -5564,6 +5614,41 @@ function promotedPanelBuildRefusal(ctx, nodeId, widget, reason, capability) {
  * indeterminate read fails closed because the panel can resolve a promoted
  * container to its unsafe inner node.
  */
+/**
+ * Why the panel binding is no longer the one we captured, or undefined when it is.
+ *
+ * WHY THIS IS A FUNCTION AND NOT A THIRD COPY. An early `return null` out of the
+ * promoted pre-dispatch check does not mean "refuse" — it means "this is not a promoted
+ * write, proceed on the ordinary path". So every exit that crosses an `await` is a WRITE
+ * AUTHORIZATION issued against a binding that may have moved underneath it, and each one
+ * needs the same re-read. There were two hand-written copies of these five checks; a third
+ * exit was then added between them without one, which is #2401, and fixing that exit alone
+ * left the next one bare, which is #2409. One copy, called by each exit, so the next early
+ * return has one obvious thing to call.
+ *
+ * `where` is appended to each message so the caller keeps naming its own await.
+ */
+function panelBindingDriftReason(ctx, where, hasIdentityApi, identityBefore, tabBefore) {
+    if (!hasIdentityApi)
+        return `the receiver identity was unavailable ${where}`;
+    if (!isUsablePanelConnectionIdentity(identityBefore)) {
+        return `the panel connection identity was unavailable ${where}`;
+    }
+    let identityAfter;
+    try {
+        identityAfter = ctx.panelConnectionIdentity?.();
+    }
+    catch {
+        return `the panel connection identity became unreadable ${where}`;
+    }
+    if (ctx.tabId !== tabBefore || !isUsablePanelConnectionIdentity(identityAfter)) {
+        return `the panel tab or connection changed ${where}`;
+    }
+    if (!samePanelConnectionIdentity(identityBefore, identityAfter)) {
+        return `the panel session or connection changed ${where}`;
+    }
+    return undefined;
+}
 async function preparePromotedWidgetWrite(ctx, nodeId, widget) {
     // Production PanelToolCtx is always backed by UiBridge, which exposes this
     // per-hello capability getter. A few transport-only forwarding contexts (and
@@ -5600,12 +5685,23 @@ async function preparePromotedWidgetWrite(ctx, nodeId, widget) {
     // absent. An unreadable scope probe is not permission for an outer write;
     // it falls through to the existing conservative graph_get_subgraph path.
     const targetScope = await readPromotedTargetScope(ctx, nodeId);
-    if (targetScope?.activeView === "root" && targetScope.node === "ordinary")
+    if (targetScope?.activeView === "root" && targetScope.node === "ordinary") {
+        // The scope probe crossed an await. Re-read the binding before taking the
+        // ordinary fast path; otherwise a tab/connection rebind can make this
+        // probe's ordinary classification authorize a write on the new receiver.
+        const drift = panelBindingDriftReason(ctx, "after the scope probe", hasIdentityApi, identityBefore, tabBefore);
+        if (drift)
+            return promotedWriteRefusal(widget, drift);
         return null;
+    }
     const sub = await ctx.call({ cmd: "graph_get_subgraph", node_id: nodeId });
     if (sub.isError) {
-        if (isDefinitiveNonPromotedSubgraphRead(sub))
+        if (isDefinitiveNonPromotedSubgraphRead(sub)) {
+            const drift2 = panelBindingDriftReason(ctx, "after the subgraph read", hasIdentityApi, identityBefore, tabBefore);
+            if (drift2)
+                return promotedWriteRefusal(widget, drift2);
             return null;
+        }
         return promotedSubgraphReadRefusal(widget, sub, "graph_get_subgraph could not determine whether the addressed node is a promoted container");
     }
     let payload = parseToolResultJson(sub);
@@ -8522,6 +8618,7 @@ async function rebindWorkflowFence(ctx, opts) {
             before,
             kind: "no_uuid",
             why: "the active workflow record carries no usable workflow_uuid",
+            active,
         };
     }
     // "already current" requires a KNOWN prior fence equal to the live uuid. An
@@ -9161,8 +9258,19 @@ WHAT TO DO: settle it with a graph read — call panel_graph_outline. That ` +
  * active object and accept the returned UUID only while it still names this
  * open's canonical target; otherwise leave the old stamp to fail closed.
  */
-async function refreshOpenWorkflowUuid(ctx, requestedPath, openResult) {
+async function refreshOpenWorkflowUuid(ctx, requestedPath, openResult, legacyRebind) {
     const parsedOpen = parseToolResultJson(openResult);
+    // #971 compatibility: older/lightweight bridges may return only an explicit
+    // transport route for a successful open. The proof is supplied by the one
+    // immediately following open only after the caller consumed it before any
+    // await; it is never a substitute for the modern bare-alias `opened.path` +
+    // confirmed active workflow contract.
+    const legacyReboundRoute = legacyRebind?.tabId === ctx.tabId &&
+        legacyRebind.savedIdentity === canonicalBareSavedIdentity(requestedPath) &&
+        !openResult.isError &&
+        parsedOpen?.ok === true &&
+        parsedOpen.routedTo === ctx.tabId &&
+        (typeof ctx.bridge.canReach !== "function" || ctx.bridge.canReach(ctx.tabId));
     const opened = parsedOpen?.opened;
     const openedPath = opened && typeof opened === "object" && typeof opened.path === "string"
         ? opened.path
@@ -9171,11 +9279,118 @@ async function refreshOpenWorkflowUuid(ctx, requestedPath, openResult) {
     // alias/basename to a path, but that reply must never retroactively turn the
     // alias into a UUID-refresh authorization. Require the reply to corroborate
     // the original exact saved identity before consulting the live active record.
+    const requestedSavedPath = canonicalSavedWorkflowPath(requestedPath);
+    const requestedIsBareAlias = !!requestedSavedPath && !requestedSavedPath.includes("/");
     const requestedIdentity = canonicalRequestedSavedIdentity(requestedPath);
     const openedIdentity = openedPath
         ? canonicalSavedRecordIdentity({ path: openedPath, routing_key: parsedOpen?.routing_key })
         : null;
+    if (requestedIsBareAlias) {
+        // A bare filename is only a selector. It is not safe to let a native
+        // success through unless the panel both resolved it to a saved path and
+        // gave us a fresh, explicitly confirmed active observation. In particular,
+        // an omitted `opened.path` is not a resolution, and an omitted
+        // `active_confirmed` is not confirmation (#1639).
+        if (!openedPath) {
+            if (legacyReboundRoute)
+                return null;
+            return {
+                drifted: true,
+                unverified: true,
+                activeLabel: "the panel did not return a resolved path for this filename",
+            };
+        }
+        if (!canonicalRequestedSavedIdentity(openedPath)) {
+            return {
+                drifted: true,
+                unverified: true,
+                activeLabel: "the panel did not return a resolved path for this filename",
+            };
+        }
+        let list = null;
+        try {
+            const res = await ctx.call({ cmd: "workflow_list" }, 6000);
+            if (!res?.isError)
+                list = parseToolResultJson(res);
+        }
+        catch {
+            list = null;
+        }
+        if (!list || list.active_confirmed !== true) {
+            return {
+                drifted: true,
+                unverified: true,
+                activeLabel: "the panel did not return a freshly confirmed active workflow after resolving this filename",
+            };
+        }
+        const resolvedIdentity = canonicalSavedRecordIdentity({
+            path: openedPath,
+            routing_key: parsedOpen?.routing_key,
+        });
+        const activeIdentity = canonicalSavedRecordIdentity(list.active);
+        if (resolvedIdentity && activeIdentity === resolvedIdentity) {
+            // The re-read proves which resolved path is active, but the caller only
+            // supplied an alias. Preserve #716's no-adoption rule.
+            return null;
+        }
+        if (activeIdentity) {
+            return { drifted: true, activeLabel: describeActiveRecord(list.active) };
+        }
+        return {
+            drifted: true,
+            unverified: true,
+            activeLabel: "the panel returned an unconfirmed active workflow after resolving this filename",
+        };
+    }
     if (!requestedIdentity || requestedIdentity !== openedIdentity) {
+        // A bare filename is an alias, not a saved identity. The panel's `opened.path`
+        // is the resolution of that alias; once it is available, corroborate THAT exact
+        // path against a fresh active-list read before allowing the caller to treat the
+        // success as an active-canvas success. Without this branch, the alias exits here
+        // before any live observation and a stale previous tab can be reported as active
+        // and bound (#1639).
+        const resolvedIdentity = openedPath ? canonicalRequestedSavedIdentity(openedPath) : null;
+        if (!requestedIdentity && resolvedIdentity) {
+            let list = null;
+            try {
+                const res = await ctx.call({ cmd: "workflow_list" }, 6000);
+                if (!res?.isError)
+                    list = parseToolResultJson(res);
+            }
+            catch {
+                list = null;
+            }
+            if (!list) {
+                return {
+                    drifted: true,
+                    unverified: true,
+                    activeLabel: "the panel did not return a confirmed active workflow after resolving this filename",
+                };
+            }
+            if (list.active_confirmed !== true) {
+                return {
+                    drifted: true,
+                    unverified: true,
+                    activeLabel: "the panel returned an unconfirmed active workflow after resolving this filename",
+                };
+            }
+            const activeIdentity = canonicalSavedRecordIdentity(list.active);
+            if (activeIdentity === resolvedIdentity) {
+                // The re-read proves which resolved path is active, but the caller only
+                // supplied an alias. Preserve #716's no-adoption rule: an alias may be
+                // observed for the #1639 wrong-canvas guard, never promoted into a new
+                // command-fence UUID by the reply-resolved path.
+                return null;
+            }
+            if (activeIdentity) {
+                return { drifted: true, activeLabel: describeActiveRecord(list.active) };
+            }
+            return {
+                drifted: true,
+                unverified: true,
+                activeLabel: "the panel returned an unconfirmed active workflow after resolving this filename",
+            };
+        }
         // #812 — the SAVED corroboration above can never succeed for an unsaved
         // target (there is no path), so try the parallel UNSAVED identity: the
         // caller's literal token against the panel's own proven routing_key for
@@ -9413,6 +9628,11 @@ function noReachableTabFail(cmd, ctx) {
         `sent. Retry in a moment, or rebind with panel_set_workflow_target({mode:"current"}).`);
 }
 async function openWorkflowWithVerify(path, ctx) {
+    // #971 — consume the explicit-current proof BEFORE the first await. This
+    // makes it one-shot even when this open fails, and prevents a concurrent or
+    // later open from inheriting a proof belonging to an earlier operation.
+    const legacyRebind = ctx.lastExplicitCurrentRebind;
+    ctx.lastExplicitCurrentRebind = undefined;
     // #402: after a full ComfyUI restart the browser tab re-registers a few seconds
     // later. Awaiting a stable binding BEFORE dispatching a mutating workflow_open
     // (nothing is sent yet — no double-apply risk) means the command reaches a live
@@ -9476,7 +9696,7 @@ async function openWorkflowWithVerify(path, ctx) {
                 `save-as, or edit expecting ${path}. Call panel_list_workflows to see the current state.`);
         }
         {
-            const drift = await refreshOpenWorkflowUuid(ctx, path, res);
+            const drift = await refreshOpenWorkflowUuid(ctx, path, res, legacyRebind);
             // #887 — the read above is the ONLY observation in this whole path taken
             // after a real round trip, so it is the only thing that can catch the active
             // pointer having settled elsewhere. It already declined to adopt the uuid;
@@ -9489,6 +9709,12 @@ async function openWorkflowWithVerify(path, ctx) {
             // act is typically a write. The session's fence is untouched (nothing was
             // adopted), so the tab that IS active keeps its own protection.
             if (drift) {
+                if (drift.unverified) {
+                    return fail(`workflow_open: ${path} was reported applied, but the panel could not prove that ` +
+                        `${drift.activeLabel}. The active canvas is UNKNOWN, so this open is not a ` +
+                        `success and this session's workflow identity was NOT re-pointed. Inspect ` +
+                        `panel_list_workflows before reading or writing the graph.`);
+                }
                 return fail(`workflow_open: ${path} was opened, but ${drift.activeLabel} is the ACTIVE workflow now — ` +
                     `the panel confirmed this on a re-read after the open completed. This session's ` +
                     `workflow identity was NOT re-pointed at ${path}, so the canvas you would read or ` +
@@ -9829,6 +10055,11 @@ function canonicalRequestedSavedIdentity(path) {
     // authorize replacing its existing UUID stamp.
     return canonicalPath && canonicalPath.includes("/") ? `wf:${canonicalPath}` : null;
 }
+/** Canonical identity for a bare saved-workflow selector, for one-shot #971 proof matching. */
+function canonicalBareSavedIdentity(path) {
+    const canonicalPath = canonicalSavedWorkflowPath(path);
+    return canonicalPath && !canonicalPath.includes("/") ? `wf:${canonicalPath}` : null;
+}
 /**
  * Canonical `wf:<path>` identity, but only for a complete corroborating record.
  * Command-fence replacement is stricter than pin routing: a same-path record
@@ -14918,8 +15149,9 @@ export function buildPanelToolDefs() {
             // inner mapping and set it there (the issue's own workaround), then
             // leave the subgraph so the caller's scope is unchanged.
             const refusal = parseContradictoryPromotedWidgetRefusal(textOfToolResult(first), args.widget);
-            if (!refusal || String(refusal.nodeId) !== String(args.node_id))
-                return first;
+            if (!refusal || String(refusal.nodeId) !== String(args.node_id)) {
+                return withModelInventoryDisclosure(first, args.widget, value, ctx);
+            }
             if (refusal.widget !== args.widget) {
                 const remapped = await guardedWrite(args.node_id, refusal.widget);
                 if (!remapped.isError) {
@@ -17087,6 +17319,10 @@ export function buildPanelToolDefs() {
             if (mode === "pinned" && !(path ?? "").trim()) {
                 return fail("Provide path when pinning — use panel_list_workflows to list open workflows.");
             }
+            // A prior explicit recovery proof must not survive another targeting
+            // call. It is valid only for the open immediately following the rebind
+            // that produced it.
+            ctx.lastExplicitCurrentRebind = undefined;
             // mode:'current' is the explicit, user/agent-initiated "rebind me to the
             // tab that's live now" consent signal. Self-heal a session whose captured
             // tab id was orphaned (reconnect/reload/workflow-switch) BEFORE writing the
@@ -17099,8 +17335,10 @@ export function buildPanelToolDefs() {
             // on a successful turn-pin recovery. Track that separately from the
             // real-tab rebind note below.
             let currentModeTurnRepinned = false;
+            let explicitCurrentRebindBefore;
             if (mode === "current" && ctx.rebindToActiveTab) {
                 const before = ctx.tabId;
+                explicitCurrentRebindBefore = before;
                 const recoveringScope = isScopeAddress(before);
                 // Hold the send() wait BEFORE the first await so a same-batch sibling
                 // that already hit the null pin waits instead of minting #884.
@@ -17360,6 +17598,21 @@ export function buildPanelToolDefs() {
                     rebindNote += ` The panel dropped mid-call: this session moved from tab ${tabBeforeProbe} onto tab ${ctx.tabId}, and mode:"current" was applied there too.`;
                 }
             }
+            // #971 — preserve the old-panel recovery only when the current-mode
+            // operation itself corroborated the saved identity now selected. The
+            // proof is consumed by the next open before its first await, so a failed
+            // open, a different alias, or a later open cannot inherit it.
+            if (mode === "current" &&
+                !deferredBind &&
+                explicitCurrentRebindBefore !== undefined &&
+                ctx.tabId !== explicitCurrentRebindBefore &&
+                fenceRebind &&
+                "active" in fenceRebind) {
+                const savedIdentity = canonicalSavedRecordIdentity(fenceRebind.active);
+                if (savedIdentity) {
+                    ctx.lastExplicitCurrentRebind = { tabId: ctx.tabId, savedIdentity };
+                }
+            }
             // panel#1529 — "Graph tools will target that workflow" is a CLAIM ABOUT
             // ROUTING, and this call only ever wrote the workflow-target store. It is
             // true when the panel confirmed the target IS the live canvas, because a
@@ -19535,7 +19788,7 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
             // and refuse to report freed:true when a device is still pinned.
             return annotateFreeVramAck(ctx, res);
         }),
-        def("panel_show_media", "Display one or more images, videos or AUDIO files directly in the panel chat. Use this whenever the user asks to SEE, SHOW, PLAY or HEAR a file — a disk path you composited/downloaded/generated (absolute path on the orchestrator host) OR a ComfyUI output ref ({ filename, subfolder?, type? }). Items are rendered as media cards in the agent chat area — audio gets a real player (.wav/.mp3/.flac/.ogg/.oga/.opus/.m4a/.aac), so a generated TTS or voice take is played back with this tool, not described; supply optional captions. You are never sent the audio yourself and cannot hear it. Max 8 items per call. A path item OVER the 20 MB inline cap that is not under any directory ComfyUI serves can still be shown by passing stage:true on that item — the orchestrator COPIES it into <output>/_panel_staged (an opt-in, persistent disk write; 512 MB per-file and 2 GB total caps) and displays the copy by reference. NEVER describe an image with emoji or text placeholders — call this tool instead.", {
+        def("panel_show_media", "Display one or more images, videos or AUDIO files directly in the panel chat. Use this whenever the user asks to SEE, SHOW, PLAY or HEAR a file — a disk path you composited/downloaded/generated (absolute path on the orchestrator host) OR a ComfyUI output ref ({ filename, subfolder?, type? }). Items are rendered as media cards in the agent chat area — audio gets a real player (.wav/.mp3/.flac/.ogg/.oga/.opus/.m4a/.aac), so a generated TTS or voice take is played back with this tool, not described; supply optional captions. You are never sent the audio yourself and cannot hear it. Max 8 items per call. A path item OVER the 20 MB inline cap that is not under any directory ComfyUI serves can still be shown by passing stage:true on that item — the orchestrator COPIES it into <output>/_panel_staged (an opt-in, persistent disk write; 512 MB per-file and 2 GB total caps) and displays the copy by reference. Staging needs a LOCAL ComfyUI: it is a filesystem copy into ComfyUI's own output directory, so it cannot run against a remote target (--comfyui-url on another host) and the call reports that instead of staging. NEVER describe an image with emoji or text placeholders — call this tool instead.", {
             items: z
                 .array(z.object({
                 // #1968 — OPTIONAL in the shape, required by normalizeShowMediaItem