comfyui-mcp 0.52.156 → 0.52.157

package/dist/orchestrator/panel-tools.js

@@ -184,8 +184,8 @@ function journalConversationFor(ctx) {
     return conversationOfScopeAddress(ctx.tabId);
 }
 import { BRIDGE_DEFAULT_TIMEOUT_MS, BRIDGE_READ_DEFAULT_TIMEOUT_MS, dispatchOutcomeOf, GRAPH_CMD_EFFECT, isCapabilityRefusal, isPanelCmdUnsupportedError, isMidCommandDisconnectTagged, isReplyTimeoutTagged, isRoutingAmbiguity, requiresWorkflowStampEnforcement, } from "../services/ui-bridge.js";
-import { PANEL_TOOL_BY_GRAPH_CMD, QUEUE_BUSY_READ_TOOLS, RETRY_TOKEN_CMD_BY_TOOL, panelToolForGraphCmd, } from "../services/panel-graph-cmd-tools.js";
-export { PANEL_TOOL_BY_GRAPH_CMD, QUEUE_BUSY_READ_TOOLS, RETRY_TOKEN_CMD_BY_TOOL, panelToolForGraphCmd, };
+import { GRAPH_READ_CMD_BY_TOOL, PANEL_TOOL_BY_GRAPH_CMD, QUEUE_BUSY_READ_TOOLS, RETRY_TOKEN_CMD_BY_TOOL, panelToolForGraphCmd, } from "../services/panel-graph-cmd-tools.js";
+export { GRAPH_READ_CMD_BY_TOOL, PANEL_TOOL_BY_GRAPH_CMD, QUEUE_BUSY_READ_TOOLS, RETRY_TOKEN_CMD_BY_TOOL, panelToolForGraphCmd, };
 import { withWorkflowTarget, } from "../services/workflow-target-store.js";
 import { addUserMcpServer, backendInheritsUserMcpServers, readUserMcpServers, removeUserMcpServer, setUserMcpServerSecret, } from "../services/user-mcp-config.js";
 import { setComfyuiSecret, setAgentSecret, isAllowedAgentSecretKey, receiptDisclosures, shadowedNote, storeDamageNote, } from "../services/panel-secrets.js";
@@ -853,6 +853,10 @@ export const __panelToolsTestHooks = {
     setRunLateAckGraceMs(ms) {
         runLateAckGraceMsOverride = ms;
     },
+    /** Shrink the #2527 graph-read wait for an outstanding timed-out mutation. */
+    setOutstandingMutationReadSettleMs(ms) {
+        outstandingMutationReadSettleMsOverride = ms;
+    },
     /** Mark a synthetic graph_run result as the bridge's authoritative reply timeout. */
     markRunReplyTimeout(res) {
         Object.defineProperty(res, REPLY_TIMEOUT_RESULT, {
@@ -949,6 +953,65 @@ const OBJECT_INFO_REFRESH_ACK_TIMEOUT_MS = 90_000;
  *  rather than "wait longer for a chance at completeness". 8 s is the same elective
  *  probe budget the graph_query / graph_serialize probes in this file already use. */
 const GET_ERRORS_COMPLETION_BUDGET_MS = 8_000;
+// #2527 — after a mutating graph command times out, the frontend may still be
+// applying it. An immediate graph read can then echo the pre-write value, and a
+// later write reports the timed-out value as `previous`. Graph reads wait this
+// long for that settlement, then disclose any still-outstanding receipt.
+const OUTSTANDING_MUTATION_READ_SETTLE_MS = 8_000;
+let outstandingMutationReadSettleMsOverride = null;
+function outstandingMutationReadSettleMs() {
+    return outstandingMutationReadSettleMsOverride ?? OUTSTANDING_MUTATION_READ_SETTLE_MS;
+}
+const GRAPH_READ_SETTLE_CMDS = new Set([
+    ...Object.values(GRAPH_READ_CMD_BY_TOOL),
+    "graph_get_subgraph",
+    "graph_get_state",
+    "graph_serialize",
+]);
+function isGraphReadSettleCmd(cmd) {
+    return typeof cmd.cmd === "string" && GRAPH_READ_SETTLE_CMDS.has(cmd.cmd);
+}
+function sameMutationScalar(a, b) {
+    if (a === b)
+        return true;
+    if (a == null || b == null)
+        return a == null && b == null;
+    return String(a) === String(b);
+}
+/**
+ * Semantic identity of a delivered mutation vs a retry, ignoring bridge-owned
+ * stamps (`rid`, `retry_of`, `timeout_ms`, `workflow_uuid`) and write-fence
+ * witnesses that a later probe may reconstruct (`expected_*`).
+ */
+function mutationIdentityMatches(retryCmd, delivered) {
+    if (retryCmd.cmd !== delivered.cmd)
+        return false;
+    if (retryCmd.cmd === "graph_set_widget") {
+        return (sameMutationScalar(retryCmd.node_id, delivered.node_id) &&
+            sameMutationScalar(retryCmd.widget, delivered.widget) &&
+            sameMutationScalar(retryCmd.value, delivered.value));
+    }
+    if ("node_id" in delivered)
+        return sameMutationScalar(retryCmd.node_id, delivered.node_id);
+    return true;
+}
+async function awaitOutstandingMutationSettle(bridge, tabId) {
+    const wait = bridge.waitForOutstandingMutations;
+    if (typeof wait !== "function")
+        return;
+    await wait.call(bridge, tabId, outstandingMutationReadSettleMs());
+}
+function discloseOutstandingMutations(bridge, tabId, res) {
+    const list = bridge.listOutstandingMutations?.(tabId);
+    if (!list?.length)
+        return res;
+    const named = list
+        .map((m) => `"${m.cmd}" retry_of:"${m.rid}"`)
+        .join(", ");
+    return appendReplyNote(res, `OUTCOME UNKNOWN: ${list.length} delivered mutation(s) still unsettled on this tab (${named}). ` +
+        `This graph read may show values from before those writes applied. Do not treat this snapshot ` +
+        `as proof the write failed; wait, or retry the named mutation with its retry_of token.`);
+}
 // #1639 — while a ComfyUI prompt is running the frontend main thread often
 // cannot service graph_* at all. Waiting out the 20/90 s ack bound only
 // surfaces "tab may be backgrounded or frozen" with an unknown mutation
@@ -9800,6 +9863,20 @@ function pinHonorsLiveCanvas(pin, liveActive) {
         return false;
     return readOpenActiveAgainstTarget(liveActive, pin.path) === "same";
 }
+/**
+ * Automatic fence repair needs stronger identity than legacy pin resolution.
+ * `activeMatchesTarget` intentionally accepts filename/basename aliases for
+ * compatibility, but a basename cannot prove which saved workflow is live
+ * when two directories contain the same filename. Use only a canonical path
+ * or a canonical key here; otherwise leave the dispatch fence refusing.
+ */
+function exactPinnedSavedPathMatchesLive(pinPath, liveActive) {
+    const expected = canonicalSavedWorkflowPath(pinPath);
+    if (!expected || !expected.includes("/") || !liveActive)
+        return false;
+    const observed = liveActive;
+    return [observed.path, observed.key].some((value) => canonicalSavedWorkflowPath(value) === expected);
+}
 /**
  * The ONE remedy that is actually reachable from every wedged state below, and
  * the one the reporters found to be the only thing that worked.
@@ -12363,6 +12440,12 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets, onRunTicketOpen
             const blocked = graphCmdBlockedByRunningPrompt(cmd);
             if (blocked)
                 return fail(blocked);
+            // #2527 — a timed-out mutation may still be applying. Graph reads wait for
+            // that settlement (or disclose the outstanding receipt) so they cannot
+            // certify a stale widget value as current.
+            if (isGraphReadSettleCmd(cmd)) {
+                await awaitOutstandingMutationSettle(bridge, ctx.tabId);
+            }
             // The bridge owns the graph lane and re-resolves the live connection after
             // waiting. Pass the fence through so it runs at the actual socket dispatch,
             // not before that retarget window.
@@ -12373,7 +12456,9 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets, onRunTicketOpen
             // switch inherited its age and was announced as stuck at once (codex r4).
             if (successProvesSwitchCleared(cmd.cmd))
                 clearSwitchHold(ctx.tabId);
-            return firstTry;
+            return isGraphReadSettleCmd(cmd)
+                ? discloseOutstandingMutations(bridge, ctx.tabId, firstTry)
+                : firstTry;
         }
         catch (err) {
             onFailure?.(err); // #1560 — the error this attempt failed on (see the wrapper).
@@ -12450,6 +12535,9 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets, onRunTicketOpen
                     await awaitReachable();
                     ensureReachable(); // rebinds a current-mode session onto the reconnected tab
                     holdTab = ctx.tabId;
+                    if (isGraphReadSettleCmd(cmd)) {
+                        await awaitOutstandingMutationSettle(bridge, ctx.tabId);
+                    }
                     const retried = ok(await sendRouted(cmd, timeoutMs, observeRid, beforeDispatch, options));
                     // Cleared HERE and nowhere else, and only when the failure this retried
                     // was a SWITCH refusal. Clearing on every routed success let an unguarded
@@ -12463,7 +12551,9 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets, onRunTicketOpen
                     if (isWorkflowSwitchGuardRefusal(err) && successProvesSwitchCleared(cmd.cmd)) {
                         clearSwitchHold(holdTab);
                     }
-                    return retried;
+                    return isGraphReadSettleCmd(cmd)
+                        ? discloseOutstandingMutations(bridge, ctx.tabId, retried)
+                        : retried;
                 }
                 catch (err2) {
                     // #1560 — the RETRY's failure is the one every exit below describes, so it
@@ -13017,7 +13107,9 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets, onRunTicketOpen
                             const retried = ok(await sendRouted(cmd, timeoutMs, observeRid));
                             if (successProvesSwitchCleared(cmd.cmd))
                                 clearSwitchHold(ctx.tabId);
-                            return retried;
+                            return isGraphReadSettleCmd(cmd)
+                                ? discloseOutstandingMutations(bridge, ctx.tabId, retried)
+                                : retried;
                         }
                     }
                     catch {
@@ -13046,7 +13138,9 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets, onRunTicketOpen
                             const retried = ok(await sendRouted(cmd, timeoutMs, observeRid));
                             if (successProvesSwitchCleared(cmd.cmd))
                                 clearSwitchHold(ctx.tabId);
-                            return retried;
+                            return isGraphReadSettleCmd(cmd)
+                                ? discloseOutstandingMutations(bridge, ctx.tabId, retried)
+                                : retried;
                         }
                         catch (retryErr) {
                             onFailure?.(retryErr);
@@ -13061,7 +13155,9 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets, onRunTicketOpen
                             const retried = ok(await sendRouted(cmd, timeoutMs, observeRid));
                             if (successProvesSwitchCleared(cmd.cmd))
                                 clearSwitchHold(ctx.tabId);
-                            return retried;
+                            return isGraphReadSettleCmd(cmd)
+                                ? discloseOutstandingMutations(bridge, ctx.tabId, retried)
+                                : retried;
                         }
                         catch (retryErr) {
                             onFailure?.(retryErr);
@@ -13494,6 +13590,95 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets, onRunTicketOpen
  * what I have open" is the common ask, and requiring a save-to-disk round trip
  * first derailed real sessions (deleted placeholder files, 404 tabs).
  */
+/**
+ * #2487 — whether the dispatch-time stamp-target gate would refuse a fenced
+ * graph command from this session.
+ *
+ * TRI-STATE on purpose. The gate compares the session stamp against the routed
+ * tab's LAST ADVERTISED identity, which is not the pin and is not the live
+ * canvas. A missing or throwing probe is an unmade observation, not "no
+ * disagreement".
+ */
+function stampTargetDisagrees(ctx) {
+    try {
+        const cap = ctx.tabGraphMutationCapability?.();
+        if (!cap)
+            return undefined;
+        if (cap.known !== true)
+            return undefined;
+        return cap.canMutate === false && cap.because === "target_disagreement";
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * #2487 — a pin is a PATH, not the last-active tab's advertised instance.
+ *
+ * After a verified pin, subgraph enter/exit can succeed (they go through
+ * `ctx.call`) while the next live-canvas capture — `panel_strip_workflow({})`
+ * via `bridge.send` — is refused because the routed tab still advertises a
+ * different workflow instance. The refusal names `mode:"current"`, which
+ * RELEASES the pin.
+ *
+ * Re-resolve the pin against the live canvas. If it still NAMES that canvas,
+ * reconcile a stale advertisement (#2209) or refresh a reminted instance
+ * stamp (#1913: honoring the path is not abandoning it). A pin to a
+ * DIFFERENT canvas is left alone — that refusal is the fence working.
+ *
+ * Returns whether a repair actually happened, so a caller can retry a
+ * capture that was refused for this reason and not for any other.
+ */
+async function repairPinnedStampForLiveCanvas(ctx) {
+    let pin;
+    try {
+        pin = ctx.workflowTarget?.get(ctx.tabId);
+    }
+    catch {
+        return false;
+    }
+    if (pin?.mode !== "pinned" || typeof pin.path !== "string" || pin.path.length === 0) {
+        return false;
+    }
+    if (typeof ctx.call !== "function")
+        return false;
+    let probe;
+    try {
+        probe = await rebindWorkflowFence(ctx, { adopt: false });
+    }
+    catch {
+        return false;
+    }
+    // pinHonorsLiveCanvas is the UUID-adoption gate: it needs routing_key ===
+    // wf:<path>. Current panels advertise wf:<route>:<path> (#640), which that
+    // gate reads as indeterminate. Path/filename/key equality still proves the
+    // pin names this canvas. A path/key match is required when the panel's
+    // routing shape is indeterminate; a bare filename is never enough.
+    const live = liveActiveFromProbe(probe);
+    const namesLive = pinHonorsLiveCanvas(pin, live) ||
+        exactPinnedSavedPathMatchesLive(pin.path, live);
+    if (!namesLive)
+        return false;
+    if (probe.status === "already_current") {
+        return reconcileStampTarget(ctx, probe.uuid).ok;
+    }
+    if (probe.status === "diverged") {
+        const identity = probe.active ?? { workflow_uuid: probe.uuid };
+        if (!refreshWorkflowUuid(ctx, identity))
+            return false;
+        const rec = reconcileStampTarget(ctx, probe.uuid);
+        return rec.ok || rec.why === "no_disagreement";
+    }
+    return false;
+}
+/** Live-canvas capture: the same pin injection `ctx.call` applies, over the
+ *  direct `bridge.send` this path has to use (it needs the raw graph, not a
+ *  ToolResult wrapper). */
+async function sendLiveCanvasGraphCmd(ctx, cmd, timeoutMs) {
+    const target = ctx.workflowTarget?.get(ctx.tabId);
+    const routed = target ? withWorkflowTarget({ cmd }, target) : { cmd };
+    return ctx.bridge.send(routed, { tabId: ctx.tabId, timeoutMs });
+}
 /**
  * Rebuild a UI-format workflow ({ nodes, links }) from the panel's back-compat
  * `graph_get_state` reply (the #384 fallback). Each summarized node carries its
@@ -13672,18 +13857,27 @@ notes) {
     let reply;
     try {
         ctx.ensureReachable?.();
-        // Route to the SAME authoritative target as ctx.call: when the session is
-        // pinned, inject the pinned workflow_path so the live-canvas capture serializes
-        // the PINNED workflow, not whatever tab is visible (codex — this direct send
-        // otherwise bypasses withWorkflowTarget and reads the wrong graph).
-        const target = ctx.workflowTarget?.get(ctx.tabId);
-        const cmd = target
-            ? withWorkflowTarget({ cmd: "graph_serialize" }, target)
-            : { cmd: "graph_serialize" };
-        reply = await ctx.bridge.send(cmd, {
-            tabId: ctx.tabId,
-            timeoutMs: 30000,
-        });
+        // #2487 — honor a verified pin BEFORE the capture is compared against the
+        // routed tab's last-advertised identity. That advertisement is unrelated
+        // active-tab state: subgraph enter/exit can leave it stale while the pin
+        // still names the live canvas. Re-resolve here rather than telling the
+        // caller to `mode:"current"`, which would release the pin. Cheap when the
+        // gate is not refusing; a missing probe is not treated as disagreement.
+        if (stampTargetDisagrees(ctx) === true) {
+            await repairPinnedStampForLiveCanvas(ctx);
+        }
+        try {
+            reply = await sendLiveCanvasGraphCmd(ctx, "graph_serialize", 30000);
+        }
+        catch (err) {
+            // The capability probe is optional (lightweight ctxs omit it) and can
+            // miss a disagreement the send() gate still sees. One repair+retry, and
+            // only for this refusal — any other capture error keeps its own path.
+            if (!isWorkflowInstanceMismatch(err) || !(await repairPinnedStampForLiveCanvas(ctx))) {
+                throw err;
+            }
+            reply = await sendLiveCanvasGraphCmd(ctx, "graph_serialize", 30000);
+        }
     }
     catch (err) {
         // #384: a panel too old to register graph_serialize (added at 0.8.2) still
@@ -13700,14 +13894,7 @@ notes) {
         const msg = err instanceof Error ? err.message : String(err);
         if (allowStateFallback && isPanelCmdUnsupportedError(err, "graph_serialize")) {
             try {
-                const target = ctx.workflowTarget?.get(ctx.tabId);
-                const stateCmd = target
-                    ? withWorkflowTarget({ cmd: "graph_get_state" }, target)
-                    : { cmd: "graph_get_state" };
-                const stateReply = await ctx.bridge.send(stateCmd, {
-                    tabId: ctx.tabId,
-                    timeoutMs: 30000,
-                });
+                const stateReply = await sendLiveCanvasGraphCmd(ctx, "graph_get_state", 30000);
                 const rebuilt = reconstructUiFromState(stateReply);
                 if (rebuilt)
                     return rebuilt;
@@ -13741,14 +13928,7 @@ notes) {
     if (allowStateFallback && notes) {
         let stateReply;
         try {
-            const target = ctx.workflowTarget?.get(ctx.tabId);
-            const stateCmd = target
-                ? withWorkflowTarget({ cmd: "graph_get_state" }, target)
-                : { cmd: "graph_get_state" };
-            stateReply = await ctx.bridge.send(stateCmd, {
-                tabId: ctx.tabId,
-                timeoutMs: 30000,
-            });
+            stateReply = await sendLiveCanvasGraphCmd(ctx, "graph_get_state", 30000);
         }
         catch (err) {
             // Never fatal: strip already HAS a usable graph. Losing the cross-check
@@ -15093,32 +15273,50 @@ function withRetryToken(d) {
             // they just named it. Drained here (once) and reported alongside the
             // retry's own outcome.
             //
-            // Deliberately NOT a short-circuit. Skipping the dispatch would be wrong
-            // whenever the token is stale or pasted onto different args -- the bridge
-            // stores the rid, not a fingerprint of what it carried, so "the write for
-            // this rid landed" does not prove "the write you are asking for now is
-            // that same write". Suppressing a real mutation on that inference is the
-            // #683 mistake with the arrow reversed, and #687 reverted it for cause.
-            // Double-apply is already the #521 panel ledger's job; this only makes the
-            // outcome VISIBLE, which is the half of #694 nothing else does.
-            const wrapped = Object.create(ctx);
-            wrapped.call = (cmd, timeoutMs, onDispatchedRid, beforeDispatch) => ctx.call(
-            // Ask the RETRY MAP's question, not the workflow fence's (codex gate).
-            // These were the same answer only while isMutatingGraphCommand
-            // over-classified — the #778 defect. Once the fence got its own effect
-            // ledger they diverged, and gating on the fence would have SILENTLY
-            // DROPPED a caller-supplied retry_of for the four UI-state commands the
-            // map admits on purpose: the schema accepts the token, the description
-            // promises dedupe, and nothing would reach the wire. A caller who
-            // believes their retry is deduped and is wrong is exactly the failure
-            // the token exists to prevent.
+            // #683/#687 — do NOT short-circuit on rid alone. The token names an
+            // attempt, not a fingerprint of its args, so "this rid landed" does not
+            // prove "the write you are asking for now is that same write".
             //
-            // A read probe inside a mutating handler (panel_flatten_workflow's
-            // graph_serialize) is still excluded — RETRY_TOKEN_CMDS contains no
-            // reads, which is asserted in panel-retry-identity.test.ts.
-            RETRY_TOKEN_CMDS.has(typeof cmd.cmd === "string" ? cmd.cmd : "")
-                ? { ...cmd, retry_of: retryOf }
-                : cmd, timeoutMs, onDispatchedRid, beforeDispatch);
+            // #2527 — when the receipt for that rid is the SAME command (semantic
+            // identity) and the frontend has already settled it, re-dispatching is
+            // what gets rejected as "retry_of refers to a different command or
+            // workflow". Answer from the receipt instead. A sibling mutation inside
+            // the same handler (enter_subgraph during a set_widget retry) must not
+            // carry this token at all.
+            const wrapped = Object.create(ctx);
+            wrapped.call = (cmd, timeoutMs, onDispatchedRid, beforeDispatch) => {
+                const cmdName = typeof cmd.cmd === "string" ? cmd.cmd : "";
+                const original = ctx.bridge?.peekDeliveredMutation?.(retryOf);
+                if (original) {
+                    if (original.cmd !== cmdName) {
+                        return ctx.call(cmd, timeoutMs, onDispatchedRid, beforeDispatch);
+                    }
+                    const settled = ctx.bridge.peekLateMutation?.(retryOf);
+                    if (settled && mutationIdentityMatches(cmd, original.frame)) {
+                        return Promise.resolve(ok(settled.result !== undefined ? settled.result : { ok: true, retry_of: retryOf }));
+                    }
+                    if (mutationIdentityMatches(cmd, original.frame)) {
+                        const replay = { ...original.frame, retry_of: retryOf };
+                        delete replay.rid;
+                        return ctx.call(replay, timeoutMs, onDispatchedRid, beforeDispatch);
+                    }
+                }
+                return ctx.call(
+                // Ask the RETRY MAP's question, not the workflow fence's (codex gate).
+                // These were the same answer only while isMutatingGraphCommand
+                // over-classified — the #778 defect. Once the fence got its own effect
+                // ledger they diverged, and gating on the fence would have SILENTLY
+                // DROPPED a caller-supplied retry_of for the four UI-state commands the
+                // map admits on purpose: the schema accepts the token, the description
+                // promises dedupe, and nothing would reach the wire. A caller who
+                // believes their retry is deduped and is wrong is exactly the failure
+                // the token exists to prevent.
+                //
+                // A read probe inside a mutating handler (panel_flatten_workflow's
+                // graph_serialize) is still excluded — RETRY_TOKEN_CMDS contains no
+                // reads, which is asserted in panel-retry-identity.test.ts.
+                RETRY_TOKEN_CMDS.has(cmdName) ? { ...cmd, retry_of: retryOf } : cmd, timeoutMs, onDispatchedRid, beforeDispatch);
+            };
             const out = await d.handler(args, wrapped);
             // Drained AFTER the handler, deliberately, for two measured reasons.
             //