comfyui-mcp 0.52.35 → 0.52.36

package/dist/orchestrator/panel-tools.js

@@ -1460,16 +1460,7 @@ export function classifyTabReconnect({ serverReady, baselineCaptured, tabBack, }
 export function classifyRestartFallbackTarget({ headlessBase, panelBase, observedOrigin = null, }) {
     if (panelBase != null && sameHttpBase(headlessBase, panelBase))
         return { kind: "same" };
-    const dnsAmbiguous = (u) => {
-        if (!u)
-            return false;
-        try {
-            return new URL(u).hostname.toLowerCase().replace(/^\[|\]$/g, "") === "localhost";
-        }
-        catch {
-            return false;
-        }
-    };
+    const dnsAmbiguous = isDnsAmbiguousLoopback;
     const originMismatch = observedOrigin != null &&
         !dnsAmbiguous(observedOrigin) &&
         !dnsAmbiguous(headlessBase) &&
@@ -1597,7 +1588,11 @@ function restartRefusedPreservingBinding(ctx, note) {
         note,
     });
 }
-function unboundLocalRestartRefusalNote(ctx, panelBase) {
+function unboundLocalRestartRefusalNote(ctx, panelBase, 
+// panel#1546 — the blocker from the SAME capture that produced `panelBase`.
+// Passed in rather than re-derived: a second call to the classifier could read
+// a binding that changed in between and explain a refusal that did not happen.
+blocker = null) {
     return ("Refusing to restart ComfyUI: I could not confirm that this panel's ComfyUI is " +
         "the local instance I can account for, so I cannot tell which server the restart " +
         "would stop — and it STOPS it, relying on whatever supervises it to start it " +
@@ -1623,6 +1618,10 @@ function unboundLocalRestartRefusalNote(ctx, panelBase) {
             panelBase,
             observedOrigin: ctx.bridge?.tabServerOrigin?.(ctx.tabId) ?? null,
         }) +
+        // panel#1546 — and say WHICH proof was missing. Without this, a `localhost`
+        // origin (curable in one step), an absent Origin (cured by updating the
+        // panel) and a relayed tab (not curable here at all) were the same sentence.
+        restartIdentityBlockerNote(blocker) +
         // artokun/comfyui-mcp-panel#769 — a REMOTE ComfyUI reached over a
         // tunnel or port-forward has a LOOPBACK host, and remoteUrlActive is
         // derived from exactly that (`forceRemote || !isLoopbackHost(host)`).
@@ -1848,16 +1847,28 @@ function objectInfoHostMismatchMessage(err) {
 
 Node definitions are read from COMFYUI_URL (${configured}) for a pack/path/inline source. That host did not answer /object_info.`;
 }
-function captureRebootHealthBase(ctx) {
+/** The SINGLE decision. `captureRebootHealthBase` returns `.base`; the refusal
+ *  note reads `.blocker`. Two readers of one evidence set that cannot disagree —
+ *  the same reason `classifyRestartFallbackTarget` was extracted for #1593. */
+function resolveRebootHealthBinding(ctx) {
+    const no = (blocker) => ({ base: null, blocker });
     if (isCloudMode() || isRemoteMode())
-        return null;
+        return no({ kind: "not-local-mode" });
     const bootBase = getBootLocalComfyUIBaseUrl(); // server-authorized, hello-immutable
-    if (!bootBase || !isLoopbackOrigin(bootBase))
-        return null;
+    if (!bootBase)
+        return no({ kind: "no-boot-base" });
+    // `localhost` fails isLoopbackOrigin (loopbackFamily returns null for it by
+    // design), so it lands here — NOT in the origin comparison below, which never
+    // sees an ambiguous boot base. Naming it separately is the difference between
+    // "your ComfyUI is not on this machine" (false) and a config line to change.
+    if (isDnsAmbiguousLoopback(bootBase))
+        return no({ kind: "boot-base-dns-ambiguous", bootBase });
+    if (!isLoopbackOrigin(bootBase))
+        return no({ kind: "boot-base-not-loopback", bootBase });
     const base = bootBase.replace(/\/+$/, "");
     // Server-trusted provenance: the tab arrived on the token-less loopback listener.
     if (ctx.bridge?.tabIsLocal?.(ctx.tabId) !== true)
-        return null;
+        return no({ kind: "tab-not-local" });
     // And the rebooted tab must provably front THAT SAME boot instance. Use the SERVER-
     // OBSERVED handshake Origin (tabServerOrigin) — the browser sets it on the WS upgrade
     // and blocks page JS from forging it — NOT the spoofable client hello.comfyui_url
@@ -1874,13 +1885,143 @@ function captureRebootHealthBase(ctx) {
     // (loopbackFamily → null), so it never matches a concrete literal and this returns null
     // (coordinator P0). A different instance / family / path / absent Origin → null too.
     const origin = ctx.bridge?.tabServerOrigin?.(ctx.tabId);
-    if (!sameHttpBase(origin, base))
-        return null;
+    if (!sameHttpBase(origin, base)) {
+        // SAME verdict as before — only the reason is now carried out. Ordered so each
+        // kind names the FIRST thing that made a match impossible, because that is the
+        // one the reader can act on.
+        if (!origin)
+            return no({ kind: "origin-absent", bootBase: base });
+        return no(classifyOriginBlocker(origin, base));
+    }
     // Return a CONNECTABLE probe URL bound to the SAME concrete family identity matched
     // above: a wildcard-bound (0.0.0.0/::) local ComfyUI is reachable on loopback, so probe
     // the family literal at that port (127.0.0.1 / [::1]). The probe (and the auth headers
     // it carries) can therefore never cross to a different-family instance.
-    return loopbackProbeUrl(base);
+    return { base: loopbackProbeUrl(base), blocker: null };
+}
+function captureRebootHealthBase(ctx) {
+    return resolveRebootHealthBinding(ctx).base;
+}
+/**
+ * panel#1546 — WHY a present Origin failed to match the boot base.
+ *
+ * Ordered so each verdict names the FIRST thing that made a match impossible, and
+ * NEVER blames the DNS ambiguity for something the ambiguity did not cause. A
+ * `localhost` origin on a DIFFERENT PORT is a different server and is reported as
+ * one; a `localhost` origin against a basePath mount is unprovable even with the
+ * host resolved, so it stays the path verdict. Only the case where resolving
+ * `localhost` would ACTUALLY settle it — same port, no mount, exactly one
+ * ambiguous side — gets the DNS answer and its one-step remedy.
+ *
+ * Exported for test: the boot base is fixed at process start, so the
+ * boot-side-ambiguous direction has no handler-driven fixture.
+ */
+export function classifyOriginBlocker(origin, bootBase) {
+    // Callers reach here only past `isLoopbackOrigin(bootBase)`, which rejects
+    // `localhost` — so the boot base is always a concrete literal and the panel is
+    // the only side that can be ambiguous. Asserted, not assumed: an ambiguous boot
+    // base would make the comparison below meaningless rather than merely wrong.
+    if (isDnsAmbiguousLoopback(origin) && !isDnsAmbiguousLoopback(bootBase)) {
+        let sameSpot = false;
+        try {
+            const o = new URL(origin);
+            const b = new URL(bootBase);
+            // A handshake Origin is pathless BY CONSTRUCTION — normalizeHandshakeOrigin
+            // rebuilds it from protocol/hostname/port and relayIdentityOrigin uses
+            // URL.origin — so only the BOOT base can carry a mount, and the DNS answer
+            // can never settle one. Ports must already agree; resolving a hostname never
+            // reconciles :8188 with :8189. Compare EFFECTIVE ports: the same normalizer
+            // fills in 80/443 explicitly, so a default-port boot base ("") would
+            // otherwise read as a port mismatch against an origin that says "80".
+            const port = (u) => u.port || (u.protocol === "https:" ? "443" : "80");
+            sameSpot =
+                o.protocol === b.protocol &&
+                    port(o) === port(b) &&
+                    b.pathname.replace(/\/+$/, "") === "";
+        }
+        catch {
+            sameSpot = false;
+        }
+        if (sameSpot)
+            return { kind: "origin-dns-ambiguous", bootBase, origin };
+    }
+    // The Origin is pathless by construction, so a boot base under a basePath mount
+    // can be same-ORIGIN yet unprovable as the same INSTANCE. Distinguish that from a
+    // genuinely different host:port, which is the #851 wrong-server case.
+    if (sameHttpOrigin(origin, bootBase))
+        return { kind: "origin-path-ambiguous", bootBase, origin };
+    return { kind: "origin-different", bootBase, origin };
+}
+/** True when a URL's host is the DNS-ambiguous `localhost` — it names a loopback
+ *  service without revealing which family the browser actually reached, which is
+ *  exactly why `loopbackFamily` refuses it (coordinator P0, #1233). Shared by the
+ *  blocker classifier and `classifyRestartFallbackTarget` so "ambiguous" means one
+ *  thing in this file. */
+function isDnsAmbiguousLoopback(rawUrl) {
+    if (!rawUrl)
+        return false;
+    try {
+        return new URL(rawUrl).hostname.toLowerCase().replace(/^\[|\]$/g, "") === "localhost";
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * panel#1546 — the one sentence that turns the refusal from a dead end into a step.
+ *
+ * The reporter's panel was attached, local and graph-tool ready; the refusal named
+ * neither what was missing nor how to supply it, so the filed diagnosis was
+ * "target identity cannot be confirmed" with no next action. Each blocker has a
+ * DIFFERENT next action, and `origin-dns-ambiguous` — a browser at
+ * `localhost:8188` against a `127.0.0.1:8188` boot base, the ordinary local setup
+ * this file's own comments already flag as returning null — has a one-step one.
+ *
+ * Deliberately NOT a fix for the underlying ambiguity. Proving that a `localhost`
+ * tab reached the boot family would mean trusting a resolution this process did
+ * not observe, and #1233 recorded why that is a P0. Naming the cause costs no
+ * soundness; guessing it would.
+ */
+export function restartIdentityBlockerNote(blocker) {
+    if (!blocker)
+        return "";
+    const why = " WHY I could not confirm it: ";
+    switch (blocker.kind) {
+        case "not-local-mode":
+            return `${why}this target is configured as remote/cloud, so there is no local process here to account for.`;
+        case "no-boot-base":
+            return `${why}no local ComfyUI address was resolvable when this server started, so there is no boot instance to compare against.`;
+        case "boot-base-not-loopback":
+            return (`${why}the ComfyUI this server booted against (${blocker.bootBase}) is not a loopback address, ` +
+                "so it is not a process on this machine that I can account for.");
+        case "boot-base-dns-ambiguous":
+            return (`${why}this server is configured with COMFYUI_URL=${blocker.bootBase}. That IS loopback, but ` +
+                `"localhost" does not say which address it resolves to — 127.0.0.1 and ::1 can be DIFFERENT ` +
+                "ComfyUI instances on the same port — so I cannot tie it to a specific local process, and no " +
+                "panel tab can be matched against it. This disables the panel restart for every tab, not just " +
+                "this one. FIX: set COMFYUI_URL to the literal your ComfyUI actually listens on " +
+                "(http://127.0.0.1:<port>, or http://[::1]:<port> for an IPv6-only bind) and restart this server.");
+        case "tab-not-local":
+            return (`${why}this panel tab did not arrive on the local loopback listener — it reached me over a relay, ` +
+                "tunnel, LAN address or pairing link, so I cannot treat the ComfyUI behind it as one of mine. " +
+                "Restart it from the machine it actually runs on.");
+        case "origin-absent":
+            return (`${why}this tab's WebSocket handshake carried no Origin, so there is nothing to check against ` +
+                `the boot instance (${blocker.bootBase}). An older panel build does this; updating the panel restores the proof.`);
+        case "origin-dns-ambiguous":
+            return (`${why}this panel is open at ${blocker.origin}, and "localhost" does not say which loopback ` +
+                `address the browser actually reached — it can be 127.0.0.1 or ::1, and those can be DIFFERENT ` +
+                `ComfyUI instances on the same port. The boot instance I account for is ${blocker.bootBase}, so ` +
+                `I cannot show the two are one server. FIX: open the panel at ${loopbackProbeUrl(blocker.bootBase)} ` +
+                `— the same ComfyUI, addressed by its literal.`);
+        case "origin-path-ambiguous":
+            return (`${why}the boot instance is mounted under a path (${blocker.bootBase}) and a handshake Origin ` +
+                `carries no path (${blocker.origin}), so this tab could be fronting a different ComfyUI at the ` +
+                "same host and port. I will not stop a server on that.");
+        case "origin-different":
+            return (`${why}this panel is open at ${blocker.origin}, which is not the ComfyUI this server booted ` +
+                `against (${blocker.bootBase}) — a different server, so stopping mine would not restart yours.`);
+    }
 }
 /**
  * #1671 — the configured LOCAL boot instance, when that is a known loopback
@@ -13238,7 +13379,8 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
             // of the current binding: a silent rebind here would confirm a restart of
             // a tab the user was not working in. Healing belongs on the refusal path.
             if (!isRemoteMode() && !isCloudMode()) {
-                const identityHealthBase = captureRebootHealthBase(ctx);
+                const identityBinding = resolveRebootHealthBinding(ctx);
+                const identityHealthBase = identityBinding.base;
                 const identityBound = identityHealthBase != null &&
                     sameHttpBase(getComfyUIBaseUrl(), identityHealthBase);
                 if (!identityBound) {
@@ -13246,7 +13388,7 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
                         ? ctx.bridge.canReach(ctx.tabId) === true
                         : true;
                     if (tabStillHere) {
-                        return restartRefusedPreservingBinding(ctx, unboundLocalRestartRefusalNote(ctx, identityHealthBase));
+                        return restartRefusedPreservingBinding(ctx, unboundLocalRestartRefusalNote(ctx, identityHealthBase, identityBinding.blocker));
                     }
                     // Tab is gone: confirm will be unreachable and #1671 crash-recovery
                     // decides whether a headless restart can still be accounted for.
@@ -13876,7 +14018,8 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
             // can be proven. They keep restart_comfyui, and the note says so. Weighed
             // against #814 — where exactly such a user's server was stopped and never came
             // back — declining is the recoverable side.
-            const preflightHealthBase = captureRebootHealthBase(ctx);
+            const preflightBinding = resolveRebootHealthBinding(ctx);
+            const preflightHealthBase = preflightBinding.base;
             const preflightBound = preflightHealthBase != null &&
                 sameHttpBase(getComfyUIBaseUrl(), preflightHealthBase);
             // #848: what the instance was OBSERVED running with, taken from the preflight
@@ -13903,7 +14046,7 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
                 // Identity was proven before the card; landing here means the binding
                 // was lost during the confirm wait. Same refusal, and the tab that is
                 // still here must stay usable (#1819).
-                return restartRefusedPreservingBinding(ctx, unboundLocalRestartRefusalNote(ctx, preflightHealthBase));
+                return restartRefusedPreservingBinding(ctx, unboundLocalRestartRefusalNote(ctx, preflightHealthBase, preflightBinding.blocker));
             }
             if (preflightBound) {
                 // Snapshot the target GENERATION at the decision (r11): a final-state