comfyui-mcp 0.52.42 → 0.52.44

package/dist/orchestrator/index.js

@@ -30,8 +30,11 @@ import { panelRecoveryContext } from "../services/panel-recovery.js";
 import { isPanelAutoInstallDisabled } from "../services/panel-installer.js";
 import { releaseOwnedPanelLock } from "../services/panel-pin-guard.js";
 import { SelfRestarter, canSelfRestart } from "../services/self-restart.js";
+import { tickPanelAutoUpdate } from "../services/panel-auto-update.js";
 import { pairUrlDurability } from "./pair-durability.js";
 import { loadOrCreatePairToken } from "./pair-token-store.js";
+import { autoUpdateApplyAllowed, pairAutoUpdateDisclosure, pairingActiveOf, pairingTransportOf, } from "../services/auto-update-gate.js";
+import { loadPairUpdatePrefs, savePairUpdatePrefs } from "./pair-update-prefs.js";
 import { SessionStore, workflowIdentityParts, carryWorkflowCommandStamp } from "./session-store.js";
 import { unreachableReason, noPanelTabReason, identityReason } from "./fence-refusal.js";
 import { SHARED_SESSION_SCOPE, isScopeAddress, conversationTabs, shouldRetireSharedAgent, messageOrigin, normalizeHelloBackend, workflowOriginNote, } from "../services/session-scope.js";
@@ -81,7 +84,7 @@ import { PanelAgentManager, fetchSupportedModels, fetchSupportedCommands, isEffo
 import { promptText } from "./error-text.js";
 import { callToolAdmission } from "./call-tool-admission.js";
 import { DEFERRED_PANEL_TOOLS_STEERING, withDeferredPanelToolsNote, } from "../deferred-panel-tools.js";
-import { createPanelMcpServer, makePanelToolCtx, resolvePinTarget, secretSavedReply, setApplyMcpReload, RETRY_TOKEN_CMDS, } from "./panel-tools.js";
+import { createPanelMcpServer, makePanelToolCtx, resolvePinTarget, secretSavedReply, setApplyMcpReload, forgetAbandonedConfirmCards, RETRY_TOKEN_CMDS, } from "./panel-tools.js";
 import { optionsAckFrame, optionsErrorAckFrame, optionsRequestMeta, } from "./options-ack.js";
 import { readUserMcpServers } from "../services/user-mcp-config.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -124,7 +127,7 @@ import { startPanelConsoleHttpServer } from "./panel-console-http.js";
 import { readComfyuiCrashLog, formatCrashNote } from "../services/crash-log.js";
 import { QueueMonitor } from "../services/queue-monitor.js";
 import { RunCompletions, describe as describeCorrelation, } from "./run-completion-journal.js";
-import { createRunCompletionWatchdog, resolveHistoryCompletionImages } from "./run-completion-watchdog.js";
+import { createRunCompletionWatchdog, resolveHistoryCompletionImages, resolveHistoryCompletionStatus, } from "./run-completion-watchdog.js";
 import { AskAnswers, preview as previewQuestion } from "./ask-answer-journal.js";
 import { initRunpodWatcher, getRunpodWatcher } from "../services/runpod-watch.js";
 import { getPod } from "../services/runpod-client.js";
@@ -1054,20 +1057,25 @@ export async function runPanelOrchestrator() {
     let pairToken = envPairToken;
     let pairListenerStarted = false;
     let pairTunnel = null;
+    // Forward declaration — assigned after teardownCore exists. Declared here so
+    // pair / apply_updates_now handlers can refresh the restarter without hitting
+    // the TDZ if a frame arrives before that assignment.
+    let selfRestarter = null;
     /**
-     * #875 — is a phone paired over a TUNNEL right now?
+     * #1963 — APPLY gate for auto-update. Checking still runs.
      *
-     * Gates the self-restarter (see its allIdle below). A tunnel URL cannot survive
-     * a restart: cloudflared mints a fresh quick-tunnel hostname per run and there
-     * is no way to pin it, so restarting under a live tunnel breaks a phone that is
-     * connected at that moment. A LAN URL is fine — the token persists now — which
-     * is why this is narrowed to the tunnel rather than to pairing in general.
+     * pairingActive is STICKY on `pairTunnel` (the handle exists from mint until
+     * process exit). A live-socket test is the hole a locked-screen phone falls
+     * through: the OS has closed the socket, the gate opened, the hostname
+     * rotated. The pair-time toggle (default ON) is how a desk session applies
+     * anyway; apply_updates_now is the one-shot override.
      */
-    // Requires BOTH: a tunnel exists AND a client is connected through it right
-    // now. `pairTunnel` alone is not liveness — nothing stops the tunnel until the
-    // process exits, so gating on it would postpone every future update after a
-    // single pairing, rather than deferring to the next disconnect as intended.
-    const tunnelPairingLive = () => pairTunnel !== null && bridge.hasLiveHeadlessClient();
+    const autoUpdateGateInput = () => ({
+        activeTransport: pairingTransportOf(pairTunnel),
+        pairingActive: pairingActiveOf(pairTunnel),
+        deferWhilePaired: loadPairUpdatePrefs().deferWhilePaired,
+    });
+    const applyAutoUpdateAllowed = () => autoUpdateApplyAllowed(autoUpdateGateInput());
     // #875 — the token is PERSISTED, not per-session. It used to be minted fresh on
     // every run, so a self-restart (on by default, hourly npm check) invalidated the
     // URL the phone had saved. The reporter experienced that as "updating the npm
@@ -2608,7 +2616,14 @@ export async function runPanelOrchestrator() {
     // newcomer never asked the previous occupant's questions, so its answers must
     // stop being recoverable and stop being pushed. closeAsks downgrades and
     // unsends; it never deletes, so those answers are still reported.
-    bridge.setTabTakenOverListener((tabId) => AskAnswers.closeAsks(tabId));
+    // panel#1554 — same boundary, same reason: a confirmation card the previous
+    // occupant abandoned must not be claimable by the newcomer. Both retirements ride
+    // THIS one listener because the bridge takes a single takeover listener, so a
+    // second setTabTakenOverListener call would silently replace the first.
+    bridge.setTabTakenOverListener((tabId) => {
+        AskAnswers.closeAsks(tabId);
+        forgetAbandonedConfirmCards(tabId);
+    });
     bridge.setTabGoneListener((tabId, incarnation) => AskAnswers.retireDebt(tabId, incarnation));
     // #694 — the bridge retains a late mutation only for commands that can come
     // back as a retry token, which is the retry-token layer's own set. Installed
@@ -2914,6 +2929,12 @@ export async function runPanelOrchestrator() {
         backendForTab,
         backendOfKey: backendOf,
         info: (msg) => logger.info(msg),
+        // panel#1557 — a unique-canvas reconnect that hello'd without `backend`
+        // joined the default conversation; claiming puts it on this one so the
+        // pin we just wrote is not immediately invalidated at resolution.
+        claimTab: (tab, backend) => {
+            tabBackends.set(tab, backend);
+        },
     }));
     // #884 P1 (confirming gate 2) — a hello whose `backend` is absent or unknown
     // JOINS the default conversation, so its backend-qualified buffers must drain
@@ -3504,6 +3525,10 @@ export async function runPanelOrchestrator() {
             logger.warn(`[panel-orchestrator] readiness probe failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
+    // Assigned next to the queue-status timer below. Declared here so the hello
+    // path can reconcile owed panel_run tickets the moment the panel reconnects
+    // (#1556) without waiting for that timer to construct it.
+    let runCompletionWatchdog;
     bridge.onPanelMessage = (event) => {
         // Connect ack: the instant a panel tab connects, the orchestrator announces
         // itself so "connected" means "a real agent is attending" — not merely "a
@@ -3958,6 +3983,12 @@ export async function runPanelOrchestrator() {
             // are change-only, so a tab connecting MID-render would otherwise wait for
             // the next state transition to learn a job is already running.
             bridge.push(buildQueueStatusFrame(QueueMonitor.snapshot()), panelTab);
+            // #1556 — a hello is a reconnect (or the first chance after a missed
+            // ComfyUI WS frame). Look up every still-owed panel_run in /history NOW
+            // and journal a completion if ComfyUI already finished it, instead of
+            // waiting the synthesis grace. Exactly-once: the journal skips a run it
+            // already holds.
+            void runCompletionWatchdog?.reconcile(RunCompletions.owedCompletions().map((t) => t.promptId));
             // Seed the RunPod control panel too — a tab that just connected gets the
             // current pod-status frame (or a cleared one when nothing is watched).
             const rpFrame = getRunpodWatcher()?.current();
@@ -4538,6 +4569,18 @@ export async function runPanelOrchestrator() {
         if (event.type === "pair" && event.tab_id) {
             const mode = event.mode === "tunnel" ? "tunnel" : "lan";
             const tabId = event.tab_id;
+            // Pair-time toggle, default ON. An explicit boolean is the only thing we
+            // persist — a missing field leaves the last saved (or default) value.
+            const rawDefer = event.defer_while_paired;
+            if (typeof rawDefer === "boolean") {
+                try {
+                    savePairUpdatePrefs({ deferWhilePaired: rawDefer });
+                }
+                catch (err) {
+                    logger.warn(`[panel-orchestrator] could not persist pair-update prefs: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                selfRestarter?.requestApplyPolicyRefresh();
+            }
             void (async () => {
                 const token = await ensurePairListener();
                 let url;
@@ -4582,12 +4625,55 @@ export async function runPanelOrchestrator() {
                     (durability.survivesRestart
                         ? "survives restart"
                         : `rotates on restart: ${durability.rotates.join(", ")}`));
-                bridge.push({ type: "pair_url", mode, url, durability }, tabId);
+                const auto_update = pairAutoUpdateDisclosure(autoUpdateGateInput());
+                bridge.push({ type: "pair_url", mode, url, durability, auto_update }, tabId);
             })().catch((err) => {
                 bridge.push({ type: "pair_error", mode, error: err instanceof Error ? err.message : String(err) }, tabId);
             });
             return;
         }
+        // #1963 — flip the pair-time "Don't update while my phone is paired" toggle
+        // after the URL is already minted (the checkbox on the QR modal).
+        if (event.type === "set_pair_update_pref" && event.tab_id) {
+            const tabId = event.tab_id;
+            const rawDefer = event.defer_while_paired;
+            if (typeof rawDefer !== "boolean") {
+                bridge.push({ type: "pair_update_pref", ok: false, error: "defer_while_paired must be a boolean" }, tabId);
+                return;
+            }
+            try {
+                const prefs = savePairUpdatePrefs({ deferWhilePaired: rawDefer });
+                bridge.push({
+                    type: "pair_update_pref",
+                    ok: true,
+                    defer_while_paired: prefs.deferWhilePaired,
+                    apply: autoUpdateApplyAllowed({
+                        ...autoUpdateGateInput(),
+                        deferWhilePaired: prefs.deferWhilePaired,
+                    }),
+                }, tabId);
+                selfRestarter?.requestApplyPolicyRefresh();
+            }
+            catch (err) {
+                bridge.push({
+                    type: "pair_update_pref",
+                    ok: false,
+                    error: err instanceof Error ? err.message : String(err),
+                }, tabId);
+            }
+            return;
+        }
+        // #1963 — "Update now" from the desk (or from the deferred-update notice).
+        // One-shot: ignores the tunnel gate for this tick only.
+        if (event.type === "apply_updates_now") {
+            const tabId = event.tab_id;
+            logger.info("[panel-orchestrator] apply_updates_now — checking and applying updates (bypass tunnel gate)");
+            void selfRestarter?.updateTick({ forceApply: true });
+            if (tabId) {
+                bridge.push({ type: "ack", ok: true, kind: "apply_updates_now" }, tabId);
+            }
+            return;
+        }
         // Direct tool channel: the mobile app invokes a WHITELISTED read/download tool
         // (structured data for nav lists + rig downloads) without an agent turn. Replies
         // with a `tool_result` frame the client correlates by rid.
@@ -5899,9 +5985,10 @@ export async function runPanelOrchestrator() {
     // after the grace is synthesised into the SAME journal the real frame uses.
     // See run-completion-watchdog.ts for why it waits, and why the panel's frame
     // still wins whenever it is coming.
-    const runCompletionWatchdog = createRunCompletionWatchdog({
+    const wd = createRunCompletionWatchdog({
         awaiting: (promptId) => RunCompletions.awaitingCompletion(promptId),
         resolveOutputs: (promptId) => resolveHistoryCompletionImages(promptId),
+        lookupStatus: (promptId) => resolveHistoryCompletionStatus(promptId),
         deliver: (payload, ticket) => {
             // The SAME arrival path the panel's frame takes: correlated once, here,
             // against the ticket that is still open — so the agent is told this is the
@@ -5914,13 +6001,14 @@ export async function runPanelOrchestrator() {
             flushRunCompletions(ticket.tabId);
         },
     });
+    runCompletionWatchdog = wd;
     const queueStatusBroadcaster = createQueueStatusBroadcaster(() => QueueMonitor.snapshot(), (frame) => void bridge.push(frame), 
     // TEE, not a second drain: drainCompletions() splices, so the watchdog has
     // to read the same array the broadcaster is handed rather than call it
     // again — a second call would race and each consumer would see only half.
     () => {
         const completions = QueueMonitor.drainCompletions();
-        runCompletionWatchdog.observe(completions);
+        wd.observe(completions);
         return completions;
     });
     // Each tick first refreshes the monitor over HTTP (GET /queue + /history
@@ -5934,7 +6022,7 @@ export async function runPanelOrchestrator() {
             // …and only THEN expire the watchdog's arms: the broadcaster tick is what
             // feeds it (the drain tee above), so ticking it first would let an
             // observation sit a whole extra second before it is even armed. #1789.
-            runCompletionWatchdog.tick();
+            wd.tick();
         });
     }, 1000);
     queueStatusTimer.unref?.();
@@ -6205,9 +6293,6 @@ export async function runPanelOrchestrator() {
             : " — remote target: installs/downloads run ON the ComfyUI host via its Manager (a local path would be the wrong filesystem; only local-FS tools like node_pack (action:'verify') are unavailable)";
     logger.info(`[panel-orchestrator] ready — bridge on ws://127.0.0.1:${bridgePort}, console on ${consoleUrl}; an agent spawns per ComfyUI tab on its first message (model=${model}, comfyui=${comfyuiUrl}${pathNote})`);
     let shuttingDown = false;
-    // Forward declaration — assigned right after teardownCore exists; teardownCore
-    // stops its timers so no update-check tick can fire mid-teardown.
-    let selfRestarter = null;
     /** Everything shutdown does EXCEPT exiting — shared with the self-restarter,
      *  which spawns its replacement first and exits itself after this settles. */
     const teardownCore = async () => {
@@ -6334,24 +6419,12 @@ export async function runPanelOrchestrator() {
             // …and the same for an ask answer the user actually gave that has not
             // reached the agent yet (#486). Restarting would destroy it silently.
             !AskAnswers.hasOutstanding() &&
-            !QueueMonitor.isBusy() &&
-            // #875 — a LIVE TUNNEL PAIRING SESSION defers the restart to the next
-            // disconnect. The token now persists, so a LAN URL survives a restart; a
-            // tunnel URL cannot, because cloudflared mints a fresh quick-tunnel
-            // hostname every run and there is no way to pin it. Restarting under a live
-            // tunnel therefore breaks a phone that is connected RIGHT NOW, to install
-            // an update nobody asked for at that moment — which is what the reporter
-            // experienced and (reasonably) blamed on the npm version.
-            //
-            // Deferral, not cancellation: the update check still runs and the restart
-            // stays armed, so it fires as soon as the tunnel goes away. The cost is
-            // that a tunnel left up indefinitely postpones updates indefinitely, so it
-            // is DISCLOSED — in pair-durability's tunnel note, which the panel shows at
-            // pair time. Deliberately not announced from here: this is a predicate the
-            // restarter polls, and emitting from it would either fire repeatedly or
-            // need its own state to suppress itself. Pair time is also where the user
-            // is actually looking (#1077: an orchestrator log may be unreachable).
-            !tunnelPairingLive(),
+            !QueueMonitor.isBusy(),
+        // #1963 — transport gate is applyAllowed, not allIdle. Idle is in-flight
+        // work; this is "would a restart rotate the phone's tunnel hostname?"
+        // Checking still runs; APPLY (disk + restart, and the panel pack) does not.
+        applyAllowed: applyAutoUpdateAllowed,
+        panelTick: async ({ apply }) => tickPanelAutoUpdate({ apply }),
         announce: (text) => void bridge.push({ type: "say", text }),
         teardown: teardownCore,
     });