comfyui-mcp 0.52.82 → 0.52.84

package/dist/orchestrator/panel-tools.js

@@ -190,7 +190,7 @@ import { RunCompletions } from "./run-completion-journal.js";
 import { AskAnswers, askFingerprint, PANEL_ASK_ID_PREFIX, } from "./ask-answer-journal.js";
 import { getQueueVerified, resetClient, resetObjectInfoCache, } from "../comfyui/client.js";
 import { convertUiToApi, collectNodeTypes } from "../services/workflow-converter.js";
-import { restartComfyUI, preflightLocalRestart, readServingArgv, describeArgvDrift, recordRestartDispatch, clearRestartDispatch, getRestartDispatchRecord, RESTART_DISPATCH_CAUSATION_WINDOW_MS, PROCESS_WIDE_RESTART_DISPATCH_TOKEN, __processControlTestHooks, } from "../services/process-control.js";
+import { restartComfyUI, preflightLocalRestart, readServingArgv, resolveVerifiedProxyRestartTarget, describeArgvDrift, recordRestartDispatch, clearRestartDispatch, getRestartDispatchRecord, RESTART_DISPATCH_CAUSATION_WINDOW_MS, PROCESS_WIDE_RESTART_DISPATCH_TOKEN, __processControlTestHooks, } from "../services/process-control.js";
 import { resetManagerApiCache } from "../services/manager-api-cache.js";
 import { desktopSavedLaunchArgs, describeSavedLaunchArgDrift, } from "../services/desktop-launch-args.js";
 import { config, isRemoteMode, isCloudMode, getBootLocalComfyUIBaseUrl, getComfyUIBaseUrl, getComfyuiTargetGeneration, } from "../config.js";
@@ -735,6 +735,10 @@ export const __panelToolsTestHooks = {
     setLocalRestartPreflight(fn) {
         localRestartPreflightOverride = fn;
     },
+    /** Inject the narrow EZi/CEI proxy proof; null restores the live resolver. */
+    setVerifiedProxyRestartTarget(fn) {
+        verifiedProxyRestartTargetOverride = fn;
+    },
     /** Inject a fast #742 decline-probe recheck window so decline-path tests
      *  don't wait the real ~6s. null restores the DECLINE_PROBE_* constants. */
     setDeclineProbeTiming(timing) {
@@ -2221,6 +2225,16 @@ let healthProbeOverride = null;
 /** Test injection for the #742 refuse-safe restart preflight (the real one is
  *  preflightLocalRestart in process-control). null → the live preflight. */
 let localRestartPreflightOverride = null;
+let verifiedProxyRestartTargetOverride = null;
+function panelVerifiedProxyRestartTarget() {
+    return (verifiedProxyRestartTargetOverride ?? resolveVerifiedProxyRestartTarget)();
+}
+function proxyTargetBindsPanel(ctx, target) {
+    return (target != null &&
+        sameHttpBase(getComfyUIBaseUrl(), target.proxyBase) &&
+        ctx.bridge?.tabIsLocal?.(ctx.tabId) === true &&
+        sameHttpBase(ctx.bridge?.tabServerOrigin?.(ctx.tabId), target.proxyBase));
+}
 /** Test injection for the #742 decline-probe recheck window, so tests don't
  *  wait the real ~6s. null → the DECLINE_PROBE_* constants. */
 let declineProbeTimingOverride = null;
@@ -5679,10 +5693,22 @@ function isRetryableRunToNodeStampRace(res, rejection) {
     return (/workflow graph CHANGED after the run was queued/i.test(text) &&
         /Nothing was queued/i.test(text));
 }
+/**
+ * #2120 — an older panel can decorate a fixed seed while it builds the deferred
+ * run prompt. That can make the same scoped run hit the certified stamp race more
+ * than once. The panel still has to identify the changed entry as a seed; this is
+ * deliberately narrower than allowing an arbitrary third dispatch.
+ */
+const MAX_SCOPED_STAMP_RACE_RETRIES = 2;
+function isSeedRunToNodeStampRace(res, rejection) {
+    return (isRetryableRunToNodeStampRace(res, rejection) &&
+        /\bdiffering\b[\s\S]{0,160}\bseed\b/i.test(toolResultText(rejection)));
+}
 export const __panelRunTestHooks = {
     detectRunRejection,
     formatRunRejection,
     isRetryableRunToNodeStampRace,
+    isSeedRunToNodeStampRace,
     describeDroppedOutputs,
 };
 /** Drop a trailing .json (case-insensitive) so filename/path forms compare equal. */
@@ -13262,15 +13288,25 @@ export function buildPanelToolDefs() {
             // "you'll be notified automatically" guidance. Only a genuine queue
             // gets the anti-poll note below.
             let rejection = detectRunRejection(res);
-            // #772 — ONE re-issue, and only for the scoped-run stamp race the panel
-            // explicitly certifies as not-queued. Gated on OUR OWN args (this really was a
-            // scoped run) and on the panel having ANSWERED, so an unknown outcome is never
-            // retried. Exactly once: a second race is surfaced, never re-raced.
+            // #772/#2120 — re-issue only the scoped-run stamp race the panel explicitly
+            // certifies as not-queued. Gated on OUR OWN args (this really was a scoped run)
+            // and on the panel having ANSWERED, so an unknown outcome is never retried.
+            // The ordinary race gets one re-issue. A repeated race gets ONE additional
+            // chance only when the panel names a differing seed entry — the fixed-seed
+            // decoration race reported in #2120. Every attempt still passes the panel's
+            // graph-stamp check independently; this is not a bypass or a blind mutation
+            // retry.
             let scopeRebuilt = false;
-            if (rejection &&
+            let scopeRetryCount = 0;
+            while (rejection &&
                 typeof args.to_node_id === "number" &&
-                isRetryableRunToNodeStampRace(res, rejection)) {
+                isRetryableRunToNodeStampRace(res, rejection) &&
+                (scopeRetryCount === 0 ||
+                    (scopeRetryCount < MAX_SCOPED_STAMP_RACE_RETRIES &&
+                        isSeedRunToNodeStampRace(res, rejection)))) {
                 scopeRebuilt = true;
+                scopeRetryCount += 1;
+                let retryResultReceived = false;
                 try {
                     // #1050 — SETTLE before re-issuing. The panel refuses this race when the
                     // graph changed between dispatch and apply, and re-dispatching in the
@@ -13292,6 +13328,7 @@ export function buildPanelToolDefs() {
                     // prompt id rather than allowing that stale arm to be synthesized (#2021).
                     runDispatchedAt = Date.now();
                     res = await ctx.call(runCmd, 20000, observeRunRid);
+                    retryResultReceived = true;
                     // #1175 — the re-issue can miss its window exactly as the first
                     // dispatch can, and this is the one whose outcome is genuinely open
                     // (the first was CERTIFIED to have queued nothing). Reconcile it on
@@ -13300,17 +13337,37 @@ export function buildPanelToolDefs() {
                     rejection = detectRunRejection(res);
                 }
                 catch (err) {
+                    // A bridge/late-receipt failure after ctx.call already returned must not
+                    // erase the retry's own result (notably its retry_of token). Preserve it
+                    // verbatim and stop: no further dispatch is justified by a failed local
+                    // reconciliation step.
+                    if (retryResultReceived) {
+                        return appendToolResultText(res, `\n\n(Dispatch history: the retry dispatch returned the result above, but local ` +
+                            `late-ack reconciliation failed before this handler could finish ` +
+                            `interpreting it. That result is preserved and no further dispatch was ` +
+                            `made. Do not infer an additional queue entry from the reconciliation ` +
+                            `failure alone. (${err instanceof Error ? err.message : String(err)})`);
+                    }
                     // ctx.call settles every panel/transport failure into a ToolResult and does
                     // not throw today — but this await is the one point where a throw would
-                    // DESTROY evidence we already hold: that the first dispatch was certified
-                    // not-queued, and that a second dispatch went out whose outcome is now
-                    // unknown. Propagating the raw throw would lose both and invite a third
-                    // dispatch. Report what we observed, claim nothing we did not.
-                    return fail(`panel_run re-issued the scoped run after the panel's certified run-to-node ` +
-                        `stamp race, and that SECOND dispatch failed before any reply could be read — ` +
-                        `its outcome is UNKNOWN and it may have queued a render. The FIRST dispatch was ` +
-                        `certified by the panel to have queued nothing. Do NOT re-run blindly: check the ` +
-                        `queue (action:"list") or get_history before deciding. (${err instanceof Error ? err.message : String(err)})`);
+                    // DESTROY evidence we already hold: that every prior dispatch was
+                    // certified not-queued, and that this dispatch went out whose outcome is
+                    // now unknown. Propagating the raw throw would lose both and invite a
+                    // blind dispatch. Report what we observed, claim nothing we did not.
+                    if (scopeRetryCount === 1) {
+                        return fail(`panel_run re-issued the scoped run after the panel's certified run-to-node ` +
+                            `stamp race, and that SECOND dispatch failed before any reply could be read — ` +
+                            `its outcome is UNKNOWN and it may have queued a render. The FIRST dispatch was ` +
+                            `certified by the panel to have queued nothing. Do NOT re-run blindly: check the ` +
+                            `queue (action:"list") or get_history before deciding. (${err instanceof Error ? err.message : String(err)})`);
+                    }
+                    return fail(`panel_run re-issued the scoped run ${scopeRetryCount} times after the panel ` +
+                        `certified each prior run-to-node stamp race as not-queued, and the ` +
+                        `dispatch ${scopeRetryCount + 1} failed before any reply could be read — ` +
+                        `its outcome is UNKNOWN and it may have queued a render. The first ` +
+                        `${scopeRetryCount} dispatches were certified by the panel to have queued ` +
+                        `nothing. Do NOT re-run blindly: check the queue (action:"list") or ` +
+                        `get_history before deciding. (${err instanceof Error ? err.message : String(err)})`);
                 }
             }
             if (rejection) {
@@ -13327,14 +13384,24 @@ export function buildPanelToolDefs() {
                 // cannot tell whether these are one event or two.
                 if (!scopeRebuilt)
                     return lateAckNote ? appendToolResultText(rejection, lateAckNote) : rejection;
-                return appendToolResultText(rejection, `\n\n(Dispatch history: the first graph_run was refused by the panel's run-to-node ` +
-                    `graph-stamp race, which CERTIFIED that nothing was queued, so the scoped run was ` +
-                    `re-issued exactly once — after a short pause to let pending graph edits land ` +
-                    `(#1050). The failure above is that SECOND dispatch; it was not retried again. ` +
-                    `Judge whether anything was queued from that message alone — the first dispatch ` +
-                    `definitely queued nothing. Racing AGAIN after the pause means the graph is still ` +
-                    `changing under the run: let the canvas settle, then re-run.)` +
-                    lateAckNote);
+                return appendToolResultText(rejection, scopeRetryCount === 1
+                    ? `\n\n(Dispatch history: the first graph_run was refused by the panel's run-to-node ` +
+                        `graph-stamp race, which CERTIFIED that nothing was queued, so the scoped run was ` +
+                        `re-issued exactly once — after a short pause to let pending graph edits land ` +
+                        `(#1050). The failure above is that SECOND dispatch; it was not retried again. ` +
+                        `Judge whether anything was queued from that message alone — the first dispatch ` +
+                        `definitely queued nothing. Racing AGAIN after the pause means the graph is still ` +
+                        `changing under the run: let the canvas settle, then re-run.)` +
+                        lateAckNote
+                    : `\n\n(Dispatch history: the first ${scopeRetryCount} graph_run dispatches were each ` +
+                        `refused by the panel's run-to-node graph-stamp race, and each CERTIFIED ` +
+                        `that nothing was queued. The scoped run was re-issued ${scopeRetryCount} ` +
+                        `times after short pauses to let pending graph edits land (#1050). The ` +
+                        `failure above is dispatch ${scopeRetryCount + 1}; it was not retried again. ` +
+                        `Judge whether anything was queued from that message alone — the first ` +
+                        `${scopeRetryCount} dispatches definitely queued nothing. Let the canvas ` +
+                        `settle, then re-run.)` +
+                        lateAckNote);
             }
             // Attribute this genuine queue to ourselves so a later panel_run in the
             // same batch recognizes the in-flight job as our own and doesn't false-warn
@@ -13465,22 +13532,28 @@ export function buildPanelToolDefs() {
             // clear_pending remedy that would wipe the user's whole batch (#559). A
             // genuinely stalled render is caught by the turn-start stall notice, which
             // does the staleness gating and keeps the interrupt guidance.
-            // #772 — never report a dispatch history the caller did not see. When the scoped
-            // run only queued on the SECOND dispatch, say so, so the agent does not read the
-            // earlier refusal (if it surfaces in a log) as a separate queued job.
+            // #772/#2120 — never report a dispatch history the caller did not see. Say
+            // exactly which earlier dispatches were certified clean, so the agent does
+            // not read a refusal (if it surfaces in a log) as a separate queued job.
             //
             // It says only what was OBSERVED (codex gate). An earlier draft said "exactly one
             // render was queued" — but `batch_count` is "times to queue", so a successful
             // dispatch can enqueue several, and the panel reports one prompt id, not a count.
-            // The certified fact is about DISPATCHES, not renders: the first queued nothing,
-            // so everything in the queue came from the second. State that and stop.
-            const retryNote = scopeRebuilt
-                ? "\n\n[NOTE] The first dispatch of this scoped run was refused by the panel's run-to-node " +
-                    "graph-stamp race (the graph changed between dispatch and apply); the panel certified that " +
-                    "nothing was queued, so the scope was rebuilt and re-issued once, and THAT is the run above. " +
-                    "The first dispatch contributed NOTHING to the queue, so whatever this run queued was " +
-                    "queued once, not twice."
-                : "";
+            // The certified fact is about DISPATCHES, not renders: the prior dispatches
+            // queued nothing, so everything in the queue came from the final dispatch.
+            const retryNote = scopeRetryCount === 0
+                ? ""
+                : scopeRetryCount === 1
+                    ? "\n\n[NOTE] The first dispatch of this scoped run was refused by the panel's run-to-node " +
+                        "graph-stamp race (the graph changed between dispatch and apply); the panel certified that " +
+                        "nothing was queued, so the scope was rebuilt and re-issued once, and THAT is the run above. " +
+                        "The first dispatch contributed NOTHING to the queue, so whatever this run queued was " +
+                        "queued once, not twice."
+                    : `\n\n[NOTE] The first ${scopeRetryCount} dispatches of this scoped run were refused by the ` +
+                        `panel's run-to-node graph-stamp race (the graph changed between dispatch and apply), ` +
+                        `and each was certified to have queued NOTHING. The scope was rebuilt and re-issued ` +
+                        `${scopeRetryCount} times, and THAT is the run above. Whatever this run queued came ` +
+                        `from the final dispatch; the earlier dispatches contributed NOTHING to the queue.`;
             let warn = "";
             if (pre.connected && pre.running) {
                 const pending = Math.max(0, pre.queueDepth - 1);
@@ -15561,6 +15634,10 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
                 return fail(surfaceErr +
                     " To restart the server without a panel confirmation card, use restart_comfyui.");
             }
+            // #2118: keep the proxy proof alive across the confirmation/preflight
+            // awaits. The proxy is never treated as a ComfyUI process; it only lets
+            // the tab-scoped Manager request be observed against the immutable backend.
+            let proxyRestartTarget;
             // #1819: resolve instance identity BEFORE the confirmation card. Asking the
             // user to confirm a restart, then refusing because we cannot tell which
             // ComfyUI this tab fronts, is two contradictory outcomes (timeout vs refuse)
@@ -15575,10 +15652,14 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
                 const identityBound = identityHealthBase != null &&
                     sameHttpBase(getComfyUIBaseUrl(), identityHealthBase);
                 if (!identityBound) {
+                    const candidate = await panelVerifiedProxyRestartTarget();
+                    if (proxyTargetBindsPanel(ctx, candidate)) {
+                        proxyRestartTarget = candidate;
+                    }
                     const tabStillHere = typeof ctx.bridge?.canReach === "function"
                         ? ctx.bridge.canReach(ctx.tabId) === true
                         : true;
-                    if (tabStillHere) {
+                    if (tabStillHere && proxyRestartTarget == null) {
                         return restartRefusedPreservingBinding(ctx, unboundLocalRestartRefusalNote(ctx, identityHealthBase, identityBinding.blocker));
                     }
                     // Tab is gone: confirm will be unreachable and #1671 crash-recovery
@@ -16151,8 +16232,16 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
             // "idle" and a restart aborts whatever is running.
             const configuredRestartCommand = config.comfyuiRestartCommand;
             if (configuredRestartCommand && !isRemoteMode() && !isCloudMode()) {
-                const commandHealthBase = captureRebootHealthBase(ctx);
-                if (commandHealthBase != null && sameHttpBase(getComfyUIBaseUrl(), commandHealthBase)) {
+                if (proxyRestartTarget != null) {
+                    const refreshedProxy = await panelVerifiedProxyRestartTarget();
+                    proxyRestartTarget = proxyTargetBindsPanel(ctx, refreshedProxy)
+                        ? refreshedProxy
+                        : undefined;
+                }
+                const commandHealthBase = proxyRestartTarget?.backendBase ?? captureRebootHealthBase(ctx);
+                const commandBound = proxyRestartTarget != null ||
+                    (commandHealthBase != null && sameHttpBase(getComfyUIBaseUrl(), commandHealthBase));
+                if (commandHealthBase != null && commandBound) {
                     if (force !== true) {
                         let busyCount = null;
                         try {
@@ -16191,7 +16280,13 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
                     // Re-heal and re-verify at the point of action, exactly as the
                     // dispatch path below does.
                     ctx.ensureReachable?.();
-                    const postCheckHealthBase = captureRebootHealthBase(ctx);
+                    if (proxyRestartTarget != null) {
+                        const postProxy = await panelVerifiedProxyRestartTarget();
+                        proxyRestartTarget = proxyTargetBindsPanel(ctx, postProxy)
+                            ? postProxy
+                            : undefined;
+                    }
+                    const postCheckHealthBase = proxyRestartTarget?.backendBase ?? captureRebootHealthBase(ctx);
                     if (postCheckHealthBase == null ||
                         !sameHttpBase(commandHealthBase, postCheckHealthBase)) {
                         return ok({
@@ -16271,10 +16366,20 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
             // can be proven. They keep restart_comfyui, and the note says so. Weighed
             // against #814 — where exactly such a user's server was stopped and never came
             // back — declining is the recoverable side.
+            // Re-resolve after the confirmation await. A proxy proof is an endpoint
+            // identity claim, not a durable permission; a retarget or tab rebind makes
+            // it unusable and returns to the existing refusal path.
+            if (proxyRestartTarget != null) {
+                const refreshedProxy = await panelVerifiedProxyRestartTarget();
+                proxyRestartTarget = proxyTargetBindsPanel(ctx, refreshedProxy)
+                    ? refreshedProxy
+                    : undefined;
+            }
             const preflightBinding = resolveRebootHealthBinding(ctx);
-            const preflightHealthBase = preflightBinding.base;
-            const preflightBound = preflightHealthBase != null &&
-                sameHttpBase(getComfyUIBaseUrl(), preflightHealthBase);
+            const preflightHealthBase = proxyRestartTarget?.backendBase ?? preflightBinding.base;
+            const preflightBound = proxyRestartTarget != null ||
+                (preflightHealthBase != null &&
+                    sameHttpBase(getComfyUIBaseUrl(), preflightHealthBase));
             // #848: what the instance was OBSERVED running with, taken from the preflight
             // that already had to resolve it. Nothing new is probed before the dispatch —
             // the no-await invariant between the binding capture and the reboot stands.
@@ -16308,7 +16413,9 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
                 // EVERY retarget — any mutation, including a round trip back to the
                 // same base, is caught.
                 const preflightTargetGeneration = getComfyuiTargetGeneration();
-                const preflight = await (localRestartPreflightOverride ?? preflightLocalRestart)();
+                const preflight = proxyRestartTarget
+                    ? { ok: true, observedArgv: proxyRestartTarget.argv }
+                    : await (localRestartPreflightOverride ?? preflightLocalRestart)();
                 // #848: keep the observed launch arguments. Recorded here and spent ONLY on
                 // the success path far below, where the reboot has been proven to have
                 // cycled THIS instance — it never influences any decision above.
@@ -16327,11 +16434,19 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
                 // re-capture BEFORE trusting the result either way. The guarantee
                 // that must hold: a stop/reboot is only ever sent when the preflight
                 // validated THE instance the dispatch will cycle.
+                if (proxyRestartTarget) {
+                    // The proxy branch performs no local stop/preflight. Its direct
+                    // backend proof is rechecked immediately before dispatch below.
+                    preflightArgvGeneration = proxyRestartTarget.generation;
+                }
                 ctx.ensureReachable?.();
                 const postPreflightHealthBase = captureRebootHealthBase(ctx);
-                const tabFrontsSameInstance = postPreflightHealthBase != null &&
-                    sameHttpBase(preflightHealthBase, postPreflightHealthBase);
-                const configStable = getComfyuiTargetGeneration() === preflightTargetGeneration;
+                const tabFrontsSameInstance = proxyRestartTarget != null ||
+                    (postPreflightHealthBase != null &&
+                        sameHttpBase(preflightHealthBase, postPreflightHealthBase));
+                const configStable = proxyRestartTarget != null
+                    ? getComfyuiTargetGeneration() === proxyRestartTarget.generation
+                    : getComfyuiTargetGeneration() === preflightTargetGeneration;
                 if (!configStable && tabFrontsSameInstance) {
                     // r10: the target config moved MID-CHECK, so the preflight result
                     // — pass OR fail — cannot vouch for the tab-fronted instance (a
@@ -16409,7 +16524,17 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
             // this SAME browser tab; a different tab can reuse the same saved-workflow
             // routing id while the original is still reconnecting.
             const preRestartPanelIdentity = ctx.panelConnectionIdentity?.();
-            const healthBase = captureRebootHealthBase(ctx);
+            if (proxyRestartTarget != null) {
+                const dispatchProxy = await panelVerifiedProxyRestartTarget();
+                proxyRestartTarget = proxyTargetBindsPanel(ctx, dispatchProxy)
+                    ? dispatchProxy
+                    : undefined;
+                if (proxyRestartTarget) {
+                    preflightArgv = [...proxyRestartTarget.argv];
+                    preflightArgvGeneration = proxyRestartTarget.generation;
+                }
+            }
+            const healthBase = proxyRestartTarget?.backendBase ?? captureRebootHealthBase(ctx);
             // THE BINDING RULE APPLIES AT THE DISPATCH POINT, NOT ONLY BEFORE THE AWAIT.
             //
             // The check above happens before the preflight; a tab or connection rebind
@@ -16422,7 +16547,8 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
             //
             // Same rule, same exclusions: only a LOCAL target we cannot tie to the
             // instance this server accounts for is refused.
-            const dispatchBound = healthBase != null && sameHttpBase(getComfyUIBaseUrl(), healthBase);
+            const dispatchBound = proxyRestartTarget != null ||
+                (healthBase != null && sameHttpBase(getComfyUIBaseUrl(), healthBase));
             if (!dispatchBound && !isRemoteMode() && !isCloudMode()) {
                 return restartRefusedPreservingBinding(ctx, "Refusing to restart ComfyUI: the panel connection changed while the restart " +
                     "was being prepared, and I can no longer confirm which ComfyUI this tab " +
@@ -16614,6 +16740,7 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
                     // server replaced at the same URL between the reboot and here. That gap is real
                     // and tracked in #871; this gate narrows the window, it does not close it.
                     healthBase != null &&
+                    proxyRestartTarget == null &&
                     sameHttpBase(getComfyUIBaseUrl(), healthBase)) {
                     return runHeadlessManagedRestart({
                         healthBase,