dsh-multimodal-node 0.0.0-stage → 0.3.1

package/lib/remote.js

@@ -0,0 +1,3348 @@
+/**
+ * The remote port (8186 by default).
+ *
+ * A separate listener from the gateway, on purpose: the gateway speaks
+ * ComfyUI's protocol to other machines' scripts, while this one speaks to
+ * people — it needs a login, a session cookie, an HTML console, and a
+ * picture-in-picture tunnel to a real ComfyUI canvas. Mixing the two on one
+ * port would mean every API caller also has to survive an HTML 401 flow.
+ *
+ * Auth is password + a 6-digit code shown on the desktop gateway panel. Both
+ * are required; a reviewer who only has the password gets nothing.
+ *
+ * Bridging: opening an instance's canvas takes an exclusive *lease* on it. The
+ * pool stops dispatching there while the lease is held (the machine's VRAM is
+ * in a person's hands, not the scheduler's), and the lease is released on
+ * close, on logout, and by timeout. The canvas is proxied through this port, so
+ * the remote browser never needs direct reach to 8188/8189.
+ */
+import { createServer, request as httpRequest } from 'node:http';
+import { readdirSync } from 'node:fs';
+import { dirname, isAbsolute, join } from 'node:path';
+import { connect } from 'node:net';
+import { randomBytes } from 'node:crypto';
+import { readCookie, cookieHeader, SESSION_MAX_MS } from './auth.js';
+import { errorMessage, pipeGuarded, readJson, sendJson, closeServer } from './http.js';
+import { imageTargets, promptTargets, setImage, setText, stripNameAnnotation } from './workflows.js';
+import { classifyWorkflow, classifyRun, detectAdult, normalizeTier, scanStrings, screenImage, visibleTo } from './tiers.js';
+import { probeSize } from './imagesize.js';
+import { LOGIN_HTML, CONSOLE_HTML, ADMIN_HTML } from './pages.js';
+import { layoutFor, withLayout } from './viewport.js';
+import { promptTargets as textTargets } from './workflows.js';
+import { assist, assistCandidates, joinPrompt, listKnowledgeBases, loadPromptSkill, searchTags, suggestTags } from './promptassist.js';
+import { booleanInputsOf, collectNodeTitles, headTargets, joinLayers, layersForNode, normalizeNodeHeads, normalizeNodeLayers, normalizeParamKind, normalizePromptNodes, normalizeSwitchValue, parseParamText, promptBoxes } from './library.js';
+import { applySeed, hasSeed, seedForRun } from './seed.js';
+import { firstImageOutput, MAX_STEPS, ChainLibrary } from './chain.js';
+
+const COOKIE = 'cgw_remote';
+const BRIDGE_TTL_MS = 30 * 60_000;
+const MAX_UPLOAD_BYTES = 48 * 1024 * 1024;
+
+export class RemoteServer {
+    /**
+     * @param {{settings:()=>any, store:object, auth:import('./auth.js').AuthStore,
+     *          instances:import('./instances.js').InstanceManager,
+     *          pool:import('./pool.js').TaskPool, gateway:object,
+     *          library:import('./library.js').WorkflowLibrary,
+     *          log:(level:string,message:string)=>void}} deps
+     */
+    constructor(deps) {
+        this.deps = deps;
+        this.server = null;
+        this.port = null;
+        this.host = null;
+        this.lastError = null;
+        /** token -> { user, instanceId, createdAt, lastSeen } */
+        this.bridges = new Map();
+        /**
+         * Session tokens whose account has lifted its tier ceiling.
+         *
+         * Deliberately in memory and keyed by token, never persisted:
+         *
+         *   - "退出登录或关闭页面都会恢复关闭" is a promise about lifetime, and anything
+         *     written to disk would survive a restart, which is the opposite;
+         *   - per token, not per user, so two tabs (or two people sharing an admin account)
+         *     cannot silently inherit each other's elevated view;
+         *   - admins only, checked at the route, because it is an operator convenience for
+         *     reviewing the library, not a tier change for the account.
+         */
+        this.adminEyes = new Map();
+    }
+
+    get listening() {
+        return this.server !== null && this.server.listening;
+    }
+
+    async start() {
+        const config = this.deps.settings().remote ?? {};
+        if (config.enabled !== true) return { ok: true, skipped: 'disabled' };
+        const host = typeof config.host === 'string' && config.host !== '' ? config.host : '0.0.0.0';
+        const port = Number(config.port ?? 8286);
+        await this.stop();
+        const server = createServer((request, response) => {
+            this.handle(request, response).catch((error) => {
+                if (!response.headersSent) sendJson(response, 500, { error: errorMessage(error) });
+                else response.end();
+            });
+        });
+        server.on('upgrade', (request, socket, head) => this.handleUpgrade(request, socket, head));
+        await new Promise((resolve, reject) => {
+            const onError = (error) => {
+                server.off('listening', onListening);
+                reject(error);
+            };
+            const onListening = () => {
+                server.off('error', onError);
+                resolve();
+            };
+            server.once('error', onError);
+            server.once('listening', onListening);
+            server.listen(port, host);
+        });
+        server.on('error', (error) => {
+            this.lastError = errorMessage(error);
+            this.deps.log('error', `remote listen error: ${this.lastError}`);
+        });
+        this.server = server;
+        this.port = port;
+        this.host = host;
+        // Expire leases: a closed tab must not freeze a GPU forever.
+        this.sweeper = setInterval(() => this.sweepLeases(), 15_000);
+        if (typeof this.sweeper.unref === 'function') this.sweeper.unref();
+        this.lastError = null;
+        this.deps.log('info', `remote console listening on ${host}:${port}`);
+        return { ok: true, host, port };
+    }
+
+    async stop() {
+        if (this.sweeper !== undefined) {
+            clearInterval(this.sweeper);
+            this.sweeper = undefined;
+        }
+        for (const token of [...this.bridges.keys()]) this.releaseBridge(token);
+        const server = this.server;
+        this.server = null;
+        if (server === null) return { ok: true };
+        // 强制断开 keep-alive 连接，端口才真的释放（见 http.js 的 closeServer）。
+        await closeServer(server);
+        return { ok: true };
+    }
+
+    /** Drop leases nobody is looking at any more. */
+    sweepLeases() {
+        const now = Date.now();
+        for (const [token, lease] of this.bridges) {
+            if (now - lease.lastSeen > BRIDGE_TTL_MS) this.releaseBridge(token);
+        }
+        for (const task of this.deps.pool.tasks.values()) {
+            if (task.state === 'done' || task.state === 'failed' || task.state === 'cancelled') {
+                if (task.responseWaitedAt !== undefined) delete task.responseWaitedAt;
+            }
+        }
+        void this.settleOwnRuns().catch(() => {});
+    }
+
+    releaseBridge(token) {
+        const lease = this.bridges.get(token);
+        if (lease === undefined) return;
+        this.bridges.delete(token);
+        // Only lift the lock if no other open tab holds the same instance.
+        const stillHeld = [...this.bridges.values()].some((other) => other.instanceId === lease.instanceId);
+        if (!stillHeld) this.deps.pool.setBridgeLock(lease.instanceId, null);
+        this.deps.log('info', `bridge released for ${lease.instanceId}`);
+    }
+
+    currentSession(request) {
+        const token = readCookie(request.headers.cookie, COOKIE);
+        return this.deps.auth.touch(token);
+    }
+
+    // --- HTTP ------------------------------------------------------------
+    async handle(request, response) {
+        const url = new URL(request.url ?? '/', 'http://remote.invalid');
+        const path = decodeURIComponent(url.pathname);
+
+        // A bridge tunnel is unauthenticated only at the socket level: the token in
+        // the URL *is* the credential, minted behind the login and expiring.
+        if (path.startsWith('/bridge/')) {
+            return this.handleBridgeHttp(path, url, request, response);
+        }
+
+        if (path === '/health') return sendJson(response, 200, { ok: true });
+
+        if (path === '/' || path === '/index.html') return this.sendPage(response, 'login', request);
+        if (path === '/api/login' && request.method === 'POST') {
+            const body = await readJson(request).catch(() => ({}));
+            const result = await this.deps.auth.login(body.name, body.password, body.code ?? '', {
+                ip: request.socket.remoteAddress ?? '',
+                agent: request.headers['user-agent'] ?? '',
+            });
+            if (result.ok !== true) return sendJson(response, 401, { ok: false, error: result.error });
+            response.setHeader('set-cookie', cookieHeader(COOKIE, result.token, Math.floor(SESSION_MAX_MS / 1000)));
+            return sendJson(response, 200, {
+                ok: true,
+                user: { name: result.session.user, role: result.session.role, tier: result.session.tier },
+            });
+        }
+        if (path === '/api/pairing-status') {
+            // Tells the login page whether a code is even required, and how long the
+            // current one lives — never the code itself.
+            const code = await this.deps.auth.currentCode();
+            return sendJson(response, 200, { ok: true, secondsLeft: code.secondsLeft, required: code.required !== false });
+        }
+
+        const session = await this.currentSession(request);
+        if (session === undefined) {
+            if (path.startsWith('/api/')) return sendJson(response, 401, { ok: false, error: '未登录' });
+            return this.sendPage(response, 'login', request);
+        }
+        /**
+         * Attach the eye state to the session, so every existing tier check keeps working
+         * unchanged. `tierOf()` reads `session.eyes` and returns nsfw when it is on — one
+         * place to change instead of touching each route.
+         *
+         * Read from the PERSISTED session row, not from the in-memory map: the row is what
+         * survives a reload, a second tab, and a host restart. The map is now only a fallback
+         * for a token written before this field existed.
+         */
+        session.token = readCookie(request.headers.cookie, COOKIE);
+        const persisted = this.deps.auth.sessions().find((entry) => entry.token === session.token);
+        const eyeWanted = persisted?.eyes === true || this.adminEyes.get(session.token) === true;
+        session.eyes = eyeWanted && session.role === 'admin';
+
+        if (path === '/app' || path === '/console') return this.sendPage(response, 'console', request);
+        if (path === '/admin') {
+            // The page itself is not a secret — every control it shows is gated on the
+            // server — but sending a viewer to their own console is kinder than letting
+            // them land on a page of buttons that all refuse.
+            if (session.role !== 'admin') {
+                response.writeHead(302, { location: '/app' });
+                response.end();
+                return undefined;
+            }
+            return this.sendPage(response, 'admin', request);
+        }
+        if (path === '/api/logout' && request.method === 'POST') {
+            const token = readCookie(request.headers.cookie, COOKIE);
+            await this.deps.auth.logout(token);
+            // The eye is per session; logging out must also drop the elevated view, or the
+            // next person to log in on this browser would inherit it.
+            if (token !== null && token !== '') this.adminEyes.delete(token);
+            for (const [bridgeToken, lease] of this.bridges) {
+                if (lease.user === session.user) this.releaseBridge(bridgeToken);
+            }
+            response.setHeader('set-cookie', cookieHeader(COOKIE, '', 0));
+            return sendJson(response, 200, { ok: true });
+        }
+        if (path === '/api/me') {
+            return sendJson(response, 200, {
+                ok: true,
+                user: { name: session.user, role: session.role, tier: this.tierOf(session) },
+                gateway: { port: this.deps.gateway.port, listening: this.deps.gateway.listening },
+            });
+        }
+
+        /**
+         * The admin "eye": show the adult half of the library for THIS session.
+         *
+         * Two things were wrong with the first version and both are fixed here.
+         *
+         * 1. **It was memory-only.** Reloading the page kept it, but the token was handed
+         *    out again on the same session... except the map was keyed by token and the page
+         *    could not read it back after a reload raced the GET, so it looked like "刷新了
+         *    就没了". Worse, nothing in the console called it at all. The state now lives on
+         *    the session record, which is already persisted, so it survives a reload and a
+         *    host restart until the operator turns it off or logs out.
+         *
+         * 2. **Nothing consumed it.** The toggle changed `tierOf()`, but the workflow list
+         *    and the asset list were both already "own data only", so flipping it changed
+         *    nothing visible — "控制台的资源库和工作流没有关联到成人按钮上". Both routes now
+         *    consult `eyes` explicitly: on, the adult rows appear (with a badge); off, they
+         *    are absent.
+         *
+         * Deliberate limit: this is an ELEVATED VIEW, not an account change. It never edits
+         * the account's stored tier, so an SFW viewer cannot be raised by an admin's toggle.
+         */
+        if (path === '/api/admin/eyes') {
+            if (session.role !== 'admin') {
+                return sendJson(response, 403, { ok: false, error: '只有管理员可以切换成人内容显示' });
+            }
+            const token = readCookie(request.headers.cookie, COOKIE);
+            if (request.method === 'GET') {
+                return sendJson(response, 200, { ok: true, eyes: session.eyes === true });
+            }
+            const body = await readJson(request).catch(() => ({}));
+            const wanted = body?.on === true;
+            if (wanted) this.adminEyes.set(token, true);
+            else this.adminEyes.delete(token);
+            // Persisted as well as cached: the in-memory map alone is why a reload could lose
+            // the state. The row is the source of truth; the map is the fast path.
+            await this.deps.auth.patchSession(token, { eyes: wanted });
+            this.deps.log('info', `admin eyes ${wanted ? 'on' : 'off'} for ${session.user}`);
+            return sendJson(response, 200, { ok: true, eyes: wanted });
+        }
+        if (path === '/api/state') return sendJson(response, 200, this.statePayload(session));
+
+        if (path === '/api/workflows' && request.method === 'GET') {
+            const tier = this.tierOf(session);
+            // Pick up a library that changed on disk while the plugin was running.
+            // Without this, an import script writes workflows.json and the console
+            // keeps serving the list it read at startup — "Restart gateway" only
+            // restarts listeners, so the only cure was restarting the whole host.
+            await this.deps.library.reloadIfChanged();
+            /**
+             * The library is SHARED: one list configured by the operator, visible to every
+             * account. Ownership is no longer the boundary — the tier is.
+             *
+             * This reverses an earlier design where each account kept its own workflows.
+             * That made "admin builds the workflows, users just run them" impossible: a
+             * user saw an empty picker. The library is a rig capability (which graphs this
+             * machine can run), not a personal document, so it belongs to the deployment.
+             *
+             * Tier still filters: an SFW account does not see adult workflows at all —
+             * not greyed out, absent, because the name alone is a disclosure.
+             */
+            const all = this.deps.library.list(tier);
+            return sendJson(response, 200, {
+                ok: true,
+                tier,
+                workflows: all,
+                // Whether this account may add or change workflows at all. The console uses
+                // it to hide the edit affordances rather than letting someone fill a form
+                // that the POST will reject.
+                canEdit: session.role === 'admin',
+                // Still returned, but now only as the *template* a new workflow
+                // starts from. The heads actually used come with the workflow.
+                defaultHeads: this.deps.settings().promptHeads ?? {},
+            });
+        }
+        if (path === '/api/workflows' && request.method === 'POST') {
+            /**
+             * Writing is admin-only now.
+             *
+             * Not an arbitrary restriction: the library is shared, so an edit by one account
+             * silently rewrites what every other account runs. That is a deployment-level
+             * change and belongs to the operator. Running a shared workflow stays open to
+             * everyone — that is the whole point of sharing it.
+             */
+            if (session.user === '') return sendJson(response, 403, { ok: false, error: '需要登录' });
+            if (session.role !== 'admin') {
+                return sendJson(response, 403, { ok: false, error: '只有管理员可以新增或修改工作流（工作流库是所有账号共用的）' });
+            }
+            const body = await readJson(request, 8 * 1024 * 1024).catch(() => null);
+            if (body === null) return sendJson(response, 400, { ok: false, error: 'JSON 解析失败' });
+            try {
+                /**
+                 * `object_info` is only needed to convert a UI graph. An API-format
+                 * workflow is already the prompt, and a rename/head edit adds nothing to
+                 * the graph at all — so a failed probe must not block the save.
+                 *
+                 * Before this, every save called objectInfo() and turned into
+                 * "pa /object_info: fetch failed" whenever an instance was asleep or a
+                 * GPU box was off. That made the most routine edit (fix the name) depend
+                 * on ComfyUI being up, which is exactly backwards: the library is the
+                 * thing you edit *while* the rig is down.
+                 */
+                const tier = this.tierOf(session);
+                const incoming = body?.declared === 'nsfw' ? 'nsfw' : null;
+                if (incoming === 'nsfw' && tier !== 'nsfw') {
+                    return sendJson(response, 403, { ok: false, error: '当前账号不能创建成人级工作流' });
+                }
+                const graph = body?.graph;
+                const alreadyApi =
+                    graph !== null &&
+                    typeof graph === 'object' &&
+                    !Array.isArray(graph.nodes) &&
+                    Object.keys(graph).length > 0 &&
+                    Object.values(graph).every((node) => node !== null && typeof node === 'object' && typeof node.class_type === 'string');
+                const objectInfo = alreadyApi ? undefined : await this.objectInfo();
+                const saved = await this.deps.library.put({
+                    ...body,
+                    objectInfo,
+                    owner: session.user,
+                    // Sent by the console's create form; when omitted the stored
+                    // operator default seeds a new workflow.
+                    defaultHeads: this.deps.settings().promptHeads,
+                });
+                return sendJson(response, 200, { ok: true, workflow: saved });
+            } catch (error) {
+                return sendJson(response, 400, { ok: false, error: errorMessage(error) });
+            }
+        }
+        if (path.startsWith('/api/workflows/') && request.method === 'GET') {
+            const id = path.slice('/api/workflows/'.length);
+            // Same reason as the list route: the row may have arrived on disk after
+            // startup, and a freshly imported workflow must open without a host restart.
+            await this.deps.library.reloadIfChanged();
+            const record = this.deps.library.get(id);
+            // Shared library: any account may read any workflow it is allowed to see. The
+            // tier check below is the only gate, and it answers 403 rather than 404 — the
+            // id is not a secret once the row appears in a shared picker.
+            if (record === undefined) {
+                return sendJson(response, 404, { ok: false, error: 'no such workflow' });
+            }
+            if (!visibleTo(this.tierOf(session), classifyWorkflow(record).tier)) {
+                return sendJson(response, 403, { ok: false, error: '当前账号的等级看不到这个工作流' });
+            }
+            const described = this.deps.library.describe(record);
+            /**
+             * Model pickers follow the ROLE, not the eye.
+             *
+             * This used to key off the session tier, which was fine while the tier was a fact
+             * about the account. It stopped being fine when the eye became the switch for an
+             * admin: turning adult content OFF dropped the tier to sfw and took the model
+             * dropdowns with it, so the workbench lost its checkpoint lists for a reason that
+             * has nothing to do with content. Choosing a model file is an operator capability;
+             * which half of the library is on screen is a separate question.
+             *
+             * Filtered HERE, on the payload, not in the page: a viewer that hand-edits a
+             * request must not receive model entries either.
+             */
+            const tier = this.tierOf(session);
+            const mayPickModels = session.role === 'admin';
+            const allParams = mainParams(record.api, record.paramPicks ?? [], record.paramHidden ?? [], new Set(record.booleanKeys ?? []));
+            const params = mayPickModels ? allParams : allParams.filter((row) => row.kind !== 'model');
+            /**
+             * Fill each model parameter's dropdown.
+             *
+             * Done here rather than by the page calling /api/models per folder: the detail
+             * request is already open, the folder list is small, and a second round trip per
+             * model parameter would make the form appear in stages.
+             */
+            if (mayPickModels) {
+                /**
+                 * Options come from the NODE first, the disk second.
+                 *
+                 * A custom node that builds its own list does not list filenames at all:
+                 * `GroundingDinoModelLoader` offers `GroundingDINO_SwinB (938MB)`, while the
+                 * file on disk is `groundingdino_swinb_cogcoor.pth`. Offering the disk name
+                 * produced `value_not_in_list` on submit — the run failed before it started,
+                 * and the dropdown showed a name the node never accepts.
+                 *
+                 * So: when `object_info` declares a concrete option list for this exact
+                 * node+input, that list IS the answer and the disk has no say. Only when the
+                 * declaration is a bare type (IMAGE / a free string) does the folder scan
+                 * supply the choices.
+                 */
+                const info = await this.objectInfo().catch(() => null);
+                for (const row of params) {
+                    if (row.kind !== 'model') continue;
+                    const declared = comboValuesOf(info, row.classType, row.input);
+                    if (declared.length > 0) {
+                        row.options = declared;
+                        row.optionsFrom = 'node';
+                        continue;
+                    }
+                    if (row.folder === '') {
+                        row.options = [];
+                        row.optionsFrom = 'none';
+                        continue;
+                    }
+                    try {
+                        row.options = await this.modelsInFolder(row.folder);
+                        row.optionsFrom = 'disk';
+                    } catch {
+                        // A folder this build does not expose simply has no choices; the
+                        // select renders empty rather than failing the whole payload.
+                        row.options = [];
+                        row.optionsFrom = 'none';
+                    }
+                }
+            }
+            /**
+             * Tell the console whether each image slot's CURRENT value is usable.
+             *
+             * A stored filename can point at a file the instance no longer has — the graph was
+             * saved elsewhere, or the file was cleaned out of `input/`. Today that only surfaces
+             * at submit time as `Invalid image file`, after the person has filled in everything
+             * else. Flagging it here lets the panel say "这个值不行，选一张" before anything is typed.
+             *
+             * `available: null` means the instance could not be asked (asleep), so the console
+             * shows no verdict rather than a wrong one. `false` is not an error: the slot still
+             * works, the person just has to pick a file first.
+             */
+            let inputImages = null;
+            try {
+                const info = await this.objectInfo();
+                const decl = info?.LoadImage?.input?.required?.image;
+                const list = Array.isArray(decl?.[0]) ? decl[0] : (decl?.[0]?.options ?? null);
+                if (Array.isArray(list)) inputImages = new Set(list.map(String));
+            } catch {
+                inputImages = null;
+            }
+            const images = (described.images ?? []).map((row) => ({
+                ...row,
+                available: inputImages === null ? null : inputImages.has(String(row.value ?? '')),
+            }));
+
+            return sendJson(response, 200, {
+                ok: true,
+                workflow: { ...described, images },
+                graph: record.graph,
+                // The few inputs a person actually turns: what the sampler is set to,
+                // and what the latent is. Everything else stays in the canvas.
+                params,
+                /**
+                 * Node titles, so both surfaces can group parameters by node NAME.
+                 *
+                 * A grouped list whose heading is only "节点 11" is no better than the flat
+                 * grid it replaced. Read off the graph here rather than stored on the record:
+                 * the title is presentation, and a renamed node in the canvas must show up
+                 * without a save.
+                 */
+                nodeTitles: collectNodeTitles(record.graph, record.api),
+                /** Whether model pickers are available at all, so the page can say why. */
+                modelsLocked: !mayPickModels,
+                /**
+                 * Whether this graph has a seed input at all.
+                 *
+                 * The console hides the whole seed control for a pure upscale, and more
+                 * importantly the server refuses to invent one: writing `seed` into a graph
+                 * that has no seed input would submit a prompt the instance rejects.
+                 */
+                hasSeed: hasSeed(record.api ?? {}),
+            });
+        }
+        if (path.startsWith('/api/workflows/') && request.method === 'DELETE') {
+            // Deleting from a shared library is an operator action: it removes the workflow
+            // for everyone. Ownership is no longer the boundary, so the role is.
+            if (session.role !== 'admin') {
+                return sendJson(response, 403, { ok: false, error: '只有管理员可以删除工作流（工作流库是所有账号共用的）' });
+            }
+            const id = path.slice('/api/workflows/'.length);
+            const record = this.deps.library.get(id);
+            if (record === undefined) {
+                return sendJson(response, 404, { ok: false, error: 'no such workflow' });
+            }
+            try {
+                await this.deps.library.remove(id);
+                return sendJson(response, 200, { ok: true });
+            } catch (error) {
+                return sendJson(response, 404, { ok: false, error: errorMessage(error) });
+            }
+        }
+
+        if (path === '/api/upload' && request.method === 'POST') {
+            return this.handleUpload(request, response, session);
+        }
+
+        /**
+         * Model inventory, grouped by the loader a workflow would point at.
+         *
+         * Read from the instances' own /models/<folder> endpoints rather than from a
+         * hardcoded list: whatever is installed is what the operator can actually pick,
+         * and a folder the ComfyUI build does not have simply comes back empty. Failures
+         * are per-folder so one dead instance cannot blank the whole panel.
+         */
+        if (path === '/api/models' && request.method === 'GET') {
+            /**
+             * The model inventory is NSFW-only.
+             *
+             * A SFW account gets the folder list but no filenames: the shape is public (the
+             * page shows folders in the model panel), the contents are the operator's model
+             * collection. Answering 403 would break that panel; answering with names would
+             * hand over exactly what the model parameters are gated away from.
+             */
+            const inventory = await this.modelInventory();
+            // Keyed off the ROLE, not the eye: choosing a model file is an operator capability,
+            // and safe mode is about adult CONTENT, not about hiding the checkpoint list.
+            if (session.role === 'admin') return sendJson(response, 200, inventory);
+            return sendJson(response, 200, {
+                ...inventory,
+                folders: (inventory.folders ?? []).map((folder) => ({ ...folder, items: [] })),
+                total: 0,
+                locked: true,
+                error: inventory.ok === false ? inventory.error : '当前账号是全年龄等级，不显示模型文件',
+            });
+        }
+
+        /**
+         * Test a workflow without queueing anything.
+         *
+         * Two things are checked, in the order that saves the most time:
+         *   1. structural — is the graph something ComfyUI would accept (node classes, links
+         *      pointing at nodes that exist)?
+         *   2. semantic — ask the instance's own /object_info whether every class_type in the
+         *      graph is installed, and whether the model files it names are present.
+         *
+         * It deliberately does NOT submit a job. "Test" on a workflow editor means "will this
+         * run", and submitting a real job would consume GPU time and write files while the
+         * operator is still typing — and a broken graph would fail minutes later in the
+         * queue rather than immediately here.
+         */
+        /**
+         * Recognise a pasted parameter list.
+         *
+         * Runs on the server because the matcher needs the *graph* — a name is only valid if
+         * some node in this workflow actually has that input. Doing it in the browser would
+         * mean shipping the graph there twice and keeping two matchers in step.
+         */
+        if (path === '/api/workflows/params/parse' && request.method === 'POST') {
+            if (session.role !== 'admin') {
+                return sendJson(response, 403, { ok: false, error: '只有管理员可以识别参数' });
+            }
+            const body = await readJson(request, 1024 * 1024).catch(() => ({}));
+            const text = String(body?.text ?? '');
+            let api = body?.api ?? null;
+            // A workflow id may be given instead of the graph itself.
+            if (api === null && typeof body?.workflowId === 'string' && body.workflowId !== '') {
+                await this.deps.library.reloadIfChanged();
+                const record = this.deps.library.get(body.workflowId);
+                api = record?.api ?? null;
+            }
+            if (api === null || typeof api !== 'object') {
+                return sendJson(response, 400, { ok: false, error: '需要先有 workflow JSON 才能识别参数名' });
+            }
+            const parsed = parseParamText(text, api);
+            return sendJson(response, 200, {
+                ok: parsed.problems.length === 0,
+                params: parsed.params,
+                problems: parsed.problems,
+            });
+        }
+
+        if (path === '/api/workflows/test' && request.method === 'POST') {
+            if (session.role !== 'admin') {
+                return sendJson(response, 403, { ok: false, error: '只有管理员可以测试工作流' });
+            }
+            const body = await readJson(request, 8 * 1024 * 1024).catch(() => null);
+            if (body === null) return sendJson(response, 400, { ok: false, error: 'JSON 解析失败' });
+            try {
+                return sendJson(response, 200, await this.testWorkflow(body));
+            } catch (error) {
+                return sendJson(response, 200, { ok: false, problems: [errorMessage(error)], checked: 0 });
+            }
+        }
+
+        /**
+         * The 8187 pool, unfiltered by account.
+         *
+         * /api/state deliberately returns only the caller's own tasks — the console is
+         * per-account. The workbench is the operator's view of the machine, so it asks
+         * for this one explicitly, which is why it is a separate route and not a flag
+         * on the state payload: the boundary stays one route wide and greppable.
+         */
+        if (path === '/api/queue' && request.method === 'GET') {
+            if (session.role !== 'admin') return sendJson(response, 403, { ok: false, error: '只有管理员能看整机队列' });
+            const status = this.deps.gateway.statusPayload();
+            return sendJson(response, 200, {
+                ok: true,
+                dynamic: status.dynamic,
+                counters: status.counters,
+                estimate: status.estimate,
+                gateway: { port: this.deps.gateway.port, listening: this.deps.gateway.listening },
+                tasks: status.tasks.map((task) => ({
+                    ...task,
+                    user: this.deps.pool.tasks.get(task.id)?.extraData?.remoteUser ?? null,
+                })),
+            });
+        }
+
+        if (path === '/api/queue' && request.method === 'POST') {
+            if (session.role !== 'admin') return sendJson(response, 403, { ok: false, error: '只有管理员能动整机队列' });
+            const body = await readJson(request).catch(() => ({}));
+            const action = String(body?.action ?? '');
+            const id = String(body?.id ?? '');
+            if (action === 'cancel') return sendJson(response, 200, { ...this.deps.pool.cancel(id) });
+            if (action === 'move') return sendJson(response, 200, { ...this.deps.pool.reorder(id, Number(body?.delta ?? 0)) });
+            return sendJson(response, 400, { ok: false, error: `未知队列操作：${action}` });
+        }
+
+        if (path === '/api/generate' && request.method === 'POST') {
+            const body = await readJson(request).catch(() => ({}));
+            try {
+                const result = await this.generate(body, session);
+                return sendJson(response, 200, result);
+            } catch (error) {
+                return sendJson(response, 400, { ok: false, error: errorMessage(error) });
+            }
+        }
+
+        if (path === '/api/pool' && request.method === 'POST') {
+            const body = await readJson(request).catch(() => ({}));
+            const action = String(body.action ?? '');
+            if (action === 'cancel') return sendJson(response, 200, { ...this.deps.pool.cancel(String(body.id ?? '')), state: this.statePayload(session) });
+            if (action === 'move') {
+                const result = this.deps.pool.reorder(String(body.id ?? ''), Number(body.delta ?? 0));
+                return sendJson(response, 200, { ...result, state: this.statePayload(session) });
+            }
+            if (action === 'dynamic') {
+                this.deps.pool.toggleDynamic(body.enabled === true);
+                return sendJson(response, 200, { ok: true, state: this.statePayload(session) });
+            }
+            return sendJson(response, 400, { ok: false, error: `unknown action ${action}` });
+        }
+
+        if (path === '/api/bridge' && request.method === 'POST') {
+            // Leasing an instance is an administrative act: it takes a GPU out of
+            // the shared pool and hands its canvas to one person. A viewer may use
+            // the console; only an admin may take a machine away from everybody.
+            if (session.role !== 'admin') {
+                return sendJson(response, 403, { ok: false, error: '只有管理员可以桥接实例' });
+            }
+            const body = await readJson(request).catch(() => ({}));
+            const instanceId = String(body.instanceId ?? '');
+            const runtime = this.deps.instances.get(instanceId);
+            if (runtime === undefined) return sendJson(response, 404, { ok: false, error: `没有实例 ${instanceId}` });
+            if (body.action === 'release') {
+                for (const [token, lease] of this.bridges) {
+                    if (lease.instanceId === instanceId) this.releaseBridge(token);
+                }
+                return sendJson(response, 200, { ok: true, state: this.statePayload(session) });
+            }
+            const token = randomBytes(18).toString('base64url');
+            this.bridges.set(token, { user: session.user, instanceId, createdAt: Date.now(), lastSeen: Date.now() });
+            // Take the instance out of rotation for the duration: a person editing a
+            // canvas and the scheduler both queueing work on one GPU is how VRAM
+            // gets exhausted and a run dies mid-sampling.
+            this.deps.pool.setBridgeLock(instanceId, { by: session.user, token });
+            this.deps.log('info', `bridge opened for ${instanceId} by ${session.user}`);
+            return sendJson(response, 200, {
+                ok: true,
+                url: `/bridge/${token}/`,
+                instanceId,
+                state: this.statePayload(session),
+            });
+        }
+
+        if (path === '/api/history') {
+            const max = Math.min(200, Number(url.searchParams.get('max') ?? '40') || 40);
+            const tier = this.tierOf(session);
+            // The account's own runs, from the durable index — not the merged
+            // gateway history, which is everybody's work.
+            const own = await this.ownHistory(session, max);
+            return sendJson(response, 200, { ok: true, tier, history: own });
+        }
+        /**
+         * Forget one run.
+         *
+         * Deleting a *history row* and deleting a *picture* are different actions, so
+         * they are different routes. This one drops the run record (`runs.json`) and
+         * deliberately leaves the asset rows alone: the pictures were really produced,
+         * and a library that loses images because someone tidied their history would be
+         * worse than the clutter. `/api/assets` owns picture deletion.
+         *
+         * A run still in the pool is refused rather than half-forgotten: the index is the
+         * console's only source of truth, and removing a live record would make the pool's
+         * later settle silently recreate it.
+         */
+        if (path.startsWith('/api/history/') && request.method === 'DELETE') {
+            const promptId = decodeURIComponent(path.slice('/api/history/'.length));
+            if (promptId === '') return sendJson(response, 400, { ok: false, error: '缺少运行 id' });
+            const live = this.deps.pool.tasks.get(promptId);
+            if (live !== undefined && (live.state === 'queued' || live.state === 'running')) {
+                return sendJson(response, 409, { ok: false, error: '这次运行还在队列里，先取消再删记录' });
+            }
+            const result = await this.deps.runs.forget(session.user, promptId);
+            if (result.ok !== true) return sendJson(response, 404, { ok: false, error: '没有这条记录' });
+            return sendJson(response, 200, { ok: true, history: await this.ownHistory(session, 30) });
+        }
+        if (path === '/api/assist' && request.method === 'POST') {
+            const body = await readJson(request, 1024 * 1024).catch(() => ({}));
+            const tier = this.tierOf(session);
+            const heads = this.deps.settings().promptHeads ?? {};
+            try {
+                const result = await this.assistTurn(body, session);
+                return sendJson(response, 200, { ok: result.ok !== false, ...result, heads });
+            } catch (error) {
+                return sendJson(response, 400, { ok: false, error: errorMessage(error) });
+            }
+        }
+        /**
+         * Live suggestion pass while the person types — model first, dictionary as fallback.
+         *
+         * Called on every keystroke (debounced in the page). `suggestTags` merges a model
+         * pass with the deterministic dictionary scan, so a slow or failed model degrades to
+         * the local list instead of an empty panel.
+         *
+         * Returns rows shaped for the list the console draws:
+         *   {tag, zh, note, section, role, fromModel}
+         * where `note` is the one-line Chinese reading the person chooses by.
+         */
+        if (path === '/api/tags' && request.method === 'POST') {
+            const body = await readJson(request, 64 * 1024).catch(() => ({}));
+            const tier = this.tierOf(session);
+            const config = this.deps.settings();
+            if (config.remote?.assistant === false) {
+                return sendJson(response, 200, { ok: false, tags: [], error: '提示词助手已被管理员关闭' });
+            }
+            const text = String(body?.text ?? '').slice(0, 400);
+            if (text.trim() === '') return sendJson(response, 200, { ok: true, tags: [] });
+            if (tier !== 'nsfw' && detectAdult(text).hit === true) {
+                return sendJson(response, 200, { ok: false, tags: [], error: '当前账号是全年龄等级，这条需求包含成人内容' });
+            }
+            try {
+                const tags = await suggestTags(
+                    { llm: this.deps.llm, route: this.deps.llmRoute, config, tier },
+                    { text },
+                );
+                return sendJson(response, 200, { ok: true, tags });
+            } catch (error) {
+                return sendJson(response, 200, { ok: false, tags: [], error: errorMessage(error) });
+            }
+        }
+
+        /**
+         * Work chains: saved step lists plus the runner.
+         *
+         * Saving and listing are ordinary CRUD. `/api/chains/run` blocks until the chain
+         * finishes, because "ran it" and "it finished" must not be conflated: the caller
+         * needs the per-step outcome to show which link broke.
+         */
+        if (path === '/api/chains' && request.method === 'GET') {
+            return sendJson(response, 200, { ok: true, chains: this.deps.chains.list(session.user), maxSteps: MAX_STEPS });
+        }
+        if (path === '/api/chains' && request.method === 'POST') {
+            const body = await readJson(request, 1024 * 1024).catch(() => ({}));
+            try {
+                const saved = await this.deps.chains.add(session.user, body);
+                return sendJson(response, 200, { ok: true, chain: saved, chains: this.deps.chains.list(session.user) });
+            } catch (error) {
+                return sendJson(response, 400, { ok: false, error: errorMessage(error) });
+            }
+        }
+        // `/run` must be matched BEFORE the `startsWith` delete route, or DELETE would
+        // swallow it and a run request would be treated as "delete chain 'run'".
+        if (path === '/api/chains/run' && request.method === 'POST') {
+            const body = await readJson(request, 1024 * 1024).catch(() => ({}));
+            try {
+                return sendJson(response, 200, await this.runChain(body, session));
+            } catch (error) {
+                return sendJson(response, 400, { ok: false, error: errorMessage(error) });
+            }
+        }
+        if (path.startsWith('/api/chains/') && request.method === 'DELETE') {
+            const id = path.slice('/api/chains/'.length);
+            try {
+                await this.deps.chains.remove(session.user, id);
+                return sendJson(response, 200, { ok: true, chains: this.deps.chains.list(session.user) });
+            } catch (error) {
+                return sendJson(response, 404, { ok: false, error: errorMessage(error) });
+            }
+        }
+
+        /**
+         * Saved prompts. Per-account like every other list here, and deliberately outside
+         * the workflow library: a favourite is text, reusable on any graph.
+         */
+        if (path === '/api/prompts' && request.method === 'GET') {
+            return sendJson(response, 200, { ok: true, prompts: this.deps.prompts.list(session.user) });
+        }
+        if (path === '/api/prompts' && request.method === 'POST') {
+            const body = await readJson(request, 1024 * 1024).catch(() => ({}));
+            try {
+                const saved = await this.deps.prompts.add(session.user, body);
+                return sendJson(response, 200, { ok: true, prompt: saved, prompts: this.deps.prompts.list(session.user) });
+            } catch (error) {
+                return sendJson(response, 400, { ok: false, error: errorMessage(error) });
+            }
+        }
+        if (path.startsWith('/api/prompts/') && request.method === 'DELETE') {
+            const id = path.slice('/api/prompts/'.length);
+            try {
+                await this.deps.prompts.remove(session.user, id);
+                return sendJson(response, 200, { ok: true, prompts: this.deps.prompts.list(session.user) });
+            } catch (error) {
+                return sendJson(response, 404, { ok: false, error: errorMessage(error) });
+            }
+        }
+
+        if (path === '/api/assets' && request.method === 'GET') {
+            const limit = Math.min(300, Number(url.searchParams.get('max') ?? '60') || 60);
+            const list = await this.assetsPayload(session, limit);
+            return sendJson(response, 200, { ok: true, assets: list, hiddenAdult: list.hiddenAdult ?? 0, eyes: session.eyes === true });
+        }
+
+        /**
+         * Delete one picture from this account's library.
+         *
+         * Addressed by `?prompt_id=…&file=…` rather than a path segment, because a
+         * filename can contain characters a path segment cannot carry safely on every
+         * client (spaces, `#`, `%`). Both halves are required and both must match one
+         * row, so a guessed filename alone is never enough authority.
+         *
+         * The bytes stay on the ComfyUI instance: this library only ever held index
+         * rows, and pretending otherwise would leave the two disagreeing.
+         */
+        /**
+         * Which prompt-engineering skill is in force, and whether it can actually be read.
+         *
+         * Admin-only, read-only. The point is the `ok` flag: a skill that is configured but
+         * missing on disk silently degrades the assistant to "generic English tags", and the
+         * operator would only notice by the pictures getting worse. This answers that directly.
+         */
+        if (path === '/api/skill' && request.method === 'GET') {
+            if (session.role !== 'admin') {
+                return sendJson(response, 403, { ok: false, error: '只有管理员可以查看技能配置' });
+            }
+            const config = this.deps.settings().promptSkill ?? {};
+            const loaded = await loadPromptSkill(config);
+            return sendJson(response, 200, {
+                ok: true,
+                configured: String(config.name ?? ''),
+                dir: String(config.dir ?? ''),
+                includeReferences: config.includeReferences !== false,
+                loaded: { ok: loaded.ok, name: loaded.name, dir: loaded.dir, files: loaded.files, bytes: loaded.bytes, reason: loaded.reason ?? '' },
+            });
+        }
+
+        /**
+         * Bring an output picture into the `input/` folder so a LoadImage can use it.
+         *
+         * Asset-library rows are produced images: they live under `output/`, and `LoadImage`
+         * only ever lists `input/`. Picking one used to submit `nsfw_xxx.png` straight into
+         * the graph, which the instance rejects as "Invalid image file" — the reported
+         * 「资产库引入图片失败」.
+         *
+         * The instance's own /view gives the bytes back, so this copies them across the same
+         * way a browser download would, then re-uploads under a neutral name. Ownership and
+         * tier are checked before any bytes move.
+         */
+        if (path === '/api/assets/use' && request.method === 'POST') {
+            const body = await readJson(request, 64 * 1024).catch(() => ({}));
+            const promptId = String(body?.promptId ?? '');
+            const filename = String(body?.filename ?? '');
+            if (promptId === '' || filename === '') {
+                return sendJson(response, 400, { ok: false, error: '需要 promptId 与 filename' });
+            }
+            if (!this.deps.assets.owns(session.user, promptId, filename)) {
+                return sendJson(response, 404, { ok: false, error: '资产库里没有这张图' });
+            }
+            const asset = this.deps.assets.get(session.user, promptId, filename);
+            if (asset === undefined) return sendJson(response, 404, { ok: false, error: '资产库里没有这张图' });
+            if (this.tierOf(session) !== 'nsfw' && (asset.tier ?? 'sfw') === 'nsfw') {
+                return sendJson(response, 403, { ok: false, error: '当前账号的等级看不到这张图' });
+            }
+            const runtime = asset.endpointId === null ? undefined : this.deps.instances.get(asset.endpointId);
+            const target = runtime ?? this.deps.instances.enabled()[0];
+            if (target === undefined) return sendJson(response, 503, { ok: false, error: '没有可用的 ComfyUI 实例' });
+            const query = new URLSearchParams({
+                filename: asset.filename,
+                subfolder: asset.subfolder ?? '',
+                type: asset.type ?? 'output',
+            }).toString();
+            let bytes;
+            try {
+                const fetched = await this.deps.pool.backend(target).request(`/view?${query}`);
+                bytes = Buffer.from(await fetched.arrayBuffer());
+            } catch (error) {
+                return sendJson(response, 502, { ok: false, error: `取图失败：${errorMessage(error)}` });
+            }
+            if (bytes.length === 0) return sendJson(response, 502, { ok: false, error: '取回来的图是空的' });
+            /**
+             * Name the copy after the asset, with a prefix that says where it came from.
+             *
+             * Reusing the output name is tempting but wrong: `input/` and `output/` are
+             * separate namespaces, so a same-named input silently shadows nothing and makes
+             * the two libraries look identical in a listing.
+             */
+            const stem = asset.filename.replace(/\.[^.]+$/, '').replace(/[\\/:*?"<>|]/g, '_').slice(-60);
+            const uploadName = `asset_${stem}.png`;
+            try {
+                /**
+                 * `target` is an InstanceRuntime, not an instance record.
+                 *
+                 * `uploadBytesToInput` reads `.baseUrl`, and a runtime keeps that one level
+                 * down as `.instance.baseUrl`. Passing the runtime directly made the address
+                 * read as empty — the reported「写入 input 失败：实例地址为空」, which looked like
+                 * a missing configuration but was the wrong object shape at the call site.
+                 */
+                const uploaded = await uploadBytesToInput(target.instance ?? target, uploadName, bytes);
+                return sendJson(response, 200, { ok: true, ...uploaded });
+            } catch (error) {
+                return sendJson(response, 502, { ok: false, error: `写入 input 失败：${errorMessage(error)}` });
+            }
+        }
+
+        if (path === '/api/assets' && request.method === 'DELETE') {
+            const promptId = url.searchParams.get('prompt_id') ?? '';
+            const filename = url.searchParams.get('file') ?? '';
+            if (promptId === '' || filename === '') {
+                return sendJson(response, 400, { ok: false, error: '需要 prompt_id 与 file 两个参数' });
+            }
+            const removed = await this.deps.assets.remove(session.user, promptId, filename);
+            if (!removed) return sendJson(response, 404, { ok: false, error: '资产库里没有这张图' });
+            const list = await this.assetsPayload(session, 60);
+            return sendJson(response, 200, { ok: true, assets: list, hiddenAdult: list.hiddenAdult ?? 0, eyes: session.eyes === true });
+        }
+
+        if (path === '/api/settings' && request.method === 'POST') {
+            if (session.role !== 'admin') {
+                return sendJson(response, 403, { ok: false, error: '只有管理员可以改设置' });
+            }
+            const body = await readJson(request, 256 * 1024).catch(() => ({}));
+            const patch = {};
+            if (body?.promptHeads !== undefined && body.promptHeads !== null) {
+                patch.promptHeads = {
+                    positive: String(body.promptHeads.positive ?? '').slice(0, 4000),
+                    negative: String(body.promptHeads.negative ?? '').slice(0, 4000),
+                };
+            }
+            if (Object.keys(patch).length === 0) {
+                return sendJson(response, 400, { ok: false, error: '没有可改的字段' });
+            }
+            await this.deps.store.patch(patch);
+            return sendJson(response, 200, {
+                ok: true,
+                defaultHeads: this.deps.settings().promptHeads ?? {},
+            });
+        }
+
+        if (path === '/api/knowledge' && request.method === 'GET') {
+            const root = this.deps.settings().promptKb?.root ?? '';
+            const bases = await listKnowledgeBases(root);
+            return sendJson(response, 200, {
+                ok: true,
+                selected: this.deps.settings().promptKb?.kbName ?? '',
+                bases: bases.map((entry) => ({
+                    name: entry.name,
+                    documents: entry.documents,
+                    description: entry.description.slice(0, 120),
+                })),
+            });
+        }
+
+        if (path === '/api/tags' && request.method === 'GET') {
+            const query = url.searchParams.get('q') ?? '';
+            const tier = this.tierOf(session);
+            return sendJson(response, 200, { ok: true, tags: searchTags(query, tier, 40) });
+        }
+
+        // Media for the history grid. The console is on its own port, so it cannot
+        // use the Harness web server's /comfyui/media; this route finds the file on
+        // whichever instance holds it and streams it through the same origin.
+        if (path === '/media') {
+            const promptId = url.searchParams.get('prompt_id') ?? '';
+            // A file is served only when this account's own index names it. The
+            // filename alone is not authority: output names are guessable
+            // (`ComfyUI_00001_.png`), so an unowned request is a 404, not a stream.
+            const owned = promptId !== '' && this.deps.runs.owns(session.user, promptId);
+            const byName = promptId === '' ? this.ownsFile(session.user, url.searchParams.get('file') ?? '') : null;
+            if (!owned && byName === null) {
+                return sendJson(response, 404, { error: '没有这个文件' });
+            }
+            return this.proxyMedia(url, request, response);
+        }
+
+        sendJson(response, 404, { ok: false, error: `not found: ${path}` });
+    }
+
+    /** The session's content ceiling; a missing field means SFW. */
+    tierOf(session) {
+        /**
+         * The eye means SAFE MODE, not elevation.
+         *
+         * The purpose, in the operator's words: 让 NSFW 账户在公共环境不适合暴露成人信息的
+         * 场景下可以正常使用. So the eye starts OFF (the account behaves normally, adult
+         * content visible to an NSFW account) and turning it ON HIDES the adult half — for
+         * that session only, so a glance over your shoulder is not a config change.
+         *
+         * The earlier version had it backwards (on = show), which is why the button looked
+         * broken: the rig's owner is an NSFW admin, so "on" changed nothing they could see.
+         */
+        if (session?.eyes === true) return 'sfw';
+        return normalizeTier(session?.tier ?? (this.deps.auth.accounts().find((entry) => entry.name === session?.user)?.tier));
+    }
+
+    /**
+    /**
+     * Run one chain: steps in order, each waiting for the previous to finish.
+     *
+     * Deliberately NOT queued as one pool task. A chain is a *sequence* whose later steps
+     * depend on earlier results; handing all steps to the scheduler at once would run them
+     * in parallel and the "feed the previous image" step would have nothing to feed.
+     *
+     * The loop is bounded (MAX_STEPS) and every step gets a hard deadline, because a step
+     * that never finishes must not hold the chain open forever — the run is marked failed
+     * with the step index, which is the only useful thing to report.
+     */
+    async runChain(body, session) {
+        /**
+         * Two ways in: a saved chain by id, or an inline `chain` object.
+         *
+         * Inline exists so a person can try a chain before saving it. It is normalised
+         * through the same `normalizeStep`, so an inline run cannot be a way to bypass the
+         * step validation (a workflow id that does not exist still fails here, not three
+         * steps later).
+         */
+        let chain;
+        const chainId = String(body?.chainId ?? '');
+        if (chainId !== '') {
+            chain = this.deps.chains.get(session.user, chainId);
+            if (chain === undefined) throw new Error('没有这条工作链');
+        } else if (body?.chain !== undefined && Array.isArray(body.chain.steps)) {
+            const rawSteps = body.chain.steps;
+            if (rawSteps.length === 0) throw new Error('工作链至少要有一个环节');
+            if (rawSteps.length > MAX_STEPS) throw new Error(`最多 ${MAX_STEPS} 个环节`);
+            const steps = rawSteps.map((step, index) => ChainLibrary.normalizeStep(step, index));
+            if (steps.some((step) => step.workflowId === '')) throw new Error('每个环节都要选一个工作流');
+            chain = { id: 'inline', name: String(body.chain.name ?? '临时链'), steps };
+        } else {
+            throw new Error('需要 chainId 或 chain.steps');
+        }
+
+        const runId = `chain-${randomBytes(4).toString('hex')}`;
+        const results = [];
+        /** The previous step's output image, or null when the next step did not ask for it. */
+        let previous = null;
+
+        for (let index = 0; index < chain.steps.length; index += 1) {
+            const step = chain.steps[index];
+            const stepLabel = step.label || step.workflowId;
+            try {
+                const request = {
+                    workflowId: step.workflowId,
+                    negative: step.negative,
+                    params: step.params,
+                    repeat: step.repeat,
+                    /**
+                     * Chains get the same seed behaviour as a single run, per step.
+                     *
+                     * Default random, not fixed: a chain re-run is usually "try that again
+                     * differently", and pinning the seed would hand back the same pictures
+                     * step after step. A step that names a concrete value still overrides.
+                     */
+                    seed: step.seed,
+                    chainOf: { runId, step: index + 1, total: chain.steps.length },
+                };
+                if (Array.isArray(step.layers) && step.layers.some((value) => value !== '')) {
+                    request.layers = step.layers.map((value) => ({ value }));
+                }
+                /**
+                 * The ordering contract, in one line: this step's input image IS the previous
+                 * step's output. `feedPrevious` is per step because a chain may start with a
+                 * text-to-image step (no input) and continue with an upscaler (needs one);
+                 * forcing every step to accept an image would silently drop it for the ones
+                 * that have no image input.
+                 *
+                 * `generate()` writes `images[]` into whatever image node the workflow has,
+                 * which is exactly the mechanism the console's upload uses — so a chained
+                 * image and an uploaded one are indistinguishable downstream.
+                 */
+                if (previous !== null && step.feedPrevious) {
+                    request.images = [{ nodeId: '', filename: previous }];
+                }
+                const reply = await this.generate(request, session);
+                const promptIds = Array.isArray(reply.promptIds) ? reply.promptIds : [reply.prompt_id];
+
+                // Wait for EVERY run of this step before moving on: with repeat>1 the point
+                // of waiting is that the next step must not start while one of this step's
+                // images is still being written.
+                let lastOutputs = null;
+                for (const promptId of promptIds) {
+                    const finished = await this.waitForTask(promptId, 30 * 60_000);
+                    if (finished.state !== 'done') {
+                        throw new Error(`第 ${index + 1} 步「${stepLabel}」失败：${finished.error ?? finished.state}`);
+                    }
+                    lastOutputs = finished.outputs ?? null;
+                }
+                const image = firstImageOutput(lastOutputs);
+                results.push({
+                    step: index + 1,
+                    label: stepLabel,
+                    workflowId: step.workflowId,
+                    promptIds,
+                    state: 'done',
+                    image: image?.filename ?? null,
+                });
+                // Carry it forward only if the next step declared that it consumes one.
+                const next = chain.steps[index + 1];
+                previous = image !== null && next !== undefined && next.feedPrevious === true ? image.filename : null;
+            } catch (error) {
+                results.push({
+                    step: index + 1,
+                    label: stepLabel,
+                    workflowId: step.workflowId,
+                    promptIds: [],
+                    state: 'failed',
+                    error: errorMessage(error),
+                });
+                // Stop at the first failure: later steps were designed against this one's
+                // output, so running them would produce confident nonsense.
+                return { ok: false, runId, chain: { id: chain.id, name: chain.name }, steps: results, error: errorMessage(error) };
+            }
+        }
+        return { ok: true, runId, chain: { id: chain.id, name: chain.name }, steps: results };
+    }
+
+    /** Resolve when a pool task leaves queued/running, or when the deadline passes. */
+    async waitForTask(promptId, timeoutMs) {
+        const deadline = Date.now() + timeoutMs;
+        while (Date.now() < deadline) {
+            const task = this.deps.pool.tasks.get(promptId);
+            if (task === undefined) {
+                return { state: 'failed', error: '任务从池里消失了', outputs: null };
+            }
+            if (task.state === 'done' || task.state === 'failed' || task.state === 'cancelled') {
+                return { state: task.state, error: task.error ?? null, outputs: task.outputs ?? null };
+            }
+            await new Promise((resolve) => setTimeout(resolve, 700));
+        }
+        return { state: 'failed', error: '等待超时（30 分钟）', outputs: null };
+    }
+
+    /**
+     * One assistant turn, with the tier enforced on both the input and the model's
+     * answer. A SFW account must not be able to smuggle an adult request through
+     * the assistant and have it pasted into a workflow that then runs.
+     */
+    async assistTurn(body, session) {
+        const tier = this.tierOf(session);
+        const config = this.deps.settings();
+        if (config.remote?.assistant === false) {
+            throw new Error('提示词助手已被管理员关闭');
+        }
+        const message = String(body?.message ?? '');
+        const history = Array.isArray(body?.history) ? body.history : [];
+        if (tier !== 'nsfw') {
+            const hit = detectAdult(message) || scanStrings(history);
+            if (hit.hit === true) {
+                return {
+                    ok: false,
+                    mode: 'tier',
+                    error: `当前账号是全年龄等级，这条需求里的「${hit.matched}」属于成人内容；换成适合的表述，或让管理员提升等级。`,
+                };
+            }
+        }
+        const requested = typeof body?.kb === 'string' ? body.kb.trim() : undefined;
+        const effective =
+            requested === undefined
+                ? config
+                : { ...config, promptKb: { ...(config.promptKb ?? {}), kbName: requested } };
+        const layerNames = this.layerNamesOf(body?.workflowId);
+        const result = await assist(
+            {
+                llm: this.deps.llm,
+                route: this.deps.llmRoute,
+                config: effective,
+                tier,
+            },
+            {
+                message,
+                positive: body?.positive,
+                negative: body?.negative,
+                history,
+                /**
+                 * Layer names, resolved on the server from the workflow the console is
+                 * showing — not taken from the request. A client that could name its own
+                 * layers could ask the model to produce a shape the workflow does not have,
+                 * and the assemble step would then write layer text nowhere.
+                 */
+                layerNames,
+            },
+        );
+        /**
+         * Ship the answer as pickable rows, not as a blob to paste in.
+         *
+         * The console lists these under the assistant box with a checkbox each and a target
+         * box per row; nothing is written until the person presses 确定. Built here rather
+         * than in the page so the "which layer is which" names come from the stored workflow
+         * and the row notes cannot disagree with what the model actually produced.
+         */
+        return { ...result, candidates: assistCandidates(result, layerNames) };
+    }
+
+    /** Declared layer names for one workflow, or [] when it has none. */
+    layerNamesOf(workflowId) {
+        const id = String(workflowId ?? '');
+        if (id === '') return [];
+        const record = this.deps.library.get(id);
+        if (record === undefined) return [];
+        const layers = Array.isArray(record.layers) ? record.layers : [];
+        return layers.map((layer) => (typeof layer?.name === 'string' ? layer.name : ''));
+    }
+
+    /**
+     * One account's pictures, with the one field the console cannot compute.
+     *
+     * Pixel sizes live only on the instance, so they are probed here — but under a
+     * budget: measuring every row on every browse would turn opening the library into
+     * hundreds of upstream requests. Twelve per call, newest first, means the first
+     * browse fills in quickly and later ones are free because the result is written
+     * back to the index.
+     *
+     * Shared by the list route and the delete route so a caller gets the same shape
+     * from both, and so deleting a picture does not need a second round trip just to
+     * learn what the library looks like afterwards.
+     */
+    async assetsPayload(session, limit = 60) {
+        const owner = session.user;
+        /**
+         * Which pictures this session may see.
+         *
+         * The eye is the only thing that gates the library, and it now actually does:
+         * "控制台的资源库…没有关联到成人按钮上". With the eye off, adult rows are filtered
+         * out; with it on, they appear and say so. `null` tier on an old row means "recorded
+         * before the column existed" — treated as SFW so an upgrade cannot start showing
+         * adult pictures to an account that had the eye off.
+         */
+        // Safe mode: the eye hides the adult half instead of revealing it.
+        const safeMode = session.eyes === true;
+        const everything = this.deps.assets.list(owner, limit);
+        const rows = everything.filter((asset) => !safeMode || (asset.tier ?? 'sfw') !== 'nsfw');
+        const hiddenAdult = everything.length - rows.length;
+        let budget = 12;
+        for (const asset of rows) {
+            if (budget <= 0) break;
+            if (asset.width !== null && asset.height !== null) continue;
+            const runtime = asset.endpointId === null ? undefined : this.deps.instances.get(asset.endpointId);
+            const target = runtime ?? this.deps.instances.enabled()[0];
+            if (target === undefined) break;
+            budget -= 1;
+            const query = new URLSearchParams({ filename: asset.filename, subfolder: asset.subfolder, type: asset.type }).toString();
+            const size = await probeSize(this.deps.pool.backend(target), query);
+            if (size !== null) {
+                asset.width = size.width;
+                asset.height = size.height;
+                void this.deps.assets.setSize(owner, asset.promptId, asset.filename, size);
+            }
+        }
+        const payload = rows.map((asset) => {
+            const source = `/media?file=${encodeURIComponent(asset.filename)}&subfolder=${encodeURIComponent(asset.subfolder)}&type=${encodeURIComponent(asset.type)}&prompt_id=${encodeURIComponent(asset.promptId)}`;
+            return {
+                promptId: asset.promptId,
+                filename: asset.filename,
+                subfolder: asset.subfolder,
+                type: asset.type,
+                name: asset.name,
+                width: asset.width,
+                height: asset.height,
+                /** The seed this exact picture came from; null when the run had none. */
+                seed: typeof asset.seed === 'number' ? asset.seed : null,
+                tier: asset.tier ?? 'sfw',
+                submittedAt: asset.submittedAt,
+                url: source,
+                download: `${source}&download=1`,
+            };
+        });
+        /**
+         * The count of adult rows the eye is currently hiding travels with the list.
+         *
+         * Silently dropping them makes an empty library indistinguishable from a filtered
+         * one, and the operator's first question on seeing a gap was "where did my pictures
+         * go". A number lets the page say "还有 N 张在成人内容里".
+         */
+        if (hiddenAdult > 0) payload.hiddenAdult = hiddenAdult;
+        return payload;
+    }
+
+    /**
+     * One account's own runs, from the durable index and the live pool together.
+     *
+     * The index is what survives logout; the pool is what has a live task object
+     * and therefore the freshest state and file list. Either alone is incomplete:
+     * the index alone would never show progress, the pool alone would forget
+     * everything at a restart.
+     */
+    async ownHistory(session, max) {
+        const merged = {};
+        for (const record of this.deps.runs.list(session.user, max)) {
+            const live = this.deps.pool.tasks.get(record.promptId);
+            if (live !== undefined && live.state === 'done' && live.historyEntry !== undefined && live.historyEntry !== null) {
+                const files = outputsOf(live.historyEntry);
+                if (files.length !== (record.files ?? []).length) {
+                    void this.deps.runs.settle(session.user, record.promptId, { files, state: live.state });
+                }
+                merged[record.promptId] = {
+                    ...live.historyEntry,
+                    meta: {
+                        ...(live.historyEntry.meta ?? {}),
+                        owner: session.user,
+                        run: { name: record.name, endpointId: live.backendId, submittedAt: record.submittedAt },
+                    },
+                    files,
+                    state: live.state,
+                    error: live.error ?? null,
+                };
+                continue;
+            }
+            if (live !== undefined) {
+                merged[record.promptId] = {
+                    prompt: null,
+                    outputs: {},
+                    status: { status_str: live.state, completed: false },
+                    meta: { owner: session.user, run: { name: record.name, endpointId: live.backendId, submittedAt: record.submittedAt } },
+                    files: [],
+                    state: live.state,
+                    error: live.error ?? null,
+                };
+                continue;
+            }
+            const state = record.state ?? 'done';
+            merged[record.promptId] = {
+                prompt: null,
+                outputs: {},
+                status: { status_str: state, completed: state === 'done' },
+                meta: { owner: session.user, run: { name: record.name, endpointId: record.endpointId ?? null, submittedAt: record.submittedAt } },
+                files: record.files ?? [],
+                state,
+                error: record.error ?? null,
+            };
+        }
+        return merged;
+    }
+
+    /** Does any run this account owns reference this exact filename? */
+    ownsFile(owner, filename) {
+        if (filename === '') return null;
+        for (const record of this.deps.runs.list(owner, 400)) {
+            for (const file of record.files ?? []) {
+                if (file.filename === filename) return file;
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Pull the pool's finished state into the durable index.
+     *
+     * Called on a timer: without it a run finished while the browser was closed
+     * would never record its file list, and the history after re-login would show
+     * the run with no images.
+     */
+    async settleOwnRuns() {
+        for (const task of this.deps.pool.tasks.values()) {
+            const owner = task.extraData?.remoteUser;
+            if (typeof owner !== 'string' || owner === '') continue;
+            if (task.state !== 'done' && task.state !== 'failed' && task.state !== 'cancelled') continue;
+            const record = this.deps.runs.get(owner, task.id);
+            if (record === undefined) continue;
+            const files = task.historyEntry === null || task.historyEntry === undefined ? [] : outputsOf(task.historyEntry);
+            const same = (record.state ?? null) === task.state && (record.files ?? []).length === files.length;
+            if (same) continue;
+            await this.deps.runs.settle(owner, task.id, {
+                state: task.state,
+                files,
+                endpointId: task.backendId ?? record.endpointId ?? null,
+                error: task.error ?? null,
+            });
+            // One asset row per produced file, so the library is a picture list
+            // rather than a run list. Idempotent: a second sweep rewrites the same
+            // rows and keeps any size already measured.
+            if (files.length > 0 && task.state === 'done') {
+                await this.deps.assets.recordRun(owner, { ...record, endpointId: task.backendId ?? record.endpointId ?? null, tier: classifyRun(task) }, files);
+            }
+        }
+        /**
+         * Second pass over the durable index, because the loop above cannot see everything.
+         *
+         * `pool.tasks` lives in memory. A run that finished before a host restart — or whose
+         * task object was dropped — sits in runs.json with its files but was never copied into
+         * the asset library, so the console showed "还没有图片" for images the person had
+         * produced. That is the reported bug: one done run with a file, assets.json empty.
+         *
+         * Idempotent by construction: `recordRun` replaces that run's rows wholesale and keeps
+         * sizes already measured, and `hasRun` short-circuits the common case so a sweep over a
+         * current library writes nothing.
+         */
+        for (const owner of this.deps.runs.owners()) {
+            for (const record of this.deps.runs.list(owner, 400)) {
+                if (record.state !== 'done') continue;
+                const files = Array.isArray(record.files) ? record.files : [];
+                if (files.length === 0) continue;
+                if (this.deps.assets.hasRun(owner, record.promptId, files.length)) continue;
+                await this.deps.assets.recordRun(owner, { ...record, endpointId: record.endpointId ?? null, tier: record.tier ?? classifyRun({ extraData: { workflowName: record.name } }) }, files);
+            }
+        }
+    }
+
+    async objectInfo() {
+        const primary = await this.deps.gateway.primary();
+        if (primary === undefined) throw new Error('没有可用的 ComfyUI 实例');
+        return this.deps.gateway.cachedObjectInfo(primary, '');
+    }
+
+    /**
+     * What is installed on the bound instances, grouped by folder.
+     *
+     * The folder names are ComfyUI's own (`/models/checkpoints`, `/models/loras`, …);
+     * asking each one is the only way to learn what a given build actually serves.
+     * Results are merged across instances because the operator cares that a model
+     * exists somewhere in the rig, not on which card.
+     */
+    /**
+     * Check a graph without running it.
+     *
+     * Returns a list of problems rather than a boolean: "cannot run" without saying which
+     * node or model is useless to the person editing the JSON.
+     */
+    async testWorkflow(body) {
+        const problems = [];
+        const warnings = [];
+        const raw = body?.graph;
+
+        // --- shape ---------------------------------------------------------
+        let api = null;
+        const graph = raw;
+        if (graph === null || typeof graph !== 'object') {
+            return { ok: false, problems: ['JSON 不是一个对象'], warnings: [], checked: 0 };
+        }
+        const isApi =
+            !Array.isArray(graph.nodes) &&
+            Object.keys(graph).length > 0 &&
+            Object.values(graph).every((node) => node !== null && typeof node === 'object' && typeof node.class_type === 'string');
+        if (isApi) {
+            api = graph;
+        } else if (Array.isArray(graph.nodes)) {
+            // A UI graph is legal input for saving, but testing it requires the instance to
+            // convert it — which is exactly what saving does. Say so rather than pretend.
+            warnings.push('这是画布格式（含 nodes 数组）。测试只检查 API 格式；保存时会自动转成 API。');
+        } else {
+            return { ok: false, problems: ['既不是 API 格式（class_type 节点表），也不像画布格式（缺 nodes 数组）'], warnings: [], checked: 0 };
+        }
+
+        if (api === null) {
+            return { ok: warnings.length === 0, problems, warnings, checked: 0 };
+        }
+
+        // Node id sanity: a link to a node that does not exist is the classic silent break.
+        for (const [nodeId, node] of Object.entries(api)) {
+            for (const [input, value] of Object.entries(node?.inputs ?? {})) {
+                if (!Array.isArray(value) || value.length !== 2) continue;
+                const [target, slot] = value;
+                if (typeof target !== 'string') continue;
+                if (api[target] === undefined) {
+                    problems.push(`节点 ${nodeId} 的 ${input} 指向不存在的节点 ${target}`);
+                } else if (!Number.isInteger(slot)) {
+                    problems.push(`节点 ${nodeId} 的 ${input} 槽位不是整数：${String(slot)}`);
+                }
+            }
+        }
+
+        // --- installed node types and model files ---------------------------
+        let objectInfo = null;
+        try {
+            objectInfo = await this.objectInfo();
+        } catch (error) {
+            warnings.push(`读不到实例的节点清单（${errorMessage(error)}），只能做结构检查`);
+        }
+        if (objectInfo !== null) {
+            const classes = [...new Set(Object.values(api).map((node) => String(node.class_type)))].sort();
+            for (const className of classes) {
+                if (objectInfo[className] === undefined) {
+                    problems.push(`实例上没有这个节点类型：${className}`);
+                }
+            }
+            /**
+             * Model files: only check inputs whose name and value look like a model
+             * reference. A missing checkpoint gives the most confusing ComfyUI error of all
+             * ("Value not in list"), so naming the file here is worth the small heuristic.
+             *
+             * The folder depends on the NODE TYPE where the input name alone is ambiguous:
+             * `model_name` is a LoRA on LoraLoader and an upscale model on
+             * UpscaleModelLoader. Checking a valid upscaler against /models/loras reported a
+             * phantom "file not found", which is worse than not checking at all.
+             */
+            const INPUT_FOLDERS = {
+                ckpt_name: 'checkpoints',
+                unet_name: 'diffusion_models',
+                vae_name: 'vae',
+                clip_name: 'clip',
+                clip_name1: 'clip',
+                clip_name2: 'clip',
+                clip_vision_name: 'clip_vision',
+                control_net_name: 'controlnet',
+                ipadapter_file: 'ipadapter',
+            };
+            /** Node types whose `model_name` means a specific folder. */
+            const MODEL_NAME_FOLDER = {
+                LoraLoader: 'loras',
+                LoraLoaderModelOnly: 'loras',
+                UpscaleModelLoader: 'upscale_models',
+                ImageUpscaleWithModel: 'upscale_models',
+                UnetLoaderGGUF: 'unet',
+            };
+            for (const [nodeId, node] of Object.entries(api)) {
+                const classType = String(node?.class_type ?? '');
+                for (const [input, value] of Object.entries(node?.inputs ?? {})) {
+                    if (typeof value !== 'string' || value === '') continue;
+                    let folder = INPUT_FOLDERS[input];
+                    if (folder === undefined && input === 'model_name') folder = MODEL_NAME_FOLDER[classType];
+                    if (folder === undefined) continue;
+                    try {
+                        const list = await this.deps.pool.backend(this.deps.instances.enabled()[0]).json(`/models/${folder}`);
+                        if (Array.isArray(list) && !list.map(String).includes(value)) {
+                            problems.push(`节点 ${nodeId} 的 ${input} 找不到模型文件：${value}（/models/${folder}）`);
+                        }
+                    } catch {
+                        // Best effort: a folder this build does not expose is not a failure.
+                    }
+                }
+            }
+        }
+
+        return {
+            ok: problems.length === 0,
+            problems,
+            warnings,
+            checked: Object.keys(api).length,
+            classes: [...new Set(Object.values(api).map((node) => String(node.class_type)))].sort(),
+            /**
+             * What the editor needs to redraw its derived sections without a second route.
+             * "重新识别" and "测试" are the same question to the server — "look at this
+             * graph" — so they share one response rather than two nearly identical ones.
+             */
+            needsText: promptBoxes(
+                promptTargets(api, body?.promptNodes ?? null),
+                body?.nodeHeads ?? null,
+                body?.nodeLayers ?? null,
+                body?.layers ?? null,
+            ).length > 0,
+            params: mainParams(api, body?.paramPicks ?? [], body?.paramHidden ?? [], booleanInputsOf(api, objectInfo)),
+            /** Node titles, so the grouped parameter list has headings worth reading. */
+            nodeTitles: collectNodeTitles(body?.graph, api),
+            texts: promptTargets(api, body?.promptNodes ?? null).map((row) => ({
+                nodeId: row.nodeId,
+                input: row.input,
+                role: row.role,
+                classType: String(api[row.nodeId]?.class_type ?? ''),
+                value: api[row.nodeId]?.inputs?.[row.input] ?? '',
+            })),
+        };
+    }
+
+    /**
+     * Filenames in one model folder, merged across instances.
+     *
+     * Used to fill a model parameter's dropdown. Merged and de-duplicated for the same
+     * reason the inventory is: two GPUs sharing a model directory must not list every file
+     * twice, and a file only on the second card must still be selectable.
+     */
+    /**
+     * The model folders on THIS machine, read from disk.
+     *
+     * Local disk is the authority, not the instance's `/models`. Reasons, all observed here:
+     *
+     *  - `/models` only lists folders `folder_paths` registered. `grounding-dino`,
+     *    `insightface`, `reactor`, `yolo`, `nsfw_detector` exist on disk and never appear
+     *    there, so an API-only list can never offer them.
+     *  - The API answers per instance. Two instances sharing one `models` directory produced
+     *    the same names twice, and an instance that was asleep produced nothing at all.
+     *  - Scanning the directory is one `readdir`; asking an instance is an HTTP round trip
+     *    that fails when the rig is down — and the library is exactly what you edit while it is
+     *    down.
+     *
+     * The root comes from `modelsRoot` when set, else from the launcher: `<dir of bat>/ComfyUI/models`,
+     * which is how every portable ComfyUI build is laid out. Labels are the folder's own name —
+     * the operator is matching against what is on disk.
+     */
+    async modelFolders() {
+        const seen = new Set();
+        const rows = [];
+        for (const root of this.localModelRoots()) {
+            let entries;
+            try {
+                entries = readdirSync(root, { withFileTypes: true });
+            } catch {
+                continue;
+            }
+            for (const entry of entries) {
+                if (!entry.isDirectory()) continue;
+                const name = entry.name;
+                if (seen.has(name)) continue;
+                /**
+                 * Build artefacts are not model folders. ComfyUI keeps `configs` / `datasets`
+                 * next to the weights and they hold no loadable model.
+                 */
+                if (name === 'configs' || name === 'datasets') continue;
+                seen.add(name);
+                rows.push([name, name]);
+            }
+        }
+        if (rows.length === 0) return MODEL_FOLDERS.map(([id, label]) => [id, label]);
+        return rows.sort((left, right) => left[0].localeCompare(right[0]));
+    }
+
+    /**
+     * Every resolvable local `models` root, de-duplicated, in instance order.
+     *
+     * Read from the SETTINGS, not from `instances.enabled()`. The runtime objects are rebuilt
+     * by `sync()` on a settings change, and a caller that patches settings without syncing
+     * (the tests do; so does any future editor) would otherwise keep serving the previous
+     * `modelsRoot` — the panel would look stale until the next restart.
+     *
+     * Settings are the flat truth here: this only needs a path string, no live process state.
+     */
+    localModelRoots() {
+        const roots = [];
+        const rows = this.deps.settings?.()?.instances ?? [];
+        for (const instance of rows) {
+            if (instance === null || typeof instance !== 'object') continue;
+            if (instance.enabled === false) continue;
+            const explicit = String(instance.modelsRoot ?? '').trim();
+            let root = explicit;
+            if (root === '') {
+                const bat = String(instance.control?.batPath ?? '').trim();
+                if (bat === '') continue;
+                root = join(dirname(bat), 'ComfyUI', 'models');
+            }
+            if (!isAbsolute(root)) continue;
+            if (!roots.includes(root)) roots.push(root);
+        }
+        return roots;
+    }
+
+    /**
+     * Sub-directory names under each instance's local `models` root.
+     *
+     * Kept as the folder-only view; `modelFolders()` is the one the routes use.
+     */
+    localModelFolders() {
+        const names = [];
+        for (const root of this.localModelRoots()) {
+            try {
+                for (const entry of readdirSync(root, { withFileTypes: true })) {
+                    if (entry.isDirectory()) names.push(entry.name);
+                }
+            } catch {
+                // No local access to that root: nothing to contribute.
+            }
+        }
+        return names;
+    }
+
+    /**
+     * Files inside one model folder, read from DISK.
+     *
+     * Recursive, and returned as `subdir/name.ext` — the same shape ComfyUI's own `/models`
+     * reports, so a graph that names `subdir/name.safetensors` keeps working and a dropdown
+     * shows the nested file where it actually lives.
+     *
+     * **Only actual weights are listed.** An earlier version said "every extension, because a
+     * filter would hide real files" — and then `grounding-dino/` offered
+     * `GroundingDINO_SwinB.cfg.py`, `bert-base-uncased/` offered `vocab.txt` and
+     * `tokenizer_config.json`, and `configs/` offered a dozen `.yaml` sampling configs. Those
+     * are not models: they are code and configuration that sit NEXT TO the weights, and picking
+     * one fails at load time. A whitelist of weight extensions is the honest rule.
+     */
+    async modelsInFolder(folder) {
+        const name = String(folder ?? '').trim();
+        // A folder name is one path segment: reject anything that could escape the root.
+        if (name === '' || name === '.' || name === '..' || /[\\/]/.test(name)) return [];
+        const found = new Set();
+        for (const root of this.localModelRoots()) {
+            const dir = join(root, name);
+            const walk = (current, prefix, depth) => {
+                // A model tree is shallow; the cap stops a symlink loop from hanging the request.
+                if (depth > 6) return;
+                let entries;
+                try {
+                    entries = readdirSync(current, { withFileTypes: true });
+                } catch {
+                    return;
+                }
+                for (const entry of entries) {
+                    if (entry.isDirectory()) {
+                        /**
+                         * Skip the auxiliary trees that hold assets rather than weights.
+                         *
+                         * `bert-base-uncased/` is a tokenizer directory (config.json +
+                         * vocab.txt); walking into it produced two "models" that are plainly
+                         * configuration.
+                         */
+                        if (/^(\.git|__pycache__)$/i.test(entry.name)) continue;
+                        walk(join(current, entry.name), `${prefix}${entry.name}/`, depth + 1);
+                        continue;
+                    }
+                    if (!entry.isFile()) continue;
+                    /**
+                     * ComfyUI's own placeholder markers, and anything that is not weights.
+                     *
+                     * Every model folder ships a zero-byte file named like
+                     * `put_esrgan_and_other_upscale_models_here`; it is documentation, not a
+                     * model. And a `.py` / `.json` / `.yaml` / `.txt` next to the weights is
+                     * code or configuration — `GroundingDINO_SwinB.cfg.py` is the reported case.
+                     */
+                    if (/^put_.*_here$/i.test(entry.name)) continue;
+                    if (!MODEL_FILE_EXT.test(entry.name)) continue;
+                    found.add(`${prefix}${entry.name}`);
+                }
+            };
+            walk(dir, '', 0);
+        }
+        return [...found].sort();
+    }
+
+    async modelInventory() {
+        /**
+         * Everything here comes from the LOCAL DISK, not from the instances.
+         *
+         * The instance's `/models` was the old source and it was wrong three ways at once: it
+         * omits folders `folder_paths` never registered (`grounding-dino`, `insightface`,
+         * `reactor`, `yolo`), it answers per instance so a shared models directory came back
+         * duplicated, and it fails outright when the rig is asleep — which is precisely when
+         * someone is in the workbench fixing a graph.
+         *
+         * One `readdir` per folder answers the same question locally and completely.
+         */
+        const FOLDERS = await this.modelFolders();
+        const roots = this.localModelRoots();
+        if (roots.length === 0) {
+            return { ok: false, error: '没有可读的本地模型目录（请在实例里设置 modelsRoot 或启动脚本）', folders: [], instances: [] };
+        }
+        const folders = [];
+        const enabledIds = (this.deps.settings?.()?.instances ?? [])
+            .filter((row) => row !== null && typeof row === 'object' && row.enabled !== false)
+            .map((row) => String(row.id ?? ''))
+            .filter((id) => id !== '')
+            .sort();
+        for (const [name, label] of FOLDERS) {
+            const items = await this.modelsInFolder(name);
+            // An empty section is pure noise: the operator cannot pick anything from it.
+            if (items.length === 0) continue;
+            folders.push({
+                name,
+                label,
+                items,
+                /**
+                 * Which instance(s) would load these files. With one shared local `models`
+                 * directory every enabled instance can, so this stays a plain list of ids
+                 * rather than an attribution guess.
+                 */
+                instances: enabledIds,
+            });
+        }
+        folders.sort((left, right) => right.items.length - left.items.length);
+        return {
+            ok: true,
+            source: 'disk',
+            roots,
+            instance: null,
+            instances: enabledIds.map((id) => ({ id, label: id })),
+            failed: [],
+            folders,
+            total: folders.reduce((sum, folder) => sum + folder.items.length, 0),
+        };
+    }
+
+    /**
+     * Stream one output file from whichever instance holds it.
+     *
+     * The pool knows where a run landed; for a filename with no prompt id the
+     * instances are tried in order. Range is forwarded so a phone can scrub a
+     * video preview instead of downloading it whole.
+     */
+    async proxyMedia(url, request, response) {
+        const filename = url.searchParams.get('file') ?? url.searchParams.get('filename') ?? '';
+        if (filename === '') return sendJson(response, 400, { error: 'file is required' });
+        const subfolder = url.searchParams.get('subfolder') ?? '';
+        const type = url.searchParams.get('type') ?? 'output';
+        const query = new URLSearchParams({ filename, subfolder, type }).toString();
+        const method = request.method === 'HEAD' ? 'HEAD' : 'GET';
+        const ordered = [];
+        const promptId = url.searchParams.get('prompt_id');
+        if (promptId !== null && promptId !== '') {
+            const task = this.deps.pool.tasks.get(promptId);
+            const runtime = task?.backendId ? this.deps.instances.get(task.backendId) : undefined;
+            if (runtime !== undefined) ordered.push(runtime);
+        }
+        for (const runtime of this.deps.instances.enabled()) {
+            if (!ordered.includes(runtime)) ordered.push(runtime);
+        }
+        let lastError = '没有实例持有这个文件';
+        for (const runtime of ordered) {
+            try {
+                const stream = await this.deps.pool.backend(runtime).openView(query, method, request.headers.range);
+                const head = {
+                    'content-type': stream.headers.get('content-type') ?? 'application/octet-stream',
+                    'accept-ranges': 'bytes',
+                    'cache-control': 'private, max-age=600',
+                };
+                if (url.searchParams.get('download') === '1') {
+                    // A download is the same bytes with a filename, so the file keeps
+                    // its name instead of becoming what the browser would invent.
+                    head['content-disposition'] = `attachment; filename="${filename.replace(/["\\]/g, '_')}"`;
+                }
+                for (const name of ['content-length', 'content-range']) {
+                    const value = stream.headers.get(name);
+                    if (value !== null) head[name] = value;
+                }
+                response.writeHead(stream.status, head);
+                if (method === 'HEAD' || stream.body === null) {
+                    response.end();
+                    return undefined;
+                }
+                // Same reason as the gateway relay: the upstream body carries an abort
+                // timer, and an abandoned `/media` (thumbnail scrolled away, console
+                // closed while saving) must not surface as a host-killing exception.
+                pipeGuarded(stream.body, response);
+                return undefined;
+            } catch (error) {
+                lastError = errorMessage(error);
+            }
+        }
+        return sendJson(response, 404, { error: lastError });
+    }
+
+    /** Everything the console polls: instances, pool, leases. */
+    statePayload(session) {
+        const status = this.deps.gateway.statusPayload();
+        const tier = this.tierOf(session);
+        const defaultHeads = this.deps.settings().promptHeads ?? {};
+        return {
+            ok: true,
+            user: { name: session.user, role: session.role, tier },
+            canBridge: session.role === 'admin',
+            gateway: { port: this.deps.gateway.port, listening: this.deps.gateway.listening },
+            assistant: this.deps.settings().remote?.assistant !== false,
+            /** Which knowledge base the assistant reads, so the page can show it. */
+            promptKb: { kbName: this.deps.settings().promptKb?.kbName ?? '' },
+            /**
+             * Which prompt-engineering skill the assistant follows.
+             *
+             * Reported so the console can say "按技能 X 出词" instead of leaving the operator
+             * to guess whether the rules are actually in play. Cheap: it is the configured
+             * name, not a disk read.
+             */
+            promptSkill: {
+                name: this.deps.settings().promptSkill?.name ?? '',
+                references: this.deps.settings().promptSkill?.includeReferences !== false,
+            },
+            // The template for new workflows, not the heads in force: those travel
+            // with each workflow, because only the workflow knows whether a graph
+            // takes text at all.
+            defaultHeads: { positive: defaultHeads.positive ?? '', negative: defaultHeads.negative ?? '' },
+            dynamic: status.dynamic,
+            counters: status.counters,
+            estimate: status.estimate,
+            // Only this account's own tasks. The pool is shared, but the console is
+            // not: seeing other people's queued work (and its workflow names) is the
+            // same disclosure as seeing their history.
+            tasks: status.tasks.filter((task) => {
+                const live = this.deps.pool.tasks.get(task.id);
+                if (live === undefined) return false;
+                if (live.extraData?.remoteUser !== session.user) return false;
+                return tier === 'nsfw' ? true : visibleTo(tier, classifyRun(live));
+            }),
+            instances: status.instances.map((entry) => ({
+                id: entry.id,
+                label: entry.label,
+                healthy: entry.healthy,
+                enabled: entry.enabled,
+                version: entry.version,
+                devices: entry.devices,
+                speed: entry.speed,
+                maxConcurrent: entry.maxConcurrent,
+                bridgeLock: this.deps.pool.bridgeLockOf(entry.id),
+            })),
+            bridges: [...this.bridges.entries()].map(([token, lease]) => ({
+                token: token.slice(0, 6),
+                instanceId: lease.instanceId,
+                user: lease.user,
+                url: `/bridge/${token}/`,
+            })),
+        };
+    }
+
+    /**
+     * Build the prompt for one workflow, apply the console's edits, and hand it to
+     * the pool. The reply is the gateway prompt id — polling /api/task/<id> follows.
+     */
+    async generate(body, session) {
+        const workflowId = String(body.workflowId ?? '');
+        const tier = this.tierOf(session);
+        // Generating right after an import must work in the same session that sees the
+        // new row; resolve() reads from the in-memory list.
+        await this.deps.library.reloadIfChanged();
+        const record = this.deps.library.get(workflowId);
+        if (record !== undefined && !visibleTo(tier, classifyWorkflow(record).tier)) {
+            throw new Error('当前账号的等级看不到这个工作流');
+        }
+        /**
+         * Gate the PROMPT, not just the workflow.
+         *
+         * A SFW account could reach an adult result two ways before this: by typing an adult
+         * prompt into a shared SFW workflow (the graph is safe, the text is not), or by
+         * putting the words in `layers` rather than `texts`. This checks every string the
+         * request would write into the graph — the two the console sends — and refuses the
+         * run rather than silently sanitising it: a silently cleaned prompt produces a
+         * picture the person did not ask for, which is worse than a clear refusal.
+         */
+        if (tier !== 'nsfw') {
+            const wanted = [];
+            for (const edit of Array.isArray(body.texts) ? body.texts : []) wanted.push(String(edit?.value ?? ''));
+            for (const layer of Array.isArray(body.layers) ? body.layers : []) {
+                wanted.push(String(layer !== null && typeof layer === 'object' ? layer?.value ?? '' : layer ?? ''));
+            }
+            // Per-node layers are a separate array: a SFW account must not be able to put an
+            // adult tag into the negative encoder's 排除项 layer just because the scan only
+            // looked at the legacy field.
+            for (const entry of Array.isArray(body.layered) ? body.layered : []) {
+                for (const value of Array.isArray(entry?.values) ? entry.values : []) {
+                    wanted.push(String(value !== null && typeof value === 'object' ? value?.value ?? '' : value ?? ''));
+                }
+            }
+            wanted.push(String(body.prompt ?? ''));
+            const hit = wanted.map((text) => detectAdult(text)).find((row) => row.hit === true);
+            if (hit !== undefined) {
+                throw new Error(`当前账号是全年龄等级，提示词里的「${hit.matched}」属于成人内容，已被拦截。`);
+            }
+        }
+        /**
+         * The operator's declared prompt roles for THIS workflow, or null when inferred.
+         *
+         * Read once here and threaded through every place a role decides which encoder gets
+         * written — layered positive, per-run head override, and the first-positive fallback.
+         * Reading it per call site would let two of them disagree on a graph with several
+         * text nodes, which is exactly the case this declaration exists for.
+         *
+         * The declaration is resolved AFTER `resolved` because it comes off the record:
+         * reading `resolved.record` up here was a temporal-dead-zone throw on every call
+         * ("Cannot access 'resolved' before initialization"), not an undefined read.
+         */
+        const objectInfo = await this.objectInfo();
+        const resolved = this.deps.library.resolve(workflowId, objectInfo);
+        const prompt = resolved.api;
+        /**
+         * Roles, and the per-node prompt surface built from them.
+         *
+         * `promptNodes` says which nodes are positive, which negative and which 不参与;
+         * `nodeHeads` carries each node's own standing head. `boxes` is the SAME list the
+         * console renders, so a box shown and the encoder written cannot be different nodes.
+         */
+        const recordTexts = resolved.record === undefined
+            ? []
+            : promptTargets(prompt, normalizePromptNodes(resolved.record.promptNodes) ?? null);
+        const boxes = promptBoxes(recordTexts, resolved.record?.nodeHeads ?? null);
+        /**
+         * Which inputs this workflow must write as real booleans.
+         *
+         * Persisted on the record at save time (see library.put → booleanKeys). It is read
+         * here, not from a live object_info call, because a run must not depend on the
+         * instance answering a second request — and because the parameter edit loop below has
+         * to know the answer before it writes.
+         */
+        const declaredBooleans = new Set(
+            Array.isArray(resolved.record?.booleanKeys) ? resolved.record.booleanKeys.map(String) : [],
+        );
+        /**
+         * Drop the folder annotation ComfyUI's frontend leaves on filenames.
+         *
+         * A graph saved with a dropdown pick stores `photo.png [output]`; the bracket is a UI
+         * label, not part of the name. Submitted as-is the instance answers "Invalid image
+         * file", and the slot was not even recognised as an image input. Cleaning every string
+         * input costs one pass and fixes both.
+         */
+        for (const node of Object.values(prompt ?? {})) {
+            for (const [key, value] of Object.entries(node.inputs ?? {})) {
+                if (typeof value !== 'string') continue;
+                if (!/\s*\[[^\]]*\]\s*$/.test(value)) continue;
+                node.inputs[key] = stripNameAnnotation(value);
+            }
+        }
+        /**
+         * Fill in required inputs that the stored graph predates.
+         *
+         * A custom node can gain a REQUIRED input at any time — this happened for real:
+         * `LoraLoaderVanilla` added `append_loraname_if_empty`, and every existing workflow
+         * using it started failing with `required_input_missing` even though nothing about
+         * the workflow had changed. The prompt is rejected before it runs, so the operator
+         * sees "生成失败" with no way to fix it from the console: the missing input is not a
+         * parameter anyone can edit, it simply is not in the JSON.
+         *
+         * Only MISSING keys are touched, and only with the node's own declared default. An
+         * input already present keeps its value — this fills gaps, it never overrides.
+         */
+        const filled = [];
+        for (const [nodeId, node] of Object.entries(prompt ?? {})) {
+            const spec = objectInfo?.[node.class_type];
+            if (spec === undefined) continue;
+            node.inputs = node.inputs ?? {};
+            for (const [name, decl] of Object.entries(spec.input?.required ?? {})) {
+                if (name in node.inputs) continue;
+                const meta = Array.isArray(decl) ? decl[1] : undefined;
+                const type = Array.isArray(decl) ? decl[0] : decl?.type;
+                // A link-shaped input (MODEL/CLIP/IMAGE...) cannot be defaulted — wiring it to
+                // a constant would produce a graph the instance rejects for a different reason.
+                if (typeof type === 'string' && /^[A-Z_]+$/.test(type) && !['STRING', 'INT', 'FLOAT', 'BOOLEAN'].includes(type)) continue;
+                if (meta === undefined || !('default' in meta)) continue;
+                node.inputs[name] = meta.default;
+                filled.push(`#${nodeId}.${name}`);
+            }
+        }
+        if (filled.length > 0) {
+            this.deps.log('info', `filled missing defaults: ${filled.join(', ')}`);
+        }
+        /**
+         * Rename stored input keys to the names the INSTANCE currently uses.
+         *
+         * A custom node can rename an input between versions. `TagsSelector` used to take
+         * `civitai_tags_list` and `Selector`; this build takes `tags_list` and `selector`. The
+         * stored workflow keeps the old spellings, so the prompt was rejected with
+         * `required_input_missing: tags_list` while the link sat right there under a name the
+         * instance no longer reads.
+         *
+         * Only when the match is unambiguous: the stored key is absent from the spec, and
+         * exactly ONE spec key equals it case-insensitively or differs only by a recognised
+         * prefix. Two candidates means "not the same input", and guessing would silently wire
+         * the wrong thing.
+         */
+        const renamed = [];
+        for (const [nodeId, node] of Object.entries(prompt ?? {})) {
+            const spec = objectInfo?.[node.class_type];
+            if (spec === undefined) continue;
+            const known = new Set([
+                ...Object.keys(spec.input?.required ?? {}),
+                ...Object.keys(spec.input?.optional ?? {}),
+            ]);
+            const lower = new Map([...known].map((name) => [name.toLowerCase(), name]));
+            for (const stored of Object.keys(node.inputs ?? {})) {
+                if (known.has(stored)) continue;
+                // `civitai_tags_list` → `tags_list`: strip a leading qualifier and retry.
+                const tail = stored.replace(/^[a-z0-9]+_/i, '');
+                const candidates = [
+                    lower.get(stored.toLowerCase()),
+                    known.has(tail) ? tail : undefined,
+                    lower.get(tail.toLowerCase()),
+                ].filter((name) => name !== undefined);
+                const unique = [...new Set(candidates)];
+                if (unique.length !== 1) continue;
+                const target = unique[0];
+                if (target in node.inputs) continue;
+                node.inputs[target] = node.inputs[stored];
+                delete node.inputs[stored];
+                renamed.push(`#${nodeId}.${stored}→${target}`);
+            }
+        }
+        if (renamed.length > 0) {
+            this.deps.log('info', `renamed inputs to match the instance: ${renamed.join(', ')}`);
+        }
+        /**
+         * Repair a model value the node will not accept.
+         *
+         * A custom node can name its choices anything it likes: `GroundingDinoModelLoader`
+         * wants `GroundingDINO_SwinB (938MB)` while the file on disk is
+         * `groundingdino_swinb_cogcoor.pth`. A graph saved with the disk name is rejected with
+         * `value_not_in_list` before anything runs, and nothing in the UI explained why — the
+         * dropdown simply showed a value that was not one of the choices.
+         *
+         * Silently substituting a DIFFERENT model would change what the picture looks like, so
+         * this only fires when the stored value maps onto exactly one declared choice by name
+         * (case-insensitive, ignoring spaces/punctuation/extension). Anything fuzzier is left
+         * alone: a wrong guess here is worse than a visible failure.
+         */
+        const repaired = [];
+        for (const [nodeId, node] of Object.entries(prompt ?? {})) {
+            for (const [input, value] of Object.entries(node.inputs ?? {})) {
+                if (typeof value !== 'string' || value === '') continue;
+                const declared = comboValuesOf(objectInfo, node.class_type, input);
+                if (declared.length === 0 || declared.includes(value)) continue;
+                /**
+                 * Normalise away the three things that differ between a disk filename and the
+                 * name a node shows: the parenthesised size, the extension, and punctuation.
+                 *
+                 * Order matters — the size is stripped FIRST. Running the extension strip
+                 * first matched the dot inside `(2.56GB)` and left a mangled tail that could
+                 * never equal a choice.
+                 */
+                const norm = (text) => String(text)
+                    .replace(/\([^)]*\)/g, ' ')
+                    .replace(/\.[a-z0-9]+(\s|$)/gi, ' ')
+                    .toLowerCase()
+                    .replace(/[^a-z0-9]/g, '');
+                const key = norm(value);
+                if (key === '') continue;
+                /**
+                 * Exact match first, then ONE-SIDED containment.
+                 *
+                 * `groundingdino_swinb_cogcoor.pth` normalises to `groundingdinoswinbcogcoor`,
+                 * while the node's choice is `groundingdinoswinb` — equal prefixes, not equal
+                 * strings, because the checkpoint's variant suffix (`cogcoor`) is not part of
+                 * the display name. Requiring exact equality meant this case was never fixed
+                 * and the workflow kept failing with `value_not_in_list`.
+                 *
+                 * Containment is only accepted when exactly ONE choice qualifies: two choices
+                 * sharing a prefix means the name does not identify the model, and guessing
+                 * would silently load the wrong one.
+                 */
+                const exact = declared.filter((choice) => norm(choice) === key);
+                const matches = exact.length > 0
+                    ? exact
+                    /**
+                     * Containment is ONE-DIRECTIONAL: the value may be a SUPERSET of a choice,
+                     * never a subset.
+                     *
+                     * The case this repairs is a checkpoint whose real name carries a suffix the
+                     * display name omits — `groundingdino_swinb_cogcoor` contains
+                     * `groundingdinoswinb`, so the value is longer and the choice is its prefix.
+                     * That direction is safe: the extra text identifies a variant, and the node
+                     * only knows the family name.
+                     *
+                     * The other direction is not. `v1` is contained in `v10`, and
+                     * `realesrganx4plus` is contained in `realesrganx4plusanime6b`. Allowing it
+                     * meant a stale filename silently became a DIFFERENT model — the anime
+                     * upscaler instead of the generic one, a v10 checkpoint instead of v1 — with
+                     * only a log line. A wrong guess here changes the picture, which is worse
+                     * than a visible failure that names the missing file.
+                     */
+                    : declared.filter((choice) => {
+                        const other = norm(choice);
+                        return other !== '' && key.includes(other) && other.length >= 4;
+                    });
+                if (matches.length !== 1) continue;
+                node.inputs[input] = matches[0];
+                repaired.push(`#${nodeId}.${input}: ${value} → ${matches[0]}`);
+            }
+        }
+        if (repaired.length > 0) {
+            this.deps.log('warn', `repaired model values the node does not accept: ${repaired.join(', ')}`);
+        }
+        /**
+         * Which SLOTS the console must never write per-run text into.
+         *
+         * Keyed by `nodeId::input`, not by node id. Roles are per-slot: on a multi-input node
+         * (`StringFunction|pysssss` has text_a / text_b / text_c) the wired and empty slots are
+         * always 不参与 while text_a is a real box. Keying this set by node id put node 15 into
+         * it permanently, so every request naming `15` was skipped and the operator's text_a
+         * content was silently discarded — the run succeeded, the picture came out, and the
+         * prompt was simply not in it. That is the worst shape a bug can take.
+         */
+        const ignoredSlots = new Set(
+            (recordTexts ?? [])
+                .filter((row) => row.role === 'ignored')
+                .map((row) => `${String(row.nodeId)}::${String(row.input)}`),
+        );
+        /**
+         * A whole node is off limits only when EVERY one of its slots is 不参与.
+         *
+         * Without this, a request that names a node but no input (the legacy shape) would slip
+         * past the slot check on a node the operator fully parked.
+         */
+        const slotsPerNode = new Map();
+        for (const row of recordTexts ?? []) {
+            const id = String(row.nodeId);
+            const entry = slotsPerNode.get(id) ?? { total: 0, ignored: 0 };
+            entry.total += 1;
+            if (row.role === 'ignored') entry.ignored += 1;
+            slotsPerNode.set(id, entry);
+        }
+        const fullyIgnored = (nodeId) => {
+            const entry = slotsPerNode.get(nodeId);
+            return entry !== undefined && entry.total > 0 && entry.ignored === entry.total;
+        };
+        /** The single positive / negative node a role-wide write should land on, or null. */
+        const headOf = (role) => {
+            /**
+             * A LEGACY per-role head still wins when it names a node that has a box.
+             *
+             * Workflows saved before per-node heads existed carry `headNodes: {positive: '9'}`
+             * — "the 正向 box lives on node 9". Ignoring it once the workbench switched to per-node
+             * heads would silently move every layered/overridden write to the FIRST positive,
+             * which on a two-encoder graph is a different node and a different picture. New
+             * records never write this field, so it can only ever be a leftover to honour.
+             */
+            const legacy = String(resolved.record?.headNodes?.[role] ?? '');
+            if (legacy !== '') {
+                const match = boxes.find((row) => row.role === role && String(row.nodeId) === legacy);
+                if (match !== undefined) return { nodeId: match.nodeId, input: match.input };
+            }
+            const box = boxes.find((row) => row.role === role);
+            return box === undefined ? null : { nodeId: box.nodeId, input: box.input };
+        };
+
+        // Main parameters, applied by node+input so a workflow with two samplers only
+        // changes the one the person was looking at.
+        for (const edit of Array.isArray(body.params) ? body.params : []) {
+            const node = prompt[String(edit?.nodeId ?? '')];
+            if (node === undefined || typeof node.inputs !== 'object') continue;
+            const key = String(edit?.input ?? '');
+            if (key === '' || !(key in node.inputs)) continue;
+            /**
+             * Type follows the DECLARATION first, then the current value.
+             *
+             * A switch input in these custom nodes stores the STRING "true" — ComfyUI accepts
+             * `true` for a BOOLEAN input but the graph was saved with the string form, and
+             * testing only `typeof node.inputs[key] === 'boolean'` therefore never fired. The
+             * submitted prompt then carried `"true"` instead of `true`, which is the reported
+             * 「开关参数提交时仍然按照字符串提交」.
+             *
+             * `booleanKeys` is the authority (from object_info, persisted on the record); the
+             * typeof check stays as the second signal for graphs saved before that existed.
+             */
+            const isBoolean = typeof node.inputs[key] === 'boolean'
+                || (declaredBooleans !== null && declaredBooleans.has(`${String(edit?.nodeId ?? '')}::${key}`));
+            if (isBoolean) {
+                node.inputs[key] = normalizeSwitchValue(edit.value);
+                continue;
+            }
+            const value = edit.value;
+            if (typeof value !== 'number' && typeof value !== 'string') continue;
+            node.inputs[key] = value;
+        }
+
+        /**
+         * Per-run prompt text: APPENDED to the encoder, never substituted.
+         *
+         * The contract the operator settled on: the JSON body holds the standing head, and
+         * everything typed at task time goes after it. So `append: true` joins with the
+         * plugin's own comma rule instead of replacing — which also means an empty box is a
+         * no-op rather than a way to blank the head.
+         *
+         * `append: false` (or absent) keeps the older replace semantics for callers that
+         * really do mean "set this encoder to exactly this": scripts, the chain runner, and
+         * the assistant's "覆盖" mode.
+         */
+        const texts = Array.isArray(body.texts) ? body.texts : [];
+        for (const entry of texts) {
+            const nodeId = String(entry.nodeId ?? '');
+            if (!(nodeId in prompt)) continue;
+            /**
+             * Skip a write only when THIS SLOT is 不参与.
+             *
+             * A request that names an input is judged on `nodeId::input`; one that names only a
+             * node (legacy) is judged on whether the whole node was parked. Blanket node-level
+             * skipping silently dropped text_a on any node whose other inputs were wired or
+             * empty — see the note on `ignoredSlots`.
+             */
+            const slotKey = typeof entry.input === 'string' && entry.input !== ''
+                ? `${nodeId}::${entry.input}`
+                : '';
+            if (slotKey !== '' ? ignoredSlots.has(slotKey) : fullyIgnored(nodeId)) continue;
+            if (typeof entry.value !== 'string') continue;
+            if (entry.append === true) {
+                const current = String(prompt[nodeId]?.inputs?.[String(entry.input ?? '')] ?? '');
+                const extra = entry.value.trim();
+                if (extra === '') continue;
+                // Find the text key the entry means; fall back to the first string input,
+                // which is what setText would have written anyway.
+                const key = typeof entry.input === 'string' && entry.input in (prompt[nodeId].inputs ?? {})
+                    ? entry.input
+                    : Object.keys(prompt[nodeId]?.inputs ?? {}).find((name) => typeof prompt[nodeId].inputs[name] === 'string');
+                if (key === undefined) continue;
+                const base = String(prompt[nodeId].inputs[key] ?? '');
+                prompt[nodeId].inputs[key] = joinPrompt(base, extra);
+                continue;
+            }
+            setText(prompt, nodeId, entry.value, typeof entry.input === 'string' ? entry.input : '');
+        }
+        /**
+         * Layered positive prompt: one box per declared layer, joined in array order by
+         * the server so the console never has to know the separator or the skipping rules.
+         *
+         * `layers` here is the *content* ([{value}, …]), while the names come from the
+         * workflow's stored definition — the request must not be able to rename layers,
+         * only fill them. Filling the positive head encoder is the single place layered
+         * input lands.
+         *
+         * "The positive head encoder" is the first positive BOX — the same list the console
+         * renders — not "the first positive row in the JSON". On a graph with two positive
+         * encoders those are different nodes, and on a graph where the first positive was
+         * marked 不参与 the old rule wrote into a node the operator had removed from the form.
+         */
+        /**
+         * Layered prompt, PER NODE.
+         *
+         * Every text node can carry its own layer list (面部 / 躯干 for the positive,
+         * 排除项 / 画质 for the negative), and each node's layers are joined in array order by
+         * the server so the console never has to know the separator or the skipping rules.
+         *
+         * Two request shapes are accepted:
+         *
+         *   - `layered: [{nodeId, value}, …]` — the console's current form: the node says
+         *     where the text goes, so a negative encoder can be layered independently.
+         *   - `layers: [{value}, …]` — the legacy form, which meant "the positive encoder".
+         *     Kept so the chain runner and older consoles keep working; it lands on the first
+         *     positive BOX (not the first positive ROW — they differ once a node is 不参与).
+         *
+         * The level count is NOT taken from the request: a node is only written when the
+         * workflow declares layers for it, so a stale console cannot invent a split.
+         */
+        const layered = Array.isArray(body.layered) ? body.layered : [];
+        if (layered.length > 0) {
+            for (const entry of layered) {
+                const nodeId = String(entry?.nodeId ?? '');
+                if (!(nodeId in prompt)) continue;
+                // Layered writes pick the node's box below, so the guard is "the whole node is
+                // parked" — a node with one live slot still has text to receive.
+                if (fullyIgnored(nodeId)) continue;
+                const values = Array.isArray(entry?.values)
+                    ? entry.values.map((row) => (row && typeof row === 'object' ? row.value : row))
+                    : [];
+                const assembled = joinLayers(values);
+                if (assembled === '') continue;
+                const box = boxes.find((row) => row.nodeId === nodeId);
+                if (box === undefined) continue;
+                prompt[nodeId].inputs[box.input] = assembled;
+            }
+        }
+        if (Array.isArray(body.layers) && body.layers.length > 0) {
+            const assembled = joinLayers(body.layers.map((row) => (row && typeof row === 'object' ? row.value : row)));
+            if (assembled !== '') {
+                const head = headOf('positive');
+                if (head !== null) prompt[head.nodeId].inputs[head.input] = assembled;
+            }
+        }
+        if (body.prompt !== undefined && String(body.prompt) !== '') {
+            // Convenience: the console's single text box fills the positive head encoder
+            // when the user did not address a node explicitly.
+            const head = headOf('positive');
+            if (head !== null && texts.length === 0) prompt[head.nodeId].inputs[head.input] = String(body.prompt);
+        }
+        /**
+         * Heads are the graph's own prompt text.
+         *
+         * They used to be a separate stored prefix, joined in front of the encoder value at
+         * submit time. That made two copies of the same thing: the JSON said one prompt, the
+         * `heads` block said another, and the picture used a third (head + body). Nobody
+         * could tell which one to edit, and a workbench edit to the JSON left the prefix
+         * behind. Now the text box IS the encoder value: what the person types is what runs.
+         *
+         * A request may still name `heads` explicitly — that is the console's per-run
+         * override — and it replaces the whole positive/negative text rather than prefixing
+         * it. Nothing is ever joined.
+         */
+        if (body?.heads !== undefined && body?.heads !== null && body.applyHeads !== false) {
+            const override = {
+                positive: typeof body.heads.positive === 'string' ? body.heads.positive : undefined,
+                negative: typeof body.heads.negative === 'string' ? body.heads.negative : undefined,
+            };
+            /**
+             * One node per role — the FIRST box of that role, i.e. the same node the console
+             * would have shown first. Writing every positive encoder would be wrong precisely
+             * when it matters: a second positive encoder carries its own standing text (a
+             * refiner prompt, a style prefix), and overwriting it with the console's text is a
+             * silent edit of something the person never saw.
+             *
+             * A node marked 不参与 has no box, so it is not a candidate at all — `headOf`
+             * reads the box list, not the raw text rows.
+             */
+            for (const role of ['positive', 'negative']) {
+                const wanted = role === 'negative' ? override.negative : override.positive;
+                const target = headOf(role);
+                if (wanted === undefined || target === null) continue;
+                prompt[target.nodeId].inputs[target.input] = wanted;
+            }
+        }
+        if (tier !== 'nsfw') {
+            const hit = scanStrings(prompt);
+            if (hit.hit === true) {
+                throw new Error(`当前账号是全年龄等级，提示词里的「${hit.matched}」属于成人内容，已阻止提交`);
+            }
+        }
+
+        const images = Array.isArray(body.images) ? body.images : [];
+        for (const entry of images) {
+            const nodeId = String(entry.nodeId ?? '');
+            const filename = String(entry.filename ?? '');
+            const inputName = String(entry.input ?? '');
+            if (filename === '') continue;
+            if (nodeId === '') {
+                /**
+                 * No node named: fill EVERY image input the graph has.
+                 *
+                 * This is the chain case. A chained step cannot know which node holds the
+                 * image — that depends on the workflow the operator dragged in — and the
+                 * caller is saying "use this image wherever this graph takes one". Silently
+                 * skipping it (the old behaviour for an empty id) made a chain look like it
+                 * ran while every step was actually text-only.
+                 */
+                for (const target of imageTargetsOf(prompt)) setImage(prompt, target.nodeId, filename, target.input);
+                continue;
+            }
+            if (!(nodeId in prompt)) continue;
+            /**
+             * A named `input` wins over the node: one node can hold several image inputs
+             * (a LoadImage plus a mask loader on the same node type, or an inpaint graph with
+             * two), and writing by node id alone would put the chosen photo into every image
+             * slot on it. The console always sends the input name now; a chain or an older
+             * client that does not still falls back to "every image input of that node".
+             */
+            setImage(prompt, nodeId, filename, inputName);
+        }
+        // The sampler reads the negative encoder through its `negative` link, so a
+        // person editing the *text* of that encoder is enough — nothing else to do.
+
+        /**
+         * Stamp the output filename with the content class.
+         *
+         * Every SaveImage gets a prefix of `sfw_` or `nsfw_`, decided once per run:
+         *
+         *   - an adult workflow produces `nsfw_…`;
+         *   - a run that consumed an `nsfw_` image produces `nsfw_…` even from a safe
+         *     workflow, because image-to-image of adult material is still adult material —
+         *     a laundered filename would be the whole filter defeated by one round trip;
+         *   - everything else produces `sfw_…`.
+         *
+         * The prefix replaces whatever the workflow declared rather than being prepended to
+         * it: two prefixes make the class ambiguous, which defeats the purpose.
+         */
+        const adultWorkflow = record !== undefined && classifyWorkflow(record).tier === 'nsfw';
+        const adultInput = (Array.isArray(body.images) ? body.images : []).some(
+            (entry) => /^nsfw/i.test(String(entry?.filename ?? '')),
+        );
+        const outputPrefix = adultWorkflow || adultInput ? 'nsfw' : 'sfw';
+        for (const [nodeId, node] of Object.entries(prompt)) {
+            if (!/SaveImage$/i.test(String(node?.class_type ?? ''))) continue;
+            const original = String(node.inputs?.filename_prefix ?? '');
+            // Keep the workflow's own naming after the class, so files stay recognisable:
+            // nsfw_单张文生图_人物 → the operator still knows what made it.
+            const stem = original.replace(/^(sfw|nsfw)[_-]*/i, '').replace(/[\\/:*?"<>|]/g, '_').slice(0, 40);
+            node.inputs = { ...node.inputs, filename_prefix: stem === '' ? outputPrefix : `${outputPrefix}_${stem}` };
+            void nodeId;
+        }
+
+        /**
+         * How many runs to queue from this click, 1–8.
+         *
+         * The pool would happily take 50, and that is exactly why the cap is small: these
+         * land on one or two consumer GPUs, and a typo that queues fifty SDXL runs is a
+         * half-day queue nobody can cancel one by one. Eight is "give me a few options",
+         * which is what the feature is for; more is a batch job and belongs in a script.
+         *
+         * Each run is enqueued as its own task, so the pool schedules them independently —
+         * no special multi-run state, and cancel/priority keep working per run.
+         */
+        const repeat = Math.min(8, Math.max(1, Math.floor(Number(body.repeat ?? 1)) || 1));
+        /**
+         * Seeds are resolved per run, inside the loop.
+         *
+         * Drawing one seed outside the loop and copying it would give `repeat` identical
+         * pictures — the batch feature exists precisely to get different ones. A fixed seed
+         * is the opposite intent, so it is read once and applied to every run of this click.
+         *
+         * Two sources, in order of authority:
+         *
+         *   1. `body.seed` — the console's request-level mode (random / fixed + value).
+         *   2. a seed PARAMETER declared on the workflow, whose own `seedMode` says whether
+         *      that row is random or fixed. This is what makes the workbench's seed row work
+         *      without the console having to know anything about it.
+         *
+         * The graph is probed here rather than earlier because a workflow without any seed
+         * input must not fail and must not grow one: applySeed writes only the inputs that
+         * already exist.
+         */
+        const seedParam = (resolved.record?.paramPicks ?? []).find((pick) => normalizeParamKind(pick, pick.input) === 'seed');
+        const seedSeed = body.seed !== undefined && body.seed !== null
+            ? body.seed
+            : (seedParam === undefined
+                ? undefined
+                : (seedParam.seedMode === 'fixed'
+                    ? { mode: 'fixed', value: seedParam.value }
+                    : { mode: 'random' }));
+        const wantsSeed = seedSeed !== undefined;
+        const graphHasSeed = hasSeed(prompt);
+        const extraData = {
+            workflowName: resolved.record.name,
+            workflowId: resolved.record.id,
+            remoteUser: session.user,
+            tier: classifyWorkflow(resolved.record).tier,
+        };
+        const replies = [];
+        const seeds = [];
+        for (let index = 0; index < repeat; index += 1) {
+            // A fresh deep copy per run: the pool mutates the prompt it owns
+            // (node errors, injected values), and sharing one object across runs
+            // would let run 2 see run 1's edits.
+            const runPrompt = JSON.parse(JSON.stringify(prompt));
+            let usedSeed = null;
+            if (wantsSeed && graphHasSeed) {
+                const resolvedSeed = seedForRun(seedSeed);
+                applySeed(runPrompt, resolvedSeed.seed);
+                usedSeed = resolvedSeed;
+                seeds.push(resolvedSeed.seed);
+            }
+            replies.push(
+                this.deps.pool.enqueue({
+                    prompt: runPrompt,
+                    client_id: `remote-${session.user}`,
+                    priority: Number(body.priority ?? 0),
+                    extra_data: { ...extraData, runIndex: index + 1, runOf: repeat },
+                    ...(typeof body.endpoint === 'string' && body.endpoint !== '' ? { endpoint: body.endpoint } : {}),
+                }),
+            );
+        }
+        const reply = replies[0];
+        // Durable record before returning: a browser that closes the tab mid-run
+        // must still find the run after logging back in.
+        //
+        // `seed` travels with the record because it is the one fact about a run that cannot
+        // be recovered afterwards: the picture is on disk, the workflow is unchanged, and the
+        // seed that made that particular image exists nowhere else once this line is gone.
+        // The asset library shows it per picture, which is what makes "reproduce that one"
+        // possible without digging through the console log.
+        for (const [index, entry] of replies.entries()) {
+            await this.deps.runs.submit(session.user, {
+                promptId: entry.prompt_id,
+                name: resolved.record.name,
+                workflowId: resolved.record.id,
+                endpointId: null,
+                state: 'queued',
+                files: [],
+                ...(seeds[index] === undefined ? {} : { seed: seeds[index] }),
+            });
+        }
+        return {
+            ok: true,
+            ...reply,
+            promptIds: replies.map((entry) => entry.prompt_id),
+            repeat,
+            /** Which seed each run actually got, in submission order. */
+            seeds,
+            seedMode: seeds.length === 0 ? null : (seedSeed?.mode === 'fixed' ? 'fixed' : 'random'),
+            workflow: { id: resolved.record.id, name: resolved.record.name },
+            warnings: resolved.warnings,
+        };
+    }
+
+    /** Multipart is not worth a dependency: one file per request, raw body. */
+    async handleUpload(request, response, session) {
+        const filename = String(request.headers['x-filename'] ?? 'upload.png');
+        /**
+         * Sanitise for FILESYSTEM danger only, not for being non-ASCII.
+         *
+         * The old rule `[^\w.\-] → _` turned `测试图片.png` into `____.png`: every Chinese
+         * character became an underscore, so two different photos could collide on the same
+         * name and the console would submit a filename the person never had. ComfyUI itself
+         * stores Chinese and spaced filenames verbatim (verified on this instance), so the
+         * only things that must go are path separators and characters Windows forbids.
+         */
+        const safe = filename
+            .replace(/[\\/:*?"<>|\u0000-\u001f]/g, '_')
+            .replace(/^\.+/, '')
+            .trim()
+            .slice(-80) || 'upload.png';
+        void session;
+        const chunks = [];
+        let total = 0;
+        for await (const chunk of request) {
+            total += chunk.length;
+            if (total > MAX_UPLOAD_BYTES) {
+                return sendJson(response, 413, { ok: false, error: `文件超过 ${Math.round(MAX_UPLOAD_BYTES / 1048576)} MB` });
+            }
+            chunks.push(chunk);
+        }
+        if (chunks.length === 0) return sendJson(response, 400, { ok: false, error: '空文件' });
+        /**
+         * Screen the image before it reaches the instance.
+         *
+         * The rule is one rule: an SFW account may not upload adult images. It is checked
+         * here, at the boundary, so a blocked file never lands in ComfyUI's input directory
+         * where a later run could pick it up by name.
+         *
+         * NSFW accounts skip the call entirely rather than screening and ignoring the answer:
+         * spending a model call to discard its result would slow every upload for nothing.
+         */
+        const tier = this.tierOf(session);
+        const body = Buffer.concat(chunks);
+        if (tier !== 'nsfw') {
+            const mime = String(request.headers['content-type'] ?? 'image/png').split(';')[0].trim() || 'image/png';
+            const verdict = await screenImage(this.deps.llm, this.deps.llmRoute, body, mime);
+            if (verdict.nsfw) {
+                this.deps.log('warn', `upload blocked as adult for ${String(session?.user ?? '')}: ${verdict.reason}`);
+                return sendJson(response, 403, {
+                    ok: false,
+                    error: `这张图片被判为成人内容，当前账号不能上传：${verdict.reason}`,
+                    screened: true,
+                });
+            }
+        }
+        const primary = await this.deps.gateway.primary();
+        if (primary === undefined) return sendJson(response, 503, { ok: false, error: '没有可用的 ComfyUI 实例' });
+        let uploaded;
+        try {
+            uploaded = await uploadBytesToInput(primary.instance, safe, body);
+        } catch (error) {
+            return sendJson(response, 502, { ok: false, error: `实例上传失败: ${errorMessage(error).slice(0, 400)}` });
+        }
+        return sendJson(response, 200, { ok: true, ...uploaded, instanceId: primary.id });
+    }
+
+    // --- bridge ----------------------------------------------------------
+    leaseOf(pathname) {
+        const match = /^\/bridge\/([^/]+)(\/.*)?$/.exec(pathname);
+        if (match === null) return undefined;
+        return { token: match[1], rest: match[2] ?? '/' };
+    }
+
+    handleBridgeHttp(pathname, url, request, response) {
+        const parsed = this.leaseOf(pathname);
+        if (parsed === undefined) return sendJson(response, 404, { error: 'bad bridge path' });
+        const lease = this.bridges.get(parsed.token);
+        if (lease === undefined) return sendJson(response, 404, { error: '桥接已结束，请重新打开' });
+        lease.lastSeen = Date.now();
+        const runtime = this.deps.instances.get(lease.instanceId);
+        if (runtime === undefined) return sendJson(response, 404, { error: '实例已解绑' });
+        const base = new URL(runtime.instance.baseUrl);
+        const targetPath = parsed.rest + url.search;
+        const headers = { ...request.headers };
+        delete headers.host;
+        delete headers.cookie;
+        /**
+         * Strip the cross-origin markers the browser adds, because the bridge is a proxy.
+         *
+         * Measured on this machine: the same asset URL answers 200 with no Origin header and
+         * **403 with one** — ComfyUI's CSRF guard treats any Origin as foreign. Every ES
+         * module fetch and XHR from a bridged page carries one, so three bundles came back
+         * 403 and the SPA could not boot.
+         *
+         * The bridge has already authenticated the caller (session cookie, checked before
+         * this handler runs), so dropping Origin grants the upstream nothing it should not
+         * have: the console is the client now, not a foreign page.
+         */
+        delete headers.origin;
+        delete headers.referer;
+        delete headers['sec-fetch-site'];
+        delete headers['sec-fetch-mode'];
+        delete headers['sec-fetch-dest'];
+        delete headers['sec-fetch-user'];
+        const upstream = httpRequest(
+            { hostname: base.hostname, port: base.port, path: targetPath, method: request.method, headers },
+            (reply) => {
+                const outHeaders = { ...reply.headers };
+                delete outHeaders['set-cookie'];
+                const contentType = String(reply.headers['content-type'] ?? '');
+                /**
+                 * JavaScript gets its module specifiers rewritten too.
+                 *
+                 * `import('/assets/late.js')` is evaluated by the browser's module loader,
+                 * not by fetch, so no runtime shim can intercept it: a 404 there leaves the
+                 * SPA half-booted. The only place to fix it is the bytes.
+                 *
+                 * The rewrite is deliberately narrow — a quoted root-absolute path that
+                 * looks like a file, is not already prefixed, and is not a protocol-relative
+                 * "//host". Anything wider starts corrupting string literals that merely
+                 * contain a slash.
+                 */
+                if (/javascript|ecmascript/i.test(contentType)) {
+                    const chunks = [];
+                    reply.on('data', (chunk) => chunks.push(chunk));
+                    reply.on('end', () => {
+                        const source = Buffer.concat(chunks).toString('utf8');
+                        const body = Buffer.from(rewriteModuleSpecifiers(source, `/bridge/${parsed.token}/`), 'utf8');
+                        delete outHeaders['transfer-encoding'];
+                        delete outHeaders['content-encoding'];
+                        outHeaders['content-length'] = String(body.length);
+                        response.writeHead(reply.statusCode ?? 200, outHeaders);
+                        response.end(body);
+                    });
+                    reply.on('error', () => response.end());
+                    return;
+                }
+                /**
+                 * JSON too, for the same reason as JavaScript.
+                 *
+                 * The web app manifest names its icons with ROOT-ABSOLUTE paths
+                 * ("/assets/images/comfy-icon-192.png"). The browser resolves those against
+                 * the origin, so it asked the console for the icon and got a 404 — visible
+                 * in the report as "comfy-icon-192.png Not Found". No runtime shim can fix
+                 * this: the manifest is parsed by the browser, not by page JavaScript.
+                 *
+                 * Rewritten values are only strings that begin with a single "/", so numbers,
+                 * booleans and ordinary text are untouched.
+                 */
+                if (/application\/json|\+json/i.test(contentType)) {
+                    const chunks = [];
+                    reply.on('data', (chunk) => chunks.push(chunk));
+                    reply.on('end', () => {
+                        const source = Buffer.concat(chunks).toString('utf8');
+                        const body = Buffer.from(rewriteJsonPaths(source, `/bridge/${parsed.token}/`), 'utf8');
+                        delete outHeaders['transfer-encoding'];
+                        delete outHeaders['content-encoding'];
+                        outHeaders['content-length'] = String(body.length);
+                        response.writeHead(reply.statusCode ?? 200, outHeaders);
+                        response.end(body);
+                    });
+                    reply.on('error', () => response.end());
+                    return;
+                }
+                if (contentType.includes('text/html')) {
+                    // The canvas is a full SPA: it fetches and opens sockets by path.
+                    // A <base> alone is not enough for root-absolute URLs, so the page
+                    // also gets a shim that re-prefixes fetch/WebSocket/EventSource.
+                    const chunks = [];
+                    reply.on('data', (chunk) => chunks.push(chunk));
+                    reply.on('end', () => {
+                        const html = Buffer.concat(chunks).toString('utf8');
+                        const patched = injectBridgeShim(html, `/bridge/${parsed.token}/`);
+                        const body = Buffer.from(patched, 'utf8');
+                        // Node re-frames the body: the upstream may have used chunked
+                        // encoding, and keeping that header while also claiming a length
+                        // hands the browser framing bytes instead of HTML.
+                        delete outHeaders['transfer-encoding'];
+                        delete outHeaders['content-encoding'];
+                        outHeaders['content-length'] = String(body.length);
+                        response.writeHead(reply.statusCode ?? 200, outHeaders);
+                        response.end(body);
+                    });
+                    reply.on('error', () => response.end());
+                    return;
+                }
+                response.writeHead(reply.statusCode ?? 502, outHeaders);
+                // Same class of bug as the media proxies: an http IncomingMessage has
+                // no 'error' listener here, so an upstream reset mid-body (the canvas
+                // WS dying as the tab closes) would surface as an uncaughtException.
+                pipeGuarded(reply, response);
+            },
+        );
+        upstream.on('error', (error) => {
+            if (!response.headersSent) sendJson(response, 502, { error: errorMessage(error) });
+            else response.end();
+        });
+        // The request body is the caller's own upload stream. When the browser
+        // cancels a large upload mid-flight, an unguarded pipe here raises on the
+        // request object — and that has no error handler above it either.
+        request.on('error', () => upstream.destroy());
+        request.pipe(upstream);
+    }
+
+    handleUpgrade(request, socket, head) {
+        const pathname = (request.url ?? '/').split('?')[0];
+        const parsed = this.leaseOf(pathname);
+        if (parsed === undefined) {
+            socket.destroy();
+            return;
+        }
+        const lease = this.bridges.get(parsed.token);
+        if (lease === undefined) {
+            socket.destroy();
+            return;
+        }
+        lease.lastSeen = Date.now();
+        const runtime = this.deps.instances.get(lease.instanceId);
+        if (runtime === undefined) {
+            socket.destroy();
+            return;
+        }
+        const base = new URL(runtime.instance.baseUrl);
+        // WebSocket needs the raw framing preserved, so this is a byte tunnel with
+        // the request line rewritten, not a message-level proxy.
+        const upstream = connect(Number(base.port), base.hostname, () => {
+            const headerLines = [`GET ${parsed.rest} HTTP/1.1`];
+            for (const [name, value] of Object.entries(request.headers)) {
+                const lower = name.toLowerCase();
+                if (lower === 'host') continue;
+                /**
+                 * The WebSocket handshake must look same-origin to the instance.
+                 *
+                 * ComfyUI answers 101 only when Origin matches its own host:port; anything
+                 * else is 403 and the socket never opens. The bridged page's Origin is the
+                 * CONSOLE, so the canvas could never connect — which is exactly what a
+                 * broken bridge looks like from the browser: a shell that loads and then
+                 * does nothing.
+                 *
+                 * Dropping it is safe: the caller's session cookie was already verified
+                 * before this handler ran, so the tunnel is authorised at this layer.
+                 */
+                if (lower === 'origin' || lower === 'referer') continue;
+                if (Array.isArray(value)) for (const item of value) headerLines.push(`${name}: ${item}`);
+                else headerLines.push(`${name}: ${value}`);
+            }
+            headerLines.push(`host: ${base.host}`);
+            upstream.write(`${headerLines.join('\r\n')}\r\n\r\n`);
+            if (head !== undefined && head.length > 0) upstream.write(head);
+            upstream.pipe(socket);
+            socket.pipe(upstream);
+        });
+        const close = () => {
+            upstream.destroy();
+            socket.destroy();
+        };
+        upstream.on('error', close);
+        socket.on('error', close);
+        socket.on('close', close);
+    }
+
+    sendPage(response, which, request) {
+        const html = which === 'admin' ? ADMIN_HTML : which === 'login' ? LOGIN_HTML : CONSOLE_HTML;
+        const layout = layoutFor(request?.headers?.['user-agent']);
+        response.writeHead(200, {
+            'content-type': 'text/html; charset=utf-8',
+            'cache-control': 'no-store',
+            'referrer-policy': 'same-origin',
+            'x-content-type-options': 'nosniff',
+            vary: 'User-Agent',
+        });
+        response.end(withLayout(html, layout));
+    }
+}
+
+// --- pages ---------------------------------------------------------------
+//
+// Both pages are single files with no build step and no external asset: the
+// only machine guaranteed to reach them is a phone on the same LAN.
+
+/**
+ * Rewrite a proxied ComfyUI page so its root-absolute requests come back here.
+ *
+ * The frontend loads `./assets/...` (fine with <base>), but also calls
+ * `/api/...`, `/view`, `/ws`, `/object_info` and writes `<img src="/view?...">`.
+ * A prefix on those must be applied in the page, because the browser resolves
+ * them against this origin — which is the console, not the instance.
+ */
+/**
+ * The handful of inputs worth showing as controls: sampler steps/cfg/sampler/
+ * seed/denoise, and the latent size/batch. Everything else belongs in the canvas.
+ */
+const PARAM_KEYS = ['steps', 'cfg', 'sampler_name', 'scheduler', 'seed', 'denoise', 'width', 'height', 'batch_size'];
+
+/**
+ * The model folders an instance can expose, shared with the parameter editor.
+ *
+ * A model parameter names one of these folders and the console lists that folder's
+ * files. Keeping the list in one place is what stops the editor from offering a folder
+ * the model inventory never reads.
+ */
+/**
+ * The model folders a workflow can reference, as `[id, label]` pairs.
+ *
+ * The LABEL is the folder's own name now, not a Chinese translation. "底模" tells you nothing
+ * when ComfyUI's own UI says `checkpoints` and the file on disk sits in `models/checkpoints` —
+ * the operator's whole job here is matching what the instance actually reports, so the label
+ * and the id are the same string.
+ *
+ * This list used to be 13 hardcoded entries, which is the other half of the "文件夹不全"
+ * report: the instance exposes 39 folders (per /models), and anything outside the hardcoded
+ * 13 could never be chosen — nor was it read by the inventory. `discoverModelFolders()` asks
+ * the instance instead, and this constant is only the fallback for when it cannot.
+ */
+const MODEL_FOLDERS = [
+    ['checkpoints', 'checkpoints'],
+    ['loras', 'loras'],
+    ['vae', 'vae'],
+    ['upscale_models', 'upscale_models'],
+    ['clip', 'clip'],
+    ['text_encoders', 'text_encoders'],
+    ['clip_vision', 'clip_vision'],
+    ['controlnet', 'controlnet'],
+    ['embeddings', 'embeddings'],
+    ['unet', 'unet'],
+    ['diffusion_models', 'diffusion_models'],
+    ['animatediff_models', 'animatediff_models'],
+    ['ipadapter', 'ipadapter'],
+    ['style_models', 'style_models'],
+    ['gligen', 'gligen'],
+    ['photomaker', 'photomaker'],
+    ['hypernetworks', 'hypernetworks'],
+    ['latent_upscale_models', 'latent_upscale_models'],
+    ['model_patches', 'model_patches'],
+    ['audio_encoders', 'audio_encoders'],
+    ['background_removal', 'background_removal'],
+    ['frame_interpolation', 'frame_interpolation'],
+    ['geometry_estimation', 'geometry_estimation'],
+    ['optical_flow', 'optical_flow'],
+    ['detection', 'detection'],
+    ['sams', 'sams'],
+    ['ultralytics', 'ultralytics'],
+    ['ultralytics_bbox', 'ultralytics_bbox'],
+    ['ultralytics_segm', 'ultralytics_segm'],
+    ['facerestore_models', 'facerestore_models'],
+    ['rmbg', 'rmbg'],
+    ['unet_gguf', 'unet_gguf'],
+    ['clip_gguf', 'clip_gguf'],
+    ['diffusers', 'diffusers'],
+    ['vae_approx', 'vae_approx'],
+    ['LLM', 'LLM'],
+];
+
+export { MODEL_FOLDERS };
+
+/**
+ * Parameters a person can turn for one workflow.
+ *
+ * Two sources, merged: the well-known sampler/latent keys (derived from the graph, so they
+ * always exist), plus whatever the operator pinned by hand. The pinning exists because
+ * `PARAM_KEYS` is a fixed list and real graphs carry knobs outside it — a ControlNet
+ * strength, a LoRA weight, a `batch_size` on a node whose name is not ours. Without pins,
+ * "add a key parameter" was impossible: the list was whatever the code knew about.
+ *
+ * A pinned entry is `{nodeId, input}`; the value still comes from the graph, so a pin
+ * cannot invent a value the graph does not carry.
+ */
+/**
+ * The parameters a workflow exposes, merged from the graph and the operator's declarations.
+ *
+ * `hidden` is the third input and it is load-bearing: a row the operator deleted in the
+ * workbench must not come back in the console. It used to, because this function only ever
+ * looked at the graph and the pins — the delete wrote `paramHidden` on the workflow and
+ * nothing read it, so "在编辑工作流删除的关键参数，在控制台页面还会出现". A pin for the
+ * same key wins over the hidden entry, which is how "put it back" still works.
+ */
+/**
+ * Push bytes into an instance's `input/` folder and report the name a node should use.
+ *
+ * One implementation for both entry points — a browser upload and "use this asset as an
+ * input" — because they must agree on two things that were each wrong once:
+ *
+ *   - the name the INSTANCE assigns is authoritative (ComfyUI keeps Chinese filenames
+ *     verbatim); returning our own guess points at a file that was never created;
+ *   - the folder must travel with it. `/upload/image` answers `{name, subfolder}`, and
+ *     `LoadImage` expects `subfolder/name`; dropping the folder makes an existing file read
+ *     as "Invalid image file".
+ *
+ * Resolves to `{filename, name, subfolder}` where `filename` is what a node input takes.
+ */
+function uploadBytesToInput(instance, filename, bytes) {
+    const base = String(instance?.baseUrl ?? '').replace(/\/+$/, '');
+    if (base === '') return Promise.reject(new Error('实例地址为空'));
+    const boundary = `----cgw${randomBytes(6).toString('hex')}`;
+    const head = Buffer.from(
+        `--${boundary}\r\nContent-Disposition: form-data; name="image"; filename="${filename}"\r\n`
+        + 'Content-Type: application/octet-stream\r\n\r\n',
+        'utf8',
+    );
+    const tail = Buffer.from(`\r\n--${boundary}--\r\n`, 'utf8');
+    const payload = Buffer.concat([head, bytes, tail]);
+    const target = new URL(`${base}/upload/image`);
+    return new Promise((resolve, reject) => {
+        const upstream = httpRequest(
+            {
+                hostname: target.hostname,
+                port: target.port,
+                path: `${target.pathname}?type=input&overwrite=true`,
+                method: 'POST',
+                headers: { 'content-type': `multipart/form-data; boundary=${boundary}`, 'content-length': payload.length },
+            },
+            (reply) => {
+                const parts = [];
+                reply.on('data', (chunk) => parts.push(chunk));
+                reply.on('end', () => {
+                    const body = Buffer.concat(parts).toString('utf8');
+                    if ((reply.statusCode ?? 0) >= 400) {
+                        reject(new Error(`HTTP ${reply.statusCode} ${body.slice(0, 400)}`));
+                        return;
+                    }
+                    try {
+                        const parsed = JSON.parse(body);
+                        const name = typeof parsed.name === 'string' && parsed.name !== '' ? parsed.name : filename;
+                        const subfolder = typeof parsed.subfolder === 'string' ? parsed.subfolder.trim() : '';
+                        resolve({ filename: subfolder === '' ? name : `${subfolder}/${name}`, name, subfolder });
+                    } catch {
+                        resolve({ filename, name: filename, subfolder: '' });
+                    }
+                });
+            },
+        );
+        upstream.on('error', reject);
+        upstream.end(payload);
+    });
+}
+
+/**
+ * Extensions that hold model WEIGHTS.
+ *
+ * A folder like `grounding-dino/` contains `GroundingDINO_SwinB.cfg.py` next to the `.pth`, and
+ * `bert-base-uncased/` is all `config.json` + `vocab.txt`. Those are code and configuration;
+ * listing them as models invites someone to pick one and fail at load time.
+ *
+ * A whitelist rather than a blacklist: a new auxiliary file type appearing in a model folder is
+ * far more likely than a new weight format nobody has told this list about.
+ */
+const MODEL_FILE_EXT = /\.(safetensors|ckpt|pt|pth|bin|gguf|ggml|onnx|sft|pkl)$/i;
+
+/**
+ * The concrete choices a node declares for one input, or [] when it declares none.
+ *
+ * ComfyUI has shipped two shapes for a dropdown:
+ *
+ *   old: ["a.png", "b.png"]                                   // the list IS the declaration
+ *   new: ["COMBO", { "options": ["a.png", "b.png"] }]         // wrapped one level deeper
+ *
+ * Both must be understood: reading only the old shape silently returns [] on a current build,
+ * and then the caller falls back to a disk listing that may use entirely different names —
+ * which is how `groundingdino_swinb_cogcoor.pth` got submitted to a node that only accepts
+ * `GroundingDINO_SwinB (938MB)`.
+ *
+ * A declaration that is a bare type ("IMAGE", "STRING") has no choices and returns [].
+ */
+function comboValuesOf(objectInfo, classType, inputName) {
+    const spec = objectInfo?.[String(classType ?? '')];
+    if (spec === undefined) return [];
+    const decl = spec.input?.required?.[inputName] ?? spec.input?.optional?.[inputName];
+    if (!Array.isArray(decl) || decl.length === 0) return [];
+    if (Array.isArray(decl[0])) return decl[0].map(String);
+    if (decl[0] === 'COMBO' && decl[1] !== null && typeof decl[1] === 'object' && Array.isArray(decl[1].options)) {
+        return decl[1].options.map(String);
+    }
+    if (decl[0] !== null && typeof decl[0] === 'object' && Array.isArray(decl[0].options)) {
+        return decl[0].options.map(String);
+    }
+    return [];
+}
+
+function mainParams(api, picks = [], hidden = [], booleans = null) {
+    const rows = [];
+    const seen = new Set();
+    const declared = Array.isArray(picks) ? picks : [];
+    const byKey = new Map();
+    for (const pick of declared) {
+        const nodeId = String(pick?.nodeId ?? '');
+        const input = String(pick?.input ?? '');
+        if (nodeId === '' || input === '') continue;
+        byKey.set(`${nodeId}::${input}`, pick);
+    }
+    const hiddenKeys = new Set(
+        (Array.isArray(hidden) ? hidden : [])
+            .map((row) => `${String(row?.nodeId ?? '')}::${String(row?.input ?? '')}`)
+            .filter((key) => key !== '::'),
+    );
+    /**
+     * The kind of one row, decided by the instance's declaration first.
+     *
+     * `booleans` is a Set of `nodeId::input` keys that `object_info` reports as BOOLEAN. It is
+     * the authority, and it is what made the switch kind finally work: the stored graph holds
+     * these as the STRING "true" (which ComfyUI accepts for those custom nodes), so a check on
+     * `typeof value === 'boolean'` never fired — every real switch fell through to a text box
+     * and was submitted as a string, which is exactly the reported failure.
+     */
+    const kindOf = (pick, input, value, key) => {
+        const isBool = typeof value === 'boolean' || (booleans !== null && booleans.has(key));
+        return normalizeParamKind(pick, input, isBool);
+    };
+
+    for (const [nodeId, node] of Object.entries(api ?? {})) {
+        const type = String(node?.class_type ?? '');
+        for (const [input, value] of Object.entries(node?.inputs ?? {})) {
+            /**
+             * Derived rows are the well-known sampler keys, plus every boolean input.
+             *
+             * Booleans are included because a switch IS a knob — `tiled_decode` decides
+             * whether an upscale tiles its VAE decode, and it used to be reachable only by
+             * pinning it by hand. The whitelist cannot grow to cover them: their names are
+             * whatever a custom node chose.
+             */
+            if (!PARAM_KEYS.includes(input) && typeof value !== 'boolean' && (booleans === null || !booleans.has(`${nodeId}::${input}`))) continue;
+            if (typeof value !== 'number' && typeof value !== 'string' && typeof value !== 'boolean') continue;
+            const key = `${nodeId}::${input}`;
+            const pick = byKey.get(key);
+            if (hiddenKeys.has(key) && pick === undefined) continue;
+            const kind = kindOf(pick, input, value, key);
+            const declaredValue = pick !== undefined && (typeof pick.value === 'number' || typeof pick.value === 'string' || typeof pick.value === 'boolean')
+                ? pick.value
+                : undefined;
+            rows.push({
+                // A declaration renames a derived row without removing it: the operator's
+                // label beats the raw input key, which is what they wanted to fix.
+                name: String(pick?.name ?? '').trim() || input,
+                nodeId,
+                input,
+                value: kind === 'switch' ? normalizeSwitchValue(declaredValue ?? value) : (declaredValue ?? value),
+                desc: String(pick?.desc ?? ''),
+                // Four kinds: a switch is decided by the value's type, a seed by its input
+                // name, a model by its declaration, everything else is a plain value.
+                kind,
+                folder: String(pick?.folder ?? ''),
+                ...(kind === 'seed' ? { seedMode: pick?.seedMode === 'fixed' ? 'fixed' : 'random' } : {}),
+                classType: type,
+                declared: pick !== undefined,
+            });
+            seen.add(key);
+        }
+    }
+
+    // Declared entries whose input is outside the whitelist above — the reason declaring
+    // exists at all: ControlNet strength, LoRA weight, a second sampler, a boolean flag.
+    for (const [key, pick] of byKey) {
+        if (seen.has(key)) continue;
+        const node = api?.[pick.nodeId];
+        if (node === undefined) continue;
+        const graphValue = node.inputs?.[pick.input];
+        if (typeof graphValue !== 'number' && typeof graphValue !== 'string' && typeof graphValue !== 'boolean') continue;
+        const kind = kindOf(pick, pick.input, graphValue);
+        const pickedValue = typeof pick.value === 'number' || typeof pick.value === 'string' || typeof pick.value === 'boolean'
+            ? pick.value
+            : graphValue;
+        rows.push({
+            name: String(pick.name ?? '').trim() || pick.input,
+            nodeId: String(pick.nodeId),
+            input: String(pick.input),
+            value: kind === 'switch' ? normalizeSwitchValue(pickedValue) : pickedValue,
+            desc: String(pick.desc ?? ''),
+            kind,
+            folder: String(pick.folder ?? ''),
+            ...(kind === 'seed' ? { seedMode: pick.seedMode === 'fixed' ? 'fixed' : 'random' } : {}),
+            classType: String(node.class_type ?? ''),
+            declared: true,
+        });
+        seen.add(key);
+    }
+
+    // Straw-poll order: sampler settings first, then the frame.
+    const rank = (row) => {
+        const order = ['steps', 'cfg', 'sampler_name', 'scheduler', 'seed', 'denoise', 'width', 'height', 'batch_size'];
+        const index = order.indexOf(row.input);
+        return index < 0 ? order.length : index;
+    };
+    return rows.sort((left, right) => rank(left) - rank(right));
+}
+
+/**
+ * Image inputs of a graph, found without the instance's object_info.
+ *
+ * `imageTargets()` needs class declarations to know which inputs take an IMAGE, but a
+ * chain step runs through `generate()` where object_info may be unavailable or stale. The
+ * fallback rule is what a person would use reading the JSON: an input whose value looks
+ * like a media filename, or whose name says image/mask/video, on a node that is not the
+ * one producing them.
+ */
+function imageTargetsOf(prompt) {
+    const rows = [];
+    for (const [nodeId, node] of Object.entries(prompt ?? {})) {
+        const classType = String(node?.class_type ?? '');
+        for (const [input, value] of Object.entries(node?.inputs ?? {})) {
+            if (typeof value !== 'string') continue;
+            const looksLikeFile = /\.(png|jpe?g|webp|bmp|gif|mp4|webm|mp3|wav|flac)$/i.test(value);
+            const namedLikeImage = /^(image|image_path|mask|video|images)$/i.test(input);
+            if (looksLikeFile || (namedLikeImage && value !== '')) rows.push({ nodeId, input, classType });
+        }
+    }
+    return rows;
+}
+
+/** Every media reference one history entry produced, flattened. */
+function outputsOf(entry) {
+    const rows = [];
+    for (const output of Object.values(entry?.outputs ?? {})) {
+        for (const list of Object.values(output ?? {})) {
+            if (!Array.isArray(list)) continue;
+            for (const item of list) {
+                if (item === null || typeof item !== 'object') continue;
+                if (typeof item.filename !== 'string' || item.filename === '') continue;
+                rows.push({ filename: item.filename, subfolder: item.subfolder ?? '', type: item.type ?? 'output' });
+            }
+        }
+    }
+    return rows;
+}
+
+/**
+ * Classify a merged-history entry that has no live pool task (older run, or one
+ * started directly on an instance). Its graph is in `prompt[2]`.
+ */
+function classifyHistoryEntry(entry) {
+    const name = entry?.meta?.run?.name ?? entry?.meta?.workflowName ?? '';
+    if (detectAdult(String(name)).hit) return 'nsfw';
+    const prompt = Array.isArray(entry?.prompt) ? entry.prompt[2] : undefined;
+    return scanStrings(prompt ?? {}).hit ? 'nsfw' : 'sfw';
+}
+
+/** A history entry that predates the pool's task record: classify from its graph. */
+/**
+ * Add the bridge prefix to root-absolute path values inside a JSON response.
+ *
+ * Only JSON *string values* that start with a single "/" are touched, which covers a web
+ * app manifest's icon list without disturbing numbers, booleans, or prose. The rewrite is
+ * done on the raw text with a narrow pattern rather than by parsing and re-serialising:
+ * re-serialising would change key order and whitespace, and ComfyUI's own ETags would then
+ * disagree with the bytes.
+ *
+ * A path is left alone when it is already prefixed, protocol-relative ("//host"), or does
+ * not look like a request path (no character after the slash).
+ */
+export function rewriteJsonPaths(source, prefix) {
+    return source.replace(/"(\/(?!\/)[^"\\]*)"/g, (whole, path) => {
+        if (path.startsWith(prefix)) return whole;
+        return `"${prefix}${path.slice(1)}"`;
+    });
+}
+
+/**
+ * Add the bridge prefix to module specifiers inside a JavaScript response.
+ *
+ * Only two shapes are touched, because anything broader corrupts ordinary strings:
+ *   - static `from "/x"` / `import "/x"`
+ *   - dynamic `import("/x")`
+ *
+ * A path that is already prefixed, protocol-relative ("//host"), or a bare specifier
+ * ("three") is left alone.
+ */
+export function rewriteModuleSpecifiers(source, prefix) {
+    const fix = (path) => {
+        if (!path.startsWith('/')) return path;
+        if (path.startsWith('//')) return path;
+        if (path.startsWith(prefix)) return path;
+        return `${prefix}${path.slice(1)}`;
+    };
+    return source
+        // from "/x"   and   from '/x'
+        .replace(/\bfrom\s*(["'])(\/(?!\/)[^"']*)\1/g, (whole, quote, path) => `from ${quote}${fix(path)}${quote}`)
+        // import "/x"   (side-effect import)
+        .replace(/\bimport\s*(["'])(\/(?!\/)[^"']*)\1/g, (whole, quote, path) => `import ${quote}${fix(path)}${quote}`)
+        // import("/x")
+        .replace(/\bimport\s*\(\s*(["'])(\/(?!\/)[^"']*)\1\s*\)/g, (whole, quote, path) => `import(${quote}${fix(path)}${quote})`);
+}
+
+export function injectBridgeShim(html, prefix) {
+    const shim = `<script>
+(function(){
+  var P=${JSON.stringify(prefix)};
+  function fix(u){
+    if(typeof u!=='string'||u==='')return u;
+    if(u.indexOf(P)===0)return u;
+    // data:/blob:/about: are not requests; an absolute http URL is left alone —
+    // the instance's own page has no reason to hold one, and rewriting a foreign
+    // origin would break it rather than help.
+    if(/^(data:|blob:|about:|javascript:|https?:)/i.test(u))return u;
+    if(u.charAt(0)==='/')return P+u.slice(1);
+    return u;
+  }
+  var of=window.fetch;
+  window.fetch=function(input,init){
+    if(typeof input==='string')input=fix(input);
+    else if(input&&input.url){try{var c=new Request(fix(input.url),input);input=c;}catch(e){}}
+    return of.call(this,input,init);
+  };
+  var OW=window.WebSocket;
+  window.WebSocket=function(url,protocols){
+    return protocols===undefined?new OW(fix(url)):new OW(fix(url),protocols);
+  };
+  window.WebSocket.prototype=OW.prototype;
+  try{Object.assign(window.WebSocket,OW);}catch(e){}
+  var OE=window.EventSource;
+  if(OE){window.EventSource=function(url,cfg){return new OE(fix(url),cfg);};window.EventSource.prototype=OE.prototype;}
+  var od=Object.getOwnPropertyDescriptor(HTMLImageElement.prototype,'src');
+  if(od&&od.set){Object.defineProperty(HTMLImageElement.prototype,'src',{set:function(v){return od.set.call(this,fix(v));},get:od.get,configurable:true});}
+  var ov=Object.getOwnPropertyDescriptor(HTMLVideoElement.prototype,'src');
+  if(ov&&ov.set){Object.defineProperty(HTMLVideoElement.prototype,'src',{set:function(v){return ov.set.call(this,fix(v));},get:ov.get,configurable:true});}
+  var open=window.open;
+  window.open=function(url){return open.call(window,typeof url==='string'?fix(url):url);};
+  try{
+    var base=document.createElement('base');
+    base.href=P;
+    (document.head||document.documentElement).prepend(base);
+
+    /**
+     * Patch the asset URLs that are already in the document.
+     *
+     * A <base href> does NOT fix root-absolute URLs: "/assets/app.js" resolves against the
+     * origin and drops the base path entirely, so the browser asked the CONSOLE for
+     * /assets/app.js and got the console's 404 JSON instead of JavaScript. Nothing booted
+     * and the page sat on its logo forever.
+     *
+     * Only root-absolute paths are rewritten. Relative ones already resolve against the
+     * base, and absolute http(s) URLs belong to somebody else.
+     */
+    function fixAttr(selector, attr){
+      try{
+        var nodes=document.querySelectorAll(selector);
+        for(var i=0;i<nodes.length;i+=1){
+          var value=nodes[i].getAttribute(attr);
+          if(value&&value.charAt(0)==='/'&&value.indexOf(P)!==0){
+            nodes[i].setAttribute(attr,P+value.slice(1));
+          }
+        }
+      }catch(e){}
+    }
+    fixAttr('script[src]','src');
+    fixAttr('link[href]','href');
+    fixAttr('img[src]','src');
+    fixAttr('source[src]','src');
+    fixAttr('video[src]','src');
+    fixAttr('audio[src]','src');
+  }catch(e){}
+})();
+</script>`;
+    /**
+     * Rewrite root-absolute asset URLs in the markup too, not only at runtime.
+     *
+     * The shim runs after parsing has begun, so `<script type="module" src="/assets/app.js">`
+     * may already have been fetched — and a module script that 404s is not retried. Fixing
+     * the HTML is the difference between "the bundle loads" and "the SPA spins forever".
+     */
+    const rewrite = (markup) => markup.replace(
+        /\b(src|href)="(\/(?!\/)[^"]*)"/gi,
+        (whole, attr, value) => (value.startsWith(prefix) ? whole : `${attr}="${prefix}${value.slice(1)}"`),
+    );
+    const withPrefix = rewrite(shim);
+    if (/<head[^>]*>/i.test(html)) return rewrite(html.replace(/<head([^>]*)>/i, (match) => `${match}${withPrefix}`));
+    return `${withPrefix}${rewrite(html)}`;
+}