fix(panel): the conversation is always panel-owned — retire the workflow/ask chat scopes (mcp#884)

[artokun]

Companion to the orchestrator-side P0 fix for artokun/comfyui-mcp#884 (agent sessions were workflow-scoped; the owner-stated invariant is one session across all panels, tabs and workflows, keyed and persisted by the orchestrator). This PR lands together with artokun/comfyui-mcp#897 — neither is complete alone: mcp#897 makes the session orchestrator-global; this PR makes the panel's history/thread identity follow it.

Commit 1 — retire the workflow/ask chat scopes

• chatScopeMode() is hard-wired to "panel". The legacy workflow and ask chat scopes were per-workflow sessions by another name; the owner ruled the shared session is the default and the ONLY behavior.
• The Settings → "Chat conversation scope" combo is removed. A stored workflow/ask value from an older build is simply ignored (not migrated).
• Per-workflow threads created under the old modes remain in history, grouped as before, and open through the history picker like any archived conversation. Nothing is deleted.

Commit 2 — history/thread identity follows the orchestrator's session, not the tab (gate P0s)

The independent gate found that commit 1 left the history layer tab-local while the session became orchestrator-global. The design principle for the fix: which conversation a tab renders and records into is SHARED state — the panel:global active pointer in history metadata — resolved by ONE selector (selectPanelThread), on cold restore and on cross-tab sync alike. A tab never decides for itself; it either acts (loadThread / new chat — writes the pointer and tells the orchestrator) or adopts (reads the pointer and repaints).

P0-1 — wrong-conversation rendering / transcript mis-attribution across tabs. The history-sync subscriber now passively adopts the shared selection: when another tab moves the pointer (opening an archived thread, new chat, delete), every other tab repaints to the new selection and re-keys its sessionStorage, so its next user_message is recorded in the transcript the agent is actually in. Adoption is deliberately passive — only the tab the user acted in sends resume_session/new_session; this also removes the old behavior where every observing tab echoed new_session after a remote delete (N tabs racing to reset the ONE global session). Same-thread remote appends are mirrored onto an idle view (never mid-turn, never over a live A2UI card).

P0-2 — stale pre-upgrade pointer restoring an old conversation. selectPanelThread gains a stale-pointer guard: the pointer only pins a conversation over newer CONVERSATION activity elsewhere (message createdAt recency) when the pointer write itself is the most recent action. Opening a chat from the archive stamps a fresh revision, so deliberate selections stick; rename/pin/todo edits and archive imports deliberately do NOT count as conversation activity, so grooming the archive can never hijack the selection. An upgrading user whose panel:global pointer predates weeks of workflow-mode conversations now restores the conversation they were actually in; the old one stays in history, openable.

selectRestoreThread (cold restore): the shared pointer is authoritative when it resolves or was deliberately cleared; the tab-local pointer only bridges (a) legacy snapshots with no shared pointer and (b) dangling pointers (target evicted — the pointer then carries no information, and the tab that was just using a conversation is better evidence than recency guessing). The subscriber applies the same dangling rule.

Also removed the last scope machinery the retired setting fed — applyChatScope, askModeFollowsPanel, the ask window.confirm — and the retired setting-id constants, so there is no live scope switcher left to reintroduce per-workflow sessions behind the orchestrator's back.

Commit 3 — abandoned-turn output fence (self-gate round 2, codex P0)

Codex review of commit 2 found the adoption path's dual: a turn can be streaming when the selection moves, and the abandoned turn's late say/stream/todo frames would paint into — and be recorded under — the newly adopted conversation. Fix: extend the existing liveTurnThreadId turn-ownership (pinned at turn:working for #381's usage frames) to transcript output — when the shown conversation is not the turn's owner, onSay/onStream/onTodo return early and record() drops any non-user entry at its choke point. The straggler is dropped like an interrupt's, deliberately NOT re-routed into its owner thread: a fresh message stamp there would win selectPanelThread's conversation-recency and yank the shared selection straight back. This also hardens the pre-existing same-tab hazard (opening an archived chat mid-turn used to file the old turn's tail into the newly opened transcript). The adoption e2e runs this exact scenario and is mutation-checked (disabling the fence makes it fail). Residual: panel_ask question cards from an abandoned turn can still paint transiently (never persisted — the record choke point drops them).

Commit 4 — independent gate round 3 (five P0s)

The coordinator's gate failed the previous head with five P0s; commit 4 addresses all of them, P0-2 first (structural):

P0-2 — the selection pointer is now BACKEND-scoped. One panel:global key shared by every backend meant a Claude tab's selection moved a Codex tab's conversation (and a reload lost Codex's resumable id). The pointer key is now panel:backend:<id> — the same axis as the orchestrator's orchestrator::<backend> session key — resolved via resolvePanelPointer with a one-way legacy fallback (a written backend key, including a deliberate clear, never falls back). Another backend's selection ops are explicitly not evidence for this backend's conversation.

P0-1 — the commit is the transition. loadThread/newChat now dispatch the resume_session/new_session frame FIRST and publish the shared selection only when sendFrame returned true. A disconnected tab still switches its own view (reading an archive offline is legitimate) but can no longer move every other tab onto a conversation the backend never entered. E2E-pinned by a new disconnected-actor spec, mutation-checked (always-publish makes it fail). Honest residual: two connected actors racing can still disagree (pointer revisions and socket delivery are ordered independently); closing that needs orchestrator-confirmed transitions, which is mcp#897-side work — the panel has no authority signal to reconcile against.

P0-3 — selection evidence only. The stale-pointer guard no longer treats message createdAt as evidence (the gate's import-hijack and future-clock probes). Only SELECTION ops compete: the retired workflow mode stamped a workflow-scoped active op on every thread creation/open, so a genuine pre-upgrade snapshot carries a newer workflow selection — the newest selection op that resolves to a live thread wins, total-ordered by compareRevisions (no equal-millisecond ambiguity). Imported archives (which never write active ops) and straggler message writes can no longer move the shared conversation; unit tests pin the import shape explicitly.

P0-4 — ownership pinned at dispatch; every output path fenced. pinTurnOwnerAtDispatch pins the turn's owner at every successful user_message dispatch, closing the pre-turn:working hole (an adoption's endTurnLocally discards a working frame inside the stale-working window, which used to leave ownership null exactly when the fences needed it). The fence now also covers ask_user, show_media, and ui_render (honest tool errors — an interactive card sitting in the wrong conversation is not "transient") and command activity cards. E2E: the abandoned-turn spec sends say + set_todo + ask_user after a mid-turn switch with no turn:working ever emitted; mutation-checked (removing the pin makes it fail).

P0-5 — the prompt is filed at dispatch, not at type time. sendCurrent re-checks the current conversation after its awaits (attachment uploads, grounding, validation): if the selection moved, the optimistically recorded prompt is relocated — tombstoned out of the old thread (merge-safe) and re-recorded + repainted in the current one — before the frame goes out. Queued sends were already dispatch-side (they record at materialize/dequeue). Residual: the wire frame itself still carries no thread identity; a failed-send manual retry from the tray does not re-relocate.

P2-6 — the E2Es drive the real actor seam. The adoption spec's actor is now a second connected panel clicking the history row (real loadThread: dispatch + publish); specs seed thread content only, never the selection being adopted under test.

Commit 5 — self-gate round 4 (two follow-up P0s the backend scoping introduced)

• Provider switching now adopts the target backend's own conversation. The handshake compares the selection key before/after the backend resolves; when it changed, the panel adopts the new backend's conversation through the normal actor path (loadThread → dispatch + publish under the NEW key; newChat when it has none) — otherwise the new backend's session would run against a conversation it does not own while reloads and other tabs resolve its real one. Same-backend reconnects are untouched (keys equal). E2E: a second MockBridge reporting backend: codex — the panel adopts the seeded codex conversation and Claude's selection stays intact; mutation-checked (disabling the adoption fails it).
• A disconnected delete of the active conversation queues the session reset it owes. The tombstone and pointer clear propagate immediately (peers honestly go blank — the transcript is deleted), and the un-dispatchable new_session is queued per backend scope, fired on the next ready ack under three guards: same backend scope, the shared pointer is still in the cleared state this tab left (any newer act — here or in another tab — supersedes and drops it), and the frame actually sends. Not e2e-tested (deterministically killing and resurrecting the mock socket mid-spec is not worth the flake risk); the guard logic is small and codex-re-reviewed ("finding 2 is closed").
• Corner (codex round-4 re-review): the switch transition also runs when the target is the thread already on screen. First connect can land on a different backend than the restored default while the new scope resolves the same legacy thread — the session still needs the resume/new + replay alignment and the publish under the new backend's key; loadThread now runs on every backend-key change with a target (its provider check scrubs a foreign session id).

Self-gate log (codex, adversarial, disclosed): round 1 FAIL (abandoned-turn straggler → fixed), round 2 PASS, coordinator gate FAIL (the five P0s above), round 3 FAIL (provider-switch adoption + disconnected-delete reset → fixed), round 4 FAIL (same-thread switch corner → fixed) / finding 2 closed. Per the round-cap discipline the self-gate loop stops here; the head is gated independently.

Tests

• Unit (CI): new cases in browser_tests/unit/chat-history-store.test.mjs for the selector rules — selection-evidence guard (newer retired-mode selection wins; newer messages never do — the import shape is pinned explicitly), deliberate archive-open sticks, metadata-edit immunity, compacted-op fallback, backend scoping + one-way legacy fallback matrix, shared-pointer-beats-tab-pointer, deliberate clear, dangling pointer. Full suite: 2390/2390 pass; typecheck + vocabulary gate pass.
• Playwright (NOT in CI — run live on this rig against ComfyUI :8188, --workers=1; parallel workers against the live instance produce mass false failures): 16/17 pass. The five gate-flagged workflow-scope cases were rewritten or deleted, plus a sixth found in conversation-persistence.spec.ts, plus four new invariant specs:
  • workflow-chat-identity.spec.ts "opening a workflow does not dirty it…" → rewritten: panel scope records provenance off-graph (no embed, no dirty).
  • workflow-chat-identity.spec.ts "settings hydration never adopts a loose session…" → deleted: its contract (scope flip at hydration) no longer exists.
  • workflow-chat-identity.spec.ts "embeds a workflow UUID and blocks a foreign transcript pointer" → rewritten as the adoption e2e, actor-driven per gate P2-6: a second connected panel clicks the history row (real loadThread), this tab adopts live and records the next message into the adopted thread; cross-workflow archives stay openable.
  • New: "a disconnected tab cannot move the shared conversation" (P0-1; mutation-checked — always-publish fails it).
  • New: "switching backends adopts that backend's own conversation" (round-4; second MockBridge with backend: codex; mutation-checked).
  • New: "an abandoned turn cannot leak output into a conversation opened mid-turn" (P0-4 incl. the pre-turn:working hole; say + set_todo + ask_user all fenced; mutation-checked — removing the dispatch pin fails it).
  • chat-history-v2.spec.ts "embeds a stable workflow UUID…" → scope-forcing removed (assertions are scope-independent and pass).
  • chat-history-v2.spec.ts "workflow scope disables foreign chats…" → rewritten as the P0-2/P0-3 cold-upgrade e2e: realistic pre-0.11.63 — closing a workflow stops discarding changes a node made (#882) #884 storage (stale panel pointer + newer workflow-scoped selection op) restores the current conversation; the old chat stays openable.
  • conversation-persistence.spec.ts "strict workflow storage sync detaches…" (sixth lying case, forced the retired sessionFollowsPanel boolean) → rewritten: panel-owned continuity survives a remote provenance re-key.
  • New shared fixture browser_tests/fixtures/worktreeSource.ts routes the whole web/js tree from the checked-out source, so the specs exercise this commit instead of whatever stale copy the dev ComfyUI has linked (the previous two-file routing broke the ES-module graph once the linked checkout drifted).
  • The one failure, chat-history-v2.spec.ts "keeps multiple chats, supports search…" ("Current workflow only" filter finds 1 of 2 rows), fails identically on the original PR head f2f0cd4 — pre-existing, unrelated to the P0s; filed as panel#694.
• Not live-tested: the P0-5 relocation path (deterministically opening the await window mid-send needs an injection hook; the logic is reviewed, unit-adjacent tombstone semantics reuse deleteMsg's pattern) and true two-actor concurrent streaming (mock frames stand in for real orchestrator fanout).

Verified: node --check as ESM passes on both changed modules; zero stray control bytes in all changed files.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Cross-tab history selection can corrupt session bindings, while existing tests and documentation still assume retired scopes.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Retires legacy workflow/ask conversation scopes to enforce orchestrator-managed shared sessions.

Changes:

• Hard-wires chat scope to panel-wide.
• Removes the conversation-scope setting.

File summaries

File	Description
web/js/comfyui-mcp-panel.js	Enforces panel scope and removes its selector.

Review details

Suppressed comments (2)

web/js/comfyui-mcp-panel.js:2606

• The browser suites still force the retired workflow mode and assert its behavior. For example, browser_tests/chat-history-v2.spec.ts:292-385 and workflow-chat-identity.spec.ts:203-270 expect foreign chats to be disabled, while conversation-persistence.spec.ts:502-583 expects a cross-scope sync to detach the session; all of those assertions become false with this unconditional return. Update or retire those cases and add coverage that stored workflow/ask values are ignored and workflow switches emit neither new_session nor resume_session.
  web/js/comfyui-mcp-panel.js:3045
• Removing this setting leaves the checked-in design guide incorrect: docs/design/chat-history-v2.md:6-12 still directs users to “Chat conversation scope” and documents the retired Workflow and Ask options. Update that section so the public documentation matches the only supported behavior.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.