fix(panel): fence ask_user / request_secret to the conversation whose turn asked for them

[artokun]

What

ask_user (a question card) and request_secret (a masked token input) are the two
cards the panel renders on the agent's behalf that collect a value from the user and
return it as the tool result. On main both painted unconditionally:

onAsk(msg)    { const p = paintQuestion(msg); … return p; },
onSecret(msg) { const p = paintSecret(msg);   … return p; },

while onThinking, sitting between them in the same object, is fenced — "a late
thinking frame arriving AFTER a local interrupt must not resurrect the indicator the
user just dismissed."

For these two the consequence isn't a stray indicator, it's a stray value: an
abandoned or superseded turn could paint a secure input into whatever conversation the
tab happened to be showing, and the token typed there came back as the result of a turn
belonging to a different conversation. mcp #897 made agent sessions
orchestrator-scoped, so "which conversation is on screen" and "which turn this frame
belongs to" are now genuinely separable — which is what makes it reachable.

This PR fences both.

Origin

Found by the independent gate on PR #680 and re-verified on origin/main.

It deliberately does NOT address #680's structural blocker. The panel publishes
shared conversation state off sendFrame() returning true, which only means the local
socket accepted bytes — not that the orchestrator applied the transition. Both the panel
author and the gate concluded separately that the panel cannot fix that alone; it needs
orchestrator-confirmed session transitions, which do not exist yet. This is a standalone
fix that lands on its own and leaves #680 exactly where it is.

The fence

New pure module web/js/lib/interactive-card-fence.js. Paint only when a turn is in
flight in this tab and the conversation that turn was captured under is the
conversation on screen. Why nothing weaker works:

candidate	why it's insufficient
agentWorking alone	bare "some turn is in flight" — exactly what #381 already found insufficient for attribution, which is why liveTurnThreadId exists. Still the load-bearing half for the reported shape: every abandon path (new chat, opening an older conversation, workflow switch, backend switch, Disconnect, Esc, cancelling a queued message) routes through endTurnLocally().
CURRENT_THREAD_KEY / thread?.id alone	describes only what's on screen; carries zero frame provenance, so it can't tell "this turn owns the screen" from "this is a late frame for something else" — the one distinction needed.
commandRidLedger / commandEpoch	the rid dedupes one command from another; the epoch separates a restarted orchestrator from its predecessor (#694). An abandoned turn and the live turn share both the epoch and the socket. (The socket half is already covered upstream by isActive().)
the frame itself	request_secret carries only label/hint; ask_user carries an ask_id that is a fresh random UUID per call, for correlation, not a conversation. A conversation id on the wire is the fix this should have — it's an orchestrator protocol change, not a panel change.

The owner-less case

liveTurnThreadId is captured as thread?.id ?? null, so it's null for a turn that
began on a view with no conversation yet. Such a turn isn't owner-less — it owns the
conversation it creates. My own gate got this wrong twice, and both wrong answers
are written down in the module header:

• refusing whenever owner !== shown false-refuses that legitimate card (the agent
  emits a progress say, which mints the conversation, then asks);
• painting whenever owner === null opens a hole the other way — loadThread()'s
  cross-workflow BLOCKED branch calls detachInvalidCurrentThread({rebind:true}) and
  returns without endTurnLocally();
• "created after the turn started" isn't enough either — a conversation created in
  another tab after this turn began can sync into this tab's history and be rebound
  onto the screen by that same detach path. Newer than the turn, and still not the
  turn's.

So the discriminator is provenance, not age: lastMintedThreadId is written only by
record()'s thread-creation branch (the sole place a conversation is created) and reset
by onTurn("working"), so a non-null value means exactly "record() created this
conversation during the turn now running." A conversation that merely appeared can
never satisfy it. It's module-scoped on purpose — record() runs from many points
inside the panel builder closure, and a let partway down that closure would be in its
temporal dead zone for any call reaching record() earlier.

What the agent sees when a card is refused

An explicit ok:false — not silence, not a fabricated success, and not a card painted
somewhere else. Tone matches command-liveness.js's redactSensitiveReply, including
its rule that the panel reports what it OBSERVED, never a guess:

the panel did not show the secure token input for "request_secret": that ComfyUI tab
has no turn in flight, so nothing there owns this card. That is what the panel
OBSERVED, not a diagnosis — the usual cause is that the turn was ended in that tab (an
interrupt, a new chat, an older conversation reopened, a workflow or backend switch, a
disconnect), but a turn start the panel has not registered yet looks the same. Nothing
was shown, nothing was collected and nothing was stored — a secure input must never be
painted into whatever conversation the tab happens to be showing: the token typed
there would come back as THIS turn's result, putting a secret in a conversation the
user never chose to put it in. Do not retry this in a loop: say in plain text what you
need and why, and ask again after the user's next message in the tab you want to ask
in.

No value can be logged on this path: the refusal runs before any card exists, so
there is nothing to leak. A refused request_secret also consumes the Settings
"set at" marker rather than leaving it armed for an unrelated later secret.

Known residuals (documented, pinned by tests, deliberately not fixed here)

Both have one root cause — the turn frame carries a state and no turn identity:

1. a straggler turn:working arriving past STALE_WORKING_GUARD_MS is
   indistinguishable from a fresh turn's, so onTurn adopts the conversation then on
   screen. Narrower than the defect being fixed (which required no precondition at all),
   but not zero.
2. the mirror: a genuinely fresh turn whose turn:working lands inside that window is
   discarded, so a legitimate card is refused. It fails closed, with the honest
   error above.

Closing either means putting a turn/conversation id on the wire, which subsumes both —
a comfyui-mcp protocol change, not a panel change. Each has a KNOWN RESIDUAL: test so
the residual is visible and a future turn-id has a test to flip.

Verification

• npm run test:unit — 2554 pass, 0 fail. npm run typecheck clean.
  node --check on both files; the panel re-verified as a real ES module (parses and
  links, no duplicate top-level declaration).
• 41 tests in browser_tests/unit/interactive-card-fence.test.mjs: the pure decision,
  the refusal wording, source-level pins on the shipped handlers, and a lifecycle
  section that wires the real endTurnLocally and onTurn bodies to the real fence
  and handlers over one closure, so agentWorking / liveTurnThreadId are produced by
  shipped code rather than injected.
• 26 mutations verified — each breaks one behaviour, fails a specific named test,
  and is restored. Including the pre-fix state: removing the fence from both handlers
  fails the load-bearing tests with a card painted into the wrong conversation.
• 3 adversarial gate rounds on substance plus a narrow re-gate of the newest commit.
  Every finding was either fixed (round 2's false refusal, round 3's cross-tab hole,
  round 3's brittle pins) or accepted and documented (the two turn-identity residuals).
• No control bytes in any changed file; no git-binary files.
• pyproject.toml and PANEL_VERSION are untouched — no Comfy Registry publish.

Do not merge without a human look.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Fences interactive cards to the visible conversation that owns the active turn, preventing cross-conversation answers or secret disclosure.

Changes:

• Adds a pure card-fence classifier and refusal messages.
• Applies fencing to question and secret handlers.
• Adds extensive unit and lifecycle regression coverage.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
web/js/lib/interactive-card-fence.js	Defines ownership checks and refusal messages.
web/js/comfyui-mcp-panel.js	Integrates turn provenance fencing into card handlers.
browser_tests/unit/interactive-card-fence.test.mjs	Tests decisions, handlers, lifecycle, and known residuals.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.