@com55/node-red-ai-access 0.2.0-beta.7 → 0.2.0-beta.9

package/CHANGELOG.md

@@ -6,6 +6,60 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0-beta.9] - 2026-11-02
+
+- Redesign the dashboard with a GitHub-Settings-style grouped left sidebar and
+  inline SVG icons. Show one section at a time with hash routing and browser
+  back/forward navigation, single-column rows, a 1200px container and a narrow
+  top menu. Improve current-page semantics, group labels and heading focus
+  (#110).
+- Harden the approval queue against deployments that finish after the
+  five-minute cap. Block approvals with `deploy_outcome_unknown` until
+  settlement, restart or an attempt-matched "Confirm live checked", unless an
+  audited override is used; allow rejection with a warning. Audit late
+  overwrites across tabs, alert on affected later decisions, show a dashboard
+  banner and mark proposals that landed after withdrawal (#111).
+- Keep `outputs`, `wires` and switch `rules` coupled during rebase for every
+  node type. Preserve the owner acknowledgement flag when an unchanged
+  replacement body still differs from base (#111).
+- Fix OpenAPI loading in the CommonJS build with `import.meta` shims and an
+  `__dirname` fallback (#111).
+- Reuse production builds in tests through a content-hash build stamp, with
+  `SKIP_TEST_BUILD=1` support (#111). Exclude `dist/.production-build-hash` from
+  the npm package.
+
+## [0.2.0-beta.8] - 2026-10-29
+
+- Proposal review shows human conflict reasons and Base / Live / Proposed field
+  values, including flow environment variables. Choices have explanations,
+  confirmation, a visible chosen state, and persisted undo of the latest choice.
+- Proposals with no net deployment change clearly say nothing changes and hide
+  approval and security notes.
+- Consolidate review notes with a count and separate security from
+  configuration; omit duplicate comparisons and unchanged editor diffs. Re-check
+  shows progress and a result toast. Pending totals match the badge, including
+  conflicts.
+- Improve light-theme readability, settings width, sticky navigation clearance,
+  sign-in footer visibility and stable sign-in button colors; errors use alerts.
+- Reject invalid TTL settings with a minimum of 1; keep invalid input visible
+  and never report it saved. Investigate the NR4 Active link (box-only
+  findings).
+
+- Merge disjoint fields on the same node and tab, including env entries by
+  unique name and credentials by key. Conflict choices preserve independent
+  changes from both sides and retain secret safeguards and warnings.
+- Keep peer proposals mergeable after approval of a different field on the same
+  node.
+- Report actual changed fields in `outbound_node_changed` warnings.
+- Expose `baseRev` and rename the informational revision flag to
+  `baseRevChanged`; use `rebase.state` and `rebase.rev` to assess the checked
+  merge.
+- Add `nodeId` + `choice` to MCP/REST proposal resolution and clarify that
+  replacement operations apply to the flow snapshot at `expectedRev`.
+- Allow full admins to withdraw proposals after token loss, with recovery
+  authority and original ownership in the audit log. Other tokens remain
+  blocked.
+
 ## [0.2.0-beta.7] - 2026-10-28
 
 ### Fixed

package/README.md

@@ -418,30 +418,76 @@ minute hard cap is reached. Before the cap, a late success marks the proposal
 approved with its `resultRev`; a late failure clears `deployPending` and keeps
 it pending for retry. At the cap the queue and proposal lock are released,
 `deployPending.queueReleased` becomes true, and the card asks reviewers to check
-the live flow before approving again. Later runtime settlement leaves this
-unknown-outcome record unchanged. Every subsequent approval re-reads live flows
-before rebasing and deploying, recognizing already-applied results. Queued
-approvals time out after 60 seconds with **504** `approve_queue_timeout` without
-deploying. Queued proposals can still be rejected or withdrawn; their approvals
-then return `proposal_not_pending` when dequeued. These three deadlines are
-configurable in `settings.js` under `aiAccess` (positive milliseconds; invalid
-values use the defaults shown above). When choosing **proposed** during conflict
-resolution, unchanged secret spans keep their live editor values. If spans
-cannot be aligned safely, proposed values are retained with a
-`secret_may_revert` warning on the dashboard card. Deliberately deleted secret
-spans do not raise this warning. Deleting one of several identical secret lines
-while their live values changed keeps the proposal in conflict; resolve that
-field against the live flow or choose **live**. Changed env arrays with
-duplicate names show `duplicate_env_keys`, since pairing by name is ambiguous
-when entries are reordered.
+the live flow before approving again. Approvals remain blocked until settlement
+or a matching confirm-live-checked action, unless explicitly overridden with an
+audit entry. Late settlement clears the matching unknown-outcome record. A late
+deploy that changes other tabs writes a warning and a `late_deploy_overwrite`
+audit entry, even when only editor changes were overwritten. Closed proposals
+are alerted only if their decision changed after the cap snapshot. A withdrawn
+proposal keeps its decision and shows “Landed after withdraw” if its deploy
+lands. Every subsequent approval re-reads live flows before rebasing and
+deploying, recognizing already-applied results. Queued approvals time out after
+60 seconds with **504** `approve_queue_timeout` without deploying. Queued
+proposals can still be rejected or withdrawn; their approvals then return
+`proposal_not_pending` when dequeued. These three deadlines are configurable in
+`settings.js` under `aiAccess` (positive milliseconds; invalid values use the
+defaults shown above). When choosing **proposed** during conflict resolution,
+unchanged secret spans keep their live editor values. If spans cannot be aligned
+safely, proposed values are retained with a `secret_may_revert` warning on the
+dashboard card. Deliberately deleted secret spans do not raise this warning.
+Deleting one of several identical secret lines while their live values changed
+keeps the proposal in conflict; resolve that field against the live flow or
+choose **live**. Changed env arrays with duplicate names show
+`duplicate_env_keys`, since pairing by name is ambiguous when entries are
+reordered.
+
+Open proposals merge changes per node and tab field. Different fields on the
+same node merge automatically; changes to the same field conflict even when both
+values are identical. Position (`x`/`y`) edits never conflict; a proposed
+position edit wins a tie. Env entries merge by unique name and then entry field;
+credentials merge by key (including nested keys). Duplicate env names use an
+atomic array comparison and retain the existing ambiguity warning. Deletion
+versus modification, id collisions, dangling references, and unsafe redacted
+placeholders still block approval.
+
+Proposal responses and diffs expose `baseRev` (an alias of `expectedRev`).
+`baseRevChanged` replaces `baseRevStale`: it only reports that the base revision
+differs from live for an open proposal. It is informational, including after a
+successful rebase. `rebase.rev` is the checked live revision and `rebase.state`
+is `clean` (proposal applies unchanged), `merged` (live edits incorporated), or
+`conflict` (approval blocked). A merged proposal still requires review of its
+current `mergedHash` before approval.
+
+MCP `resolve_proposal_conflict` and REST `POST /proposals/:id/resolve` accept
+`nodeId` + `choice: "live" | "proposed"` for one current conflict. Choices
+affect only overlapping fields; independent edits from both sides survive.
+Existing secret preservation and ambiguity warnings also apply. Alternatively
+send `expectedRev` + `payload` to replace the proposal body: node operations
+apply to the **flow snapshot at expectedRev**, not to the stored proposal or
+merged result, so include every intended edit. These modes cannot be mixed. Both
+require the submitting token; tab conflicts use the flow id as `nodeId`.
+
+If the submitting token is lost, a full (`*`) admin can withdraw an open
+proposal through `POST /mcp/api/v1/proposals/:id/withdraw` using the dashboard's
+authenticated admin session (optional JSON `reason`). Other access tokens,
+including replacement tokens, cannot withdraw it. Recovery records
+`proposal.withdrawn` with the admin identity, original owner id,
+`withdrawalAuthority: "admin-recovery"`, proposal id, and reason. Owner-token
+withdrawal records `withdrawalAuthority: "owner-token"`. Withdrawal never
+deploys flows and cannot interrupt an in-flight approval.
 
 Open proposals auto-rebase on editor changes. A `conflict` blocks approval until
 resolved using REST `POST /proposals/:id/resolve`, admin
-`POST /proposals/:id/resolve-conflict`, or MCP `resolve_proposal_conflict`.
-Diffs include `rebase`, `liveChanges` and (without conflicts) `vsCurrent`, the
-merged deployment. Approval requires the reviewed `mergedHash` when editor
-changes are merged. Proposals expire after `proposalTtlDays` (integer 1–365,
-default 7), editable through the settings API. Approve may send
+`POST /proposals/:id/resolve-conflict`, or MCP `resolve_proposal_conflict`. The
+dashboard confirms conflict choices and shows the chosen side. Admins can undo
+the latest choice with `POST /proposals/:id/resolve-conflict` and
+`{ "nodeId": "...", "choice": "undo" }` until the next proposal edit or choice;
+undo restores the proposal and rechecks current live flows without deploying.
+Diffs include `conflictValues` (base/live/proposed per field, including flow
+env; redacted for AI callers), `rebase`, `liveChanges` and (without conflicts)
+`vsCurrent`, the merged deployment. Approval requires the reviewed `mergedHash`
+when editor changes are merged. Proposals expire after `proposalTtlDays`
+(integer 1–365, default 7), editable through the settings API. Approve may send
 `deploymentType`: `nodes` (default), `flows`, or `full`. Approval rebases
 against the current revision; conflicts leave the proposal open for resolution.
 Deploy timeouts keep it **pending**; other deploy errors mark it **failed**.

package/ai-access.html

@@ -14,7 +14,7 @@
     }
     window.__com55AiAccessSidebarLoading = true;
 
-    var EDITOR_SIDEBAR_ASSET_VERSION = '0.2.0-beta.7';
+    var EDITOR_SIDEBAR_ASSET_VERSION = '0.2.0-beta.9';
     var root = (RED.settings.httpAdminRoot || '/').replace(/\/$/, '');
     var src =
       (root || '') +