@ihyeon/flow-qa 0.2.3 → 0.2.5

package/README.ko.md

@@ -13,17 +13,19 @@ CLI와 `127.0.0.1` 전용 웹 UI를 제공합니다. UI는 영어로 시작하
 
 ## 로컬 데모 시작
 
-Node.js 24.8 이상이 필요합니다. 브라우저는 첫 웹 실행 전에 설치합니다.
+Node.js 24.x(24.22.1 이상) 또는 26.12.1 이상이 필요합니다. 브라우저는 첫 웹 실행 전에 설치합니다.
 
 ```sh
-npm install -g @ihyeon/flow-qa@0.2.3
+npm install -g @ihyeon/flow-qa@0.2.5
 flow-qa browser install
 flow-qa ui --demo
 ```
 
 출력된 로컬 UI 주소에서 **케이스 보관함 → 예제 불러오기 → 검토 → 실행** 순서로 진행합니다. 데모 앱과 별도 작업 공간이 함께 시작되며 API 키가 필요하지 않습니다. 결과는 현재 디렉터리의 `.flowqa/ui-demo-en/`에 저장됩니다. 기존 한국어 데모 데이터는 별도로 유지되며, 언어 전환은 예제·사용자 문장을 자동 번역하지 않습니다. 문제가 있으면 `flow-qa browser install --with-deps`로 Chromium의 시스템 의존성을 설치할 수 있습니다. 자세한 화면 동작은 [UI 안내](https://github.com/hyeonse-swing/flow-qa/blob/main/docs/ui.md)에 있습니다.
 
-소스에서 개발하거나 검증을 재현하려면:
+Flow QA를 설치하기 전에 Node 자체도 업데이트해야 합니다. npm 패키지 업데이트만으로 실행 중인 Node가 패치되지는 않습니다. 최소 버전은 [2026년 10월 21일 Node 보안 릴리스](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)를 기준으로 하며 Node 25는 지원하지 않습니다. nvm을 쓴다면 `nvm install 24.22.1`, `nvm use 24.22.1`을 실행하고 이미 실행 중인 Flow QA를 재시작하세요.
+
+소스에서 개발하거나 검증을 재현하려면 `.nvmrc`에 지정된 Node 24 LTS를 사용합니다(nvm: `nvm install`, `nvm use`).
 
 ```sh
 npm ci

package/README.md

@@ -13,17 +13,19 @@ Flow QA is available as a CLI and a web UI bound to `127.0.0.1`. Provide a targe
 
 ## Try the local demo
 
-Node.js 24.8 or later is required. Install Chromium before the first web run:
+Node.js 24.x (24.22.1 or later) or 26.12.1 or later is required. Install Chromium before the first web run:
 
 ```sh
-npm install -g @ihyeon/flow-qa@0.2.3
+npm install -g @ihyeon/flow-qa@0.2.5
 flow-qa browser install
 flow-qa ui --demo
 ```
 
 Open the printed local UI address, then follow **Case library → Load → Review → Run QA**. The command starts a separate local demo app and workspace; no API key is needed. Results are saved under `.flowqa/ui-demo-en/` in the current directory. If Chromium lacks system libraries, use `flow-qa browser install --with-deps`. See the [UI guide](https://github.com/hyeonse-swing/flow-qa/blob/main/docs/ui.md).
 
-To work from source or reproduce the checks:
+Upgrade Node itself before installing Flow QA; an npm package update does not patch the runtime. This minimum follows the [October 21, 2026 Node.js security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Node 25 is not supported. With nvm, run `nvm install 24.22.1` and `nvm use 24.22.1`, then restart any running Flow QA process.
+
+To work from source or reproduce the checks, use the Node 24 LTS version pinned in `.nvmrc` (with nvm: `nvm install` and `nvm use`):
 
 ```sh
 npm ci

package/dist/src/ui/public/app.js

@@ -243,7 +243,7 @@
     if (state.lastError && state.lastError !== app.lastError) { app.lastError = state.lastError; notice(state.lastError, true); }
   }
   async function work(fn) { if (app.busy) return; app.busy = true; readiness(); notice(''); try { await fn(); } catch (error) { showError(error); } finally { app.busy = false; readiness(); } }
-  async function loadSuite(file) { await work(async () => { const result = await api(`/api/suite?file=${encodeURIComponent(file)}`); $('flow-input').value = result.flow || ''; setDraft(result.suite, result.script, 'library', result.flow || '', file, result.suiteHash || ''); noticeKey('app.suiteLoaded'); view('scenario'); }); }
+  async function loadSuite(file) { await work(async () => { const result = await api(`/api/suite?file=${encodeURIComponent(file)}`); if (!confirmScenarioReplacement('app.confirmReplaceDraft')) return; $('flow-input').value = result.flow || ''; setDraft(result.suite, result.script, 'library', result.flow || '', file, result.suiteHash || ''); noticeKey('app.suiteLoaded'); view('scenario'); }); }
   async function generate() { await work(async () => {
     const flow = $('flow-input').value.trim();
     if (!flow) throw localizedError('app.enterFlow');
@@ -267,6 +267,9 @@
       || suite !== JSON.stringify(app.draft, null, 2)
       || $('scenario-platform').value !== suitePlatform();
   }
+  function confirmScenarioReplacement(key) {
+    return !hasUnsavedScenario() || window.confirm(t(key));
+  }
   function warnBeforeUnload(event) {
     if (!hasUnsavedScenario()) return;
     event.preventDefault();
@@ -286,6 +289,7 @@
       const body = { suite, ...(flow === undefined ? {} : { flow }) };
       if (new TextEncoder().encode(JSON.stringify(body)).byteLength > 256 * 1024) throw localizedError('app.importTooLarge');
       const result = await api('/api/import', body);
+      if (!confirmScenarioReplacement('app.confirmReplaceDraft')) return;
       $('flow-input').value = flow || '';
       setDraft(result.suite, result.script, 'imported', flow || '');
       noticeKey('app.importComplete');
@@ -393,6 +397,9 @@
     $('library-shortcut').addEventListener('click', () => view('library'));
     $('new-draft-btn').addEventListener('click', () => {
       if (app.busy) return;
+      const json = $('suite-editor').value;
+      const unsavedJson = json.trim() && (!app.savedFile || json !== JSON.stringify(app.draft, null, 2));
+      if (unsavedJson && !confirmScenarioReplacement('app.confirmNewDraft')) return;
       app.draft = null; app.script = ''; app.savedFile = ''; app.savedHash = '';
       app.origin = 'none'; app.sourceFlow = ''; app.boundSource = null; app.stale = false; app.dirty = false;
       $('suite-editor').value = ''; $('review-checkbox').checked = false;

package/dist/src/ui/public/i18n.js

@@ -226,6 +226,8 @@
     'app.plannerCliOnly': ['This model can be used from the CLI. Connect an OpenAI-compatible model to generate cases in the UI.', '이 모델은 CLI에서 사용할 수 있습니다. UI에서 생성하려면 OpenAI 호환 모델을 연결하세요.'],
     'app.plannerReady': ['Ready to generate. The actual model call and costs may occur when you select Generate.', '생성 준비가 됐습니다. 실제 모델 호출과 비용은 생성 버튼을 누를 때 발생할 수 있습니다.'],
     'app.runEnded': ['Run ended. Check Run history for results.', '실행이 종료됐습니다. 실행 기록에서 결과를 확인하세요.'],
+    'app.confirmReplaceDraft': ['Unsaved changes to the current scenario or cases will be discarded. Saved files will remain unchanged. Cancel to keep editing.', '현재 시나리오 또는 케이스의 저장되지 않은 변경 사항이 사라집니다. 저장된 파일은 변경되지 않습니다. 취소하면 계속 편집할 수 있습니다.'],
+    'app.confirmNewDraft': ['Unsaved case JSON will be cleared. The scenario text and saved files will remain unchanged. Cancel to keep editing.', '저장되지 않은 케이스 JSON이 지워집니다. 시나리오 내용과 저장된 파일은 유지됩니다. 취소하면 계속 편집할 수 있습니다.'],
     'app.suiteLoaded': ['Saved cases loaded. Editing the linked scenario requires generating or loading cases again.', '저장된 케이스를 불러왔습니다. 연결된 시나리오를 수정하면 케이스를 다시 생성하거나 불러와야 합니다.'],
     'app.enterFlow': ['Enter a scenario with expected behavior.', '기대 동작을 포함한 시나리오를 입력하세요.'],
     'app.configurePlanner': ['Configure an OpenAI-compatible AI planner and key environment variable in Connections.', '연결 설정에서 OpenAI 호환 AI 플래너와 키 환경 변수를 준비하세요.'],

package/docs/mobile.md

@@ -1,6 +1,6 @@
 # User-configured iOS and Android targets
 
-Mobile targets require Flow QA `0.2.0` or later and Node.js 24.8 or later. The web demo remains a browser demo; it is not proof of a mobile run.
+Mobile targets require Flow QA `0.2.0` or later and Node.js 24.x (24.22.1 or later) or 26.12.1 or later. The web demo remains a browser demo; it is not proof of a mobile run.
 
 ## Write cases now, connect an app later
 
@@ -9,7 +9,7 @@ Choose **Mobile** on the scenario screen, describe the flow, and generate or dow
 With the installed CLI:
 
 ```sh
-npm install -g @ihyeon/flow-qa@0.2.3
+npm install -g @ihyeon/flow-qa@0.2.5
 flow-qa init ./my-qa
 # Write your mobile flow in my-qa/flows/my-flow.md first.
 flow-qa plan flows/my-flow.md --platform mobile --prompt-only --workspace ./my-qa

package/docs/releases.md

@@ -2,6 +2,28 @@
 
 The alpha entries below are historical release records. They document earlier package versions and checks.
 
+## 0.2.5: update the Node.js security baseline
+
+Raises the Node.js requirement to `^24.22.1 || >=26.12.1` for the [October 21, 2026 security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases), including fixes in TLS, DNS, HTTP, and Brotli. Vulnerable Node 24/26 versions and the unsupported Node 25 line no longer satisfy the package engine requirement. Local development and all release jobs use Node 24.22.1 from `.nvmrc`.
+
+Upgrade Node itself and restart Flow QA; installing this package does not replace an existing Node process. With nvm, run `nvm install 24.22.1` and `nvm use 24.22.1` before installing Flow QA. The locked Undici dependency is also updated from 7.30.0 to 7.30.1 for its [security fixes](https://github.com/nodejs/undici/releases/tag/v7.30.1). Application behavior and direct dependency versions remain unchanged.
+
+The separate MCP server SDK findings in `npm audit` remain in the pinned e2e dependency. Flow QA invokes `e2e run`, not the MCP server command; upgrading that runner requires separate compatibility validation and is outside this Node security patch.
+
+Locally verified on macOS with Node.js 24.22.1 on 2026-10-22: 92 tests, type checking, UI syntax and design-system audit, real Chromium UI and demo checks, package validation, and a fresh tarball install with three passing browser cases. The engine range rejects older Node 24/26 versions and Node 25, and all release jobs read the same runtime pin. No model calls were used.
+
+- Package: [`@ihyeon/flow-qa@0.2.5`](https://www.npmjs.com/package/@ihyeon/flow-qa/v/0.2.5)
+- Release: [GitHub 0.2.5](https://github.com/hyeonse-swing/flow-qa/releases/tag/v0.2.5)
+
+## 0.2.4: confirm before replacing unsaved cases
+
+Loading a library suite, importing valid case files, or starting a new JSON draft now asks before discarding unsaved content. Cancel preserves the current draft and selected import files. New JSON drafts keep the scenario text; unchanged saved cases, flow-only JSON resets, and ordinary screen navigation stay quiet. Failed imports still report validation errors without replacing the draft. Existing save, review, generation, and execution behavior remains unchanged.
+
+Locally verified on macOS with Node.js 24.14.1 on 2026-10-21: 92 tests, type checking, UI syntax and design-system audit, real Chromium confirmation acceptance/cancellation in English and Korean, preserved inputs and import selections, unchanged navigation and validation errors, and a fresh package install with three passing browser cases. Existing file download, re-import, and browser leave-page checks passed without model calls.
+
+- Package: [`@ihyeon/flow-qa@0.2.4`](https://www.npmjs.com/package/@ihyeon/flow-qa/v/0.2.4)
+- Release: [GitHub 0.2.4](https://github.com/hyeonse-swing/flow-qa/releases/tag/v0.2.4)
+
 ## 0.2.3: download saved case files
 
 Adds separate case JSON and source Markdown download buttons to case review. Saved cases can be reused without finding workspace files manually; source-less cases offer JSON only. Unsaved or outdated drafts are excluded. The source text and hash remain compatible with file import, while existing save, review, and execution gates stay in place.

package/docs/ui.md

@@ -4,10 +4,10 @@ Describe a user flow, review cases, and configure a target when ready to run. We
 
 ## Start
 
-Node.js 24.8 or later is required. Install Flow QA and start the web demo:
+Node.js 24.x (24.22.1 or later) or 26.12.1 or later is required. Node 25 is unsupported. Upgrade the Node runtime and restart any running UI process; updating Flow QA alone does not patch Node. Install Flow QA and start the web demo:
 
 ```sh
-npm install -g @ihyeon/flow-qa@0.2.3
+npm install -g @ihyeon/flow-qa@0.2.5
 flow-qa browser install
 flow-qa ui --demo
 ```
@@ -42,7 +42,9 @@ For each attempt, the report can open or download an approved screenshot or text
 
 To enter fresh JSON after changing a scenario, open the JSON editor in case review and choose **New JSON draft**. Existing saved files remain; validate and save the new JSON before reviewing it for a run.
 
-From version `0.2.2`, the UI requests the browser's leave-page confirmation when refreshing or closing a tab with an unsaved scenario or case draft. Unchanged saved cases do not trigger it; saving clears the warning. Choose to stay on the page to keep editing. The browser controls the prompt wording and availability. This is not automatic saving, and it does not guard actions within the UI that replace the draft.
+From version `0.2.2`, the UI requests the browser's leave-page confirmation when refreshing or closing a tab with an unsaved scenario or case draft. Unchanged saved cases do not trigger it; saving clears the warning. Choose to stay on the page to keep editing. The browser controls the prompt wording and availability. This is not automatic saving.
+
+From version `0.2.4`, loading a suite from the library or importing valid case files also asks before replacing unsaved scenario or case content. **New JSON draft** asks before clearing unsaved JSON and keeps the scenario text. Cancel keeps the current content and selected import files. Unchanged saved cases and ordinary navigation between screens do not prompt; invalid imports still show their validation error without replacing anything.
 
 ### Import existing case files
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ihyeon/flow-qa",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "license": "MIT",
   "author": "Hyeonse Im",
   "repository": {
@@ -38,7 +38,7 @@
   "description": "Turn user flows into repeatable tests and evidence-backed QA reports.",
   "type": "module",
   "engines": {
-    "node": ">=24.8.0"
+    "node": "^24.22.1 || >=26.12.1"
   },
   "bin": {
     "flow-qa": "./dist/bin/flow-qa.mjs"