@ihyeon/flow-qa 0.2.4 → 0.2.6

package/README.ko.md

@@ -13,17 +13,19 @@ CLI와 `127.0.0.1` 전용 웹 UI를 제공합니다. UI는 영어로 시작하
 
 ## 로컬 데모 시작
 
-Node.js 24.8 이상이 필요합니다. 브라우저는 첫 웹 실행 전에 설치합니다.
+Node.js 24.x(24.22.1 이상) 또는 26.12.1 이상이 필요합니다. 브라우저는 첫 웹 실행 전에 설치합니다.
 
 ```sh
-npm install -g @ihyeon/flow-qa@0.2.4
+npm install -g @ihyeon/flow-qa@0.2.6
 flow-qa browser install
 flow-qa ui --demo
 ```
 
 출력된 로컬 UI 주소에서 **케이스 보관함 → 예제 불러오기 → 검토 → 실행** 순서로 진행합니다. 데모 앱과 별도 작업 공간이 함께 시작되며 API 키가 필요하지 않습니다. 결과는 현재 디렉터리의 `.flowqa/ui-demo-en/`에 저장됩니다. 기존 한국어 데모 데이터는 별도로 유지되며, 언어 전환은 예제·사용자 문장을 자동 번역하지 않습니다. 문제가 있으면 `flow-qa browser install --with-deps`로 Chromium의 시스템 의존성을 설치할 수 있습니다. 자세한 화면 동작은 [UI 안내](https://github.com/hyeonse-swing/flow-qa/blob/main/docs/ui.md)에 있습니다.
 
-소스에서 개발하거나 검증을 재현하려면:
+Flow QA를 설치하기 전에 Node 자체도 업데이트해야 합니다. npm 패키지 업데이트만으로 실행 중인 Node가 패치되지는 않습니다. 최소 버전은 [2026년 10월 21일 Node 보안 릴리스](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)를 기준으로 하며 Node 25는 지원하지 않습니다. nvm을 쓴다면 `nvm install 24.22.1`, `nvm use 24.22.1`을 실행하고 이미 실행 중인 Flow QA를 재시작하세요.
+
+소스에서 개발하거나 검증을 재현하려면 `.nvmrc`에 지정된 Node 24 LTS를 사용합니다(nvm: `nvm install`, `nvm use`).
 
 ```sh
 npm ci

package/README.md

@@ -13,17 +13,19 @@ Flow QA is available as a CLI and a web UI bound to `127.0.0.1`. Provide a targe
 
 ## Try the local demo
 
-Node.js 24.8 or later is required. Install Chromium before the first web run:
+Node.js 24.x (24.22.1 or later) or 26.12.1 or later is required. Install Chromium before the first web run:
 
 ```sh
-npm install -g @ihyeon/flow-qa@0.2.4
+npm install -g @ihyeon/flow-qa@0.2.6
 flow-qa browser install
 flow-qa ui --demo
 ```
 
 Open the printed local UI address, then follow **Case library → Load → Review → Run QA**. The command starts a separate local demo app and workspace; no API key is needed. Results are saved under `.flowqa/ui-demo-en/` in the current directory. If Chromium lacks system libraries, use `flow-qa browser install --with-deps`. See the [UI guide](https://github.com/hyeonse-swing/flow-qa/blob/main/docs/ui.md).
 
-To work from source or reproduce the checks:
+Upgrade Node itself before installing Flow QA; an npm package update does not patch the runtime. This minimum follows the [October 21, 2026 Node.js security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Node 25 is not supported. With nvm, run `nvm install 24.22.1` and `nvm use 24.22.1`, then restart any running Flow QA process.
+
+To work from source or reproduce the checks, use the Node 24 LTS version pinned in `.nvmrc` (with nvm: `nvm install` and `nvm use`):
 
 ```sh
 npm ci

package/dist/src/ui/public/app.js

@@ -204,7 +204,10 @@
     const host = $('library-list'); replace(host);
     const suites = app.state?.suites || [];
     if (!suites.length) { host.append(el('p', 'empty', t('app.libraryEmpty'))); return; }
-    for (const suite of suites) {
+    const query = $('library-search').value.trim().toLowerCase();
+    const matchingSuites = suites.filter((suite) => !query || [suite.title, suite.id, suite.file].some((field) => String(field || '').toLowerCase().includes(query)));
+    if (!matchingSuites.length) { host.append(el('p', 'empty', t('app.libraryNoMatches'))); return; }
+    for (const suite of matchingSuites) {
       const row = el('div', 'list-row'); const copy = el('div'); copy.append(el('strong', '', suite.title || suite.id), el('small', '', t('app.libraryMeta', { id: suite.id, count: suite.caseCount, questions: suite.questionCount, file: suite.file })));
       const button = el('button', 'button', t('app.load')); button.type = 'button'; button.addEventListener('click', () => loadSuite(suite.file)); row.append(copy, button); host.append(row);
     }
@@ -393,6 +396,7 @@
   function wire() {
     window.addEventListener('beforeunload', warnBeforeUnload);
     document.querySelectorAll('[data-view]').forEach((button) => button.addEventListener('click', () => view(button.dataset.view)));
+    $('library-search').addEventListener('input', renderLibrary);
     $('nav-toggle').addEventListener('click', () => { const open = $('sidebar').classList.toggle('nav-open'); $('nav-toggle').setAttribute('aria-expanded', String(open)); });
     $('library-shortcut').addEventListener('click', () => view('library'));
     $('new-draft-btn').addEventListener('click', () => {

package/dist/src/ui/public/i18n.js

@@ -70,6 +70,8 @@
     'library.intro': ['Cases saved on disk. Local demo examples are not AI generated results.', '디스크에 저장된 케이스입니다. 로컬 데모 예제는 AI 생성 결과가 아닙니다.'],
     'library.title': ['Saved suites', '저장된 스위트'],
     'library.help': ['Load a suite, then review it on the Scenario page.', '불러온 뒤 시나리오 화면에서 검토하세요.'],
+    'library.searchLabel': ['Search saved suites', '저장된 스위트 검색'],
+    'library.searchPlaceholder': ['Search title, ID, or file name', '제목, ID 또는 파일명 검색'],
     'history.heading': ['Run history', '실행 기록'],
     'history.eyebrow': ['03 / RUNS', '03 / 실행'],
     'history.intro': ['Only runs that actually started appear here. Once results are saved, you can view the detailed report.', '실제로 시작된 실행만 표시합니다. 결과가 저장되면 상세 보고서를 볼 수 있습니다.'],
@@ -204,6 +206,7 @@
     'app.saveConnection': ['Save connection', '연결 저장'],
     'app.clearConnection': ['Disconnect', '연결 해제'],
     'app.libraryEmpty': ['No saved cases. Validate and save JSON from Scenario, or prepare a local demo case.', '저장된 케이스가 없습니다. 시나리오에서 JSON을 검증해 저장하거나 로컬 데모 케이스를 준비하세요.'],
+    'app.libraryNoMatches': ['No saved suites match your search.', '검색 조건과 일치하는 저장된 스위트가 없습니다.'],
     'app.libraryMeta': ['{id} · {count} cases · {questions} open questions · file {file}', '{id} · {count}개 케이스 · 확인 질문 {questions}개 · 파일 {file}'],
     'app.load': ['Load', '불러오기'],
     'app.historyActiveEmpty': ['First run in progress. Its report will appear here when complete.', '첫 실행을 처리 중입니다. 완료되면 이곳에 보고서가 표시됩니다.'],

package/dist/src/ui/public/index.html

@@ -88,7 +88,7 @@
         </section>
         <section id="view-library" class="view" hidden>
           <div class="page-heading"><p class="eyebrow" data-i18n="library.eyebrow">02 / LIBRARY</p><h1 data-i18n="nav.library">Case library</h1><p data-i18n="library.intro">Cases saved on disk. Local demo examples are not AI generated results.</p></div>
-          <section class="list-section"><div class="section-head"><span class="section-number">01</span><div><h2 data-i18n="library.title">Saved suites</h2><p data-i18n="library.help">Load a suite, then review it on the Scenario page.</p></div></div><div id="library-list" class="list-body"></div></section>
+          <section class="list-section"><div class="section-head"><span class="section-number">01</span><div><h2 data-i18n="library.title">Saved suites</h2><p data-i18n="library.help">Load a suite, then review it on the Scenario page.</p></div></div><div class="section-body form-stack"><label for="library-search" data-i18n="library.searchLabel">Search saved suites</label><input id="library-search" type="search" placeholder="Search title, ID, or file name" data-i18n-placeholder="library.searchPlaceholder"><div id="library-list" class="list-body"></div></div></section>
         </section>
         <section id="view-history" class="view" hidden>
           <div class="page-heading"><p class="eyebrow" data-i18n="history.eyebrow">03 / RUNS</p><h1 data-i18n="nav.history">Run history</h1><p data-i18n="history.intro">Only runs that actually started appear here. Once results are saved, you can view the detailed report.</p></div>

package/docs/mobile.md

@@ -1,6 +1,6 @@
 # User-configured iOS and Android targets
 
-Mobile targets require Flow QA `0.2.0` or later and Node.js 24.8 or later. The web demo remains a browser demo; it is not proof of a mobile run.
+Mobile targets require Flow QA `0.2.0` or later and Node.js 24.x (24.22.1 or later) or 26.12.1 or later. The web demo remains a browser demo; it is not proof of a mobile run.
 
 ## Write cases now, connect an app later
 
@@ -9,7 +9,7 @@ Choose **Mobile** on the scenario screen, describe the flow, and generate or dow
 With the installed CLI:
 
 ```sh
-npm install -g @ihyeon/flow-qa@0.2.4
+npm install -g @ihyeon/flow-qa@0.2.6
 flow-qa init ./my-qa
 # Write your mobile flow in my-qa/flows/my-flow.md first.
 flow-qa plan flows/my-flow.md --platform mobile --prompt-only --workspace ./my-qa

package/docs/releases.md

@@ -2,6 +2,28 @@
 
 The alpha entries below are historical release records. They document earlier package versions and checks.
 
+## 0.2.6: search the case library
+
+Adds a search field to the case library. Filter saved suites by title, suite ID, or file name with case-insensitive partial matching; surrounding whitespace is ignored. Clearing the query restores the full list. English and Korean labels and no-match guidance are included. The current query stays through navigation, language changes, and automatic library updates. Existing case loading, unsaved-draft confirmation, review, and execution behavior stays in place.
+
+Locally verified on macOS with Node.js 24.22.1 on 2026-10-26: 92 tests, type checking, UI syntax and design-system audit, real Chromium search checks for all three fields, Korean text, no matches, clearing, navigation, language changes, newly saved files, filtered loading, and a 390px viewport. Existing UI and demo checks, package validation, and a fresh tarball install with three passing browser cases also passed. No model calls were used.
+
+- Package: [`@ihyeon/flow-qa@0.2.6`](https://www.npmjs.com/package/@ihyeon/flow-qa/v/0.2.6)
+- Release: [GitHub 0.2.6](https://github.com/hyeonse-swing/flow-qa/releases/tag/v0.2.6)
+
+## 0.2.5: update the Node.js security baseline
+
+Raises the Node.js requirement to `^24.22.1 || >=26.12.1` for the [October 21, 2026 security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases), including fixes in TLS, DNS, HTTP, and Brotli. Vulnerable Node 24/26 versions and the unsupported Node 25 line no longer satisfy the package engine requirement. Local development and all release jobs use Node 24.22.1 from `.nvmrc`.
+
+Upgrade Node itself and restart Flow QA; installing this package does not replace an existing Node process. With nvm, run `nvm install 24.22.1` and `nvm use 24.22.1` before installing Flow QA. The locked Undici dependency is also updated from 7.30.0 to 7.30.1 for its [security fixes](https://github.com/nodejs/undici/releases/tag/v7.30.1). Application behavior and direct dependency versions remain unchanged.
+
+The separate MCP server SDK findings in `npm audit` remain in the pinned e2e dependency. Flow QA invokes `e2e run`, not the MCP server command; upgrading that runner requires separate compatibility validation and is outside this Node security patch.
+
+Locally verified on macOS with Node.js 24.22.1 on 2026-10-22: 92 tests, type checking, UI syntax and design-system audit, real Chromium UI and demo checks, package validation, and a fresh tarball install with three passing browser cases. The engine range rejects older Node 24/26 versions and Node 25, and all release jobs read the same runtime pin. No model calls were used.
+
+- Package: [`@ihyeon/flow-qa@0.2.5`](https://www.npmjs.com/package/@ihyeon/flow-qa/v/0.2.5)
+- Release: [GitHub 0.2.5](https://github.com/hyeonse-swing/flow-qa/releases/tag/v0.2.5)
+
 ## 0.2.4: confirm before replacing unsaved cases
 
 Loading a library suite, importing valid case files, or starting a new JSON draft now asks before discarding unsaved content. Cancel preserves the current draft and selected import files. New JSON drafts keep the scenario text; unchanged saved cases, flow-only JSON resets, and ordinary screen navigation stay quiet. Failed imports still report validation errors without replacing the draft. Existing save, review, generation, and execution behavior remains unchanged.

package/docs/ui.md

@@ -4,10 +4,10 @@ Describe a user flow, review cases, and configure a target when ready to run. We
 
 ## Start
 
-Node.js 24.8 or later is required. Install Flow QA and start the web demo:
+Node.js 24.x (24.22.1 or later) or 26.12.1 or later is required. Node 25 is unsupported. Upgrade the Node runtime and restart any running UI process; updating Flow QA alone does not patch Node. Install Flow QA and start the web demo:
 
 ```sh
-npm install -g @ihyeon/flow-qa@0.2.4
+npm install -g @ihyeon/flow-qa@0.2.6
 flow-qa browser install
 flow-qa ui --demo
 ```
@@ -32,7 +32,7 @@ The UI starts in **English**, regardless of browser language. Switch to **한국
 2. **Connections:** When ready, register a target name and web URL, or choose iOS/Android and enter an installed app's bundle/package ID and device. Planner and execution agent models have separate settings. Saving settings does not start an app or model request.
 3. **Review and save cases:** Expand each case to read preconditions, actions, expected results, and unresolved questions. Editing the JSON keeps the linked flow; if that source flow changes, design the cases again. Planning and running are separate actions. Editing inputs or connection settings alone does not call a model.
 4. **Run QA:** Review the saved case file, select a matching web/mobile target, and check the review confirmation before running. If the file or target settings change after review, reload and review them again. Fixed steps need no agent model. `act` and `assertAgent` require a compatible agent; missing models and unresolved questions are reported as blocked cases.
-5. **Case library and Run history:** Save cases as new files and load them again. Open run details to see each case, attempt, and evidence; download the Markdown or JSON report.
+5. **Case library and Run history:** Save cases as new files, search by title, suite ID, or file name, and load them again. Open run details to see each case, attempt, and evidence; download the Markdown or JSON report.
 
 The top bar shows planning, running, and stopping states, plus a cancel button. A late planning response cannot change the draft after cancellation. The UI does not estimate progress inside an individual browser action. If the server disconnects, reconnect; runs started in another tab also appear. Refreshing settings rereads targets and models, so save edits first.
 
@@ -46,6 +46,10 @@ From version `0.2.2`, the UI requests the browser's leave-page confirmation when
 
 From version `0.2.4`, loading a suite from the library or importing valid case files also asks before replacing unsaved scenario or case content. **New JSON draft** asks before clearing unsaved JSON and keeps the scenario text. Cancel keeps the current content and selected import files. Unchanged saved cases and ordinary navigation between screens do not prompt; invalid imports still show their validation error without replacing anything.
 
+### Search saved cases
+
+From version `0.2.6`, **Case library** filters saved suites as you type in **Search saved suites**. Search matches part of a title, suite ID, or file name, ignores letter case and surrounding whitespace, and supports Korean text. Clear the field to show all suites. The query stays while navigating, changing language, or receiving updated saved cases; it resets when the page reloads. Search covers the listed top-level case files, not individual steps or source Markdown.
+
 ### Import existing case files
 
 From version `0.2.1`, select a `flow-qa/suite-1` JSON file and, when it declares a source, its Markdown file in case review, then choose **Import case files**. The two file controls let you select files from different folders. For an error-to-test export, select `cases/error-to-test.json` and `flows/error-to-test.md`. A JSON file without a source can be imported alone or with a Markdown file.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ihyeon/flow-qa",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "license": "MIT",
   "author": "Hyeonse Im",
   "repository": {
@@ -38,7 +38,7 @@
   "description": "Turn user flows into repeatable tests and evidence-backed QA reports.",
   "type": "module",
   "engines": {
-    "node": ">=24.8.0"
+    "node": "^24.22.1 || >=26.12.1"
   },
   "bin": {
     "flow-qa": "./dist/bin/flow-qa.mjs"