@manny-est/node-red-flowpilot 0.4.0 → 0.5.0

package/lib/core/redaction.js

@@ -0,0 +1,165 @@
+    // ---------------------------------------------------------------------
+    // Secret detection — shared by the node-selection sanitizer (below)
+    // and the live debug-message redactor (next section). Two
+    // complementary checks:
+    //   - VALUE_SECRET_PATTERNS: the VALUE looks like a credential (bearer
+    //     token, JWT, AWS key, high-entropy blob), regardless of field name.
+    //   - SECRET_KEY: the field NAME looks secret-bearing (password, token,
+    //     apiKey, ...) AND the value is a string long enough to plausibly be
+    //     a real secret — short strings like `key: "ab"` or numbers like
+    //     `keyCount: 3` are left alone.
+    // Redaction is informative, not silent: placeholders carry the kind and
+    // original length (`[redacted: bearer token, 211 chars]`) so the AI can
+    // still reason about "an auth header was present" without seeing it.
+    // ---------------------------------------------------------------------
+    var SECRET_KEY = /pass|secret|token|apikey|api_key|key$|credential|auth|bearer/i;
+    var SECRET_NAME_MIN_LEN = 8;
+
+    var VALUE_SECRET_PATTERNS = [
+        // Case-insensitive and tolerant of "Bearer: <token>" /
+        // "bearer=<token>" variants, not just the strict HTTP-header form.
+        { kind: "bearer token", re: /\bbearer\s*[:=]?\s+[A-Za-z0-9._\-]{8,}/i },
+        // "Token <credential>" — same HTTP Authorization form used by Django REST
+        // Framework and many other APIs. Case-sensitive: lowercase "token" is also
+        // matched via SECRET_KEY's name-based check; this catches the value-shape.
+        { kind: "token credential", re: /\bToken\s+[A-Za-z0-9._\-]{8,}/ },
+        { kind: "JWT", re: /\beyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+/ },
+        { kind: "AWS key", re: /\bAKIA[0-9A-Z]{16}\b/ },
+        // Long high-entropy hex/base64-ish blob with no whitespace — catches
+        // raw tokens/secrets that don't match a more specific pattern above.
+        { kind: "token/secret", re: /^[A-Za-z0-9+/=_\-]{32,}$/ }
+    ];
+
+    function matchSecretValue(str) {
+        for (var i = 0; i < VALUE_SECRET_PATTERNS.length; i++) {
+            if (VALUE_SECRET_PATTERNS[i].re.test(str)) { return VALUE_SECRET_PATTERNS[i].kind; }
+        }
+        return null;
+    }
+
+    // Node-RED's "edit message properties" UI (Inject node's Properties list,
+    // Change node's rules, etc.) stores each entry as
+    // { p: "<property name>", v/to: "<value>", vt/tot: "<type>" } — the
+    // secret-indicating NAME lives in `p`, but the secret VALUE lives in a
+    // sibling `v`/`to` field. SECRET_KEY.test() against the object key alone
+    // ("v"/"to") never matches, so a property literally named "auth" or
+    // "apikey" sailed through untouched. Check `p` explicitly for these
+    // known value-holding sibling keys.
+    var DYNAMIC_PROPERTY_VALUE_KEYS = ["v", "to"];
+
+    // Recursively redacts secret-shaped values out of a debug message / node
+    // config value. `key` is the property name the value was found under
+    // (undefined for array elements and the top-level value) — used only for
+    // the name-based check. Structural data (numbers, booleans, short
+    // strings, object/array shape) passes through untouched, preserving
+    // diagnostic value.
+    //
+    // currentSettings.redactionEnabled defaults true (settings.json default,
+    // and an empty {} before settings ever load) — explicitly opting OUT via
+    // the type-to-confirm Settings toggle is required to disable this. The
+    // Node-RED credentials field is a SEPARATE, always-on mechanism (dropped
+    // entirely in sanitizeNode's INTERNAL_FIELDS) and is unaffected either way.
+    function redactDebugValue(value, key) {
+        if (currentSettings.redactionEnabled === false) { return value; }
+        if (typeof value === "string") {
+            var kind = matchSecretValue(value);
+            if (kind) { return "[redacted: " + kind + ", " + value.length + " chars]"; }
+            if (key !== undefined && SECRET_KEY.test(String(key)) && value.length > SECRET_NAME_MIN_LEN) {
+                return "[redacted: secret field, " + value.length + " chars]";
+            }
+            return value;
+        }
+        if (Array.isArray(value)) {
+            return value.map(function (v) { return redactDebugValue(v, key); });
+        }
+        if (value && typeof value === "object") {
+            var out = {};
+            var dynamicNameIsSecret = typeof value.p === "string" && SECRET_KEY.test(value.p);
+            Object.keys(value).forEach(function (k) {
+                if (dynamicNameIsSecret && DYNAMIC_PROPERTY_VALUE_KEYS.indexOf(k) !== -1 &&
+                        typeof value[k] === "string" && value[k].length > SECRET_NAME_MIN_LEN) {
+                    out[k] = "[redacted: secret field, " + value[k].length + " chars]";
+                    return;
+                }
+                out[k] = redactDebugValue(value[k], k);
+            });
+            return out;
+        }
+        return value;
+    }
+
+    function truncateForDebug(text, max) {
+        text = String(text);
+        return text.length > max ? text.slice(0, max - 1) + "…" : text;
+    }
+
+    // Best-effort stringify for a debug message's value — may be any type
+    // (string, number, object, undefined for "complete msg" mode where the
+    // value lives one level down, etc.).
+    function stringifyDebugValue(value) {
+        if (typeof value === "string") { return value; }
+        try { return JSON.stringify(value); } catch (e) { return String(value); }
+    }
+
+    // ---- Node-selection sanitizer ------------------------------------------
+    // We read the user's current node selection and build a SANITIZED copy to
+    // send to the AI. Two reasons we never send raw nodes:
+    //   1. Node objects are proxies carrying editor-internal fields (geometry,
+    //      validation state, i18n functions) that waste tokens and mean nothing
+    //      to the model.
+    //   2. Config nodes can hold secrets (broker passwords, API keys). We drop
+    //      anything whose field name looks secret-bearing.
+    // The user only ever sees how many nodes are attached, and nothing is sent
+    // unless they have an active selection — staying within "user-initiated"
+    // and "complete visibility".
+
+    var INTERNAL_FIELDS = {
+        _def: 1, _: 1, changed: 1, moved: 1, dirty: 1, selected: 1, valid: 1,
+        validationErrors: 1, _index: 1, resize: 1, x: 1, y: 1, w: 1, h: 1, l: 1,
+        __outputs: 1, inputs: 1, outputs: 1, g: 1, _config: 1, _orig: 1,
+        credentials: 1
+    };
+
+    function sanitizeNode(n) {
+        var out = {};
+        Object.keys(n).forEach(function (k) {
+            if (INTERNAL_FIELDS[k]) { return; }
+            var v = n[k];
+            if (typeof v === "function") { return; }
+            // A secret-shaped field NAME (password/token/apikey/auth/...) only
+            // means "redact" when the value is itself a string long enough to
+            // plausibly BE a secret. Short strings under such names are usually
+            // enum/selector fields (e.g. an HTTP request node's authType:
+            // "basic"/"bearer"/"digest"/"") — hiding those gives the model no
+            // way to reason about (or fix) auth configuration while protecting
+            // nothing. Real credential VALUES are already excluded entirely via
+            // INTERNAL_FIELDS.credentials.
+            if (currentSettings.redactionEnabled !== false &&
+                    SECRET_KEY.test(k) && typeof v === "string" && v.length > SECRET_NAME_MIN_LEN) {
+                out[k] = "[redacted: secret field, " + v.length + " chars]";
+                return;
+            }
+            // JSON round-trip strips the proxy wrapper and drops anything
+            // non-serializable, leaving plain config values (incl. props).
+            try { v = JSON.parse(JSON.stringify(v)); }
+            catch (e) { out[k] = "[unserializable]"; return; }
+            // Defense-in-depth: catch secrets hiding in objects/arrays under a
+            // secret-shaped name (recurses and redacts only the actual secret
+            // sub-fields), or in an innocuously-named field by value shape
+            // (e.g. a "data" field holding a JWT).
+            out[k] = redactDebugValue(v, k);
+        });
+        // "g" itself (the bare group id) is skipped above like x/y/w/h —
+        // meaningless to the model on its own. But WHICH group a node
+        // belongs to, and that group's name, is real semantic information
+        // (Phase 8.5 C2) — resolve it via RED.nodes.group(), one level
+        // deep only (a node's immediate group, not its ancestor chain if
+        // nested groups are in play). Distinct from buildConnections()'s
+        // "subFlow" numbering below, which is connectivity-based ("are
+        // these wired together"), not an actual visual group.
+        if (n.g && RED.nodes.group) {
+            var grp = RED.nodes.group(n.g);
+            if (grp) { out.group = { id: grp.id, name: grp.name || "" }; }
+        }
+        return out;
+    }

package/lib/core/selection-context.js

@@ -0,0 +1,211 @@
+    // Resolves the node-selection context that would actually be sent right
+    // now: the live canvas selection, or (while an Execute action is armed
+    // with nothing currently selected) the pinned selection from when it was
+    // armed. Used by "Preview JSON" so it can never show different context
+    // than what Send actually uses.
+    function resolveCurrentSelectionContext() {
+        var sel = (RED.view && RED.view.selection) ? RED.view.selection() : null;
+        var liveCount = (sel && sel.nodes) ? sel.nodes.length : 0;
+        if (liveCount > 0) { return collectSelectionContext(); }
+        if (armedExecuteAction && pinnedSelectionIds) {
+            return collectSelectionContext(pinnedSelectionIds);
+        }
+        return null;
+    }
+
+    // Clicking a group's border/background in the editor selects the GROUP
+    // itself — one object, type:"group" — not its members; RED.view.selection()
+    // returns exactly that one entry, same as selecting a single regular
+    // node. For context/counting purposes the user means "everything
+    // inside it," so expand any group entries into their real member
+    // nodes via RED.group.getNodes(group, recursive, excludeGroup) — the
+    // editor's own public API for this (recursive: descend into nested
+    // sub-groups too; excludeGroup: only real nodes in the result, not
+    // the nested group containers themselves — nesting still isn't
+    // authored by FlowPilot, but a member node of one shouldn't vanish
+    // from context just because it's nested one level deeper).
+    // Returns { nodes: [...real nodes, deduped], groupCount } so callers
+    // needing just ids and callers needing the group count (the status
+    // strip) share one expansion instead of two slightly different ones.
+    function expandGroupSelection(rawNodes) {
+        var expanded = [];
+        var seen = {};
+        var groupCount = 0;
+        (rawNodes || []).forEach(function (n) {
+            if (!n) { return; }
+            if (n.type === "group") {
+                groupCount++;
+                var members = (RED.group && RED.group.getNodes) ? RED.group.getNodes(n, true, true) : [];
+                members.forEach(function (m) {
+                    if (m && !seen[m.id]) { seen[m.id] = true; expanded.push(m); }
+                });
+            } else if (!seen[n.id]) {
+                seen[n.id] = true; expanded.push(n);
+            }
+        });
+        return { nodes: expanded, groupCount: groupCount };
+    }
+
+    function pinCurrentSelection() {
+        var sel = (RED.view && RED.view.selection) ? RED.view.selection() : null;
+        var ids = expandGroupSelection((sel && sel.nodes) ? sel.nodes : []).nodes
+            .map(function (n) { return n.id; });
+        if (ids.length) { pinnedSelectionIds = ids; }
+    }
+
+    // The node ids to use for context: the live selection if non-empty,
+    // else the pinned selection from earlier in this armed session (or null
+    // if neither — Generate works fine with no context).
+    function activeSelectionIds() {
+        var sel = (RED.view && RED.view.selection) ? RED.view.selection() : null;
+        var liveIds = (sel && sel.nodes && sel.nodes.length)
+            ? expandGroupSelection(sel.nodes).nodes.map(function (n) { return n.id; })
+            : null;
+        return (liveIds && liveIds.length ? liveIds : null) || pinnedSelectionIds;
+    }
+
+    // ---- Selection context -------------------------------------------------
+    // We read the user's current node selection and build a context payload
+    // to send to the AI: sanitized node configs (sanitizeNode, lib/core/
+    // redaction.js) plus their wiring (buildConnections below). Nothing is
+    // sent unless the user has an active selection — staying within
+    // "user-initiated" and "complete visibility".
+
+    // Build readable connections from the editor's LIVE wiring model.
+    // Important: in the editor, node.wires is NOT populated — that's an
+    // export-time artifact. Live wiring lives as separate link objects, which
+    // RED.view.selection() hands us in sel.links. Each link is already an
+    // explicit edge: { source: <node>, sourcePort: <int>, target: <node> }.
+    // This handles multi-output and multi-input naturally — each is just
+    // another link object.
+    function nodeLabel(n) {
+        if (!n) { return "(unknown node)"; }
+        var nm = (n.name && n.name.length) ? n.name : "(unnamed)";
+        return nm + " [" + n.type + "]";
+    }
+
+    function buildConnections(nodes, links) {
+        var selectedIds = nodes.map(function (n) { return n.id; });
+        links = Array.isArray(links) ? links : [];
+
+        var edges = links.map(function (l) {
+            var srcId = l.source && l.source.id;
+            var tgtId = l.target && l.target.id;
+            return {
+                fromId: srcId,
+                from: nodeLabel(l.source),
+                fromPort: (typeof l.sourcePort === "number") ? l.sourcePort : 0,
+                toId: tgtId,
+                to: nodeLabel(l.target),
+                sourceInSelection: selectedIds.indexOf(srcId) !== -1,
+                targetInSelection: selectedIds.indexOf(tgtId) !== -1
+            };
+        });
+
+        // Group selected nodes into connected sub-flows (undirected connected
+        // components over the links). This turns "are these separate flows?"
+        // from a reasoning task into a lookup for the model. Two nodes share a
+        // group if a link connects them either way; an unlinked selected node
+        // forms its own group.
+        var parent = {};
+        nodes.forEach(function (n) { parent[n.id] = n.id; });
+        function find(x) {
+            while (parent[x] !== x) { parent[x] = parent[parent[x]]; x = parent[x]; }
+            return x;
+        }
+        edges.forEach(function (e) {
+            if (parent[e.fromId] === undefined || parent[e.toId] === undefined) { return; }
+            parent[find(e.fromId)] = find(e.toId);
+        });
+        var rootToGroup = {};
+        var nextGroup = 1;
+        var groupOf = {};
+        nodes.forEach(function (n) {
+            var r = find(n.id);
+            if (rootToGroup[r] === undefined) { rootToGroup[r] = nextGroup++; }
+            groupOf[n.id] = rootToGroup[r];
+        });
+        var subFlowCount = nextGroup - 1;
+
+        // Per-node summary of inputs and outputs, reconstructed from edges so
+        // multi-input nodes are legible without the model cross-referencing.
+        // Each node is tagged with its sub-flow group.
+        var perNode = nodes.map(function (n) {
+            var outs = edges.filter(function (e) { return e.fromId === n.id; })
+                            .map(function (e) { return "port " + e.fromPort + " -> " + e.to; });
+            var ins = edges.filter(function (e) { return e.toId === n.id; })
+                           .map(function (e) { return e.from + " (port " + e.fromPort + ")"; });
+            return { node: nodeLabel(n), subFlow: groupOf[n.id], inputs: ins, outputs: outs };
+        });
+
+        // B4: "edges" and "perNode" otherwise duplicate the same from/to
+        // labels — perNode already carries the readable "Name [type]" labels,
+        // so trim edges down to ids + port + selection flags (the part
+        // perNode doesn't have) to avoid sending the same labels twice.
+        var compactEdges = edges.map(function (e) {
+            return {
+                fromId: e.fromId,
+                fromPort: e.fromPort,
+                toId: e.toId,
+                sourceInSelection: e.sourceInSelection,
+                targetInSelection: e.targetInSelection
+            };
+        });
+
+        return { edges: compactEdges, perNode: perNode, subFlowCount: subFlowCount };
+    }
+
+    // Returns { nodes, connections } or null if nothing selected.
+    // With nodeIds (an array of node ids — e.g. a pinned selection),
+    // builds context from those live nodes via RED.nodes instead of the
+    // current view selection. Nodes that no longer exist are dropped; links
+    // are gathered from the workspace's full link list, same shape as
+    // RED.view.selection().links (sourceInSelection/targetInSelection in
+    // buildConnections still works against this nodeIds set).
+    // Gathers every link touching any node in the given list, scanning the
+    // workspace's full link set directly rather than trusting
+    // RED.view.selection().links — needed whenever the node list didn't
+    // come from a literal click-drag selection (an explicit nodeIds array,
+    // or a group's expanded membership, whose internal wiring was never
+    // part of any selection.links to begin with).
+    function linksTouchingNodes(nodes) {
+        var idSet = nodes.map(function (n) { return n.id; });
+        var links = [];
+        if (RED.nodes.eachLink) {
+            RED.nodes.eachLink(function (l) {
+                var srcId = l.source && l.source.id;
+                var tgtId = l.target && l.target.id;
+                if (idSet.indexOf(srcId) !== -1 || idSet.indexOf(tgtId) !== -1) {
+                    links.push(l);
+                }
+            });
+        }
+        return links;
+    }
+
+    function collectSelectionContext(nodeIds) {
+        var rawNodes, rawLinks;
+        if (Array.isArray(nodeIds)) {
+            rawNodes = nodeIds.map(function (id) { return RED.nodes.node(id); })
+                              .filter(function (n) { return !!n; });
+            if (!rawNodes.length) { return null; }
+            rawLinks = linksTouchingNodes(rawNodes);
+        } else {
+            var sel = (RED.view && RED.view.selection) ? RED.view.selection() : null;
+            var expandedSel = expandGroupSelection((sel && sel.nodes) ? sel.nodes : []);
+            rawNodes = expandedSel.nodes;
+            if (!rawNodes.length) { return null; }
+            // A literal click-drag selection's sel.links already has the
+            // right shape — but it never reflects a SELECTED GROUP's
+            // internal wiring (those nodes were never individually
+            // selected), so gather links directly whenever a group was
+            // part of the selection instead of trusting sel.links.
+            rawLinks = expandedSel.groupCount > 0
+                ? linksTouchingNodes(rawNodes)
+                : ((sel && sel.links) ? sel.links : []);
+        }
+        return {
+            nodes: rawNodes.map(sanitizeNode),
+            connections: buildConnections(rawNodes, rawLinks)
+        };
+    }

package/lib/envelope.js

@@ -0,0 +1,136 @@
+"use strict";
+
+// Envelope parsing (Phase 9 refactor seam 2): pulls the model's JSON
+// envelope out of a raw provider response. Shared by every mode
+// (chat/generate/document/modify/build) via flowpilot.js - this was the
+// source of two cross-mode bugs this project already hit (a brace
+// embedded in prose like "{{payload}}" mistaken for the envelope's start,
+// and a valid-but-unrelated JSON snippet in prose mistaken for the
+// envelope itself), which is exactly the case for keeping this logic in
+// ONE place instead of duplicated per mode.
+//
+// Pure functions, no dependency on anything else in this package -
+// require()'d directly, no special build step needed (unlike the
+// browser-side flowpilot-core.js split, this file already has a real
+// module system).
+
+// Given s[startIdx] === "{", scans forward with brace-depth counting that
+// ignores braces inside string literals (so a value like "{{payload}}"
+// can't be mistaken for structure) to find the index of the MATCHING
+// closing "}". Returns -1 if the braces never balance before the string
+// ends (truncated/malformed input).
+function findMatchingBrace(s, startIdx) {
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  for (let i = startIdx; i < s.length; i++) {
+    const ch = s[i];
+    if (inString) {
+      if (escaped) { escaped = false; }
+      else if (ch === "\\") { escaped = true; }
+      else if (ch === "\"") { inString = false; }
+      continue;
+    }
+    if (ch === "\"") { inString = true; }
+    else if (ch === "{") { depth++; }
+    else if (ch === "}") {
+      depth--;
+      if (depth === 0) { return i; }
+    }
+  }
+  return -1;
+}
+
+function extractJsonObject(text) {
+  if (!text) { throw new Error("Empty response from provider."); }
+  let s = String(text).trim();
+  // Strip markdown code fences if the model wrapped the JSON.
+  s = s.replace(/^```(?:json)?\s*/i, "").replace(/\s*```$/i, "").trim();
+
+  const firstBrace = s.indexOf("{");
+  const firstBracket = s.indexOf("[");
+
+  // The model occasionally returns a bare top-level array (e.g.
+  // `[ {...node...} ]`) instead of the {explanation, flow} envelope. If we
+  // fell through to the {...} extraction below, indexOf("{")/lastIndexOf("}")
+  // would grab just the first node object — which has no "flow" key and
+  // fails validation. Detect this case up front and wrap it as a minimal
+  // envelope instead.
+  if (firstBracket !== -1 && (firstBrace === -1 || firstBracket < firstBrace)) {
+    const lastBracket = s.lastIndexOf("]");
+    if (lastBracket !== -1 && lastBracket > firstBracket) {
+      try {
+        const arr = JSON.parse(s.slice(firstBracket, lastBracket + 1));
+        if (Array.isArray(arr)) {
+          return { explanation: "", flow: arr };
+        }
+      } catch (e) {
+        // Not a parseable array — fall through to the {...} extraction.
+      }
+    }
+  }
+
+  const firstObjIdx = s.indexOf("{");
+  if (firstObjIdx === -1) {
+    // No JSON object found at all — flagged separately from a found-
+    // but-unparseable ({...} present, JSON.parse failed) "garbled" error,
+    // so callers can distinguish "model just answered in prose" (tolerate)
+    // from "model's JSON envelope is broken" (still an error).
+    const err = new Error("Provider did not return a JSON object.");
+    err.noJsonFound = true;
+    throw err;
+  }
+
+  // There may be more than one "{" before the real envelope — e.g. prose
+  // explaining a fix that mentions inline code like "{{payload}}" before
+  // the actual JSON (seen live: a review response started with "The
+  // template node is using `{{payload}}` with...", and slicing from THAT
+  // brace to the envelope's real closing "}" produced unparseable
+  // garbage). Try each candidate "{" in order with string-aware brace
+  // matching (findMatchingBrace, which ignores braces inside quoted
+  // strings) rather than just slicing from the first "{" to the last
+  // "}".
+  //
+  // A candidate must not just PARSE, it must also look like one of the
+  // known envelope shapes (have at least one recognized top-level key) —
+  // seen live: a pure-prose advice response that mentioned structured
+  // logging included the illustrative example
+  // `{"level":"info","event":"trivia_answer","user":"alex","correct":true}`,
+  // which IS valid standalone JSON, so the old "first candidate that
+  // parses wins" rule accepted it as "the envelope" and the caller threw
+  // "no recognizable modify fields" — when the right answer was to treat
+  // the whole reply as prose, since there was no real envelope at all.
+  const ENVELOPE_KEYS = ["explanation", "flow", "question", "changes", "newNodes", "newWires", "removeNodes", "newGroups", "prose"];
+  function looksLikeEnvelope(obj) {
+    if (!obj || typeof obj !== "object" || Array.isArray(obj)) { return false; }
+    return ENVELOPE_KEYS.some(function (k) { return k in obj; });
+  }
+
+  let lastError = null;
+  let searchFrom = firstObjIdx;
+  while (searchFrom !== -1 && searchFrom < s.length) {
+    const end = findMatchingBrace(s, searchFrom);
+    if (end !== -1) {
+      try {
+        const candidate = JSON.parse(s.slice(searchFrom, end + 1));
+        if (looksLikeEnvelope(candidate)) { return candidate; }
+        // Valid JSON, but not envelope-shaped (e.g. an illustrative
+        // example embedded in prose) — keep searching rather than
+        // accepting it.
+      } catch (e) {
+        lastError = e;
+      }
+    }
+    searchFrom = s.indexOf("{", searchFrom + 1);
+  }
+  // No candidate both parsed AND looked like a real envelope — equivalent
+  // to "the model just answered in prose," not "the envelope is broken."
+  // Let callers fall back to rendering this as a normal message instead
+  // of surfacing a parse error (same noJsonFound flag the "no { at all"
+  // branch above uses).
+  const err = lastError || new Error("Provider's JSON object could not be parsed.");
+  err.noJsonFound = true;
+  throw err;
+}
+
+module.exports = { extractJsonObject: extractJsonObject, findMatchingBrace: findMatchingBrace };

package/lib/modify-system-prompt.js

@@ -97,7 +97,7 @@ Rules for "changes" (sparse patches against the existing selection):
 5. Do not include "wires" in "set" unless the instruction explicitly asks to rewire that node's connections.
 6. Never include "id", "x", or "y", or "z" inside "set" — those cannot change via a patch.
 7. An id must not appear in both "changes" and "removeNodes".
-8. A node's "group" field in context (when present) is INFORMATIONAL ONLY — never include "group" as a key inside "set". It has no effect; setting it does nothing and silently fails to change membership. To add/remove/rename a group, use "newGroups" instead (see below) — the ONE exception is renaming/restyling the group ITSELF: target the group's own "id" (from its "group" field) with a "changes" entry, e.g. {"id": "<group's id>", "set": {"name": "New Name"}}.
+8. A node's "group" field in context (when present) is INFORMATIONAL ONLY — never include "group" as a key inside "set". It has no effect; setting it does nothing and silently fails to change membership. To add/remove/rename a group, use "newGroups" instead (see below) — the ONE exception is renaming/restyling the group ITSELF: target the group's own "id" (from its "group" field) with a "changes" entry, e.g. {"id": "<group's id>", "set": {"name": "New Name"}}. Never include "nodes" inside that "set" object, even when renaming — a group's membership can ONLY change via "newGroups", never via "changes".
 
 ---
 
@@ -198,6 +198,7 @@ Each entry: { "id": "<id>", "name": "<optional label>", "nodes": ["<id>", ...] }
 - If a selected node's context included a "group" field (e.g. {"id":"g1","name":"Weather lookup"}), that's an EXISTING group you can extend, shrink, rename, or fully disband — reuse its exact "id" in your entry. Renaming only (no membership change) still needs the same "nodes" list as it has now, with a different "name".
 - To UNGROUP nodes (remove them from their group without deleting them) — e.g. "ungroup this", "take these out of the group" — use this same mechanism: an entry for the EXISTING group's id whose "nodes" list simply OMITS the ones being removed. Removing every current member this way (an empty "nodes": []) disbands the group entirely. This is the ONLY way to change group membership — never try to clear/null a node's "group" field via "changes", that field is informational only and doing so has no effect.
 - To create a BRAND NEW group instead, invent a short placeholder "id" the same way you would for "newNodes" (e.g. "fp-group-0") — the editor assigns its real id. An empty "nodes" only makes sense for an EXISTING group (disbanding it) — a brand new group needs at least one member.
+- To MERGE several existing groups into one: pick ONE of the existing group ids (or a new placeholder) and give it a "nodes" entry listing the UNION of every member across all the groups being merged, then add a SEPARATE "newGroups" entry for each OTHER group being absorbed with an empty "nodes": [] (disbanding it). Always submit ALL of these entries together in the SAME "newGroups" array.
 - A group has no "wires" — groups never pass messages, they're a visual container only.
 
 ---
@@ -243,6 +244,7 @@ You MUST ask a clarifying question when the instruction is too vague to act on s
 - Vague goals like "Improve this", "Optimize this", "Better this" without describing what "better" means
 - Ambiguous requests like "Add something", "Add a node", "Add something to" without specifying what or where
 - The instruction refers to an existing node by description (e.g. "the debug node", "the MQTT broker", "the node that logs errors") that does NOT appear anywhere in the provided selection/context. Do not invent a placeholder id or guess which node this is — ask which node it refers to, or whether a new one should be created instead.
+- The instruction asks you to change a field that appears in context as a \`[redacted: ...]\` placeholder. You cannot propose a meaningful change to a redacted field — any value you propose will either still contain the placeholder (producing an empty diff) or will overwrite the real credential with garbage. Do NOT attempt the change. Instead, tell the user plainly that the field is redacted and must be edited directly in the Node-RED node editor. If you already tried once and saw "No changes detected," the redacted field is the reason — do not repeat the same attempt.
 
 When in doubt, ask. It is better to ask than to make incorrect assumptions.
 

package/lib/storage.js

@@ -58,6 +58,10 @@ function createStorage(userDir) {
     // own hardcoded AGENT_LOOP_MAX_STEPS (a different bound, for a
     // different loop).
     agentLoopMaxIterations: 5,
+    // When true, the build loop pauses at the "attach → review" transition
+    // and shows a checkpoint question ("Continue with AI review, or stop?")
+    // instead of auto-advancing. Default false = original auto-advance behavior.
+    loopHoldStep: false,
     // Lets the user silence the recurring secrets/size reminder bar after
     // typing an explicit acknowledgement in settings.
     suppressContextWarnings: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manny-est/node-red-flowpilot",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "FlowPilot for Node-RED - an AI-powered development assistant sidebar",
   "main": "flowpilot.js",
   "keywords": [
@@ -38,7 +38,6 @@
   "files": [
     "flowpilot.js",
     "flowpilot.html",
-    "flowpilot-core.js",
     "flowpilot-core.css",
     "lib",
     "icons",