@manny-est/node-red-flowpilot 0.4.1 → 0.5.1

package/CHANGELOG.md

@@ -2,6 +2,48 @@
 
 All notable changes to FlowPilot are documented here.
 
+## [0.5.1] - 2026-07-24
+
+### Added
+- **`/refresh` command**: re-renders the entire message panel from an in-memory record store without clearing conversation history. Restores interactive Apply buttons and review panels that may have become stale after a long session or a pop-out sync. Type `/refresh` at any time.
+- **Reasoning model support**: FlowPilot detects reasoning models (Nemotron, DeepSeek, QwQ, and any model returning `reasoning_content` or `<think>` blocks) at pre-flight and handles them correctly throughout. Streaming: a live collapsing "Thinking…" block shows reasoning tokens as they arrive, then auto-collapses when the real response begins. Non-streaming (agent loop): a pre-collapsed thinking block renders alongside the final response. Both the SGLang/Nemotron (`delta.reasoning_content`) and llama.cpp/LocalAI (`<think>…</think>` in `delta.content`) formats are supported. Token count shown on collapse.
+- **Auto-preflight on model change**: changing the model field and sending a message now triggers a silent capability probe before the request goes out — no need to click "Test Provider" after every model switch. A notice appears in the chat thread confirming the probe result (model name, tool support, reasoning flag). Settings are saved automatically as part of the probe so the backend uses the new model. The provider status line also updates live as you type the model name.
+
+### Fixed
+- **Pre-flight `probedModel` not reaching frontend**: after a `/test` run, `probedModel` was saved to disk but never mirrored into the in-memory provider profile, so the auto-probe condition (`probedModel !== currentModel`) could never fire after a page reload. The `/test` response now includes `probedModel` in the `capability` object and `handleSendResult` mirrors it into `currentSettings.providers`.
+- **Reasoning content scrolling**: the live thinking block now scrolls to bottom on each streaming delta so long reasoning chains stay visible as they arrive.
+
+### Internal
+- Phase 10 Workstream 0A: shadow record store added across `main.js`, `apply-review.js`, `modes.js`, `init.js` — addMessage/addModifyReview/addGeneratedReview/renderActionChip/renderClarifyingQuestion/renderLoopCheckpoint/renderLoopStepper all create typed records; rerenderRecord dispatches each kind on refresh.
+- Phase 10 Workstream 0B: DOM elements now carry `data-fp-record-id` (record id) instead of inline JSON payloads in `data-fp-apply-*` attributes. Four separate pop-out bind functions consolidated into a single `bindReviewApplyButtons`; four separate parent postMessage handlers replaced by a unified `applyByRecordId` handler that dispatches on the record's subkind.
+
+## [0.5.0] - 2026-07-06
+
+### Added
+- **Slash autocomplete**: type `/` in the compose box and a panel shows all available commands with descriptions. Arrow keys, Tab, and Enter navigate; Escape dismisses.
+- **Mode-suggestion chips**: FlowPilot detects when you describe a Generate, Modify, or Build task while in a different mode and offers a one-click chip to switch — no need to type the slash command manually. A chip also surfaces after a Generate response if the flow looks like it needs a follow-up Build loop.
+- **Build loop — hold-at-next-step pacing**: a new Settings → Behavior toggle pauses the loop at each waypoint for review instead of auto-advancing. Useful for carefully inspecting each iteration.
+- **Build loop — checkpoint questions**: the loop can now ask a focused clarifying question at any waypoint (e.g. "the debug output shows X — did you mean to test Y?") with prefilled quick-reply options, the same mechanism Modify uses. The loop only continues once you answer.
+- **Build loop — context-aware start**: `/build` now reads your current selection as the starting context (same as `/modify`), letting you target an existing sub-flow to extend or fix rather than always building from scratch.
+- **Build loop — done confirmation**: a "Done" confirmation step with an explicit success/fail verdict now closes the loop instead of silently stopping.
+- **Pop-out — debug log**: the debug log panel is now fully mirrored in the pop-out window, including the "Clear debug" button and the "Attach N to context" indicator.
+- **Pop-out — Recall and flight log**: the Recall panel and flight-log history are now accessible from the pop-out; opening a past conversation or recalling a message works the same as in the main window.
+- **Pop-out — prompt resize handle**: the compose box in the pop-out can now be resized vertically, matching the main window.
+
+### Fixed
+- **Partial id-validation** (`finalizeModifyResult`): a Modify response containing a mix of valid patches and one bad node id no longer rejects the whole response — valid patches are applied and the bad ones are silently dropped. Previously a single unrecognized id caused every change in the batch to be discarded.
+- **Redaction round-trip poisoning** (issue #7): when a Modify request targets a field that FlowPilot redacted (e.g. an HTTP Authorization header), the model's response — echoing back the `[redacted: ...]` placeholder — previously produced a silent empty diff. Now the diff step recognises placeholder values, skips those fields, and if ALL proposed changes were redacted-field-only, shows an explicit warning explaining the limitation and instructing the user to edit that field directly in the node editor.
+- **Token credential redaction**: `Authorization: Token <value>` headers (used by Django REST Framework and similar APIs) were not caught by the existing bearer-token pattern and could be sent to the model in plain text. The `Token <credential>` form is now recognised as a separate pattern.
+- **Recursive sentinel check**: `isSanitizeSentinel` now walks into nested arrays and objects, so a placeholder buried inside a list property (e.g. `rules[0].v`) is correctly detected and skipped instead of producing a spurious empty diff.
+- **Group data corruption**: a plain `changes` patch could reach the `nodes` membership array of a group container (since context exposes it as a plain field), overwriting the live group membership with a stringified copy. The `nodes` array is now in `DIFF_SKIP` so Modify patches never touch it directly.
+- **Group create/extend on mixed-membership selections**: creating or extending a group when the selection contained nodes from more than one existing group (or some grouped and some ungrouped) could silently fail or corrupt membership. The membership reconciliation step now handles the mixed case correctly.
+- **Invalid port wiring**: FlowPilot now guards against wiring to or from a port index that doesn't exist on a node (e.g. connecting output 3 of a node that only has 2 outputs) — the bad wire is skipped with a warning instead of being applied and then causing a Node-RED canvas error.
+- **Pop-out — settings auth failure**: opening Settings from the pop-out could fail with a 404 or 401 in certain auth configurations because the settings request was issued from the pop-out's nested route rather than through the main window. All settings reads and writes are now relayed through the parent window.
+- **Pop-out — recall and flight-log relay**: recall and flight-log API calls are now relayed through the parent window so they resolve correctly from the pop-out.
+
+### Internal
+- Phase 9 refactor complete: `flowpilot-core.js` is now assembled at runtime from focused fragments under `lib/core/` (redaction, history, markdown, selection-context, apply-review, modes, main, init). The assembled script is functionally identical to the old single file; the split is purely for maintainability.
+
 ## [0.4.1] - 2026-06-29
 
 ### Fixed

package/PROJECT-OVERVIEW.md

@@ -115,13 +115,13 @@ including every step of the `/build` loop and every group mutation.
 
 - **`flowpilot.html`** — the editor-side plugin entry point: registers the
   sidebar panel and loads the shared client module below.
-- **`flowpilot-core.js`** — the shared client logic (chat/generate/modify/
-  document/build, selection/context handling, settings UI, diff review and
-  apply, group mutations) — used by both the sidebar and the pop-out window,
-  so they stay in sync by construction rather than by copy-pasted code.
-  Served via a dedicated static route alongside the pop-out's own minimal
-  page (`lib/popout/view.html`), which loads this same module and relays
-  state to/from the main editor window over `postMessage`.
+- **`lib/core/*.js`** — the shared client logic, split into focused fragments
+  (redaction, history, markdown, selection-context, apply-review, modes, main,
+  init) and assembled at request time by `lib/build-core-script.js` into one
+  complete IIFE served at `/flowpilot/core.js`. Used by both the sidebar and
+  the pop-out window so they stay in sync by construction. The pop-out's
+  minimal page (`lib/popout/view.html`) loads this same assembled module and
+  relays state to/from the main editor window over `postMessage`.
 - **`flowpilot.js`** — the Node-RED runtime plugin: HTTP routes
   (`/flowpilot/*`), provider calls, response parsing/validation, and audit
   logging.

package/README.md

@@ -93,26 +93,32 @@ See the [User Guide](USER-GUIDE.md#privacy-and-safety) for the full details.
 
 Node-RED 4.x and 5.x, tested. Node.js 16+.
 
-## Install in a local Node-RED user directory
+## Install
 
-From your Node-RED user directory:
+In the Node-RED editor: **Menu → Manage palette → Install**, search for
+`@manny-est/node-red-flowpilot`, and click **Install**.
+
+Or, from your Node-RED user directory:
 
 ```bash
 cd ~/.node-red
-npm install /path/to/node-red-flowpilot
+npm install @manny-est/node-red-flowpilot
 node-red
 ```
 
-For a Docker/container setup, place or install the package inside the
-mounted Node-RED user directory. If your user directory is
-`/data` (or `/workspaces/nodered`, etc.), this folder should exist:
+Restart Node-RED (or the container) after installing or updating — FlowPilot's
+editor UI is cached server-side, so a browser refresh alone is not enough.
+
+For a Docker/container setup, install into the mounted Node-RED user directory.
+If your user directory is `/data` (or `/workspaces/nodered`, etc.), this folder
+should exist:
 
 ```text
 <node-red-userDir>/node_modules/@manny-est/node-red-flowpilot
 ```
 
-Restart the Node-RED container/process after installing or updating —
-plugin HTML is cached server-side, so a browser refresh alone is not enough.
+Restart the Node-RED container/process after updating the package files
+directly — the plugin server caches assembled scripts in memory.
 
 FlowPilot stores its own settings and logs separately from the plugin code,
 under `<node-red-userDir>/flowpilot/`:

package/USER-GUIDE.md

@@ -212,14 +212,23 @@ and apply like any other change.
 ### Build (the agentic loop)
 
 Describe a goal (e.g. "fetch the weather every hour and log it to a file")
-and arm **Build**, or type `/build <goal>` directly. FlowPilot plans the
-work, proposes a first flow, and once you apply and deploy it, walks an
-interactive loop with you: attach the resulting Debug output, FlowPilot
-reviews it against the goal, and either confirms it's working or proposes a
-fix — repeating until it works or a configurable attempt limit is reached
-(**Settings → Behavior → Build loop iteration cap**). Every proposal and fix
-still goes through the same review-then-apply flow as Modify — FlowPilot
-never deploys for you.
+and arm **Build**, or type `/build <goal>` directly. If you have nodes
+selected, FlowPilot uses them as the starting context (like Modify) — useful
+for targeting an existing sub-flow to extend or fix.
+
+FlowPilot plans the work, proposes a first flow, and once you apply and
+deploy it, walks an interactive loop: attach the resulting Debug output,
+FlowPilot reviews it against the goal, and either confirms it's working
+(with a Done confirmation showing the debug output that proved success) or
+proposes a fix — repeating until it works or a configurable attempt limit is
+reached (**Settings → Behavior → Build loop iteration cap**). At any waypoint
+FlowPilot may ask a focused clarifying question with quick-reply buttons
+before continuing. Every proposal and fix still goes through the same
+review-then-apply flow as Modify — FlowPilot never deploys for you.
+
+**Hold at next step** (**Settings → Behavior**): when enabled, the loop pauses
+at each waypoint for you to review before auto-advancing — useful for
+careful, step-by-step inspection of each iteration.
 
 ### Document
 
@@ -263,13 +272,18 @@ them from there or by clicking **Clear chat**.
 
 ![A debug message attached, shown in the status strip](https://github.com/manny-est/flowpilot/releases/download/v0.2.1/debug-log-attached.png)
 
-### Action chips
+### Action chips and mode suggestions
 
 When FlowPilot's reply describes a change you could make, it may offer an
 action chip — a one-click button that switches to the suggested mode
 (Generate/Modify/Document/Chat) with the request pre-filled. Nothing is sent
 until you review and hit Send yourself.
 
+FlowPilot also watches what you type: if your prompt reads like a Generate,
+Modify, or Build task but a different mode is armed, it surfaces a suggestion
+chip below the reply so you can switch with one click instead of typing the
+slash command manually.
+
 ![A reply with an action chip below it](https://github.com/manny-est/flowpilot/releases/download/v0.2.1/action-chip.png)
 
 ![The full chat thread leading up to an action chip](https://github.com/manny-est/flowpilot/releases/download/v0.2.1/action-chip-full.png)
@@ -303,7 +317,9 @@ Behavior → Stream chat replies**.
 
 ### Slash commands
 
-Type these directly into the prompt box:
+Type `/` in the prompt box to see a floating panel listing all available
+commands with descriptions. Arrow keys or Tab to highlight, Enter or Tab to
+complete, Escape to dismiss.
 
 - `/help` — show the full command/feature briefing
 - `/generate`, `/document`, `/modify`, `/build` — arm that Execute mode
@@ -312,6 +328,7 @@ Type these directly into the prompt box:
 - `/history` — open the Flight log
 - `/settings` — open Settings
 - `/demo` — load a sample Generate request into the prompt box
+- `/feedback` — links to the repo and issue tracker
 - `/compact` / `/expand` — hide/restore labels on the selected node(s),
   instant and deterministic, no AI round-trip
 - `/disable` / `/enable` — disable/re-enable the selected node(s) (skipped on

package/flowpilot-core.css

@@ -103,6 +103,65 @@
     border-color: rgba(80, 130, 255, 0.35);
 }
 
+/* Reasoning / thinking block — shown for models that emit reasoning_content
+   (e.g. Nemotron, DeepSeek-R1). Sits above the assistant response bubble.
+   Expanded while the model thinks; collapses automatically when content starts. */
+.fp-thinking {
+    margin-bottom: 8px;
+    border-radius: 8px;
+    border: 1px solid rgba(120, 100, 220, 0.25);
+    background: rgba(100, 80, 200, 0.05);
+    overflow: hidden;
+}
+
+.fp-thinking summary {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    padding: 7px 12px;
+    cursor: pointer;
+    font-size: 11px;
+    font-weight: 600;
+    letter-spacing: 0.04em;
+    color: var(--red-ui-secondary-text-color, #888);
+    user-select: none;
+    list-style: none;
+}
+
+.fp-thinking summary::-webkit-details-marker { display: none; }
+
+.fp-thinking summary::before {
+    content: "▶";
+    font-size: 8px;
+    display: inline-block;
+    transition: transform 0.15s ease;
+    color: var(--red-ui-secondary-text-color, #aaa);
+    flex-shrink: 0;
+}
+
+.fp-thinking[open] summary::before {
+    transform: rotate(90deg);
+}
+
+.fp-thinking-tokens {
+    margin-left: auto;
+    font-size: 10px;
+    font-weight: 400;
+    opacity: 0.55;
+}
+
+.fp-thinking-body {
+    padding: 4px 12px 10px 12px;
+    font-family: monospace;
+    font-size: 11px;
+    line-height: 1.5;
+    color: var(--red-ui-secondary-text-color, #999);
+    opacity: 0.8;
+    white-space: pre-wrap;
+    max-height: 180px;
+    overflow-y: auto;
+}
+
 .fp-error {
     background: rgba(255, 80, 80, 0.12);
     border-color: rgba(255, 80, 80, 0.65);
@@ -1056,6 +1115,50 @@
     background: rgba(127, 127, 127, 0.15);
 }
 
+/* Slash-command autocomplete panel */
+#fp-slash-suggest {
+    position: absolute;
+    bottom: 100%;
+    left: 0;
+    right: 0;
+    margin-bottom: 4px;
+    background: var(--red-ui-primary-background, #fff);
+    border: 1px solid var(--red-ui-form-input-border-color, #ccc);
+    border-radius: 6px;
+    box-shadow: 0 4px 12px rgba(0, 0, 0, 0.12);
+    overflow: hidden;
+    z-index: 100;
+}
+
+.fp-slash-row {
+    display: flex;
+    align-items: baseline;
+    gap: 10px;
+    padding: 6px 10px;
+    cursor: pointer;
+    user-select: none;
+}
+
+.fp-slash-row:hover,
+.fp-slash-row.fp-slash-active {
+    background: var(--red-ui-secondary-background, #f5f5f5);
+}
+
+.fp-slash-cmd {
+    font-weight: 600;
+    font-size: 13px;
+    min-width: 90px;
+    color: var(--red-ui-primary-text-color, #333);
+}
+
+.fp-slash-desc {
+    font-size: 12px;
+    color: var(--red-ui-secondary-text-color, #777);
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+}
+
 #fp-provider-status {
     flex: 0 1 auto;
     min-width: 0;