@manny-est/node-red-flowpilot 0.5.1 → 0.5.2

package/lib/core/modes.js

@@ -812,15 +812,20 @@
         var flow = Array.isArray(data.flow) ? layoutGeneratedFlow(data.flow) : data.flow;
         addMessage("assistant", data.explanation || "(no explanation returned)");
         pushHistory("assistant", data.explanation || "(no explanation returned)");
-        addGeneratedReview(flow);
-        // After any Generate result, offer the deploy-verify loop as a one-click
-        // option. Only shown when no loop is already running and the original
-        // prompt is available (it always is here — goalPrompt comes from the
-        // compose box value captured at send time via wrappedOnResult).
-        if (goalPrompt && !activeBuildLoop) {
-            renderActionChip({ mode: "build", prompt: goalPrompt, customTitle: "Run deploy-verify loop on this →" });
-        }
-        renderActionChip(data.suggestedAction);
+        // B1: bake the deploy-verify option into the review panel as the
+        // primary chip rather than a separate chip below it. Only for
+        // executable flows (not documentation-only comment nodes) and when no
+        // loop is already active. The secondary "Just add to canvas" button is
+        // always shown alongside it as an escape hatch.
+        var _hasDeployable = flow.some(function (n) { return n && n.type !== "comment" && n.type !== "group"; });
+        var _buildOnImported = (goalPrompt && !activeBuildLoop && _hasDeployable)
+            ? function (importResult) { startBuildLoop(goalPrompt, flow, importResult); }
+            : null;
+        addGeneratedReview(flow, _buildOnImported, _buildOnImported ? goalPrompt : null);
+        // Suppress a server-suggested build chip when deploy-verify is already
+        // the primary action inside the review panel — it would be a duplicate.
+        renderActionChip(_buildOnImported && data.suggestedAction && data.suggestedAction.mode === "build"
+            ? null : data.suggestedAction);
         setBusy(false);
         updateSelectionStatus();
     }
@@ -831,10 +836,41 @@
         hidePending();
         if (renderQuestionOrProse(data)) { return; }
 
+        // W4: parse and surface the Plan: block if present.
+        var planItems = parseTodoPlan(data.explanation || "");
+        var todoRec = null;
+        if (planItems.length) {
+            // Verification only produces one aggregate pass/fail result for
+            // the whole Modify response — mark every item active up front so
+            // they all resolve together instead of leaving items 2+ stuck at
+            // "pending" forever (only item 1 would ever flip otherwise).
+            planItems.forEach(function (item) { item.status = "active"; });
+            todoRec = addRecord("todo", { action: "modify", items: planItems });
+            rerenderTodoRecord(todoRec);
+        }
+
         addMessage("assistant", data.explanation || "(no explanation returned)");
         pushHistory("assistant", data.explanation || "(no explanation returned)");
         if (data.skippedNote) { addMessage("assistant", "⚠ " + data.skippedNote); }
-        addModifyReview(data.flow, data.newNodes || [], data.newWires || [], data.removeNodes || [], applyModifications, null, data.newGroups || []);
+
+        // W4 Phase 2: wrap apply to run a real graph read-back via
+        // verifySteps (Track A, server) instead of unconditionally marking
+        // the todo done. Falls back to the Phase 1 behavior (check off with
+        // no verification) when the server sent no verifySteps.
+        var verifySteps = Array.isArray(data.verifySteps) ? data.verifySteps : [];
+        var applyCallback = todoRec ? function(nodeDiffs, removeNodes, $btn, idMap) {
+            applyModifications(nodeDiffs, removeNodes, $btn, idMap);
+            if (verifySteps.length) {
+                verifyModifySteps(verifySteps, idMap, todoRec);
+            } else {
+                todoRec.items.forEach(function(item) {
+                    if (item.status === "active") { item.status = "done"; }
+                });
+                rerenderTodoRecord(todoRec);
+            }
+        } : applyModifications;
+
+        addModifyReview(data.flow, data.newNodes || [], data.newWires || [], data.removeNodes || [], applyCallback, null, data.newGroups || []);
         renderActionChip(data.suggestedAction);
         setBusy(false);
         updateSelectionStatus();
@@ -1055,8 +1091,272 @@
         ajaxJson("POST", fullEndpoint, payload, wrappedOnResult, onError);
     }
 
+    // W4: parse a "Plan:" block from the model's explanation field.
+    // Returns an array of { text, status } items, or [] if none found.
+    // Each numbered/bulleted line under "Plan:" up to the first blank line
+    // becomes one item. Status starts as "pending" for all items — the
+    // caller sets the first to "active" before rendering.
+    function parseTodoPlan(explanation) {
+        if (!explanation || typeof explanation !== "string") { return []; }
+        var planStart = explanation.indexOf("Plan:");
+        if (planStart === -1) { return []; }
+        var afterPlan = explanation.slice(planStart + 5);
+        var planBlock = afterPlan.split(/\n\n/)[0];
+        var lines = planBlock.split("\n");
+        var items = [];
+        lines.forEach(function (line) {
+            var stripped = line.replace(/^\s*\d+[.):\s]+/, "").replace(/^\s*[-*]\s+/, "").trim();
+            if (stripped) { items.push({ text: stripped, status: "pending" }); }
+        });
+        return items;
+    }
+
+    // W4: render or re-render a "todo" record. For a 1-item plan, renders
+    // as a compact status line (one chip). For N>1 items, renders as a
+    // checklist card. Updates in place when the record already has a
+    // data-fp-todo-id element in the message box (e.g. on verify check-off).
+    function rerenderTodoRecord(rec) {
+        if (!rec || !rec.items) { return; }
+        var $box = el("#fp-messages");
+        if (!$box.length) { return; }
+        var items = rec.items;
+        var $existing = $box.find("[data-fp-todo-id='" + rec.id + "']");
+
+        var $wrap;
+        if (items.length === 1) {
+            var item = items[0];
+            var icon = item.status === "done" ? "✓" : item.status === "failed" ? "✗" : "▶";
+            $wrap = $("<div>")
+                .addClass("fp-todo-status fp-todo-" + item.status)
+                .attr("data-fp-todo-id", rec.id)
+                .text(icon + " " + item.text);
+        } else {
+            $wrap = $("<div>")
+                .addClass("fp-todo-card")
+                .attr("data-fp-todo-id", rec.id);
+            var $ul = $("<ul>").addClass("fp-todo-list");
+            items.forEach(function (item) {
+                var icon = item.status === "done" ? "✓" :
+                           item.status === "failed" ? "✗" :
+                           item.status === "active" ? "▶" : "○";
+                $("<li>")
+                    .addClass("fp-todo-item fp-todo-item-" + item.status)
+                    .text(icon + " " + item.text)
+                    .appendTo($ul);
+            });
+            $wrap.append($ul);
+        }
+
+        if ($existing.length) {
+            $existing.replaceWith($wrap);
+        } else {
+            $box.append($wrap);
+        }
+    }
+
+    // Step-queue path for Generate (opt-in via enableStepQueue setting).
+    // After the user clicks "Add to workspace", performs a synchronous graph
+    // read-back — calls RED.nodes.node(id) for every node that landed on the
+    // canvas — and surfaces the result as a verification notice. This is the
+    // structural verification step for Generate: "did the import actually land?"
+    // not "does it do the thing?" (that's the semantic loop, Build's domain).
+    // Skips comment and group nodes — those aren't addressable via RED.nodes.node.
+    // todoRec: optional todo record to check off (or fail) after verification.
+    function verifyImportedNodes(importResult, todoRec) {
+        if (!importResult || !importResult.nodeMap) { return; }
+        var nodeMap = importResult.nodeMap;
+        var total = 0, found = 0, missing = [];
+        // Config nodes (e.g. an http-request's TLS config, an mqtt broker
+        // config) ride along in nodeMap whenever the model's own `flow`
+        // array included them, but they aren't part of what the user asked
+        // for — RED.nodes.node() resolves them same as regular nodes (it
+        // checks configNodes[id] before falling back), so left uncounted
+        // they'd silently inflate the headline total (e.g. "8" instead of
+        // "5"). Track and verify them separately instead.
+        var configTotal = 0, configFound = 0;
+        // Node-RED's own RED.nodes.import (the generateIds:true path used
+        // for every Generate/Build import) keys nodeMap TWICE per imported
+        // node: once under the model's own placeholder id (assigned while
+        // constructing the node, before it's added to the live registry)
+        // and again under the freshly-generated real editor id (assigned in
+        // the final addNode/addGroup/addJunction registration loop) — both
+        // entries point to the same live node object. Left undeduped this
+        // doubles every count here (visible AND config alike), independent
+        // of the config/visible split above. Confirmed by reading
+        // @node-red/editor-client/public/red/red.js's importNodes directly.
+        var seenLiveIds = {};
+        Object.keys(nodeMap).forEach(function (pid) {
+            var liveNode = nodeMap[pid];
+            if (!liveNode || !liveNode.id) { return; }
+            if (seenLiveIds[liveNode.id]) { return; }
+            seenLiveIds[liveNode.id] = true;
+            if (liveNode.type === "comment" || liveNode.type === "group") { return; }
+            if (liveNode._def && liveNode._def.category === "config") {
+                configTotal++;
+                if (RED.nodes.node(liveNode.id)) { configFound++; }
+                return;
+            }
+            total++;
+            if (RED.nodes.node(liveNode.id)) {
+                found++;
+            } else {
+                missing.push(liveNode.type || pid);
+            }
+        });
+        var configMissing = configTotal - configFound;
+        var allGood = total > 0 && missing.length === 0 && configMissing === 0;
+        if (total === 0) {
+            // Nothing user-visible to verify (only comments/groups/config
+            // nodes) — skip notice.
+        } else if (allGood) {
+            var configSuffix = configTotal > 0
+                ? " (+" + configTotal + " supporting config node(s))"
+                : "";
+            addMessage("fp-notice", "✓ Verified: all " + found + " node(s) confirmed on canvas" + configSuffix + ".");
+        } else {
+            var allMissing = missing.slice();
+            if (configMissing > 0) { allMissing.push(configMissing + " config node(s)"); }
+            addMessage("fp-notice", "⚠ Verification: " + found + "/" + total + " node(s) on canvas — " +
+                allMissing.length + " not found after import (" + allMissing.join(", ") + "). " +
+                "These may be uninstalled node types that were silently dropped.");
+        }
+        // Check off (or fail) the active todo item.
+        if (todoRec && todoRec.items) {
+            todoRec.items.forEach(function (item) {
+                if (item.status === "active") { item.status = allGood ? "done" : "failed"; }
+            });
+            rerenderTodoRecord(todoRec);
+        }
+    }
+
+    // W4 Phase 2: real graph read-back verification for Modify, using the
+    // server-derived verifySteps (Track A — property/exists/absent/wire
+    // checks; see finalizeModifyResult in flowpilot.js). Mirrors
+    // verifyImportedNodes's design for Generate: aggregate pass/fail across
+    // all steps, surface one notice, and check off (or fail) the active
+    // todo item. idMap resolves the response-time placeholder ids that
+    // existence/wire checks on newly-inserted nodes carry (the server can't
+    // know the browser-assigned id at response time — applyInsertions
+    // assigns it and returns idMap). Property/absent checks already use
+    // real existing-node ids, so idMap[id] simply misses and falls through
+    // to the id unchanged.
+    function verifyModifySteps(verifySteps, idMap, todoRec) {
+        if (!Array.isArray(verifySteps) || !verifySteps.length) { return; }
+        idMap = idMap || {};
+        function resolve(id) { return (idMap && idMap[id]) || id; }
+
+        var total = 0, passed = 0, failures = [];
+        verifySteps.forEach(function (step) {
+            var ok = false;
+            switch (step.check) {
+            case "property": {
+                var pNode = RED.nodes.node(resolve(step.nodeId));
+                ok = !!pNode && pNode[step.prop] === step.expected;
+                if (!ok) { failures.push((step.prop || "property") + " on " + step.nodeId); }
+                break;
+            }
+            case "exists": {
+                ok = !!RED.nodes.node(resolve(step.nodeId));
+                if (!ok) { failures.push(step.nodeId + " missing"); }
+                break;
+            }
+            case "absent": {
+                ok = !RED.nodes.node(resolve(step.nodeId));
+                if (!ok) { failures.push(step.nodeId + " still present"); }
+                break;
+            }
+            case "wire": {
+                // Read from the live link registry (RED.nodes.eachLink), not
+                // node.wires — RED.nodes.addLink/removeLink never re-sync a
+                // live node's own .wires array mid-session (it's only set at
+                // import and recomputed at export), so fromNode.wires[port] is
+                // stale for any wire added/removed during the current editing
+                // session. Mirrors computeWireDiff (apply-review.js).
+                var fromId = resolve(step.fromId);
+                var toId = resolve(step.toId);
+                var port = step.fromPort || 0;
+                ok = false;
+                RED.nodes.eachLink(function (l) {
+                    if (ok) { return; }
+                    if (l.source && l.source.id === fromId &&
+                            (l.sourcePort || 0) === port &&
+                            l.target && l.target.id === toId) {
+                        ok = true;
+                    }
+                });
+                if (!ok) { failures.push("wire " + step.fromId + " → " + step.toId); }
+                break;
+            }
+            default:
+                return; // unrecognized check type — don't count it either way
+            }
+            total++;
+            if (ok) { passed++; }
+        });
+
+        if (total === 0) { return; }
+        var allGood = failures.length === 0;
+        if (allGood) {
+            addMessage("fp-notice", "✓ Verified: all " + passed + " change(s) confirmed on canvas.");
+        } else {
+            addMessage("fp-notice", "⚠ Verification: " + passed + "/" + total + " change(s) confirmed — " +
+                failures.length + " did not land as expected (" + failures.join(", ") + ").");
+        }
+        if (todoRec && todoRec.items) {
+            todoRec.items.forEach(function (item) {
+                if (item.status === "active") { item.status = allGood ? "done" : "failed"; }
+            });
+            rerenderTodoRecord(todoRec);
+        }
+    }
+
+    function handleStepQueueGenerateResult(data, goalPrompt) {
+        hidePending();
+        if (renderQuestionOrProse(data)) { return; }
+        var flow = Array.isArray(data.flow) ? layoutGeneratedFlow(data.flow) : data.flow;
+
+        // Build the todo plan. Parse "Plan:" from explanation if present;
+        // fall back to an implicit single item from the goal prompt.
+        var planItems = parseTodoPlan(data.explanation || "");
+        if (!planItems.length) {
+            planItems = [{ text: goalPrompt || "Generate flow", status: "pending" }];
+        }
+        // Same aggregate-verification reasoning as the Modify path: mark
+        // every item active up front so a multi-item plan resolves together.
+        planItems.forEach(function (item) { item.status = "active"; });
+        var todoRec = addRecord("todo", { action: "generate", items: planItems });
+        rerenderTodoRecord(todoRec);
+
+        addMessage("assistant", data.explanation || "(no explanation returned)");
+        pushHistory("assistant", data.explanation || "(no explanation returned)");
+        // B1: when a build loop is appropriate, bake deploy-verify into the
+        // primary chip (same as handleSimpleGenerationResult). The callback
+        // also runs verifyImportedNodes so the todo record still gets checked
+        // off. Without a build loop, fall back to a plain "Add to canvas"
+        // button that still fires the verify callback.
+        var _hasDeployable = flow.some(function (n) { return n && n.type !== "comment" && n.type !== "group"; });
+        var _wantLoop = goalPrompt && !activeBuildLoop && _hasDeployable;
+        var _onImported = _wantLoop
+            ? function (importResult) {
+                verifyImportedNodes(importResult, todoRec);
+                startBuildLoop(goalPrompt, flow, importResult);
+            }
+            : function (importResult) { verifyImportedNodes(importResult, todoRec); };
+        addGeneratedReview(flow, _onImported, _wantLoop ? goalPrompt : null);
+        // Suppress a server-suggested build chip when deploy-verify is already
+        // the primary action inside the review panel.
+        renderActionChip(_wantLoop && data.suggestedAction && data.suggestedAction.mode === "build"
+            ? null : data.suggestedAction);
+        setBusy(false);
+        updateSelectionStatus();
+    }
+
     function generate() {
-        runGenerateLikeAction("generate", "generate", "Generate: ", handleSimpleGenerationResult);
+        if (currentSettings.enableStepQueue) {
+            runGenerateLikeAction("generate", "generate", "Generate: ", handleStepQueueGenerateResult);
+        } else {
+            runGenerateLikeAction("generate", "generate", "Generate: ", handleSimpleGenerationResult);
+        }
     }
 
     // /build's first step. Reuses Generate's pipeline wholesale for the
@@ -1165,6 +1465,127 @@
         updateSelectionStatus();
     }
 
+    // WS4: real consent gate for side-effecting build steps. Renders one
+    // combined chip covering every side-effecting node this step's
+    // classification found (classifyFlowNodes in flowpilot.js, server-side)
+    // — a single decision rather than per-node chips, which is sufficient
+    // because only the FIRST /flowpilot/build response carries
+    // stepNodeClasses today (fix iterations via /flowpilot/modify don't, so
+    // there's exactly one consent point per loop lifetime under the current
+    // limitation — see the handleBuildResult call site).
+    //
+    // Reconstructed entirely from `src` (plain data, never a live closure)
+    // on every call — the initial render from handleBuildResult AND every
+    // later rerender (refresh, pop-out reopen, the W0A idle/focus
+    // auto-refresh) via rerenderRecord's buildConsentGate branch below.
+    // Mirrors rerenderReviewRecord's pattern in apply-review.js: a fresh
+    // record is added each time from the source's stored fields (including
+    // `decision`, once made), rather than relying on an in-memory callback
+    // surviving a refresh. That in-memory-callback version is exactly what
+    // broke before this fix — a refresh mid-decision fell through to
+    // renderClarifyingQuestion's generic path, whose buttons send the
+    // clicked label as a new chat message instead of resolving Proceed/Skip,
+    // permanently stranding the loop.
+    //
+    // src fields: sideEffecting, flow, goalPrompt, fpUidManifest,
+    // suggestedAction — everything runBuildConsentDecision needs — plus,
+    // once resolved, `decision` ("proceed"|"skip") so a later rerender shows
+    // a settled state instead of re-offering an already-made choice.
+    function renderBuildConsentGate(src) {
+        var $box = el("#fp-messages");
+        if (!$box.length) {
+            if (!src.decision) { runBuildConsentDecision(src, true); }
+            return;
+        }
+
+        var _rec = addRecord("question", {
+            buildConsentGate: true,
+            options: ["Auto-verify", "I'll check myself"],
+            sideEffecting: src.sideEffecting,
+            flow: src.flow,
+            goalPrompt: src.goalPrompt,
+            fpUidManifest: src.fpUidManifest,
+            suggestedAction: src.suggestedAction,
+            decision: src.decision
+        });
+
+        var sideEffecting = Array.isArray(_rec.sideEffecting) ? _rec.sideEffecting : [];
+        var labels = sideEffecting.map(function (n) { return n.name || n.type; }).join(", ");
+
+        if (_rec.decision) {
+            // Already resolved before this render (e.g. resolved earlier in
+            // the session, now showing again after a refresh) — settled
+            // state, not an interactive choice.
+            addMessage("assistant", "This step calls an external service: " + labels + ".");
+            var $settledRow = $("<div>").addClass("fp-chip-row fp-question-row");
+            $("<button>")
+                .addClass("fp-consent-chip")
+                .addClass(_rec.decision === "proceed" ? "fp-consent-chip-primary" : "fp-consent-chip-alt")
+                .attr("type", "button").prop("disabled", true)
+                .text(_rec.decision === "proceed" ? "Auto-verify ✓" : "Checking myself ✓")
+                .appendTo($settledRow);
+            $box.append($settledRow);
+            scrollMessagesToBottom();
+            return;
+        }
+
+        addMessage("assistant", "This step calls an external service: " + labels +
+            ". Want it verified automatically once triggered, or would you rather check it yourself?");
+
+        var $row = $("<div>").addClass("fp-chip-row fp-question-row");
+
+        function decide(proceed) {
+            $row.find("button").prop("disabled", true);
+            _rec.decision = proceed ? "proceed" : "skip";
+            runBuildConsentDecision(_rec, proceed);
+        }
+
+        $("<button>")
+            .addClass("fp-consent-chip fp-consent-chip-primary")
+            .attr("type", "button")
+            .text("Auto-verify")
+            .on("click", function () { decide(true); })
+            .appendTo($row);
+        $("<button>")
+            .addClass("fp-consent-chip fp-consent-chip-alt")
+            .attr("type", "button")
+            .text("I'll check myself")
+            .on("click", function () { decide(false); })
+            .appendTo($row);
+
+        $box.append($row);
+        scrollMessagesToBottom();
+    }
+
+    // The actual "proceed with review + loop" action, factored out so both
+    // the fresh (no side-effecting nodes) and gated (decision made) paths in
+    // handleBuildResult, and a rerendered consent-gate record's decide(),
+    // all run identical logic sourced from plain data — never a captured
+    // closure. consentGranted=false builds the Skip consent object
+    // (skippedNodeIds/fpUidManifest) that startBuildLoop resolves into real
+    // ids via importResult.nodeMap — see startBuildLoop's own comment.
+    function runBuildConsentDecision(src, consentGranted) {
+        var sideEffecting = Array.isArray(src.sideEffecting) ? src.sideEffecting : [];
+        var flow = src.flow;
+        var goalPrompt = src.goalPrompt;
+        var fpUidManifest = Array.isArray(src.fpUidManifest) ? src.fpUidManifest : [];
+
+        if (sideEffecting.length > 0) {
+            var sideLabels = sideEffecting.map(function (n) { return n.name || n.type; }).join(", ");
+            addMessage("fp-notice", consentGranted
+                ? "⚠ External calls: " + sideLabels + " — the deploy-test loop will auto-verify these once triggered."
+                : "⚠ External calls: " + sideLabels + " — auto-verify skipped for these node(s); confirm the result yourself.");
+        }
+        var consent = consentGranted ? null : {
+            skippedNodeIds: sideEffecting.map(function (n) { return n.id; }),
+            fpUidManifest: fpUidManifest
+        };
+        addGeneratedReview(flow, function (importResult) {
+            startBuildLoop(goalPrompt, flow, importResult, consent);
+        }, goalPrompt);
+        renderActionChip(src.suggestedAction);
+    }
+
     function handleBuildResult(data, goalPrompt) {
         hidePending();
         if (renderQuestionOrProse(data)) { return; }
@@ -1173,8 +1594,24 @@
         var flow = Array.isArray(data.flow) ? layoutGeneratedFlow(data.flow) : data.flow;
         addMessage("assistant", data.explanation || "(no explanation returned)");
         pushHistory("assistant", data.explanation || "(no explanation returned)");
-        addGeneratedReview(flow, function (importResult) { startBuildLoop(goalPrompt, flow, importResult); }, goalPrompt);
-        renderActionChip(data.suggestedAction);
+
+        var nodeClasses = data.stepNodeClasses;
+        var sideEffecting = (nodeClasses && Array.isArray(nodeClasses.sideEffecting))
+            ? nodeClasses.sideEffecting : [];
+        var fpUidManifest = Array.isArray(data.fpUidManifest) ? data.fpUidManifest : [];
+        var consentSrc = {
+            sideEffecting: sideEffecting,
+            flow: flow,
+            goalPrompt: goalPrompt,
+            fpUidManifest: fpUidManifest,
+            suggestedAction: data.suggestedAction
+        };
+
+        if (sideEffecting.length > 0) {
+            renderBuildConsentGate(consentSrc);
+        } else {
+            runBuildConsentDecision(consentSrc, true);
+        }
         setBusy(false);
         updateSelectionStatus();
     }
@@ -1265,6 +1702,8 @@
             addMessage("error", "Describe what you want to change.");
             return;
         }
+        var existingNodeIds = context.nodes.map(function (n) { return n.id; });
+
         var label = "Modify: " + instruction + contextAttachmentNote(context);
         addMessage("user", label);
         // Snapshot history before pushing this turn (see send()).
@@ -1289,6 +1728,10 @@
             handleExecuteError(msg, raw);
         }
 
+        function onModifyResult(data) {
+            handleModifyResult(data);
+        }
+
         // Explore-then-propose, same as generate(). The
         // model may call read tools (e.g. to re-check the selected node's
         // current config) before producing the modify envelope; the final
@@ -1296,7 +1739,7 @@
         if (isAgentLoop) {
             runAgentLoop("flowpilot/modify", payload,
                 { mode: "modify", context: context, prompt: instruction },
-                handleModifyResult, onModifyError);
+                onModifyResult, onModifyError);
             return;
         }
 
@@ -1304,11 +1747,11 @@
         // generate() for details.
         if (currentSettings.streamingEnabled) {
             payload.stream = true;
-            sendExecuteStream("modify", payload, handleModifyResult);
+            sendExecuteStream("modify", payload, onModifyResult);
             return;
         }
 
-        ajaxJson("POST", "flowpilot/modify", payload, handleModifyResult, onModifyError);
+        ajaxJson("POST", "flowpilot/modify", payload, onModifyResult, onModifyError);
     }
 
     // Render generated flow JSON in a preformatted, copyable block. Used for
@@ -1357,6 +1800,10 @@
     // the review — see onDebugMessage for why (a forked/split flow can
     // fire its debug node more than once per trigger).
     var BUILD_LOOP_ATTACH_DEBOUNCE_MS = 1200;
+    // W0.3: how many times the model can bail (emit a prose reply with a
+    // suggestedAction mode-redirect) before the loop gives up with an
+    // honest-timeout instead of silently treating the bail as success.
+    var BUILD_LOOP_MAX_BAILS = 2;
     var buildLoopAttachTimer = null;
     // Fires when "attach" waits too long with no debug — surfaces a prompt
     // for flows that don't produce automatic debug output (HTTP endpoints, etc).
@@ -1410,6 +1857,55 @@
         scrollMessagesToBottom();
     }
 
+    // WS3: remove FP-UID checkpoint tap nodes that the build prompt placed
+    // on the canvas as FlowPilot scaffolding. These are debug nodes named
+    // FP-UID001, FP-UID002, etc. — wired in parallel to external-call nodes
+    // so the loop can attribute debug messages to specific checkpoints.
+    // Called at loop end (any outcome) to clean up before returning control
+    // to the user. Replicates the remove-and-history pattern from
+    // applyModifications in apply-review.js (confirmed group-cleanup bookkeeping).
+    function removeFpUidTaps(loop) {
+        if (!loop || !Array.isArray(loop.nodeIds) || !loop.nodeIds.length) { return 0; }
+        var FP_UID_RE = /^FP-UID\d+$/;
+        var removed = 0;
+        loop.nodeIds.forEach(function (id) {
+            var liveNode = RED.nodes.node(id);
+            if (!liveNode || !FP_UID_RE.test(liveNode.name)) { return; }
+            var connectedLinks = [];
+            RED.nodes.eachLink(function (l) {
+                if ((l.source && l.source.id === id) || (l.target && l.target.id === id)) {
+                    connectedLinks.push(l);
+                }
+            });
+            try { RED.nodes.remove(liveNode.id); } catch (e) { return; }
+            if (liveNode.g && RED.nodes.group) {
+                var ownerGroup = RED.nodes.group(liveNode.g);
+                if (ownerGroup) {
+                    var idx = ownerGroup.nodes.indexOf(liveNode);
+                    if (idx !== -1) { ownerGroup.nodes.splice(idx, 1); }
+                    RED.group.markDirty(ownerGroup);
+                }
+            }
+            RED.history.push({
+                t: "delete",
+                nodes: [liveNode],
+                links: connectedLinks,
+                groups: [],
+                junctions: [],
+                subflow: { id: undefined, instances: [] },
+                subflowInputs: [],
+                subflowOutputs: [],
+                dirty: RED.nodes.dirty()
+            });
+            removed++;
+        });
+        if (removed) {
+            RED.nodes.dirty(true);
+            RED.view.redraw(true);
+        }
+        return removed;
+    }
+
     // The single exit point for every way a build loop ends — Touchdown,
     // the cap being reached, pausing on a clarifying question, or the user
     // clicking Stop. Releases Build mode and its pinned selection too: once
@@ -1420,6 +1916,7 @@
     // visible as a completion badge. success=false (default): remove the stepper
     // (user stop, cap reached, paused for question).
     function stopBuildLoop(note, success) {
+        var tapCount = activeBuildLoop ? removeFpUidTaps(activeBuildLoop) : 0;
         if (success && activeBuildLoop) {
             activeBuildLoop.waypoint = "done";
             renderLoopStepper(activeBuildLoop);
@@ -1430,6 +1927,7 @@
         if (!success) { el("#fp-loop-stepper").remove(); }
         disarmExecuteAction();
         if (note) { addMessage("assistant", note); }
+        if (tapCount) { addMessage("assistant", "Removed " + tapCount + " FP-UID checkpoint tap(s) from the canvas."); }
     }
 
     // Applies a build-loop review's fix envelope, then keeps the loop's
@@ -1492,7 +1990,21 @@
         if (loop.waypoint === "apply") {
             hint = "Click the canvas to place the new node(s), then Deploy — I'll move on automatically once you deploy.";
         } else if (loop.waypoint === "attach") {
-            hint = "Trigger the flow, then check the Debug sidebar — I'll attach the next debug message automatically.";
+            var eps = loop.httpEndpoints;
+            if (eps && eps.length > 0) {
+                var ep = eps[0];
+                var baseUrl = (typeof window !== "undefined" && window.location)
+                    ? window.location.origin : "";
+                var curlMethod = ep.method === "GET" ? "" : " -X " + ep.method;
+                hint = "Send " + ep.method + " " + ep.url + " to trigger the flow — " +
+                    "e.g. curl" + curlMethod + " " + baseUrl + ep.url +
+                    ". I’ll attach the debug output automatically.";
+                if (eps.length > 1) {
+                    hint += " (" + (eps.length - 1) + " more endpoint(s) in this flow.)";
+                }
+            } else {
+                hint = "Trigger the flow, then check the Debug sidebar — I'll attach the next debug message automatically.";
+            }
         } else if (loop.waypoint === "review") {
             hint = "Debug output attached — reviewing against the goal…";
         }
@@ -1513,7 +2025,8 @@
             iteration: loop.iteration,
             maxIterations: loop.maxIterations,
             goal: loop.goal,
-            nodeIds: Array.isArray(loop.nodeIds) ? loop.nodeIds.slice() : []
+            nodeIds: Array.isArray(loop.nodeIds) ? loop.nodeIds.slice() : [],
+            httpEndpoints: Array.isArray(loop.httpEndpoints) ? loop.httpEndpoints.slice() : []
         });
 
         $box.append($msg);
@@ -1526,7 +2039,8 @@
             iteration: rec.iteration || 1,
             maxIterations: rec.maxIterations || 5,
             goal: rec.goal || "",
-            nodeIds: Array.isArray(rec.nodeIds) ? rec.nodeIds : []
+            nodeIds: Array.isArray(rec.nodeIds) ? rec.nodeIds : [],
+            httpEndpoints: Array.isArray(rec.httpEndpoints) ? rec.httpEndpoints : []
         });
     }
 
@@ -1542,12 +2056,22 @@
     // end up on the canvas — importResult.nodeMap maps each placeholder id
     // to the real live node object, which is the only way later review/fix
     // requests can target the right nodes via collectSelectionContext.
-    function startBuildLoop(goal, nodeIdsOrNodes, importResult) {
+    //
+    // consent (WS4, optional): { skippedNodeIds, fpUidManifest } from a
+    // Skip decision at the build consent gate (see handleBuildResult /
+    // renderBuildConsentGate) — skippedNodeIds are the side-effecting
+    // nodes' own PLACEHOLDER ids, fpUidManifest maps each FP-UID debug tap's
+    // placeholder id to the placeholder id of the node it's wired from
+    // (wiredFrom). Resolved here into two REAL-id sets: the skipped nodes
+    // themselves (onNodeStatus's status/<nodeId> path checks against these)
+    // and the taps wired to them (onDebugMessage's msg.id check does) — so
+    // both auto-verify evidence paths honor the same Skip decision.
+    function startBuildLoop(goal, nodeIdsOrNodes, importResult, consent) {
         var nodeIds = [];
+        var nodeMap = importResult && importResult.nodeMap;
         if (importResult) {
             // Fresh build: map placeholder ids from the proposal to the real
             // ids importNodes assigned on the canvas.
-            var nodeMap = importResult.nodeMap;
             if (nodeMap && Array.isArray(nodeIdsOrNodes)) {
                 nodeIdsOrNodes.forEach(function (n) {
                     var real = n && n.id && nodeMap[n.id];
@@ -1558,13 +2082,43 @@
             // Existing-flow build: ids are already resolved real canvas ids.
             nodeIds = nodeIdsOrNodes.filter(function (id) { return typeof id === "string" && id; });
         }
+        // Detect HTTP-in endpoints so the "attach" step can show a specific
+        // trigger hint instead of the generic "trigger the flow" message.
+        var httpEndpoints = [];
+        nodeIds.forEach(function (id) {
+            var n = RED.nodes.node(id);
+            if (n && n.type === "http in" && n.url) {
+                httpEndpoints.push({ method: (n.method || "get").toUpperCase(), url: n.url });
+            }
+        });
+
+        var skipCheckpointNodeIds = [];
+        var skipCheckpointTapIds = [];
+        var skippedPlaceholderIds = consent && Array.isArray(consent.skippedNodeIds) ? consent.skippedNodeIds : [];
+        if (skippedPlaceholderIds.length && nodeMap) {
+            skippedPlaceholderIds.forEach(function (placeholderId) {
+                var real = nodeMap[placeholderId];
+                if (real && real.id) { skipCheckpointNodeIds.push(real.id); }
+            });
+            var manifest = Array.isArray(consent.fpUidManifest) ? consent.fpUidManifest : [];
+            manifest.forEach(function (tap) {
+                if (!tap || skippedPlaceholderIds.indexOf(tap.wiredFrom) === -1) { return; }
+                var realTap = nodeMap[tap.id];
+                if (realTap && realTap.id) { skipCheckpointTapIds.push(realTap.id); }
+            });
+        }
+
         activeBuildLoop = {
             goal: goal,
             nodeIds: nodeIds,
             iteration: 1,
             maxIterations: getAgentLoopMaxIterations(),
             waypoint: "apply",
-            conversationId: conversationId
+            conversationId: conversationId,
+            bailCount: 0,
+            httpEndpoints: httpEndpoints,
+            skipCheckpointNodeIds: skipCheckpointNodeIds,
+            skipCheckpointTapIds: skipCheckpointTapIds
         };
         renderLoopStepper(activeBuildLoop);
     }
@@ -1580,7 +2134,47 @@
     function runBuildReview(loop) {
         var context = collectSelectionContext(loop.nodeIds);
         context = attachDebugContext(context);
-        var instruction = "Review the attached debug output against this build goal: \"" +
+        var reviewEvidence = context && Array.isArray(context.debugMessages)
+            ? context.debugMessages : [];
+        var statusOnlyEvidence = reviewEvidence.length > 0 &&
+            reviewEvidence.every(function (entry) {
+                return entry && entry.sourceKind === "status";
+            });
+        // W0.3: framing block — suppresses the Modify escape hatch
+        // (suggestedAction mode-redirect) inside the build loop context.
+        // The code-side handler (handleBuildReviewResult) also detects and
+        // counts bail attempts so N bails trigger an honest-timeout instead
+        // of silently treating a redirect as success.
+        var instruction = "CONTEXT: You are the fix engine inside a build-test-fix loop. " +
+            "Your only valid responses are: (1) plain text when the goal is fully " +
+            "satisfied, or (2) a {\"explanation\", \"changes\", ...} fix envelope " +
+            "when something needs patching." +
+            (statusOnlyEvidence
+                ? " (3) Because the attached evidence contains ONLY coarse node-status " +
+                  "lines, you may instead return the atomic {\"question\", " +
+                  "\"questionOptions\"} envelope described below."
+                : "") +
+            " Do NOT use the <<<FLOWPILOT_DATA>>> " +
+            "block or suggest switching to chat/generate/document — you are already " +
+            "in the right context and any mode-redirect will be ignored. If you are " +
+            "genuinely uncertain what to fix, " +
+            (statusOnlyEvidence
+                ? "use the status-only confirmation question below."
+                : "describe the uncertainty inside \"explanation\" in a fix envelope.") +
+            "\n\nEach attached evidence object has sourceKind. sourceKind:\"debug\" " +
+            "is real message content emitted by a debug node. sourceKind:\"status\" " +
+            "is only a coarse connection/status line synthesized from node status; " +
+            "never treat it as proof of message payload content or successful " +
+            "end-to-end behavior. " +
+            (statusOnlyEvidence
+                ? "STATUS-ONLY FALLBACK: if the coarse status does not prove whether " +
+                  "the deployed node is actually connected/working, do not guess or " +
+                  "assert failure. Ask one concrete yes/no confirmation such as " +
+                  "\"Does the node show connected after deploy?\" by returning ONLY " +
+                  "{\"question\":\"...\",\"questionOptions\":[\"Yes\",\"No\"]}. "
+                : "") +
+            "\n\n" +
+            "Review the attached debug output against this build goal: \"" +
             loop.goal + "\". Before concluding anything, list out every distinct " +
             "piece of data or behavior the goal actually requires, then check the " +
             "attached debug payload(s) contain EACH one — a payload that's merely " +
@@ -1588,7 +2182,22 @@
             "goal asked to combine two things but the payload only shows one), " +
             "does NOT fully satisfy it. If more than one debug message is " +
             "attached, treat them together as the full picture from one trigger, " +
-            "not as separate independent attempts. If it fully satisfies the goal, " +
+            "not as separate independent attempts. " +
+            "SPECIAL CASE — network errors: if the debug output shows ONLY a " +
+            "network-level error (EHOSTUNREACH, ECONNREFUSED, ETIMEDOUT, " +
+            "ENOTFOUND, getaddrinfo ENOTFOUND, EAI_AGAIN, EAI_NODATA), the " +
+            "flow MIGHT be correctly built — BUT you MUST first check the node " +
+            "context: if any http-request node has an empty url field, a " +
+            "placeholder, or a clearly malformed url (no hostname, no protocol, " +
+            "etc.), the DNS or connection error is a CONFIGURATION problem — " +
+            "fix the url field, do NOT declare it an infrastructure issue. Only " +
+            "apply this special case when the url is a real, non-empty, " +
+            "well-formed URL and the external service is simply unreachable. In " +
+            "that case reply in plain text acknowledging the flow is structurally " +
+            "correct and the network error is an infrastructure issue outside the " +
+            "flow. Do NOT propose any changes; this error cannot be resolved by " +
+            "modifying the flow. " +
+            "If it fully satisfies the goal, " +
             "say so in plain text — no changes needed. If something's wrong " +
             "(including a node that never fired, or a value that's missing/empty " +
             "when the goal needed it), propose the fix directly as a patch in " +
@@ -1644,6 +2253,26 @@
     // diff-then-Apply pipeline as a manual Modify, then the loop advances
     // back to "apply" for the next deploy/test cycle, or stops if the
     // iteration cap is reached).
+    // Returns false when all of data's proposed changes are sentinel-echoed
+    // with no insertions, removals, or wire changes. Used by
+    // handleBuildReviewResult to avoid showing an all-blocked review panel
+    // when the model said "no changes needed" but still emitted a modify
+    // envelope (a common model behavior after a build-loop review).
+    function reviewHasRealDiffs(data) {
+        if ((data.newNodes && data.newNodes.length) ||
+                (data.removeNodes && data.removeNodes.length) ||
+                (data.newWires && data.newWires.length) ||
+                (data.newGroups && data.newGroups.length)) { return true; }
+        var nodes = Array.isArray(data.flow) ? data.flow : [];
+        return nodes.some(function (modNode) {
+            if (!modNode || !modNode.id) { return false; }
+            var liveNode = findLiveNode(modNode.id);
+            if (!liveNode) { return false; }
+            var diff = computeNodeDiff(liveNode, modNode);
+            return diff.propertyChanges.length > 0 || diff.wiresChanged;
+        });
+    }
+
     function handleBuildReviewResult(data) {
         hidePending();
         var loop = activeBuildLoop;
@@ -1667,6 +2296,51 @@
         }
 
         if (data.prose) {
+            var explanation = data.explanation || "(no content returned)";
+
+            // W0.3: bail detection — a prose reply with a mode-redirect
+            // suggestedAction means the model tried to exit the loop
+            // context via the Modify escape hatch. Count it and retry or
+            // honest-timeout rather than treating it as success.
+            var sa = data.suggestedAction;
+            var isBail = sa && (sa.mode === "chat" || sa.mode === "generate" || sa.mode === "document");
+            if (isBail) {
+                loop.bailCount = (loop.bailCount || 0) + 1;
+                console.warn("[FlowPilot] build-loop bail #" + loop.bailCount +
+                    " mode=" + sa.mode + ": " + explanation);
+                addMessage("assistant", explanation);
+                pushHistory("assistant", explanation);
+                if (loop.bailCount >= BUILD_LOOP_MAX_BAILS) {
+                    stopBuildLoop("Build loop could not assess the debug output — the AI kept redirecting instead of reviewing. Try attaching more debug context or continuing manually with Modify.", false);
+                    setBusy(false);
+                    updateSelectionStatus();
+                } else {
+                    addMessage("fp-notice", "Build-loop: review redirected to " + sa.mode +
+                        " — staying in build context and retrying (bail " + loop.bailCount +
+                        "/" + BUILD_LOOP_MAX_BAILS + ").");
+                    runBuildReview(loop);
+                }
+                return;
+            }
+
+            addMessage("assistant", explanation);
+            pushHistory("assistant", explanation);
+            renderActionChip(data.suggestedAction);
+            var stopMsg = /EHOSTUNREACH|ECONNREFUSED|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|EAI_NODATA|getaddrinfo|unreachable|infrastructure/i
+                .test(explanation)
+                ? "Build complete — the flow is correctly structured, but the external endpoint was unreachable during testing (infrastructure issue, not a flow problem)."
+                : "Touchdown — the debug output matches the goal.";
+            stopBuildLoop(stopMsg, true);
+            setBusy(false);
+            updateSelectionStatus();
+            return;
+        }
+
+        // Modify envelope where every proposed change is a sentinel echo —
+        // the model emitted a changes object but all fields are redacted
+        // placeholders with no insertions, removals, or wire changes. Treat
+        // it as "no changes needed" rather than showing an all-blocked panel.
+        if (!reviewHasRealDiffs(data)) {
             addMessage("assistant", data.explanation || "(no content returned)");
             pushHistory("assistant", data.explanation || "");
             renderActionChip(data.suggestedAction);