@manny-est/node-red-flowpilot 0.5.2 → 0.6.0-beta.1

package/lib/provider-openai-compatible.js

@@ -33,12 +33,18 @@ function postJson(urlString, headers, body, timeoutMs) {
         try {
           parsed = data ? JSON.parse(data) : null;
         } catch (err) {
-          reject(new Error(`Provider returned non-JSON response (${res.statusCode}): ${data.slice(0, 500)}`));
+          // Never echo the raw upstream body — a security boundary, not just
+          // tidiness. This request may be the provider-confirmation check
+          // hitting a baseUrl for the first time (SSRF mitigation, ADR-007);
+          // an attacker-controlled target (internal service, cloud metadata)
+          // must not be able to get its response body reflected back to the
+          // caller through a FlowPilot error message.
+          reject(new Error(`Provider returned a non-JSON response (status ${res.statusCode}).`));
           return;
         }
 
         if (res.statusCode < 200 || res.statusCode >= 300) {
-          const msg = parsed && parsed.error ? JSON.stringify(parsed.error) : data;
+          const msg = parsed && parsed.error ? JSON.stringify(parsed.error) : `status ${res.statusCode}`;
           reject(new Error(`Provider request failed (${res.statusCode}): ${msg}`));
           return;
         }
@@ -86,12 +92,13 @@ function getJson(urlString, headers, timeoutMs) {
         try {
           parsed = data ? JSON.parse(data) : null;
         } catch (err) {
-          reject(new Error(`Provider returned non-JSON response (${res.statusCode}): ${data.slice(0, 500)}`));
+          // See postJson above — never echo the raw upstream body.
+          reject(new Error(`Provider returned a non-JSON response (status ${res.statusCode}).`));
           return;
         }
 
         if (res.statusCode < 200 || res.statusCode >= 300) {
-          const msg = parsed && parsed.error ? JSON.stringify(parsed.error) : data;
+          const msg = parsed && parsed.error ? JSON.stringify(parsed.error) : `status ${res.statusCode}`;
           reject(new Error(`Provider request failed (${res.statusCode}): ${msg}`));
           return;
         }
@@ -172,6 +179,9 @@ async function chat(settings, messages, options) {
   if (options && options.responseFormat) {
     body.response_format = options.responseFormat;
   }
+  if (options && Number.isInteger(options.maxTokens) && options.maxTokens > 0) {
+    body.max_tokens = options.maxTokens;
+  }
 
   const startedAt = Date.now();
   const response = await postJson(`${baseUrl}/v1/chat/completions`, headers, body, settings.requestTimeoutMs || 180000);
@@ -187,6 +197,8 @@ async function chat(settings, messages, options) {
     raw: response,
     content: content || (toolCalls ? "" : "[No assistant message returned by provider]"),
     toolCalls: toolCalls,
+    finishReason: (response && response.choices && response.choices[0] &&
+      response.choices[0].finish_reason) || null,
     timing: { totalMs },
     usage: (response && response.usage) || null
   };
@@ -282,20 +294,22 @@ function postStream(urlString, headers, body, timeoutMs, onDelta, onReasoningDel
     const startedAt = Date.now();
     let firstTokenAt = null;
     let usage = null;
+    let finishReason = null;
 
     const req = transport.request(options, (res) => {
       res.setEncoding("utf8");
 
       if (res.statusCode < 200 || res.statusCode >= 300) {
-        let errData = "";
-        res.on("data", chunk => { errData += chunk; });
+        // Drain the body but never reflect it — see postJson's comment above.
+        res.on("data", () => {});
         res.on("end", () => {
-          reject(new Error(`Provider request failed (${res.statusCode}): ${errData.slice(0, 500)}`));
+          reject(new Error(`Provider request failed (status ${res.statusCode}).`));
         });
         return;
       }
 
       let sseBuf = "";
+      let sawValidSseData = false;
       let full = "";
       // When onReasoningDelta is provided, intercept <think>...</think> from
       // delta.content in addition to the dedicated delta.reasoning_content field
@@ -325,7 +339,12 @@ function postStream(urlString, headers, body, timeoutMs, onDelta, onReasoningDel
             return; // ignore malformed/partial SSE chunk
           }
 
+          sawValidSseData = true;
+
           if (evt && evt.usage) { usage = evt.usage; }
+          if (evt && evt.choices && evt.choices[0] && evt.choices[0].finish_reason) {
+            finishReason = evt.choices[0].finish_reason;
+          }
 
           const deltaObj = evt && evt.choices && evt.choices[0] && evt.choices[0].delta;
           if (deltaObj) {
@@ -350,12 +369,17 @@ function postStream(urlString, headers, body, timeoutMs, onDelta, onReasoningDel
       });
       res.on("end", () => {
         if (thinkSplitter) { thinkSplitter.finish(); }
+        if (!sawValidSseData) {
+          reject(new Error(`Provider returned a non-SSE response (status ${res.statusCode}).`));
+          return;
+        }
         const endedAt = Date.now();
         resolve({
           content: full,
           ttftMs: firstTokenAt !== null ? firstTokenAt - startedAt : null,
           totalMs: endedAt - startedAt,
-          usage: usage
+          usage: usage,
+          finishReason: finishReason
         });
       });
     });
@@ -397,6 +421,9 @@ async function chatStream(settings, messages, onDelta, onReasoningDelta, options
   if (options && options.responseFormat) {
     body.response_format = options.responseFormat;
   }
+  if (options && Number.isInteger(options.maxTokens) && options.maxTokens > 0) {
+    body.max_tokens = options.maxTokens;
+  }
 
   const result = await postStream(`${baseUrl}/v1/chat/completions`, headers,
     body, settings.requestTimeoutMs || 180000, onDelta, onReasoningDelta);
@@ -404,7 +431,8 @@ async function chatStream(settings, messages, onDelta, onReasoningDelta, options
   return {
     content: result.content || "",
     timing: { ttftMs: result.ttftMs, totalMs: result.totalMs },
-    usage: result.usage
+    usage: result.usage,
+    finishReason: result.finishReason
   };
 }
 

package/lib/provider-shape-check.js

@@ -0,0 +1,34 @@
+"use strict";
+
+// ---------------------------------------------------------------------
+// The provider-confirmation gate's own pass/fail criterion (ADR-007, the
+// SSRF mitigation). Deliberately NOT "HTTP 200 with a JSON body" — an
+// internal admin panel or a cloud metadata endpoint can trivially return
+// that. Requires an actually provider-shaped response: a well-formed
+// OpenAI-compatible chat-completion object (choices[].message) or Anthropic
+// message (content[]), or a valid OpenAI-style /v1/models list (data[] of
+// {id}). Anything else — including a bare 200, an HTML error page, or JSON
+// that merely happens to parse but isn't shaped like either — fails the
+// check, and the provider stays unconfirmed.
+// ---------------------------------------------------------------------
+
+function isChatShaped(providerType, raw) {
+  if (providerType === "anthropic") {
+    return Array.isArray(raw.content);
+  }
+  return Array.isArray(raw.choices) && raw.choices.length > 0 &&
+    raw.choices[0] && typeof raw.choices[0] === "object" &&
+    raw.choices[0].message && typeof raw.choices[0].message === "object";
+}
+
+function isModelsListShaped(raw) {
+  return Array.isArray(raw.data) && raw.data.length > 0 &&
+    raw.data.every(function (m) { return m && typeof m.id === "string" && m.id; });
+}
+
+function isProviderShapedResponse(providerType, raw) {
+  if (!raw || typeof raw !== "object") { return false; }
+  return isChatShaped(providerType, raw) || isModelsListShaped(raw);
+}
+
+module.exports = { isProviderShapedResponse };

package/lib/storage.js

@@ -1,10 +1,83 @@
 const fs = require("fs");
 const path = require("path");
 
+// Sentinel the client sends back for an apiKey field it never actually saw
+// (see maskProviderSecrets in flowpilot.js) to mean "leave the stored key
+// alone". Shared between the GET/POST /flowpilot/settings routes (masking)
+// and reconcileProviderSecrets below (unmasking on save) — both must agree
+// on the exact string or a real key could get silently overwritten.
+const API_KEY_UNCHANGED = "__FP_KEY_UNCHANGED__";
+
 function ensureDir(dir) {
   fs.mkdirSync(dir, { recursive: true });
 }
 
+// Strips control characters (CR/LF and friends) from a freshly-typed API
+// key before it's persisted — cheap insurance against a pasted value
+// corrupting a future header or a log line.
+function sanitizeApiKey(raw) {
+  return String(raw).replace(/[\x00-\x1F\x7F]/g, "");
+}
+
+// Reconciles an incoming providers list (as submitted by POST /flowpilot/
+// settings, where the client only ever sees the masked sentinel/"" for
+// apiKey — never a real key) against the previously-stored list, matched by
+// provider id. A sentinel or missing apiKey keeps the stored key; an empty
+// string clears it; anything else is a real retyped key. Also enforces the
+// server-writes-only discipline for confirmedBaseUrl/confirmedAt (the
+// provider-confirmation gate, B1): a client can never set or forge these,
+// and confirmation is dropped whenever baseUrl or apiKey actually changed
+// from what was last confirmed.
+// trustedConfirmation: true ONLY when called from saveSettings' own internal
+// callers (/flowpilot/test, /flowpilot/probe, right after a real passing
+// check) — never from the public POST /settings path. Those two routes
+// compute confirmedBaseUrl themselves (== the exact URL they just verified),
+// so it's server-computed data at that point, not client input; every OTHER
+// provider in the same save (anything not freshly (re)confirmed this call)
+// still only keeps its OWN prior confirmation, and only while baseUrl/apiKey
+// still match what was actually confirmed.
+function reconcileProviderSecrets(incoming, existing, trustedConfirmation) {
+  const existingById = {};
+  (Array.isArray(existing) ? existing : []).forEach(function (p) {
+    if (p && p.id) { existingById[p.id] = p; }
+  });
+
+  return (Array.isArray(incoming) ? incoming : []).map(function (p) {
+    const prior = existingById[p.id];
+    const next = Object.assign({}, p);
+    delete next.hasApiKey;
+
+    if (next.apiKey === API_KEY_UNCHANGED || next.apiKey === undefined) {
+      next.apiKey = prior ? (prior.apiKey || "") : "";
+    } else if (typeof next.apiKey === "string" && next.apiKey !== "") {
+      next.apiKey = sanitizeApiKey(next.apiKey);
+    }
+
+    // typeof, not truthiness: baseUrl "" is a real, documented, supported
+    // value (Anthropic's "leave blank for api.anthropic.com" convention),
+    // so confirmedBaseUrl can legitimately BE "" too — `"" && ...` would
+    // silently evaluate false and lock that configuration out of
+    // confirmation forever. Only an actually-absent field should fail.
+    if (trustedConfirmation && typeof p.confirmedBaseUrl === "string") {
+      next.confirmedBaseUrl = p.confirmedBaseUrl;
+      next.confirmedAt = p.confirmedAt;
+      return next;
+    }
+
+    // Untrusted path (public POST /settings): never trust what the client
+    // sent, start from the prior stored state, then drop it if baseUrl or
+    // the (now-reconciled) apiKey no longer matches what was confirmed.
+    if (prior && typeof prior.confirmedBaseUrl === "string" && next.baseUrl === prior.baseUrl && next.apiKey === prior.apiKey) {
+      next.confirmedBaseUrl = prior.confirmedBaseUrl;
+      next.confirmedAt = prior.confirmedAt;
+    } else {
+      delete next.confirmedBaseUrl;
+      delete next.confirmedAt;
+    }
+    return next;
+  });
+}
+
 function createStorage(userDir) {
   const baseDir = path.join(userDir, "flowpilot");
   const chatsDir = path.join(baseDir, "chats");
@@ -38,11 +111,11 @@ function createStorage(userDir) {
     maxContextChars: 12000,
     defaultContextMode: "selected",
     allowConfigContext: false,
-    // When true, each assembled prompt (post-redaction messages array) plus the
-    // raw provider response and parse outcome is appended to assembled-prompts.log
+    // When true, provider turns (post-redaction messages, replies, and tool calls)
+    // are appended to debug.log
     // (0600 perms). Auth headers/keys are never logged — only the content bytes
     // that the provider actually received. Off by default (diagnostic tool).
-    logAssembledPrompts: false,
+    debugLogging: false,
     streamingEnabled: true,
     // First-run welcome/warning shows until the user saves settings once.
     firstRunAcknowledged: false,
@@ -59,6 +132,9 @@ function createStorage(userDir) {
     // than cloud providers; users on that hardware raise this in Behavior
     // settings rather than living with a hardcoded ceiling.
     requestTimeoutMs: 180000,
+    // Hard output bound for each tool-capable agent turn. Classic completions
+    // remain uncapped so ordinary flow envelopes are never silently clipped.
+    agentTurnMaxTokens: 4096,
     // Max build->deploy->test->fix cycles the /build agentic loop will run
     // before stopping with an honest "couldn't fully verify" instead of
     // proposing another fix. Bounds against a non-converging loop burning
@@ -75,6 +151,10 @@ function createStorage(userDir) {
     // verification after import). The legacy path remains available when a
     // user explicitly disables this setting.
     enableStepQueue: true,
+    // W7 WRITE-tool loop. Default-off until the server/client Round 1
+    // plumbing has passed its integration and mandatory human live-test
+    // gates. This is separate from enableStepQueue (Generate checklist UI).
+    enableAgentWrite: false,
     // Lets the user silence the recurring secrets/size reminder bar after
     // typing an explicit acknowledgement in settings.
     suppressContextWarnings: false,
@@ -84,12 +164,15 @@ function createStorage(userDir) {
     // dedicated Node-RED credentials field is dropped by the frontend
     // regardless of this setting, via a different, always-on mechanism.
     redactionEnabled: true,
-    // Chat-only persona slider, 1-10: 1 is a plain Node-RED engineer, 10 is
-    // a comically over-the-top airline captain who happens to be a Node-RED
-    // expert. 3 matches the original "subtle co-pilot" voice this replaced.
+    // Chat-only persona slider, 1-5 (CLAUDE-032: was 1-10, collapsed to 5
+    // discrete levels after live testing found the old scale's
+    // interpolated-between-anchors design produced no discernible voice
+    // difference across most of its range): 1 is a plain Node-RED engineer,
+    // 5 is a comically over-the-top airline captain who happens to be a
+    // Node-RED expert. 2 ("subtle co-pilot") is the default.
     // See lib/persona-prompt.js — generated fresh per request, never baked
     // into the persisted systemPrompt below.
-    personaIntensity: 3,
+    personaIntensity: 2,
     // User-defined intent buttons: array of { label, text }.
     customIntents: [],
     systemPrompt: require("./default-system-prompt")
@@ -176,6 +259,7 @@ function createStorage(userDir) {
 
     if (!fs.existsSync(settingsFile)) {
       fs.writeFileSync(settingsFile, JSON.stringify(defaultSettings, null, 2), "utf8");
+      try { fs.chmodSync(settingsFile, 0o600); } catch (e) { /* best-effort */ }
     }
 
     if (!fs.existsSync(auditFile)) {
@@ -204,7 +288,13 @@ function createStorage(userDir) {
     }
   }
 
-  function saveSettings(settings) {
+  // options.trustConfirmation: pass true ONLY from /flowpilot/test or
+  // /flowpilot/probe's own internal saveSettings call, right after a real
+  // passing provider check — see reconcileProviderSecrets's own comment.
+  // Every other caller (in particular the public POST /settings route)
+  // omits this, so confirmedBaseUrl/confirmedAt stay strictly
+  // server-computed and can never be set via a settings save.
+  function saveSettings(settings, options) {
     init();
 
     let current = {};
@@ -218,16 +308,19 @@ function createStorage(userDir) {
     const merged = Object.assign({}, defaultSettings, current, settings || {});
     merged.systemPrompt = fixStaleSystemPrompt(merged.systemPrompt);
     delete merged._error;
-    // If the caller sent a providers list, it wins outright (Object.assign
-    // already did this, but be explicit for clarity/safety).
+    // If the caller sent a providers list, reconcile it against what's
+    // actually stored (real apiKey/confirmedBaseUrl never come from the
+    // client — see reconcileProviderSecrets above) rather than trusting it
+    // outright the way Object.assign would.
     if (settings && Array.isArray(settings.providers)) {
-      merged.providers = settings.providers;
+      merged.providers = reconcileProviderSecrets(settings.providers, current.providers, !!(options && options.trustConfirmation));
     }
     // Saving settings is an explicit user action; mark first-run complete so
     // the welcome/warning stops showing.
     merged.firstRunAcknowledged = true;
 
     fs.writeFileSync(settingsFile, JSON.stringify(merged, null, 2), "utf8");
+    try { fs.chmodSync(settingsFile, 0o600); } catch (e) { /* best-effort */ }
 
     return merged;
   }
@@ -253,7 +346,16 @@ function createStorage(userDir) {
 
   function appendTranscript(conversationId, entry) {
     init();
-    fs.appendFileSync(transcriptFile(conversationId), JSON.stringify(entry) + "\n", "utf8");
+    const file = transcriptFile(conversationId);
+    const isNewFile = !fs.existsSync(file);
+    // Same 0600-on-append pattern as appendDebugLog below — transcripts hold
+    // full conversation content, never world-readable even on first write.
+    const fd = fs.openSync(file, "a", 0o600);
+    fs.writeSync(fd, JSON.stringify(entry) + "\n");
+    fs.closeSync(fd);
+    if (isNewFile) {
+      try { fs.chmodSync(file, 0o600); } catch (e) { /* best-effort */ }
+    }
   }
 
   // Removes a conversation's transcript file (e.g. user deletes it from the
@@ -303,14 +405,14 @@ function createStorage(userDir) {
     return defaultSettings.systemPrompt;
   }
 
-  const assembledPromptsFile = path.join(baseDir, "assembled-prompts.log");
+  const debugLogFile = path.join(baseDir, "debug.log");
 
-  // W0.4: Append one JSON-lines entry to assembled-prompts.log.
+  // Append one JSON-lines entry to debug.log.
   // Written 0600 — diagnostic data, never world-readable.
   // Auth keys are NOT included (only baseUrl + model from the provider
   // profile, never apiKey). The bytes logged are post-redaction: the same
   // content the provider actually received.
-  function appendAssembledPromptLog(entry) {
+  function appendDebugLog(entry) {
     init();
     const line = JSON.stringify({
       timestamp: new Date().toISOString(),
@@ -319,13 +421,13 @@ function createStorage(userDir) {
     try {
       // Open with O_APPEND | O_CREAT, mode 0600 so secrets never land
       // in a world-readable file even on first write.
-      const fd = fs.openSync(assembledPromptsFile, "a", 0o600);
+      const fd = fs.openSync(debugLogFile, "a", 0o600);
       fs.writeSync(fd, line + "\n");
       fs.closeSync(fd);
       // Ensure 0600 regardless of umask on subsequent opens.
-      fs.chmodSync(assembledPromptsFile, 0o600);
+      fs.chmodSync(debugLogFile, 0o600);
     } catch (err) {
-      console.error("[FlowPilot] assembled-prompts log write failed:", err.message);
+      console.error("[FlowPilot] debug log write failed:", err.message);
     }
   }
 
@@ -337,13 +439,13 @@ function createStorage(userDir) {
     backupsDir,
     settingsFile,
     auditFile,
-    assembledPromptsFile,
+    debugLogFile,
     getSettings,
     saveSettings,
     getActiveProvider,
     getDefaultSystemPrompt,
     appendAudit,
-    appendAssembledPromptLog,
+    appendDebugLog,
     appendTranscript,
     readTranscript,
     deleteTranscript,
@@ -351,4 +453,9 @@ function createStorage(userDir) {
   };
 }
 
-module.exports = createStorage;
+// Static, instance-independent — flowpilot.js's route handlers need the
+// exact same sentinel string that reconcileProviderSecrets checks against
+// above, without needing a storage instance to get it.
+createStorage.API_KEY_UNCHANGED = API_KEY_UNCHANGED;
+
+module.exports = createStorage;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manny-est/node-red-flowpilot",
-  "version": "0.5.2",
+  "version": "0.6.0-beta.1",
   "description": "FlowPilot for Node-RED - an AI-powered development assistant sidebar",
   "main": "flowpilot.js",
   "keywords": [