@manny-est/node-red-flowpilot 0.5.2 → 0.6.0

package/CHANGELOG.md

@@ -2,6 +2,91 @@
 
 All notable changes to FlowPilot are documented here.
 
+## [0.6.0] - 2026-09-01
+
+Promoted from `0.6.0-beta.1` to the stable `latest` npm tag.
+
+### Added
+- **Agentic WRITE-tool loop for Modify and Generate** (behind the
+  `enableAgentWrite` setting, default off): step-by-step tool calls
+  against the live flow (`apply_step`, `remove_step`, `rename_node`,
+  `group_nodes`), each write-gated by a per-step consent prompt (Proceed
+  / Skip this step) before it touches the canvas. Multi-item requests are
+  tracked and executed as separate, individually-verified steps rather
+  than one all-or-nothing envelope; an injected mid-run failure (e.g. a
+  referenced node no longer exists) fails only that item, with the rest
+  completing normally. Generate joined the same agentic runtime Modify
+  already used, closing the last place a mutation could land through the
+  older, less-verified classic JSON path while write-tool mode is on.
+- **`ask_user` clarifying-question tool**: an agent-strategy turn can pause
+  mid-run to ask a single focused question (with optional quick-reply
+  buttons) instead of guessing, and resumes exactly where it left off once
+  answered.
+- **Deterministic run summaries**: when a Modify or Generate run actually
+  applied WRITE-tool steps, the per-item outcome you see (✓ applied and
+  verified / ✗ failed, with why) now comes straight from what the tools
+  actually reported — not from the model's own retelling. The model's own
+  wrap-up explanation still shows, underneath, clearly secondary — useful
+  context, never the thing you have to trust to know what really
+  happened.
+- **Contract-exclusivity enforcement**: a server-side safety net
+  (`enforceAgentContract`) strips any classic-style mutation fields
+  (`changes`/`newNodes`/`newWires`/`removeNodes`/`newGroups`/`flow`) that
+  accidentally appear on an agent-strategy turn with no tool calls, before
+  they ever reach the client — the two mutation paths (classic envelope vs.
+  agentic WRITE tools) stay mutually exclusive per turn, for every mode
+  that can run agentically.
+- **Run identity and honest interruption**: agent-strategy runs now carry a
+  stable run/operation id so a duplicate tool-call delivery (a retry, or the
+  model repeating itself) is applied at most once; a run that's stopped or
+  hits its step/token ceiling reports an honest "interrupted after N steps"
+  instead of silently truncating. That step-by-step record is also now
+  visible to the server (previously client-side only), the foundation for
+  the deterministic run summaries above.
+
+### Fixed
+- **The FlowPilot sidebar's entire client script was loading twice on
+  every single editor page load** — a packaging issue present since the
+  plugin's first release, only now found and fixed. In practice this
+  meant a page reload silently lost the current conversation (a second,
+  redundant script execution would stomp the first one's restored state)
+  and, more subtly, any other one-time setup code in the client ran
+  twice per load. Reloading the Node-RED editor now correctly picks the
+  conversation back up where you left off.
+- Anthropic (Claude) responses now get the exact same deterministic
+  run-summary and contract-exclusivity treatment as every other
+  provider — verified directly against Claude Sonnet, not just the
+  OpenAI-compatible path.
+
+### Security
+- **API keys are now write-only over HTTP** (previously exposed on
+  `GET`/`POST /flowpilot/settings` — a fork-hygiene regression from the
+  0.5.1 stable line, now ported forward and closed for good). Every
+  provider's `apiKey` is masked to a sentinel or `""` in both responses;
+  the real key never leaves the server. `settings.json` and per-conversation
+  transcripts are now created with `0600` permissions.
+- **Provider-confirmation gate (SSRF mitigation)**: no chat, generate,
+  modify, document, build, agent-step, or model-list request reaches a
+  configured provider's Base URL until that exact URL has passed a real
+  FlowPilot connection check (Pre-flight check / Test Provider). The check
+  itself is blind on failure — a non-provider target's response is never
+  reflected back to the client — so pointing a provider at an unintended
+  internal address yields nothing readable. Confirmation is tied to the
+  exact URL and clears automatically if the Base URL or API key changes.
+  See `dev-docs/decisions/ADR-007-Provider-Confirmation-Gate.md` for the
+  full design.
+- **Audit-trail completeness**: an agent-strategy request whose very first
+  model turn is a tool call (rather than a later continuation) is now
+  always recorded to the audit log — previously this specific case left no
+  trace at all.
+
+### Internal
+- Phase 10: strategy propagation, contract-exclusivity enforcement, agent
+  turn output caps, run identity/idempotency, and verification consolidation
+  across the classic and agentic Modify paths. Full history in
+  `dev-docs/current/Phase10-Build-Progress.md` and
+  `dev-docs/current/Phase10-Gate-Closeout-Final.md`.
+
 ## [0.5.2] - 2026-08-04
 
 This release continues the 0.5.x line. Phase 10's agentic Modify redesign
@@ -39,32 +124,6 @@ until it's ready to replace this one.
   the canvas.
 
 ### Fixed
-- **Build loop — status-only evidence false negatives**: a live, working
-  node could be declared "disconnected"/broken off a single coarse
-  node-status read, with no way to confirm otherwise. Evidence is now
-  tagged by source (`debug` vs. `status`); when only status-line evidence
-  is available and it doesn't clearly prove success or failure, the build
-  loop asks a direct yes/no confirmation instead of guessing.
-- **Modify's wire verification** read a node's stale `.wires` array
-  instead of the live link registry — a wire added earlier in the same
-  editing session could be reported as "did not land" even though it was
-  actually there. Verification now reads from `RED.nodes.eachLink`.
-- **Phantom output port on newly-created nodes**: a model-supplied
-  `wires` array that disagreed with a node type's real port count (e.g.
-  a stray empty port on a 0-output type like `http response`) rendered a
-  visible port anchor that shouldn't exist. The array length is now
-  reconciled against the node's real output count on insertion.
-- **New-node layout scatter**: the collision-avoidance grid still placed
-  two nodes at the same vertical level; switched to a single-column
-  layout (one node per row, wrap to a new column after 5 rows).
-- **`newWires` endpoint aliases**: a model response using `fromId`/`toId`
-  instead of `from`/`to` on a `newWires` entry is now repaired
-  automatically instead of both endpoints silently appearing missing.
-- **`.fp-chip-card-alt` background**: the secondary "Just add to canvas"
-  chip relied on its surrounding message bubble being dark to read as
-  part of the same chip-card family as the primary action above it —
-  bubbles follow Node-RED's light editor theme by default, so it rendered
-  as a plain white box instead.
 - Redaction round-trip poisoning, token-credential redaction gaps, and
   several redaction echo/false-positive fixes across Modify and the build
   loop's review step.

package/README.md

@@ -26,7 +26,9 @@ installation, the sidebar UI, and a chapter on every feature.
 - **User-initiated only** — FlowPilot never changes your flow without an
   explicit request.
 - **Complete visibility** — every proposed change is shown as a diff/review
-  before anything is applied.
+  before it's applied; in the opt-in agentic mode (below), each step is
+  gated by its own Proceed/Skip prompt instead, so you're still in control
+  of what actually lands on the canvas.
 - **Undo first** — every change goes through Node-RED's native undo
   (Ctrl+Z), including multi-part changes (insertions + rewires + new nodes)
   as a single step.
@@ -73,6 +75,13 @@ See the [User Guide](USER-GUIDE.md#privacy-and-safety) for the full details.
   Document, with a clear notice when older messages are truncated.
 - **Clarifying questions** — if an instruction is too vague to act on
   safely, FlowPilot asks ONE question instead of guessing.
+- **Agentic mode (opt-in, Settings)** — Generate and Modify can work
+  step by step instead of one big review-then-apply diff: each step
+  (insert, rewire, rename, remove, group) lands on the canvas as it's
+  proposed, gated by its own Proceed/Skip consent prompt for anything
+  beyond the safest node types. The summary you see when a run finishes
+  is built from what the tools actually reported happened, not just the
+  model's own retelling — if a step failed or was skipped, it says so.
 - **Streaming replies** — optional SSE streaming for chat responses.
 - **`/build`** — describe a goal and FlowPilot plans it, proposes a first
   flow, then walks an interactive build → deploy → debug → review → fix loop

package/USER-GUIDE.md

@@ -134,7 +134,11 @@ OpenAI-compatible endpoint), LM Studio, etc.
 ![Provider settings: Base URL, API key, model, and temperature fields](https://github.com/manny-est/flowpilot/releases/download/v0.2.1/sidebar-settings-providers.png)
 
 4. Click **Pre-flight check**. This saves your settings and sends a small
-   test request. A reply in the chat panel means you're connected.
+   test request. A reply in the chat panel means you're connected. **This
+   step is required** — a provider must pass Pre-flight check before Chat,
+   Generate, Modify, Document, or Build will send it anything; a provider
+   you just added or just changed the Base URL/API key on starts
+   unconfirmed until this check passes again.
 
 ![A successful Pre-flight check reply in Chat](https://github.com/manny-est/flowpilot/releases/download/v0.2.1/preflight-success.png)
 

package/flowpilot-core.css

@@ -108,6 +108,21 @@
     border-color: rgba(80, 130, 255, 0.35);
 }
 
+/* Subordinate to the deterministic run summary above it (C1): same shape,
+   visibly de-emphasized so a model's free-text recap can't be mistaken for
+   the authoritative per-item outcome. */
+.fp-secondary {
+    padding: 8px 14px;
+    background: transparent;
+    border-style: dashed;
+    font-size: 12px;
+    color: var(--red-ui-secondary-text-color, #888);
+}
+
+.fp-secondary .fp-label {
+    opacity: 0.7;
+}
+
 /* Reasoning / thinking block — shown for models that emit reasoning_content
    (e.g. Nemotron, DeepSeek-R1). Sits above the assistant response bubble.
    Expanded while the model thinks; collapses automatically when content starts. */
@@ -249,7 +264,7 @@
     padding: 4px 0;
 }
 
-.fp-typing span:not(.fp-typing-label) {
+.fp-typing span:not(.fp-typing-label):not(.fp-typing-elapsed) {
     width: 7px;
     height: 7px;
     border-radius: 50%;
@@ -258,8 +273,15 @@
     animation: fp-bounce 1.2s infinite ease-in-out;
 }
 
-.fp-typing span:nth-child(2) { animation-delay: 0.18s; }
-.fp-typing span:nth-child(3) { animation-delay: 0.36s; }
+/* CLAUDE-033: matches the base rule's :not() clauses too, so specificity
+   (0,4,1) beats the base rule's (0,3,1) — otherwise the base rule's
+   "animation" SHORTHAND implicitly resets animation-delay back to 0s on
+   every dot regardless of source order, since shorthand properties reset
+   unspecified sub-values, and CSS resolves same-property conflicts by
+   specificity first. Without this, all three dots silently bounce in
+   perfect sync instead of staggered. */
+.fp-typing span:not(.fp-typing-label):not(.fp-typing-elapsed):nth-child(2) { animation-delay: 0.18s; }
+.fp-typing span:not(.fp-typing-label):not(.fp-typing-elapsed):nth-child(3) { animation-delay: 0.36s; }
 
 .fp-typing-label {
     font-size: 11px;
@@ -268,6 +290,12 @@
     align-self: center;
 }
 
+.fp-typing-elapsed {
+    font-size: 11px;
+    color: var(--red-ui-secondary-text-color, #999);
+    align-self: center;
+}
+
 .fp-agent-stop {
     margin-left: 8px;
     align-self: center;
@@ -371,15 +399,11 @@
     font-size: 16px;
 }
 
-/* Secondary/escape-hatch variant: muted dark background, muted text.
+/* Secondary/escape-hatch variant: transparent background, muted text.
    Same hover glow as fp-chip-card so it reads as part of the same family
-   without competing visually with the primary action above it. Explicit
-   background, not transparent — .fp-message's surrounding bubble follows
-   Node-RED's light editor theme variable by default, so "transparent"
-   showed through as plain white instead of blending into a dark parent
-   that doesn't actually exist. */
+   without competing visually with the primary action above it. */
 .fp-chip-card.fp-chip-card-alt {
-    background: #171e25;
+    background: transparent;
     border-color: #2a333c;
     color: #8a96a3;
 }
@@ -388,6 +412,14 @@
     font-weight: 500;
 }
 .fp-chip-card.fp-chip-card-alt:hover {
+    /* CLAUDE-031: this variant's background stays transparent at rest by
+       design, so on Node-RED's LIGHT theme it inherits a white/near-white
+       surrounding background — the near-white hover text below then had
+       nothing dark to sit on and became unreadable. A solid dark fill on
+       hover (paired with the same green glow as the primary chip) fixes
+       contrast regardless of the surrounding theme, without touching the
+       transparent, theme-following look at rest. */
+    background: #141a21;
     border-color: #46d39a;
     box-shadow: inset 0 1px 0 rgba(255, 255, 255, 0.05), 0 0 0 1px #46d39a, 0 0 14px -2px #46d39a;
     color: #dfe6ee;
@@ -722,6 +754,17 @@
 .fp-todo-item-done    { color: #1a7a1a; }
 .fp-todo-item-failed  { color: #b22222; }
 
+/* P10-D2: honest-interruption notice appended inside a "todo" record whose
+   last run event isn't "done" (see rerenderTodoRecord, modes.js). */
+.fp-todo-interrupted {
+    margin-top: 6px;
+    padding: 4px 8px;
+    border-radius: 4px;
+    font-size: 12px;
+    background: rgba(200, 140, 0, 0.10);
+    color: #8a5a00;
+}
+
 .fp-json-toolbar {
     display: flex;
     justify-content: flex-end;

package/flowpilot-node-entry.js

@@ -0,0 +1,15 @@
+// Node-RED's "nodes" registration entry needs its own .js file, separate
+// from flowpilot.js — Node-RED derives an editor-template path for every
+// declared "nodes" entry by replacing the .js extension with .html
+// (@node-red/registry/lib/loader.js loadNodeConfig: `file.replace(/\.c?js$/,".html")`),
+// with NO awareness of the "plugins" entry that already explicitly declares
+// flowpilot.html. If this entry pointed at flowpilot.js directly, Node-RED
+// would derive "flowpilot.html" as this node's own template, find the real
+// file (same basename), and load its content a SECOND time — the plugin's
+// entire client bundle (flowpilot/core.js and its inline init script)
+// ends up in the editor page twice, executing every module-level
+// side effect (including sessionStorage init) twice per page load.
+// This shim's own basename ("flowpilot-node-entry") has no matching .html,
+// so Node-RED's template lookup misses (ENOENT) and loads no content for
+// it — exactly what a route-registration-only, no-editor-UI node needs.
+module.exports = require("./flowpilot.js");