@manny-est/node-red-flowpilot 0.6.0-beta.1 → 0.6.0

package/CHANGELOG.md

@@ -2,34 +2,61 @@
 
 All notable changes to FlowPilot are documented here.
 
-## [0.6.0-beta.1] - 2026-08-31
+## [0.6.0] - 2026-09-01
 
-Prerelease — published to the `beta` npm tag only. `latest` stays on `0.5.2`.
+Promoted from `0.6.0-beta.1` to the stable `latest` npm tag.
 
 ### Added
-- **Agentic WRITE-tool loop for Modify** (behind the `enableAgentWrite`
-  setting, default off): step-by-step tool calls against the live flow
-  (`apply_step`, `remove_step`, `rename_node`, `group_nodes`), each
-  write-gated by a per-step consent prompt (Proceed / Skip this step) before
-  it touches the canvas. Multi-item requests are tracked and executed as
-  separate, individually-verified steps rather than one all-or-nothing
-  envelope; an injected mid-run failure (e.g. a referenced node no longer
-  exists) fails only that item, with the rest completing normally.
+- **Agentic WRITE-tool loop for Modify and Generate** (behind the
+  `enableAgentWrite` setting, default off): step-by-step tool calls
+  against the live flow (`apply_step`, `remove_step`, `rename_node`,
+  `group_nodes`), each write-gated by a per-step consent prompt (Proceed
+  / Skip this step) before it touches the canvas. Multi-item requests are
+  tracked and executed as separate, individually-verified steps rather
+  than one all-or-nothing envelope; an injected mid-run failure (e.g. a
+  referenced node no longer exists) fails only that item, with the rest
+  completing normally. Generate joined the same agentic runtime Modify
+  already used, closing the last place a mutation could land through the
+  older, less-verified classic JSON path while write-tool mode is on.
 - **`ask_user` clarifying-question tool**: an agent-strategy turn can pause
   mid-run to ask a single focused question (with optional quick-reply
   buttons) instead of guessing, and resumes exactly where it left off once
   answered.
+- **Deterministic run summaries**: when a Modify or Generate run actually
+  applied WRITE-tool steps, the per-item outcome you see (✓ applied and
+  verified / ✗ failed, with why) now comes straight from what the tools
+  actually reported — not from the model's own retelling. The model's own
+  wrap-up explanation still shows, underneath, clearly secondary — useful
+  context, never the thing you have to trust to know what really
+  happened.
 - **Contract-exclusivity enforcement**: a server-side safety net
   (`enforceAgentContract`) strips any classic-style mutation fields
-  (`changes`/`newNodes`/`newWires`/`removeNodes`/`newGroups`) that
+  (`changes`/`newNodes`/`newWires`/`removeNodes`/`newGroups`/`flow`) that
   accidentally appear on an agent-strategy turn with no tool calls, before
   they ever reach the client — the two mutation paths (classic envelope vs.
-  agentic WRITE tools) stay mutually exclusive per turn.
+  agentic WRITE tools) stay mutually exclusive per turn, for every mode
+  that can run agentically.
 - **Run identity and honest interruption**: agent-strategy runs now carry a
   stable run/operation id so a duplicate tool-call delivery (a retry, or the
   model repeating itself) is applied at most once; a run that's stopped or
   hits its step/token ceiling reports an honest "interrupted after N steps"
-  instead of silently truncating.
+  instead of silently truncating. That step-by-step record is also now
+  visible to the server (previously client-side only), the foundation for
+  the deterministic run summaries above.
+
+### Fixed
+- **The FlowPilot sidebar's entire client script was loading twice on
+  every single editor page load** — a packaging issue present since the
+  plugin's first release, only now found and fixed. In practice this
+  meant a page reload silently lost the current conversation (a second,
+  redundant script execution would stomp the first one's restored state)
+  and, more subtly, any other one-time setup code in the client ran
+  twice per load. Reloading the Node-RED editor now correctly picks the
+  conversation back up where you left off.
+- Anthropic (Claude) responses now get the exact same deterministic
+  run-summary and contract-exclusivity treatment as every other
+  provider — verified directly against Claude Sonnet, not just the
+  OpenAI-compatible path.
 
 ### Security
 - **API keys are now write-only over HTTP** (previously exposed on
@@ -60,6 +87,59 @@ Prerelease — published to the `beta` npm tag only. `latest` stays on `0.5.2`.
   `dev-docs/current/Phase10-Build-Progress.md` and
   `dev-docs/current/Phase10-Gate-Closeout-Final.md`.
 
+## [0.5.2] - 2026-08-04
+
+This release continues the 0.5.x line. Phase 10's agentic Modify redesign
+(WRITE-tool loop, per-call consent gates, `ask_user`) is developed
+separately and is not included here — it ships under its own beta line
+until it's ready to replace this one.
+
+### Added
+- **Anthropic provider support**: FlowPilot can now talk directly to the
+  Anthropic API (Claude models) alongside any OpenAI-compatible endpoint.
+  A new Provider Type dropdown in Settings switches between them; message
+  format, tool-call translation, and streaming (SSE) are handled
+  transparently by a dedicated adapter. Leave Base URL blank to use
+  `api.anthropic.com`.
+- **Reasoning model support**: FlowPilot detects reasoning models
+  (Nemotron, DeepSeek, QwQ, and any model returning `reasoning_content` or
+  `<think>` blocks) and shows a live collapsing "Thinking…" block during
+  streaming, or a pre-collapsed one on the agent-loop path.
+- **Auto-preflight on model change**: switching models and sending a
+  message silently probes capabilities first — no more manual "Test
+  Provider" click after every model swap.
+- **`/refresh` command**: re-renders the message panel from the in-memory
+  record store without losing conversation history — restores interactive
+  Apply buttons and review panels that went stale after a long session.
+- **Build loop — consent gates for side-effecting steps, checkpoint
+  questions, context-aware start from a selection, and an explicit
+  done/fail confirmation** instead of silently stopping.
+- **Modify — todo/plan checklist rendering**: multi-item Modify requests
+  now show a checklist that resolves as verification confirms each item
+  landed, instead of a single opaque pass/fail.
+- **Config node support**: config nodes (MQTT brokers, TLS configs, etc.)
+  are now exposed in context and can be created/connected by Modify.
+- **Server-side validator/repair layer**: malformed model output is
+  caught and, where possible, automatically repaired before it reaches
+  the canvas.
+
+### Fixed
+- Redaction round-trip poisoning, token-credential redaction gaps, and
+  several redaction echo/false-positive fixes across Modify and the build
+  loop's review step.
+- Group data corruption from a stray `changes` patch touching a group's
+  membership array directly; mixed-membership group create/extend
+  corruption.
+- Invalid port wiring (wiring to/from a port index that doesn't exist)
+  now guarded instead of silently applied.
+- New-node insertion collision avoidance tuned for faster, more reliable
+  separation on dense flows.
+- Several build-loop review false positives (metadata-field echoes,
+  debug/function/mqtt node misclassification, stale in-progress status
+  read as a real error).
+- Partial id-validation no longer discards an entire valid Modify batch
+  over one bad node id.
+
 ## [0.5.1] - 2026-07-24
 
 ### Added

package/README.md

@@ -26,7 +26,9 @@ installation, the sidebar UI, and a chapter on every feature.
 - **User-initiated only** — FlowPilot never changes your flow without an
   explicit request.
 - **Complete visibility** — every proposed change is shown as a diff/review
-  before anything is applied.
+  before it's applied; in the opt-in agentic mode (below), each step is
+  gated by its own Proceed/Skip prompt instead, so you're still in control
+  of what actually lands on the canvas.
 - **Undo first** — every change goes through Node-RED's native undo
   (Ctrl+Z), including multi-part changes (insertions + rewires + new nodes)
   as a single step.
@@ -73,6 +75,13 @@ See the [User Guide](USER-GUIDE.md#privacy-and-safety) for the full details.
   Document, with a clear notice when older messages are truncated.
 - **Clarifying questions** — if an instruction is too vague to act on
   safely, FlowPilot asks ONE question instead of guessing.
+- **Agentic mode (opt-in, Settings)** — Generate and Modify can work
+  step by step instead of one big review-then-apply diff: each step
+  (insert, rewire, rename, remove, group) lands on the canvas as it's
+  proposed, gated by its own Proceed/Skip consent prompt for anything
+  beyond the safest node types. The summary you see when a run finishes
+  is built from what the tools actually reported happened, not just the
+  model's own retelling — if a step failed or was skipped, it says so.
 - **Streaming replies** — optional SSE streaming for chat responses.
 - **`/build`** — describe a goal and FlowPilot plans it, proposes a first
   flow, then walks an interactive build → deploy → debug → review → fix loop

package/flowpilot-core.css

@@ -108,6 +108,21 @@
     border-color: rgba(80, 130, 255, 0.35);
 }
 
+/* Subordinate to the deterministic run summary above it (C1): same shape,
+   visibly de-emphasized so a model's free-text recap can't be mistaken for
+   the authoritative per-item outcome. */
+.fp-secondary {
+    padding: 8px 14px;
+    background: transparent;
+    border-style: dashed;
+    font-size: 12px;
+    color: var(--red-ui-secondary-text-color, #888);
+}
+
+.fp-secondary .fp-label {
+    opacity: 0.7;
+}
+
 /* Reasoning / thinking block — shown for models that emit reasoning_content
    (e.g. Nemotron, DeepSeek-R1). Sits above the assistant response bubble.
    Expanded while the model thinks; collapses automatically when content starts. */

package/flowpilot-node-entry.js

@@ -0,0 +1,15 @@
+// Node-RED's "nodes" registration entry needs its own .js file, separate
+// from flowpilot.js — Node-RED derives an editor-template path for every
+// declared "nodes" entry by replacing the .js extension with .html
+// (@node-red/registry/lib/loader.js loadNodeConfig: `file.replace(/\.c?js$/,".html")`),
+// with NO awareness of the "plugins" entry that already explicitly declares
+// flowpilot.html. If this entry pointed at flowpilot.js directly, Node-RED
+// would derive "flowpilot.html" as this node's own template, find the real
+// file (same basename), and load its content a SECOND time — the plugin's
+// entire client bundle (flowpilot/core.js and its inline init script)
+// ends up in the editor page twice, executing every module-level
+// side effect (including sessionStorage init) twice per page load.
+// This shim's own basename ("flowpilot-node-entry") has no matching .html,
+// so Node-RED's template lookup misses (ENOENT) and loads no content for
+// it — exactly what a route-registration-only, no-editor-UI node needs.
+module.exports = require("./flowpilot.js");

package/flowpilot.js

@@ -1,5 +1,7 @@
 const http = require("http");
+const https = require("https");
 const path = require("path");
+const PACKAGE_VERSION = require("./package.json").version;
 const createStorage = require("./lib/storage");
 const openaiProvider = require("./lib/provider-openai-compatible");
 const anthropicProvider = require("./lib/provider-anthropic");
@@ -82,6 +84,110 @@ const { repairEnvelope } = require("./lib/validator");
 const { enforceAgentContract } = require("./lib/agent-contract");
 const { isProviderShapedResponse } = require("./lib/provider-shape-check");
 const API_KEY_UNCHANGED = createStorage.API_KEY_UNCHANGED;
+const UPDATE_CHECK_URL = "https://registry.npmjs.org/-/package/@manny-est/node-red-flowpilot/dist-tags";
+const UPDATE_CHECK_SUCCESS_TTL_MS = 6 * 60 * 60 * 1000;
+const UPDATE_CHECK_FAILURE_TTL_MS = 15 * 60 * 1000;
+const RUN_EVENTS_MAX_STORED = 50;
+const runEventsStore = new Map();
+let updateCheckCache = null;
+
+function parseVersion(v) {
+  var parts = String(v).split("-");
+  var core = parts[0].split(".").map(Number);
+  var pre = parts.length > 1 ? parts.slice(1).join("-").split(".") : null;
+  return { core: core, pre: pre };
+}
+
+function isNewer(remoteVersion, localVersion) {
+  var r = parseVersion(remoteVersion), l = parseVersion(localVersion);
+  for (var i = 0; i < 3; i++) {
+    var rv = r.core[i] || 0, lv = l.core[i] || 0;
+    if (rv !== lv) { return rv > lv; }
+  }
+  // core version numbers are equal
+  if (!r.pre && l.pre) { return true; }   // remote is a full release, local is a prerelease of the same core
+  if (r.pre && !l.pre) { return false; }  // remote is a prerelease, local is already past it
+  if (!r.pre && !l.pre) { return false; } // identical plain releases
+  // both are prereleases of the same core version — compare the last dot segment numerically if possible
+  var rn = Number(r.pre[r.pre.length - 1]);
+  var ln = Number(l.pre[l.pre.length - 1]);
+  if (!isNaN(rn) && !isNaN(ln)) { return rn > ln; }
+  return r.pre.join(".") !== l.pre.join(".") && r.pre.join(".") > l.pre.join(".");
+}
+
+function updateCheckFallbackResponse() {
+  return { enabled: true, updateAvailable: false };
+}
+
+function fetchUpdateDistTags() {
+  return new Promise((resolve, reject) => {
+    let url;
+    try {
+      url = new URL(UPDATE_CHECK_URL);
+    } catch (err) {
+      reject(err);
+      return;
+    }
+
+    const req = https.request({
+      method: "GET",
+      hostname: url.hostname,
+      port: url.port || 443,
+      path: url.pathname + url.search,
+      headers: { Accept: "application/json" }
+    }, (res) => {
+      let data = "";
+      res.setEncoding("utf8");
+      res.on("data", chunk => { data += chunk; });
+      res.on("end", () => {
+        let parsed = null;
+        try {
+          parsed = data ? JSON.parse(data) : null;
+        } catch (err) {
+          reject(err);
+          return;
+        }
+        if (res.statusCode !== 200 || !parsed || typeof parsed !== "object") {
+          reject(new Error("Update check failed."));
+          return;
+        }
+        resolve(parsed);
+      });
+    });
+
+    req.on("error", reject);
+    req.setTimeout(5000, () => {
+      req.destroy(new Error("Timeout"));
+    });
+    req.end();
+  });
+}
+
+async function performUpdateCheck() {
+  try {
+    const distTags = await fetchUpdateDistTags();
+    const tag = PACKAGE_VERSION.indexOf("-") !== -1 ? "beta" : "latest";
+    const tagVersion = distTags && distTags[tag];
+    if (typeof tagVersion !== "string" || !tagVersion) {
+      throw new Error("Missing dist-tag.");
+    }
+    return {
+      succeeded: true,
+      result: {
+        enabled: true,
+        updateAvailable: isNewer(tagVersion, PACKAGE_VERSION),
+        latestVersion: tagVersion,
+        currentVersion: PACKAGE_VERSION,
+        tag: tag
+      }
+    };
+  } catch (err) {
+    return {
+      succeeded: false,
+      result: updateCheckFallbackResponse()
+    };
+  }
+}
 
 module.exports = function flowPilotRuntime(RED) {
   const storage = createStorage(RED.settings.userDir);
@@ -385,14 +491,17 @@ module.exports = function flowPilotRuntime(RED) {
             },
             targetNodeIds: {
               oneOf: [
-                { type: "string", enum: ["all"] },
+                { type: "string", enum: ["all", "instance"] },
                 {
                   type: "array",
                   items: { type: "string" },
                   minItems: 1
                 }
               ],
-              description: "Optional resolved node target for Document redirects."
+              description: "Optional resolved node target for Document redirects. " +
+                "\"all\" is the entire active flow/tab; \"instance\" is every flow " +
+                "tab in the whole Node-RED instance. Omit when the scope genuinely " +
+                "can't be resolved from context."
             }
           },
           required: ["mode", "prompt", "explanation"],
@@ -432,7 +541,7 @@ module.exports = function flowPilotRuntime(RED) {
 
   function agentToolsFor(settings, activeProvider, mode, writesAllowed) {
     const writesEnabled = settings.enableAgentWrite === true &&
-      mode === "modify" && writesAllowed !== false &&
+      (mode === "modify" || mode === "generate") && writesAllowed !== false &&
       activeProvider && activeProvider.supportsTools === true;
     return providerToolDefinitions(AGENT_READ_TOOLS.concat(writesEnabled ? WRITE_TOOLS : []));
   }
@@ -1233,12 +1342,43 @@ module.exports = function flowPilotRuntime(RED) {
 
   RED.httpAdmin.get("/flowpilot/settings", RED.auth.needsPermission("settings.read"), function (req, res) {
     try {
-      res.json(maskProviderSecrets(storage.getSettings()));
+      const responseBody = maskProviderSecrets(storage.getSettings());
+      responseBody.flowpilotVersion = PACKAGE_VERSION;
+      res.json(responseBody);
     } catch (err) {
       res.status(500).json({ error: err.message });
     }
   });
 
+  RED.httpAdmin.get("/flowpilot/update-check", RED.auth.needsPermission("settings.read"), async function (req, res) {
+    const settings = storage.getSettings();
+    if (settings.checkForUpdates === false) {
+      res.json({ enabled: false });
+      return;
+    }
+
+    const now = Date.now();
+    if (updateCheckCache) {
+      const ageMs = now - updateCheckCache.checkedAt;
+      if (updateCheckCache.succeeded && ageMs < UPDATE_CHECK_SUCCESS_TTL_MS) {
+        res.json(updateCheckCache.result);
+        return;
+      }
+      if (!updateCheckCache.succeeded && ageMs < UPDATE_CHECK_FAILURE_TTL_MS) {
+        res.json(updateCheckFallbackResponse());
+        return;
+      }
+    }
+
+    const check = await performUpdateCheck();
+    updateCheckCache = {
+      checkedAt: now,
+      succeeded: check.succeeded,
+      result: check.result
+    };
+    res.json(check.result);
+  });
+
   // ---- Settings: default system prompt (for "Reset to default") -------
 
   RED.httpAdmin.get("/flowpilot/default-system-prompt", RED.auth.needsPermission("settings.read"), function (req, res) {
@@ -1249,6 +1389,11 @@ module.exports = function flowPilotRuntime(RED) {
     }
   });
 
+  RED.httpAdmin.get("/flowpilot/run-events/:runId", RED.auth.needsPermission("settings.read"), function (req, res) {
+    const runId = req.params.runId;
+    res.json({ runId: runId, events: runEventsStore.get(runId) || [] });
+  });
+
   // ---- Pop-out window (Phase 8.5 C1, v1 review-only) -------------------
   // Serves the shared renderer (flowpilot-core.js, the same script
   // flowpilot.html loads for the sidebar) plus its stylesheet and the
@@ -1307,13 +1452,21 @@ module.exports = function flowPilotRuntime(RED) {
   // a known limitation, not fixed by this ticket.
 
   // ---- Provider confirmation gate (ADR-007, SSRF mitigation) -----------
-  // No operational request (chat/generate/modify/document/build/agent-step/
-  // models) touches a provider's baseUrl until that exact URL has passed a
-  // real FlowPilot provider check — see isProviderShapedResponse
+  // No operational request (chat/generate/modify/document/build/agent-step)
+  // touches a provider's baseUrl until that exact URL has passed a real
+  // FlowPilot provider check — see isProviderShapedResponse
   // (lib/provider-shape-check.js) below
-  // and /flowpilot/test, /flowpilot/probe, the only two routes allowed to
-  // contact an unconfirmed URL. confirmedBaseUrl/confirmedAt are written
-  // ONLY by those two routes on a passing check; lib/storage.js's
+  // and /flowpilot/test, /flowpilot/probe, /flowpilot/models — the only
+  // three routes allowed to contact an unconfirmed URL. The first two
+  // WRITE confirmedBaseUrl/confirmedAt on a passing check (the deliberate
+  // confirming action); /flowpilot/models never does — it's read-only
+  // reconnaissance (listing available models), safe to allow pre-confirmation
+  // the same way /probe is, but not itself a confirmation. All three stay
+  // safe against an unconfirmed/malicious target the same way: a strict
+  // shape check on any "success" response (isProviderShapedResponse for
+  // chat-shaped, isModelsListShaped for a models list) and a generic,
+  // never-reflects-the-body error on failure (enforced at the shared HTTP
+  // client layer in lib/provider-*.js). lib/storage.js's
   // reconcileProviderSecrets is the other half — it strips any
   // client-supplied confirmedBaseUrl/confirmedAt on save and clears
   // confirmation whenever baseUrl or apiKey actually changes, so
@@ -1399,16 +1552,22 @@ module.exports = function flowPilotRuntime(RED) {
   // ---- Models: list models via the active provider's /v1/models -------
   // Always acts on the SAVED active provider (the frontend saves the form
   // first, mirroring Pre-flight check), and never errors out for a provider
-  // that doesn't support /v1/models — see listModels().
+  // that doesn't support /v1/models — see listModels(). No request body is
+  // read here, so no body-presence check applies (unlike /flowpilot/settings,
+  // which does act on its body).
+  //
+  // This is the THIRD route allowed to touch an unconfirmed baseUrl (ADR-007)
+  // — users need to see a model list before ever running Pre-flight check,
+  // and the confirmation gate would otherwise block that. Kept safe the same
+  // way /flowpilot/test and /flowpilot/probe are: listModels() only trusts a
+  // genuinely provider-shaped response (isModelsListShaped) and never
+  // reflects a raw failure body. Does not itself write confirmedBaseUrl/
+  // confirmedAt — only the deliberate /flowpilot/test action confirms.
 
   RED.httpAdmin.post("/flowpilot/models", RED.auth.needsPermission("settings.write"), async function (req, res) {
-    if (!hasRequestBody(req.body)) {
-      return res.status(400).json({ error: "Request body is required." });
-    }
     try {
       const settings = storage.getSettings();
       const activeProvider = storage.getActiveProvider(settings);
-      if (!requireConfirmedProvider(res, activeProvider)) { return; }
       const result = await getProvider(activeProvider).listModels(activeProvider);
       storage.appendAudit({
         action: "list_models",
@@ -1562,6 +1721,17 @@ module.exports = function flowPilotRuntime(RED) {
     const activeProvider = storage.getActiveProvider(settings);
     const execution = requireExecutionContract(req, res, settings, activeProvider);
     if (!execution) { return; }
+    if (Array.isArray(req.body.events) && typeof execution.runId === "string" && execution.runId) {
+      runEventsStore.set(execution.runId, req.body.events);
+      if (runEventsStore.size > RUN_EVENTS_MAX_STORED) {
+        runEventsStore.delete(runEventsStore.keys().next().value);
+      }
+      maybeLogDebugEvent("run_events", {
+        mode: req.body.mode || "chat",
+        runId: execution.runId,
+        events: req.body.events
+      });
+    }
     if (!requireConfirmedProvider(res, activeProvider)) { return; }
 
     const messages = req.body && req.body.messages;
@@ -1650,7 +1820,7 @@ module.exports = function flowPilotRuntime(RED) {
                 r, (context && Array.isArray(context.nodes)) ? context.nodes : [], execution
               );
             }
-          : finalizeSimpleGeneration;
+          : function (r) { return finalizeSimpleGeneration(r, execution); };
         const { status, body } = finalize(generated);
         return res.status(status).json(body);
       }
@@ -2295,6 +2465,8 @@ module.exports = function flowPilotRuntime(RED) {
       return modifyResult;
     }
 
+    enforceAgentContract(parsed, auditContext, false);
+
     const flow = Array.isArray(parsed.flow) ? parsed.flow : null;
     if (!flow) {
       const err = new Error("The response did not contain a 'flow' array.");
@@ -2319,6 +2491,9 @@ module.exports = function flowPilotRuntime(RED) {
       newNodes: Array.isArray(parsed.newNodes) ? parsed.newNodes : [],
       newWires: Array.isArray(parsed.newWires) ? parsed.newWires : []
     };
+    if (Array.isArray(parsed.strippedFields) && parsed.strippedFields.length) {
+      flowResult.strippedFields = parsed.strippedFields.slice();
+    }
     if (auditAction === "build") {
       const fpUidManifest = buildFpUidManifest(flow);
       if (fpUidManifest.length) { flowResult.fpUidManifest = fpUidManifest; }
@@ -2353,7 +2528,7 @@ module.exports = function flowPilotRuntime(RED) {
       ? agentToolsFor(settings, activeProvider, auditAction, execution && execution.strategy === "agent")
       : [];
     const responseFormat = directCompletionResponseFormat(activeProvider, auditAction, toolsEnabled);
-    const toolChoice = auditAction === "modify" && execution &&
+    const toolChoice = (auditAction === "modify" || auditAction === "generate") && execution &&
       execution.strategy === "agent" ? "required" : "auto";
     let chatOptions = toolsEnabled
       ? { tools: offeredTools, toolChoice: toolChoice }
@@ -2498,7 +2673,7 @@ module.exports = function flowPilotRuntime(RED) {
   // Used by both the non-streaming route (res.status(status).json(body)) and
   // the streaming route (relayed as the final SSE event).
   // ---------------------------------------------------------------------
-  function finalizeSimpleGeneration(result) {
+  function finalizeSimpleGeneration(result, execution) {
     if (result.question) {
       const body = { explanation: result.explanation, question: result.question, flow: null };
       if (result.suggestedAction) { body.suggestedAction = result.suggestedAction; }
@@ -2511,6 +2686,19 @@ module.exports = function flowPilotRuntime(RED) {
       if (result.questionOptions) { proseBody.questionOptions = result.questionOptions; }
       return { status: 200, body: proseBody };
     }
+    if (execution && execution.strategy === "agent") {
+      const agentBody = {
+        explanation: result.explanation || "",
+        prose: true,
+        flow: null
+      };
+      if (Array.isArray(result.strippedFields) && result.strippedFields.length) {
+        agentBody.strippedFields = result.strippedFields.slice();
+      }
+      if (result.skippedNote) { agentBody.skippedNote = result.skippedNote; }
+      if (result.suggestedAction) { agentBody.suggestedAction = result.suggestedAction; }
+      return { status: 200, body: agentBody };
+    }
     return { status: 200, body: result };
   }
 
@@ -2871,6 +3059,11 @@ module.exports = function flowPilotRuntime(RED) {
   }
 
   RED.httpAdmin.post("/flowpilot/generate", RED.auth.needsPermission("settings.write"), async function (req, res) {
+    const settings = storage.getSettings();
+    const activeProvider = storage.getActiveProvider(settings);
+    const execution = requireExecutionContract(req, res, settings, activeProvider);
+    if (!execution) { return; }
+
     const prompt = req.body && req.body.prompt;
 
     if (!prompt || !String(prompt).trim()) {
@@ -2879,11 +3072,12 @@ module.exports = function flowPilotRuntime(RED) {
 
     const history = sanitizeHistory(req.body.history);
     const historyTruncated = !!req.body.historyTruncated;
+    const finalize = function (result) { return finalizeSimpleGeneration(result, execution); };
 
     if (req.body.stream) {
       return runExecuteStream(
         req, res, generationSystemPrompt, "generate", prompt, req.body && req.body.context,
-        history, historyTruncated, finalizeSimpleGeneration, req.body.conversationId
+        history, historyTruncated, finalize, req.body.conversationId, execution
       );
     }
 
@@ -2891,7 +3085,7 @@ module.exports = function flowPilotRuntime(RED) {
       const useTools = !!req.body.tools;
       const generated = await runFlowGeneration(
         generationSystemPrompt, "generate", prompt, req.body && req.body.context,
-        history, historyTruncated, useTools
+        history, historyTruncated, useTools, execution
       );
       if (generated.toolCalls) {
         return res.json({
@@ -2903,7 +3097,7 @@ module.exports = function flowPilotRuntime(RED) {
         });
       }
       recordTranscriptTurn(req.body.conversationId, "generate", prompt, transcriptTextFromGenerationResult(generated));
-      const { status, body } = finalizeSimpleGeneration(generated);
+      const { status, body } = finalize(generated);
       res.status(status).json(body);
     } catch (err) {
       sendGenerationError(res, "generate", err);

package/lib/agent-contract.js

@@ -4,8 +4,13 @@
 // The agent-strategy contract: a "strategy":"agent" turn is only ever
 // allowed to mutate the flow via a WRITE tool call, never via the classic
 // JSON-envelope mutation fields (changes/newNodes/newWires/removeNodes/
-// newGroups). If a model still emits those fields on a turn that made no
-// tool calls, strip them before the response reaches the client and log
+// newGroups for Modify; flow for Generate/Document/Build — Generate's own
+// envelope shape uses "flow", not "newNodes"/"newWires", found live during
+// the 0.6.0 FINISH-list pass: the field was missing from this list entirely,
+// so an agent-strategy Generate final turn with no tool calls could emit a
+// full flow array completely unprotected). If a model still emits those
+// fields on a turn that made no tool calls, strip them before the response
+// reaches the client and log
 // what was stripped — the two mutation code paths (classic envelope vs.
 // agentic WRITE tools) must stay mutually exclusive per agent turn.
 // Classic-strategy turns and turns that DID make tool calls are untouched
@@ -13,7 +18,7 @@
 // violating shape it exists to catch.
 // ---------------------------------------------------------------------
 
-const AGENT_MUTATION_FIELDS = ["changes", "newNodes", "newWires", "removeNodes", "newGroups"];
+const AGENT_MUTATION_FIELDS = ["changes", "newNodes", "newWires", "removeNodes", "newGroups", "flow"];
 
 function enforceAgentContract(result, execution, hasToolCalls) {
   if (!result || !execution || execution.strategy !== "agent" || hasToolCalls) {