@manny-est/node-red-flowpilot 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 All notable changes to FlowPilot are documented here.
 
+## [0.6.1] - 2026-09-02
+
+### Fixed
+- **Deterministic run summaries actually work now.** 0.6.0 shipped this
+  feature — the per-item ✓/✗ outcome from a Modify or Generate run,
+  built from what the WRITE tools actually reported instead of the
+  model's own retelling — but a control-flow bug in the message-
+  rendering path made it unreachable for every real run: the code path
+  that shows the deterministic summary as primary (with the model's
+  own explanation demoted underneath) never executed. Every response
+  fell through to showing the model's own prose at full weight
+  instead, exactly the narrative-accuracy gap this feature exists to
+  close. Found and fixed during this release's own go-live testing,
+  now live-verified against a real agentic write.
+- **Installed-package awareness was silently non-functional — FlowPilot
+  now actually receives your palette.** The feature that keeps
+  Generate/Modify from proposing node types you don't have, and lets
+  FlowPilot correctly answer "is X installed?", called a Node-RED API
+  that doesn't exist on this version's plugin interface. The call was
+  a silent no-op on every single request: FlowPilot never had real
+  palette information to work with, so the model either said as much
+  or, in some cases, guessed. This wasn't a timing bug or a stale
+  cache — the underlying data source itself never worked. Now reads
+  the live node registry directly and is correct immediately, from
+  the very first request after a restart.
+
 ## [0.6.0] - 2026-09-01
 
 Promoted from `0.6.0-beta.1` to the stable `latest` npm tag.

package/flowpilot.js

@@ -1,6 +1,6 @@
-const http = require("http");
 const https = require("https");
 const path = require("path");
+const nodeRedRegistry = require("@node-red/registry");
 const PACKAGE_VERSION = require("./package.json").version;
 const createStorage = require("./lib/storage");
 const openaiProvider = require("./lib/provider-openai-compatible");
@@ -189,7 +189,47 @@ async function performUpdateCheck() {
   }
 }
 
+// Found live (0.6.1), while verifying the palette-cache fix below: Node-RED
+// loads flowpilot.js TWICE per process start, and always has — package.json
+// declares BOTH "nodes": {"flowpilot": "flowpilot-node-entry.js"} (itself a
+// shim added earlier this same release for a related but distinct bug — see
+// that shim's own comment) AND "plugins": {"flowpilot": "flowpilot.html"}.
+// @node-red/registry/lib/loader.js's loadPluginConfig derives a companion
+// runtime file for every "plugins" entry via the SAME basename-replace
+// pattern (file.replace(/\.[^.]+$/,".js")) that caused the earlier
+// flowpilot.html double-load — "flowpilot.html" -> "flowpilot.js", which
+// genuinely exists, so Node-RED loads and calls it a second time completely
+// independently of the "nodes" entry's shim. Confirmed live: a temporary
+// diagnostic showed flowPilotRuntime executing twice per restart, and a
+// registered RED.events.on("nodes-started", ...) listener firing twice.
+// Unlike the client-side html/script duplication, this one can't be closed
+// by renaming what "plugins" points to without duplicating flowpilot.html's
+// content under a second filename — not worth the maintenance burden for
+// what's fundamentally the same fix in spirit. Guard here instead.
+//
+// A first attempt at this guard used a plain module-level `let` flag,
+// reasoning that Node's require() cache makes a module's own top-level code
+// run exactly once. That reasoning doesn't hold here: confirmed by reading
+// @node-red/registry/lib/loader.js directly, the "nodes" entry is loaded via
+// loadNodeSet, which uses a dynamic import() of a file:// URL (see its
+// `pathToFileURL(node.file)` call), while the "plugins" entry's companion
+// file is loaded via loadPlugin, which uses a plain require(). Node's CJS
+// require() cache and its ESM import() module cache are not the same
+// cache — a module reached through both paths can genuinely execute its
+// top-level code twice, each with its OWN independent closure (own
+// `let flowPilotRuntimeInitialized`, own everything). Confirmed live: a
+// module-level flag did NOT stop the second invocation's independent
+// httpAdmin route registrations from being the ones actually serving
+// requests, while the diagnostic-carrying instance sat silent.
+//
+// Fix: mark completion on `global` instead. Node's global object is a
+// true process-wide singleton — unaffected by which loader/module-cache
+// reached this file — so it's a reliable gate regardless of how many
+// separate module realms this file's code ends up evaluated in.
 module.exports = function flowPilotRuntime(RED) {
+  if (global.__flowPilotRuntimeInitialized) { return; }
+  global.__flowPilotRuntimeInitialized = true;
+
   const storage = createStorage(RED.settings.userDir);
 
   // ---------------------------------------------------------------------
@@ -703,17 +743,42 @@ module.exports = function flowPilotRuntime(RED) {
   // their node types when relevant and otherwise stick to core nodes
   // rather than proposing types that aren't installed.
   //
-  // The node-level RED API passed to this module has no direct registry
-  // lookup (no RED.nodes.getNodeList), so the node list is fetched via a
-  // loopback call to Node-RED's own admin API (the same data the palette
-  // sidebar uses) and cached briefly — the palette rarely changes, and
-  // every chat/generate/document/modify request goes through
-  // buildMessages, so this must stay cheap and synchronous.
+  // Node-RED's admin GET /nodes route ultimately reads the runtime registry's
+  // getNodeList(). A previous fix tried to reach that through RED.nodes, but
+  // Node-RED 5's @node-red/registry/lib/util.js createNodeApi only copies a
+  // small allow-list onto the node-level RED API (createNode/getNode/
+  // eachNode/addCredentials/getCredentials/deleteCredentials) —
+  // getNodeList is NOT one of them. Confirmed live: RED.nodes.getNodeList is
+  // undefined in this runtime, so describeInstalledNodes() quietly returned
+  // null from its catch on every request even after flows:started had fired.
+  //
+  // Use the registry module directly instead. FlowPilot already runs inside
+  // the same Node-RED process, and @node-red/registry is the exact source
+  // runtime.nodes.getNodeList() delegates to.
+  //
+  // Found live (0.6.1): this WAS a cached snapshot, through three
+  // successive designs (a naive restart-seeded TTL timer; a
+  // "nodes-started"-gated refresh; that plus a bounded settle re-check on
+  // top), because the original data source was an HTTP loopback to this
+  // same instance's own /nodes admin route — expensive enough to be worth
+  // caching, and, on any adminAuth-enabled instance, unable to
+  // authenticate itself at all (a real bug, fixed by switching to the
+  // in-process RED.nodes.getNodeList() call below). Once the data source
+  // is a synchronous, already-in-memory function call, caching it stops
+  // paying for itself — it only adds staleness/timing bugs, three of
+  // which got live-found in a row this same afternoon (the gate never
+  // set; set but the fetch 401ing; set and fetched but still an early
+  // snapshot for a slow-registering package like uibuilder). The one
+  // thing still worth gating is genuinely knowing nothing yet: before
+  // Node-RED's own "flows:started" event (the non-deprecated alias of
+  // "nodes-started", confirmed emitted from
+  // @node-red/runtime/lib/flows/index.js right after every active flow's
+  // own start() resolves) has fired at least once,
+  // describeInstalledNodes() returns null — "don't know yet" instead of a
+  // false "confirmed absent."
   // ---------------------------------------------------------------------
-  let installedNodesCache = null;
-  let installedNodesCacheAt = 0;
-  let installedNodesRefreshInFlight = false;
-  const INSTALLED_NODES_CACHE_TTL_MS = 5 * 60 * 1000;
+  let nodesRegistryReady = false;
+  RED.events.on("flows:started", function () { nodesRegistryReady = true; });
 
   function buildInstalledNodesContent(list) {
     if (!Array.isArray(list)) { return null; }
@@ -752,39 +817,13 @@ module.exports = function flowPilotRuntime(RED) {
     return content;
   }
 
-  function refreshInstalledNodesCache() {
-    if (installedNodesRefreshInFlight) { return; }
-    installedNodesRefreshInFlight = true;
-
-    const root = String(RED.settings.httpAdminRoot || "/").replace(/\/+$/, "");
-    const req = http.get({
-      host: "127.0.0.1",
-      port: RED.settings.uiPort,
-      path: root + "/nodes",
-      headers: { Accept: "application/json" },
-      timeout: 5000
-    }, function (res) {
-      const chunks = [];
-      res.on("data", function (chunk) { chunks.push(chunk); });
-      res.on("end", function () {
-        installedNodesRefreshInFlight = false;
-        if (res.statusCode !== 200) { return; }
-        try {
-          const list = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-          installedNodesCache = buildInstalledNodesContent(list);
-          installedNodesCacheAt = Date.now();
-        } catch (err) { /* leave previous cache value in place */ }
-      });
-    });
-    req.on("error", function () { installedNodesRefreshInFlight = false; });
-    req.on("timeout", function () { req.destroy(); installedNodesRefreshInFlight = false; });
-  }
-
   function describeInstalledNodes() {
-    if (Date.now() - installedNodesCacheAt > INSTALLED_NODES_CACHE_TTL_MS) {
-      refreshInstalledNodesCache();
+    if (!nodesRegistryReady) { return null; }
+    try {
+      return buildInstalledNodesContent(nodeRedRegistry.getNodeList());
+    } catch (err) {
+      return null;
     }
-    return installedNodesCache;
   }
 
   // Chat-only: the user's base system prompt plus a freshly-generated

package/lib/core/modes.js

@@ -1259,7 +1259,19 @@
             updateSelectionStatus();
             return true;
         }
-        if (data.prose) {
+        // finalizeSimpleGeneration/finalizeModifyResult set prose:true on
+        // EVERY agent-strategy final response, whether or not real
+        // WRITE-tool work happened this run — it's the server's generic
+        // "no classic flow/changes to review" signal, not a claim that
+        // nothing happened. When real write results are attached
+        // (data._agentWriteResults, added client-side in handleStep before
+        // onDone fires), the caller's own deterministic-summary rendering
+        // needs to run instead of this generic prose bubble — bug found
+        // live during the 0.6.0 go-live smoke test: this unconditional
+        // early-return made C1's entire deterministic-summary/prose-
+        // demotion feature unreachable for every real agent-strategy run.
+        var hasRealWriteResults = Array.isArray(data._agentWriteResults) && data._agentWriteResults.length > 0;
+        if (data.prose && !hasRealWriteResults) {
             if (looksLikeToolEnvelope(data.explanation)) {
                 handleExecuteError("FlowPilot's reply didn't come through as expected.", data.explanation);
                 updateSelectionStatus();
@@ -1320,7 +1332,7 @@
         // executable flows (not documentation-only comment nodes) and when no
         // loop is already active. The secondary "Just add to canvas" button is
         // always shown alongside it as an escape hatch.
-        var _hasDeployable = flow.some(function (n) { return n && n.type !== "comment" && n.type !== "group"; });
+        var _hasDeployable = (flow || []).some(function (n) { return n && n.type !== "comment" && n.type !== "group"; });
         var _buildOnImported = (goalPrompt && !activeBuildLoop && _hasDeployable)
             ? function (importResult) { startBuildLoop(goalPrompt, flow, importResult); }
             : null;
@@ -2019,7 +2031,7 @@
         // also runs verifyImportedNodes so the todo record still gets checked
         // off. Without a build loop, fall back to a plain "Add to canvas"
         // button that still fires the verify callback.
-        var _hasDeployable = flow.some(function (n) { return n && n.type !== "comment" && n.type !== "group"; });
+        var _hasDeployable = (flow || []).some(function (n) { return n && n.type !== "comment" && n.type !== "group"; });
         var _wantLoop = goalPrompt && !activeBuildLoop && _hasDeployable;
         var _onImported = _wantLoop
             ? function (importResult) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manny-est/node-red-flowpilot",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "FlowPilot for Node-RED - an AI-powered development assistant sidebar",
   "main": "flowpilot.js",
   "keywords": [