@tbrandenburg/node-red-cli 0.2.12 → 0.2.14

package/README.md

@@ -54,6 +54,7 @@ make install-global
   - [Passing flow JSON inline](#passing-flow-json-inline)
   - [Installing additional Node-RED node packages](#installing-additional-node-red-node-packages)
   - [Running sandboxed in Docker](#running-sandboxed-in-docker-)
+  - [Agentic workflows](#agentic-workflows-)
 - [Host API](#host-api-)
 - [Technical approach](#technical-approach-)
 - [Preflight and limitations](#preflight-and-limitations-)
@@ -277,7 +278,9 @@ Sandboxing defaults applied to every `--docker` run:
 
 - `--rm -i` (always disposable)
 - `--network none`, unless `--node-modules` is also given (needs registry
-  access) — narrowest network exposure by default
+  access) or `--network` is passed explicitly (enables network access for a
+  flow that needs to call out, independent of installing any package) —
+  narrowest network exposure by default
 - `--read-only` root filesystem + a `/tmp` tmpfs mount
 - `--cap-drop=ALL`
 - `--security-opt=no-new-privileges`
@@ -293,6 +296,49 @@ failed: ...` if the image build fails (e.g. the local version isn't yet
 published to npm — use `--docker <image>` or `--docker @path` as an
 escape hatch in that case).
 
+### Agentic workflows 🤖
+
+Node-RED nodes such as [`agent`](https://www.npmjs.com/package/@tbrandenburg/node-red-agents)
+(OpenCode, `pi`) turn a `link in -> agent -> link out (return)` flow into a
+callable AI step, invoked like any other target — a JSON flow with an
+inline multiline prompt, in one command:
+
+```bash
+echo '{"payload":"Summarize this repo in one sentence.","cwd":"/repo"}' \
+  | node-red-cli --flow-json '[
+      {"id":"tab","type":"tab","label":"Agent"},
+      {"id":"ask","type":"link in","z":"tab","name":"ask","wires":[["agent"]]},
+      {"id":"agent","type":"agent","z":"tab","name":"opencode","agent":"opencode",
+       "runtime":"direct","prompt":"payload","promptType":"msg",
+       "cwd":"cwd","cwdType":"msg","wires":[["return"],[]]},
+      {"id":"return","type":"link out","z":"tab","name":"return","mode":"return"}
+    ]' ask --node-modules @tbrandenburg/node-red-agents --user-dir --timeout=120000 --format=json
+```
+
+The same flow runs sandboxed via `--docker <image>` against an image that
+already ships `opencode` + `node-red-agents`, e.g.
+[`ghcr.io/tbrandenburg/agentic-workflow-dev-env`](https://github.com/tbrandenburg/agentic-workflow-dev-env)
+(`--network` is required for network access, since the agent calls out to
+its own API; `--node-modules`/`--user-dir` are still required too, since
+Node-RED only discovers node types from a userDir it actually loaded —
+see [#24](https://github.com/tbrandenburg/node-red-cli/issues/24) for a
+currently-tracked compatibility gap when the image's own default userDir
+already ships the package):
+
+```bash
+echo '{"payload":"Summarize this repo in one sentence.","cwd":"/repo"}' \
+  | node-red-cli --flow-json '[
+      {"id":"tab","type":"tab","label":"Agent"},
+      {"id":"ask","type":"link in","z":"tab","name":"ask","wires":[["agent"]]},
+      {"id":"agent","type":"agent","z":"tab","name":"opencode","agent":"opencode",
+       "runtime":"direct","prompt":"payload","promptType":"msg",
+       "cwd":"cwd","cwdType":"msg","wires":[["return"],[]]},
+      {"id":"return","type":"link out","z":"tab","name":"return","mode":"return"}
+    ]' ask --docker ghcr.io/tbrandenburg/agentic-workflow-dev-env:latest \
+    --node-modules @tbrandenburg/node-red-agents --user-dir --network \
+    --timeout=120000 --format=json
+```
+
 ## Host API 🛠️
 
 The core interface is intentionally small:

package/bin/node-red-cli.js

@@ -70,10 +70,11 @@ const HELP_TEXT = [
   "  - '@<path>' or an http(s) URL: build from a Dockerfile (local file or",
   "    fetched URL), cached by content hash.",
   "Sandboxing defaults: --network none (unless --node-modules is also set,",
-  "which needs registry access), --read-only rootfs with a /tmp tmpfs,",
-  "--cap-drop=ALL, --security-opt=no-new-privileges. When combined with",
-  "--user-dir, persistence uses a named Docker volume, never a host bind",
-  "mount.",
+  "which needs registry access, or --network is passed explicitly to enable",
+  "network access independent of installing any package), --read-only",
+  "rootfs with a /tmp tmpfs, --cap-drop=ALL, --security-opt=no-new-privileges.",
+  "When combined with --user-dir, persistence uses a named Docker volume,",
+  "never a host bind mount.",
   "",
   "Example:",
   '  echo \'{"payload":{"x":4,"y":5}}\' | node-red-cli flows.json calculate',
@@ -231,7 +232,10 @@ async function run(args, options) {
     let result;
     try {
       image = await resolveImage(options.docker, { version });
-      result = await runContainer(image, envelope, { networkNeeded: nodeModules.length > 0, volumeName });
+      result = await runContainer(image, envelope, {
+        networkNeeded: nodeModules.length > 0 || options.network,
+        volumeName
+      });
     } catch (error) {
       console.error(error.message);
       process.exitCode = 1;
@@ -296,6 +300,10 @@ program
     "run the invocation sandboxed in a disposable Docker container; bare = cached default image, " +
       "'<image[:tag]>' = explicit image (installed into if missing), '@path'/URL = build from a Dockerfile"
   )
+  .option(
+    "--network",
+    "enable network access in --docker mode, independent of --node-modules (default: --network none)"
+  )
   .addHelpText("after", HELP_TEXT)
   .version(version, "-v, --version", "print the installed node-red-cli version and exit")
   .action(run);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tbrandenburg/node-red-cli",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "description": "Call existing Node-RED flows from Node.js and the command line",
   "main": "src/link-call.js",
   "bin": {

package/src/docker-image.js

@@ -87,9 +87,16 @@ function derivedDockerfile(image, version) {
   // The derived image is left running as root - restoring the original
   // image's default user would require inspecting the base image at build
   // time, which is out of scope here.
+  //
+  // Force the npm global prefix to /usr/local regardless of what the base
+  // image's own NPM_CONFIG_PREFIX/.npmrc sets: SANDBOX_ENTRY_PATH is
+  // hardcoded to /usr/local, so an install that lands elsewhere would
+  // silently succeed at build time but fail with MODULE_NOT_FOUND at
+  // `docker run`.
   return [
     `FROM ${image}`,
     "USER root",
+    "ENV NPM_CONFIG_PREFIX=/usr/local",
     `RUN npm install -g @tbrandenburg/node-red-cli@${version}`,
     `ENTRYPOINT ["node", "${SANDBOX_ENTRY_PATH}"]`,
     ""

package/src/docker-run.js

@@ -8,7 +8,8 @@
  *
  * Sandboxing defaults (always applied):
  * - `--rm -i` (always disposable, interactive stdin)
- * - `--network none`, unless `networkNeeded` (i.e. `--node-modules` is set)
+ * - `--network none`, unless `networkNeeded` (i.e. `--node-modules` and/or
+ *   the CLI's `--network` flag is set)
  * - `--read-only` root filesystem + a `/tmp` tmpfs mount
  * - `-e HOME=/tmp`, so tools needing a writable `$HOME` (config/cache dirs)
  *   land on the writable `/tmp` tmpfs instead of the read-only rootfs

package/src/node-modules-install.js

@@ -74,7 +74,13 @@ function checkNpmAvailable() {
   });
 }
 
-/** Runs `npm install <name>[@version]` into `userDir`, returns on success, throws a clear error otherwise. */
+/**
+ * Runs `npm install <name>[@version]` into `userDir`, returns on success,
+ * throws a clear error otherwise. Passes an explicit `--prefix <userDir>`
+ * so npm's own project-root/workspace detection can't walk up to an
+ * ancestor directory's `node_modules` when `userDir` is fresh/empty
+ * (see issue #24); `cwd` is kept as-is for the npm CLI invocation itself.
+ */
 function npmInstall(userDir, { name, version }, timeoutMs = 5 * 60 * 1000) {
   const installName = version ? `${name}@${version}` : name;
   const args = [
@@ -85,6 +91,8 @@ function npmInstall(userDir, { name, version }, timeoutMs = 5 * 60 * 1000) {
     "--no-fund",
     "--save",
     "--omit=dev",
+    "--prefix",
+    userDir,
     "--",
     installName
   ];
@@ -144,5 +152,6 @@ module.exports = {
   isModuleInstalled,
   diffMissingModules,
   installMissingNodeModules,
-  checkNpmAvailable
+  checkNpmAvailable,
+  npmInstall
 };

package/src/run-envelope.js

@@ -34,6 +34,48 @@ function stderrLogHandler() {
   };
 }
 
+/**
+ * Waits for Node-RED to finish attempting to start the deployed flows.
+ *
+ * `RED.start()` resolves as soon as the runtime itself has booted, but the
+ * actual flow deploy happens asynchronously afterward and normally signals
+ * completion via a one-off `flows:started` event. However, when the flow
+ * references a node type that isn't registered (or another deploy-blocking
+ * condition applies, e.g. missing external modules or safe mode), Node-RED's
+ * `Flow.start()` logs the problem and returns *without* ever emitting
+ * `flows:started` (see `@node-red/runtime/lib/flows/index.js`). Awaiting
+ * only `flows:started` would then hang forever; since nothing else keeps
+ * the event loop alive, the process exits silently with code 0 once the
+ * loop drains, abandoning the pending call.
+ *
+ * Node-RED does always emit a `runtime-event` with id `runtime-state` in
+ * both cases: `payload.state === "start"` on success, and
+ * `payload.state === "stop"` / `"safe"` on any of the early-return failure
+ * paths. Racing both events lets us return as soon as Node-RED has settled
+ * either way; if the flows never actually started, the target/return nodes
+ * simply won't be instantiated and the existing preflight validation in
+ * `createHostLinkCaller` reports the real, specific error instead.
+ */
+function waitForFlowsSettled(RED) {
+  return new Promise((resolve) => {
+    const onStarted = () => {
+      RED.events.removeListener("runtime-event", onRuntimeEvent);
+      resolve();
+    };
+    const onRuntimeEvent = (event) => {
+      if (
+        event?.id === "runtime-state" &&
+        (event.payload?.state === "stop" || event.payload?.state === "safe")
+      ) {
+        RED.events.removeListener("flows:started", onStarted);
+        resolve();
+      }
+    };
+    RED.events.once("flows:started", onStarted);
+    RED.events.on("runtime-event", onRuntimeEvent);
+  });
+}
+
 /**
  * Runs a single link-call invocation against a real, freshly booted
  * Node-RED runtime: installs any missing `--node-modules`, boots RED with
@@ -80,9 +122,9 @@ async function runFlowInvocation({ flow, flowFile, msg, options }) {
     });
 
     try {
-      const flowsStarted = new Promise((resolve) => RED.events.once("flows:started", resolve));
+      const flowsSettled = waitForFlowsSettled(RED);
       await RED.start();
-      await flowsStarted;
+      await flowsSettled;
 
       caller = createHostLinkCaller(RED);
       const result = await caller.call(target, msg, {