@timo9378/flow2code 0.1.5 → 0.1.7

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.1.7] — 2026-03-05
+
+### Performance
+- **Precompute `edgeSuccessors` map** — Eliminated O(N×E) per-call rebuild in `generateBlockContinuation`; successor lookup is now O(1) via pre-built map in `CompilerContext`
+- **Reuse `nodeMap` in control-flow analysis** — `computeControlFlowDescendants` now receives the existing `nodeMap` instead of rebuilding a redundant `new Map()` each call
+
+### Fixed
+- **Decompiler `processForStatement` AST correctness** — Replaced fragile `.split("{")` string hack with proper AST methods (`getInitializer()`, `getCondition()`, `getIncrementor()`); fixes incorrect parsing when loop body contains object literals
+- **OpenAPI YAML import** — `handleImportOpenAPI` now supports `.yaml`/`.yml` files via dynamic `import("yaml")` instead of silently failing with `JSON.parse`
+- **`revokeObjectURL` download race** — Deferred `URL.revokeObjectURL` by 10 seconds after `click()` to prevent Safari/slow-browser download failures
+- **CLI watch mode async I/O** — New `loadFlowProjectAsync` reads flow projects with `fs/promises` (`readFile`/`readdir`); `compileFlowDirAsync` no longer blocks the event loop with sync file I/O
+
+### Tests
+- Added `loadFlowProjectAsync` parity tests (split + JSON + error case)
+- Test count: 410 tests / 33 test files
+
+## [0.1.6] — 2026-03-05
+
+### Fixed (Critical)
+- **Compiler uses migratedIR** — `compile()` now uses validator's auto-migrated IR instead of the stale original, preventing silent data corruption on older IR versions
+- **`generateConcurrentNodes` flowState overwrite** — Removed `flowState[nodeId] = rN` overwrite that replaced correct values with `undefined` (task functions already populate flowState internally)
+- **`handleCompile` path traversal** — Added separator suffix to `startsWith()` check, preventing directory-prefix attacks (e.g. `/home/user` → `/home/user2/`)
+- **Undo/Redo snapshot deep clone** — `createSnapshot()` now uses `structuredClone(n.data)` instead of shallow spread, preventing nested mutation from corrupting all snapshots sharing a reference
+
+### Tests
+- Added path traversal regression test, IR migration integration test
+- Test count: 407 tests / 33 test files
+
 ## [0.1.5] — 2026-03-05
 
 ### Security

package/dist/cli.js

@@ -1822,21 +1822,22 @@ function compile(ir, options) {
       errors: validation.errors.map((e) => `[${e.code}] ${e.message}`)
     };
   }
+  const workingIR = validation.migrated && validation.migratedIR ? validation.migratedIR : ir;
   let plan;
   try {
-    plan = topologicalSort(ir);
+    plan = topologicalSort(workingIR);
   } catch (err) {
     return {
       success: false,
       errors: [err instanceof Error ? err.message : String(err)]
     };
   }
-  const nodeMap = new Map(ir.nodes.map((n) => [n.id, n]));
+  const nodeMap = new Map(workingIR.nodes.map((n) => [n.id, n]));
   const platformName = options?.platform ?? "nextjs";
   const platform = getPlatform(platformName);
-  const symbolTable = buildSymbolTable(ir);
+  const symbolTable = buildSymbolTable(workingIR);
   const context = {
-    ir,
+    ir: workingIR,
     plan,
     nodeMap,
     envVars: /* @__PURE__ */ new Set(),
@@ -1851,10 +1852,18 @@ function compile(ir, options) {
     dagMode: false,
     symbolTableExclusions: /* @__PURE__ */ new Set(),
     generatedBlockNodeIds: /* @__PURE__ */ new Set(),
-    pluginRegistry
+    pluginRegistry,
+    edgeSuccessors: (() => {
+      const map = /* @__PURE__ */ new Map();
+      for (const edge of workingIR.edges) {
+        if (!map.has(edge.sourceNodeId)) map.set(edge.sourceNodeId, []);
+        map.get(edge.sourceNodeId).push(edge.targetNodeId);
+      }
+      return map;
+    })()
   };
-  const trigger = ir.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
-  const preComputedBlockNodes = computeControlFlowDescendants(ir, trigger.id);
+  const trigger = workingIR.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
+  const preComputedBlockNodes = computeControlFlowDescendants(workingIR, trigger.id, nodeMap);
   for (const nodeId of preComputedBlockNodes) {
     context.childBlockNodeIds.add(nodeId);
     context.symbolTableExclusions.add(nodeId);
@@ -1864,7 +1873,7 @@ function compile(ir, options) {
   );
   if (hasConcurrency) {
     context.dagMode = true;
-    for (const node of ir.nodes) {
+    for (const node of workingIR.nodes) {
       if (node.category !== "trigger" /* TRIGGER */) {
         context.symbolTableExclusions.add(node.id);
       }
@@ -1879,8 +1888,8 @@ function compile(ir, options) {
   });
   const code = sourceFile.getFullText();
   const filePath = platform.getOutputFilePath(trigger);
-  collectRequiredPackages(ir, context);
-  const sourceMap = buildSourceMap(code, ir, filePath);
+  collectRequiredPackages(workingIR, context);
+  const sourceMap = buildSourceMap(code, workingIR, filePath);
   const dependencies = {
     all: [...context.requiredPackages].sort(),
     missing: [...context.requiredPackages].sort(),
@@ -1934,8 +1943,7 @@ function isControlFlowEdge(edge, nodeMap) {
   const controlPorts = CONTROL_FLOW_PORT_MAP[sourceNode.nodeType];
   return controlPorts !== void 0 && controlPorts.has(edge.sourcePortId);
 }
-function computeControlFlowDescendants(ir, triggerId) {
-  const nodeMap = new Map(ir.nodes.map((n) => [n.id, n]));
+function computeControlFlowDescendants(ir, triggerId, nodeMap) {
   const strippedSuccessors = /* @__PURE__ */ new Map();
   for (const node of ir.nodes) {
     strippedSuccessors.set(node.id, /* @__PURE__ */ new Set());
@@ -1968,13 +1976,7 @@ function computeControlFlowDescendants(ir, triggerId) {
 function generateBlockContinuation(writer, fromNodeId, context) {
   const reachable = /* @__PURE__ */ new Set();
   const bfsQueue = [fromNodeId];
-  const edgeSuccessors = /* @__PURE__ */ new Map();
-  for (const edge of context.ir.edges) {
-    if (!edgeSuccessors.has(edge.sourceNodeId)) {
-      edgeSuccessors.set(edge.sourceNodeId, []);
-    }
-    edgeSuccessors.get(edge.sourceNodeId).push(edge.targetNodeId);
-  }
+  const edgeSuccessors = context.edgeSuccessors;
   while (bfsQueue.length > 0) {
     const id = bfsQueue.shift();
     if (reachable.has(id)) continue;
@@ -2129,11 +2131,8 @@ function generateConcurrentNodes(writer, nodeIds, context) {
     writer.writeLine(";");
   }
   writer.writeLine(
-    `const [${taskNames.map((_, i) => `r${i}`).join(", ")}] = await Promise.all([${taskNames.map((t) => `${t}()`).join(", ")}]);`
+    `await Promise.all([${taskNames.map((t) => `${t}()`).join(", ")}]);`
   );
-  activeNodeIds.forEach((nodeId, i) => {
-    writer.writeLine(`flowState['${nodeId}'] = r${i};`);
-  });
   activeNodeIds.forEach((nodeId) => {
     const varName = context.symbolTable.getVarName(nodeId);
     writer.writeLine(`const ${varName} = flowState['${nodeId}'];`);
@@ -2766,7 +2765,10 @@ function processForInStatement(stmt, _prevNodeId, ctx, line) {
 }
 function processForStatement(stmt, _prevNodeId, ctx, line) {
   const nodeId = ctx.nextId("loop");
-  const fullText = stmt.getText().split("{")[0].trim();
+  const initText = stmt.getInitializer()?.getText() ?? "";
+  const condText = stmt.getCondition()?.getText() ?? "";
+  const incrText = stmt.getIncrementor()?.getText() ?? "";
+  const fullText = `for (${initText}; ${condText}; ${incrText})`;
   ctx.addNode({
     id: nodeId,
     nodeType: "for_loop" /* FOR_LOOP */,
@@ -3707,7 +3709,9 @@ function handleCompile(body, projectRoot) {
     let writtenPath = null;
     if (shouldWrite && result.filePath && result.code) {
       const fullPath = resolve(join2(projectRoot, result.filePath));
-      if (!fullPath.startsWith(resolve(projectRoot))) {
+      const resolvedRoot = resolve(projectRoot);
+      const sep = resolvedRoot.endsWith("/") || resolvedRoot.endsWith("\\") ? "" : process.platform === "win32" ? "\\" : "/";
+      if (!fullPath.startsWith(resolvedRoot + sep)) {
         return {
           status: 400,
           body: { success: false, error: "Output path escapes project root" }
@@ -3946,7 +3950,7 @@ __export(server_exports, {
   startServer: () => startServer
 });
 import { createServer } from "http";
-import { readFile, stat } from "fs/promises";
+import { readFile as readFile2, stat } from "fs/promises";
 import { join as join3, extname as extname2, dirname as dirname3, resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
 import { existsSync as existsSync3 } from "fs";
@@ -4044,7 +4048,7 @@ async function serveStatic(staticDir, pathname, res) {
     if (!s.isFile()) return false;
     const ext = extname2(filePath).toLowerCase();
     const contentType = MIME_TYPES[ext] || "application/octet-stream";
-    const content = await readFile(filePath);
+    const content = await readFile2(filePath);
     res.writeHead(200, { "Content-Type": contentType });
     res.end(content);
     return true;
@@ -4108,7 +4112,7 @@ async function handleRequest(req, res, staticDir, projectRoot) {
   if (served) return;
   const indexPath = join3(staticDir, "index.html");
   try {
-    const content = await readFile(indexPath, "utf-8");
+    const content = await readFile2(indexPath, "utf-8");
     res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
     res.end(content);
   } catch {
@@ -4190,7 +4194,7 @@ init_logger();
 init_validator();
 import { Command } from "commander";
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, existsSync as existsSync4, readdirSync as readdirSync2, rmSync as rmSync2 } from "fs";
-import { readFile as readFile2, writeFile, mkdir } from "fs/promises";
+import { readFile as readFile3, writeFile, mkdir } from "fs/promises";
 import { join as join4, dirname as dirname4, resolve as resolve3, basename as basename2 } from "path";
 import { watch } from "chokidar";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -4329,6 +4333,7 @@ function sanitizeFilename(id) {
 
 // src/lib/storage/flow-project.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, rmSync, statSync } from "fs";
+import { readFile, readdir } from "fs/promises";
 import { join, dirname } from "path";
 function detectFormat(inputPath) {
   if (inputPath.endsWith(".flow.json") && existsSync(inputPath)) {
@@ -4379,6 +4384,37 @@ function loadFlowProject(inputPath) {
   const ir = mergeIR({ meta, edges, nodes });
   return { path: resolvedPath, format, ir };
 }
+async function loadFlowProjectAsync(inputPath) {
+  const { resolvedPath, format } = detectFormat(inputPath);
+  if (format === "json") {
+    if (!existsSync(resolvedPath)) {
+      throw new Error(`Flow file not found: ${resolvedPath}`);
+    }
+    const raw = await readFile(resolvedPath, "utf-8");
+    const ir2 = JSON.parse(raw);
+    return { path: resolvedPath, format, ir: ir2 };
+  }
+  if (!existsSync(resolvedPath)) {
+    throw new Error(`Flow directory not found: ${resolvedPath}`);
+  }
+  const metaPath = join(resolvedPath, "meta.yaml");
+  if (!existsSync(metaPath)) {
+    throw new Error(`meta.yaml not found in ${resolvedPath} \u2014 not a valid Flow directory`);
+  }
+  const meta = await readFile(metaPath, "utf-8");
+  const edgesPath = join(resolvedPath, "edges.yaml");
+  const edges = existsSync(edgesPath) ? await readFile(edgesPath, "utf-8") : "";
+  const nodesDir = join(resolvedPath, "nodes");
+  const nodes = /* @__PURE__ */ new Map();
+  if (existsSync(nodesDir)) {
+    const nodeFiles = (await readdir(nodesDir)).filter((f) => f.endsWith(".yaml"));
+    for (const file of nodeFiles) {
+      nodes.set(file, await readFile(join(nodesDir, file), "utf-8"));
+    }
+  }
+  const ir = mergeIR({ meta, edges, nodes });
+  return { path: resolvedPath, format, ir };
+}
 function saveFlowProject(ir, outputPath, options = {}) {
   const { format = "split", cleanOrphanNodes = true } = options;
   if (format === "json") {
@@ -5310,7 +5346,7 @@ function generateEnvExample() {
 async function compileFileAsync(filePath, projectRoot) {
   const startTime = Date.now();
   try {
-    const raw = await readFile2(filePath, "utf-8");
+    const raw = await readFile3(filePath, "utf-8");
     const ir = JSON.parse(raw);
     const validation = validateFlowIR(ir);
     if (!validation.valid) {
@@ -5345,7 +5381,7 @@ async function compileFileAsync(filePath, projectRoot) {
 async function compileFlowDirAsync(dirPath, projectRoot) {
   const startTime = Date.now();
   try {
-    const project = loadFlowProject(dirPath);
+    const project = await loadFlowProjectAsync(dirPath);
     const ir = project.ir;
     const validation = validateFlowIR(ir);
     if (!validation.valid) {

package/dist/compiler.cjs

@@ -1831,21 +1831,22 @@ function compile(ir, options) {
       errors: validation.errors.map((e) => `[${e.code}] ${e.message}`)
     };
   }
+  const workingIR = validation.migrated && validation.migratedIR ? validation.migratedIR : ir;
   let plan;
   try {
-    plan = topologicalSort(ir);
+    plan = topologicalSort(workingIR);
   } catch (err) {
     return {
       success: false,
       errors: [err instanceof Error ? err.message : String(err)]
     };
   }
-  const nodeMap = new Map(ir.nodes.map((n) => [n.id, n]));
+  const nodeMap = new Map(workingIR.nodes.map((n) => [n.id, n]));
   const platformName = options?.platform ?? "nextjs";
   const platform = getPlatform(platformName);
-  const symbolTable = buildSymbolTable(ir);
+  const symbolTable = buildSymbolTable(workingIR);
   const context = {
-    ir,
+    ir: workingIR,
     plan,
     nodeMap,
     envVars: /* @__PURE__ */ new Set(),
@@ -1860,10 +1861,18 @@ function compile(ir, options) {
     dagMode: false,
     symbolTableExclusions: /* @__PURE__ */ new Set(),
     generatedBlockNodeIds: /* @__PURE__ */ new Set(),
-    pluginRegistry
+    pluginRegistry,
+    edgeSuccessors: (() => {
+      const map = /* @__PURE__ */ new Map();
+      for (const edge of workingIR.edges) {
+        if (!map.has(edge.sourceNodeId)) map.set(edge.sourceNodeId, []);
+        map.get(edge.sourceNodeId).push(edge.targetNodeId);
+      }
+      return map;
+    })()
   };
-  const trigger = ir.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
-  const preComputedBlockNodes = computeControlFlowDescendants(ir, trigger.id);
+  const trigger = workingIR.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
+  const preComputedBlockNodes = computeControlFlowDescendants(workingIR, trigger.id, nodeMap);
   for (const nodeId of preComputedBlockNodes) {
     context.childBlockNodeIds.add(nodeId);
     context.symbolTableExclusions.add(nodeId);
@@ -1873,7 +1882,7 @@ function compile(ir, options) {
   );
   if (hasConcurrency) {
     context.dagMode = true;
-    for (const node of ir.nodes) {
+    for (const node of workingIR.nodes) {
       if (node.category !== "trigger" /* TRIGGER */) {
         context.symbolTableExclusions.add(node.id);
       }
@@ -1888,8 +1897,8 @@ function compile(ir, options) {
   });
   const code = sourceFile.getFullText();
   const filePath = platform.getOutputFilePath(trigger);
-  collectRequiredPackages(ir, context);
-  const sourceMap = buildSourceMap(code, ir, filePath);
+  collectRequiredPackages(workingIR, context);
+  const sourceMap = buildSourceMap(code, workingIR, filePath);
   const dependencies = {
     all: [...context.requiredPackages].sort(),
     missing: [...context.requiredPackages].sort(),
@@ -1948,8 +1957,7 @@ function isControlFlowEdge(edge, nodeMap) {
   const controlPorts = CONTROL_FLOW_PORT_MAP[sourceNode.nodeType];
   return controlPorts !== void 0 && controlPorts.has(edge.sourcePortId);
 }
-function computeControlFlowDescendants(ir, triggerId) {
-  const nodeMap = new Map(ir.nodes.map((n) => [n.id, n]));
+function computeControlFlowDescendants(ir, triggerId, nodeMap) {
   const strippedSuccessors = /* @__PURE__ */ new Map();
   for (const node of ir.nodes) {
     strippedSuccessors.set(node.id, /* @__PURE__ */ new Set());
@@ -1982,13 +1990,7 @@ function computeControlFlowDescendants(ir, triggerId) {
 function generateBlockContinuation(writer, fromNodeId, context) {
   const reachable = /* @__PURE__ */ new Set();
   const bfsQueue = [fromNodeId];
-  const edgeSuccessors = /* @__PURE__ */ new Map();
-  for (const edge of context.ir.edges) {
-    if (!edgeSuccessors.has(edge.sourceNodeId)) {
-      edgeSuccessors.set(edge.sourceNodeId, []);
-    }
-    edgeSuccessors.get(edge.sourceNodeId).push(edge.targetNodeId);
-  }
+  const edgeSuccessors = context.edgeSuccessors;
   while (bfsQueue.length > 0) {
     const id = bfsQueue.shift();
     if (reachable.has(id)) continue;
@@ -2143,11 +2145,8 @@ function generateConcurrentNodes(writer, nodeIds, context) {
     writer.writeLine(";");
   }
   writer.writeLine(
-    `const [${taskNames.map((_, i) => `r${i}`).join(", ")}] = await Promise.all([${taskNames.map((t) => `${t}()`).join(", ")}]);`
+    `await Promise.all([${taskNames.map((t) => `${t}()`).join(", ")}]);`
   );
-  activeNodeIds.forEach((nodeId, i) => {
-    writer.writeLine(`flowState['${nodeId}'] = r${i};`);
-  });
   activeNodeIds.forEach((nodeId) => {
     const varName = context.symbolTable.getVarName(nodeId);
     writer.writeLine(`const ${varName} = flowState['${nodeId}'];`);
@@ -2820,7 +2819,10 @@ function processForInStatement(stmt, _prevNodeId, ctx, line) {
 }
 function processForStatement(stmt, _prevNodeId, ctx, line) {
   const nodeId = ctx.nextId("loop");
-  const fullText = stmt.getText().split("{")[0].trim();
+  const initText = stmt.getInitializer()?.getText() ?? "";
+  const condText = stmt.getCondition()?.getText() ?? "";
+  const incrText = stmt.getIncrementor()?.getText() ?? "";
+  const fullText = `for (${initText}; ${condText}; ${incrText})`;
   ctx.addNode({
     id: nodeId,
     nodeType: "for_loop" /* FOR_LOOP */,
@@ -3769,6 +3771,7 @@ function sanitizeFilename(id) {
 
 // src/lib/storage/flow-project.ts
 var import_node_fs = require("fs");
+var import_promises = require("fs/promises");
 var import_node_path = require("path");
 function detectFormat(inputPath) {
   if (inputPath.endsWith(".flow.json") && (0, import_node_fs.existsSync)(inputPath)) {

package/dist/compiler.js

@@ -1764,21 +1764,22 @@ function compile(ir, options) {
       errors: validation.errors.map((e) => `[${e.code}] ${e.message}`)
     };
   }
+  const workingIR = validation.migrated && validation.migratedIR ? validation.migratedIR : ir;
   let plan;
   try {
-    plan = topologicalSort(ir);
+    plan = topologicalSort(workingIR);
   } catch (err) {
     return {
       success: false,
       errors: [err instanceof Error ? err.message : String(err)]
     };
   }
-  const nodeMap = new Map(ir.nodes.map((n) => [n.id, n]));
+  const nodeMap = new Map(workingIR.nodes.map((n) => [n.id, n]));
   const platformName = options?.platform ?? "nextjs";
   const platform = getPlatform(platformName);
-  const symbolTable = buildSymbolTable(ir);
+  const symbolTable = buildSymbolTable(workingIR);
   const context = {
-    ir,
+    ir: workingIR,
     plan,
     nodeMap,
     envVars: /* @__PURE__ */ new Set(),
@@ -1793,10 +1794,18 @@ function compile(ir, options) {
     dagMode: false,
     symbolTableExclusions: /* @__PURE__ */ new Set(),
     generatedBlockNodeIds: /* @__PURE__ */ new Set(),
-    pluginRegistry
+    pluginRegistry,
+    edgeSuccessors: (() => {
+      const map = /* @__PURE__ */ new Map();
+      for (const edge of workingIR.edges) {
+        if (!map.has(edge.sourceNodeId)) map.set(edge.sourceNodeId, []);
+        map.get(edge.sourceNodeId).push(edge.targetNodeId);
+      }
+      return map;
+    })()
   };
-  const trigger = ir.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
-  const preComputedBlockNodes = computeControlFlowDescendants(ir, trigger.id);
+  const trigger = workingIR.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
+  const preComputedBlockNodes = computeControlFlowDescendants(workingIR, trigger.id, nodeMap);
   for (const nodeId of preComputedBlockNodes) {
     context.childBlockNodeIds.add(nodeId);
     context.symbolTableExclusions.add(nodeId);
@@ -1806,7 +1815,7 @@ function compile(ir, options) {
   );
   if (hasConcurrency) {
     context.dagMode = true;
-    for (const node of ir.nodes) {
+    for (const node of workingIR.nodes) {
       if (node.category !== "trigger" /* TRIGGER */) {
         context.symbolTableExclusions.add(node.id);
       }
@@ -1821,8 +1830,8 @@ function compile(ir, options) {
   });
   const code = sourceFile.getFullText();
   const filePath = platform.getOutputFilePath(trigger);
-  collectRequiredPackages(ir, context);
-  const sourceMap = buildSourceMap(code, ir, filePath);
+  collectRequiredPackages(workingIR, context);
+  const sourceMap = buildSourceMap(code, workingIR, filePath);
   const dependencies = {
     all: [...context.requiredPackages].sort(),
     missing: [...context.requiredPackages].sort(),
@@ -1881,8 +1890,7 @@ function isControlFlowEdge(edge, nodeMap) {
   const controlPorts = CONTROL_FLOW_PORT_MAP[sourceNode.nodeType];
   return controlPorts !== void 0 && controlPorts.has(edge.sourcePortId);
 }
-function computeControlFlowDescendants(ir, triggerId) {
-  const nodeMap = new Map(ir.nodes.map((n) => [n.id, n]));
+function computeControlFlowDescendants(ir, triggerId, nodeMap) {
   const strippedSuccessors = /* @__PURE__ */ new Map();
   for (const node of ir.nodes) {
     strippedSuccessors.set(node.id, /* @__PURE__ */ new Set());
@@ -1915,13 +1923,7 @@ function computeControlFlowDescendants(ir, triggerId) {
 function generateBlockContinuation(writer, fromNodeId, context) {
   const reachable = /* @__PURE__ */ new Set();
   const bfsQueue = [fromNodeId];
-  const edgeSuccessors = /* @__PURE__ */ new Map();
-  for (const edge of context.ir.edges) {
-    if (!edgeSuccessors.has(edge.sourceNodeId)) {
-      edgeSuccessors.set(edge.sourceNodeId, []);
-    }
-    edgeSuccessors.get(edge.sourceNodeId).push(edge.targetNodeId);
-  }
+  const edgeSuccessors = context.edgeSuccessors;
   while (bfsQueue.length > 0) {
     const id = bfsQueue.shift();
     if (reachable.has(id)) continue;
@@ -2076,11 +2078,8 @@ function generateConcurrentNodes(writer, nodeIds, context) {
     writer.writeLine(";");
   }
   writer.writeLine(
-    `const [${taskNames.map((_, i) => `r${i}`).join(", ")}] = await Promise.all([${taskNames.map((t) => `${t}()`).join(", ")}]);`
+    `await Promise.all([${taskNames.map((t) => `${t}()`).join(", ")}]);`
   );
-  activeNodeIds.forEach((nodeId, i) => {
-    writer.writeLine(`flowState['${nodeId}'] = r${i};`);
-  });
   activeNodeIds.forEach((nodeId) => {
     const varName = context.symbolTable.getVarName(nodeId);
     writer.writeLine(`const ${varName} = flowState['${nodeId}'];`);
@@ -2756,7 +2755,10 @@ function processForInStatement(stmt, _prevNodeId, ctx, line) {
 }
 function processForStatement(stmt, _prevNodeId, ctx, line) {
   const nodeId = ctx.nextId("loop");
-  const fullText = stmt.getText().split("{")[0].trim();
+  const initText = stmt.getInitializer()?.getText() ?? "";
+  const condText = stmt.getCondition()?.getText() ?? "";
+  const incrText = stmt.getIncrementor()?.getText() ?? "";
+  const fullText = `for (${initText}; ${condText}; ${incrText})`;
   ctx.addNode({
     id: nodeId,
     nodeType: "for_loop" /* FOR_LOOP */,
@@ -3705,6 +3707,7 @@ function sanitizeFilename(id) {
 
 // src/lib/storage/flow-project.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, rmSync, statSync } from "fs";
+import { readFile, readdir } from "fs/promises";
 import { join, dirname } from "path";
 function detectFormat(inputPath) {
   if (inputPath.endsWith(".flow.json") && existsSync(inputPath)) {

package/dist/server.js

@@ -1717,21 +1717,22 @@ function compile(ir, options) {
       errors: validation.errors.map((e) => `[${e.code}] ${e.message}`)
     };
   }
+  const workingIR = validation.migrated && validation.migratedIR ? validation.migratedIR : ir;
   let plan;
   try {
-    plan = topologicalSort(ir);
+    plan = topologicalSort(workingIR);
   } catch (err) {
     return {
       success: false,
       errors: [err instanceof Error ? err.message : String(err)]
     };
   }
-  const nodeMap = new Map(ir.nodes.map((n) => [n.id, n]));
+  const nodeMap = new Map(workingIR.nodes.map((n) => [n.id, n]));
   const platformName = options?.platform ?? "nextjs";
   const platform = getPlatform(platformName);
-  const symbolTable = buildSymbolTable(ir);
+  const symbolTable = buildSymbolTable(workingIR);
   const context = {
-    ir,
+    ir: workingIR,
     plan,
     nodeMap,
     envVars: /* @__PURE__ */ new Set(),
@@ -1746,10 +1747,18 @@ function compile(ir, options) {
     dagMode: false,
     symbolTableExclusions: /* @__PURE__ */ new Set(),
     generatedBlockNodeIds: /* @__PURE__ */ new Set(),
-    pluginRegistry
+    pluginRegistry,
+    edgeSuccessors: (() => {
+      const map = /* @__PURE__ */ new Map();
+      for (const edge of workingIR.edges) {
+        if (!map.has(edge.sourceNodeId)) map.set(edge.sourceNodeId, []);
+        map.get(edge.sourceNodeId).push(edge.targetNodeId);
+      }
+      return map;
+    })()
   };
-  const trigger = ir.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
-  const preComputedBlockNodes = computeControlFlowDescendants(ir, trigger.id);
+  const trigger = workingIR.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
+  const preComputedBlockNodes = computeControlFlowDescendants(workingIR, trigger.id, nodeMap);
   for (const nodeId of preComputedBlockNodes) {
     context.childBlockNodeIds.add(nodeId);
     context.symbolTableExclusions.add(nodeId);
@@ -1759,7 +1768,7 @@ function compile(ir, options) {
   );
   if (hasConcurrency) {
     context.dagMode = true;
-    for (const node of ir.nodes) {
+    for (const node of workingIR.nodes) {
       if (node.category !== "trigger" /* TRIGGER */) {
         context.symbolTableExclusions.add(node.id);
       }
@@ -1774,8 +1783,8 @@ function compile(ir, options) {
   });
   const code = sourceFile.getFullText();
   const filePath = platform.getOutputFilePath(trigger);
-  collectRequiredPackages(ir, context);
-  const sourceMap = buildSourceMap(code, ir, filePath);
+  collectRequiredPackages(workingIR, context);
+  const sourceMap = buildSourceMap(code, workingIR, filePath);
   const dependencies = {
     all: [...context.requiredPackages].sort(),
     missing: [...context.requiredPackages].sort(),
@@ -1834,8 +1843,7 @@ function isControlFlowEdge(edge, nodeMap) {
   const controlPorts = CONTROL_FLOW_PORT_MAP[sourceNode.nodeType];
   return controlPorts !== void 0 && controlPorts.has(edge.sourcePortId);
 }
-function computeControlFlowDescendants(ir, triggerId) {
-  const nodeMap = new Map(ir.nodes.map((n) => [n.id, n]));
+function computeControlFlowDescendants(ir, triggerId, nodeMap) {
   const strippedSuccessors = /* @__PURE__ */ new Map();
   for (const node of ir.nodes) {
     strippedSuccessors.set(node.id, /* @__PURE__ */ new Set());
@@ -1868,13 +1876,7 @@ function computeControlFlowDescendants(ir, triggerId) {
 function generateBlockContinuation(writer, fromNodeId, context) {
   const reachable = /* @__PURE__ */ new Set();
   const bfsQueue = [fromNodeId];
-  const edgeSuccessors = /* @__PURE__ */ new Map();
-  for (const edge of context.ir.edges) {
-    if (!edgeSuccessors.has(edge.sourceNodeId)) {
-      edgeSuccessors.set(edge.sourceNodeId, []);
-    }
-    edgeSuccessors.get(edge.sourceNodeId).push(edge.targetNodeId);
-  }
+  const edgeSuccessors = context.edgeSuccessors;
   while (bfsQueue.length > 0) {
     const id = bfsQueue.shift();
     if (reachable.has(id)) continue;
@@ -2029,11 +2031,8 @@ function generateConcurrentNodes(writer, nodeIds, context) {
     writer.writeLine(";");
   }
   writer.writeLine(
-    `const [${taskNames.map((_, i) => `r${i}`).join(", ")}] = await Promise.all([${taskNames.map((t) => `${t}()`).join(", ")}]);`
+    `await Promise.all([${taskNames.map((t) => `${t}()`).join(", ")}]);`
   );
-  activeNodeIds.forEach((nodeId, i) => {
-    writer.writeLine(`flowState['${nodeId}'] = r${i};`);
-  });
   activeNodeIds.forEach((nodeId) => {
     const varName = context.symbolTable.getVarName(nodeId);
     writer.writeLine(`const ${varName} = flowState['${nodeId}'];`);
@@ -2569,7 +2568,10 @@ function processForInStatement(stmt, _prevNodeId, ctx, line) {
 }
 function processForStatement(stmt, _prevNodeId, ctx, line) {
   const nodeId = ctx.nextId("loop");
-  const fullText = stmt.getText().split("{")[0].trim();
+  const initText = stmt.getInitializer()?.getText() ?? "";
+  const condText = stmt.getCondition()?.getText() ?? "";
+  const incrText = stmt.getIncrementor()?.getText() ?? "";
+  const fullText = `for (${initText}; ${condText}; ${incrText})`;
   ctx.addNode({
     id: nodeId,
     nodeType: "for_loop" /* FOR_LOOP */,
@@ -3485,7 +3487,9 @@ function handleCompile(body, projectRoot) {
     let writtenPath = null;
     if (shouldWrite && result.filePath && result.code) {
       const fullPath = resolve(join(projectRoot, result.filePath));
-      if (!fullPath.startsWith(resolve(projectRoot))) {
+      const resolvedRoot = resolve(projectRoot);
+      const sep = resolvedRoot.endsWith("/") || resolvedRoot.endsWith("\\") ? "" : process.platform === "win32" ? "\\" : "/";
+      if (!fullPath.startsWith(resolvedRoot + sep)) {
         return {
           status: 400,
           body: { success: false, error: "Output path escapes project root" }