@timo9378/flow2code 0.1.7 → 0.1.8

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.1.8] — 2026-03-05
+
+### Security
+- **HTTP server request timeout** — Added `headersTimeout` (30s) and `requestTimeout` (60s) to prevent Slowloris-style DoS attacks (#16)
+- **Server `headersSent` guard** — Error handler now checks `res.headersSent` before writing 500 response, preventing `ERR_HTTP_HEADERS_SENT` crash (#14)
+- **Validate IR from server** — `handleDecompileTS` and `handleSelectOpenAPIFlow` now call `validateFlowIR()` before `loadIR()`, matching `handleLoadIRFromJSON` behavior (#22)
+
+### Fixed
+- **Validator iterative DFS** — Replaced recursive `dfs()` with explicit stack-based iteration to prevent stack overflow on deep graphs (5000+ nodes) (#11)
+- **`isFetchCall` AST-based detection** — Replaced `text.includes("fetch(")` string matching with proper AST walk using `CallExpression` + `Identifier` node types (#12)
+- **`hasAwaitExpression` AST walk** — Replaced `text.startsWith("await ")` fallback with recursive `forEachChild` AST traversal to detect nested awaits (#23)
+- **`trackVariableUses` strip strings** — Expression string now has string literals (`"..."`, `'...'`, `` `...` ``) stripped before identifier regex scan, preventing false-positive variable references (#13)
+- **`_nodeCounter` max ID parse** — After `loadIR`, counter is set to max numeric ID from existing node IDs (not `nodes.length`), preventing ID collisions (#15)
+- **`resolveTriggerRef` cache** — Trigger node lookup cached per IR reference, eliminating O(N) linear scan on every `$trigger` expression evaluation (#17)
+- **`$input` ambiguity warning** — `resolveInputRef` now emits `console.warn` when a node has multiple non-trigger upstream edges, identifying which source is used (#18)
+- **OpenAPI tags filter** — `handleImportOpenAPI` now implements `filter.tags` (case-insensitive match against `meta.tags`), which was previously accepted but silently ignored (#20)
+- **Clipboard fallback** — `handleExportIR` now catches clipboard write errors gracefully instead of letting promise rejection propagate (#21)
+
+### Added
+- **`createPlatformRegistry` factory** — New function for creating isolated platform registry instances, enabling safe test parallelism and concurrent compilation (#19)
+
+### Tests
+- Added iterative DFS deep graph test (5000 nodes, verifies no stack overflow)
+- Test count: 411 tests / 33 test files
+
 ## [0.1.7] — 2026-03-05
 
 ### Performance

package/dist/cli.js

@@ -218,25 +218,32 @@ function detectCycles(nodes, edges) {
   for (const node of nodes) {
     color.set(node.id, WHITE);
   }
-  function dfs(nodeId) {
-    color.set(nodeId, GRAY);
-    for (const neighbor of adjacency.get(nodeId) ?? []) {
+  for (const node of nodes) {
+    if (color.get(node.id) !== WHITE) continue;
+    const stack = [[node.id, 0]];
+    color.set(node.id, GRAY);
+    while (stack.length > 0) {
+      const top = stack[stack.length - 1];
+      const [currentId, idx] = top;
+      const neighbors = adjacency.get(currentId) ?? [];
+      if (idx >= neighbors.length) {
+        color.set(currentId, BLACK);
+        stack.pop();
+        continue;
+      }
+      top[1] = idx + 1;
+      const neighbor = neighbors[idx];
       if (color.get(neighbor) === GRAY) {
         errors.push({
           code: "CYCLE_DETECTED",
-          message: `Cycle detected: node "${nodeId}" \u2192 "${neighbor}"`,
-          nodeId
+          message: `Cycle detected: node "${currentId}" \u2192 "${neighbor}"`,
+          nodeId: currentId
         });
       } else if (color.get(neighbor) === WHITE) {
-        dfs(neighbor);
+        color.set(neighbor, GRAY);
+        stack.push([neighbor, 0]);
       }
     }
-    color.set(nodeId, BLACK);
-  }
-  for (const node of nodes) {
-    if (color.get(node.id) === WHITE) {
-      dfs(node.id);
-    }
   }
   return errors;
 }
@@ -450,10 +457,16 @@ function resolveInputRef(path, context) {
   const incoming = context.ir.edges.filter(
     (e) => e.targetNodeId === context.currentNodeId
   );
-  const dataSource = incoming.find((e) => {
+  const nonTriggerIncoming = incoming.filter((e) => {
     const src = context.nodeMap.get(e.sourceNodeId);
     return src && src.category !== "trigger" /* TRIGGER */;
-  }) || incoming[0];
+  });
+  if (nonTriggerIncoming.length > 1 && typeof console !== "undefined") {
+    console.warn(
+      `[flow2code] $input is ambiguous: node "${context.currentNodeId}" has ${nonTriggerIncoming.length} non-trigger upstream edges. Using first match "${nonTriggerIncoming[0].sourceNodeId}".`
+    );
+  }
+  const dataSource = nonTriggerIncoming[0] || incoming[0];
   if (dataSource) {
     const srcId = dataSource.sourceNodeId;
     if (context.blockScopedNodeIds?.has(srcId)) {
@@ -469,21 +482,27 @@ function resolveInputRef(path, context) {
   );
 }
 function resolveTriggerRef(path, context) {
-  const trigger = context.ir.nodes.find(
-    (n) => n.category === "trigger" /* TRIGGER */
-  );
-  if (trigger) {
-    if (context.symbolTable?.hasVar(trigger.id)) {
-      return `${context.symbolTable.getVarName(trigger.id)}${path}`;
+  if (_cachedTriggerIR !== context.ir) {
+    _cachedTriggerIR = context.ir;
+    const trigger = context.ir.nodes.find(
+      (n) => n.category === "trigger" /* TRIGGER */
+    );
+    _cachedTriggerId = trigger?.id ?? null;
+  }
+  if (_cachedTriggerId) {
+    if (context.symbolTable?.hasVar(_cachedTriggerId)) {
+      return `${context.symbolTable.getVarName(_cachedTriggerId)}${path}`;
     }
-    return `flowState['${trigger.id}']${path}`;
+    return `flowState['${_cachedTriggerId}']${path}`;
   }
   return "undefined";
 }
-var ExpressionParseError;
+var _cachedTriggerIR, _cachedTriggerId, ExpressionParseError;
 var init_expression_parser = __esm({
   "src/lib/compiler/expression-parser.ts"() {
     "use strict";
+    _cachedTriggerIR = null;
+    _cachedTriggerId = null;
     ExpressionParseError = class extends Error {
       constructor(message, expression, position) {
         super(message);
@@ -2987,12 +3006,18 @@ function computeAuditHints(ctx) {
   return hints;
 }
 function isFetchCall(node) {
-  const text = node.getText();
-  return text.includes("fetch(") && (text.includes("await") || node.getKind() === SyntaxKind.AwaitExpression);
+  if (node.getKind() === SyntaxKind.CallExpression) {
+    const expr = node.getExpression();
+    if (expr.getKind() === SyntaxKind.Identifier && expr.getText() === "fetch") return true;
+  }
+  if (node.getKind() === SyntaxKind.AwaitExpression) {
+    return isFetchCall(node.getChildAtIndex(1) ?? node);
+  }
+  return node.forEachChild((child) => isFetchCall(child) || void 0) ?? false;
 }
 function hasAwaitExpression(node) {
   if (node.getKind() === SyntaxKind.AwaitExpression) return true;
-  return node.getText().startsWith("await ");
+  return node.forEachChild((child) => hasAwaitExpression(child) || void 0) ?? false;
 }
 function extractAwaitedExpression(node) {
   const text = node.getText();
@@ -3062,7 +3087,8 @@ function inferLabel(code, varName) {
   return truncate(code, 30);
 }
 function trackVariableUses(nodeId, expression, ctx) {
-  const identifiers = expression.match(/\b([a-zA-Z_]\w*)\b/g);
+  const stripped = expression.replace(/(["'`])(?:(?!\1|\\).|\\.)*\1/g, "");
+  const identifiers = stripped.match(/\b([a-zA-Z_]\w*)\b/g);
   if (!identifiers) return;
   const uses = [];
   const seen = /* @__PURE__ */ new Set();
@@ -3868,6 +3894,13 @@ function handleImportOpenAPI(body) {
         (flow) => paths.some((p) => flow.meta.name.includes(p))
       );
     }
+    if (body.filter?.tags && Array.isArray(body.filter.tags)) {
+      const tags = body.filter.tags.map((t) => t.toLowerCase());
+      filteredFlows = filteredFlows.filter((flow) => {
+        const flowTags = flow.meta.tags ?? [];
+        return flowTags.some((t) => tags.includes(t.toLowerCase()));
+      });
+    }
     return {
       status: 200,
       body: {
@@ -4128,10 +4161,14 @@ function startServer(options = {}) {
   const server = createServer((req, res) => {
     handleRequest(req, res, staticDir, projectRoot).catch((err) => {
       logger.error("Internal error:", err);
-      res.writeHead(500, { "Content-Type": "text/plain" });
-      res.end("Internal Server Error");
+      if (!res.headersSent) {
+        res.writeHead(500, { "Content-Type": "text/plain" });
+        res.end("Internal Server Error");
+      }
     });
   });
+  server.headersTimeout = 3e4;
+  server.requestTimeout = 6e4;
   const hasUI = existsSync3(join3(staticDir, "index.html"));
   server.listen(port, host, () => {
     const url = `http://localhost:${port}`;

package/dist/compiler.cjs

@@ -294,25 +294,32 @@ function detectCycles(nodes, edges) {
   for (const node of nodes) {
     color.set(node.id, WHITE);
   }
-  function dfs(nodeId) {
-    color.set(nodeId, GRAY);
-    for (const neighbor of adjacency.get(nodeId) ?? []) {
+  for (const node of nodes) {
+    if (color.get(node.id) !== WHITE) continue;
+    const stack = [[node.id, 0]];
+    color.set(node.id, GRAY);
+    while (stack.length > 0) {
+      const top = stack[stack.length - 1];
+      const [currentId, idx] = top;
+      const neighbors = adjacency.get(currentId) ?? [];
+      if (idx >= neighbors.length) {
+        color.set(currentId, BLACK);
+        stack.pop();
+        continue;
+      }
+      top[1] = idx + 1;
+      const neighbor = neighbors[idx];
       if (color.get(neighbor) === GRAY) {
         errors.push({
           code: "CYCLE_DETECTED",
-          message: `Cycle detected: node "${nodeId}" \u2192 "${neighbor}"`,
-          nodeId
+          message: `Cycle detected: node "${currentId}" \u2192 "${neighbor}"`,
+          nodeId: currentId
         });
       } else if (color.get(neighbor) === WHITE) {
-        dfs(neighbor);
+        color.set(neighbor, GRAY);
+        stack.push([neighbor, 0]);
       }
     }
-    color.set(nodeId, BLACK);
-  }
-  for (const node of nodes) {
-    if (color.get(node.id) === WHITE) {
-      dfs(node.id);
-    }
   }
   return errors;
 }
@@ -514,10 +521,16 @@ function resolveInputRef(path, context) {
   const incoming = context.ir.edges.filter(
     (e) => e.targetNodeId === context.currentNodeId
   );
-  const dataSource = incoming.find((e) => {
+  const nonTriggerIncoming = incoming.filter((e) => {
     const src = context.nodeMap.get(e.sourceNodeId);
     return src && src.category !== "trigger" /* TRIGGER */;
-  }) || incoming[0];
+  });
+  if (nonTriggerIncoming.length > 1 && typeof console !== "undefined") {
+    console.warn(
+      `[flow2code] $input is ambiguous: node "${context.currentNodeId}" has ${nonTriggerIncoming.length} non-trigger upstream edges. Using first match "${nonTriggerIncoming[0].sourceNodeId}".`
+    );
+  }
+  const dataSource = nonTriggerIncoming[0] || incoming[0];
   if (dataSource) {
     const srcId = dataSource.sourceNodeId;
     if (context.blockScopedNodeIds?.has(srcId)) {
@@ -532,15 +545,21 @@ function resolveInputRef(path, context) {
     `Expression parser error: Node "${context.currentNodeId}" has no input connected`
   );
 }
+var _cachedTriggerIR = null;
+var _cachedTriggerId = null;
 function resolveTriggerRef(path, context) {
-  const trigger = context.ir.nodes.find(
-    (n) => n.category === "trigger" /* TRIGGER */
-  );
-  if (trigger) {
-    if (context.symbolTable?.hasVar(trigger.id)) {
-      return `${context.symbolTable.getVarName(trigger.id)}${path}`;
+  if (_cachedTriggerIR !== context.ir) {
+    _cachedTriggerIR = context.ir;
+    const trigger = context.ir.nodes.find(
+      (n) => n.category === "trigger" /* TRIGGER */
+    );
+    _cachedTriggerId = trigger?.id ?? null;
+  }
+  if (_cachedTriggerId) {
+    if (context.symbolTable?.hasVar(_cachedTriggerId)) {
+      return `${context.symbolTable.getVarName(_cachedTriggerId)}${path}`;
     }
-    return `flowState['${trigger.id}']${path}`;
+    return `flowState['${_cachedTriggerId}']${path}`;
   }
   return "undefined";
 }
@@ -3041,12 +3060,18 @@ function computeAuditHints(ctx) {
   return hints;
 }
 function isFetchCall(node) {
-  const text = node.getText();
-  return text.includes("fetch(") && (text.includes("await") || node.getKind() === import_ts_morph2.SyntaxKind.AwaitExpression);
+  if (node.getKind() === import_ts_morph2.SyntaxKind.CallExpression) {
+    const expr = node.getExpression();
+    if (expr.getKind() === import_ts_morph2.SyntaxKind.Identifier && expr.getText() === "fetch") return true;
+  }
+  if (node.getKind() === import_ts_morph2.SyntaxKind.AwaitExpression) {
+    return isFetchCall(node.getChildAtIndex(1) ?? node);
+  }
+  return node.forEachChild((child) => isFetchCall(child) || void 0) ?? false;
 }
 function hasAwaitExpression(node) {
   if (node.getKind() === import_ts_morph2.SyntaxKind.AwaitExpression) return true;
-  return node.getText().startsWith("await ");
+  return node.forEachChild((child) => hasAwaitExpression(child) || void 0) ?? false;
 }
 function extractAwaitedExpression(node) {
   const text = node.getText();
@@ -3116,7 +3141,8 @@ function inferLabel(code, varName) {
   return truncate2(code, 30);
 }
 function trackVariableUses(nodeId, expression, ctx) {
-  const identifiers = expression.match(/\b([a-zA-Z_]\w*)\b/g);
+  const stripped = expression.replace(/(["'`])(?:(?!\1|\\).|\\.)*\1/g, "");
+  const identifiers = stripped.match(/\b([a-zA-Z_]\w*)\b/g);
   if (!identifiers) return;
   const uses = [];
   const seen = /* @__PURE__ */ new Set();

package/dist/compiler.js

@@ -227,25 +227,32 @@ function detectCycles(nodes, edges) {
   for (const node of nodes) {
     color.set(node.id, WHITE);
   }
-  function dfs(nodeId) {
-    color.set(nodeId, GRAY);
-    for (const neighbor of adjacency.get(nodeId) ?? []) {
+  for (const node of nodes) {
+    if (color.get(node.id) !== WHITE) continue;
+    const stack = [[node.id, 0]];
+    color.set(node.id, GRAY);
+    while (stack.length > 0) {
+      const top = stack[stack.length - 1];
+      const [currentId, idx] = top;
+      const neighbors = adjacency.get(currentId) ?? [];
+      if (idx >= neighbors.length) {
+        color.set(currentId, BLACK);
+        stack.pop();
+        continue;
+      }
+      top[1] = idx + 1;
+      const neighbor = neighbors[idx];
       if (color.get(neighbor) === GRAY) {
         errors.push({
           code: "CYCLE_DETECTED",
-          message: `Cycle detected: node "${nodeId}" \u2192 "${neighbor}"`,
-          nodeId
+          message: `Cycle detected: node "${currentId}" \u2192 "${neighbor}"`,
+          nodeId: currentId
         });
       } else if (color.get(neighbor) === WHITE) {
-        dfs(neighbor);
+        color.set(neighbor, GRAY);
+        stack.push([neighbor, 0]);
       }
     }
-    color.set(nodeId, BLACK);
-  }
-  for (const node of nodes) {
-    if (color.get(node.id) === WHITE) {
-      dfs(node.id);
-    }
   }
   return errors;
 }
@@ -447,10 +454,16 @@ function resolveInputRef(path, context) {
   const incoming = context.ir.edges.filter(
     (e) => e.targetNodeId === context.currentNodeId
   );
-  const dataSource = incoming.find((e) => {
+  const nonTriggerIncoming = incoming.filter((e) => {
     const src = context.nodeMap.get(e.sourceNodeId);
     return src && src.category !== "trigger" /* TRIGGER */;
-  }) || incoming[0];
+  });
+  if (nonTriggerIncoming.length > 1 && typeof console !== "undefined") {
+    console.warn(
+      `[flow2code] $input is ambiguous: node "${context.currentNodeId}" has ${nonTriggerIncoming.length} non-trigger upstream edges. Using first match "${nonTriggerIncoming[0].sourceNodeId}".`
+    );
+  }
+  const dataSource = nonTriggerIncoming[0] || incoming[0];
   if (dataSource) {
     const srcId = dataSource.sourceNodeId;
     if (context.blockScopedNodeIds?.has(srcId)) {
@@ -465,15 +478,21 @@ function resolveInputRef(path, context) {
     `Expression parser error: Node "${context.currentNodeId}" has no input connected`
   );
 }
+var _cachedTriggerIR = null;
+var _cachedTriggerId = null;
 function resolveTriggerRef(path, context) {
-  const trigger = context.ir.nodes.find(
-    (n) => n.category === "trigger" /* TRIGGER */
-  );
-  if (trigger) {
-    if (context.symbolTable?.hasVar(trigger.id)) {
-      return `${context.symbolTable.getVarName(trigger.id)}${path}`;
+  if (_cachedTriggerIR !== context.ir) {
+    _cachedTriggerIR = context.ir;
+    const trigger = context.ir.nodes.find(
+      (n) => n.category === "trigger" /* TRIGGER */
+    );
+    _cachedTriggerId = trigger?.id ?? null;
+  }
+  if (_cachedTriggerId) {
+    if (context.symbolTable?.hasVar(_cachedTriggerId)) {
+      return `${context.symbolTable.getVarName(_cachedTriggerId)}${path}`;
     }
-    return `flowState['${trigger.id}']${path}`;
+    return `flowState['${_cachedTriggerId}']${path}`;
   }
   return "undefined";
 }
@@ -2977,12 +2996,18 @@ function computeAuditHints(ctx) {
   return hints;
 }
 function isFetchCall(node) {
-  const text = node.getText();
-  return text.includes("fetch(") && (text.includes("await") || node.getKind() === SyntaxKind.AwaitExpression);
+  if (node.getKind() === SyntaxKind.CallExpression) {
+    const expr = node.getExpression();
+    if (expr.getKind() === SyntaxKind.Identifier && expr.getText() === "fetch") return true;
+  }
+  if (node.getKind() === SyntaxKind.AwaitExpression) {
+    return isFetchCall(node.getChildAtIndex(1) ?? node);
+  }
+  return node.forEachChild((child) => isFetchCall(child) || void 0) ?? false;
 }
 function hasAwaitExpression(node) {
   if (node.getKind() === SyntaxKind.AwaitExpression) return true;
-  return node.getText().startsWith("await ");
+  return node.forEachChild((child) => hasAwaitExpression(child) || void 0) ?? false;
 }
 function extractAwaitedExpression(node) {
   const text = node.getText();
@@ -3052,7 +3077,8 @@ function inferLabel(code, varName) {
   return truncate2(code, 30);
 }
 function trackVariableUses(nodeId, expression, ctx) {
-  const identifiers = expression.match(/\b([a-zA-Z_]\w*)\b/g);
+  const stripped = expression.replace(/(["'`])(?:(?!\1|\\).|\\.)*\1/g, "");
+  const identifiers = stripped.match(/\b([a-zA-Z_]\w*)\b/g);
   if (!identifiers) return;
   const uses = [];
   const seen = /* @__PURE__ */ new Set();

package/dist/server.js

@@ -198,25 +198,32 @@ function detectCycles(nodes, edges) {
   for (const node of nodes) {
     color.set(node.id, WHITE);
   }
-  function dfs(nodeId) {
-    color.set(nodeId, GRAY);
-    for (const neighbor of adjacency.get(nodeId) ?? []) {
+  for (const node of nodes) {
+    if (color.get(node.id) !== WHITE) continue;
+    const stack = [[node.id, 0]];
+    color.set(node.id, GRAY);
+    while (stack.length > 0) {
+      const top = stack[stack.length - 1];
+      const [currentId, idx] = top;
+      const neighbors = adjacency.get(currentId) ?? [];
+      if (idx >= neighbors.length) {
+        color.set(currentId, BLACK);
+        stack.pop();
+        continue;
+      }
+      top[1] = idx + 1;
+      const neighbor = neighbors[idx];
       if (color.get(neighbor) === GRAY) {
         errors.push({
           code: "CYCLE_DETECTED",
-          message: `Cycle detected: node "${nodeId}" \u2192 "${neighbor}"`,
-          nodeId
+          message: `Cycle detected: node "${currentId}" \u2192 "${neighbor}"`,
+          nodeId: currentId
         });
       } else if (color.get(neighbor) === WHITE) {
-        dfs(neighbor);
+        color.set(neighbor, GRAY);
+        stack.push([neighbor, 0]);
       }
     }
-    color.set(nodeId, BLACK);
-  }
-  for (const node of nodes) {
-    if (color.get(node.id) === WHITE) {
-      dfs(node.id);
-    }
   }
   return errors;
 }
@@ -418,10 +425,16 @@ function resolveInputRef(path, context) {
   const incoming = context.ir.edges.filter(
     (e) => e.targetNodeId === context.currentNodeId
   );
-  const dataSource = incoming.find((e) => {
+  const nonTriggerIncoming = incoming.filter((e) => {
     const src = context.nodeMap.get(e.sourceNodeId);
     return src && src.category !== "trigger" /* TRIGGER */;
-  }) || incoming[0];
+  });
+  if (nonTriggerIncoming.length > 1 && typeof console !== "undefined") {
+    console.warn(
+      `[flow2code] $input is ambiguous: node "${context.currentNodeId}" has ${nonTriggerIncoming.length} non-trigger upstream edges. Using first match "${nonTriggerIncoming[0].sourceNodeId}".`
+    );
+  }
+  const dataSource = nonTriggerIncoming[0] || incoming[0];
   if (dataSource) {
     const srcId = dataSource.sourceNodeId;
     if (context.blockScopedNodeIds?.has(srcId)) {
@@ -436,15 +449,21 @@ function resolveInputRef(path, context) {
     `Expression parser error: Node "${context.currentNodeId}" has no input connected`
   );
 }
+var _cachedTriggerIR = null;
+var _cachedTriggerId = null;
 function resolveTriggerRef(path, context) {
-  const trigger = context.ir.nodes.find(
-    (n) => n.category === "trigger" /* TRIGGER */
-  );
-  if (trigger) {
-    if (context.symbolTable?.hasVar(trigger.id)) {
-      return `${context.symbolTable.getVarName(trigger.id)}${path}`;
+  if (_cachedTriggerIR !== context.ir) {
+    _cachedTriggerIR = context.ir;
+    const trigger = context.ir.nodes.find(
+      (n) => n.category === "trigger" /* TRIGGER */
+    );
+    _cachedTriggerId = trigger?.id ?? null;
+  }
+  if (_cachedTriggerId) {
+    if (context.symbolTable?.hasVar(_cachedTriggerId)) {
+      return `${context.symbolTable.getVarName(_cachedTriggerId)}${path}`;
     }
-    return `flowState['${trigger.id}']${path}`;
+    return `flowState['${_cachedTriggerId}']${path}`;
   }
   return "undefined";
 }
@@ -2790,12 +2809,18 @@ function computeAuditHints(ctx) {
   return hints;
 }
 function isFetchCall(node) {
-  const text = node.getText();
-  return text.includes("fetch(") && (text.includes("await") || node.getKind() === SyntaxKind.AwaitExpression);
+  if (node.getKind() === SyntaxKind.CallExpression) {
+    const expr = node.getExpression();
+    if (expr.getKind() === SyntaxKind.Identifier && expr.getText() === "fetch") return true;
+  }
+  if (node.getKind() === SyntaxKind.AwaitExpression) {
+    return isFetchCall(node.getChildAtIndex(1) ?? node);
+  }
+  return node.forEachChild((child) => isFetchCall(child) || void 0) ?? false;
 }
 function hasAwaitExpression(node) {
   if (node.getKind() === SyntaxKind.AwaitExpression) return true;
-  return node.getText().startsWith("await ");
+  return node.forEachChild((child) => hasAwaitExpression(child) || void 0) ?? false;
 }
 function extractAwaitedExpression(node) {
   const text = node.getText();
@@ -2865,7 +2890,8 @@ function inferLabel(code, varName) {
   return truncate(code, 30);
 }
 function trackVariableUses(nodeId, expression, ctx) {
-  const identifiers = expression.match(/\b([a-zA-Z_]\w*)\b/g);
+  const stripped = expression.replace(/(["'`])(?:(?!\1|\\).|\\.)*\1/g, "");
+  const identifiers = stripped.match(/\b([a-zA-Z_]\w*)\b/g);
   if (!identifiers) return;
   const uses = [];
   const seen = /* @__PURE__ */ new Set();
@@ -3646,6 +3672,13 @@ function handleImportOpenAPI(body) {
         (flow) => paths.some((p) => flow.meta.name.includes(p))
       );
     }
+    if (body.filter?.tags && Array.isArray(body.filter.tags)) {
+      const tags = body.filter.tags.map((t) => t.toLowerCase());
+      filteredFlows = filteredFlows.filter((flow) => {
+        const flowTags = flow.meta.tags ?? [];
+        return flowTags.some((t) => tags.includes(t.toLowerCase()));
+      });
+    }
     return {
       status: 200,
       body: {
@@ -3964,10 +3997,14 @@ function startServer(options = {}) {
   const server = createServer((req, res) => {
     handleRequest(req, res, staticDir, projectRoot).catch((err) => {
       logger.error("Internal error:", err);
-      res.writeHead(500, { "Content-Type": "text/plain" });
-      res.end("Internal Server Error");
+      if (!res.headersSent) {
+        res.writeHead(500, { "Content-Type": "text/plain" });
+        res.end("Internal Server Error");
+      }
     });
   });
+  server.headersTimeout = 3e4;
+  server.requestTimeout = 6e4;
   const hasUI = existsSync2(join2(staticDir, "index.html"));
   server.listen(port, host, () => {
     const url = `http://localhost:${port}`;