langflower 0.1.3 → 0.2.0

package/vendor/runtime/dist/types.d.ts

@@ -19,6 +19,11 @@ export type RuntimeFeedPortMeta = {
     readonly role?: RuntimeFeedRole;
     /** When true, feed visit stays open for chunks / interleaved streams. */
     readonly streaming?: boolean;
+    /**
+     * Stamped on every frame of a {@link RuntimeNode.feedVisitBoundary} node
+     * so the work log can close the caller visit without a palette lookup.
+     */
+    readonly closesPreviousVisit?: true;
 };
 /**
  * Typed metadata attached to every `statefulConnection` / `statefulObservable`
@@ -51,7 +56,7 @@ export type PortMeta = {
  */
 export type MetaFromStatefulObservable<T extends StatefulObservable<unknown, unknown, unknown>> = T extends StatefulObservable<unknown, unknown, infer Meta> ? Meta : never;
 /**
- * v2 runtime contracts — **execution only**.
+ * Runtime contracts — **execution only**.
  *
  * Responsibilities of `@langflower/runtime` (this module):
  * - Wire node ports and run reactive handlers (StatefulObservable graph).
@@ -60,9 +65,8 @@ export type MetaFromStatefulObservable<T extends StatefulObservable<unknown, unk
  *   and `@langflower/server` on purpose — each layer must fail fast without
  *   depending on the others.
  *
- * **Out of scope** (handled by `@langflower/server` or later phases):
- * - `WorkflowGraph` → {@link RuntimeNode} factory (isolated runtime first)
- * - `defineNode` / sync lift adapters
+ * **Out of scope** (owned by `@langflower/server` / UI / tools):
+ * - Persisted `WorkflowGraph` load/save (server hydrates {@link RuntimeFacade.editor})
  * - HITL / chat semantics — server marks which ports are HITL and maps
  *   {@link RuntimeRunnerEvent} (+ user replies as seed) to chat / WS protocol
  * - runId persistence, harness, LLM, filesystem
@@ -70,8 +74,9 @@ export type MetaFromStatefulObservable<T extends StatefulObservable<unknown, unk
  * **Server telemetry:** subscribe to {@link RuntimeRunner.events$} and
  * translate frames to WebSocket; runtime does not speak WS.
  *
- * Phase 1 builds an **isolated runtime** — nodes wired manually in tests,
- * no Langflower workflow loader yet.
+ * Isolated unit tests still wire {@link RuntimeNode} instances by hand.
+ * Production server hydrates {@link RuntimeFacade.editor} from the workflow
+ * graph. There is no separate `WorkflowRuntime` / Phase-1-only loader.
  *
  * ## Status lifecycle
  * - {@link RuntimeRunner.start} / {@link RuntimeRunner.startNode} → `'running'`
@@ -113,7 +118,8 @@ export type MetaFromStatefulObservable<T extends StatefulObservable<unknown, unk
  * ## Input vs output ports
  * `inputs` expose {@link StatefulConnection} — runtime wires edges with
  * `connect(source)` on {@link RuntimeRunner.start} and `disconnect()` on
- * {@link RuntimeRunner.interrupt}. Seeds use `connect(of(value))` on open slots.
+ * {@link RuntimeRunner.interrupt}. Seeds use `connect(of(value))` on open slots,
+ * or `connect(value)` when `value` is already an Observable.
  * `outputs` expose {@link StatefulObservable} (read side) for telemetry and
  * optional {@link RuntimeNode.stopsRun} completion.
  */
@@ -153,7 +159,10 @@ export declare const isPortPendingTelemetry: (event: RuntimeRunnerEvent) => even
     };
 };
 export declare const isRuntimeDone: (event: RuntimeRunnerEvent) => event is RuntimeDoneTelemetry;
-/** Seed value pushed into an input port slot on {@link RuntimeRunner.start}. */
+/**
+ * Seed value pushed into an input port slot on {@link RuntimeRunner.start}.
+ * Plain values are wrapped in `of`; Observables are connected as the stream.
+ */
 export type RuntimeSeedPortValue = {
     readonly portId: string | symbol;
     /** Multi-input slot index (`0` for single-slot ports). */
@@ -183,7 +192,7 @@ export type RuntimeNode = {
      *
      * On run start the runner calls `connect(upstreamOutput)` per edge; on
      * interrupt it calls `disconnect()`. Open slots may be seeded with
-     * `connect(of(value))`.
+     * `connect(of(value))`, or `connect(value)` when `value` is an Observable.
      *
      * Port metadata lives on `connection.meta` as {@link PortMeta}.
      */
@@ -224,17 +233,18 @@ export type RuntimeNode = {
      * {@link RuntimeRunnerApi.pushIntoInput} (composer) instead.
      */
     readonly chatEntry?: boolean;
+    /**
+     * When `true`, every port frame from this node (including errors on
+     * role-less ports) carries {@link RuntimeFeedPortMeta.closesPreviousVisit}
+     * so the work log opens a new visit card.
+     */
+    readonly feedVisitBoundary?: boolean;
     /**
      * Declares handler contract: at most one output value per input
      * activation (e.g. constant, delay). Runtime does not enforce this —
      * metadata for factories and tests.
      */
     readonly emitOncePerActivation?: boolean;
-    /**
-     * Seeded snapshot node — emits cached outputs without re-execution.
-     * Server skips running/completed telemetry for these nodes.
-     */
-    readonly skipExecutionTelemetry?: boolean;
 };
 export type RuntimeEdge = {
     readonly edgeId: EdgeId;
@@ -317,8 +327,8 @@ export type RuntimeEditorApi = {
     };
     /** Ready-to-use calculated graph clusters. Recalculated after graph edits. */
     allClusters: readonly GraphCluster[];
-    /** Resolve the ready cluster containing `nodeId`. */
-    getClusterByNodeId(nodeId: NodeId): GraphCluster;
+    /** Resolve the ready cluster containing `nodeId`, or `false` if missing. */
+    getClusterByNodeId(nodeId: NodeId): GraphCluster | false;
 };
 export type RuntimeRunnerApi = {
     /**
@@ -348,7 +358,7 @@ export type RuntimeRunnerApi = {
      * Run stays `'running'` until {@link RuntimeRunnerApi.interrupt} or a
      * {@link RuntimeNode.stopsRun} node in scope emits.
      *
-     * Throws if status is already `'running'`.
+     * Returns `false` if status is already `'running'` or `nodeId` is missing.
      *
      * Flow: `RuntimeEditorApi.getClusterByNodeId(nodeId)` -> internal runner
      * `runScope` (cluster node/edge sets).

package/vendor/server/skeleton/instructions.md

@@ -13,6 +13,12 @@ Each `*.ts` file may `export default` a definition or an array. No required
 Langflower does **not** auto-install on start, bootstrap, or palette reload.
 Startup **does** compile packs under `.langflower/nodes/`.
 
+Port OpenCode / CLI `.mjs` tools into pack TypeScript (`defineToolRegistrations`)
+and compile — do **not** spawn `node` on a leftover sidecar (that breaks when
+the pack is copied). **Do** wrap named scripts from the project root or a
+monorepo workspace `package.json` as tools (`npm run <script>`, allowlisted
+literal, no `start` / `dev` / watch) so the agent does not need bash.
+
 If pack files `import` each other with a **`.ts` suffix**, set
 `"allowImportingTsExtensions": true` next to `"noEmit": true` in the pack
 `tsconfig.json` (hello-embed seed). Without it the pack does not compile.

package/vendor/server/skeleton/nodes/my-nodes/README.md

@@ -28,8 +28,9 @@ its own `package.json`.
 Rules:
 
 - **One pack = one folder** with its own `package.json`.
-- **No required `index.ts`.** Each `*.ts` / `*.tsx` may `export default` a node
+- **No required `index.ts`.** Each `*.ts` may `export default` a node
   definition or an array of definitions. Langflower discovers those defaults.
+  Custom nodes are not React — do not author `.tsx`.
 - Skip `*.test.ts`, `*.d.ts`, `dist/`, and `node_modules/` when scanning.
 - Import from **`@langflower/node-sdk`** directly — not from a root
   `nodes/types.ts`.
@@ -127,6 +128,23 @@ model calls `git_diff` on demand (optional `path` scopes the diff). Prefer this
 over `defineNode` when the value should be inventory for the tool loop, not a
 graph wire.
 
+### Common mistake: wrapping a `.mjs` CLI instead of compiling TypeScript
+
+**Wrong:** keep `tool.mjs` and have `handler` spawn `node path/to/tool.mjs`
+(`__dirname`, `import.meta.url`, or a hardcoded path). Only `*.ts` is a pack
+entry. Copying the pack without that sidecar breaks the tool.
+
+**Right:** port the script into TypeScript in this pack (helpers in `lib/` with
+`from './lib/x.ts'` plus `allowImportingTsExtensions` if needed) so compile
+bundles it. The original `.mjs` is not a runtime dependency of the node.
+
+**Exception:** wrap named scripts from the **project root** or a **monorepo
+workspace** `package.json` as tools (`npm run <script>`, allowlisted literal,
+`cwd` under `ctx.projectDir`). Prefer that over granting bash. Do not register
+hanging scripts (`start`, `dev`, `test:watch`). Seed `review-gate.ts` wraps
+`npm run test` this way. Host `git` via `child_process` is also OK
+(`git-diff-tool.ts`).
+
 ### Common mistake: `defineNode` for `ok` / `fail` gates
 
 **Wrong:** a review / QA gate with `defineNode` that returns `{ ok: true }` or

package/vendor/server/skeleton/schemas/langflower-config.schema.json

@@ -97,7 +97,7 @@
 		},
 		"permission": {
 			"type": "object",
-			"description": "Runtime allow/ask/deny for harness tools (≠ Inspector enabledToolIds).",
+			"description": "Runtime allow/ask/deny for harness tools (≠ node toolPermissions).",
 			"additionalProperties": {
 				"$ref": "#/$defs/permissionToolConfig"
 			}

package/vendor/server/skeleton/skills/langflower-helper/SKILL.md

@@ -74,8 +74,9 @@ do not say coding pipelines “don’t exist” or are unavailable.
   and runs the same CLI (`--no-open -p <port>`), then opens the editor in
   the **system browser** after the instance is listening. Several
   projects can run at once, each on its own port. Unsigned Windows/macOS
-  zips ship on GitHub Releases (`launcher-v*` tags, not npm `v*`). Closing
-  the launcher stops instances **it** started. Closing a browser tab does
+  zips ship on GitHub Releases (`launcher-v*` tags, not npm `v*`). The
+  macOS zip contains `Langflower.app`. Closing the launcher stops
+  instances **it** started. Closing a browser tab does
   not. The **?** control opens the user manual on GitHub
   (`docs/public/launcher.md`).
 - **Cannot:** Claim the launcher embeds the canvas, or that it is a
@@ -163,11 +164,16 @@ do not say coding pipelines “don’t exist” or are unavailable.
 
 ### 5. Editor chrome
 
+- **Can:** Infinite agent chat uses **Chat Loop** (`common-chat-loop`):
+  agent `response` → `result`, `feedback` → agent `feedback`. Send only —
+  no Approve; the run ends on Stop. Do not use Review Gate Approve for that
+  loop, and do not use bash for the conversation.
 - **Can:** Chat Input graphs start from the composer **Start** control. Plain
   **Run** stays disabled for those graphs. Prefill or last typed text lives on
   the Chat Input node (`inputs.message`) and reappears after Stop.
 - **Can:** While running — Hard **Stop**, soft **Pause**, HITL,
-  `ask_user` (composer Send; question in the work log), and `permission.ask`
+  `ask_user` (composer Send; question in the work log; option chips when
+  the agent passed `questions`), and `permission.ask`
   in the composer. Work log **clears** on
   successful
   workflow load / create / copy (not rename).
@@ -245,9 +251,15 @@ These four are **not** the same thing.
 
 ### 8. Tools, permissions, MCP
 
-- **Can:** Harness builtins (including default `ask_user`) + `permission.ask`
-  Allow/Deny for those builtins. `ask_user` shows the question in the work
-  log and opens the composer textarea (Send), not Allow/Deny. Wired pack /
+- **Can:** Harness builtins (including default `ask_user` and `sleep`) +
+  `permission.ask`
+  Allow/Deny for those builtins. Rename or move a file or directory with
+  builtin `move` (`from` + `to` under the project) — do not use bash `mv`.
+  Wait without bash with builtin `sleep` (`seconds` 1–300); Stop aborts.
+  Not a job-wait and not canvas Delay (`common-delay`).
+  `ask_user` shows the question in the work
+  log and opens the composer (textarea + optional option chips, Send), not
+  Allow/Deny. Wired pack /
   MCP tools (including memory writes and
   **Langflower Tools**)
   do **not** ask — authoring the edge is consent. Write Allow does **not**
@@ -261,7 +273,10 @@ These four are **not** the same thing.
   (`common-tool-invoke`: `tools` + `toolId` + JSON `args` → `result`). **Tool
   inspect** (`common-tool-inspect`) prints copy-paste `toolId`, example
   args, and `inputSchema` from the same `tools` wire (optional inspect
-  `toolId` filters the dump). No LLM required on that path.
+  `toolId` filters the dump). No LLM required on that path. **Preview**
+  (`common-preview`) accepts any wire on **input** (including `tool-handle`):
+  the node and **text** show JSON; **output** passes the value through.
+  Tool inspect remains the structured dump.
 - **Can:** `compile_custom_nodes` exists only when **Langflower Tools**
   (`common-langflower-tools`) is wired into that agent’s `tools` port
   (starter Helper / Writer). Same intent as Custom → **Update**. Recompile
@@ -275,8 +290,6 @@ These four are **not** the same thing.
   unlock” as the product model (use graph stages / tool profiles). All
   `mcp.servers` always start. Agent sees raw MCP config instead of handles.
   Equating a checkbox allowlist with runtime allow — use the permission table.
-  Preview (`common-preview`) showing a `tool-handle` wire — use **Tool
-  inspect**.
 
 ### 9. Sub-Agent and swarm
 
@@ -312,7 +325,7 @@ Sub-Agent is an **explicit canvas node** for **control and observability**
   output, `feed.role: result`). There is no separate Plan mode. **Embeddings**
   catalog nodes + Settings default embedding model
   are shipped for API checks and pack **`EmbedHandle`** wiring — separate from
-  vector KB ([ADR-033](../../../../../docs/ADR.md#adr-033--markdown-memory-tools-no-embedding-as-base)).
+  vector KB ([ADR-033](../../../../../docs/architecture/ADR.md#adr-033--markdown-memory-tools-no-embedding-as-base)).
   Obsidian vault helpers are **not** shipped (TBD-007).
 - **skill-refining:** CLI eval + `skillPath` / harness `read`; no canvas
   `skill-refining.json` demo.
@@ -358,6 +371,10 @@ When the user asks to “create a project wiki”, “build a knowledge base”,
   are extra packs (no jsonc registration).
   LLM tool `handler`s return short **strings** (expected failures as text,
   not throws). Do not dump raw subprocess logs at the model.
+  Wrap named scripts from the project root or a monorepo workspace
+  `package.json` as `ToolHandle`s (`npm run <script>`, allowlisted literal,
+  no hangers) so the agent uses tools instead of bash. Seed `review-gate`
+  wraps `npm run test` this way.
   Exclusive `ok` / `fail` gates are **`defineReactiveNode`**. Seed
   `review-gate` uses a boolean **pulse** on `ok`. If the next stage needs
   the original payload, `ok` **passthroughs `trigger`** (`inferTypeFrom`)
@@ -367,7 +384,9 @@ When the user asks to “create a project wiki”, “build a knowledge base”,
   (Stop / done / Start) until the user loads another workflow or shuts down
   Langflower — not the same as Checkpoint resume after process kill.
 - **Cannot:** Plain JS as the authoring path, Go, Python, or other languages.
-  Server auto-install. Sandboxed arbitrary user-node execution as shipped.
+  Wrap OpenCode/CLI `.mjs` by spawning `node` on a sidecar file (not
+  TypeScript authoring; pack is not portable — port into pack `.ts` and
+  compile). Server auto-install. Sandboxed arbitrary user-node execution as shipped.
   Ambient compile without Langflower Tools wired. Canvas add/remove node or
   edge tools (not shipped). Claim that every node always resets on Stop, or
   that in-memory node state survives process restart without Checkpoints.
@@ -379,7 +398,11 @@ When the user asks to “create a project wiki”, “build a knowledge base”,
 
 When the user asks to add or change a custom node from this starter chat:
 
-1. Call Writer (or edit `.langflower/nodes/<pack>/*.ts` yourself).
+1. Call Writer (or edit `.langflower/nodes/<pack>/*.ts` yourself). When
+   converting OpenCode / CLI `.mjs` tools, **port the logic into pack `.ts`**
+   and compile — do **not** keep a sidecar and spawn `node` on it. When they
+   ask for safe project commands, wrap `package.json` scripts as tools
+   (`npm run <script>`) instead of granting bash.
 2. Call **`compile_custom_nodes`** (no args). Report `status` / `nodeTypes` /
    `errors` from the tool text. Pack failures also write
    `COMPILATION_ERRORS.md`. If tsc rejects `.ts` import paths, add

package/vendor/server/skeleton/skills/langflower-helper/layout.md

@@ -16,8 +16,9 @@ Facts for UI chrome and on-disk paths. Prefer this file over guessing.
   **Settings**. Opening Settings (gear or empty-provider onboarding) swaps out
   feed/inspector; canvas stays. Settings open/close is server-driven.
 - **Composer (bottom)** — **Start** / Hard **Stop** / soft **Pause**; HITL
-  input and actions; `ask_user` textarea + Send (question is in the work log);
-  `permission.ask` Allow/Deny while a run needs them.
+  input and actions; `ask_user` textarea + optional option chips + Send
+  (question is in the work log); `permission.ask` Allow/Deny while a run
+  needs them.
 
 ## Where can I…?
 
@@ -28,11 +29,11 @@ Facts for UI chrome and on-disk paths. Prefer this file over guessing.
 | Start a Chat Input graph                         | Composer **Start** — not plain **Run**. Prefill lives on the node; Stop then Start reuses it.                                                                                                                                                                                                                                                                                                                                      |
 | See run output / stream                          | Right aside **feed**                                                                                                                                                                                                                                                                                                                                                                                                               |
 | Answer HITL / send into a waiting node           | Composer + feed context                                                                                                                                                                                                                                                                                                                                                                                                            |
-| Answer an agent's `ask_user` question            | Work log shows the question; composer textarea + **Send** (not Allow/Deny)                                                                                                                                                                                                                                                                                                                                                         |
+| Answer an agent's `ask_user` question            | Work log shows the question; composer option chips (if any) + textarea + **Send** (not Allow/Deny)                                                                                                                                                                                                                                                                                                                                 |
 | Allow or Deny `permission.ask`                   | Composer permission controls                                                                                                                                                                                                                                                                                                                                                                                                       |
 | Soft-pause last feed agent / continue            | Composer **Pause** (per-node) / Send or Resume (soft pause ≠ Hard Stop)                                                                                                                                                                                                                                                                                                                                                            |
 | Hard-stop a run                                  | Composer **Stop**                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| Edit selected node params / ports                | Select node → right aside **inspector** (not Settings). Read-only while a run is active — Stop first.                                                                                                                                                                                                                                                                                                                              |
+| Edit selected node params / ports                | Select node → right aside **inspector** (not Settings). Close via canvas click or inspector **Close**. Read-only while a run is active — Stop first.                                                                                                                                                                                                                                                                               |
 | See what a built-in node does                    | Hover a palette row (popover) **or** select the node → inspector **description** (markdown).                                                                                                                                                                                                                                                                                                                                       |
 | Add a node from the palette                      | Drag from the left palette onto the canvas. Disabled while a run is active (`cursor-not-allowed`) — Stop first.                                                                                                                                                                                                                                                                                                                    |
 | Hide / show the node palette                     | Palette title `<<` / canvas `>>`. Shared across tabs; stored as `paletteVisible` in project `langflower.jsonc`. Allowed during a run.                                                                                                                                                                                                                                                                                              |
@@ -54,6 +55,7 @@ Facts for UI chrome and on-disk paths. Prefer this file over guessing.
 | `instructions.md`  | Project-level agent instructions                                                                                                      |
 | `runs/`            | Run artifacts / checkpoints when created                                                                                              |
 | `logs/`            | Server bridge diagnostic JSONL logs when the server runs                                                                              |
+| `.gitignore`       | Seeded ignore rules: compiled node cache (`.cache/`), `logs/`, pack `node_modules/`                                                   |
 
 ## Out of chrome
 

package/vendor/server/skeleton/skills/langflower-node-writer/SKILL.md

@@ -14,7 +14,10 @@ You help the user write **custom nodes** for Langflower.
 
 - Custom nodes are **TypeScript** via `@langflower/node-sdk` only — first-class
   language; `tsc` / IDE types are the compile-time validators. **Not** plain JS
-  as the authoring path, Go, Python, Rust, or other runtimes.
+  as the authoring path, Go, Python, Rust, or other runtimes. Do **not** wrap
+  leftover `.mjs` by spawning `node` — port the logic into pack `.ts`. Wrapping
+  named `npm run <script>` entries from the project root or a monorepo
+  workspace `package.json` is the exception (tools instead of bash).
 - Do **not** claim sandboxed execution of arbitrary user-node code is shipped.
 - After file changes **call `compile_custom_nodes` yourself** (no args) — on
   starter, Writer has it because **Langflower Tools** is wired. Custom →
@@ -39,10 +42,16 @@ You help the user write **custom nodes** for Langflower.
   branches, streams, or advanced bind wiring are required.
 - Import from **`@langflower/node-sdk`** — never from a generated
   `nodes/types.ts` or a required `index.ts` barrel.
-- Each `*.ts` / `*.tsx` may `export default` a definition or an array.
-  Skip `*.test.ts`, `*.d.ts`, `dist/`, `node_modules/`.
+- Each `*.ts` may `export default` a definition or an array. Skip `*.test.ts`,
+  `*.d.ts`, `dist/`, `node_modules/`. Custom nodes are not React — do not
+  author `.tsx`.
 - Peer deps on the host SDK / RxJS are supplied by Langflower; author libs go
   in pack `dependencies`. The user runs `npm install` in the pack.
+- The `@langflower/node-sdk` version in a pack `package.json` is an editor hint
+  only: compile and runtime always use the SDK inside the installed Langflower.
+  After a Langflower upgrade every pack is recompiled; if the new SDK dropped
+  API the pack used, fix the pack source (errors in `COMPILATION_ERRORS.md`) —
+  do not edit the version range to "downgrade".
 - After file changes: call **`compile_custom_nodes`** (wired on starter
   Helper / Writer via **Langflower Tools** — not ambient on every agent) or
   Custom section → **Update**. Stop is not required for already-placed
@@ -93,6 +102,41 @@ fails `tsc` (`TS2835`). Either keep one-file nodes with no local imports
   user paths under `ctx.projectDir` and reject `..` escapes.
 - Do not register hanging processes (`start`, `dev`, `test:watch`) as tools.
 
+### Convert CLI / OpenCode `.mjs` tools
+
+**Wrong:** keep `tool.mjs` on disk and have `handler` spawn `node` on that
+file (`npx`, `execFile('node', [script])`, `__dirname`, `import.meta.url`,
+or a hardcoded path). `.mjs` is **not** a pack entry — only `*.ts` is
+compiled. That shape breaks when the pack is copied, published, or moved.
+
+**Right — port into the pack:**
+
+1. Map `process.argv` / stdin to `inputSchema`; stdout becomes the handler
+   return `string` (expected failures as text, not `throw`, except contract
+   like empty `ctx.projectDir`).
+2. Rewrite as TypeScript (`defineToolRegistrations`). Shared logic in
+   `lib/*.ts` with `from './lib/x.ts'` plus `allowImportingTsExtensions`
+   (copy hello-embed `tsconfig`).
+3. Resolve user paths under `ctx.projectDir`; reject `..` escapes. Do not
+   use the pack folder as cwd for project files.
+4. Do not leave the original `.mjs` as a runtime dependency of the node. If
+   the user still needs it for OpenCode, it may stay in the OpenCode tree
+   unused by Langflower.
+5. Call `compile_custom_nodes`. The bundled pack must run after a copy of
+   **only** the pack folder.
+
+**Exception — wrap project npm scripts as tools (prefer this over bash):**
+`handler` **may** spawn `npm run <script>` when the script exists on the
+**project root** `package.json` or a **monorepo workspace** `package.json`.
+Use an allowlisted **literal** script name (`shell: true` only for that
+literal; never splice user paths). `cwd` is that package directory under
+`ctx.projectDir`. Goal: expose finite, safe commands as `ToolHandle`s so the
+agent does not need bash. Do not register hanging scripts (`start`, `dev`,
+`test:watch`). Seed `review-gate.ts` wraps `npm run test` this way. `npm run`
+looks up the **project** (or workspace) `package.json`, not a sidecar next to
+the node — copying the custom-node pack does not break it. Host `git` via
+`child_process` is also OK (seed `git-diff-tool.ts`).
+
 ### QA / review gates (`defineReactiveNode`)
 
 - Exclusive ports: pass → emit on `ok`, silent `fail`; fail → emit on

package/vendor/server/skeleton/skills/langflower-workflow-writer/SKILL.md

@@ -15,14 +15,15 @@ You help the user **author valid Langflower workflow JSON** under
 
 - Use only **catalog** node `type` strings that exist in the project palette /
   common-nodes **or compiled custom packs**. Do **not** invent types (e.g.
-  there is no `common-hitl` — use `common-hitl-review-gate`).
+  there is no `common-hitl` — use `common-hitl-review-gate` or
+  `common-chat-loop`).
 - Use only **real port ids** from each node’s definition / `NODE.md`. Wrong
   ports are stripped on load (graceful repair) — inventing ports breaks the
   graph.
 - Identity is the **filename stem** (`my-flow.json` → `workflowId: my-flow`).
   Do not put `id` inside `metadata`.
 - Tool allowlists use plain builtin ids: `read`, `glob`, `grep`, `edit`,
-  `write`, `create`, `delete`, `bash` — never `Bash(ls)`-style strings.
+  `write`, `create`, `delete`, `move`, `bash` — never `Bash(ls)`-style strings.
 - LLM `rolePreset` values are only: `custom` | `plan` | `coder` | `explorer`.
   Unknown values silently become `custom`.
 - Recompile is opt-in: wire `common-langflower-tools` `tools` → agent
@@ -53,21 +54,23 @@ Schema: `.langflower/schemas/workflow.schema.json`. Samples:
 
 ## Ports you must get right
 
-| Node type                               | Key ports                                                                                                                                                                                                              |
-| --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `common-chat-input`                     | out `message` (no wireable in)                                                                                                                                                                                         |
-| `common-openai-llm` / `common-fake-llm` | in `userPrompt`, `systemPrompt`, `feedback`, `tools`; out `response`, `toolLog`, …                                                                                                                                     |
-| `common-mcp-stdio` / `common-mcp-http`  | out **`tools`** — wire into an agent `tools` port (not a separate `mcp` port). MCP http in **`headers`**: JSON object/string; `{lf_secrets:ID}` / `{env:VAR}` OK                                                       |
-| `common-tool-collection`                | in **`tools`** (multi combine) → out **`tools`** — optional hub; duplicate `toolId` last-wins. Direct pack → agent still OK                                                                                            |
-| `common-tool-invoke`                    | in **`tools`** (single) + **`toolId`** (string) + **`args`** (json, blank default) → out **`result`**. Graph-side `invoke`; unknown id / bad JSON → port error. Empty inventory stays inactive.                        |
-| `common-tool-inspect`                   | in **`tools`** (single) + **`toolId`** (string, empty = all) → out **`text`** — copy-paste dump + `inputSchema`. Not Preview (`common-preview` is string-only).                                                        |
-| `common-hitl-review-gate`               | in `result`; out `response`, `feedback`                                                                                                                                                                                |
-| `common-merge`                          | in/out **`value`** only (not `step` / `output`)                                                                                                                                                                        |
-| `common-review`                         | in `task`, `result`, `systemPrompt`, `tools`; out `response`, `feedback`                                                                                                                                               |
-| `common-sub-agent`                      | out **`subagent-registration`** (one specialist handle) → parent `tools`; in `systemPrompt`, `tools`                                                                                                                   |
-| `common-finish`                         | in `value`                                                                                                                                                                                                             |
-| `common-string`                         | in/out `value`                                                                                                                                                                                                         |
-| `common-langflower-tools`               | out **`tools`** only — wire into an agent `tools` port to opt in to **`compile_custom_nodes`** (unsafe; starter Helper / Writer already wired). Not ambient. Canvas add/remove node or edge tools are **not** shipped. |
+| Node type                               | Key ports                                                                                                                                                                                                                                            |
+| --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `common-chat-input`                     | out `message` (no wireable in)                                                                                                                                                                                                                       |
+| `common-openai-llm` / `common-fake-llm` | in `userPrompt`, `systemPrompt`, `feedback`, `tools`; out `response`, `toolLog`, …                                                                                                                                                                   |
+| `common-mcp-stdio` / `common-mcp-http`  | out **`tools`** — wire into an agent `tools` port (not a separate `mcp` port). MCP http in **`headers`**: JSON object/string; `{lf_secrets:ID}` / `{env:VAR}` OK                                                                                     |
+| `common-tool-collection`                | in **`tools`** (multi combine) → out **`tools`** — optional hub; duplicate `toolId` last-wins. Direct pack → agent still OK                                                                                                                          |
+| `common-tool-invoke`                    | in **`tools`** (single) + **`toolId`** (string) + **`args`** (json, blank default) → out **`result`**. Graph-side `invoke`; unknown id / bad JSON → port error. Empty inventory stays inactive.                                                      |
+| `common-tool-inspect`                   | in **`tools`** (single) + **`toolId`** (string, empty = all) → out **`text`** — copy-paste dump + `inputSchema`. Preview (`common-preview`) is separate: in **`input`** (dynamic) → out **`output`** (same value) and **`text`** (formatted string). |
+| `common-hitl-review-gate`               | in `result`; out `response`, `feedback` (no `preview`)                                                                                                                                                                                               |
+| `common-chat-loop`                      | in `result`; hidden HITL `message` (Send); out **`feedback`** only — wire to agent `feedback`. No Approve; run ends on Stop                                                                                                                          |
+| `common-merge`                          | in/out **`value`** only (not `step` / `output`)                                                                                                                                                                                                      |
+| `common-review`                         | in `task`, `result`, `systemPrompt`, `tools`; out `response` (accept), `feedback`                                                                                                                                                                    |
+| `common-critique`                       | in `assignment`, `packet`, `systemPrompt`, `tools`; out `response` (accept), `feedback`                                                                                                                                                              |
+| `common-sub-agent`                      | out **`subagent-registration`** (one specialist handle) → parent `tools`; in `systemPrompt`, `tools`                                                                                                                                                 |
+| `common-finish`                         | in `value`                                                                                                                                                                                                                                           |
+| `common-string`                         | in/out `value`                                                                                                                                                                                                                                       |
+| `common-langflower-tools`               | out **`tools`** only — wire into an agent `tools` port to opt in to **`compile_custom_nodes`** (unsafe; starter Helper / Writer already wired). Not ambient. Canvas add/remove node or edge tools are **not** shipped.                               |
 
 ## Soft↔Hard loops
 
@@ -80,6 +83,15 @@ Typical HITL revise loop:
 Do **not** feed Merge output into both gates and LLM feedback on every tick
 without a clear phase split.
 
+## One response is not a branch
+
+A path-choice output (`feedback`, or accept `response`) has one consumer.
+
+- Do not wire one LLM `response` to several next stages (clarify, red-team, and an approve gate). That node cannot choose a branch.
+- Do not wire one accept `response` to the next agent and also to later gates.
+- Use `common-critique` (`assignment` / `packet`) or `common-review` (`task` / `result`) so fail is `feedback` and pass is `response`. A Review Gate has the same split.
+- Copy `.langflower/workflows/red-team.json`. The same rule is in `docs/features/node-library.md` §5.2.
+
 ## Custom QA / review gates
 
 Custom exclusive-branch nodes (`defineReactiveNode`, seed `review-gate.ts`):

package/vendor/server/skeleton/workflows/advanced-coder.json

@@ -70,7 +70,18 @@
 					"rolePreset": "custom",
 					"providerId": "",
 					"model": "",
-					"enabledToolIds": ["read", "glob", "grep"],
+					"toolPermissions": {
+						"read": "allow",
+						"glob": "allow",
+						"grep": "allow",
+						"edit": "deny",
+						"write": "deny",
+						"create": "deny",
+						"delete": "deny",
+						"move": "deny",
+						"bash": "deny",
+						"ask_user": "deny"
+					},
 					"maxIterations": 6,
 					"maxFeedbackTurns": 0
 				},
@@ -139,7 +150,18 @@
 					"rolePreset": "custom",
 					"providerId": "",
 					"model": "",
-					"enabledToolIds": ["read", "glob", "grep", "bash"],
+					"toolPermissions": {
+						"read": "allow",
+						"glob": "allow",
+						"grep": "allow",
+						"edit": "deny",
+						"write": "deny",
+						"create": "deny",
+						"delete": "deny",
+						"move": "deny",
+						"bash": "ask",
+						"ask_user": "deny"
+					},
 					"maxIterations": 8,
 					"maxFeedbackTurns": 0
 				},

package/vendor/server/skeleton/workflows/kb-create.json

@@ -48,14 +48,18 @@
 					"rolePreset": "custom",
 					"providerId": "",
 					"model": "",
-					"enabledToolIds": [
-						"read",
-						"glob",
-						"grep",
-						"write",
-						"edit",
-						"create"
-					],
+					"toolPermissions": {
+						"read": "allow",
+						"glob": "allow",
+						"grep": "allow",
+						"edit": "allow",
+						"write": "allow",
+						"create": "allow",
+						"delete": "deny",
+						"move": "deny",
+						"bash": "deny",
+						"ask_user": "deny"
+					},
 					"maxIterations": 24,
 					"maxFeedbackTurns": 8
 				},
@@ -105,14 +109,18 @@
 					"rolePreset": "custom",
 					"providerId": "",
 					"model": "",
-					"enabledToolIds": [
-						"read",
-						"glob",
-						"grep",
-						"write",
-						"edit",
-						"create"
-					],
+					"toolPermissions": {
+						"read": "allow",
+						"glob": "allow",
+						"grep": "allow",
+						"edit": "allow",
+						"write": "allow",
+						"create": "allow",
+						"delete": "deny",
+						"move": "deny",
+						"bash": "deny",
+						"ask_user": "deny"
+					},
 					"maxIterations": 24,
 					"contextSize": 32768,
 					"compactOnError": false

package/vendor/server/skeleton/workflows/kb-manual-search.json

@@ -91,7 +91,7 @@
 				"fromNodeId": "search",
 				"fromPort": ["text", 0],
 				"toNodeId": "preview",
-				"toPort": ["text", 0]
+				"toPort": ["input", 0]
 			},
 			{
 				"edgeId": "e-search-done",

package/vendor/server/skeleton/workflows/kb-navigate.json

@@ -48,7 +48,18 @@
 					"rolePreset": "custom",
 					"providerId": "",
 					"model": "",
-					"enabledToolIds": ["read", "glob", "grep"],
+					"toolPermissions": {
+						"read": "allow",
+						"glob": "allow",
+						"grep": "allow",
+						"edit": "deny",
+						"write": "deny",
+						"create": "deny",
+						"delete": "deny",
+						"move": "deny",
+						"bash": "deny",
+						"ask_user": "deny"
+					},
 					"maxIterations": 12,
 					"maxFeedbackTurns": 6
 				},
@@ -73,7 +84,18 @@
 					"rolePreset": "custom",
 					"providerId": "",
 					"model": "",
-					"enabledToolIds": ["read"],
+					"toolPermissions": {
+						"read": "allow",
+						"glob": "deny",
+						"grep": "deny",
+						"edit": "deny",
+						"write": "deny",
+						"create": "deny",
+						"delete": "deny",
+						"move": "deny",
+						"bash": "deny",
+						"ask_user": "deny"
+					},
 					"maxIterations": 8,
 					"contextSize": 32768,
 					"compactOnError": false