Melvin StroblandClaude Fable 5
8d82d6c4ec
Playwright Tests / test-playwright (1, 2) (push) Canceled after 0s
Playwright Tests / test-playwright (2, 2) (push) Canceled after 0s
pre-commit / pre-commit (push) Canceled after 0s
Test Backend / test-backend (push) Canceled after 0s
Compose Smoke Test / test-compose (push) Canceled after 0s
Playwright Tests / merge-reports (push) Canceled after 0s
The engine now speaks MCP at /mcp, with a built-in OAuth 2.1 authorization server in front of it: an agent registers itself, sends a human to the browser to approve it, and exchanges the resulting code for a token. PKCE is required, codes are single-use and stored only as hashes, the browser is redirected to the URI that was registered rather than the one asked for, and refresh tokens rotate so that replaying a spent one revokes the whole line. Twenty tools cover reading, building, publishing and running flows, and each one calls the same REST endpoint the dashboard calls, in-process, carrying the caller's own token. That keeps one description of what a flow is and what may be done to it — validation, the draft/publish split, the version check — and means an agent can do nothing a person could not do in the browser. Agent tokens are RS256 with a keypair of their own rather than the secret that signs browser sessions, so deleting the key withdraws every agent without logging anyone out, and deps.decode_token grew the branch that trusting a second issuer will need when the hosted login arrives. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
85 lines
6.3 KiB
Markdown
85 lines
6.3 KiB
Markdown
This file captures tasks which derive from roadmap tasks (unfinished, deferred), bugs encountered during usage and feature requests/improvements which are not fitting directly in the roadmap.
|
|
Always sort by priority and put tasks blocked by other tasks/features at the dedicated section.
|
|
When working on a task, check for other, similar tasks that could be resolved on the way.
|
|
Use following pattern to classify tasks: TYPE/SCOPE
|
|
Where TYPE could be BUG, FEAT, PERF, CHORE and SCOPE could be UX, UI, FLOW, NODE, API, INFRA, DOCS appended by MOBILE if only for mobile use case.
|
|
Don't write temporary reasons for deferring a task in the task description (only strategical reasons should be noted).
|
|
Deferring because out of scope is fine, but don't mention deferring than.
|
|
|
|
## Open
|
|
|
|
- BUG/UI: enlarge the icon in the sidebar slightly
|
|
- BUG/UI: clicking outside the panel does not discard the flow edit panel
|
|
- BUG/UI: the graph showed in the node edit panel should also be shown for a specific edge inside the pop-up panel when clicking the edge
|
|
- FEAT/FLOW: single-stepping a paused flow. Pause and resume are in; a step button needs the
|
|
scheduler to keep its per-run progress between calls, which the one-shot executor does not —
|
|
without that it re-runs the first ready node instead of advancing. Needs a persistent
|
|
per-flow work queue that a step pops from and resume drains.
|
|
- FEAT/UI: interrupting a node that is already running. Pause holds nodes that have not been
|
|
submitted yet; one already executing runs to completion.
|
|
- BUG/UI: the enlarged panel (for code editing) should still maintain its floating style
|
|
- BUG/UI: `SidePanel`'s mobile branch does not set `data-testid` on the `SheetContent`, so
|
|
`[data-testid=node-panel]` does not exist on a phone. Mobile specs cannot address the panel.
|
|
- CHORE/API: node source saves carry no version precondition, so two clients editing the same
|
|
node's code are last-writer-wins. The flow document is what the optimistic lock protects;
|
|
code files would need their own, and an exact-match one produces false conflicts against a
|
|
single client's own interleaved flow and source saves.
|
|
- FEAT/UI: publishing and discarding are only reachable while no side panel is open, since the
|
|
floating chrome hides for the panel. Editing a node's code and publishing it is therefore
|
|
close-panel-then-publish.
|
|
- FEAT/UI: no screen for the OAuth clients an agent registers. They can only be listed or
|
|
removed in the database, so withdrawing one agent's access means deleting its rows or
|
|
rotating `OAUTH_PRIVATE_KEY_FILE`, which cuts off all of them.
|
|
- CHORE/INFRA: `requires-python` is capped below 3.14 because the MCP SDK wants a newer
|
|
starlette there than the pinned `sentry-sdk<2` allows. Lift the cap when sentry-sdk moves
|
|
to 2.x.
|
|
- FEAT/UI: there is no screen for managing the secrets store itself. A node parameter marked
|
|
`x-secret` offers the stored secrets, but they can only be created through the API.
|
|
- FEAT/FLOW: input discretization drops the trailing edge — if a producer goes quiet inside
|
|
the window, the consumer never sees the last value. Delivering it at the end of the window
|
|
needs a timer per (node, port).
|
|
- CHORE/FLOW: shared node sources bypass the draft/publish split. Editing one writes the
|
|
library copy and reloads immediately, since the code is not any single flow's to hold back.
|
|
Deliberate, but it means a shared node is the one thing publish does not gate.
|
|
- FEAT/UI: flow-level edits (title, inputs) go through `FlowPanel.onChange` and stay outside
|
|
the undo stack.
|
|
- CHORE/UI: `make test-backend` cannot reach Postgres while the integrated stack is up —
|
|
`compose.local.yml` does `db: ports: !reset []`. Run it against the container's address, or
|
|
move the suite inside the compose network.
|
|
- BUG/FLOW: deleting a flow leaves its state in Redis — the value, timestamp, version and
|
|
history keys under `pipeline:{flow}.*` all survive. Clear the namespace on delete.
|
|
- CHORE/UI: the Playwright specs run against the development stack and leave their users and
|
|
flows behind, which is why the flowbar filled with `test_flow_*`. Give them their own data
|
|
or clean up after themselves, as `pytest` now does.
|
|
- CHORE/UI: the standalone Vite origin (`make dev-frontend` on :5173) is still not in
|
|
`BACKEND_CORS_ORIGINS`. `scripts/setup.sh` regenerates the list on every `make init` and
|
|
`compose.local.yml` re-declares it as a container variable that wins, so the origin has to
|
|
be added in both places to work.
|
|
- CHORE/INFRA: `test-backend.yml` runs pytest on the runner host, so it keeps the fixed
|
|
container name and port 5432 that `compose.ci.yml` resets everywhere else. Two concurrent
|
|
runs of that one job collide.
|
|
- PERF/UI: (deferred for now) the Monaco chunk is 2.6 MB. It only loads when a node panel opens, but the
|
|
editor could be trimmed further or swapped for CodeMirror if that becomes a problem.
|
|
- CHORE/FLOW: `app/flow/nodes.py` is excluded from strict mypy (`[[tool.mypy.overrides]]` in
|
|
`pyproject.toml`). The node classes still carry prototype typing, `croniter` ships no stubs
|
|
and `influxdb_client` does not re-export its names. Shrink it as each integration is revisited.
|
|
- PERF/FLOW: every save rebuilds the whole pipeline. Fine at the current flow count; rebuild
|
|
only the touched flow when it starts to show.
|
|
- FEAT/UI: reintroduce `--chart-*` tokens as one designed sequential scale when the first
|
|
chart lands. The node sparkline draws one series in `--primary` and needs none.
|
|
- PERF/UI: the app's entry chunk is 680 kB (210 kB gzipped) and exceeds the warning
|
|
threshold. React Flow and Monaco are already lazy; a manualChunks split measured no better,
|
|
so this needs route-level work on the shell rather than chunking config.
|
|
|
|
## Blocked
|
|
|
|
- FEAT/UI: a "Bug" icon on the node error bubble opening the logs panel at that node's
|
|
traceback. The panel now has the traceback; wiring the bubble to open and filter it needs
|
|
the panel's open state lifted into `FlowEditor`.
|
|
- FEAT/INFRA: MQTT broker and InfluxDB compose services for local development. The node types
|
|
exist; a local broker would make them testable without external hardware.
|
|
- CHORE/INFRA: `bun install` inside the frontend Docker build intermittently fails with
|
|
"Fail extracting tarball" for several packages at once, and succeeds on a plain rebuild.
|
|
It looks like concurrent extraction under memory pressure. Pin down or retry in the
|
|
Dockerfile if it starts costing CI time.
|