Add Dynamic Workflow: visual review, execution, and script repair

[hetaoBackend]

What changes

Add Dynamic Workflow 0.8.0 at plugins/hetaoBackend/mcode-dynamic-workflows: an English Skill, 11 local MCP tools, a bilingual visual dashboard, readable source, pinned development dependencies, and ready-to-run JavaScript/QuickJS WASM assets.

Users review and edit a workflow's topology before starting agents. If execution fails because the script needs correction, Edit & repair creates a new review draft, preserves the original run, and selectively reuses valid completed results. Runtime argument/input/file/dependency checks invalidate stale candidates; rerunning an upstream invalidates downstream reuse. Reused results retain provenance without duplicating calls or token accounting.

This public package ships portable plugin.json/mcp.json plus the .claude-plugin/plugin.json declaration. It contains no automatic CLI installer or private endpoints. The Skill explains manual prerequisites instead. No other plugin is changed. The repository CI setup now installs the Python/image dependencies needed by existing tests, and a dedicated workflow validates this plugin from source and checks bundle reproducibility.

Review fixes

• Hash tracked-file bytes without lossy UTF-8 decoding, retain special filenames, and bound reads to regular files up to 1 MB.
• Decode HTTP JSON streams across UTF-8 chunk boundaries.
• Recover every unfinished run, prioritize active/attention records in the recent list, and enforce a lifetime SQLite lock even if discovery metadata is lost.
• Isolate each node's JSON Schema namespace, including repeated identifiers and local references; enforce the false schema.
• Ignore stale dashboard selection/poll/action responses, and open historic run links even outside the list window.
• Replace the public-package diagnostic that referenced an absent installer.
• Stop owned CLI process groups/trees on cancellation, timeout and protocol failure; retain escalation after the leader exits, bound inherited-pipe shutdown, and require explicit stopped-agent confirmation when cleanup is uncertain.

Controlled browser tests cover reordered selection, stale error, polling and pause responses, plus historic links. New source regressions fail on the original implementation and pass after the fixes.

The cancellation probe originally reproduced a descendant continuing to write after its CLI root was terminated. The fix now passes controlled real-process tests for ordinary descendants, inherited pipes, SIGTERM resistance after parent exit, protocol failure and timeout. An unrelated sibling remains alive. MCODE_CLEANUP_UNCONFIRMED now results in needs_attention, preventing unconfirmed resume/repair. Explicitly detached daemons and remote jobs are outside local process ownership and are disallowed by the Skill.

User value

Example prompt:

Use dynamic-workflow to create a demo with two parallel research branches and a synthesis step. Open its dashboard so I can review the topology before starting.

Expected result: a pending-review topology opens in the built-in browser when supported; the user can edit and click Start execution. Demo mode makes no model calls. A later prompt can diagnose an error and produce a reviewed repair while preserving valid completed work.

Features include pause/resume/cancel, configurable step/concurrency/timeout budgets, detailed failures and raw structured outputs, canonical project binding, persistent local history/ports, and HTML/Markdown reports.

Dependencies and data flow

• Runtime: Node 22.19+ (22.x) or Node 24–26. JavaScript dependencies and portable WebAssembly are committed; installing/using the plugin requires no npm download. No OS-native executable is bundled.
• Real agents: an existing compatible MCode CLI with the user's authentication/provider configuration and quota. Calls may incur provider charges. macOS is locally tested; real Windows/Linux host installation and account execution remain unverified.
• The local HTTP service binds to 127.0.0.1 and uses same-origin/header checks. It is not protected against other local processes and must not be forwarded publicly.
• Project-specific SQLite state includes inputs, scripts, prompts, raw outputs, errors, usage and result snapshots under the user's local data directory. Approved work survives chat disconnects. No telemetry or automatic software installation.
• Real agents use the user's configured providers/tools and smart permissions; task materials may reach those destinations and agents can modify files. QuickJS isolates orchestration, not the spawned agents. Undeclared dependencies, untracked files, external evidence and side effects require judgment before selecting cached results.

Plugin submission checklist

• Plugin lives at plugins/<github-owner>/<plugin-name>.
• plugin.json name matches the Plugin directory.
• README includes example prompts and expected results.
• LICENSE and manifests declare Apache-2.0; bundled licenses are retained.
• Dependencies, paid services, platforms and permissions are disclosed.
• Network destinations and stored data are disclosed.
• No credentials, private endpoints, telemetry, installers, symlinks or native binaries are included.
• No scaffold placeholders remain.
• npm run check passes.

Evidence

Head 08c928a passed every applicable check: shared Ubuntu CI, source/build/package reproducibility, real Windows process-lifecycle checks and CodeQL. Codesmith was skipped. No pending review comments or requested changes remained at the merge audit.

CI evidence: shared CI, plugin Ubuntu and Windows, CodeQL.

• Repository npm run check: 27 hosted plugins validated; 490 tests, 470 passed / 20 skipped / 0 failed.
• Isolated public-registry dependency installation and rebuild: successful. Five runtime/browser assets match the committed files byte-for-byte.
• Plugin source suite: 72 passed. Includes review/version guards, repair persistence, invalidation propagation, independent branches, checkpoint recomputation, schemas/raw output, workspaces/cwd and lifecycle/port behavior.
• Dependency-free packaged MCP smoke: passes from both committed and rebuilt bundles. Exercises draft -> approval -> failed script -> repair draft -> approval -> success with zero new agent calls, keeping the original failed run intact. The test is included in the repository gate.
• Dashboard 0.8.0 acceptance covers Chinese/English, 390px layout, repair edits, upstream deselection and downstream reruns, and provenance. Public dashboard assets are identical.

The new clean-install gate also found stale lockfile metadata: three tarball URLs referred to versions absent from the public registry. The lockfile was regenerated from public metadata and verified with an empty npm cache. Rebuilding produces byte-identical runtime assets and licenses.

The original Ubuntu failure came from two existing octopus-meme-maker argument-validation tests importing missing Pillow. CI now installs pinned Pillow and a CJK font without skipping those checks.

The 13 CodeQL findings were reviewed by exact alert ID: Marked tokenizer patterns were mistaken for HTML sanitizers, unexpanded brackets regex templates were mistaken for executed regexes, and Node-only Zod function generation was mistaken for an HTML script context. SECURITY_REVIEW.md records the reasoning and three regression checks exercise those boundaries. CodeQL queries and scanned paths are unchanged; the reviewed findings are classified individually as false positives.

One subsequent shared Ubuntu run failed in the unchanged cli-agent-bridge test pull makes commit attribution explicitly unavailable: the backend exited 0, but process-tree termination could not be confirmed after SIGKILL (run 35246305401, attempt 1). The preceding Ubuntu run and a focused macOS invocation passed this same test; the local result does not verify Linux process cleanup. The single rerun passed: attempt 2. No bridge code or assertion was weakened, and this successful rerun does not establish that its intermittent process-cleanup issue is fixed.

A later shared CI failure at head ef71f16 came from the unchanged bridge test direct tag writes do not hide worker-created commits, with the same unconfirmed-tree-termination diagnostic (run 35250215524). No other plugin was modified or its gate skipped.

No paid model calls, user research reruns, or new real Desktop plugin-loader acceptance test were performed. Details and limitations are in the plugin's VERIFICATION.md.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}