fix(electron,web): run desktop backend outside production mode, keep save token fresh

The packaged desktop app launched its backend with NODETOOL_ENV=production
only to make the pack loader require an allowlist. The server treats
production as "hosted cloud" and disables local-only features the desktop
is built around: the Python bridge (every Python node failed with "Python
bridge is disabled in production"), the vector/RAG nodes, the file browser,
workspaces, MCP config, local model scanning, and the /mcp mount the
bundled Claude Desktop extension connects to. Give pack trust a dedicated
flag (NODETOOL_PACKS_REQUIRE_ALLOWLIST=1), set that from Electron instead,
and leave production mode to hosted deployments.

Also adopt the server's updated_at after a save that raced a user edit:
saveWorkflow kept the whole stale workflow object in that branch, so the
client's concurrency token never advanced past its own successful write and
every later save and autosave failed with an optimistic-concurrency
conflict.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ANBmpjQdGvEasgGZfbuyBs

Author: claude

docs/configuration.md

@@ -431,6 +431,7 @@ the run is a separate concern; see
 | `NODETOOL_ENABLE_FAKE_PROVIDER` | Register the `fake` provider id as a builtin, so a workflow can select it | no | `1` only, and ignored when `NODETOOL_ENV=production`. Separate from `NODETOOL_FAKE_PROVIDERS`, which fakes the providers that are already registered |
 | `NODETOOL_PACK_SEARCH_PATHS` | Extra `node_modules` directories to load node packs from | no | Comma-, semicolon-, or `PATH`-separator-delimited (`:` is not a separator on Windows, so drive letters survive). Paths that do not exist are dropped. Searched before the walk up from the working directory. See [Node Packs](node-packs.md) |
 | `NODETOOL_OPTIONAL_NODE_MODULES` | A single extra `node_modules` directory for pack loading | no | The one-path form of `NODETOOL_PACK_SEARCH_PATHS`; both are read, and the desktop app uses this to point the loader at its bundled install root |
+| `NODETOOL_PACKS_REQUIRE_ALLOWLIST` | Default `allowUnlisted` to false without production mode | no | `1` only. Same trust default `NODETOOL_ENV=production` gives, without disabling the local-only features production mode turns off. The packaged desktop app sets it — its optional-node directory holds user-installed code, but it needs the Python bridge, file browser, and the rest of the local surface. An explicit `allowUnlisted` in `packs.json` still wins |
 | `NODETOOL_CHAT_DETACH_GRACE_MS` | How long a running chat turn survives with no client attached | no | Default `600000` (10 minutes), then the turn is aborted so an abandoned client cannot leave an agent working forever. See [Chat turn replay](#chat-turn-replay) |
 | `NODETOOL_CHAT_REPLAY_RETENTION_MS` | How long a finished turn is kept for a late reconnect | no | Default `300000` (5 minutes) |
 | `NODETOOL_CHAT_REPLAY_BUFFER_EVENTS` | Frames buffered per turn for replay | no | Default `2000`. A client whose `last_seq` predates the buffer is told the replay is incomplete and refetches thread history over REST |

docs/developer/custom-nodes-guide.md

@@ -160,7 +160,7 @@ To avoid silently running whatever happens to be in `node_modules` in production
 - **Allowlist** — a list of trusted pack names; `"*"` allows everything. Set via:
   - The env var `NODETOOL_PACKS_ALLOWLIST` (comma-separated names), or
   - The `allow` field of `~/.config/nodetool/packs.json` (path overridable with the `NODETOOL_PACKS_CONFIG` env var).
-- **`allowUnlisted`** — whether packs not on the allowlist load anyway. Defaults to **`true` in development** (so installing a pack just works) and **`false` in production** (`NODETOOL_ENV=production`). Override via the config file.
+- **`allowUnlisted`** — whether packs not on the allowlist load anyway. Defaults to **`true` in development** (so installing a pack just works) and **`false`** when either `NODETOOL_ENV=production` or `NODETOOL_PACKS_REQUIRE_ALLOWLIST=1` is set. The packaged desktop app sets the latter — it needs the allowlist without production mode, which would disable local-only features. Override via the config file.
 
 Two further guards protect the registry regardless of trust:
 

electron/src/__tests__/server.spawn.test.ts

@@ -63,17 +63,21 @@ describe("backend utilityProcess spawn contract", () => {
       "STATIC_FOLDER",
       "NODETOOL_PYTHON",
       "NODE_ENV",
-      "NODETOOL_ENV",
+      "NODETOOL_PACKS_REQUIRE_ALLOWLIST",
       "NODE_OPTIONS",
       "NODE_PATH",
     ];
+    // NODETOOL_ENV must stay OUT of this shape: production mode disables
+    // local-only server features (Python bridge, file browser, vector nodes)
+    // that the desktop app depends on. Pack trust comes from the dedicated
+    // NODETOOL_PACKS_REQUIRE_ALLOWLIST flag instead.
     const backendEnv: Record<string, string> = {
       PORT: "7777",
       HOST: "127.0.0.1",
       STATIC_FOLDER: "/mock/web",
       NODETOOL_PYTHON: "",
       NODE_ENV: "production",
-      NODETOOL_ENV: "production",
+      NODETOOL_PACKS_REQUIRE_ALLOWLIST: "1",
       NODE_OPTIONS: "--conditions=nodetool-dev",
       NODE_PATH: "/mock/backend/node_modules",
     };
@@ -110,7 +114,7 @@ describe("backend utilityProcess spawn contract", () => {
           PORT: "7777",
           HOST: "127.0.0.1",
           NODE_ENV: "production",
-          NODETOOL_ENV: "production",
+          NODETOOL_PACKS_REQUIRE_ALLOWLIST: "1",
         }),
       }),
     );

electron/src/server.ts

@@ -307,13 +307,17 @@ async function startServer(): Promise<void> {
     NODETOOL_PYTHON: pythonPath,
     NODE_ENV: isDevMode() ? "development" : "production",
     // Electron's optional-node directory holds user-installed code in every
-    // build mode; host packs need an explicit allowlist even during app development.
-    NODETOOL_ENV: "production",
-    // The line above asks for the pack allowlist, not for the curated cloud
-    // catalog. Without an explicit profile, production alone would activate it
-    // and unregister every local and OAuth-backed provider — Ollama, LM Studio,
-    // llama.cpp, vLLM, and the Claude subscription — on the one surface where
-    // they are the point. Set `NODETOOL_NODE_PROFILE=cloud` to opt back in.
+    // build mode; host packs need an explicit allowlist even during app
+    // development. This dedicated flag asks for exactly that. The backend must
+    // NOT run with NODETOOL_ENV=production — the server treats production as
+    // "hosted cloud" and disables local-only features the desktop app is built
+    // around: the Python bridge, vector nodes, the file browser, workspaces,
+    // MCP config, and local model scanning.
+    NODETOOL_PACKS_REQUIRE_ALLOWLIST: "1",
+    // Keep the full node catalog and the local providers (Ollama, LM Studio,
+    // llama.cpp, vLLM, the Claude subscription) — the desktop app is the one
+    // surface where they are the point. Set `NODETOOL_NODE_PROFILE=cloud` in
+    // the launching environment to opt into the curated cloud catalog.
     NODETOOL_NODE_PROFILE: getProcessEnv()["NODETOOL_NODE_PROFILE"] ?? "full",
     NODE_OPTIONS: nodeOptionsParts.filter(Boolean).join(" "),
     NODE_PATH: backendNodePath,

packages/node-sdk/src/pack-loader.ts

@@ -267,9 +267,18 @@ export function resolvePackTrust(
   const allowlist =
     options.allowlist ?? envList ?? fromFile.allow ?? [];
 
+  // Unlisted packs are trusted by default only in development. Production
+  // servers (NODETOOL_ENV=production) and the packaged desktop app
+  // (NODETOOL_PACKS_REQUIRE_ALLOWLIST=1 — set by Electron, which must NOT run
+  // in production mode because that disables local-only features like the
+  // Python bridge and the file browser) both require an explicit allowlist.
   const isProd = process.env["NODETOOL_ENV"] === "production";
+  const requireAllowlist =
+    process.env["NODETOOL_PACKS_REQUIRE_ALLOWLIST"] === "1";
   const allowUnlisted =
-    options.allowUnlisted ?? fromFile.allowUnlisted ?? !isProd;
+    options.allowUnlisted ??
+    fromFile.allowUnlisted ??
+    !(isProd || requireAllowlist);
 
   return { allowlist, allowUnlisted };
 }

packages/node-sdk/tests/pack-loader.test.ts

@@ -68,6 +68,7 @@ beforeEach(() => {
   mkdirSync(nodeModules, { recursive: true });
   for (const key of [
     "NODETOOL_ENV",
+    "NODETOOL_PACKS_REQUIRE_ALLOWLIST",
     "NODETOOL_PACKS_ALLOWLIST",
     "NODETOOL_PACKS_CONFIG"
   ]) {
@@ -300,6 +301,14 @@ describe("trust / allowlist", () => {
     expect(resolvePackTrust().allowUnlisted).toBe(true);
   });
 
+  // The packaged desktop app must not run in production mode (that disables
+  // local-only features), so it requests the allowlist with this flag instead.
+  it("defaults to allowUnlisted=false when NODETOOL_PACKS_REQUIRE_ALLOWLIST=1", () => {
+    delete process.env["NODETOOL_ENV"];
+    process.env["NODETOOL_PACKS_REQUIRE_ALLOWLIST"] = "1";
+    expect(resolvePackTrust().allowUnlisted).toBe(false);
+  });
+
   it("reads the allowlist from NODETOOL_PACKS_ALLOWLIST", () => {
     process.env["NODETOOL_PACKS_ALLOWLIST"] = "@acme/a, @acme/b";
     expect(resolvePackTrust().allowlist).toEqual(["@acme/a", "@acme/b"]);

web/src/stores/WorkflowManagerStore.ts

@@ -393,6 +393,14 @@ export const createWorkflowManagerStore = (queryClient: QueryClient) => {
                 workflow: persistedWorkflow
               });
               nodeStore.getState().setWorkflowDirty(false);
+            } else {
+              // The save itself succeeded, so the server row now carries this
+              // response's updated_at. Adopt it as the concurrency token —
+              // keeping the old one makes every later save and autosave fail
+              // with an optimistic-concurrency conflict.
+              nodeStore
+                .getState()
+                .setWorkflowUpdatedAt(persistedWorkflow.updated_at);
             }
           }
 

web/src/stores/__tests__/WorkflowManagerStore.save.test.ts

@@ -22,15 +22,24 @@ jest.mock("../../trpc/client", () => ({
 
 jest.mock("../NodeStore", () => ({
   createNodeStore: (workflow: Workflow) =>
-    create((_set, get: () => { workflow: Workflow }) => ({
-      workflow,
-      nodes: [],
-      edges: [],
-      workflowIsDirty: false,
-      getWorkflow: () => get().workflow,
-      setWorkflowDirty: jest.fn(),
-      cleanup: jest.fn()
-    }))
+    create(
+      (
+        set: (fn: (state: { workflow: Workflow }) => object) => void,
+        get: () => { workflow: Workflow }
+      ) => ({
+        workflow,
+        nodes: [],
+        edges: [],
+        workflowIsDirty: false,
+        getWorkflow: () => get().workflow,
+        setWorkflowDirty: jest.fn(),
+        setWorkflowUpdatedAt: (updatedAt: string) =>
+          set((state) => ({
+            workflow: { ...state.workflow, updated_at: updatedAt }
+          })),
+        cleanup: jest.fn()
+      })
+    )
 }));
 
 jest.mock("../workflowUpdates", () => ({
@@ -110,6 +119,41 @@ describe("saveWorkflow first save", () => {
     expect(updateMutate.mock.calls[1][0].expected_updated_at).toBeUndefined();
   });
 
+  it("adopts the server revision even when the user edited during the save", async () => {
+    const store = createWorkflowManagerStore(new QueryClient());
+    const serverWorkflow: Workflow = {
+      id: "wf-edited",
+      name: "Existing",
+      description: "",
+      access: "private",
+      graph: { nodes: [], edges: [] },
+      created_at: "2026-08-01T00:00:00.000Z",
+      updated_at: "2026-08-02T00:00:00.000Z"
+    };
+    store.getState().addWorkflow(serverWorkflow);
+
+    const savedUpdatedAt = "2026-08-03T00:00:00.000Z";
+    const nodeStore = store.getState().getNodeStore("wf-edited");
+    // Simulate an edit landing while the save is in flight: the mutation
+    // replaces the edges array reference before resolving.
+    updateMutate.mockImplementation(async () => {
+      nodeStore?.setState({ edges: [] });
+      return { ...serverWorkflow, updated_at: savedUpdatedAt };
+    });
+
+    await store.getState().saveWorkflow(serverWorkflow);
+
+    // The edit survives, but the concurrency token moves to the server's new
+    // revision — otherwise every later save conflicts.
+    expect(nodeStore?.getState().workflow.updated_at).toBe(savedUpdatedAt);
+    await store
+      .getState()
+      .saveWorkflow(store.getState().getWorkflow("wf-edited") as Workflow);
+    expect(updateMutate.mock.calls[1][0].expected_updated_at).toBe(
+      savedUpdatedAt
+    );
+  });
+
   it("sends expected_updated_at for a workflow that came from the server", async () => {
     const store = createWorkflowManagerStore(new QueryClient());
     const serverWorkflow: Workflow = {