feat(studio): integrate governed sources and workflow authoring

[2233admin]

Summary

• Integrate governed Source / SourceBinding APIs and Studio UI.
• Wire provider-neutral OIDC identity and the global Agent surface.
• Refine Dify/Houdini-style workflow authoring, outline, inspector, and node interactions.
• Project the complete OpenCLI capability catalog into addable workflow nodes instead of profile-gating or excluding write capabilities.

OpenCLI node projection

• 1,527 / 1,527 discovered OpenCLI capabilities materialize as canvas nodes.
• 727 are immediately runnable.
• 453 remain addable but execution-blocked until required parameters are configured.
• 347 remain addable but execution-blocked pending review.

Verification

• Frontend lint, typecheck, production build, node-capability and workflow regression suites passed.
• Backend full suite: 2,511 passed, 50 skipped.
• Coverage: 89.33% (80% threshold).
• Alembic online repair and PostgreSQL offline SQL rendering regression tests passed.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cbd69cf9-ae80-4e37-90c6-679bf7cfc409

📥 Commits

Reviewing files that changed from the base of the PR and between 97d2759 and 79d2662.

📒 Files selected for processing (72)

• .env.example
• CLAUDE.md
• DESIGN.md
• backend/api/v1/identity.py
• backend/api/v1/workflows.py
• backend/api/v1/workspaces.py
• backend/migrations/versions/g4h5i6j7k8l9_repair_plugin_installations_table.py
• backend/schemas/workflow.py
• backend/security/identity.py
• backend/workflow/capability_projection.py
• backend/workflow/opencli_adapter_nodes.py
• docs/backend-architecture-consolidated.md
• docs/backend-capability-exposure-matrix.yaml
• frontend/.env.example
• frontend/app/(app)/sources/page.tsx
• frontend/app/flow-canvas.css
• frontend/app/globals.css
• frontend/app/login/page.tsx
• frontend/components/auth/auth-provider.tsx
• frontend/components/flow/command-palette.tsx
• frontend/components/flow/command-strip.tsx
• frontend/components/flow/edges/editable-edge.tsx
• frontend/components/flow/edges/routed-edge.tsx
• frontend/components/flow/edges/workflow-edge.tsx
• frontend/components/flow/inspector-shell.tsx
• frontend/components/flow/inspector.tsx
• frontend/components/flow/node-context-menu.tsx
• frontend/components/flow/nodes/workflow-node.tsx
• frontend/components/flow/workflow-canvas-geometry.ts
• frontend/components/flow/workflow-canvas-interactions.ts
• frontend/components/flow/workflow-canvas-surface.tsx
• frontend/components/flow/workflow-editor-overlays.tsx
• frontend/components/flow/workflow-editor-selectors.ts
• frontend/components/flow/workflow-editor.tsx
• frontend/components/flow/workflow-keyboard-shortcuts.ts
• frontend/components/flow/workflow-node-menu-actions.ts
• frontend/components/shell/app-header.tsx
• frontend/components/shell/global-agent-dock.tsx
• frontend/lib/api/endpoints.ts
• frontend/lib/api/hooks.ts
• frontend/lib/api/types.ts
• frontend/lib/auth/oidc.ts
• frontend/lib/auth/types.ts
• frontend/lib/flow/graph.ts
• frontend/lib/flow/store-canonical-actions.ts
• frontend/lib/flow/store-layout-actions.ts
• frontend/lib/flow/store-slices.ts
• frontend/lib/flow/store.ts
• frontend/lib/workflow/backend-node-capability-adapter.ts
• frontend/lib/workflow/backend-opencli-adapter-nodes.ts
• frontend/lib/workflow/business-node-experience.ts
• frontend/lib/workflow/node-catalog.ts
• frontend/lib/workflow/node-contracts.ts
• frontend/lib/workflow/node-i18n.ts
• frontend/lib/workflow/node-menu.ts
• frontend/lib/workflow/parameter-interface.ts
• frontend/lib/workflow/use-opencli-adapter-catalog.ts
• frontend/lib/workflow/workflow-outline.ts
• frontend/next.config.mjs
• frontend/scripts/check-login-theme-regressions.mjs
• frontend/scripts/check-navigation-transition-regressions.mjs
• frontend/scripts/check-node-capability-catalog-regressions.mjs
• frontend/scripts/check-workflow-regressions.mjs
• frontend/scripts/check-workspace-source-regressions.mjs
• frontend/scripts/test-data-operator-nodes.mjs
• tests/integration/test_auth_api.py
• tests/integration/test_legacy_native_intelligence_migration.py
• tests/integration/test_legacy_plugin_migration.py
• tests/integration/test_workflow_capabilities_api.py
• tests/unit/api/test_workspaces.py
• tests/unit/security/test_identity.py
• tests/unit/test_migration_heads.py

---

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Added workspace- and project-scoped source binding management.
  • Expanded workflow node discovery with filters, readiness states, facets, typed connections, and node insertion on edges.
  • Added workflow outline and improved inspector dock controls, including resizing, pinning, and navigation.
  • Added multilingual workflow labels, parameters, and menu content.
  • Added OIDC profile details, provider discovery, and optional endpoint proxy support.
• Bug Fixes
  • Improved authentication fallback behavior and migration repair for missing installation data.
  • Enhanced workflow edge, parameter, and reconnection handling.
• Style
  • Refined canvas animations, connection states, accessibility, and reduced-motion behavior.

Walkthrough

The PR adds governed workspace/source-binding flows, expands OIDC identity and discovery handling, introduces OpenCLI adapter facets and readiness metadata, localizes workflow editing, and adds graph-aware connection, reconnection, and edge-insertion behavior with migration and regression coverage.

Changes

Workflow platform updates

Layer / File(s)	Summary
Identity, OIDC, and migration repair .env.example, frontend/.env.example, backend/security/identity.py, frontend/lib/auth/*, backend/migrations/versions/*	OIDC configuration, ID-token handling, profile claims, JWKS discovery, proxy routes, and conditional plugin-installation table repair are added.
Governance workspace and source bindings backend/api/v1/workspaces.py, frontend/app/(app)/sources/page.tsx, frontend/lib/api/*	Governed workspace/project endpoints and typed source-binding APIs power a workspace-scoped Sources page.
OpenCLI adapter catalog backend/workflow/opencli_adapter_nodes.py, backend/schemas/workflow.py, frontend/lib/workflow/backend-opencli-adapter-nodes.ts, frontend/components/flow/command-palette.tsx	Adapter presets expose readiness, materialization, filtering, search, grouping, and facet counts across backend and frontend catalog flows.
Localized inspector and parameter editing frontend/components/flow/inspector.tsx, frontend/lib/workflow/parameter-interface.ts, frontend/lib/workflow/node-i18n.ts, frontend/lib/workflow/workflow-outline.ts	Inspector modes, outline projection, bilingual copy, typed operator configuration fields, input binding edits, and localized source editors are added.
Canvas wiring and graph updates frontend/components/flow/workflow-editor.tsx, frontend/components/flow/workflow-canvas-surface.tsx, frontend/lib/flow/*, frontend/components/flow/workflow-canvas-interactions.ts	Connection picker sessions, typed compatibility checks, reconnection, edge insertion, canonical graph updates, grouped snapshots, and port context menus are wired into the canvas.
Supporting documentation and regression coverage DESIGN.md, CLAUDE.md, frontend/scripts/*, tests/integration/*, tests/unit/*	Design requirements, routing instructions, workflow regressions, catalog assertions, governance tests, identity tests, and migration expectations are updated.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

• 2233admin/opencli-admin#45: Adds the frontend governed workspace source and project-binding flows corresponding to the backend endpoints in this PR.

Poem

A rabbit hops through ports so neat,
With OIDC keys and nodes to meet.
Facets bloom, docks gently glow,
Bindings guide the sources’ flow.
“Hop!” says Bun, “the graph’s in tune!”

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}