Struct FlowApp 

pub struct FlowApp { /* private fields */ }

Implementations

impl FlowApp

pub fn new() -> Self

pub fn with_store_and_settings(store: Store, settings: SettingsStore) -> Self

pub fn with_workspace_base(self, base: WorkspaceBase) -> Self

Override the edition default workspace. flow-cli calls this with Fixed(<launch dir or --workspace>); desktop/server keep Scratch.

pub fn flow_workspace(&self, flow_id: &str) -> Option<String>

The per-flow workspace override, or None when the flow uses the default.

pub fn default_workspace(&self, flow_id: &str) -> String

The default workspace this host would use for flow_id absent an override - surfaced to the UI so it can show the resolved path.

pub fn set_flow_workspace( &self, flow_id: &str, path: &str, ) -> Result<(), AppError>

pub fn clear_flow_workspace(&self, flow_id: &str) -> Result<(), AppError>

pub fn set_stream_sink(&self, sink: Arc<dyn LlmStreamSink>)

Install the LLM token sink for streaming events. The host (Tauri) wires a sink that re-emits each delta as a flow:llm_token Tauri event so the header chip can render the rolling tail; headless callers can keep the default NullStreamSink. Safe to call at any time from any thread.

pub fn stream_sink(&self) -> Arc<dyn LlmStreamSink>

Snapshot the current sink so callers can hold a reference for the duration of an LLM call without blocking concurrent sink swaps.

pub fn list_connections(&self) -> Vec<ConnectionProfile>

pub fn save_connection( &self, profile: ConnectionProfile, secret: Option<&str>, ) -> Result<(), AppError>

pub fn delete_connection(&self, id: &str) -> Result<(), AppError>

pub fn connection_has_secret(&self, id: &str) -> bool

pub fn resolve_zowe_connection( &self, id: &str, ) -> Result<ResolvedZoweConnection, AppError>

pub fn set_cloud_ai_key( &self, provider: &str, secret: &str, ) -> Result<(), AppError>

pub fn delete_cloud_ai_key(&self, provider: &str) -> Result<(), AppError>

pub fn cloud_ai_key_exists(&self, provider: &str) -> bool

pub fn set_service_secret( &self, slug: &str, secret: &str, ) -> Result<(), AppError>

Store a raw connection secret (api-key / bearer token / user:pass) for a service node, keyed by its catalog slug.

pub fn disconnect_service(&self, slug: &str) -> Result<(), AppError>

Forget a service connection (token/secret + any OAuth client credentials).

pub fn service_connection_exists(&self, slug: &str) -> bool

True when a connection secret/token is stored for the service.

pub fn set_service_oauth_client( &self, slug: &str, client_id: &str, client_secret: &str, ) -> Result<(), AppError>

Persist the operator-supplied OAuth2 client id + secret for a service.

pub fn service_oauth_authorize_url( &self, slug: &str, redirect_uri: &str, state: &str, ) -> Result<String, AppError>

Build the OAuth2 consent URL the user opens to authorize a service. redirect_uri is the loopback the desktop app captures the code on.

pub async fn service_oauth_complete( &self, slug: &str, code: &str, redirect_uri: &str, ) -> Result<(), AppError>

Exchange an OAuth2 authorization code and persist the token bundle.

pub fn llms_dir() -> PathBuf

Where downloaded LLMs live: <flow_dir()>/llms/. The managed llama-server loads models from here.

pub fn engines_dir() -> PathBuf

Where the managed model-server engine is fetched on first use: <flow_dir()>/engines/. Shared by every edition on this host.

pub fn downloads_dir() -> PathBuf

Where the utility:download action writes artifacts: <flow_dir()>/downloads/. Created lazily on first access.

pub fn nodes_dir() -> PathBuf

Where third-party node schemes installed via the Node Hub live: <flow_dir()>/nodes/<slug>.json. Created lazily.

pub fn hub_catalog(&self) -> Vec<HubModel>

The Model Hub catalog (the static registry loaded from hub_catalog.json).

pub fn system_info(&self) -> SystemInfo

Probe this machine for the device-compatibility check: OS/arch, total + available RAM, and free disk on the volume holding the LLMs directory.

pub fn list_local_llms(&self) -> Vec<LocalLlm>

LLMs already downloaded into the local LLMs directory.

pub async fn hub_installed(&self) -> Vec<InstalledModel>

Installed models: downloaded LLMs matched to a catalog model whose download-option URL produces that file name.

pub async fn download_hub_model( &self, id: &str, variant: Option<&str>, cb: Option<ProgressCallback>, ) -> Result<PathBuf, AppError>

Download a catalog model’s variant into the local LLMs directory, reporting progress through cb. Returns the on-disk path.

pub fn cancel_download(&self)

Request cancellation of the in-flight Hub download (if any). The streaming loop in hub::download notices on its next chunk, removes the partial file, and returns a “download cancelled” error.

pub fn delete_local_llm(&self, file_name: &str) -> Result<(), AppError>

Delete a downloaded LLM from the local LLMs directory (confined to it).

pub fn list_templates(&self) -> Result<Vec<TemplateRecord>, AppError>

pub fn list_templates_in( &self, collection_slug: &str, ) -> Result<Vec<TemplateRecord>, AppError>

pub fn save_template( &self, name: &str, graph: FlowGraph, ) -> Result<TemplateRecord, AppError>

pub fn save_template_in( &self, name: &str, graph: FlowGraph, collection_slug: &str, source: Option<TemplateSource>, ) -> Result<TemplateRecord, AppError>

pub fn load_template(&self, slug: &str) -> Result<FlowGraph, AppError>

pub fn delete_template(&self, slug: &str) -> Result<(), AppError>

pub fn list_schedules(&self) -> Result<Vec<ScheduleRecord>, AppError>

Every persisted flow schedule (roadmap E11), newest-updated first.

pub fn get_schedule( &self, template_slug: &str, ) -> Result<Option<ScheduleRecord>, AppError>

The schedule for a saved flow, if one exists.

pub fn upsert_schedule( &self, patch: SchedulePatch, ) -> Result<ScheduleRecord, AppError>

Create or update a flow’s schedule. Validates the frequency, computes the next fire time from the anchor (when enabled), and preserves created_at / last_run_at across updates.

pub fn preview_schedule( &self, req: SchedulePreviewRequest, ) -> Result<Vec<DateTime<Utc>>, AppError>

pub fn delete_schedule(&self, template_slug: &str) -> Result<(), AppError>

pub fn set_schedule_enabled( &self, template_slug: &str, enabled: bool, ) -> Result<Option<ScheduleRecord>, AppError>

pub fn migrate_schedule( &self, old_slug: &str, new_slug: &str, collection_slug: &str, flow_name: &str, ) -> Result<(), AppError>

pub fn due_schedules(&self) -> Result<Vec<ScheduleRecord>, AppError>

Enabled schedules due to fire now - the background scheduler’s per-tick work list.

pub async fn run_scheduled( &self, schedule: &ScheduleRecord, ) -> Result<Option<ExecutionSummary>, AppError>

Fire a scheduled flow: advance its timer first (so an overlapping tick won’t double-fire), load the saved template, and run it under a fresh execution id with the run persisted to history (metadata only - the zero-egress boundary is preserved). Returns the run summary.

pub async fn run_due_schedule( &self, schedule: &ScheduleRecord, ) -> Result<Vec<ExecutionSummary>, AppError>

Fire one due schedule, honoring its catch-up policy. run-all may produce multiple summaries when several fire times were missed while the process was down; other policies produce zero or one.

pub fn list_template_collections( &self, ) -> Result<Vec<TemplateCollectionRecord>, AppError>

pub fn create_template_collection( &self, name: &str, ) -> Result<TemplateCollectionRecord, AppError>

Insert a new user collection from a display name. Slug is derived server-side via the same slugify rule as templates. Refuses on empty-after-slugify and on slug collision (idempotent re-creation callers should branch on the returned AppError::Template text).

pub fn ensure_template_collection( &self, name: &str, ) -> Result<TemplateCollectionRecord, AppError>

Idempotent get-or-create: returns the existing collection if a row already exists for the slugified name, otherwise inserts a new one. Used by the Ansible-collection importer (step 6) so re-importing the same tarball reuses the same collection row instead of failing on the slug-collision check in Self::create_template_collection.

pub fn rename_template_collection( &self, slug: &str, new_name: &str, ) -> Result<TemplateCollectionRecord, AppError>

pub fn delete_template_collection(&self, slug: &str) -> Result<(), AppError>

pub fn list_template_hub(&self) -> Vec<TemplateHubEntry>

Browse the Template Hub catalog (downloadable flow templates).

pub fn list_template_hub_with_status( &self, ) -> Result<Vec<TemplateHubEntryWithStatus>, AppError>

Same as Self::list_template_hub but annotated with where each entry is installed locally + whether the catalog ships a newer version than what the user has on disk. Used by the Hub UI to render the “Installed in ” indicator and the “Update available” pill.

pub fn add_hub_template( &self, hub_slug: &str, collection_slug: &str, ) -> Result<TemplateRecord, AppError>

Install a Hub catalog entry into the user-chosen collection. Refuses if a template with the catalog slug already exists locally (re-add must go through Self::update_hub_template).

pub fn update_hub_template( &self, hub_slug: &str, force: bool, ) -> Result<TemplateRecord, AppError>

Overwrite an installed Hub template in place with the catalog’s current graph + version. When force is false and the user has edited the file since install, the call refuses so the frontend can confirm before clobbering local edits.

pub fn list_node_catalog(&self) -> Vec<NodeCatalogEntry>

Browse the Node Hub catalog. Sorted by sortKey then slug.

pub fn list_node_catalog_with_status( &self, ) -> Result<Vec<NodeCatalogEntryWithStatus>, AppError>

Same as Self::list_node_catalog but annotated with install status (which entries are present in node_library and whether the catalog ships a newer version).

pub fn list_installed_nodes(&self) -> Result<Vec<NodeCatalogEntry>, AppError>

Runtime view: every installed kind’s full scheme, read from disk. This is what the canvas, palette, factory, inspector, and renderer consume - the embedded catalog only participates in installation.

pub fn add_node_to_library( &self, slug: &str, ) -> Result<NodeLibraryRow, AppError>

Install a catalog entry into the user library. Refuses on slug collision (use Self::update_installed_node to overwrite).

pub fn update_installed_node( &self, slug: &str, force: bool, ) -> Result<NodeLibraryRow, AppError>

Overwrite an installed scheme with the catalog’s current version and bump node_library.version.

pub fn uninstall_node(&self, slug: &str) -> Result<(), AppError>

Remove an installed scheme from disk and the node_library row.

pub fn get_node_catalog_entry( &self, slug: &str, ) -> Result<NodeCatalogEntry, AppError>

Resolve a catalog entry by slug. Prefers the on-disk installed scheme so user edits round-trip; falls back to the embedded catalog (the operator-supplied default seed data).

pub fn import_dsl(&self, source: &str) -> Result<FlowGraph, AppError>

Parse a DSL document into a FlowGraph. Positions in the result are always (0.0, 0.0) - callers (the desktop UI) run an auto-layout pass before mounting on the canvas.

pub fn serialize_dsl(&self, graph: &FlowGraph) -> String

Serialize a FlowGraph to canonical DSL text.

pub fn settings(&self) -> Settings

pub fn update_settings( &self, patch: SettingsPatch, ) -> Result<Settings, AppError>

pub fn list_cloud_providers(&self) -> Vec<ProviderInfo>

pub fn detect_llama_server() -> Option<String>

Best-effort discovery of a llama-server (llama.cpp) executable so the user usually doesn’t have to pick it manually. Checks $PATH then a few common install locations (Homebrew, /usr/local, /usr/bin).

pub fn llama_server_path(&self) -> Option<String>

Resolve the llama-server binary the Hub would use: a previously-fetched managed engine, else the saved setting, else an auto-detected one. None means none is present yet (Load will fetch one).

A saved setting that points at a now-missing file (e.g. an old build path that was cleaned away) is ignored so resolution falls through to a managed engine / $PATH instead of returning a dead path.

pub async fn ensure_llama_engine( &self, progress: Option<ProgressCallback>, ) -> Result<PathBuf, AppError>

Ensure a managed engine is present under engines_dir(), fetching it on first use. Fetch progress is mapped onto the shared InstallProgress pipeline (stage: "engine") so callers surface it exactly like a hub model download.

pub async fn start_local_llm( &self, binary: Option<String>, model: Option<String>, params: LlamaParams, ) -> Result<LlmServerStatus, AppError>

Start the managed local LLM server (llama-server) for the given binary + model, falling back to the saved setting then auto-detection when omitted. On success: persist the paths, point local_ai_base_url at the managed endpoint, and enable local AI - so the existing local provider, flow-graph generator, and agent immediately use it.

pub async fn stop_local_llm(&self) -> LlmServerStatus

Stop the managed local LLM server (idempotent). Clears the managed wiring (local_ai_base_url + discovered models) so the local provider, flow-graph generator, and agent don’t keep calling a now-dead port.

pub fn local_llm_status(&self) -> LlmServerStatus

Status snapshot of the managed local LLM server.

pub fn store(&self) -> &Store

pub fn list_executions( &self, limit: usize, ) -> Result<Vec<ExecutionRecord>, AppError>

pub fn get_execution( &self, execution_id: &str, ) -> Result<Option<(ExecutionRecord, Vec<ExecutionStepRecord>, Vec<InterceptionRecord>)>, AppError>

pub fn record_interception( &self, execution_id: String, failed_node: String, issue: Option<String>, summary: String, dsl_before: Option<String>, dsl_after: Option<String>, ) -> Result<(), AppError>

Record a monitor interception (auto-fix) against a run, so the History view can show what was changed/added beyond the per-node steps.

pub async fn execute_graph( &self, graph: FlowGraph, events: Arc<dyn EventSink>, ) -> Result<ExecutionSummary, AppError>

pub async fn execute_graph_with_id( &self, execution_id: String, graph: FlowGraph, events: Arc<dyn EventSink>, ) -> Result<ExecutionSummary, AppError>

Run graph under a caller-supplied execution id. A fresh per-run flow_execution::RunControl is registered under that id for the lifetime of the run (so FlowApp::pause_run / [resume_run] / [cancel_run] can target this run while others keep running) and removed on completion. The host generates the id up front so it can map the run to the originating tab/flow before the Started event is observed.

pub async fn run_agent_turn( &self, execution_id: String, graph: FlowGraph, events: Arc<dyn EventSink>, ) -> Result<AgentTurn, AppError>

Run one coding-agent turn as a flow. Same executor path as [execute_graph_with_id] - events stream and the run is steerable (pause/resume/cancel) under execution_id - but filesystem mutations are staged (computed, not written). Returns the run summary plus the proposed edits for the IDE to review and apply.

pub fn pause_run(&self, execution_id: &str)

Request a pause of the run with execution_id. Honored at the next node boundary; an in-flight node finishes first. No-op if no such run.

pub fn resume_run(&self, execution_id: &str)

Release the paused run with execution_id so scheduling continues.

pub fn resolve_ai_review(&self, execution_id: &str, approved: bool)

Resolve the AI review gate of the run with execution_id: record the human verdict and release the pause (RAO human authority). Approve passes the contract-bound output downstream; reject fails the node onto its fallback path. No-op if no such run.

pub fn pause_all_runs(&self)

Pause every active run. Convenience for headless runners (CLI / TUI) that only ever drive a single run and don’t track its id.

pub fn resume_all_runs(&self)

Resume every paused run. Companion to FlowApp::pause_all_runs.

pub fn disable_confirmation_gate(&self)

Force the per-step destructive-action confirmation gate off for this instance. Headless runners (CLI / TUI) call this at startup: they have no confirmation UI, so a destructive node would otherwise block the run forever waiting on a confirm that can’t arrive.

pub fn cancel_run(&self, execution_id: &str)

Cancel the run with execution_id. The current node finishes, remaining nodes are skipped, and the run ends with cancelled status. No-op if no such run.

pub fn cancel_all_runs(&self)

Cancel every active run. Used by headless runners (CLI / TUI) which only ever have a single run and don’t track its id, and as a stop-all signal.

pub fn clear_working_memory(&self)

Clear session working memory. Call when starting a fresh agent session so {{memory.<key>}} doesn’t leak values from a prior, unrelated run.

pub fn verify_flow(&self, dsl: &str) -> Vec<FlowWarning>

Static pre-apply verification of a proposed flow’s DSL: returns advisories (destructive operations, possible sandbox escapes) for the review + interception modals. Best-effort - DSL that fails to parse yields no warnings (the caller surfaces the parse error separately).

pub async fn generate_dsl_via_cloud( &self, provider: &str, model: &str, prompt: &str, max_tokens: Option<u32>, temperature: Option<f32>, ) -> Result<String, AppError>

Generate Flow DSL via a cloud AI provider (Claude / OpenAI / Gemini) or the local LLM server. Pick a model, hit Generate, and the frontend gets a parse-validated DSL string back regardless of source.

The flow-graph-generator system prompt is shipped via each provider’s native system channel (Anthropic top-level system, OpenAI system-role message, Gemini system_instruction) rather than concatenated into the user message. The PII sanitizer is intentionally bypassed: filenames and dataset names need to reach the model verbatim so the generated DSL refers to the right artifacts.

Parse validation with one retry. The first response is parsed via flow_dsl::parse. On parse failure we re-issue the request with a corrective user message that quotes the bad DSL plus the parser’s line:col and asks for a fix; the retry uses the same model, temperature, and max-tokens. Only parse-validated DSL is ever returned. If both attempts fail, the error message carries both line:col positions so the caller (and generate_dsl_auto) can surface them.

pub async fn generate_dsl_auto( &self, _local_model_id: Option<&str>, cloud: Option<(&str, &str)>, prompt: &str, ) -> Result<DslGenerationOutcome, AppError>

Generate Flow DSL via a cloud/local-provider model and parse-validate it. cloud is (provider, model_id) - the loaded LLM is the local provider. Returns parse-valid DSL or an error.

pub async fn agentic_generate( &self, local_model_id: Option<&str>, cloud: Option<(&str, &str)>, prompt: &str, ) -> Result<DslGenerationOutcome, AppError>

Agentic generation: generate DSL from the prompt alone, then ask a chat-capable model for a one-paragraph plan describing the result. Generation never reads local/user data - the workspace is an execution concern resolved at run time, not a generation input (see ADR-0007). The plan call is best-effort: failures (no chat-capable provider reachable, network error, empty response) leave plan = None so the caller can fall back to a deterministic client-side synthesis.

“Chat-capable provider” means anything we can call via generate_dsl_via_cloud with an arbitrary system prompt - the loaded LLM (when cloud == Some(("local", _))) or a real cloud provider. With neither available there is no chat path; the call returns Ok(outcome) with plan = None.

pub async fn agentic_replan( &self, local_model_id: Option<&str>, cloud: Option<(&str, &str)>, prompt: &str, prior_dsl: &str, observations: &str, ) -> Result<DslGenerationOutcome, AppError>

Observe-and-re-plan: regenerate the workflow given the prior DSL and a feedback string describing what went wrong when it ran (from [build_loop_observations]). The original task prompt is preserved so the model keeps the goal in view while fixing the failures. Goes through the same prompt-only agentic pipeline as a first generation, just with an augmented prompt.

This is the single re-plan step. The frontend’s review-then-run path calls it per user request; Self::agentic_run_loop calls it repeatedly for the autonomous path.

pub async fn agentic_run_loop( &self, local_model_id: Option<&str>, cloud: Option<(&str, &str)>, prompt: &str, workspace: Option<&str>, events: Arc<dyn EventSink>, ) -> Result<AgenticLoopSummary, AppError>

Autonomous agentic loop (the no-human-in-the-loop path): repeatedly generate → run → observe → re-plan until a run has zero failures or the MAX_AGENTIC_ITERATIONS safety cap is hit. Each iteration’s run emits the normal flow:execution events through events (so the Log Panel streams live); the returned AgenticLoopSummary carries the final DSL for the caller to load onto the canvas plus a per-iteration record.

Safety: bounded by the iteration cap, and every generated graph still runs through execute_graph, so the existing per-adapter sandbox and allow_cloud_ai / allow_local_ai gates apply unchanged - autonomy does not bypass them.

pub async fn load_graph(&self, graph_id: &str) -> Result<FlowGraph, AppError>

pub async fn validate_graph(&self, graph: FlowGraph) -> Result<(), AppError>

pub async fn run_flow( &self, _req: ExecutionRequest, ) -> Result<ExecutionResult, AppError>

Trait Implementations

impl Default for FlowApp

fn default() -> Self

Returns the “default value” for a type.