NodePilot 1.3.0

The first minor release since 1.2.0, cut from thirteen development builds and 65 commits. Highlights below; CHANGELOG.md carries the full entries with the reasoning behind each one.

Designer

• Editing no longer goes missing. Adding, pasting, duplicating, deleting and grouping nodes, and undo/redo, never marked the workflow as changed. Ctrl+S is gated on that flag, so after any of them the save did nothing, autosave never armed, and leaving the page warned about nothing.
• Undo stopped deleting the children of a collapsed group. History snapshotted the projected graph, which omits them, and autosave persisted the loss.
• Lint is off the frame path. It ran on every frame of a drag, sampling 23 bezier points per edge against every node. It now runs on a settled graph, with the publish path linting live so its verdict is never stale.
• Atelier is the only designer look; the classic design language is gone.
• dup-published-param no longer fires on names the author cannot change.

Assistants

• The knowledge assistant is reachable from every page. A launcher opens it as a widget, and conversation, draft and any running stream survive route changes. Minimising does not interrupt a stream.
• The MCP server is at 102 tools, including get_failure_causes.

Live-Ops and dashboard

• Timeline zoom, selection and shared-workflow grouping reworked.
• The run-status donut is a readable summary: total, one proportion bar, every status with count and share, keyboard-selectable.
• The success-rate trend draws a point per observed hour, so an isolated active hour is visible at all.
• Recent failures are grouped by normalised cause, with a retry counter — also via np failure-causes.
• The long-running count uses the alerting threshold instead of its own.

Engine

• startProgram no longer retains resources in reused runspaces. Output is drained without PowerShell event jobs, capture memory is bounded, and waited processes are cleaned up on timeout or cancellation.
• A runScript step that never ran no longer reports success, and queued PowerShell invocations cancel correctly instead of reporting a false result.
• Workflow input data can no longer end up as PowerShell code — the escaping now covers every quote character the parser recognises.
• Edge conditions fail closed. An unknown type or operator, a group without children or a broken legacy string is refused at save and aborts the run instead of opening the path it was meant to guard. A missing global fails the step rather than travelling on as text, and <, <= and isFalse no longer fire on missing data.
• A step no longer stays Running under a finished execution, and a step that fails to persist no longer leaves its siblings running.
• A retry no longer repeats a permanent remote failure — a denied WinRM logon could lock the account out.
• config.retry applies to remote activities; forEach children record their parent execution.

Clients and security

• The np CLI and the MCP server pin the server certificate. A SHA-256 pin replaces a root-store import for a server the client machine does not trust. The pin is additive so renewal keeps working, a mismatching pin is rejected even under --insecure-tls, and a stored pin is origin-bound.
• TLS remedies match the diagnosed cause. A name mismatch is answered with a ready-made np config set server <url> rather than a root-store import that cannot fix it; a second cause is no longer swallowed by the first.
• The Switcher signs in with Kerberos before asking for a password.

Performance

• GET /api/machines stopped parsing every workflow definition per request, GET /api/workflows no longer ships DefinitionJson, and GET /api/executions gained an opt-out for its two 32 KiB payload fields.
• Sidebar badges have their own endpoint instead of pulling the whole dashboard aggregate every 60 s from every page.
• ECharts left the boot chunk: eager path 2029 → 1419 KB raw, 591 → 386 KB gzipped.

Deployment

• The bundled ASP.NET Core runtime moves to 10.0.12. The documented 10.0.11 floor is unchanged — it is a minimum that 10.0.12 satisfies.
• The installer's closing summary prints addresses that carry the HTTPS port, so they can be opened as printed on an installation that does not listen on 443.
• The Engine Switcher is now simply the Switcher, everywhere it is persisted.

Downloads

File	What it is
NodePilot-Server-Setup-1.3.0.exe	Windows server installer (GUI and /VERYSILENT)
NodePilot-Desktop-Setup-1.3.0.exe	offline desktop installer, all services set to start at boot
NodePilot-1.3.0.zip	server payload for Install-NodePilot.ps1
NodePilot-Deploy-Scripts-1.3.0.zip	the install scripts on their own, so the verifying script can be had before the archive it verifies
NodePilot-Switcher-1.3.0-win-x64.zip	the Switcher standalone, for a machine with no NodePilot installation
NodePilot-1.3.0.zip.manifest.json + .p7s	detached signed manifest
nodepilot-release-signing.cer	publisher certificate
NodePilot-1.3.0.SHA256SUMS.txt	checksums covering every file above

New in this release: the server installer bundles the PostgreSQL command-line client. Every release up to 1.2.26 shipped without it, which meant the installer skipped CREATE ROLE / CREATE DATABASE and the readiness page asked for both to be created by hand. It can now create them for you. That is why the server installer is roughly 19 MB larger than in 1.2.26.

Signature and first run

Publisher: CN=NodePilot Release Signing.
Certificate thumbprint: 277EAB317A581C88302CE92BE805938C86B4650D.

Both installers are Authenticode-signed with a self-signed release certificate. Windows SmartScreen will show an unrecognised-app prompt and the chain will read as untrusted — there is no public CA behind this certificate yet. Before choosing More info → Run anyway, compare the download's SHA-256 against the attached checksum file and the publisher certificate against the thumbprint above. The attached .cer carries no private key.