(CODUX-216) Harden built-in nodes and external effects

[numnx]

🧩 Task: Harden built-in nodes and external effects

Automated task PR opened by Code UX for T04.

📋 Summary

Sprint: Sprint 216 · Nodes Full Integration · Task: T04

Turn the existing project-scoped node-flow foundation and browser-local canvas into a canonical, secure, versioned automation control plane with registry-driven nodes, encrypted credentials, durable execution, governed integrations, isolated custom nodes, agent authoring, dashboard integration, and authenticated headless readiness.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.6-sol

⏱️ Timing

Started	2026-07-12 05:11:09 UTC
Finished	2026-07-12 05:17:40 UTC
Duration	6m 31s

📊 Token Usage

Metric	Value
Input tokens	281,358
Cached input tokens	8,437,760
Output tokens	43,535
Total tokens	8,762,653
Invocations	9
Tool calls	73
Active time	21m 19s

Included usage estimate (subscription/local login): $6.93

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

📝 Full Task Prompt

## Objective
Complete the first governed built-in catalog on top of durable execution, centralizing external request policy and preventing unsafe or duplicate external side effects.

## Scope
- `src/services/node-flow-runtime-service.ts`
- `src/domain/node-flows/node-definition-registry.ts`
- New built-in executors under `src/services/node-flows/builtins/`
- New `src/services/node-flows/egress-policy-service.ts`
- New `src/services/node-flows/oauth-broker.ts`
- New `src/services/node-flows/outbox-service.ts` and `approval-service.ts`
- New repositories for `automation_outbox`, `automation_approvals`, and `automation_webhook_triggers`
- `src/repositories/db/app-db-migrations.ts`
- `src/server/node-flow-routes.ts` and new webhook route registration
- `src/app/dependency-factory/dashboard-factory.ts`
- Backend runtime, security, route, and repository tests
- Built-in node and security documentation under `docs/` and `docs-web/`

## Implementation Requirements
1. Register and execute Condition, Switch, Foreach, Merge, Delay, Approval, Email Draft, Email Send, Execute Subflow, Webhook Trigger, and the existing built-ins using typed ports, bounded iteration/fan-out, explicit skipped branches, merge strategies, and subflow ownership checks.
2. Route HTTP and custom-node egress through one policy service enforcing HTTPS by default, explicit HTTP opt-in, URL credential rejection, redirect revalidation, DNS/private-network and metadata blocking, rebinding protection, host/port allowlists, size/content-type limits, normalized headers, timeout propagation, retries, and rate limits.
3. Implement OAuth authorization-code/PKCE state handling, encrypted state, callback-origin validation, refresh rotation, expiry, scopes, revocation, reconnect, and health checks without exposing tokens to agents or graph JSON.
4. Implement approval persistence and an idempotent outbox for email and other side effects, with keys derived from published version, run, node, and logical item; persist provider message IDs and unknown-outcome attention states.
5. Add authenticated webhook configuration, mock external providers, focused tests for branches, bounded iteration, SSRF/DNS/redirect attacks, oversized responses, OAuth lifecycle, approval persistence, outbox deduplication, and restart behavior; update docs and examples.

## Constraints
- Do not allow unrestricted host networking, private-network access, raw credential headers, or arbitrary redirects.
- Draft-only email mode and approval gates must remain the default for irreversible effects.
- Keep node handlers behind the registry and preserve deterministic graph validation and redaction contracts.

## Verification
- Run focused built-in, runtime, route, repository, and security suites with `pnpm exec vitest run`.
- Verify private IP, loopback, cloud metadata, DNS rebinding, redirect, credential-in-URL, oversized-response, restricted-header, and retry-policy cases are rejected or bounded.
- Verify approval restart persistence and outbox uniqueness prevent duplicate mock sends.
- Run `pnpm run typecheck`, `pnpm run test:backend`, `pnpm run build`, and `pnpm run check:docs-web`.

🌿 Branch Info

Base: feature/CODUX-216-nodes-full-integration
Head: task/feature-codux-21-t04-codex-b8218574-mrhbf1q2

---

🤖 Generated by Code UX