(CODUX-223) Persist node-flow credential picker bindings

[numnx]

🧩 Task: Persist node-flow credential picker bindings

Automated task PR opened by Code UX for T07.

📋 Summary

Sprint: Sprint 223 · Complete automation credential management · Task: T07

Deliver a production-ready, write-only Automation Credentials experience with automatic secure local key custody, fail-closed production behavior, first-class Settings management, policy-aware node-flow and custom-dashboard credential-ID bindings, complete security coverage, and synchronized documentation.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.6-sol

⏱️ Timing

Started	2026-07-13 22:38:40 UTC
Finished	2026-07-13 23:03:07 UTC
Duration	24m 27s

📊 Token Usage

Metric	Value
Input tokens	302,213
Cached input tokens	19,819,776
Output tokens	48,893
Total tokens	20,170,882
Invocations	1
Tool calls	118
Active time	23m 42s

Included usage estimate (subscription/local login): $12.89

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

📝 Full Task Prompt

## Objective
Let operators bind node credential slots from the dashboard and persist each change through the existing optimistic node-flow draft workflow.

## Scope
- Edit `dashboard/src/v2/NodesPage.tsx`
- Edit `dashboard/src/v2/components/nodes/NodeFlowInspector.tsx`
- Create a reusable credential picker under `dashboard/src/v2/components/nodes/`
- Edit `dashboard/src/v2/lib/node-flow-api.ts` only as required for typed review/save responses
- Consume, but do not duplicate, metadata functions from `dashboard/src/v2/lib/automation-credential-api.ts`
- Extend `tests/dashboard/v2/nodes-page.test.tsx` and `tests/dashboard/v2/nodes-inspector.test.tsx`

## Implementation Requirements
1. Replace `Request binding` behavior with a picker driven by the selected slot's T03 `allowedKinds` and `requiredCapabilities`, project-visible metadata, active/configured state, project access, and secure-backend health.
2. Explain why unavailable or incompatible credentials are excluded or disabled without exposing secret or low-level cryptographic details; provide a direct Settings navigation affordance when no compatible credential exists.
3. On selection, replace or insert `{ slot, credentialId }` in the selected node's canonical `credentialBindings`; support explicit unbinding without changing other slots or node data.
4. Save immediately through `patchNodeFlowDraft` with the current `draftRevision`, adopt the returned canonical record/version, refresh draft review, and show distinct saving, saved, conflict, and policy-denial feedback.
5. On optimistic revision conflict, fetch the latest draft, preserve an actionable explanation, keep focus in the slot workflow, and require the user to retry rather than silently overwrite sibling edits.
6. Remove the dashboard dependency on `requestNodeFlowCredential` for persistence and never show a returned `requested` status as bound or saved.
7. Restore focus after picker close, support keyboard selection and Escape, announce save/error state, and handle project/flow/node changes while metadata or saves are in flight without applying stale results.
8. Test binding, rebinding, unbinding, incompatible filtering, backend unavailable state, optimistic conflicts, review refresh, keyboard/focus behavior, and absence of secret values from graph and component state.

## Constraints
- `NodeFlowNode.credentialBindings` is the only persisted dashboard binding source.
- Consume T03's slot policy and existing draft revision API; do not invent separate request records or bypass backend publication/runtime checks.
- Do not resolve or accept credential plaintext in the browser.
- Preserve existing node configuration editing, canvas selection, autosave, and review behavior for flows without credential slots.

## Verification
- Run `pnpm exec vitest run tests/dashboard/v2/nodes-page.test.tsx tests/dashboard/v2/nodes-inspector.test.tsx`.
- Run `pnpm run typecheck:dashboard`, `pnpm run test:dashboard`, and `pnpm run build`.
- At `http://localhost:4444`, bind, replace, and remove a compatible credential and confirm the saved graph plus refreshed review reflect each change while incompatible credentials remain unavailable.

🌿 Branch Info

Base: feature/CODUX-223-complete-automation-credential-management
Head: task/feature-codux-22-t07-codex-910650d7-mrjt0iao

---

🤖 Generated by Code UX