Fix CI: lint warnings, UI tests for removed module types

- Fix gosec G301: use 0750 directory permissions in feature flag module
- Fix gosec G115: mask hash to avoid integer overflow in migration lock
- Update UI tests to reflect removed modular module types and added
  feature flag types (7 removed, 3 added = net -4 module types)
- Add featureflag.service, step.feature_flag, step.ff_gate to UI MODULE_TYPES

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: intel352

migration/lock.go

@@ -75,5 +75,5 @@ func hashLockKey(key string) int64 {
 		h ^= uint64(key[i])
 		h *= 1099511628211 // FNV prime
 	}
-	return int64(h)
+	return int64(h & 0x7FFFFFFFFFFFFFFF) //nolint:gosec // intentional truncation for advisory lock key
 }

module/feature_flag_module.go

@@ -48,7 +48,7 @@ func NewFeatureFlagModule(name string, cfg FeatureFlagModuleConfig) (*FeatureFla
 		}
 		// Ensure parent directory exists for the SQLite file.
 		if dir := filepath.Dir(dbPath); dir != "" && dir != "." {
-			if mkErr := os.MkdirAll(dir, 0o755); mkErr != nil {
+			if mkErr := os.MkdirAll(dir, 0o750); mkErr != nil {
 				return nil, fmt.Errorf("feature flag module %q: failed to create db directory %q: %w", name, dir, mkErr)
 			}
 		}

ui/src/components/sidebar/NodePalette.test.tsx

@@ -18,10 +18,16 @@ describe('NodePalette', () => {
     expect(screen.getByText('Modules')).toBeInTheDocument();
   });
 
-  it('renders all categories', () => {
+  it('renders all categories that have modules', () => {
     renderPalette();
 
-    for (const cat of CATEGORIES) {
+    // Only categories with at least one module type are rendered
+    const categoriesWithModules = CATEGORIES.filter((cat) =>
+      MODULE_TYPES.some((t) => t.category === cat.key),
+    );
+    expect(categoriesWithModules.length).toBeGreaterThan(0);
+
+    for (const cat of categoriesWithModules) {
       const matches = screen.getAllByText(cat.label);
       expect(matches.length).toBeGreaterThanOrEqual(1);
     }
@@ -33,12 +39,10 @@ describe('NodePalette', () => {
     fireEvent.click(screen.getByText('Middleware'));
     fireEvent.click(screen.getByText('Messaging'));
     fireEvent.click(screen.getByText('Scheduling'));
-    fireEvent.click(screen.getByText('Events'));
 
     expect(screen.getByText('Auth Middleware')).toBeInTheDocument();
     expect(screen.getByText('Message Broker')).toBeInTheDocument();
     expect(screen.getByText('Scheduler')).toBeInTheDocument();
-    expect(screen.getByText('Event Logger')).toBeInTheDocument();
     expect(screen.getByText('Rate Limiter')).toBeInTheDocument();
     expect(screen.getByText('CORS Middleware')).toBeInTheDocument();
   });

ui/src/store/workflowStore.test.ts

@@ -98,17 +98,17 @@ describe('workflowStore', () => {
       expect(getStore().nodes[0].type).toBe('schedulerNode');
     });
 
-    it('maps event types to eventNode component', () => {
+    it('maps notification.slack to integrationNode component', () => {
       act(() => {
-        getStore().addNode('eventbus.modular', { x: 0, y: 0 });
+        getStore().addNode('notification.slack', { x: 0, y: 0 });
       });
 
-      expect(getStore().nodes[0].type).toBe('eventNode');
+      expect(getStore().nodes[0].type).toBe('integrationNode');
     });
 
-    it('maps httpclient to integrationNode component', () => {
+    it('maps step types to integrationNode component', () => {
       act(() => {
-        getStore().addNode('httpclient.modular', { x: 0, y: 0 });
+        getStore().addNode('step.validate', { x: 0, y: 0 });
       });
 
       expect(getStore().nodes[0].type).toBe('integrationNode');

ui/src/types/workflow.test.ts

@@ -10,7 +10,7 @@ import type { ModuleCategory } from './workflow.ts';
 describe('workflow types', () => {
   describe('MODULE_TYPES', () => {
     it('has the expected number of module types', () => {
-      expect(MODULE_TYPES.length).toBe(74);
+      expect(MODULE_TYPES.length).toBe(70);
     });
 
     it('each module type has required fields', () => {

ui/src/types/workflow.ts

@@ -940,6 +940,48 @@ export const MODULE_TYPES: ModuleTypeInfo[] = [
       { key: 'schedule', label: 'Schedule Window', type: 'json', description: 'Time window for scheduled gates (weekdays, start_hour, end_hour)' },
     ],
   },
+
+  // ---- Feature Flags ----
+  {
+    type: 'featureflag.service',
+    label: 'Feature Flag Service',
+    category: 'infrastructure',
+    defaultConfig: { provider: 'generic', cache_ttl: '1m', sse_enabled: true },
+    configFields: [
+      { key: 'provider', label: 'Provider', type: 'select', options: ['generic', 'launchdarkly'], defaultValue: 'generic', description: 'Feature flag backend provider' },
+      { key: 'cache_ttl', label: 'Cache TTL', type: 'string', defaultValue: '1m', description: 'Duration to cache flag evaluations', placeholder: '1m' },
+      { key: 'sse_enabled', label: 'SSE Enabled', type: 'boolean', defaultValue: true, description: 'Enable Server-Sent Events for real-time flag change notifications' },
+      { key: 'store_path', label: 'Store Path', type: 'string', description: 'Path for the flag definition store (file-based provider)', placeholder: 'data/flags.json' },
+      { key: 'launchdarkly_sdk_key', label: 'LaunchDarkly SDK Key', type: 'string', sensitive: true, description: 'LaunchDarkly server-side SDK key (required when provider is launchdarkly)', group: 'LaunchDarkly' },
+    ],
+    ioSignature: { inputs: [], outputs: [{ name: 'featureflag.Service', type: 'featureflag.Service' }] },
+    maxIncoming: 0,
+  },
+  {
+    type: 'step.feature_flag',
+    label: 'Feature Flag Check',
+    category: 'pipeline',
+    defaultConfig: { output_key: 'flag_value' },
+    configFields: [
+      { key: 'flag', label: 'Flag Key', type: 'string', required: true, description: 'Feature flag key to evaluate', placeholder: 'feature.my-flag' },
+      { key: 'user_from', label: 'User From', type: 'string', description: 'Template expression to extract user identifier from context', placeholder: '{{.request.user_id}}' },
+      { key: 'group_from', label: 'Group From', type: 'string', description: 'Template expression to extract group identifier from context', placeholder: '{{.request.group}}' },
+      { key: 'output_key', label: 'Output Key', type: 'string', defaultValue: 'flag_value', description: 'Key to store the flag value in pipeline context', placeholder: 'flag_value' },
+    ],
+  },
+  {
+    type: 'step.ff_gate',
+    label: 'Feature Flag Gate',
+    category: 'pipeline',
+    defaultConfig: {},
+    configFields: [
+      { key: 'flag', label: 'Flag Key', type: 'string', required: true, description: 'Feature flag key to evaluate', placeholder: 'feature.my-flag' },
+      { key: 'on_enabled', label: 'On Enabled', type: 'string', description: 'Branch or step to execute when flag is enabled' },
+      { key: 'on_disabled', label: 'On Disabled', type: 'string', description: 'Branch or step to execute when flag is disabled' },
+      { key: 'user_from', label: 'User From', type: 'string', description: 'Template expression to extract user identifier from context', placeholder: '{{.request.user_id}}' },
+      { key: 'group_from', label: 'Group From', type: 'string', description: 'Template expression to extract group identifier from context', placeholder: '{{.request.group}}' },
+    ],
+  },
 ];
 
 export const MODULE_TYPE_MAP: Record<string, ModuleTypeInfo> = Object.fromEntries(

ui/src/utils/serialization.test.ts

@@ -402,23 +402,6 @@ describe('serialization', () => {
       expect((autoWireEdges[0].data as WorkflowEdgeData).label).toBe('auto-wired');
     });
 
-    it('auto-wires to chimux.router when no http.router exists', () => {
-      const config: WorkflowConfig = {
-        modules: [
-          { name: 'my-server', type: 'http.server' },
-          { name: 'my-chi-router', type: 'chimux.router' },
-          { name: 'health', type: 'health.checker' },
-        ],
-        workflows: {},
-        triggers: {},
-      };
-
-      const { edges } = configToNodes(config);
-      const autoWireEdges = edges.filter((e) => (e.data as WorkflowEdgeData)?.edgeType === 'auto-wire');
-      expect(autoWireEdges).toHaveLength(1);
-      expect(autoWireEdges[0].target).toContain('chimux_router');
-    });
-
     it('does not create auto-wire edges when no router exists', () => {
       const config: WorkflowConfig = {
         modules: [
@@ -487,8 +470,8 @@ describe('serialization', () => {
           { name: 'Broker', type: 'messaging.broker' },
           { name: 'SM', type: 'statemachine.engine' },
           { name: 'Sched', type: 'scheduler.modular' },
-          { name: 'EvtBus', type: 'eventbus.modular' },
-          { name: 'Client', type: 'httpclient.modular' },
+          { name: 'Slack', type: 'notification.slack' },
+          { name: 'Step', type: 'step.validate' },
           { name: 'DB', type: 'database.modular' },
         ],
         workflows: {},
@@ -500,7 +483,7 @@ describe('serialization', () => {
       expect(nodes[1].type).toBe('messagingNode');
       expect(nodes[2].type).toBe('stateMachineNode');
       expect(nodes[3].type).toBe('schedulerNode');
-      expect(nodes[4].type).toBe('eventNode');
+      expect(nodes[4].type).toBe('integrationNode');
       expect(nodes[5].type).toBe('integrationNode');
       expect(nodes[6].type).toBe('infrastructureNode');
     });