Node-RED Guide

WoowTech · AI Agent Handbook

A complete skill for researching, writing, and delivering Node-RED tutorials

This specification governs an agent's sources, product boundaries, flows, security practices, brand use, quality gates, and delivery permissions. MUST marks an unconditional requirement. STOP means to stop making unsupported claims or changes and refer the decision to someone with the appropriate authority.

Source priorities and conflicts

  1. MUST 1: Exact-tag source code.Use pinned commits for Community App 22.0.1 (repository tag v22.0.1), Node-RED 5.0.2, HA WS v0.80.3, and FlowFuse Dashboard v1.30.2, in that order of priority.
  2. MUST 2: Official documentation and release notes for the same version.Use them only to supplement user guidance supported by the pinned sources. Do not let rolling latest documentation override an exact tag.
  3. MUST 3: Read-only observation of a live system.Describe only the UI visible in that environment; do not generalize those observations into claims about the product as a whole.
  4. STOP: When sources conflict, record the claim, its sources, the discrepancy, and what remains to be verified. If the conflict cannot be resolved, document it as a limitation rather than guessing.

Product boundaries

LayerPinned versionScope of supported claims
Community App22.0.1Container, Add-on schema, startup, Ingress, bundled dependencies
Node-RED5.0.2Editor, runtime, core nodes, msg, Context, Deploy, Projects
HA WebSocket0.80.3Registered nodes for HA configuration, events, states, actions, and related features
FlowFuse Dashboard 21.30.2Optional package only; MUST be described as optional and not bundled
STOP: Do not interchange the four versions, describe optional features as built into the Add-on, or recommend the legacy dashboard.

Feature manifest contract

The following representative entry shows the complete field structure but is not the source of truth. Always defer to data/node-red-22.0.1-feature-manifest.json and scripts/check_feature_manifest.js.

{
  "id": "addon-option-log-level",
  "layer": "add-on",
  "feature": "log_level: Supervisor log level schema (trace through fatal; optional)",
  "version": "22.0.1",
  "source": "https://github.com/hassio-addons/app-node-red/blob/bcfd5b83d3d322dc12a7bd2a310ca705c130b419/node-red/config.yaml",
  "sourceId": "app-node-red-22.0.1",
  "sourcePath": "node-red/config.yaml",
  "chapters": [2, 22],
  "status": "covered",
  "securityNotes": "More detailed logs may expose message content; return to the necessary level after troubleshooting."
}

layer accepts only add-on, node-red, ha-websocket, or optional; status accepts only planned or covered.

Authoring specification for 22 chapters

Safe flow JSON

MUST

  • Output an importable JSON array with unique IDs, a valid tab, and no dangling wires.
  • Use an explicit PLACEHOLDER for every server, entity, device, area, URL, broker, and topic.
  • Disable nodes with side effects—such as HTTP, MQTT, and HA action nodes—by default, and document the prerequisites for enabling them manually.
  • Use the README to record the source chapter, expected input and output, risks, import procedure, testing, and cleanup.

STOP

  • A token, password, credential, private IP address, hostname, or real HA identifier is present.
  • A flow starts automatically, retries without a limit, has no timeout, or could control a device repeatedly.
  • A third-party node type is unknown, a version has no source, a configuration reference is missing, or safe recovery is not documented.
  • Do not weaken a checker or conceal values in encoded text, comments, or names to pass a gate.

Factual, security, and editorial review

Factual MUST

List each paragraph's claims and exact evidence. Search for “always,” “all,” “guaranteed,” “default,” and “fastest.” If same-version evidence is unavailable, make the claim conditional or STOP.

Security MUST

Run the sensitive-data scan and flow gate, then manually check for secrets, identifying values, external endpoints, side effects, recovery steps, and approvals.

Editorial MUST

Do not use emoji. Keep terminology consistent. Do not describe temporary scaffolding or future work as delivered content. Give links a non-color cue, and make code and tables scrollable.

Accessibility MUST

Provide semantic landmarks, visible focus, keyboard operation, live status announcements, and descriptive link text. Prevent page-level horizontal overflow at 320 and 360 px.

Read-only screenshots

  1. Plan: List the UI elements to document, the permitted read-only actions, and any sensitive fields.
  2. Capture: Only navigate, search, and expand. Do not select Create, Save, Deploy, Delete, or Kick; trigger an Inject node; or call an action.
  3. Isolate: Store originals in a gitignored raw or probe directory. Never publish an original directly.
  4. Redact: Remove tokens, URLs, IP addresses, entity, device, and area IDs, client IDs, topics, user details, and EXIF metadata.
  5. Two-person gate: A second person must inspect every screen, filename, surrounding passage, and metadata field before publication.

WoowTech brand and downloads

Quality gates and STOP rules

node scripts/build_downloads.js --check
node scripts/build_nav.js --check
node scripts/check_links.js
node scripts/check_content.js
node scripts/check_flow_examples.js
node scripts/check_feature_manifest.js
node scripts/check_sensitive.js
node scripts/check_downloads.js
node scripts/check_resource_hub.js
node scripts/check_dockerfile.js
node scripts/test_checks.js
node scripts/validate_responsive.js

Deployment permissions and output contract

STOP: This skill does not authorize remote pushes or deployment to GitHub Pages, Cloudflare, a custom domain, Home Assistant, or any production environment. An agent may create, check, and commit changes only in an approved repository and branch. Publication requires separate approval from someone with explicit authority.

Every output MUST include

Pre-delivery checklist

Content

  • Versions are exact for all four product layers
  • The 116-entry manifest agrees with all 22 chapters
  • All 14 flows pass their gates
  • Official sources and trademark notices are complete

Security and publication

  • No secrets or real identifiers
  • All three downloads pass byte-level checks
  • Docker copies only allowlisted public files
  • No unauthorized deployment