System & Safety Nodes
Applies to: ChengOS v0.2.0+ ｜ Last verified: 2026-09-25 ｜ Source: crates/cheng-nodes/src/nodes/builtin/utils
Three nodes that guard the edges of an execution. utils/credential injects a stored secret by
reference — it is the reason no workflow needs an API key typed into a plain field. utils/approver
stops the run and waits for a human decision, which is how an otherwise autonomous graph gets a
checkpoint before something irreversible. utils/preview renders intermediate content so you can see
what a step actually produced while you are still building the graph.
Credential Injection — utils/credential
Load saved credentials and expose them as env vars for downstream nodes. Supports provider auto-match, provider/name selection, and legacy UUID refs.
Inputs
| Field | Type | Required | Default | Description |
|---|
bindings | object | ✅ | — | Map each env var name to a credential ref. Ref supports provider (auto-select), provider/name (pick one), or UUID (legacy). Example: {"OPENAI_API_KEY":"openai", "GITHUB_TOKEN":"github/work"} |
context_name | string | — | null | Context label shown in log and error messages. |
strict | boolean | — | true | When enabled, any missing credential stops the node. When disabled, returns resolved env vars and lists failed keys in missing_bindings. |
user_id | string | — | null | Optional user UUID override. Leave empty to use the current workflow caller. |
Outputs
| Field | Type | Description |
|---|
env_vars | object | Resolved env var values for downstream nodes (sensitive). |
missing_bindings | array<string> | Env var keys that could not be resolved (only populated when Strict Mode is off). |
resolved_count | integer | How many bindings were resolved successfully. |
Approval Gate — utils/approver
Pause execution and request user authorization before performing a high-risk action. Supports one-time, session-level, and skip decisions.
Inputs
| Field | Type | Required | Default | Description |
|---|
action_name | string | ✅ | — | Name of the action requiring authorization |
risk_level | enum | — | medium | Assessed risk of the action (low / medium / high / critical). Control: select. Options: low, medium, high, critical |
description | string | — | null | Human-readable explanation of what the action will do |
param_summary | string | — | null | JSON summary of action parameters shown in the approval card |
extra_whitelist | string | — | null | Extra comma-separated action names to auto-approve in addition to session whitelist |
timeout_secs | integer | — | 300 | Seconds to wait before auto-rejecting if no response (default 300) |
Outputs
| Field | Type | Description |
|---|
approved | boolean | True when the action is allowed to proceed |
approved_out | boolean | Runtime-conditional boolean emitted only when approval is granted. |
outcome | enum | Detailed approval outcome. Options: approved (User approved the action (or a whitelist rule matched).), rejected (User rejected the action.), skipped (User asked to skip this action and return feedback.), timed_out (No response was received within the timeout window.) |
whitelist_hit | boolean | True if action was auto-approved via whitelist |
scope | string | Scope granted by the user |
reason | string | User-provided reason or feedback |
request_id | string | UUID identifying this approval request |
Content Preview — utils/preview
Display output results in preview window, supports multiple formats and statistics
Inputs
| Field | Type | Required | Default | Description |
|---|
data | any | — | — | Data to preview |
context | any | — | — | Context from Chat node |
artifact | object (port) | — | — | Artifact to preview (metadata only). Connection port, not a form field. |
artifacts | object (port) | — | [] | Artifact list to preview (metadata only). Connection port, not a form field. |
artifactUri | string | — | — | artifact:// URI to preview |
currentPage | integer | — | 1 | Current page number. Control: number |
displayFormat | enum | — | raw | Select preview display format. Control: select. Options: raw (原始格式), json (JSON 格式化), table (表格视图), codeblock (代码块格式), assistantmessage (提取助手消息) |
pageLength | integer | — | 1000 | Characters per page; shorter content displays directly, longer content is paginated. Control: number |
showStats | boolean | — | true | Whether to show character count, line count and other statistics. Control: switch |
Outputs
| Field | Type | Description |
|---|
original_data | any | Original input data |
preview_content | string | Formatted preview content |
statistics | string | Data statistics |
pagination | string | Pagination info (provided when content needs pagination) |
Next steps