Commit Graph
3577 Commits
Author SHA1 Message Date
j-sanaa f37403392f Fix gemini comment 2026-05-04 17:03:51 -07:00
j-sanaa 9f3d010815 Revert changes made to add freeSolo 2026-05-04 16:42:55 -07:00
j-sanaa 66c28471c2 Pending test cases added 2026-05-04 16:11:16 -07:00
j-sanaa e40f57ccff Merge branch 'main' into fix/agentflow-loop-node 2026-05-04 13:06:50 -07:00
j-sanaa 16bb3170ae Fix node deletion 2026-05-04 12:57:31 -07:00
j-sanaa e305f1e252 Test change 2026-05-04 12:36:54 -07:00
Jocelyn LinandClaude Opus 4.7 7591ddd594 feat(observe): ExecutionDetail with tree view, headers, and resizable drawer (#6325)
* feat(observe): ExecutionDetail with tree view, headers, and resizable drawer

## Summary

Ports the legacy `ExecutionDetails.jsx` (~984 lines) into the `@flowiseai/observe` SDK as a composable `ExecutionDetail` orchestrator.

- **`ExecutionDetail`**: split-pane (sidebar tree + node detail) with sidebar header that holds the agentflow chip, Copy-ID chip, formatted updated date, and refresh button. Auto-selects the first STOPPED node (or first top-level otherwise) on initial tree build.
- **`ExecutionTreeSidebar`**: `@mui/x-tree-view` `RichTreeView` with a custom `TreeItem2` slot — per-branch border colored from `AGENTFLOW_ICONS`, status-icon variants on each row, virtual `Iteration #N` containers, controlled expand/collapse defaulting to all-expanded.
- **`useExecutionTree`** rewritten to mirror the legacy three-pass `buildTreeData`: `previousNodeIds` parent→child with most-recent disambiguation, iteration grouping under the latest parent instance, sub-tree linking inside virtual containers, iterations-first sibling sort, and recursive `FLOWISE_CREDENTIAL_ID` scrub. Iteration container status is the legacy `ERROR > INPROGRESS > all-FINISHED > UNKNOWN` rollup.
- **`useDrawerWidths`** + `useResizableSidebar({ inverted })` extension drive a resizable `ExecutionsViewer` Drawer (parity with the legacy left-edge drag handle). Adds a public `ExecutionsViewerProps.drawer?: { defaultWidth?, minWidth?, maxWidth? }` override.
- **`AGENTFLOW_ICONS`** lifted from `atoms/NodeIcon.tsx` to `core/primitives/agentflowIcons.ts` so the tree slot can consume it without re-importing through `atoms`.
- **`ExecutionDetailProps.agentflow?: AgentflowRef`** seeds the header chip while the detail endpoint loads (server-side `getExecutionById` doesn't perform the agentflow join — only `getAllExecutions` does).
- Adds `@mui/x-tree-view` as a runtime dep.

## Test plan

- [x] `pnpm -C packages/observe test:coverage` — 331 tests pass, all `coverageThreshold` entries met (85.37% statements / 82.98% branches overall; `useExecutionTree` 96.5% / 85.18%, new `useDrawerWidths` 100% / 90.9%, `ExecutionDetail` 89.18% / 92.5%).
- [x] Manually verify in `packages/observe/examples` (`pnpm dev` after copying `.env.example` to `.env`):
  - List → row click opens the resizable Drawer; left-edge handle widens/narrows.
  - Tree shows status icons for each row plus rolled-up status on virtual iteration containers; `IconLoader` spins for INPROGRESS rows.
  - Agentflow chip is clickable and opens the canvas in a new tab when `VITE_AGENTFLOW_CANVAS_URL` is set; non-clickable otherwise.
  - Copy-ID chip flips inline to `Copied!` for 2s. **Behavior change from legacy**: legacy dispatched a Redux/notistack snackbar toast ("ID copied to clipboard") via the host app; the SDK can't assume a snackbar provider exists, so the confirmation is rendered on the chip itself.
  - Refresh button re-fetches; date formatted as `MMM d, yyyy h:mm a`.
  - Standalone `<ExecutionDetail>` demo by execution id renders the same surface without the list.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* address gemini review feedback

* fix flaky test and console warning in test

* fix drawer min/max edge case bug

* fix Copy ID chip falsely showing 'Copied!' on clipboard reject

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* fix(observe): iteration tree parity with legacy

Iteration metadata (parentNodeId/iterationIndex) is nested under `data`
in the runtime payload per IAgentflowExecutedData; the SDK was reading
from the top level so virtual Iteration #N containers never materialized
and iteration children dangled at root. Same shape fix applies to
humanInputAgentflow detection in useNodeData. Iteration parent input
now shows "No data" matching legacy's `data.input.question || '*No
data*'` fallback, and virtual Iteration #N containers are selectable
with empty Input/Output panels.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>
2026-05-04 10:57:33 -07:00
github-actions[bot]andgithub-actions[bot] 88b71903e9 chore: bump @flowiseai/agentflow to 0.0.0-dev.14 (#6337)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-05-04 09:54:55 -07:00
Ilango ada643f0e2 fix: cors handling (#6304)
* fix: cors handling

* update: use app url instead of new env var

* fix: review feedback

* add: tests and validation for cors configuration
2026-05-04 14:25:50 +05:30
j-sanaa 8050b1e948 Fix iteration node 2026-05-01 16:43:07 -07:00
ce7a811b71 feat: implement scheduling functionality for AgentflowV2 (#5971)
* feat: implement scheduling functionality for AgentflowV2

- Added ScheduleQueue class for managing scheduled jobs using BullMQ.
- Introduced scheduleService for creating, updating, and disabling schedules.
- Integrated schedule validation and cron expression handling.
- Enhanced chatflow service to manage schedules for agentflows.
- Added UI components for time and day selection (TimePicker, WeekDaysPicker, MonthDaysPicker).
- Updated NodeInputHandler to support new input types for scheduling.
- Improved validation for schedule configurations in agentflows.

* feat: implement schedule management for agentflows

- Refactor ScheduleQueue to utilize executeScheduleJob for job execution.
- Add new endpoints for schedule status retrieval and enabling/disabling schedules in chatflows.
- Update chatflow service to handle schedule creation, updates, and deletions more effectively.
- Introduce DatePicker component for date input in UI.
- Enhance CanvasHeader to manage schedule state and toggle functionality.
- Integrate schedule validation logic to ensure proper configuration before enabling schedules.
- Update dependencies to include node-cron for improved scheduling capabilities.

* feat(schedule): refactor schedule services and tests for schedule job

- Seperate the utils function from schedule service.
- Created comprehensive unit tests for all utility functions in `utils.test.ts`, covering various scenarios for cron expression validation, visual picker validation, and schedule resolution.
- Ensured proper handling of edge cases and error messages for invalid inputs.

* feat(schedule): remove timestamp in schedule tabes to support sqlite

- Change the way to update the existing schedule to avoid typescript issue when building.
- Add merge function in mockRepo in schedule service test.

* fix(schedule): add nullable to optional entity columns and entity interfaces

- Add nullable: true to lastRunAt, nextRunAt, endDate on ScheduleRecord
  entity to match migration DDL and prevent runtime errors
- Add IScheduleRecord and IScheduleTriggerLog interfaces to Interface.ts
- Have entities implement their respective interfaces per codebase convention

* fixed tests and hide schedule input from package/agentflow

* feat: integrate IdentityManager into worker and queue management

- Remove supporting cron express with 6 fields (second)
- Calculate the prediction usage in cron job

* feat: add support for MIN_SCHEDULE_INTERVAL_SECONDS in cron job configuration and validation

* fixed broken tests

* UI UX fixes for scheduler in dark mode

* fix(schedule): remove unnecessary UUID generation in createOrUpdateSchedule

* adds required scheduleInputMode column with text/form/none variants, ChatType.SCHEDULED, trigger-logs endpoint + drawer UI, IANA timezone dropdown, and dark-mode UX polish.

* add deleteScheduleTriggerLogs endpoint and UI integration for log deletion

* feat: enhance cron job handling for last day of month (L) in ScheduleBeat and related utilities

Co-authored-by: Copilot <[email protected]>

* - fix(start-node): persist declared defaults of newly-visible fields so saves don't drop required values
- update ui for last day to include hints and next run datetime

---------

Co-authored-by: Jackie Chui <[email protected]>
Co-authored-by: Henry <[email protected]>
Co-authored-by: Copilot <[email protected]>
2026-05-01 22:39:20 +01:00
j-sanaa 014d35ce20 Fix(agentflow) - Add iteration node full functionality (#6324)
* Fix output node not selectable

* Fix highlight color

* Fix previous node displaying label and not ID

* Fix tool arguements not being called

* Fix dropdown values to not be bold

* Add standard sizing for all input text

* FIx syntax highlighting styling

* Use predefined tokens for font weight and size

* Fix dialog size of Source

* Fix color of syntax highlight in dark mode

* Fix the input fileds color in dark and regular mode

* Fix gemini comments

* FIx inconsistent spacing

* Standardise gap between label and field

* Remove export for unused function and standardize dialog size accrosss code, rich text,
  and source

* Fix test error

* Fix opening node editing dialog on iteration node

* Untested change

* Add {{iteration}} variable

* Add node execution status to Iteration node

* Fix delete iteration node

* stream iteration node results incrementally when it is the terminal node

* Add test cases

* Fix edit color in dark mode and gemini comments

* Fix lint warnings

* Fix review comment - Add iterationEdge z-index value to tokens

* keep succesful and error messages in content

* Add removed comment

* Remove changes to server code in this PR
2026-05-01 14:33:57 -07:00
abdullah-workday f60250caa9 fix: Adding Shahdow and elevation to dropdown list (#6322) 2026-05-01 09:54:56 -07:00
Deepak Bhagat 88eb71b11a feat(components): add missing languages to Code Text Splitter (#6290)
* feat(components): add missing languages to Code Text Splitter

The Code Text Splitter only exposed 16 languages natively supported
by @langchain/textsplitters. The Python LangChain library supports
many more. This adds 9 additional languages (c, csharp, cobol,
elixir, haskell, kotlin, lua, powershell, ts) with custom separators
ported from Python LangChain, while keeping existing languages on
the native fromLanguage() path.

* fix: address review feedback on language separators

C: replace class with struct/union/enum (C has no class keyword).
C#: remove implements (C# uses :), add namespace and struct.
Elixir: remove while (not a keyword in Elixir).
Kotlin: remove case (Kotlin uses when).
Fallback: return default splitter instead of calling fromLanguage
with an unsupported language.

* style: fix prettier formatting in CodeTextSplitter
2026-05-01 00:43:04 +01:00
Teay 2df597f220 fix: randomSeed always ignored in ChatMistral node (#6299) 2026-05-01 00:41:07 +01:00
8842d52ea2 Update logger to Remove Sensitive Fields (#6317)
* Update logger to Remove Sensitive Fields

* Update logger.ts

* Update logger.ts

* Update logger.ts

---------

Co-authored-by: christopherholland-workday <[email protected]>
Co-authored-by: yau-wd <[email protected]>
2026-05-01 06:16:54 +08:00
Jocelyn LinandClaude Opus 4.7 b32c4f6b05 feat(observe): NodeExecutionDetail component (#6310)
* feat(observe) FLOWISE-575: port NodeExecutionDetail with hooks, atoms, and tool surfaces

Ports legacy NodeExecutionDetails.jsx (~1,285 LOC) to the observe SDK as a
composed orchestrator. Adds atoms (CodeFenceBlock, JsonBlock, NodeIcon),
core utils (guards, resolveTool, extractToolCalls), feature hooks
(useNodeData, useHumanInput, useResizableSidebar), and tool / condition /
HITL surfaces. Establishes the type-location and tier-3 conventions in
ARCHITECTURE.md and TESTS.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* fix(observe): use original index for fulfilled condition labels

Iterate the original conditions array and skip non-fulfilled entries so
"Condition N" matches the branch the user configured in the Condition
node editor. Legacy had the same filter-then-index pattern; this is a
deliberate deviation tagged with a // PARITY: comment.

Addresses review on #6310.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* fix(observe): cap JSON viewer height at 400px to match legacy

Bake legacy JSONViewer.jsx's `maxHeight: '400px'` default into the
JsonBlock atom so all call sites (Tools list, fulfilled conditions,
chat message JSON content, NodeContentRenderer JSON paths) scroll
inside a bounded frame instead of pushing the rest of the panel
off-screen. Previously only NodeContentRenderer applied a cap;
ToolAccordionList and FulfilledConditionsBlock were unbounded.

Drops the now-redundant DEFAULT_JSON_MAX_HEIGHT in NodeContentRenderer
and MESSAGE_JSON_MAX_HEIGHT in ChatMessageBubble — three copies of the
same 400 collapsed to the atom's single source of truth. The
jsonMaxHeight override path in NodeContentRenderer remains for
consumers that need a non-default cap.

Adds regression tests that compare emotion classNames against an
explicit-value control (jsdom can't compute MUI sx-applied CSS).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>
2026-04-30 11:48:56 -07:00
j-sanaaandClaude Sonnet 4.6 80859b201e feat(agentflow): add node execution visualization with HITL support (#6312)
* Integrate executuons API

* Fix Status indicators example to use AgetnContext

* Fix styling of HITL pause icon

* Tet changes for node executiom

* Fix lint error

* Chat panel implementation

* Import functionality from v2

* Fix proxy issues for chat

* Fix styling of chat

* Split out chat panel changes — execution UI only

Remove TestFlowDialog, TestFlowButton container, chat avatars, react-markdown/remark-gfm/fetch-event-source deps, uuid/fileMock mocks, and related vite proxy changes. These belong to feat-agentflow-chatpanel which will be opened on top of this branch.

Restore StyledFab to node-palette, restore old TestFlowButton component, and revert Agentflow.tsx/canvas index to pre-chat state so this branch contains only the node execution status UI work.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* chore(agentflow): remove TestFlowButton placeholder from execution branch

TestFlowButton belongs to the chat panel PR. Removing the placeholder
component, its exports, and its usage in Agentflow.tsx so this branch
contains only execution UI work.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* Add test changes

* FIx gemini comments

* Add dark mode toggle

* Remove Execution API references

* Update E2E to stream API responses

---------

Co-authored-by: Claude Sonnet 4.6 <[email protected]>
2026-04-30 08:18:57 -07:00
yau-wd 3086cb7e32 Fix FLOWISE 429 executeJavaScriptCode (#6306)
fix: flowise 429 executeJavaScriptCode
2026-04-30 17:40:31 +08:00
Rohan Patil 133aacf1d5 feature: custom endpoint host for AWS Embedding Node (#6264)
* feature: custom host for AWS Embedding Node

* fix: gemini code fix lint errors
2026-04-29 16:48:52 +01:00
mmattu-wd a3ffe6611b add langsmith tracing initialized from environment variables (#6271) 2026-04-28 17:41:09 -07:00
yau-wd da8b251a9a Fix FLOWISE 566 OAuth2 (#6276)
* fix: flowise 556 oauth2

* fix(flowise-566): code review suggestions from Gemini

* feat(oauth2Security.test.ts): add test script

* feat(constants.ts): add Pipedream to default OAuth2 allowed domains
2026-04-28 21:22:48 +08:00
Ilangoandyau-wd d81483b70c fix: flowise-146 (#6170)
* fix: add tenant guards for multiple controllers

* fix: review feedback

* fix: revert permission gate

* add: workspace and organization scoping/tenant guards

* add: workspace and organization scoping/tenant guards for upsert history endpoints

* add: workspace scoping for openai assistant vector store endpoints

* add: org scoping for workspace user endpoint

* add: workspace scoping for dataset, dataset rows, documentstore preview, and evaluations services

* add: workspace scoping for oauth2 authorize endpoint

* fix: issues

* fix: ui issues

* fix: review feedback

* fix: review feedback

* fix: remove test script

* add: tests for tenant request guards

* update: workspace scoping for patch upsert history

---------

Co-authored-by: yau-wd <[email protected]>
2026-04-28 17:44:44 +05:30
Ilango 700137738b update: eval base url (#5738)
* update: eval base url

* update: eval base url
2026-04-28 17:36:56 +05:30
Henry Heng c5755574b1 Chore/Remove Deprecated Parameters For Opus 4.7 (#6294)
* fix(ChatAnthropic): remove deprecated parameters for models after Claude Opus 4.6

* updated AWSChatBedrock, ChatAnthropic, and ChatGoogleVertexAI components to handle newer Anthropic Claude models and their specific requirements

* revert targetNode changes
2026-04-28 12:29:12 +01:00
Henry Heng 47cc8c5548 Chore/update mcp sdk version, update slack, github, brave mcp (#6293)
update mcp sdk version, update slack, github, brave mcp
2026-04-28 12:29:01 +01:00
tiancizhouandClaude Sonnet 4.6 42d61f54a4 docs/ui: fix typos in user-facing copy (#6303)
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
2026-04-28 12:27:33 +01:00
chloebyun-wdandChloe Byun c79fe56a6c bug: Block read_pickle and class definitions, restrict custom CSV field to read_csv() only (#6257)
* bug: Block read_pickle and class definitions, restrict custom CSV field to read_csv() only

* pr

---------

Co-authored-by: Chloe Byun <[email protected]>
2026-04-27 14:55:27 -07:00
j-sanaa 3d69baed40 Fix/agentflow Fixing agentflow UI style and make it similar to v2 (#6280)
* Fix output node not selectable

* Fix highlight color

* Fix previous node displaying label and not ID

* Fix tool arguements not being called

* Fix dropdown values to not be bold

* Add standard sizing for all input text

* FIx syntax highlighting styling

* Use predefined tokens for font weight and size

* Fix dialog size of Source

* Fix color of syntax highlight in dark mode

* Fix the input fileds color in dark and regular mode

* Fix gemini comments

* FIx inconsistent spacing

* Standardise gap between label and field

* Remove export for unused function and standardize dialog size accrosss code, rich text,
  and source

* Fix test error
2026-04-27 09:15:16 -07:00
fed53e46b8 chore: update Node.js version consistency and optimize Docker build (#6285)
* chore: update Node.js version consistency and optimize Docker build

- Bump .nvmrc from v20.19.2 to v20.20.2 to match CI
- Narrow package.json engines to ^20 across root and packages/server
- Exclude @flowiseai/agentflow and @flowiseai/observe from Docker build
  to save ~40-50s per build (sdk packages not needed for app runtime)

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* chore: add build:docker script and fix Docker build filter

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* chore: update README files Node.js version to 20.0.0

---------

Co-authored-by: Claude Sonnet 4.6 <[email protected]>
Co-authored-by: yau-wd <[email protected]>
2026-04-27 20:20:35 +08:00
Abdul Samad Siddiqui ccc7d23baa feat: add GPT-5.5 and GPT-5.5 Pro to OpenAI chat models (#6278)
* feat(models): add gpt-5.5 and gpt-5.5-pro to chatOpenAI

  OpenAI released GPT-5.5 on April 23, 2026. Add both variants to the
  chatOpenAI model list with confirmed pricing:
  - gpt-5.5: /0 per 1M input/output tokens
  - gpt-5.5-pro: 0/80 per 1M input/output tokens

* feat(models): add gpt-5.5 and gpt-5.5-pro to chatOpenAI_LlamaIndex
2026-04-27 11:44:50 +01:00
yau-wdandgemini-code-assist[bot] b17dabbb26 Fix FLOWISE-319 Sanitize User (#6269)
* fix(account): flowise-319 sanitize user

* Update packages/server/src/enterprise/services/account.service.ts

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

---------

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
2026-04-27 16:20:23 +08:00
Jocelyn Lin 99805d6ac2 chore: update agentflow workflow and add changelog (#6284)
* chore: update agentflow workflow and add changelog

- Enhanced the npm dist-tag description in the publish-agentflow.yml workflow to clarify options for development, pre-release, and stable versions.
- Introduced a new CHANGELOG.md file for the @flowiseai/agentflow package, documenting notable changes and adhering to the Keep a Changelog format.
- Updated README.md to reflect the current development status and features of the agentflow package, including detailed descriptions of functionalities and examples.

* update TESTS.md to include TipTap mock
2026-04-24 15:29:23 -07:00
Henry Heng 1298a392d8 Chore/pin axios to 1.15.0 (#6282)
pin axios to 1.15.0
2026-04-24 18:19:56 +01:00
yau-wd ec7a7f9ebe Chore update Node.js version to 20.20.2 in CI workflows (#6277)
chore: update Node.js version to 20.20.2 in CI workflows
2026-04-23 11:27:06 -07:00
Hoang DoanandHenry 3d7597717a feat: implement the custom MCP Server in tool (#6205)
* feat: implement the custom MCP Server in tool

- Implemented MCPServersTable for displaying MCP server data with status badges and tools count.
- Created CustomMcpServerDialog for adding and editing custom MCP servers with validation and authorization features.
- Integrated MCP server management into the Tools view with tabbed navigation for Custom Tools and Custom MCP Servers.
- Added pagination and loading states for MCP servers.

* tfix nodes.test.ts ESM load crash

* feat(custom-mcp): harden security, scalability, and UI polish

* enhance custom mcp server creation flow and UI updates

* feat(mcp): add MCP server handshake timeout, enhance UI UX for editing custom mcp server

---------

Co-authored-by: Henry <[email protected]>
2026-04-23 16:52:07 +01:00
SyncWithRaj a4b3f6f1f6 docs: fix broken environment variable docs links in markdown files (#6255)
* docs: fix broken environment variables link

* docs: fix broken environment variables links at all places
2026-04-23 10:56:54 +01:00
Jocelyn Lin d226cc98e1 feat(observe): add initial package structure and configuration for @flowiseai/observe (#6270)
* feat(observe): add initial package structure and configuration for @flowiseai/observe

- Introduced the @flowiseai/observe package with a modular architecture for observing AI agent executions and evaluations.
- Added essential files including ESLint and Prettier configurations, Jest setup, and TypeScript configuration.
- Created foundational components and documentation for usage, testing, and architecture.
- Updated pnpm-lock.yaml with new dependencies for the observe package.

This commit sets the groundwork for further development of the observability features.

* fix(observe): enhance documentation and improve execution polling logic

- Updated README.md to clarify the permissions required for the API token.
- Added cleanup logic in ExecutionDetail component to prevent memory leaks by removing event listeners on unmount.
- Improved clipboard copy functionality to check for navigator.clipboard availability.
- Adjusted useExecutionPoll hook dependencies to include fetchExecution for better stability.
- Enhanced unit tests for useExecutionTree and useObserveApi to ensure proper error handling and functionality.
2026-04-22 13:58:42 -07:00
abdullah-workday 34ab4e0de4 Refactoring Validation logic into separate function (#6272) 2026-04-22 13:39:44 -07:00
Henry Heng ea68f9a859 fix(mcp): preserve tool input schema types and required fields (#6248)
* fix(mcp): preserve tool input schema types and required fields

* Update OpenAIAssistant.ts

* replace zod-to-json-schema with toolSchemaToJsonSchema for schema normalization

* enhance isZodSchema validation and handle null schemas in toolSchemaToJsonSchema
2026-04-21 14:28:15 +01:00
Junghwanandyau-wd 1e21e61dad fix(server): preserve custom iframe allowlists in frame headers (#6232)
* Preserve explicit iframe allowlists when hardening frame headers

The clickjacking fix correctly added frame-ancestors controls, but custom allowlists still emitted X-Frame-Options: DENY. This keeps SAMEORIGIN for 'self' and DENY for 'none', while letting explicit allowlists rely on CSP alone so supported embeds continue to work.

Constraint: Legacy X-Frame-Options cannot express arbitrary allowlists

Rejected: Keep DENY for all non-self values | breaks documented IFRAME_ORIGINS allowlists

Confidence: high

Scope-risk: narrow

Reversibility: clean

Directive: Keep CSP as the source of truth for custom iframe allowlists; do not reintroduce contradictory XFO headers

Tested: Added unit coverage for wildcard, self, none, and custom allowlists; local header reproduction for custom origin

Not-tested: Full browser iframe E2E across legacy browsers

* Avoid malformed iframe CSP values while removing per-request header recomputation

Gemini's review pointed out two low-risk improvements that strengthen the
existing iframe allowlist fix without changing its intent: normalize away empty
CSV tokens before building frame-ancestors, and compute the static header set
once during app startup instead of rebuilding it on every request.

Constraint: IFRAME_ORIGINS is startup configuration, not a dynamic per-request input
Rejected: Larger header-construction refactor | not necessary to address the concrete review feedback
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep CSP token normalization aligned with explicit allowlists so empty CSV segments never leak into frame-ancestors
Tested: pnpm --dir packages/server test -- src/utils/XSS.test.ts --runInBand
Not-tested: Full browser iframe embed verification against a running server

---------

Co-authored-by: yau-wd <[email protected]>
2026-04-21 16:31:13 +08:00
Jocelyn LinandClaude Sonnet 4.6 3542a047ec fix(agentflow): fix variable resolution, credential sync, and add E2E example (#6245)
* fix(agentflow): fix variable resolution, credential sync, and add E2E example

- Fix variable picker emitting {{nodeId.data.instance}} instead of {{nodeId}}
- Fix customMention serializer using display label instead of node ID
- Fix Start node missing outputData.content for chatInput type
- Sync credential selection to nodeData.credential for server-side execution
- Add E2E example with save/delete/test-run FABs via canvasActions
- Simplify BasicExample to minimal canvas-only usage
- Fix act() warnings in TooltipWithParser and useAsyncOptions tests

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* fix(agentflow): add user-facing error feedback for save failures in E2E example

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* fix(agentflow): fix variable chip display and revert Start node content field

- VariableInput: show {{nodeId}} in mention chip instead of display label,
  consistent with the value serialized to flow data
- useAvailableVariables: exclude startAgentflow from upstream node outputs;
  users reference the question via {{question}} (global variable), matching
  agentflow v2 behavior — no Start node change or server change needed
- Start.ts: revert outputData.content = input; Start node is no longer
  exposed as a node output variable in the picker

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

---------

Co-authored-by: Claude Sonnet 4.6 <[email protected]>
2026-04-20 11:04:26 -07:00
Abdul Samad SiddiquiandHenry Heng 674bfc7409 feat(components): Add support for Anthropic Claude Opus 4.7 (#6247)
* feat(components): add support for Claude Opus 4.7 model and logic

* fix(components): update thinkingEffort description to include newer Opus models

* Update models.json for opus 4-7

---------

Co-authored-by: Henry Heng <[email protected]>
2026-04-20 16:10:53 +01:00
Henry Heng 62b56d08a7 Bugfix/Missing Reasoning Item (#6237)
* - pass langchain message instance as a whole to avoid missing reasoning item
- add `normalizeMessagesForStorage` function to convert LangChain message instances into plain JSON objects, improving database storage efficiency and UI readability

* - Fix ChatflowConfigurationDialog for inconsistent behaviour
- Added a button in NodeExecutionDetails to toggle visibility of all available tools, improving user experience.

* display input data for tool node in execution
2026-04-20 12:12:38 +01:00
jchui-wdandClaude Sonnet 4.6 e10a4ca0d8 bugfix: message panel crashes via large chat volume (#6191)
* fix: replace full message load in stats endpoint with SQL COUNT queries

* fix: replace full message load in stats endpoint with SQL COUNT queries

Loading all messages into memory to compute stats caused OOM crashes with
large chat volumes. Replaced with parallel SQL COUNT queries that never load
message rows. The feedbackTypes filter now uses a correlated subquery to
avoid hitting PostgreSQL's parameter limit at high feedback volumes.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* feedback filters were incorrectly filtering messages with feedback of the WHOLE session, instead of just the feedback + previous message. Added code to count preceding messages as count to mimic previous functionality

* fix: consolidate stats queries from 4 round-trips into 1 combined query

Replace 4 separate COUNT QueryBuilders (totalMessages, totalSessions,
totalFeedback, positiveFeedback) with a single query using addSelect
and CASE WHEN for the positive feedback breakdown. When a feedbackTypes
filter is active, reduce from 5 round-trips down to 2 (combined + preceding).
Update tests to match the new single getRawOne call and aliased column names.

---------

Co-authored-by: Claude Sonnet 4.6 <[email protected]>
2026-04-17 14:09:49 -07:00
JunghwanandHenry Heng 42b9157f8c fix(mcp): guard malformed form option metadata in chatflow MCP schema generation (#6233)
* Reject malformed MCP form option metadata before schema generation crashes

Chatflow-as-MCP-server assumes addOptions is always an array for form fields of type 'options'. Imported or malformed configs can carry '', null, or undefined instead, which throws during schema generation. This change fails fast with a controlled validation path and adds coverage for those cases.

Constraint: Fix should stay inside the server-side MCP endpoint path

Rejected: Normalize all malformed values silently | hides bad config state and weakens feedback

Confidence: high

Scope-risk: narrow

Reversibility: clean

Directive: Keep MCP schema generation defensive around imported flow JSON shapes

Tested: Added unit coverage for string, undefined, and null addOptions cases; local runtime repro confirms prior crash modes

Not-tested: Full end-to-end MCP initialize/tools-list call against a running server

* Keep malformed MCP option metadata from taking down form tool schemas

The maintainer follow-up on the MCP schema fix asked for malformed or empty
options metadata to be ignored rather than treated as a fatal configuration
error. This updates the schema builder to skip unusable enum fields, adds test
coverage for those cases, and narrows the start-node shape locally so the
server-side test can compile against the current interface types.

Constraint: Maintainer requested skip semantics for invalid/empty addOptions instead of hard failure
Rejected: Preserve throw-on-invalid behavior | conflicts with upstream maintainer direction
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep malformed or empty options metadata non-fatal; omit that field rather than breaking the whole MCP tool schema
Tested: pnpm --dir packages/components build; pnpm --dir packages/server test -- src/services/mcp-endpoint/index.test.ts --runInBand
Not-tested: End-to-end MCP initialize/tools/list flow against a live server

* add schema checks for input.addOptions

---------

Co-authored-by: Henry Heng <[email protected]>
2026-04-17 21:48:47 +01:00
github-actions[bot]andgithub-actions[bot] 19b64e5803 chore: bump @flowiseai/agentflow to 0.0.0-dev.13 (#6244)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-17 10:10:54 -07:00
j-sanaa 0fc44e6b0e Fix(agentflow) - Fix z-index for validation button (#6238)
* Fix z-index for validation

* Reverting changes to ValidationFeedback.tsx

* Use tokens for z index
2026-04-16 16:23:07 -07:00
VaidikFlow 1194c97069 Bring canvas buttons to same z-index level (#6235)
* Bring canvas buttons to same z-index level

* gemini suggested Fixes

* missing space
2026-04-16 12:27:03 -07:00
j-sanaa 11a9c924a2 Fix/agentflow Fixed theming for dark mode in agentflow (#6234)
* To highlight input fiels in dark mode

* Fix background color of edit node dialog

* Fix background color for input messages field

* Fix Message container

* Fix border container color

* Make token be referenced by name

* Revert changes to server file

* Fix gemini comments
2026-04-16 09:53:49 -07:00