* fix: available dependencies in sandbox
* fix: better url validation and prevent arbitrary url injection into the sandbox
* fix: permissions in docker
* revert: all docker-related changes
* fix: review feedback
* add: new executions:update permissions and apply it to PUT /api/v1/executions endpoint
* add: executions:update permissions check in UI
* fix: review feedback
* update: node version
* fix: lint issues
* add: missing dependency in ci for faiss
* fix: pin pnpm version
* fix: more dependency issues
* fix: even more dependency issues
* update: pnpm overrides
* revert: experimental changes
* fix(httpSecurity.ts): flowise 453
* fix(httpSecurity.ts): ensure IP comparison uses parsed IP format
* fix(httpSecurity.ts): improve IP denial logic by using CIDR parsing and adjusting masks
* fix(httpSecurity.ts): skip malformed IPv4-mapped CIDR entries in deny list processing
* fix(httpSecurity.ts): enhance IP denial logic to handle non-canonical IPv6 addresses and improve entry comparison
Pricing values in chatMistralAI and chatCohere were entered as $/1K tokens
instead of the $/token unit used by every other provider in this file.
All 17 Mistral models and 5 Cohere models had their input_cost and
output_cost divided by 1000 to match actual published pricing:
- open-mistral-nemo: $0.15/M tokens (was showing $150/M)
- mistral-large-latest: $2/M in, $6/M out (was showing $2000/$6000)
- command-r-plus-08-2024: $2.50/M in, $10/M out (was showing $2500/$10000)
- command-r-08-2024: $0.15/M in, $0.60/M out (was showing $150/$600)
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
* guard prediction API against webhook/schedule trigger flows and surface trigger-specific API snippets
* Enhance error message for webhook trigger configuration in executeAgentFlow function to include the configured HTTP method
* update: type field for some credentials where string type could expose secrets
* update: contribution docs with note on adding credential files
* update: add reveal for url type, permissions for get credential by id
* fix: review feedback
* fix: review feedback
* update: agentflow package with credentials ui changes
* fix: test coverage, add tests for changes in CreateCredentialDialog
* revert: changes to agentflows package
* fix(server): remove ungated overrideConfig spread into flowConfig/flowData
The spread allowed API callers to inject arbitrary keys into the $flow.*
template namespace — bypassing the per-parameter gating that
replaceInputsWithConfig() enforces. Properly gated override paths
(replaceInputsWithConfig, $vars) are unaffected.
Closes FLOWISE-308
* added chatflowId and apiMessageId into flowData in buildFlow
* Implement Node versioning
* Add new example for showing outdated versions
* Remove header sync button
* Test changes
* ix lint error
* Fix gemini comments
* Udpate example to show no verison, outdated and correct version
* Add Sync as a FAB button
* Increase test coversge
* Add 2 sceaniors to exampels to make it clearer
* Fix gemini comments
* Fix review comments
* Fix review comments
* feat(ambient-agents): Add webhook trigger UI on start node (#6068)
* feat(ambient-agents): Add webhook trigger UI on start node, handles in both canvas, agentflow is out of scope but shows temporary ui
* fix: resolve webhookURL copy button not appearing after first save
useParams() does not update when window.history.replaceState() is used
on first save (bypasses React Router). Fall back to Redux canvas.chatflow.id
so NodeInputHandler re-renders reactively when SET_CHATFLOW is dispatched.
* feat/365-366-Webhooks-Server-Route-And-Execution (#6164)
* feat(webhooks): add server route and validation for webhook trigger
- POST /api/v1/webhook/:id route (accepts all HTTP methods via router.all)
- Validates chatflow exists and is configured as webhookTrigger, returns 404 otherwise
- Wraps raw webhook payload as incomingInput.webhook for buildAgentflow
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* feat(agentflow): wire up webhook flow execution (FLOWISE-366)
- Resolve {{ $webhook.field }} template variables in agentflow nodes
- Add required body param validation in webhook service
- Whitelist /api/v1/webhook/ to bypass global auth middleware
- Set $input to JSON payload in custom function nodes for webhook flows
- Add $webhook. autocomplete suggestions in node editors
- Unit tests for body param validation and pre-mutation body pass-through
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* feat(webhooks): namespace webhook payload under $webhook.body.*
- Wrap webhook body as { webhook: { body } } in controller so $webhook.body.*,
$webhook.headers.*, and $webhook.query.* can coexist as distinct namespaces
- Update suggestion option IDs/labels in UI from $webhook.* to $webhook.body.*
- Restrict webhookTrigger start option to agentflowv2 client only
- Remove static webhookURL placeholder from NodeInputHandler (agentflow)
---------
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
* feat/389-Webhooks-Headers-Query-params-Methods-validation (#6217)
* feat(ambient-agents): Add webhook trigger UI on start node, handles in both canvas, agentflow is out of scope but shows temporary ui
* fix: resolve webhookURL copy button not appearing after first save
useParams() does not update when window.history.replaceState() is used
on first save (bypasses React Router). Fall back to Redux canvas.chatflow.id
so NodeInputHandler re-renders reactively when SET_CHATFLOW is dispatched.
* feat(webhooks): add headers, query params & body validation to webhook trigger
- Add webhookTrigger input type to Start node with HTTP method, content
type, and expected headers/query/body param configuration
- New /api/v1/webhook/:id route with method, content-type, header, body,
and query param validation (400/405/415 on mismatch)
- Namespace webhook payload as $webhook.body.*, $webhook.headers.*,
$webhook.query.* in the flow runtime
- Resolve $webhook.* variables in downstream nodes via buildAgentflow.ts
- Auto-unwrap form-encoded `payload` JSON strings (e.g. GitHub webhooks)
so $webhook.body.* paths work regardless of content type
- Expose webhook variable suggestions in the node variable picker
- Show copyable webhook URL in the Start node canvas UI
* fixed a bug where downstream nodes cant reference values via node id, and a lowercase headers issue
* feat:533 webhook secrets (#6227)
* feat: add webhook secret & HMAC signature verification to webhook trigger
Adds server-side webhook secret management (generate/clear/verify) and a
UI control in the Start node for configuring the secret, signature header,
and signature type (HMAC-SHA256 or plain token). Raw request body is now
captured before JSON parsing so HMAC signatures can be verified against the
original bytes. Migrations added for all four supported databases.
* fix: accept string-coerced numbers and booleans in webhook body type validation
application/x-www-form-urlencoded payloads deliver all values as strings,
so the strict typeof check was incorrectly rejecting valid numeric ("42")
and boolean ("true"/"false") values. Updated the filter to coerce and
validate instead, with tests covering both JSON and form-encoded cases.
* fix: prevent mass-assignment of webhookSecret fields in chatflow create/update
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
* feat:367 | Webhooks - Human Input + Callback Support (#6263)
* Added HITL support for webhooks
* feat: add async callback URL to webhook trigger
Optional Callback URL / Secret on the Start node (or x-callback-url
header). Webhook now returns 202 immediately and POSTs SUCCESS,
STOPPED (HITL), or ERROR to the callback URL, signed with HMAC-SHA256
when a secret is set. Retries 3x with 0s/3s/6s backoff.
* used getErrorMessage for error messages
* feat: add object/array body param types and per-option show/hide on d… (#6273)
* feat: add webhook secret & HMAC signature verification to webhook trigger
Adds server-side webhook secret management (generate/clear/verify) and a
UI control in the Start node for configuring the secret, signature header,
and signature type (HMAC-SHA256 or plain token). Raw request body is now
captured before JSON parsing so HMAC signatures can be verified against the
original bytes. Migrations added for all four supported databases.
* fix: accept string-coerced numbers and booleans in webhook body type validation
application/x-www-form-urlencoded payloads deliver all values as strings,
so the strict typeof check was incorrectly rejecting valid numeric ("42")
and boolean ("true"/"false") values. Updated the filter to coerce and
validate instead, with tests covering both JSON and form-encoded cases.
* Added HITL support for webhooks
* feat: add async callback URL to webhook trigger
Optional Callback URL / Secret on the Start node (or x-callback-url
header). Webhook now returns 202 immediately and POSTs SUCCESS,
STOPPED (HITL), or ERROR to the callback URL, signed with HMAC-SHA256
when a secret is set. Retries 3x with 0s/3s/6s backoff.
* feat: add object/array body param types and per-option show/hide on dropdowns
- Add object, array[string/number/boolean/object] as webhook body param types, available when content type is application/json
- Extend options fields with show/hide conditions so individual dropdown choices can be hidden based on other param values
* fix: prevent SSRF in webhook callback URL
Remove the x-callback-url header override that allowed any external
caller to control where the server sends POST requests. Callback URL
now only comes from the Start node config (authenticated users).
Add checkDenyList validation to block callback URLs targeting private
networks, cloud metadata endpoints, and loopback addresses.
* fix: exclude HTTP method from webhook URL copy
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* feat: enhance webhook functionality in Start node
- Added new input options for webhook handling, including input modes (Custom Text, No Input, Full Webhook Payload) and response modes (Synchronous, Asynchronous, Streaming).
- Implemented request signature verification and callback URL handling for asynchronous responses.
- Updated validation logic for webhook requests, including content type and required headers.
- Enhanced tests to cover new webhook features and validation scenarios
* adds a generic SSE observer primitive and a webhook listener registry that lets the canvas watch incoming webhook executions live
* fix webhook tests by mocking webhook listener registry and updating expectations for chatId in createWebhook function
* fix: harden webhook trigger surface against SSRF, secret leakage, and listener data exposure
* fix: improve webhook listener reliability with initial heartbeat and logging
---------
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
Co-authored-by: Henry <[email protected]>
feat: remove scoped view option from ExecutionsListTable and update related components
- Removed the `scoped` prop from `ExecutionsListTable` to simplify the component.
- Adjusted the rendering logic to always display the Agentflow Name column.
- Updated comments in `ExecutionsViewer` to clarify the behavior of the agentflowId prop.
* feat: reusable publish workflow + @flowiseai/observe publish pipeline
* chore(observe): mark package as sideEffects: false
Addresses gemini-code-assist[bot] review feedback on PR #6341.
Enables tree-shaking of unused exports for consumer bundlers.
Audited src/ — no bare side-effect imports exist, so the claim is
accurate.
* show scheduled flow status
* enhance ScheduleStatusBadge to display loading state and update tooltip text. Refactor schedule status retrieval in Agentflows to handle errors and improve state management.
* feat(observe): ExecutionDetail with tree view, headers, and resizable drawer
## Summary
Ports the legacy `ExecutionDetails.jsx` (~984 lines) into the `@flowiseai/observe` SDK as a composable `ExecutionDetail` orchestrator.
- **`ExecutionDetail`**: split-pane (sidebar tree + node detail) with sidebar header that holds the agentflow chip, Copy-ID chip, formatted updated date, and refresh button. Auto-selects the first STOPPED node (or first top-level otherwise) on initial tree build.
- **`ExecutionTreeSidebar`**: `@mui/x-tree-view` `RichTreeView` with a custom `TreeItem2` slot — per-branch border colored from `AGENTFLOW_ICONS`, status-icon variants on each row, virtual `Iteration #N` containers, controlled expand/collapse defaulting to all-expanded.
- **`useExecutionTree`** rewritten to mirror the legacy three-pass `buildTreeData`: `previousNodeIds` parent→child with most-recent disambiguation, iteration grouping under the latest parent instance, sub-tree linking inside virtual containers, iterations-first sibling sort, and recursive `FLOWISE_CREDENTIAL_ID` scrub. Iteration container status is the legacy `ERROR > INPROGRESS > all-FINISHED > UNKNOWN` rollup.
- **`useDrawerWidths`** + `useResizableSidebar({ inverted })` extension drive a resizable `ExecutionsViewer` Drawer (parity with the legacy left-edge drag handle). Adds a public `ExecutionsViewerProps.drawer?: { defaultWidth?, minWidth?, maxWidth? }` override.
- **`AGENTFLOW_ICONS`** lifted from `atoms/NodeIcon.tsx` to `core/primitives/agentflowIcons.ts` so the tree slot can consume it without re-importing through `atoms`.
- **`ExecutionDetailProps.agentflow?: AgentflowRef`** seeds the header chip while the detail endpoint loads (server-side `getExecutionById` doesn't perform the agentflow join — only `getAllExecutions` does).
- Adds `@mui/x-tree-view` as a runtime dep.
## Test plan
- [x] `pnpm -C packages/observe test:coverage` — 331 tests pass, all `coverageThreshold` entries met (85.37% statements / 82.98% branches overall; `useExecutionTree` 96.5% / 85.18%, new `useDrawerWidths` 100% / 90.9%, `ExecutionDetail` 89.18% / 92.5%).
- [x] Manually verify in `packages/observe/examples` (`pnpm dev` after copying `.env.example` to `.env`):
- List → row click opens the resizable Drawer; left-edge handle widens/narrows.
- Tree shows status icons for each row plus rolled-up status on virtual iteration containers; `IconLoader` spins for INPROGRESS rows.
- Agentflow chip is clickable and opens the canvas in a new tab when `VITE_AGENTFLOW_CANVAS_URL` is set; non-clickable otherwise.
- Copy-ID chip flips inline to `Copied!` for 2s. **Behavior change from legacy**: legacy dispatched a Redux/notistack snackbar toast ("ID copied to clipboard") via the host app; the SDK can't assume a snackbar provider exists, so the confirmation is rendered on the chip itself.
- Refresh button re-fetches; date formatted as `MMM d, yyyy h:mm a`.
- Standalone `<ExecutionDetail>` demo by execution id renders the same surface without the list.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* address gemini review feedback
* fix flaky test and console warning in test
* fix drawer min/max edge case bug
* fix Copy ID chip falsely showing 'Copied!' on clipboard reject
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* fix(observe): iteration tree parity with legacy
Iteration metadata (parentNodeId/iterationIndex) is nested under `data`
in the runtime payload per IAgentflowExecutedData; the SDK was reading
from the top level so virtual Iteration #N containers never materialized
and iteration children dangled at root. Same shape fix applies to
humanInputAgentflow detection in useNodeData. Iteration parent input
now shows "No data" matching legacy's `data.input.question || '*No
data*'` fallback, and virtual Iteration #N containers are selectable
with empty Input/Output panels.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>
* feat: implement scheduling functionality for AgentflowV2
- Added ScheduleQueue class for managing scheduled jobs using BullMQ.
- Introduced scheduleService for creating, updating, and disabling schedules.
- Integrated schedule validation and cron expression handling.
- Enhanced chatflow service to manage schedules for agentflows.
- Added UI components for time and day selection (TimePicker, WeekDaysPicker, MonthDaysPicker).
- Updated NodeInputHandler to support new input types for scheduling.
- Improved validation for schedule configurations in agentflows.
* feat: implement schedule management for agentflows
- Refactor ScheduleQueue to utilize executeScheduleJob for job execution.
- Add new endpoints for schedule status retrieval and enabling/disabling schedules in chatflows.
- Update chatflow service to handle schedule creation, updates, and deletions more effectively.
- Introduce DatePicker component for date input in UI.
- Enhance CanvasHeader to manage schedule state and toggle functionality.
- Integrate schedule validation logic to ensure proper configuration before enabling schedules.
- Update dependencies to include node-cron for improved scheduling capabilities.
* feat(schedule): refactor schedule services and tests for schedule job
- Seperate the utils function from schedule service.
- Created comprehensive unit tests for all utility functions in `utils.test.ts`, covering various scenarios for cron expression validation, visual picker validation, and schedule resolution.
- Ensured proper handling of edge cases and error messages for invalid inputs.
* feat(schedule): remove timestamp in schedule tabes to support sqlite
- Change the way to update the existing schedule to avoid typescript issue when building.
- Add merge function in mockRepo in schedule service test.
* fix(schedule): add nullable to optional entity columns and entity interfaces
- Add nullable: true to lastRunAt, nextRunAt, endDate on ScheduleRecord
entity to match migration DDL and prevent runtime errors
- Add IScheduleRecord and IScheduleTriggerLog interfaces to Interface.ts
- Have entities implement their respective interfaces per codebase convention
* fixed tests and hide schedule input from package/agentflow
* feat: integrate IdentityManager into worker and queue management
- Remove supporting cron express with 6 fields (second)
- Calculate the prediction usage in cron job
* feat: add support for MIN_SCHEDULE_INTERVAL_SECONDS in cron job configuration and validation
* fixed broken tests
* UI UX fixes for scheduler in dark mode
* fix(schedule): remove unnecessary UUID generation in createOrUpdateSchedule
* adds required scheduleInputMode column with text/form/none variants, ChatType.SCHEDULED, trigger-logs endpoint + drawer UI, IANA timezone dropdown, and dark-mode UX polish.
* add deleteScheduleTriggerLogs endpoint and UI integration for log deletion
* feat: enhance cron job handling for last day of month (L) in ScheduleBeat and related utilities
Co-authored-by: Copilot <[email protected]>
* - fix(start-node): persist declared defaults of newly-visible fields so saves don't drop required values
- update ui for last day to include hints and next run datetime
---------
Co-authored-by: Jackie Chui <[email protected]>
Co-authored-by: Henry <[email protected]>
Co-authored-by: Copilot <[email protected]>
* Fix output node not selectable
* Fix highlight color
* Fix previous node displaying label and not ID
* Fix tool arguements not being called
* Fix dropdown values to not be bold
* Add standard sizing for all input text
* FIx syntax highlighting styling
* Use predefined tokens for font weight and size
* Fix dialog size of Source
* Fix color of syntax highlight in dark mode
* Fix the input fileds color in dark and regular mode
* Fix gemini comments
* FIx inconsistent spacing
* Standardise gap between label and field
* Remove export for unused function and standardize dialog size accrosss code, rich text,
and source
* Fix test error
* Fix opening node editing dialog on iteration node
* Untested change
* Add {{iteration}} variable
* Add node execution status to Iteration node
* Fix delete iteration node
* stream iteration node results incrementally when it is the terminal node
* Add test cases
* Fix edit color in dark mode and gemini comments
* Fix lint warnings
* Fix review comment - Add iterationEdge z-index value to tokens
* keep succesful and error messages in content
* Add removed comment
* Remove changes to server code in this PR
* feat(components): add missing languages to Code Text Splitter
The Code Text Splitter only exposed 16 languages natively supported
by @langchain/textsplitters. The Python LangChain library supports
many more. This adds 9 additional languages (c, csharp, cobol,
elixir, haskell, kotlin, lua, powershell, ts) with custom separators
ported from Python LangChain, while keeping existing languages on
the native fromLanguage() path.
* fix: address review feedback on language separators
C: replace class with struct/union/enum (C has no class keyword).
C#: remove implements (C# uses :), add namespace and struct.
Elixir: remove while (not a keyword in Elixir).
Kotlin: remove case (Kotlin uses when).
Fallback: return default splitter instead of calling fromLanguage
with an unsupported language.
* style: fix prettier formatting in CodeTextSplitter
* feat(observe) FLOWISE-575: port NodeExecutionDetail with hooks, atoms, and tool surfaces
Ports legacy NodeExecutionDetails.jsx (~1,285 LOC) to the observe SDK as a
composed orchestrator. Adds atoms (CodeFenceBlock, JsonBlock, NodeIcon),
core utils (guards, resolveTool, extractToolCalls), feature hooks
(useNodeData, useHumanInput, useResizableSidebar), and tool / condition /
HITL surfaces. Establishes the type-location and tier-3 conventions in
ARCHITECTURE.md and TESTS.md.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* fix(observe): use original index for fulfilled condition labels
Iterate the original conditions array and skip non-fulfilled entries so
"Condition N" matches the branch the user configured in the Condition
node editor. Legacy had the same filter-then-index pattern; this is a
deliberate deviation tagged with a // PARITY: comment.
Addresses review on #6310.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* fix(observe): cap JSON viewer height at 400px to match legacy
Bake legacy JSONViewer.jsx's `maxHeight: '400px'` default into the
JsonBlock atom so all call sites (Tools list, fulfilled conditions,
chat message JSON content, NodeContentRenderer JSON paths) scroll
inside a bounded frame instead of pushing the rest of the panel
off-screen. Previously only NodeContentRenderer applied a cap;
ToolAccordionList and FulfilledConditionsBlock were unbounded.
Drops the now-redundant DEFAULT_JSON_MAX_HEIGHT in NodeContentRenderer
and MESSAGE_JSON_MAX_HEIGHT in ChatMessageBubble — three copies of the
same 400 collapsed to the atom's single source of truth. The
jsonMaxHeight override path in NodeContentRenderer remains for
consumers that need a non-default cap.
Adds regression tests that compare emotion classNames against an
explicit-value control (jsdom can't compute MUI sx-applied CSS).
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>
* Integrate executuons API
* Fix Status indicators example to use AgetnContext
* Fix styling of HITL pause icon
* Tet changes for node executiom
* Fix lint error
* Chat panel implementation
* Import functionality from v2
* Fix proxy issues for chat
* Fix styling of chat
* Split out chat panel changes — execution UI only
Remove TestFlowDialog, TestFlowButton container, chat avatars, react-markdown/remark-gfm/fetch-event-source deps, uuid/fileMock mocks, and related vite proxy changes. These belong to feat-agentflow-chatpanel which will be opened on top of this branch.
Restore StyledFab to node-palette, restore old TestFlowButton component, and revert Agentflow.tsx/canvas index to pre-chat state so this branch contains only the node execution status UI work.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* chore(agentflow): remove TestFlowButton placeholder from execution branch
TestFlowButton belongs to the chat panel PR. Removing the placeholder
component, its exports, and its usage in Agentflow.tsx so this branch
contains only execution UI work.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* Add test changes
* FIx gemini comments
* Add dark mode toggle
* Remove Execution API references
* Update E2E to stream API responses
---------
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
yau-wd