langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 20:15:31 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Workflow with uninstalled plugin nodes can be published, causing runtime failure #21030

New Issue
Closed
opened 2026-02-21 20:10:20 -05:00 by yindo · 1 comment
yindo commented 2026-02-21 20:10:20 -05:00
Owner
Copy Link
Copy Source

Originally created by @lyzno1 on GitHub (Dec 14, 2025).

Originally assigned to: @lyzno1 on GitHub.

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

main branch (latest)

Cloud or Self Hosted

Self Hosted (Source)

Steps to reproduce

  1. Create a new workflow
  2. Add a Tool node (or DataSource node, or TriggerPlugin node) that uses a plugin
  3. Uninstall the plugin from Plugins page (or import a workflow that contains nodes using plugins you don't have installed)
  4. Go back to the workflow - the node shows a locked overlay with "Install from Marketplace" button (this is correct)
  5. Click "Publish" button
  6. The workflow is published successfully (this is the bug)
  7. Try to run the published workflow
  8. The workflow fails with ToolProviderNotFoundError at runtime

✔️ Expected Behavior

When a workflow contains nodes with uninstalled plugins, the publish operation should be blocked. The checklist panel should display these nodes as having errors (like "Plugin is not installed"), preventing the user from publishing an invalid workflow.

❌ Actual Behavior

The workflow can be published even when it contains nodes with uninstalled plugins. The frontend checkValid function returns no error because the tool schema is empty when the plugin is not installed, causing all validation to be skipped. The checklist panel does not show any warning for these nodes.

The workflow only fails at runtime when trying to execute, which is a poor user experience as the user has already published the workflow.

Root cause analysis:

  1. getToolCheckParams in web/app/components/workflow/utils/tool.ts returns empty formSchemas when the plugin is not installed (since currCollection and currTool are both undefined)
  2. checkValid in node's default.ts validates required fields against the schema, but since the schema is empty, no validation errors are reported
  3. The checklist (useChecklist hook) does not check for _pluginInstallLocked status on plugin-dependent nodes
  4. handleCheckBeforePublish also does not check for this status

This issue affects three node types:

  • Tool nodes
  • DataSource nodes
  • TriggerPlugin nodes
Originally created by @lyzno1 on GitHub (Dec 14, 2025). Originally assigned to: @lyzno1 on GitHub. ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version main branch (latest) ### Cloud or Self Hosted Self Hosted (Source) ### Steps to reproduce 1. Create a new workflow 2. Add a Tool node (or DataSource node, or TriggerPlugin node) that uses a plugin 3. Uninstall the plugin from Plugins page (or import a workflow that contains nodes using plugins you don't have installed) 4. Go back to the workflow - the node shows a locked overlay with "Install from Marketplace" button (this is correct) 5. Click "Publish" button 6. The workflow is published successfully (this is the bug) 7. Try to run the published workflow 8. The workflow fails with `ToolProviderNotFoundError` at runtime ### ✔️ Expected Behavior When a workflow contains nodes with uninstalled plugins, the publish operation should be blocked. The checklist panel should display these nodes as having errors (like "Plugin is not installed"), preventing the user from publishing an invalid workflow. ### ❌ Actual Behavior The workflow can be published even when it contains nodes with uninstalled plugins. The frontend `checkValid` function returns no error because the tool schema is empty when the plugin is not installed, causing all validation to be skipped. The checklist panel does not show any warning for these nodes. The workflow only fails at runtime when trying to execute, which is a poor user experience as the user has already published the workflow. **Root cause analysis:** 1. `getToolCheckParams` in `web/app/components/workflow/utils/tool.ts` returns empty `formSchemas` when the plugin is not installed (since `currCollection` and `currTool` are both undefined) 2. `checkValid` in node's `default.ts` validates required fields against the schema, but since the schema is empty, no validation errors are reported 3. The checklist (`useChecklist` hook) does not check for `_pluginInstallLocked` status on plugin-dependent nodes 4. `handleCheckBeforePublish` also does not check for this status This issue affects three node types: - Tool nodes - DataSource nodes - TriggerPlugin nodes
yindo added the 🐞 bug label 2026-02-21 20:10:20 -05:00
yindo closed this issue 2026-02-21 20:10:20 -05:00
yindo commented 2026-02-21 20:10:20 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 14, 2025):

You’ve correctly identified the root cause: the validation logic for Tool, DataSource, and TriggerPlugin nodes is schema-driven, and when a plugin is uninstalled, the schema is empty—so all validation is skipped and publishing is allowed. The relevant functions (getToolCheckParams, checkValid, useChecklist, and handleCheckBeforePublish) do not check for plugin installation status or the _pluginInstallLocked flag, which is why the checklist and pre-publish validation miss these cases and workflows with missing plugins can be published, leading to runtime errors like ToolProviderNotFoundError (source).

To fix this, you’ll want to update the checklist and pre-publish validation logic to explicitly check for plugin installation status (for example, by inspecting _pluginInstallLocked or similar flags on plugin-dependent nodes). If a node is locked due to a missing plugin, the checklist should show an error and publishing should be blocked, even if the schema is empty. This will prevent invalid workflows from being published and improve the user experience.

Let me know if you want a more detailed breakdown of where to add these checks or how to structure the error messages in the UI.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Dec 14, 2025): <!-- Answer --> You’ve correctly identified the root cause: the validation logic for Tool, DataSource, and TriggerPlugin nodes is schema-driven, and when a plugin is uninstalled, the schema is empty—so all validation is skipped and publishing is allowed. The relevant functions (`getToolCheckParams`, `checkValid`, `useChecklist`, and `handleCheckBeforePublish`) do not check for plugin installation status or the `_pluginInstallLocked` flag, which is why the checklist and pre-publish validation miss these cases and workflows with missing plugins can be published, leading to runtime errors like `ToolProviderNotFoundError` ([source](https://github.com/langgenius/dify/blob/3653f54bea78e1bba1ad45cc9c97f52b55a0c1b8/web/app/components/workflow/hooks/use-checklist.ts#L121-L407)). To fix this, you’ll want to update the checklist and pre-publish validation logic to explicitly check for plugin installation status (for example, by inspecting `_pluginInstallLocked` or similar flags on plugin-dependent nodes). If a node is locked due to a missing plugin, the checklist should show an error and publishing should be blocked, even if the schema is empty. This will prevent invalid workflows from being published and improve the user experience. Let me know if you want a more detailed breakdown of where to add these checks or how to structure the error messages in the UI. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/7bd66f6c-da96-438c-ab14-a264d9852192?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/7bd66f6c-da96-438c-ab14-a264d9852192?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/7bd66f6c-da96-438c-ab14-a264d9852192?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/7bd66f6c-da96-438c-ab14-a264d9852192?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/7bd66f6c-da96-438c-ab14-a264d9852192?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/7bd66f6c-da96-438c-ab14-a264d9852192?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/7bd66f6c-da96-438c-ab14-a264d9852192?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=You%E2%80%99ve%20correctly%20identified%20the%20root%20cause%3A%20the%20validation%20logic%20for%20Tool%2C%20DataSource%2C%20and%20TriggerPlugin%20nodes%20is%20schema-driven%2C%20and%20when%20a%20plugin%20is%20uninstalled%2C%20the%20schema%20is%20empty%E2%80%94so%20all%20validation%20is%20skipped%20and%20publishing%20is%20allowed.%20The%20relevant%20functions%20%28%60getToolCheckParams%60%2C%20%60checkValid%60%2C%20%60useChecklist%60%2C%20and%20%60handleCheckBeforePublish%60%29%20do%20not%20check%20for%20plugin%20installation%20status%20or%20the%20%60_pluginInstallLocked%60%20flag%2C%20which%20is%20why%20the%20checklist%20and%20pre-publish%20validation%20miss%20these%20cases%20and%20workflows%20with%20missing%20plugins%20can%20be%20published%2C%20leading%20to%20runtime%20errors%20like%20%60ToolProviderNotFoundError%60%20%28%5Bsource%5D%28https%3A//github.com/langgenius/dify/blob/3653f54bea78e1bba1ad45cc9c97f52b55a0c1b8/web/app/components/workflow/hooks/use-checklist.ts%23L121-L407%29%29.%0A%0ATo%20fix%20this%2C%20you%E2%80%99ll%20want%20to%20update%20the%20checklist%20and%20pre-publish%20validation%20logic%20to%20explicitly%20check%20for%20plugin%20installation%20status%20%28for%20example%2C%20by%20inspecting%20%60_pluginInstallLocked%60%20or%20similar%20flags%20on%20plugin-dependent%20nodes%29.%20If%20a%20node%20is%20locked%20due%20to%20a%20missing%20plugin%2C%20the%20checklist%20should%20show%20an%20error%20and%20publishing%20should%20be%20blocked%2C%20even%20if%20the%20schema%20is%20empty.%20This%20will%20prevent%20invalid%20workflows%20from%20being%20published%20and%20improve%20the%20user%20experience.%0A%0ALet%20me%20know%20if%20you%20want%20a%20more%20detailed%20breakdown%20of%20where%20to%20add%20these%20checks%20or%20how%20to%20structure%20the%20error%20messages%20in%20the%20UI.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/29629)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#21030
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?