Commit Graph

565 Commits

Author SHA1 Message Date
陈志谦
de029503ee docs: replace root-relative cross links with relative page links (#18664)
configurations.md and backup_and_migration.md cross-linked each other
via /migration#... and /configurations#s3-tigris. These host-absolute
paths match no route on the docs site (real pages live under
/administrator/...) and 404 on GitHub. Point them at the sibling
markdown files so both Docusaurus and GitHub can resolve them; the
existing anchors are preserved.

---------

Co-authored-by: jindou <jindou@local>
Co-authored-by: Jin Hai <haijin.chn@gmail.com>
2026-08-24 11:58:43 +08:00
陈志谦
c1ee17bebc fix: Invoke proxy uses validated URL; remove stray debug print in Canvas.reset (#18657)
### Summary

Two small fixes found during a code-review pass.

**1. `Invoke._build_proxies` sends the raw proxy string instead of the
normalized one**

**2. Leftover `print(self.variables)` in `Canvas.reset`**

---------

Co-authored-by: jindou <jindou@local>
2026-08-24 11:46:06 +08:00
Loong
c15241c3a9 fix(agent): reset execution path for new sessions (#18532) 2026-08-20 22:42:55 +08:00
D819
c466ff3b1a fix(llm): disable DeepSeek V4 thinking by default via extra_body (#18241)
## Summary
- Disable DeepSeek V4 thinking (chain-of-thought) by default.
- litellm 1.82.x drops `thinking: disabled`; carry the toggle through
`extra_body.thinking.type` and strip `reasoning_effort` to avoid the
400.
- Use local timezone for agent `sys.date` instead of UTC.

Reference: https://api-docs.deepseek.com/guides/thinking_mode

---------

Co-authored-by: Claude <claude@example.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Claude <noreply@anthropic.com>
2026-08-19 13:47:36 +08:00
Muhammad Furqan
c3153ba294 fix(agent/tools): port DeepL to ToolBase so it works as an Agent tool (#18395)
### Summary

Closes #18394.
2026-08-18 15:36:11 +08:00
var4dev
63a454084e fix(agent): close MCP sessions wrapped in MCPToolBinding (#18399) 2026-08-18 13:15:16 +08:00
Ilya Bogin
9c81d9be8b fix(agent/tools): read Keenable result content from snippet (#18341)
### Summary

Follow-up bug fix to #16233 (the Keenable search tool, merged
2026-06-25).
2026-08-17 20:25:24 +08:00
balibabu
e3d46efce3 Fix: The begin operator of the agent created from the template does not display a pattern. (#18367) 2026-08-17 17:12:50 +08:00
wenqian
c589a5d050 feat: add UCloud agent sandbox provider (#18088) 2026-08-13 15:33:03 +08:00
jay77721
e1b8366ecc refactor: remove resume (CV) workflow DSL template and Go handling code (#18177) 2026-08-13 10:47:37 +08:00
EthanZhang
1d8b9c7452 feat(agent): add Querit Contents tool (#18156)
### Summary

Add Querit Contents as a built-in page content tool for RAGFlow Agents
and Canvas workflows.

Querit Contents crawls one or more known URLs and returns their page
content and optional metadata. It complements the existing Querit Search
tool: Search discovers relevant pages, while Contents retrieves pages
already selected by an Agent or workflow.

This integration supports two usage modes:

- A standalone `QueritContents` node in Canvas workflows.
- An embedded content tool available to RAGFlow Agents.
2026-08-12 21:03:21 +08:00
Zhichang Yu
d9ed14ce9c feat: wiki incremental Mode A/B with durable rewrite barrier (#18122)
Port the wiki_incremental dataset-level merge and make its rewrite
barrier durable and concurrency-safe. Wiki pages merge replace-only; the
barrier persists a monotonic numeric generation, and a scheduler-backed
per-dataset lock closes the cross-process TOCTOU window. Adds the
Compiler Plan toggle (frontend) with Mode A grouping.
2026-08-11 22:10:49 +08:00
Carl Calaquian
ad6fdfd7b4 fix(sandbox): update Tenki SDKs and drop removed project_id (#18117)
### Summary

Brings both halves of the Tenki sandbox provider onto current SDKs and
removes `project_id`, which Tenki deleted from its API.

**Go:** `github.com/LuxorLabs/tenki-sdk-go/sandbox` `v0.5.2` → `v0.7.0`
(current latest).
**Python:** the provider's SDK was renamed on PyPI — `tenki-sandbox` is
frozen at 0.4.0 and everything from 0.5 ships as
[`tenki`](https://pypi.org/project/tenki/). The docs told operators to
`pip install tenki-sandbox`, which installs a stale SDK that no longer
matches this provider's expectations.

**`project_id` is gone.** Tenki removed project scoping from the sandbox
API in 0.5.x: `Client.create()` no longer accepts `project_id`, so the
current code path would raise `TypeError` against a current SDK. It was
also marked `required: True` in the config schema, so the Admin >
Sandbox Settings form asked for a value that no longer exists.
2026-08-11 20:37:21 +08:00
Wang Qi
a0438517bc Fix add agent update validation check (#18056) 2026-08-10 20:12:51 +08:00
Wang Qi
b978f94fa6 Fix: restrict max_retries as non-negative integer (#18051) 2026-08-10 20:02:24 +08:00
buua436
fc25076a11 fix: improve streaming agent tts (#18004) 2026-08-07 17:52:05 +08:00
buua436
a805105352 fix: stream agent tts audio by sentence (#18000) 2026-08-07 17:13:25 +08:00
Jack
1aa4e3c1f3 refactor(chunker): converge delimiter_mode to {delimiter, one}, drop token_size (#17979)
Converge `TokenChunker.delimiter_mode` from three values (`token_size`,
`delimiter`, `one`) to two (`delimiter`, `one`). The unified `delimiter`
mode now carries the old `token_size` semantics: when no active
(backtick) delimiter is present, text/JSON chunks are merged up to
`chunk_token_size`; when a backtick delimiter is present, the text is
split by it and not merged. `one` continues to be handled by the
separate `OneChunker`.
2026-08-07 16:11:42 +08:00
Zhichang Yu
2e37997ab9 Go knowledge compiler with scheduler-driven dataset compilation (#17913)
Ports dataset knowledge compilation (wiki/graph/tree/mindmap) to the Go
scheduler with a status contract, aligns wiki storage/retrieval with
Python, sizes prompts by content_length, and resolves embedding batch
size from provider capability.
2026-08-06 15:54:00 +08:00
Jin Hai
cf13082a1a Revert "feat: Go knowledge compiler with scheduler-driven dataset compilation" (#17897)
Reverts infiniflow/ragflow#17881
2026-08-05 21:50:28 +08:00
Zhichang Yu
14b943a04a feat: Go knowledge compiler with scheduler-driven dataset compilation (#17881)
Ports the dataset knowledge compilation (wiki/graph/tree/mindmap) to the
Go scheduler with a status contract, aligns wiki storage/retrieval with
Python, and sizes prompts by content_length.
2026-08-05 20:00:42 +08:00
Wang Qi
61d2747f6a Fix yahoo stock code extraction (#17816) 2026-08-05 10:17:50 +08:00
balibabu
4d9c62ab39 Fix: The tool icon for the agent operator created from the template is not clickable. (#17794) 2026-08-04 17:18:28 +08:00
balibabu
a18853abea Fix: The dataset for the retrieval operator of the agent created from the template cannot be selected. (#17760) 2026-08-04 15:22:26 +08:00
Hz_
79a57d2126 fix(py-agent): remove unavailable model defaults from templates (#17762)
## Summary

- Clear unavailable LLM defaults from built-in agent templates
- Avoid binding templates to unavailable provider models

## Testing

- `python3 -c 'import json, pathlib; [json.loads(p.read_text()) for p in
pathlib.Path("agent/templates").glob("*.json")]'`
- `git diff --cached --check`
2026-08-04 11:44:54 +08:00
Lynn
2e0dda59fc Fix: handle html tags in empty_response (#17657) 2026-08-03 11:14:18 +08:00
Zhichang Yu
29287ef74b refactor(knowledge_compiler): derive variant from template kind via single template id (#17630)
## Summary

Refactor the Go `KnowledgeCompilerComponent` so its parameter is a
**single string template id** instead of a DSL-level `variant` (or
plural group id list). The `variant` is no longer in the DSL — it is now
**derived at runtime from the resolved compilation template's `kind`
field**.

This aligns the Go ingestion port with the frontend Compiler operator,
which emits a singular `compilation_template_group_id` and does not
write `variant` into the generated `compiler.json`.
2026-07-31 18:01:55 +08:00
dependabot[bot]
dcaa62f118 build(deps): bump axios from 1.15.2 to 1.18.0 in /agent/sandbox/sandbox_base_image/nodejs (#17549) 2026-07-30 09:39:06 +08:00
EthanZhang
33e581a8b3 feat(agent): add Querit search tool (#17548) 2026-07-30 09:36:16 +08:00
Anupam Mediratta
43e73b3239 fix: upgrade axios to 1.15.2 (CVE-2026-42264) (#17508)
## Summary
Upgrade axios from 1.15.1 to 1.15.2 to fix CVE-2026-42264.

## Vulnerability
| Field | Value |
|-------|-------|
| **ID** | CVE-2026-42264 |
| **Severity** | HIGH |
| **Scanner** | trivy |
| **Rule** | `CVE-2026-42264` |
| **File** | `agent/sandbox/sandbox_base_image/nodejs/package-lock.json`
|
| **Assessment** | Likely exploitable |

**Description**: axios: Axios: Prototype pollution allows information
disclosure and request manipulation

---
*Automated security fix by [OrbisAI Security](https://orbisappsec.com)*
2026-07-29 12:25:02 +08:00
Wang Qi
d6f1475c5c Fix: no rate limit for sandbox run (#17503) 2026-07-29 11:19:06 +08:00
Anupam Mediratta
2a187e607f fix: upgrade axios to 1.15.1, 0.31.1 (CVE-2026-42033) (#17498)
## Summary
Upgrade axios from 1.13.6 to 1.15.1, 0.31.1 to fix CVE-2026-42033.

## Vulnerability
| Field | Value |
|-------|-------|
| **ID** | CVE-2026-42033 |
| **Severity** | HIGH |
| **Scanner** | trivy |
| **Rule** | `CVE-2026-42033` |
| **File** | `agent/sandbox/sandbox_base_image/nodejs/package-lock.json`
|
| **Assessment** | Likely exploitable |

**Description**: axios: Axios: HTTP Transport Hijacking via Prototype
Pollution

---
*Automated security fix by [OrbisAI Security](https://orbisappsec.com)*
2026-07-29 10:37:18 +08:00
yiming wang
dcadd8d837 feat: add Tenki sandbox provider (#17305)
### Summary

Adds a `tenki` sandbox provider that runs each agent code execution in a
disposable Tenki (https://tenki.cloud) microVM (create → exec → destroy,
no volumes or snapshots).
Registration mirrors PR #15039, configure `api_key` and `project_id` in
Admin > Sandbox Settings.

Both runtimes are covered:
- Python: `agent/sandbox/providers/tenki.py` (structured results +
artifact collection).
- Go: `internal/agent/sandbox/tenki.go`, mirroring the e2b provider and
wired into the provider manager.

`tenki-sandbox` is an optional dependency (it requires `protobuf>=6.31`,
which differs from RAGFlow's pinned gRPC stack), lazily imported with a
clear error when missing; installation is documented in the sandbox
quickstart.

Unit tests cover execution, structured results, artifacts
(symlink/size/extension limits), non-zero exit, timeout, error mapping,
and idempotent destroy.

---------

Co-authored-by: yiming.wang <yiming.wang@luxor.com>
2026-07-28 19:24:39 +08:00
Wang Qi
0fdefb284e Sandbox: bump rate limit from 5/second to 60/second (#928) (#17469) 2026-07-28 13:53:56 +08:00
Wang Qi
cd846cc9d4 Enhance: localhost:9385 -> sandbox-executor-manager:9385 (#17414) 2026-07-27 15:20:09 +08:00
Kevin Hu
742837ce56 Feat: Add graph keyword search and fix dataset synthesizing issue. (#17342)
### Summary

 Add graph keyword search and fix dataset synthesizing issue.
2026-07-24 18:00:43 +08:00
euvre
2f7dc60337 fix: restore download button when file type is selected in agent message (#17184) 2026-07-22 19:21:17 +08:00
Yurii214
4f1820bcaa fix(agent/tools): surface serpapi error responses in google search (#17062)
### Summary

`agent/tools/google.py` indexes `search["organic_results"]` directly
after `GoogleSearch(params).get_dict()`. serpapi returns `{"error":
...}` **without** an `organic_results` key on realistic conditions — an
invalid API key, an exhausted plan/quota, or a query that matched
nothing. that raised `KeyError('organic_results')`, which the tool's
retry loop then surfaced to the model as the opaque `"Google error:
'organic_results'"` instead of the real reason.

this guards the missing key and raises serpapi's actual `error` message
(with a clear fallback) into the existing retry/`_ERROR` path, so the
model sees e.g. `"Google error: Invalid API key."`. valid responses are
unchanged.

adds `test/unit_test/agent/tools/test_google_unit.py` covering the
error-response path (asserts the real message is surfaced, no
`KeyError`) and the normal result path, mirroring the existing
`test_googlescholar.py` pattern (skips when the `serpapi` SDK is
absent).

---------

Co-authored-by: Yaroslav98214 <diakovichyaroslav30@gmail.com>
2026-07-21 10:58:14 +08:00
euvre
f45f03a016 Add Go service/handler tests for API contract parity (#16905) 2026-07-20 20:02:41 +08:00
Yurii214
aff9ff6d0a fix(agent/tools): surface github search error responses (#17064)
### Summary

`agent/tools/github.py` indexes `response["items"]` directly after
`requests.get(...).json()`. the github search api returns `{"message":
...}` **without** an `items` key on realistic conditions — a rate limit
(403/429; this tool sends no auth token, so the unauthenticated ~10
req/min search limit is easy to hit) or an invalid query (422). that
raised `KeyError('items')`, which the tool's retry loop then surfaced to
the model as the opaque `"GitHub error: 'items'"` instead of the real
reason.

this guards the missing key and raises the api's actual `message` (with
a clear fallback) into the existing retry/`_ERROR` path, so the model
sees e.g. `"GitHub error: API rate limit exceeded ..."`. valid responses
are unchanged.

adds `test/unit_test/agent/tools/test_github_unit.py` covering the
rate-limit response (asserts the real message is surfaced, no
`KeyError`) and the normal result path.

Co-authored-by: Yaroslav98214 <diakovichyaroslav30@gmail.com>
Co-authored-by: Haruko386 <tryeverypossible@163.com>
2026-07-20 17:53:53 +08:00
qinling0210
995e405e8c Support pipeline DSL modification through dataset configuration (backend) (#16991)
…end)

### Summary

Support pipeline DSL modification through dataset configuration
(backend)

Key modification: knowledgebase.parser_config

---------

Co-authored-by: yzc <yuzhichang@gmail.com>
2026-07-17 14:40:09 +08:00
buua436
27d091b5b6 fix: make await response wait for user input (#16995)
### What problem does this PR solve?

Await Response incorrectly consumed the initial `sys.query` as its
input, so the first user interaction was skipped.

This change makes Await Response wait for actual user input while
preserving the existing initial-query behavior for the Begin node.

### Type of change

- [x] Bug Fix (non-breaking change which fixes an issue)
2026-07-17 13:12:42 +08:00
buua436
ddc2490a7d fix: align CAJAL template node types (#16972) 2026-07-16 12:31:54 +08:00
Jack
e543ff02c4 Feat: nats message processing refactor and support built in DSL (#16873) 2026-07-15 14:53:16 +08:00
hyotaek kim
760203be42 fix(agent): preserve zero temperature setting (#16897)
### Summary

- Preserve an explicitly enabled `temperature=0` in the Agent LLM
configuration.
  - Continue excluding invalid negative temperature values.
  - Add a focused regression test to the existing Agent LLM test file.

  Fixes #16683
2026-07-14 20:10:51 +08:00
Haruko386
7a20920b12 fix: unable to send email for py backend (#16888)
### Summary

As title

Can send email now
<img width="2313" height="1941" alt="image"
src="https://github.com/user-attachments/assets/c129b3c7-7e40-4bdd-8430-f3b402b9cab1"
/>
<img width="1256" height="2760" alt="f6ba88c56fe3945a6d28564fc4d4c54f"
src="https://github.com/user-attachments/assets/ae2dbe0c-e2d4-494f-8b86-03e959ef4808"
/>
2026-07-14 14:59:06 +08:00
Taranum Wasu
d48fd37ff1 fix(agent): allow underscores in variable_ref_patt component_id (#16758) (#16792)
## Summary

`ComponentBase.variable_ref_patt` (and its duplicate in
`agent.canvas.Graph.get_value_with_variable`) is the regex the canvas
runtime uses to find `cpn_id@var_nm` template refs in component prompts.

The `cpn_id` half was constrained to `[a-zA-Z:0-9]+`, which silently
dropped underscores. Component ids emitted by the frontend all contain
underscores (`userfillup_abc`, `retrieval_xyz`, `llm_0`, `message_0`,
…), so any template ref like `{userfillup_abc@line}` failed to match.
The placeholder then leaked through to the LLM verbatim, and the Agent
answered only its system-prompt directive.

This is exactly the "unconsidered await response" symptom in #16758:

```
Begin(Task) -> Await response -> Agent -> Message
```

Widen `cpn_id` from `[a-zA-Z:0-9]+` to `[a-zA-Z0-9_]+`. Bare `{line}`
(no cpn_id) remains unrecognised so it stays literal until the user
wires it up — matching the existing `VARIABLE_REF_PATTERN` shape used by
`agent.dsl_migration` for the same purpose.

## Changes

- `agent/component/base.py` — fix `variable_ref_patt` class attribute.
- `agent/canvas.py` — same fix applied to the inline regex inside
`Graph.get_value_with_variable` (kept as the literal regex to avoid
coupling the two unrelated sites).
-
`test/testcases/test_web_api/test_canvas_app/test_variable_ref_pattern_unit.py`
— new regression test pinning both the regex shape and end-to-end
resolution.

## Regression coverage

```
test_variable_ref_patt_matches_underscored_component_ids     PASSED
test_variable_ref_patt_still_matches_legacy_ids              PASSED
test_get_input_elements_from_text_resolves_underscored_id    PASSED
test_string_format_substitutes_underscored_ref                PASSED
test_variable_ref_patt_does_not_match_bare_var_name          PASSED
```

All five regression tests fail against the pre-fix regex (verified via
`git stash` round trip — drop fix, tests fail, restore fix, tests pass).

The two targeted existing tests in the same directory
(`test_fillup_unit.py`, `test_iterationitem_unit.py`) continue to pass.

## Repro before the fix

```python
import re
patt = r"\{* *\{([a-zA-Z:0-9]+@[A-Za-z0-9_.-]+|sys\.[A-Za-z0-9_.]+|env\.[A-Za-z0-9_.]+)\} *\}*"
list(re.finditer(patt, "{userfillup_abc@line}"))
# => []   # <-- bug
```

## Repro after the fix

```python
import re
patt = r"\{* *\{([a-zA-Z0-9_]+@[A-Za-z0-9_.-]+|sys\.[A-Za-z0-9_.]+|env\.[A-Za-z0-9_.]+)\} *\}*"
list(re.finditer(patt, "{userfillup_abc@line}"))
# => [<re.Match object; span=(0, 24), match='{userfillup_abc@line}'>]
```

Fixes #16758

## Test plan

- [x] New unit tests pass
- [x] Reverse-apply the fix and confirm the regression tests fail (they
do)
- [x] `test_fillup_unit.py` (existing sibling suite) still passes
- [x] `test_iterationitem_unit.py` (existing sibling suite) still passes
- [ ] Project CI green

---------

Co-authored-by: Taranum01 <taranum01@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-13 22:03:48 +08:00
euvre
3bfad1f00e fix: correct model type mappings and improve system setting persistence (#16501) 2026-07-13 16:42:55 +08:00
boskodev790
80a7a87427 fix(agent): port QWeather to ToolBase so it works as an Agent tool (#16692)
### Summary

Port the **QWeather** agent tool to the modern `ToolBase` / `_invoke`
interface. It was still written against the removed legacy
`ComponentBase` / `_run` / `be_output` API, so it was non-functional as
an Agent tool — adding it to an Agent raised `AttributeError` because it
had no `get_meta()`. This is the same defect that was fixed for the
AkShare tool in #16417.

**Changes**
- `QWeatherParam` now extends `ToolParamBase` with a `meta` exposing a
`query` (location) parameter, and adds `get_input_form()`. Existing
config (`web_apikey`, `lang`, `type`, `user_type`, `time_period`) is
preserved.
- `QWeather` now extends `ToolBase` and implements `_invoke(**kwargs)`
with the standard retry loop, cancellation checks,
`set_output("formalized_content", ...)`, and `thoughts()`. The weather /
indices / air-quality branches and the API error-code messages are kept.
- Added `test/unit_test/agent/component/test_qweather.py` covering the
restored `meta`, param validation, the weather-now and multi-day and
indices branches, the empty-query short-circuit, and the location-lookup
error message.

**Testing**
- `ruff check agent/tools/qweather.py
test/unit_test/agent/component/test_qweather.py` — clean
- `ruff format --check` — clean
- `pytest test/unit_test/agent/component/test_qweather.py`
2026-07-13 16:31:19 +08:00
qinling0210
d549194562 Implement builtin chunk method as ingestion pipeline in GO (#16822)
### Summary

Implement builtin chunk mehtod as ingestion pipeline in GO
2026-07-13 13:51:40 +08:00