diff --git a/CHANGELOG.md b/CHANGELOG.md index 4f996d7d0..78acf3472 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,7 @@ service can change a gate's answer, and a pull request number is only knowable f ## 2026-10-19 +- `agent-builders.md`: the Dify plugin debug-permission remedy now cites the pinned console web code that reads and writes the setting, alongside the API remedy already cited; which roles can reach it and where the console shows it stay open under TODO row 1.283 (#695) - Twenty more guides move to the two-section layout (maintainer request, 2026-10-18), with each guide's own tool named first in its header; `workflow-orchestrators.md`, already in the layout, now lists Temporal, Flower and Argo with its other headline tools in its header; no guide body or digest changes. Guides: `host.md`, `cloud-firewalls.md`, `egress-metadata.md`, `cloudflare.md`, `tunnels.md`, `tailscale.md`, `cloud-identity-proxies.md`, `fronting-auth.md`, `mfa.md`, `identity-providers.md`, `oidc-integration.md`, `self-hosted-idp.md`, `secrets.md`, `machine-auth.md`, `connection-poolers.md`, `neo4j.md`, `surrealdb.md`, `nodejs.md`, `go.md`, `java.md` (#697) - `authentication.md`: the transport-authentication rule now labels its requirements (authenticate and check each of WebSockets, SSE, GraphQL, gRPC, webhooks, inference and management APIs on its own, not through the HTML login; verify webhook signatures and reject replays) as this guide's, keeps the Stripe signature and timestamp citations, and states that the HTML-login boundary, GraphQL, inference and management API coverage, and replay rejection beyond those checks are not established by the cited sources; those parts stay open under TODO row 1.294 (#696) - Twenty more guides move to the two-section layout (maintainer request, 2026-10-18), with each guide's own tool named first in its header; the header now says "1 more recorded basis" rather than "bases", and the headers of guides already in the layout are regenerated where that changes them; no guide body or digest changes. Guides: `firebase-supabase.md`, `pocketbase.md`, `ray.md`, `gitops-controllers.md`, `nomad-consul.md`, `self-hosted-ci-runners.md`, `workflow-orchestrators.md`, `kubernetes.md`, `nginx.md`, `apache.md`, `caddy.md`, `traefik.md`, `haproxy.md`, `lighttpd.md`, `free-certificates.md`, `self-signed.md`, `headers.md`, `cors.md`, `docker.md`, `container-hardening.md` (#693) diff --git a/DONE.md b/DONE.md index 7190bb756..ce19d9553 100644 --- a/DONE.md +++ b/DONE.md @@ -10,6 +10,7 @@ because an item that simply vanishes gets proposed again six months later. | ID | Item | Ended | | --- | --- | --- | +| 1.283 | `agent-builders.md`: debug-remedy: establish whether the debug_permission change is available in the console UI; API remedy is already cited and UI availability is unestablished. (M, M) | Done, #695. Cited, at the pinned console commit, the console UI read and write of both plugin permissions through the permission fetch and change endpoints, the payload type that pairs install_permission with debug_permission and allows everyone/admins/noone, and the canSetPermissions flag (RBAC off plus the plugin.plugin_preferences key) that the settings-access hook returns beside the write; which roles hold that key and where the console renders the control stay open in TODO.md under the same ID. | | 1.294 | `authentication.md`: transport-authentication: qualify the transport checks, HTML-login boundary and webhook replay requirement. (M, M) | Done, #696. Labelled the requirements and source limits, retained the Stripe signature and timestamp citations, and shortened the claim; evidence for the HTML-login boundary, GraphQL/inference/management coverage and comprehensive replay rejection remains open in TODO.md under 1.294. | | 1.293 | `authentication.md`: fail2ban: source or narrow the coverage and setup of login panels beyond the cited sshd jail and failure filter. (M, M) | Done, #694. Cited fail2ban 1.1.1 nginx HTTP-auth and Webmin jails and filter patterns, retained the SSH requirement, and labelled log-selection advice and the limits on panel coverage and setup ease. | | 1.292 | `authentication.md`: cloudflare-access: source or narrow the claim that Cloudflare Access can front any application unchanged, including the One-time PIN and SSO options still not established by the cited pages. (M, M) | Done, #692. Cited the pinned one-time PIN, identity-provider options and generic OIDC pages for the login methods, narrowed the fronting statement to a self-hosted web application published through Access, and labelled unchanged any-application use as not established and this guide's assessment. | diff --git a/TODO.md b/TODO.md index 0d99165af..a1dad9236 100644 --- a/TODO.md +++ b/TODO.md @@ -57,7 +57,7 @@ A real surface the guide never covers. Correct as far as it goes, and not far en | 1.268 | `paas.md`: remaining https-redirect/verify-redirect evidence: establish Render's redirect status, Railway's HEAD redirect behaviour and POST status, and Heroku's redirect policy, configuration/application responsibility and status; cited header descriptions do not establish sanitization. (M, M) | `[gap]` | | 1.273 | `nodejs.md`: bind, remaining source gaps: establish Railway's listener address, injected port and TLS termination location, and Heroku Cedar's listener address. (M, M) | `[gap]` | | 1.276 | `python.md`: bind, remaining source gaps: establish Railway's listener address, injected port and TLS termination location, and Heroku Cedar's listener address. (M, M) | `[gap]` | -| 1.283 | `agent-builders.md`: debug-remedy: establish whether the debug_permission change is available in the console UI; API remedy is already cited and UI availability is unestablished. (M, M) | `[gap]` | +| 1.283 | `agent-builders.md`: debug-remedy, remaining UI gap: establish which roles hold the `plugin.plugin_preferences` workspace permission key and where the console renders the plugin-permission control; the console UI read/write data path, paired payload and choices are cited. (M, M) | `[gap]` | | 1.290 | `firebase-supabase.md`: local-guards: establish the unrecorded bash and other tool/parser versions for the historical authoring guard and syntax runs; the ShellCheck v0.11.0 release is cited, but does not attest to the historical host binary. (M, M) | `[gap]` | | 1.291 | `pocketbase.md`: source-limits, remaining dependency gap: trace how utopia-php/database matches requester roles against stored collection/document permissions (including documentSecurity) for document reads and what the disabled default authorization status bypasses; the Appwrite-repository call sites, PocketBase CLI wrapper and `--dev` default are cited. (M, M) | `[gap]` | | 1.294 | `authentication.md`: transport-authentication, remaining source gaps: establish the HTML-login boundary for non-HTTP transports and authentication coverage for GraphQL, inference and management APIs; establish comprehensive webhook replay rejection beyond signature and timestamp-tolerance checks, including repeats within the accepted window. These remain guide requirements, not established deployment behaviour. (M, M) | `[gap]` | diff --git a/agent-builders.md b/agent-builders.md index fd8e54c10..05743d552 100644 --- a/agent-builders.md +++ b/agent-builders.md @@ -1,6 +1,6 @@ # Agent and workflow builders: Dify, Flowise, Langflow, LibreChat -Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources. +Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources. A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide. @@ -26,7 +26,7 @@ At daemon 0.6.10, this is a plain TCP channel carrying newline-delimited JSON, w A key holder can register a remote plugin runtime into the key's tenant by supplying its declarations and assets. When Dify invokes that runtime, it receives the tool parameters or model prompts and any credentials included in those requests, and supplies the results. Treat the key as authority to supply remotely executed plugin code to the tenant's workflows; the plugin code runs at the connector, and this channel alone does not demonstrate shell execution on the Dify host. Keep the channel private even though its handshake uses a key. -Who can obtain a key: after instance setup, any initialized member with an active workspace and a valid console session can retrieve the current workspace's key, with the debugging host and port, through `GET /console/api/workspaces/current/plugin/debugging-key` at Dify commit `d39d9ddb7430522e0c828c6953afdf773ba6e675` under the defaults below. Enterprise RBAC (`RBAC_ENABLED`) defaults to false, which skips its check. The plugin-permission check then allows every member when the workspace has no plugin-permission record, and refuses only when the workspace's debug permission is set to nobody, or to admins for an account that is neither admin nor owner. The model's default `debug_permission` is `noone`, but it applies only once a row exists; with no row, everyone is allowed. By default, therefore, a member meeting those session and workspace prerequisites can retrieve the key and register a remote runtime. Where plugin debugging is needed, an admin or owner can set `debug_permission` to `admins` through the API `POST /console/api/workspaces/current/plugin/permission/change`, preserving the current `install_permission` in the request as well (omitting it defaults it to `everyone`). This is an API remedy; UI availability was not established. Otherwise disable the listener as described below. +Who can obtain a key: after instance setup, any initialized member with an active workspace and a valid console session can retrieve the current workspace's key, with the debugging host and port, through `GET /console/api/workspaces/current/plugin/debugging-key` at Dify commit `d39d9ddb7430522e0c828c6953afdf773ba6e675` under the defaults below. Enterprise RBAC (`RBAC_ENABLED`) defaults to false, which skips its check. The plugin-permission check then allows every member when the workspace has no plugin-permission record, and refuses only when the workspace's debug permission is set to nobody, or to admins for an account that is neither admin nor owner. The model's default `debug_permission` is `noone`, but it applies only once a row exists; with no row, everyone is allowed. By default, therefore, a member meeting those session and workspace prerequisites can retrieve the key and register a remote runtime. Where plugin debugging is needed, an admin or owner can set `debug_permission` to `admins` through the API `POST /console/api/workspaces/current/plugin/permission/change`, preserving the current `install_permission` in the request as well (omitting it defaults it to `everyone`). This is an API remedy that the console UI code also carries at the same commit: the console service layer reads both permissions from `GET /console/api/workspaces/current/plugin/permission/fetch` and writes them through the same permission-change endpoint, with a payload type that requires `install_permission` and `debug_permission` together and allows `everyone`, `admins` or `noone` for each, and the plugin settings-access hook returns that write beside a `canSetPermissions` flag requiring enterprise RBAC off plus the `plugin.plugin_preferences` workspace permission key. The cited files show that data path, not the screen: which roles hold that key and where the console renders the setting are not established, so this guide's advice is to make the change through the API call above. Otherwise disable the listener as described below. Set `PLUGIN_REMOTE_INSTALLING_ENABLED=false` in the `plugin_daemon` container environment when debugging is unused. This setting defaults to `true`; `false` prevents the TCP debugging server from starting and removes the daemon's debugging-key API route. It does not remove Docker's port publication. The override below disables the server and removes the publication together. @@ -277,6 +277,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max - Dify console prerequisites (instance setup, account initialization, active workspace and authenticated session): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L308-L321 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L113-L125 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L47-L59 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L152-L169 - Dify plugin permission model (row default `noone`, unlike the no-row allowance above): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407 - Dify permission-change API (admin or owner only, request defaults, create or update the permission row): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36 +- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (permission type and choices; UI read and write of both plugin permissions; settings-access flag; permission-fetch endpoint; checked October 2026): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 - `docker compose ps` output fields (`Service`, `Publishers`, `PublishedPort`): https://docs.docker.com/reference/cli/docker/compose/ps/ @@ -349,7 +350,7 @@ Claims (full source mapping in the JSON block below): - debug-key-access (REASONED; dify-console): Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions. - rbac-default (REASONED; dify-console): RBAC_ENABLED defaults false and skips enterprise RBAC checks. - plugin-permission (REASONED; dify-console): No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner. -- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone; UI availability unestablished. +- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, omitted default everyone. Console code reads/writes both (everyone/admins/noone); the hook computes canSetPermissions (RBAC off plus plugin.plugin_preferences) alongside the calls, returning the flag and mutation separately; key-holding roles and rendered setting location remain unestablished. - debug-disable (REASONED; daemon, docker): PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication. - verify-debug-config (REASONED; dify-console, daemon, docker): Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration. - flowise-tls (REASONED; flowise): Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses. @@ -395,9 +396,9 @@ Claims (full source mapping in the JSON block below): ````json { "schema": 1, - "checked": "2026-10-17", + "checked": "2026-10-19", "documentation_checked": "2026-09", - "body_sha256": "49aeeb6f2264d04bfeae494a08061515cc6649f8cda6dc14173a133553160593", + "body_sha256": "d9b3ee77e381107c6cb13fbb56ef6cc80dad8ebcffdf662fb0c82608db2cd8f2", "components": { "daemon": { "name": "Dify plugin daemon", @@ -484,7 +485,13 @@ Claims (full source mapping in the JSON block below): "s1edf3fa3d667": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407", "s09ea6abe9b9c": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106", "s662ba88445cd": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172", - "s4b8c82f515c6": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36" + "s4b8c82f515c6": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36", + "s19d7f56161fe": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276", + "s2a08cae5a24f": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156", + "s934c0d2260fe": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188", + "s951644d96965": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43", + "s6bd02c94df1a": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100", + "s044852759e49": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131" } }, "dify-compose": { @@ -631,7 +638,7 @@ Claims (full source mapping in the JSON block below): "debug-key-access": {"text": "Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions.", "components": ["dify-console"], "sources": ["dify-console:s1cd4f464c880", "dify-console:s5384bb9d1e75", "dify-console:s7cdbcd9957ac", "dify-console:s182d16f6e475", "dify-console:sf9235e345b51", "dify-console:saa9ceb383427", "dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "rbac-default": {"text": "RBAC_ENABLED defaults false and skips enterprise RBAC checks.", "components": ["dify-console"], "sources": ["dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "plugin-permission": {"text": "No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner.", "components": ["dify-console"], "sources": ["dify-console:saa9ceb383427", "dify-console:s1edf3fa3d667"], "status": "REASONED"}, - "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone; UI availability unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6"], "status": "REASONED"}, + "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, omitted default everyone. Console code reads/writes both (everyone/admins/noone); the hook computes canSetPermissions (RBAC off plus plugin.plugin_preferences) alongside the calls, returning the flag and mutation separately; key-holding roles and rendered setting location remain unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6", "dify-console:s19d7f56161fe", "dify-console:s2a08cae5a24f", "dify-console:s934c0d2260fe", "dify-console:s951644d96965", "dify-console:s6bd02c94df1a", "dify-console:s044852759e49"], "status": "REASONED"}, "debug-disable": {"text": "PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication.", "components": ["daemon", "docker"], "sources": ["daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "verify-debug-config": {"text": "Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration.", "components": ["dify-console", "daemon", "docker"], "sources": ["dify-console:s1e4c822a36b1", "daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "flowise-tls": {"text": "Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses.", "components": ["flowise"], "sources": ["flowise:s7b675aa70798", "flowise:sfee1ae75d51a"], "status": "REASONED"}, diff --git a/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 b/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 index 3184eab00..3966c799c 100644 --- a/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 +++ b/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 @@ -76,7 +76,7 @@ cae5895e27a2a0d08773bf3c6f346c25deee35db50f15cfaaceff1c2545eba3e self-hosted-er 86c0dcec778ea45f122f458981177bbe1fe089867183613939570b2fde1fdff5 mcp-clients.md 4ea7c2c7bc490c32fac988a7eca86353dd3b9edeca51bc805c4752e958bbb5e7 ray.md 0d4ebac99993632db53c1a3c835bf0cc8f113d689c2e1884b317b1427570651c mlflow.md -b772a966100db0e2b6f1f7ba78903f1dde4fd6e351b58afb752124e55440681e agent-builders.md +02779a52c70f2d558f5053862d4f68f69a2ffbe143a756e55b4d26f865dcd2a3 agent-builders.md f205ad0512c2ad45bee20f9cce6faee7eaadddc16af066c413eee316ec79efa9 ai-infra-services.md 5448efdd90dc5fdf90429e23ef8b8dbad8cad33a36b2d056ca426a63b4d56096 realtime-voice-infra.md 6b2981ef25b7920fae2233cb7fa2e8583b79d92af2aff8a715a585a0831dec60 image-gen-uis.md diff --git a/plugin/skills/secure-deployment-config/references/agent-builders.md b/plugin/skills/secure-deployment-config/references/agent-builders.md index fd8e54c10..05743d552 100644 --- a/plugin/skills/secure-deployment-config/references/agent-builders.md +++ b/plugin/skills/secure-deployment-config/references/agent-builders.md @@ -1,6 +1,6 @@ # Agent and workflow builders: Dify, Flowise, Langflow, LibreChat -Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources. +Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources. A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide. @@ -26,7 +26,7 @@ At daemon 0.6.10, this is a plain TCP channel carrying newline-delimited JSON, w A key holder can register a remote plugin runtime into the key's tenant by supplying its declarations and assets. When Dify invokes that runtime, it receives the tool parameters or model prompts and any credentials included in those requests, and supplies the results. Treat the key as authority to supply remotely executed plugin code to the tenant's workflows; the plugin code runs at the connector, and this channel alone does not demonstrate shell execution on the Dify host. Keep the channel private even though its handshake uses a key. -Who can obtain a key: after instance setup, any initialized member with an active workspace and a valid console session can retrieve the current workspace's key, with the debugging host and port, through `GET /console/api/workspaces/current/plugin/debugging-key` at Dify commit `d39d9ddb7430522e0c828c6953afdf773ba6e675` under the defaults below. Enterprise RBAC (`RBAC_ENABLED`) defaults to false, which skips its check. The plugin-permission check then allows every member when the workspace has no plugin-permission record, and refuses only when the workspace's debug permission is set to nobody, or to admins for an account that is neither admin nor owner. The model's default `debug_permission` is `noone`, but it applies only once a row exists; with no row, everyone is allowed. By default, therefore, a member meeting those session and workspace prerequisites can retrieve the key and register a remote runtime. Where plugin debugging is needed, an admin or owner can set `debug_permission` to `admins` through the API `POST /console/api/workspaces/current/plugin/permission/change`, preserving the current `install_permission` in the request as well (omitting it defaults it to `everyone`). This is an API remedy; UI availability was not established. Otherwise disable the listener as described below. +Who can obtain a key: after instance setup, any initialized member with an active workspace and a valid console session can retrieve the current workspace's key, with the debugging host and port, through `GET /console/api/workspaces/current/plugin/debugging-key` at Dify commit `d39d9ddb7430522e0c828c6953afdf773ba6e675` under the defaults below. Enterprise RBAC (`RBAC_ENABLED`) defaults to false, which skips its check. The plugin-permission check then allows every member when the workspace has no plugin-permission record, and refuses only when the workspace's debug permission is set to nobody, or to admins for an account that is neither admin nor owner. The model's default `debug_permission` is `noone`, but it applies only once a row exists; with no row, everyone is allowed. By default, therefore, a member meeting those session and workspace prerequisites can retrieve the key and register a remote runtime. Where plugin debugging is needed, an admin or owner can set `debug_permission` to `admins` through the API `POST /console/api/workspaces/current/plugin/permission/change`, preserving the current `install_permission` in the request as well (omitting it defaults it to `everyone`). This is an API remedy that the console UI code also carries at the same commit: the console service layer reads both permissions from `GET /console/api/workspaces/current/plugin/permission/fetch` and writes them through the same permission-change endpoint, with a payload type that requires `install_permission` and `debug_permission` together and allows `everyone`, `admins` or `noone` for each, and the plugin settings-access hook returns that write beside a `canSetPermissions` flag requiring enterprise RBAC off plus the `plugin.plugin_preferences` workspace permission key. The cited files show that data path, not the screen: which roles hold that key and where the console renders the setting are not established, so this guide's advice is to make the change through the API call above. Otherwise disable the listener as described below. Set `PLUGIN_REMOTE_INSTALLING_ENABLED=false` in the `plugin_daemon` container environment when debugging is unused. This setting defaults to `true`; `false` prevents the TCP debugging server from starting and removes the daemon's debugging-key API route. It does not remove Docker's port publication. The override below disables the server and removes the publication together. @@ -277,6 +277,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max - Dify console prerequisites (instance setup, account initialization, active workspace and authenticated session): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L308-L321 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L113-L125 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L47-L59 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L152-L169 - Dify plugin permission model (row default `noone`, unlike the no-row allowance above): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407 - Dify permission-change API (admin or owner only, request defaults, create or update the permission row): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36 +- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (permission type and choices; UI read and write of both plugin permissions; settings-access flag; permission-fetch endpoint; checked October 2026): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 - `docker compose ps` output fields (`Service`, `Publishers`, `PublishedPort`): https://docs.docker.com/reference/cli/docker/compose/ps/ @@ -349,7 +350,7 @@ Claims (full source mapping in the JSON block below): - debug-key-access (REASONED; dify-console): Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions. - rbac-default (REASONED; dify-console): RBAC_ENABLED defaults false and skips enterprise RBAC checks. - plugin-permission (REASONED; dify-console): No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner. -- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone; UI availability unestablished. +- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, omitted default everyone. Console code reads/writes both (everyone/admins/noone); the hook computes canSetPermissions (RBAC off plus plugin.plugin_preferences) alongside the calls, returning the flag and mutation separately; key-holding roles and rendered setting location remain unestablished. - debug-disable (REASONED; daemon, docker): PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication. - verify-debug-config (REASONED; dify-console, daemon, docker): Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration. - flowise-tls (REASONED; flowise): Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses. @@ -395,9 +396,9 @@ Claims (full source mapping in the JSON block below): ````json { "schema": 1, - "checked": "2026-10-17", + "checked": "2026-10-19", "documentation_checked": "2026-09", - "body_sha256": "49aeeb6f2264d04bfeae494a08061515cc6649f8cda6dc14173a133553160593", + "body_sha256": "d9b3ee77e381107c6cb13fbb56ef6cc80dad8ebcffdf662fb0c82608db2cd8f2", "components": { "daemon": { "name": "Dify plugin daemon", @@ -484,7 +485,13 @@ Claims (full source mapping in the JSON block below): "s1edf3fa3d667": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407", "s09ea6abe9b9c": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106", "s662ba88445cd": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172", - "s4b8c82f515c6": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36" + "s4b8c82f515c6": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36", + "s19d7f56161fe": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276", + "s2a08cae5a24f": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156", + "s934c0d2260fe": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188", + "s951644d96965": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43", + "s6bd02c94df1a": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100", + "s044852759e49": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131" } }, "dify-compose": { @@ -631,7 +638,7 @@ Claims (full source mapping in the JSON block below): "debug-key-access": {"text": "Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions.", "components": ["dify-console"], "sources": ["dify-console:s1cd4f464c880", "dify-console:s5384bb9d1e75", "dify-console:s7cdbcd9957ac", "dify-console:s182d16f6e475", "dify-console:sf9235e345b51", "dify-console:saa9ceb383427", "dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "rbac-default": {"text": "RBAC_ENABLED defaults false and skips enterprise RBAC checks.", "components": ["dify-console"], "sources": ["dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "plugin-permission": {"text": "No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner.", "components": ["dify-console"], "sources": ["dify-console:saa9ceb383427", "dify-console:s1edf3fa3d667"], "status": "REASONED"}, - "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone; UI availability unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6"], "status": "REASONED"}, + "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, omitted default everyone. Console code reads/writes both (everyone/admins/noone); the hook computes canSetPermissions (RBAC off plus plugin.plugin_preferences) alongside the calls, returning the flag and mutation separately; key-holding roles and rendered setting location remain unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6", "dify-console:s19d7f56161fe", "dify-console:s2a08cae5a24f", "dify-console:s934c0d2260fe", "dify-console:s951644d96965", "dify-console:s6bd02c94df1a", "dify-console:s044852759e49"], "status": "REASONED"}, "debug-disable": {"text": "PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication.", "components": ["daemon", "docker"], "sources": ["daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "verify-debug-config": {"text": "Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration.", "components": ["dify-console", "daemon", "docker"], "sources": ["dify-console:s1e4c822a36b1", "daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "flowise-tls": {"text": "Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses.", "components": ["flowise"], "sources": ["flowise:s7b675aa70798", "flowise:sfee1ae75d51a"], "status": "REASONED"}, diff --git a/site/llms-full.txt b/site/llms-full.txt index 8395505e0..274932036 100644 --- a/site/llms-full.txt +++ b/site/llms-full.txt @@ -44183,7 +44183,7 @@ REASONED: preceding block; listener inventory, external TCP reachability, proxy/ # Agent and workflow builders: Dify, Flowise, Langflow, LibreChat -Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources. +Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources. A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide. @@ -44209,7 +44209,7 @@ At daemon 0.6.10, this is a plain TCP channel carrying newline-delimited JSON, w A key holder can register a remote plugin runtime into the key's tenant by supplying its declarations and assets. When Dify invokes that runtime, it receives the tool parameters or model prompts and any credentials included in those requests, and supplies the results. Treat the key as authority to supply remotely executed plugin code to the tenant's workflows; the plugin code runs at the connector, and this channel alone does not demonstrate shell execution on the Dify host. Keep the channel private even though its handshake uses a key. -Who can obtain a key: after instance setup, any initialized member with an active workspace and a valid console session can retrieve the current workspace's key, with the debugging host and port, through `GET /console/api/workspaces/current/plugin/debugging-key` at Dify commit `d39d9ddb7430522e0c828c6953afdf773ba6e675` under the defaults below. Enterprise RBAC (`RBAC_ENABLED`) defaults to false, which skips its check. The plugin-permission check then allows every member when the workspace has no plugin-permission record, and refuses only when the workspace's debug permission is set to nobody, or to admins for an account that is neither admin nor owner. The model's default `debug_permission` is `noone`, but it applies only once a row exists; with no row, everyone is allowed. By default, therefore, a member meeting those session and workspace prerequisites can retrieve the key and register a remote runtime. Where plugin debugging is needed, an admin or owner can set `debug_permission` to `admins` through the API `POST /console/api/workspaces/current/plugin/permission/change`, preserving the current `install_permission` in the request as well (omitting it defaults it to `everyone`). This is an API remedy; UI availability was not established. Otherwise disable the listener as described below. +Who can obtain a key: after instance setup, any initialized member with an active workspace and a valid console session can retrieve the current workspace's key, with the debugging host and port, through `GET /console/api/workspaces/current/plugin/debugging-key` at Dify commit `d39d9ddb7430522e0c828c6953afdf773ba6e675` under the defaults below. Enterprise RBAC (`RBAC_ENABLED`) defaults to false, which skips its check. The plugin-permission check then allows every member when the workspace has no plugin-permission record, and refuses only when the workspace's debug permission is set to nobody, or to admins for an account that is neither admin nor owner. The model's default `debug_permission` is `noone`, but it applies only once a row exists; with no row, everyone is allowed. By default, therefore, a member meeting those session and workspace prerequisites can retrieve the key and register a remote runtime. Where plugin debugging is needed, an admin or owner can set `debug_permission` to `admins` through the API `POST /console/api/workspaces/current/plugin/permission/change`, preserving the current `install_permission` in the request as well (omitting it defaults it to `everyone`). This is an API remedy that the console UI code also carries at the same commit: the console service layer reads both permissions from `GET /console/api/workspaces/current/plugin/permission/fetch` and writes them through the same permission-change endpoint, with a payload type that requires `install_permission` and `debug_permission` together and allows `everyone`, `admins` or `noone` for each, and the plugin settings-access hook returns that write beside a `canSetPermissions` flag requiring enterprise RBAC off plus the `plugin.plugin_preferences` workspace permission key. The cited files show that data path, not the screen: which roles hold that key and where the console renders the setting are not established, so this guide's advice is to make the change through the API call above. Otherwise disable the listener as described below. Set `PLUGIN_REMOTE_INSTALLING_ENABLED=false` in the `plugin_daemon` container environment when debugging is unused. This setting defaults to `true`; `false` prevents the TCP debugging server from starting and removes the daemon's debugging-key API route. It does not remove Docker's port publication. The override below disables the server and removes the publication together. @@ -44460,6 +44460,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max - Dify console prerequisites (instance setup, account initialization, active workspace and authenticated session): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L308-L321 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L113-L125 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L47-L59 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L152-L169 - Dify plugin permission model (row default `noone`, unlike the no-row allowance above): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407 - Dify permission-change API (admin or owner only, request defaults, create or update the permission row): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36 +- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (permission type and choices; UI read and write of both plugin permissions; settings-access flag; permission-fetch endpoint; checked October 2026): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 - `docker compose ps` output fields (`Service`, `Publishers`, `PublishedPort`): https://docs.docker.com/reference/cli/docker/compose/ps/ @@ -44532,7 +44533,7 @@ Claims (full source mapping in the JSON block below): - debug-key-access (REASONED; dify-console): Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions. - rbac-default (REASONED; dify-console): RBAC_ENABLED defaults false and skips enterprise RBAC checks. - plugin-permission (REASONED; dify-console): No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner. -- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone; UI availability unestablished. +- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, omitted default everyone. Console code reads/writes both (everyone/admins/noone); the hook computes canSetPermissions (RBAC off plus plugin.plugin_preferences) alongside the calls, returning the flag and mutation separately; key-holding roles and rendered setting location remain unestablished. - debug-disable (REASONED; daemon, docker): PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication. - verify-debug-config (REASONED; dify-console, daemon, docker): Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration. - flowise-tls (REASONED; flowise): Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses. @@ -44578,9 +44579,9 @@ Claims (full source mapping in the JSON block below): ````json { "schema": 1, - "checked": "2026-10-17", + "checked": "2026-10-19", "documentation_checked": "2026-09", - "body_sha256": "49aeeb6f2264d04bfeae494a08061515cc6649f8cda6dc14173a133553160593", + "body_sha256": "d9b3ee77e381107c6cb13fbb56ef6cc80dad8ebcffdf662fb0c82608db2cd8f2", "components": { "daemon": { "name": "Dify plugin daemon", @@ -44667,7 +44668,13 @@ Claims (full source mapping in the JSON block below): "s1edf3fa3d667": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407", "s09ea6abe9b9c": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106", "s662ba88445cd": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172", - "s4b8c82f515c6": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36" + "s4b8c82f515c6": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36", + "s19d7f56161fe": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276", + "s2a08cae5a24f": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156", + "s934c0d2260fe": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188", + "s951644d96965": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43", + "s6bd02c94df1a": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100", + "s044852759e49": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131" } }, "dify-compose": { @@ -44814,7 +44821,7 @@ Claims (full source mapping in the JSON block below): "debug-key-access": {"text": "Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions.", "components": ["dify-console"], "sources": ["dify-console:s1cd4f464c880", "dify-console:s5384bb9d1e75", "dify-console:s7cdbcd9957ac", "dify-console:s182d16f6e475", "dify-console:sf9235e345b51", "dify-console:saa9ceb383427", "dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "rbac-default": {"text": "RBAC_ENABLED defaults false and skips enterprise RBAC checks.", "components": ["dify-console"], "sources": ["dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "plugin-permission": {"text": "No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner.", "components": ["dify-console"], "sources": ["dify-console:saa9ceb383427", "dify-console:s1edf3fa3d667"], "status": "REASONED"}, - "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone; UI availability unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6"], "status": "REASONED"}, + "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, omitted default everyone. Console code reads/writes both (everyone/admins/noone); the hook computes canSetPermissions (RBAC off plus plugin.plugin_preferences) alongside the calls, returning the flag and mutation separately; key-holding roles and rendered setting location remain unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6", "dify-console:s19d7f56161fe", "dify-console:s2a08cae5a24f", "dify-console:s934c0d2260fe", "dify-console:s951644d96965", "dify-console:s6bd02c94df1a", "dify-console:s044852759e49"], "status": "REASONED"}, "debug-disable": {"text": "PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication.", "components": ["daemon", "docker"], "sources": ["daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "verify-debug-config": {"text": "Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration.", "components": ["dify-console", "daemon", "docker"], "sources": ["dify-console:s1e4c822a36b1", "daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "flowise-tls": {"text": "Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses.", "components": ["flowise"], "sources": ["flowise:s7b675aa70798", "flowise:sfee1ae75d51a"], "status": "REASONED"},