From d78c4240270d86d29f8c33a06a7fabcbc5c07bd2 Mon Sep 17 00:00:00 2001 From: Jeff Posluns Date: Mon, 19 Oct 2026 07:32:35 -0400 Subject: [PATCH 1/3] agent-builders.md: cite the Dify console code for the plugin debug permission (TODO 1.283 in part) Pinned console web code reads and writes debug_permission; roles and placement stay open. --- CHANGELOG.md | 1 + DONE.md | 1 + TODO.md | 2 +- VERSION | 2 +- agent-builders.md | 21 ++++++++++++------- plugin/plugin.json | 2 +- .../references/MANIFEST.sha256 | 2 +- .../references/agent-builders.md | 21 ++++++++++++------- site/llms-full.txt | 21 ++++++++++++------- 9 files changed, 48 insertions(+), 25 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 370d22c4a..8d14b8551 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,7 @@ service can change a gate's answer, and a pull request number is only knowable f ## 2026-10-19 +- `agent-builders.md`: the Dify plugin debug-permission remedy now cites the pinned console web code that reads and writes the setting, alongside the API remedy already cited; which roles can reach it and where the console shows it stay open under TODO row 1.283 (#695) - `authentication.md`: the fail2ban rule now cites fail2ban 1.1.1's shipped `sshd`, `nginx-http-auth` and `webmin-auth` filters and jails, which are disabled by default; enabling the relevant jails with matching log paths is labelled as this guide's advice, and coverage of any particular login panel and how easy it is to set up are stated as not established; TODO row 1.293 moves to DONE (#694) - `authentication.md`: the Cloudflare Access rule now cites Cloudflare's One-time PIN, identity-provider and generic OIDC pages for the login options, and its existing self-hosted web application scope now reads "published through Access", stating that use with any application unchanged is not established; no command changes; TODO row 1.292 moves to DONE (#692) - Twenty more guides move to the two-section layout (maintainer request, 2026-10-18), with each guide's own tool named first in its header and components listed headline tools first; no guide body or digest changes. Guides: `llm-observability.md`, `agent-builders.md`, `ai-infra-services.md`, `vector-databases.md`, `search-engines.md`, `elasticsearch.md`, `minio.md`, `object-storage.md`, `jupyter.md`, `gradio.md`, `streamlit.md`, `code-server.md`, `n8n.md`, `headless-browser-services.md`, `headless-cms-instant-api.md`, `supabase-self-hosted.md`, `observability-components.md`, `self-hosted-error-trackers.md`, `realtime-webhooks.md`, `realtime-voice-infra.md` (#691) diff --git a/DONE.md b/DONE.md index a5a701c73..49fb5c0dc 100644 --- a/DONE.md +++ b/DONE.md @@ -10,6 +10,7 @@ because an item that simply vanishes gets proposed again six months later. | ID | Item | Ended | | --- | --- | --- | +| 1.283 | `agent-builders.md`: debug-remedy: establish whether the debug_permission change is available in the console UI; API remedy is already cited and UI availability is unestablished. (M, M) | Done, #695. Cited, at the pinned console commit, the console UI read and write of both plugin permissions through the permission fetch and change endpoints, the payload type that pairs install_permission with debug_permission and allows everyone/admins/noone, and the settings-access gating behind RBAC off plus the plugin.plugin_preferences key; which roles hold that key and where the console renders the control stay open in TODO.md under the same ID. | | 1.293 | `authentication.md`: fail2ban: source or narrow the coverage and setup of login panels beyond the cited sshd jail and failure filter. (M, M) | Done, #694. Cited fail2ban 1.1.1 nginx HTTP-auth and Webmin jails and filter patterns, retained the SSH requirement, and labelled log-selection advice and the limits on panel coverage and setup ease. | | 1.292 | `authentication.md`: cloudflare-access: source or narrow the claim that Cloudflare Access can front any application unchanged, including the One-time PIN and SSO options still not established by the cited pages. (M, M) | Done, #692. Cited the pinned one-time PIN, identity-provider options and generic OIDC pages for the login methods, narrowed the fronting statement to a self-hosted web application published through Access, and labelled unchanged any-application use as not established and this guide's assessment. | | 1.291 | `pocketbase.md`: source-limits: trace the PocketBase CLI wrapper and Appwrite document read authorization and privileged/API-key requester classification; establish the `--dev` default. (M, M) | Done, #690. Pinned the PocketBase v0.40.4 wrapper wiring, the `--dev` default (disabled unless probably started with go run) and its dev-mode logging effects, and the Appwrite 2.2.0 keys/privileged requester classification, API-key and admin-mode authorization-status handling, route scope validation and document-read call sites; the utopia-php/database role-to-permission enforcement stays open in TODO.md under the same ID. | diff --git a/TODO.md b/TODO.md index f993b4736..db92e65a1 100644 --- a/TODO.md +++ b/TODO.md @@ -57,7 +57,7 @@ A real surface the guide never covers. Correct as far as it goes, and not far en | 1.268 | `paas.md`: remaining https-redirect/verify-redirect evidence: establish Render's redirect status, Railway's HEAD redirect behaviour and POST status, and Heroku's redirect policy, configuration/application responsibility and status; cited header descriptions do not establish sanitization. (M, M) | `[gap]` | | 1.273 | `nodejs.md`: bind, remaining source gaps: establish Railway's listener address, injected port and TLS termination location, and Heroku Cedar's listener address. (M, M) | `[gap]` | | 1.276 | `python.md`: bind, remaining source gaps: establish Railway's listener address, injected port and TLS termination location, and Heroku Cedar's listener address. (M, M) | `[gap]` | -| 1.283 | `agent-builders.md`: debug-remedy: establish whether the debug_permission change is available in the console UI; API remedy is already cited and UI availability is unestablished. (M, M) | `[gap]` | +| 1.283 | `agent-builders.md`: debug-remedy, remaining UI gap: establish which roles hold the `plugin.plugin_preferences` workspace permission key and where the console renders the plugin-permission control; the console UI read/write data path, paired payload and choices are cited. (M, M) | `[gap]` | | 1.290 | `firebase-supabase.md`: local-guards: establish the unrecorded bash and other tool/parser versions for the historical authoring guard and syntax runs; the ShellCheck v0.11.0 release is cited, but does not attest to the historical host binary. (M, M) | `[gap]` | | 1.291 | `pocketbase.md`: source-limits, remaining dependency gap: trace how utopia-php/database matches requester roles against stored collection/document permissions (including documentSecurity) for document reads and what the disabled default authorization status bypasses; the Appwrite-repository call sites, PocketBase CLI wrapper and `--dev` default are cited. (M, M) | `[gap]` | | 1.294 | `authentication.md`: transport-authentication: source or narrow the HTML-login boundary for non-HTTP transports, GraphQL/inference/management APIs and webhook replay rejection. (M, M) | `[gap]` | diff --git a/VERSION b/VERSION index f8e358f8d..c21dfcadb 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.0.694 +1.0.695 diff --git a/agent-builders.md b/agent-builders.md index fd8e54c10..2eec24017 100644 --- a/agent-builders.md +++ b/agent-builders.md @@ -1,6 +1,6 @@ # Agent and workflow builders: Dify, Flowise, Langflow, LibreChat -Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources. +Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources. A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide. @@ -26,7 +26,7 @@ At daemon 0.6.10, this is a plain TCP channel carrying newline-delimited JSON, w A key holder can register a remote plugin runtime into the key's tenant by supplying its declarations and assets. When Dify invokes that runtime, it receives the tool parameters or model prompts and any credentials included in those requests, and supplies the results. Treat the key as authority to supply remotely executed plugin code to the tenant's workflows; the plugin code runs at the connector, and this channel alone does not demonstrate shell execution on the Dify host. Keep the channel private even though its handshake uses a key. -Who can obtain a key: after instance setup, any initialized member with an active workspace and a valid console session can retrieve the current workspace's key, with the debugging host and port, through `GET /console/api/workspaces/current/plugin/debugging-key` at Dify commit `d39d9ddb7430522e0c828c6953afdf773ba6e675` under the defaults below. Enterprise RBAC (`RBAC_ENABLED`) defaults to false, which skips its check. The plugin-permission check then allows every member when the workspace has no plugin-permission record, and refuses only when the workspace's debug permission is set to nobody, or to admins for an account that is neither admin nor owner. The model's default `debug_permission` is `noone`, but it applies only once a row exists; with no row, everyone is allowed. By default, therefore, a member meeting those session and workspace prerequisites can retrieve the key and register a remote runtime. Where plugin debugging is needed, an admin or owner can set `debug_permission` to `admins` through the API `POST /console/api/workspaces/current/plugin/permission/change`, preserving the current `install_permission` in the request as well (omitting it defaults it to `everyone`). This is an API remedy; UI availability was not established. Otherwise disable the listener as described below. +Who can obtain a key: after instance setup, any initialized member with an active workspace and a valid console session can retrieve the current workspace's key, with the debugging host and port, through `GET /console/api/workspaces/current/plugin/debugging-key` at Dify commit `d39d9ddb7430522e0c828c6953afdf773ba6e675` under the defaults below. Enterprise RBAC (`RBAC_ENABLED`) defaults to false, which skips its check. The plugin-permission check then allows every member when the workspace has no plugin-permission record, and refuses only when the workspace's debug permission is set to nobody, or to admins for an account that is neither admin nor owner. The model's default `debug_permission` is `noone`, but it applies only once a row exists; with no row, everyone is allowed. By default, therefore, a member meeting those session and workspace prerequisites can retrieve the key and register a remote runtime. Where plugin debugging is needed, an admin or owner can set `debug_permission` to `admins` through the API `POST /console/api/workspaces/current/plugin/permission/change`, preserving the current `install_permission` in the request as well (omitting it defaults it to `everyone`). This is an API remedy that the console UI code also carries at the same commit: the console service layer reads both permissions from `GET /console/api/workspaces/current/plugin/permission/fetch` and writes them through the same permission-change endpoint, with a payload type that requires `install_permission` and `debug_permission` together and allows `everyone`, `admins` or `noone` for each, and the plugin settings-access hook returns that write beside a `canSetPermissions` flag requiring enterprise RBAC off plus the `plugin.plugin_preferences` workspace permission key. The cited files show that data path, not the screen: which roles hold that key and where the console renders the setting are not established, so this guide's advice is to make the change through the API call above. Otherwise disable the listener as described below. Set `PLUGIN_REMOTE_INSTALLING_ENABLED=false` in the `plugin_daemon` container environment when debugging is unused. This setting defaults to `true`; `false` prevents the TCP debugging server from starting and removes the daemon's debugging-key API route. It does not remove Docker's port publication. The override below disables the server and removes the publication together. @@ -277,6 +277,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max - Dify console prerequisites (instance setup, account initialization, active workspace and authenticated session): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L308-L321 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L113-L125 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L47-L59 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L152-L169 - Dify plugin permission model (row default `noone`, unlike the no-row allowance above): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407 - Dify permission-change API (admin or owner only, request defaults, create or update the permission row): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36 +- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (permission type and choices; UI read and write of both plugin permissions; settings-access gating; permission-fetch endpoint): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 - `docker compose ps` output fields (`Service`, `Publishers`, `PublishedPort`): https://docs.docker.com/reference/cli/docker/compose/ps/ @@ -349,7 +350,7 @@ Claims (full source mapping in the JSON block below): - debug-key-access (REASONED; dify-console): Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions. - rbac-default (REASONED; dify-console): RBAC_ENABLED defaults false and skips enterprise RBAC checks. - plugin-permission (REASONED; dify-console): No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner. -- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone; UI availability unestablished. +- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone. Console UI code reads and writes both permissions together with choices everyone/admins/noone behind RBAC off plus the plugin.plugin_preferences key; which roles hold that key and where the console renders the setting are unestablished. - debug-disable (REASONED; daemon, docker): PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication. - verify-debug-config (REASONED; dify-console, daemon, docker): Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration. - flowise-tls (REASONED; flowise): Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses. @@ -395,9 +396,9 @@ Claims (full source mapping in the JSON block below): ````json { "schema": 1, - "checked": "2026-10-17", + "checked": "2026-10-19", "documentation_checked": "2026-09", - "body_sha256": "49aeeb6f2264d04bfeae494a08061515cc6649f8cda6dc14173a133553160593", + "body_sha256": "5863b63835e25b812a29eac0283a9daa899a4bbe1dc7b363ae6b6282e610991c", "components": { "daemon": { "name": "Dify plugin daemon", @@ -484,7 +485,13 @@ Claims (full source mapping in the JSON block below): "s1edf3fa3d667": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407", "s09ea6abe9b9c": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106", "s662ba88445cd": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172", - "s4b8c82f515c6": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36" + "s4b8c82f515c6": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36", + "s19d7f56161fe": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276", + "s2a08cae5a24f": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156", + "s934c0d2260fe": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188", + "s951644d96965": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43", + "s6bd02c94df1a": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100", + "s044852759e49": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131" } }, "dify-compose": { @@ -631,7 +638,7 @@ Claims (full source mapping in the JSON block below): "debug-key-access": {"text": "Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions.", "components": ["dify-console"], "sources": ["dify-console:s1cd4f464c880", "dify-console:s5384bb9d1e75", "dify-console:s7cdbcd9957ac", "dify-console:s182d16f6e475", "dify-console:sf9235e345b51", "dify-console:saa9ceb383427", "dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "rbac-default": {"text": "RBAC_ENABLED defaults false and skips enterprise RBAC checks.", "components": ["dify-console"], "sources": ["dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "plugin-permission": {"text": "No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner.", "components": ["dify-console"], "sources": ["dify-console:saa9ceb383427", "dify-console:s1edf3fa3d667"], "status": "REASONED"}, - "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone; UI availability unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6"], "status": "REASONED"}, + "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone. Console UI code reads and writes both permissions together with choices everyone/admins/noone behind RBAC off plus the plugin.plugin_preferences key; which roles hold that key and where the console renders the setting are unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6", "dify-console:s19d7f56161fe", "dify-console:s2a08cae5a24f", "dify-console:s934c0d2260fe", "dify-console:s951644d96965", "dify-console:s6bd02c94df1a", "dify-console:s044852759e49"], "status": "REASONED"}, "debug-disable": {"text": "PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication.", "components": ["daemon", "docker"], "sources": ["daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "verify-debug-config": {"text": "Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration.", "components": ["dify-console", "daemon", "docker"], "sources": ["dify-console:s1e4c822a36b1", "daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "flowise-tls": {"text": "Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses.", "components": ["flowise"], "sources": ["flowise:s7b675aa70798", "flowise:sfee1ae75d51a"], "status": "REASONED"}, diff --git a/plugin/plugin.json b/plugin/plugin.json index 41158b038..e994fe0cd 100644 --- a/plugin/plugin.json +++ b/plugin/plugin.json @@ -1,7 +1,7 @@ { "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json", "name": "secureconfig", - "version": "1.0.694", + "version": "1.0.695", "description": "Deployment-exposure guides for services AI-assisted projects commonly run: TLS, authentication, MFA, secrets, and network exposure, each line traced to a vendor page.", "author": { "name": "Jeff Posluns", "url": "https://secureconfig.ai" }, "homepage": "https://secureconfig.ai", diff --git a/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 b/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 index bde223d2c..e98610306 100644 --- a/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 +++ b/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 @@ -76,7 +76,7 @@ cae5895e27a2a0d08773bf3c6f346c25deee35db50f15cfaaceff1c2545eba3e self-hosted-er 86c0dcec778ea45f122f458981177bbe1fe089867183613939570b2fde1fdff5 mcp-clients.md b27badebb07b6e99d62e88c3aa748112bb85b8128a57cd3fc593983a3dd7daa6 ray.md 0d4ebac99993632db53c1a3c835bf0cc8f113d689c2e1884b317b1427570651c mlflow.md -b772a966100db0e2b6f1f7ba78903f1dde4fd6e351b58afb752124e55440681e agent-builders.md +cfbf661b24d8879712ea12e0c5ede7812205f6a07274049d831f4b07a1c65b6e agent-builders.md f205ad0512c2ad45bee20f9cce6faee7eaadddc16af066c413eee316ec79efa9 ai-infra-services.md 5448efdd90dc5fdf90429e23ef8b8dbad8cad33a36b2d056ca426a63b4d56096 realtime-voice-infra.md 6b2981ef25b7920fae2233cb7fa2e8583b79d92af2aff8a715a585a0831dec60 image-gen-uis.md diff --git a/plugin/skills/secure-deployment-config/references/agent-builders.md b/plugin/skills/secure-deployment-config/references/agent-builders.md index fd8e54c10..2eec24017 100644 --- a/plugin/skills/secure-deployment-config/references/agent-builders.md +++ b/plugin/skills/secure-deployment-config/references/agent-builders.md @@ -1,6 +1,6 @@ # Agent and workflow builders: Dify, Flowise, Langflow, LibreChat -Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources. +Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources. A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide. @@ -26,7 +26,7 @@ At daemon 0.6.10, this is a plain TCP channel carrying newline-delimited JSON, w A key holder can register a remote plugin runtime into the key's tenant by supplying its declarations and assets. When Dify invokes that runtime, it receives the tool parameters or model prompts and any credentials included in those requests, and supplies the results. Treat the key as authority to supply remotely executed plugin code to the tenant's workflows; the plugin code runs at the connector, and this channel alone does not demonstrate shell execution on the Dify host. Keep the channel private even though its handshake uses a key. -Who can obtain a key: after instance setup, any initialized member with an active workspace and a valid console session can retrieve the current workspace's key, with the debugging host and port, through `GET /console/api/workspaces/current/plugin/debugging-key` at Dify commit `d39d9ddb7430522e0c828c6953afdf773ba6e675` under the defaults below. Enterprise RBAC (`RBAC_ENABLED`) defaults to false, which skips its check. The plugin-permission check then allows every member when the workspace has no plugin-permission record, and refuses only when the workspace's debug permission is set to nobody, or to admins for an account that is neither admin nor owner. The model's default `debug_permission` is `noone`, but it applies only once a row exists; with no row, everyone is allowed. By default, therefore, a member meeting those session and workspace prerequisites can retrieve the key and register a remote runtime. Where plugin debugging is needed, an admin or owner can set `debug_permission` to `admins` through the API `POST /console/api/workspaces/current/plugin/permission/change`, preserving the current `install_permission` in the request as well (omitting it defaults it to `everyone`). This is an API remedy; UI availability was not established. Otherwise disable the listener as described below. +Who can obtain a key: after instance setup, any initialized member with an active workspace and a valid console session can retrieve the current workspace's key, with the debugging host and port, through `GET /console/api/workspaces/current/plugin/debugging-key` at Dify commit `d39d9ddb7430522e0c828c6953afdf773ba6e675` under the defaults below. Enterprise RBAC (`RBAC_ENABLED`) defaults to false, which skips its check. The plugin-permission check then allows every member when the workspace has no plugin-permission record, and refuses only when the workspace's debug permission is set to nobody, or to admins for an account that is neither admin nor owner. The model's default `debug_permission` is `noone`, but it applies only once a row exists; with no row, everyone is allowed. By default, therefore, a member meeting those session and workspace prerequisites can retrieve the key and register a remote runtime. Where plugin debugging is needed, an admin or owner can set `debug_permission` to `admins` through the API `POST /console/api/workspaces/current/plugin/permission/change`, preserving the current `install_permission` in the request as well (omitting it defaults it to `everyone`). This is an API remedy that the console UI code also carries at the same commit: the console service layer reads both permissions from `GET /console/api/workspaces/current/plugin/permission/fetch` and writes them through the same permission-change endpoint, with a payload type that requires `install_permission` and `debug_permission` together and allows `everyone`, `admins` or `noone` for each, and the plugin settings-access hook returns that write beside a `canSetPermissions` flag requiring enterprise RBAC off plus the `plugin.plugin_preferences` workspace permission key. The cited files show that data path, not the screen: which roles hold that key and where the console renders the setting are not established, so this guide's advice is to make the change through the API call above. Otherwise disable the listener as described below. Set `PLUGIN_REMOTE_INSTALLING_ENABLED=false` in the `plugin_daemon` container environment when debugging is unused. This setting defaults to `true`; `false` prevents the TCP debugging server from starting and removes the daemon's debugging-key API route. It does not remove Docker's port publication. The override below disables the server and removes the publication together. @@ -277,6 +277,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max - Dify console prerequisites (instance setup, account initialization, active workspace and authenticated session): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L308-L321 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L113-L125 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L47-L59 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L152-L169 - Dify plugin permission model (row default `noone`, unlike the no-row allowance above): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407 - Dify permission-change API (admin or owner only, request defaults, create or update the permission row): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36 +- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (permission type and choices; UI read and write of both plugin permissions; settings-access gating; permission-fetch endpoint): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 - `docker compose ps` output fields (`Service`, `Publishers`, `PublishedPort`): https://docs.docker.com/reference/cli/docker/compose/ps/ @@ -349,7 +350,7 @@ Claims (full source mapping in the JSON block below): - debug-key-access (REASONED; dify-console): Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions. - rbac-default (REASONED; dify-console): RBAC_ENABLED defaults false and skips enterprise RBAC checks. - plugin-permission (REASONED; dify-console): No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner. -- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone; UI availability unestablished. +- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone. Console UI code reads and writes both permissions together with choices everyone/admins/noone behind RBAC off plus the plugin.plugin_preferences key; which roles hold that key and where the console renders the setting are unestablished. - debug-disable (REASONED; daemon, docker): PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication. - verify-debug-config (REASONED; dify-console, daemon, docker): Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration. - flowise-tls (REASONED; flowise): Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses. @@ -395,9 +396,9 @@ Claims (full source mapping in the JSON block below): ````json { "schema": 1, - "checked": "2026-10-17", + "checked": "2026-10-19", "documentation_checked": "2026-09", - "body_sha256": "49aeeb6f2264d04bfeae494a08061515cc6649f8cda6dc14173a133553160593", + "body_sha256": "5863b63835e25b812a29eac0283a9daa899a4bbe1dc7b363ae6b6282e610991c", "components": { "daemon": { "name": "Dify plugin daemon", @@ -484,7 +485,13 @@ Claims (full source mapping in the JSON block below): "s1edf3fa3d667": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407", "s09ea6abe9b9c": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106", "s662ba88445cd": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172", - "s4b8c82f515c6": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36" + "s4b8c82f515c6": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36", + "s19d7f56161fe": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276", + "s2a08cae5a24f": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156", + "s934c0d2260fe": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188", + "s951644d96965": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43", + "s6bd02c94df1a": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100", + "s044852759e49": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131" } }, "dify-compose": { @@ -631,7 +638,7 @@ Claims (full source mapping in the JSON block below): "debug-key-access": {"text": "Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions.", "components": ["dify-console"], "sources": ["dify-console:s1cd4f464c880", "dify-console:s5384bb9d1e75", "dify-console:s7cdbcd9957ac", "dify-console:s182d16f6e475", "dify-console:sf9235e345b51", "dify-console:saa9ceb383427", "dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "rbac-default": {"text": "RBAC_ENABLED defaults false and skips enterprise RBAC checks.", "components": ["dify-console"], "sources": ["dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "plugin-permission": {"text": "No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner.", "components": ["dify-console"], "sources": ["dify-console:saa9ceb383427", "dify-console:s1edf3fa3d667"], "status": "REASONED"}, - "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone; UI availability unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6"], "status": "REASONED"}, + "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone. Console UI code reads and writes both permissions together with choices everyone/admins/noone behind RBAC off plus the plugin.plugin_preferences key; which roles hold that key and where the console renders the setting are unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6", "dify-console:s19d7f56161fe", "dify-console:s2a08cae5a24f", "dify-console:s934c0d2260fe", "dify-console:s951644d96965", "dify-console:s6bd02c94df1a", "dify-console:s044852759e49"], "status": "REASONED"}, "debug-disable": {"text": "PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication.", "components": ["daemon", "docker"], "sources": ["daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "verify-debug-config": {"text": "Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration.", "components": ["dify-console", "daemon", "docker"], "sources": ["dify-console:s1e4c822a36b1", "daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "flowise-tls": {"text": "Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses.", "components": ["flowise"], "sources": ["flowise:s7b675aa70798", "flowise:sfee1ae75d51a"], "status": "REASONED"}, diff --git a/site/llms-full.txt b/site/llms-full.txt index 741b6d864..8e92192c2 100644 --- a/site/llms-full.txt +++ b/site/llms-full.txt @@ -37310,7 +37310,7 @@ REASONED: preceding block; listener inventory, external TCP reachability, proxy/ # Agent and workflow builders: Dify, Flowise, Langflow, LibreChat -Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources. +Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources. A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide. @@ -37336,7 +37336,7 @@ At daemon 0.6.10, this is a plain TCP channel carrying newline-delimited JSON, w A key holder can register a remote plugin runtime into the key's tenant by supplying its declarations and assets. When Dify invokes that runtime, it receives the tool parameters or model prompts and any credentials included in those requests, and supplies the results. Treat the key as authority to supply remotely executed plugin code to the tenant's workflows; the plugin code runs at the connector, and this channel alone does not demonstrate shell execution on the Dify host. Keep the channel private even though its handshake uses a key. -Who can obtain a key: after instance setup, any initialized member with an active workspace and a valid console session can retrieve the current workspace's key, with the debugging host and port, through `GET /console/api/workspaces/current/plugin/debugging-key` at Dify commit `d39d9ddb7430522e0c828c6953afdf773ba6e675` under the defaults below. Enterprise RBAC (`RBAC_ENABLED`) defaults to false, which skips its check. The plugin-permission check then allows every member when the workspace has no plugin-permission record, and refuses only when the workspace's debug permission is set to nobody, or to admins for an account that is neither admin nor owner. The model's default `debug_permission` is `noone`, but it applies only once a row exists; with no row, everyone is allowed. By default, therefore, a member meeting those session and workspace prerequisites can retrieve the key and register a remote runtime. Where plugin debugging is needed, an admin or owner can set `debug_permission` to `admins` through the API `POST /console/api/workspaces/current/plugin/permission/change`, preserving the current `install_permission` in the request as well (omitting it defaults it to `everyone`). This is an API remedy; UI availability was not established. Otherwise disable the listener as described below. +Who can obtain a key: after instance setup, any initialized member with an active workspace and a valid console session can retrieve the current workspace's key, with the debugging host and port, through `GET /console/api/workspaces/current/plugin/debugging-key` at Dify commit `d39d9ddb7430522e0c828c6953afdf773ba6e675` under the defaults below. Enterprise RBAC (`RBAC_ENABLED`) defaults to false, which skips its check. The plugin-permission check then allows every member when the workspace has no plugin-permission record, and refuses only when the workspace's debug permission is set to nobody, or to admins for an account that is neither admin nor owner. The model's default `debug_permission` is `noone`, but it applies only once a row exists; with no row, everyone is allowed. By default, therefore, a member meeting those session and workspace prerequisites can retrieve the key and register a remote runtime. Where plugin debugging is needed, an admin or owner can set `debug_permission` to `admins` through the API `POST /console/api/workspaces/current/plugin/permission/change`, preserving the current `install_permission` in the request as well (omitting it defaults it to `everyone`). This is an API remedy that the console UI code also carries at the same commit: the console service layer reads both permissions from `GET /console/api/workspaces/current/plugin/permission/fetch` and writes them through the same permission-change endpoint, with a payload type that requires `install_permission` and `debug_permission` together and allows `everyone`, `admins` or `noone` for each, and the plugin settings-access hook returns that write beside a `canSetPermissions` flag requiring enterprise RBAC off plus the `plugin.plugin_preferences` workspace permission key. The cited files show that data path, not the screen: which roles hold that key and where the console renders the setting are not established, so this guide's advice is to make the change through the API call above. Otherwise disable the listener as described below. Set `PLUGIN_REMOTE_INSTALLING_ENABLED=false` in the `plugin_daemon` container environment when debugging is unused. This setting defaults to `true`; `false` prevents the TCP debugging server from starting and removes the daemon's debugging-key API route. It does not remove Docker's port publication. The override below disables the server and removes the publication together. @@ -37587,6 +37587,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max - Dify console prerequisites (instance setup, account initialization, active workspace and authenticated session): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L308-L321 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L113-L125 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L47-L59 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L152-L169 - Dify plugin permission model (row default `noone`, unlike the no-row allowance above): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407 - Dify permission-change API (admin or owner only, request defaults, create or update the permission row): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36 +- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (permission type and choices; UI read and write of both plugin permissions; settings-access gating; permission-fetch endpoint): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 - `docker compose ps` output fields (`Service`, `Publishers`, `PublishedPort`): https://docs.docker.com/reference/cli/docker/compose/ps/ @@ -37659,7 +37660,7 @@ Claims (full source mapping in the JSON block below): - debug-key-access (REASONED; dify-console): Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions. - rbac-default (REASONED; dify-console): RBAC_ENABLED defaults false and skips enterprise RBAC checks. - plugin-permission (REASONED; dify-console): No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner. -- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone; UI availability unestablished. +- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone. Console UI code reads and writes both permissions together with choices everyone/admins/noone behind RBAC off plus the plugin.plugin_preferences key; which roles hold that key and where the console renders the setting are unestablished. - debug-disable (REASONED; daemon, docker): PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication. - verify-debug-config (REASONED; dify-console, daemon, docker): Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration. - flowise-tls (REASONED; flowise): Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses. @@ -37705,9 +37706,9 @@ Claims (full source mapping in the JSON block below): ````json { "schema": 1, - "checked": "2026-10-17", + "checked": "2026-10-19", "documentation_checked": "2026-09", - "body_sha256": "49aeeb6f2264d04bfeae494a08061515cc6649f8cda6dc14173a133553160593", + "body_sha256": "5863b63835e25b812a29eac0283a9daa899a4bbe1dc7b363ae6b6282e610991c", "components": { "daemon": { "name": "Dify plugin daemon", @@ -37794,7 +37795,13 @@ Claims (full source mapping in the JSON block below): "s1edf3fa3d667": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407", "s09ea6abe9b9c": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106", "s662ba88445cd": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172", - "s4b8c82f515c6": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36" + "s4b8c82f515c6": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36", + "s19d7f56161fe": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276", + "s2a08cae5a24f": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156", + "s934c0d2260fe": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188", + "s951644d96965": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43", + "s6bd02c94df1a": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100", + "s044852759e49": "https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131" } }, "dify-compose": { @@ -37941,7 +37948,7 @@ Claims (full source mapping in the JSON block below): "debug-key-access": {"text": "Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions.", "components": ["dify-console"], "sources": ["dify-console:s1cd4f464c880", "dify-console:s5384bb9d1e75", "dify-console:s7cdbcd9957ac", "dify-console:s182d16f6e475", "dify-console:sf9235e345b51", "dify-console:saa9ceb383427", "dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "rbac-default": {"text": "RBAC_ENABLED defaults false and skips enterprise RBAC checks.", "components": ["dify-console"], "sources": ["dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "plugin-permission": {"text": "No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner.", "components": ["dify-console"], "sources": ["dify-console:saa9ceb383427", "dify-console:s1edf3fa3d667"], "status": "REASONED"}, - "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone; UI availability unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6"], "status": "REASONED"}, + "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone. Console UI code reads and writes both permissions together with choices everyone/admins/noone behind RBAC off plus the plugin.plugin_preferences key; which roles hold that key and where the console renders the setting are unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6", "dify-console:s19d7f56161fe", "dify-console:s2a08cae5a24f", "dify-console:s934c0d2260fe", "dify-console:s951644d96965", "dify-console:s6bd02c94df1a", "dify-console:s044852759e49"], "status": "REASONED"}, "debug-disable": {"text": "PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication.", "components": ["daemon", "docker"], "sources": ["daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "verify-debug-config": {"text": "Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration.", "components": ["dify-console", "daemon", "docker"], "sources": ["dify-console:s1e4c822a36b1", "daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "flowise-tls": {"text": "Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses.", "components": ["flowise"], "sources": ["flowise:s7b675aa70798", "flowise:sfee1ae75d51a"], "status": "REASONED"}, From 334a748b6575f97e94ab93247072b37023c24ed6 Mon Sep 17 00:00:00 2001 From: Jeff Posluns Date: Mon, 19 Oct 2026 07:59:29 -0400 Subject: [PATCH 2/3] agent-builders.md: state the permission flag relationship exactly; date the new source (round 1) QA fixes: the hook computes canSetPermissions alongside the calls; the cited lines do not show it guarding them; the new Sources item is dated October 2026. --- agent-builders.md | 8 ++++---- .../secure-deployment-config/references/MANIFEST.sha256 | 2 +- .../secure-deployment-config/references/agent-builders.md | 8 ++++---- site/llms-full.txt | 8 ++++---- 4 files changed, 13 insertions(+), 13 deletions(-) diff --git a/agent-builders.md b/agent-builders.md index 2eec24017..f0e89637a 100644 --- a/agent-builders.md +++ b/agent-builders.md @@ -277,7 +277,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max - Dify console prerequisites (instance setup, account initialization, active workspace and authenticated session): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L308-L321 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L113-L125 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L47-L59 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L152-L169 - Dify plugin permission model (row default `noone`, unlike the no-row allowance above): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407 - Dify permission-change API (admin or owner only, request defaults, create or update the permission row): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36 -- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (permission type and choices; UI read and write of both plugin permissions; settings-access gating; permission-fetch endpoint): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 +- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (checked October 2026) (permission type and choices; UI read and write of both plugin permissions; settings-access gating; permission-fetch endpoint): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 - `docker compose ps` output fields (`Service`, `Publishers`, `PublishedPort`): https://docs.docker.com/reference/cli/docker/compose/ps/ @@ -350,7 +350,7 @@ Claims (full source mapping in the JSON block below): - debug-key-access (REASONED; dify-console): Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions. - rbac-default (REASONED; dify-console): RBAC_ENABLED defaults false and skips enterprise RBAC checks. - plugin-permission (REASONED; dify-console): No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner. -- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone. Console UI code reads and writes both permissions together with choices everyone/admins/noone behind RBAC off plus the plugin.plugin_preferences key; which roles hold that key and where the console renders the setting are unestablished. +- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, omitted default everyone. Console code reads/writes both (everyone/admins/noone); the hook computes canSetPermissions (RBAC off plus plugin.plugin_preferences) alongside the calls, returning the flag and mutation separately; key-holding roles and rendered setting location remain unestablished. - debug-disable (REASONED; daemon, docker): PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication. - verify-debug-config (REASONED; dify-console, daemon, docker): Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration. - flowise-tls (REASONED; flowise): Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses. @@ -398,7 +398,7 @@ Claims (full source mapping in the JSON block below): "schema": 1, "checked": "2026-10-19", "documentation_checked": "2026-09", - "body_sha256": "5863b63835e25b812a29eac0283a9daa899a4bbe1dc7b363ae6b6282e610991c", + "body_sha256": "f110f2afc2f304e1a76c1604f387e45d48683737bde4676c6eac86ce42cd0add", "components": { "daemon": { "name": "Dify plugin daemon", @@ -638,7 +638,7 @@ Claims (full source mapping in the JSON block below): "debug-key-access": {"text": "Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions.", "components": ["dify-console"], "sources": ["dify-console:s1cd4f464c880", "dify-console:s5384bb9d1e75", "dify-console:s7cdbcd9957ac", "dify-console:s182d16f6e475", "dify-console:sf9235e345b51", "dify-console:saa9ceb383427", "dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "rbac-default": {"text": "RBAC_ENABLED defaults false and skips enterprise RBAC checks.", "components": ["dify-console"], "sources": ["dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "plugin-permission": {"text": "No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner.", "components": ["dify-console"], "sources": ["dify-console:saa9ceb383427", "dify-console:s1edf3fa3d667"], "status": "REASONED"}, - "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone. Console UI code reads and writes both permissions together with choices everyone/admins/noone behind RBAC off plus the plugin.plugin_preferences key; which roles hold that key and where the console renders the setting are unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6", "dify-console:s19d7f56161fe", "dify-console:s2a08cae5a24f", "dify-console:s934c0d2260fe", "dify-console:s951644d96965", "dify-console:s6bd02c94df1a", "dify-console:s044852759e49"], "status": "REASONED"}, + "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, omitted default everyone. Console code reads/writes both (everyone/admins/noone); the hook computes canSetPermissions (RBAC off plus plugin.plugin_preferences) alongside the calls, returning the flag and mutation separately; key-holding roles and rendered setting location remain unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6", "dify-console:s19d7f56161fe", "dify-console:s2a08cae5a24f", "dify-console:s934c0d2260fe", "dify-console:s951644d96965", "dify-console:s6bd02c94df1a", "dify-console:s044852759e49"], "status": "REASONED"}, "debug-disable": {"text": "PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication.", "components": ["daemon", "docker"], "sources": ["daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "verify-debug-config": {"text": "Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration.", "components": ["dify-console", "daemon", "docker"], "sources": ["dify-console:s1e4c822a36b1", "daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "flowise-tls": {"text": "Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses.", "components": ["flowise"], "sources": ["flowise:s7b675aa70798", "flowise:sfee1ae75d51a"], "status": "REASONED"}, diff --git a/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 b/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 index e98610306..c83f8f069 100644 --- a/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 +++ b/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 @@ -76,7 +76,7 @@ cae5895e27a2a0d08773bf3c6f346c25deee35db50f15cfaaceff1c2545eba3e self-hosted-er 86c0dcec778ea45f122f458981177bbe1fe089867183613939570b2fde1fdff5 mcp-clients.md b27badebb07b6e99d62e88c3aa748112bb85b8128a57cd3fc593983a3dd7daa6 ray.md 0d4ebac99993632db53c1a3c835bf0cc8f113d689c2e1884b317b1427570651c mlflow.md -cfbf661b24d8879712ea12e0c5ede7812205f6a07274049d831f4b07a1c65b6e agent-builders.md +24087e11b73291dfa0d93d01d4711469241499592daa1a36a5a2c5ebf7e3d756 agent-builders.md f205ad0512c2ad45bee20f9cce6faee7eaadddc16af066c413eee316ec79efa9 ai-infra-services.md 5448efdd90dc5fdf90429e23ef8b8dbad8cad33a36b2d056ca426a63b4d56096 realtime-voice-infra.md 6b2981ef25b7920fae2233cb7fa2e8583b79d92af2aff8a715a585a0831dec60 image-gen-uis.md diff --git a/plugin/skills/secure-deployment-config/references/agent-builders.md b/plugin/skills/secure-deployment-config/references/agent-builders.md index 2eec24017..f0e89637a 100644 --- a/plugin/skills/secure-deployment-config/references/agent-builders.md +++ b/plugin/skills/secure-deployment-config/references/agent-builders.md @@ -277,7 +277,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max - Dify console prerequisites (instance setup, account initialization, active workspace and authenticated session): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L308-L321 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L113-L125 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L47-L59 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L152-L169 - Dify plugin permission model (row default `noone`, unlike the no-row allowance above): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407 - Dify permission-change API (admin or owner only, request defaults, create or update the permission row): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36 -- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (permission type and choices; UI read and write of both plugin permissions; settings-access gating; permission-fetch endpoint): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 +- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (checked October 2026) (permission type and choices; UI read and write of both plugin permissions; settings-access gating; permission-fetch endpoint): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 - `docker compose ps` output fields (`Service`, `Publishers`, `PublishedPort`): https://docs.docker.com/reference/cli/docker/compose/ps/ @@ -350,7 +350,7 @@ Claims (full source mapping in the JSON block below): - debug-key-access (REASONED; dify-console): Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions. - rbac-default (REASONED; dify-console): RBAC_ENABLED defaults false and skips enterprise RBAC checks. - plugin-permission (REASONED; dify-console): No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner. -- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone. Console UI code reads and writes both permissions together with choices everyone/admins/noone behind RBAC off plus the plugin.plugin_preferences key; which roles hold that key and where the console renders the setting are unestablished. +- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, omitted default everyone. Console code reads/writes both (everyone/admins/noone); the hook computes canSetPermissions (RBAC off plus plugin.plugin_preferences) alongside the calls, returning the flag and mutation separately; key-holding roles and rendered setting location remain unestablished. - debug-disable (REASONED; daemon, docker): PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication. - verify-debug-config (REASONED; dify-console, daemon, docker): Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration. - flowise-tls (REASONED; flowise): Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses. @@ -398,7 +398,7 @@ Claims (full source mapping in the JSON block below): "schema": 1, "checked": "2026-10-19", "documentation_checked": "2026-09", - "body_sha256": "5863b63835e25b812a29eac0283a9daa899a4bbe1dc7b363ae6b6282e610991c", + "body_sha256": "f110f2afc2f304e1a76c1604f387e45d48683737bde4676c6eac86ce42cd0add", "components": { "daemon": { "name": "Dify plugin daemon", @@ -638,7 +638,7 @@ Claims (full source mapping in the JSON block below): "debug-key-access": {"text": "Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions.", "components": ["dify-console"], "sources": ["dify-console:s1cd4f464c880", "dify-console:s5384bb9d1e75", "dify-console:s7cdbcd9957ac", "dify-console:s182d16f6e475", "dify-console:sf9235e345b51", "dify-console:saa9ceb383427", "dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "rbac-default": {"text": "RBAC_ENABLED defaults false and skips enterprise RBAC checks.", "components": ["dify-console"], "sources": ["dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "plugin-permission": {"text": "No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner.", "components": ["dify-console"], "sources": ["dify-console:saa9ceb383427", "dify-console:s1edf3fa3d667"], "status": "REASONED"}, - "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone. Console UI code reads and writes both permissions together with choices everyone/admins/noone behind RBAC off plus the plugin.plugin_preferences key; which roles hold that key and where the console renders the setting are unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6", "dify-console:s19d7f56161fe", "dify-console:s2a08cae5a24f", "dify-console:s934c0d2260fe", "dify-console:s951644d96965", "dify-console:s6bd02c94df1a", "dify-console:s044852759e49"], "status": "REASONED"}, + "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, omitted default everyone. Console code reads/writes both (everyone/admins/noone); the hook computes canSetPermissions (RBAC off plus plugin.plugin_preferences) alongside the calls, returning the flag and mutation separately; key-holding roles and rendered setting location remain unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6", "dify-console:s19d7f56161fe", "dify-console:s2a08cae5a24f", "dify-console:s934c0d2260fe", "dify-console:s951644d96965", "dify-console:s6bd02c94df1a", "dify-console:s044852759e49"], "status": "REASONED"}, "debug-disable": {"text": "PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication.", "components": ["daemon", "docker"], "sources": ["daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "verify-debug-config": {"text": "Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration.", "components": ["dify-console", "daemon", "docker"], "sources": ["dify-console:s1e4c822a36b1", "daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "flowise-tls": {"text": "Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses.", "components": ["flowise"], "sources": ["flowise:s7b675aa70798", "flowise:sfee1ae75d51a"], "status": "REASONED"}, diff --git a/site/llms-full.txt b/site/llms-full.txt index 8e92192c2..ea4f42c68 100644 --- a/site/llms-full.txt +++ b/site/llms-full.txt @@ -37587,7 +37587,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max - Dify console prerequisites (instance setup, account initialization, active workspace and authenticated session): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L308-L321 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L113-L125 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L47-L59 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L152-L169 - Dify plugin permission model (row default `noone`, unlike the no-row allowance above): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407 - Dify permission-change API (admin or owner only, request defaults, create or update the permission row): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36 -- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (permission type and choices; UI read and write of both plugin permissions; settings-access gating; permission-fetch endpoint): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 +- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (checked October 2026) (permission type and choices; UI read and write of both plugin permissions; settings-access gating; permission-fetch endpoint): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 - `docker compose ps` output fields (`Service`, `Publishers`, `PublishedPort`): https://docs.docker.com/reference/cli/docker/compose/ps/ @@ -37660,7 +37660,7 @@ Claims (full source mapping in the JSON block below): - debug-key-access (REASONED; dify-console): Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions. - rbac-default (REASONED; dify-console): RBAC_ENABLED defaults false and skips enterprise RBAC checks. - plugin-permission (REASONED; dify-console): No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner. -- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone. Console UI code reads and writes both permissions together with choices everyone/admins/noone behind RBAC off plus the plugin.plugin_preferences key; which roles hold that key and where the console renders the setting are unestablished. +- debug-remedy (REASONED; dify-console): Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, omitted default everyone. Console code reads/writes both (everyone/admins/noone); the hook computes canSetPermissions (RBAC off plus plugin.plugin_preferences) alongside the calls, returning the flag and mutation separately; key-holding roles and rendered setting location remain unestablished. - debug-disable (REASONED; daemon, docker): PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication. - verify-debug-config (REASONED; dify-console, daemon, docker): Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration. - flowise-tls (REASONED; flowise): Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses. @@ -37708,7 +37708,7 @@ Claims (full source mapping in the JSON block below): "schema": 1, "checked": "2026-10-19", "documentation_checked": "2026-09", - "body_sha256": "5863b63835e25b812a29eac0283a9daa899a4bbe1dc7b363ae6b6282e610991c", + "body_sha256": "f110f2afc2f304e1a76c1604f387e45d48683737bde4676c6eac86ce42cd0add", "components": { "daemon": { "name": "Dify plugin daemon", @@ -37948,7 +37948,7 @@ Claims (full source mapping in the JSON block below): "debug-key-access": {"text": "Initialized authenticated member with active workspace after setup can GET current workspace debugging-key under documented default permissions.", "components": ["dify-console"], "sources": ["dify-console:s1cd4f464c880", "dify-console:s5384bb9d1e75", "dify-console:s7cdbcd9957ac", "dify-console:s182d16f6e475", "dify-console:sf9235e345b51", "dify-console:saa9ceb383427", "dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "rbac-default": {"text": "RBAC_ENABLED defaults false and skips enterprise RBAC checks.", "components": ["dify-console"], "sources": ["dify-console:s3998f01569b8", "dify-console:s39e0b615af71"], "status": "REASONED"}, "plugin-permission": {"text": "No plugin-permission row allows every member; existing row default noone differs, and admins permits only admin/owner.", "components": ["dify-console"], "sources": ["dify-console:saa9ceb383427", "dify-console:s1edf3fa3d667"], "status": "REASONED"}, - "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, whose omitted value defaults everyone. Console UI code reads and writes both permissions together with choices everyone/admins/noone behind RBAC off plus the plugin.plugin_preferences key; which roles hold that key and where the console renders the setting are unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6", "dify-console:s19d7f56161fe", "dify-console:s2a08cae5a24f", "dify-console:s934c0d2260fe", "dify-console:s951644d96965", "dify-console:s6bd02c94df1a", "dify-console:s044852759e49"], "status": "REASONED"}, + "debug-remedy": {"text": "Admin/owner may POST permission/change with debug_permission admins; preserve install_permission, omitted default everyone. Console code reads/writes both (everyone/admins/noone); the hook computes canSetPermissions (RBAC off plus plugin.plugin_preferences) alongside the calls, returning the flag and mutation separately; key-holding roles and rendered setting location remain unestablished.", "components": ["dify-console"], "sources": ["dify-console:s09ea6abe9b9c", "dify-console:s662ba88445cd", "dify-console:s4b8c82f515c6", "dify-console:s19d7f56161fe", "dify-console:s2a08cae5a24f", "dify-console:s934c0d2260fe", "dify-console:s951644d96965", "dify-console:s6bd02c94df1a", "dify-console:s044852759e49"], "status": "REASONED"}, "debug-disable": {"text": "PLUGIN_REMOTE_INSTALLING_ENABLED defaults true; false prevents TCP startup and removes debugging-key route, while ports: !reset [] separately removes publication.", "components": ["daemon", "docker"], "sources": ["daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "verify-debug-config": {"text": "Merged Compose should change from published 5003/default-enabled to no publication and explicit false after override and recreation; no Docker/listener demonstration.", "components": ["dify-console", "daemon", "docker"], "sources": ["dify-console:s1e4c822a36b1", "daemon:s191317bdf3a7", "daemon:s32b7d021da01", "daemon:sb19f8717ed1f", "docker:se716ad33db1f"], "status": "REASONED"}, "flowise-tls": {"text": "Flowise documented TLS uses nginx/certbot upstream localhost:3000; configure NUMBER_OF_PROXIES for real client addresses.", "components": ["flowise"], "sources": ["flowise:s7b675aa70798", "flowise:sfee1ae75d51a"], "status": "REASONED"}, From da274708972739fe4fd830b010614715f71faa93 Mon Sep 17 00:00:00 2001 From: Jeff Posluns Date: Mon, 19 Oct 2026 08:26:34 -0400 Subject: [PATCH 3/3] agent-builders.md and DONE.md: remove the remaining gating wording (round 2) QA: the DONE row and the Sources label still implied the flag gates the read/write; both now describe the flag the hook returns beside the write; the new item's date moves inside its description. --- DONE.md | 2 +- agent-builders.md | 4 ++-- .../secure-deployment-config/references/MANIFEST.sha256 | 2 +- .../secure-deployment-config/references/agent-builders.md | 4 ++-- site/llms-full.txt | 4 ++-- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/DONE.md b/DONE.md index 49fb5c0dc..dd3510d53 100644 --- a/DONE.md +++ b/DONE.md @@ -10,7 +10,7 @@ because an item that simply vanishes gets proposed again six months later. | ID | Item | Ended | | --- | --- | --- | -| 1.283 | `agent-builders.md`: debug-remedy: establish whether the debug_permission change is available in the console UI; API remedy is already cited and UI availability is unestablished. (M, M) | Done, #695. Cited, at the pinned console commit, the console UI read and write of both plugin permissions through the permission fetch and change endpoints, the payload type that pairs install_permission with debug_permission and allows everyone/admins/noone, and the settings-access gating behind RBAC off plus the plugin.plugin_preferences key; which roles hold that key and where the console renders the control stay open in TODO.md under the same ID. | +| 1.283 | `agent-builders.md`: debug-remedy: establish whether the debug_permission change is available in the console UI; API remedy is already cited and UI availability is unestablished. (M, M) | Done, #695. Cited, at the pinned console commit, the console UI read and write of both plugin permissions through the permission fetch and change endpoints, the payload type that pairs install_permission with debug_permission and allows everyone/admins/noone, and the canSetPermissions flag (RBAC off plus the plugin.plugin_preferences key) that the settings-access hook returns beside the write; which roles hold that key and where the console renders the control stay open in TODO.md under the same ID. | | 1.293 | `authentication.md`: fail2ban: source or narrow the coverage and setup of login panels beyond the cited sshd jail and failure filter. (M, M) | Done, #694. Cited fail2ban 1.1.1 nginx HTTP-auth and Webmin jails and filter patterns, retained the SSH requirement, and labelled log-selection advice and the limits on panel coverage and setup ease. | | 1.292 | `authentication.md`: cloudflare-access: source or narrow the claim that Cloudflare Access can front any application unchanged, including the One-time PIN and SSO options still not established by the cited pages. (M, M) | Done, #692. Cited the pinned one-time PIN, identity-provider options and generic OIDC pages for the login methods, narrowed the fronting statement to a self-hosted web application published through Access, and labelled unchanged any-application use as not established and this guide's assessment. | | 1.291 | `pocketbase.md`: source-limits: trace the PocketBase CLI wrapper and Appwrite document read authorization and privileged/API-key requester classification; establish the `--dev` default. (M, M) | Done, #690. Pinned the PocketBase v0.40.4 wrapper wiring, the `--dev` default (disabled unless probably started with go run) and its dev-mode logging effects, and the Appwrite 2.2.0 keys/privileged requester classification, API-key and admin-mode authorization-status handling, route scope validation and document-read call sites; the utopia-php/database role-to-permission enforcement stays open in TODO.md under the same ID. | diff --git a/agent-builders.md b/agent-builders.md index f0e89637a..05743d552 100644 --- a/agent-builders.md +++ b/agent-builders.md @@ -277,7 +277,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max - Dify console prerequisites (instance setup, account initialization, active workspace and authenticated session): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L308-L321 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L113-L125 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L47-L59 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L152-L169 - Dify plugin permission model (row default `noone`, unlike the no-row allowance above): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407 - Dify permission-change API (admin or owner only, request defaults, create or update the permission row): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36 -- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (checked October 2026) (permission type and choices; UI read and write of both plugin permissions; settings-access gating; permission-fetch endpoint): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 +- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (permission type and choices; UI read and write of both plugin permissions; settings-access flag; permission-fetch endpoint; checked October 2026): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 - `docker compose ps` output fields (`Service`, `Publishers`, `PublishedPort`): https://docs.docker.com/reference/cli/docker/compose/ps/ @@ -398,7 +398,7 @@ Claims (full source mapping in the JSON block below): "schema": 1, "checked": "2026-10-19", "documentation_checked": "2026-09", - "body_sha256": "f110f2afc2f304e1a76c1604f387e45d48683737bde4676c6eac86ce42cd0add", + "body_sha256": "d9b3ee77e381107c6cb13fbb56ef6cc80dad8ebcffdf662fb0c82608db2cd8f2", "components": { "daemon": { "name": "Dify plugin daemon", diff --git a/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 b/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 index c83f8f069..3cf838f76 100644 --- a/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 +++ b/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 @@ -76,7 +76,7 @@ cae5895e27a2a0d08773bf3c6f346c25deee35db50f15cfaaceff1c2545eba3e self-hosted-er 86c0dcec778ea45f122f458981177bbe1fe089867183613939570b2fde1fdff5 mcp-clients.md b27badebb07b6e99d62e88c3aa748112bb85b8128a57cd3fc593983a3dd7daa6 ray.md 0d4ebac99993632db53c1a3c835bf0cc8f113d689c2e1884b317b1427570651c mlflow.md -24087e11b73291dfa0d93d01d4711469241499592daa1a36a5a2c5ebf7e3d756 agent-builders.md +02779a52c70f2d558f5053862d4f68f69a2ffbe143a756e55b4d26f865dcd2a3 agent-builders.md f205ad0512c2ad45bee20f9cce6faee7eaadddc16af066c413eee316ec79efa9 ai-infra-services.md 5448efdd90dc5fdf90429e23ef8b8dbad8cad33a36b2d056ca426a63b4d56096 realtime-voice-infra.md 6b2981ef25b7920fae2233cb7fa2e8583b79d92af2aff8a715a585a0831dec60 image-gen-uis.md diff --git a/plugin/skills/secure-deployment-config/references/agent-builders.md b/plugin/skills/secure-deployment-config/references/agent-builders.md index f0e89637a..05743d552 100644 --- a/plugin/skills/secure-deployment-config/references/agent-builders.md +++ b/plugin/skills/secure-deployment-config/references/agent-builders.md @@ -277,7 +277,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max - Dify console prerequisites (instance setup, account initialization, active workspace and authenticated session): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L308-L321 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L113-L125 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L47-L59 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L152-L169 - Dify plugin permission model (row default `noone`, unlike the no-row allowance above): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407 - Dify permission-change API (admin or owner only, request defaults, create or update the permission row): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36 -- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (checked October 2026) (permission type and choices; UI read and write of both plugin permissions; settings-access gating; permission-fetch endpoint): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 +- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (permission type and choices; UI read and write of both plugin permissions; settings-access flag; permission-fetch endpoint; checked October 2026): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 - `docker compose ps` output fields (`Service`, `Publishers`, `PublishedPort`): https://docs.docker.com/reference/cli/docker/compose/ps/ @@ -398,7 +398,7 @@ Claims (full source mapping in the JSON block below): "schema": 1, "checked": "2026-10-19", "documentation_checked": "2026-09", - "body_sha256": "f110f2afc2f304e1a76c1604f387e45d48683737bde4676c6eac86ce42cd0add", + "body_sha256": "d9b3ee77e381107c6cb13fbb56ef6cc80dad8ebcffdf662fb0c82608db2cd8f2", "components": { "daemon": { "name": "Dify plugin daemon", diff --git a/site/llms-full.txt b/site/llms-full.txt index ea4f42c68..26936e6af 100644 --- a/site/llms-full.txt +++ b/site/llms-full.txt @@ -37587,7 +37587,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max - Dify console prerequisites (instance setup, account initialization, active workspace and authenticated session): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L308-L321 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/wraps.py#L113-L125 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L47-L59 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/libs/login.py#L152-L169 - Dify plugin permission model (row default `noone`, unlike the no-row allowance above): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/models/account.py#L402-L407 - Dify permission-change API (admin or owner only, request defaults, create or update the permission row): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1086-L1106 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L170-L172 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/services/plugin/plugin_permission_service.py#L14-L36 -- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (checked October 2026) (permission type and choices; UI read and write of both plugin permissions; settings-access gating; permission-fetch endpoint): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 +- Dify console UI at d39d9ddb7430522e0c828c6953afdf773ba6e675 (permission type and choices; UI read and write of both plugin permissions; settings-access flag; permission-fetch endpoint; checked October 2026): https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/types.ts#L267-L276 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1151-L1156 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/service/use-plugins.ts#L1178-L1188 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L28-L43 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/web/app/components/plugins/plugin-page/use-reference-setting.ts#L60-L100 ; https://github.com/langgenius/dify/blob/d39d9ddb7430522e0c828c6953afdf773ba6e675/api/controllers/console/workspace/plugin.py#L1109-L1131 - `docker compose ps` output fields (`Service`, `Publishers`, `PublishedPort`): https://docs.docker.com/reference/cli/docker/compose/ps/ @@ -37708,7 +37708,7 @@ Claims (full source mapping in the JSON block below): "schema": 1, "checked": "2026-10-19", "documentation_checked": "2026-09", - "body_sha256": "f110f2afc2f304e1a76c1604f387e45d48683737bde4676c6eac86ce42cd0add", + "body_sha256": "d9b3ee77e381107c6cb13fbb56ef6cc80dad8ebcffdf662fb0c82608db2cd8f2", "components": { "daemon": { "name": "Dify plugin daemon",