Charles YaoandClaude Opus 5 be24b00a2a fix(dify-builder): requirements analysis stops inventing endpoints and credentials ...

S5b (local E2E 2026-09-22, F2): analyze_goal's "a sensible default value per
field" led the LLM to prefill render_api_url=https://api.yourcompany.com/...
and Authorization: Bearer YOUR_API_KEY for a goal that named neither -- caught
only because "yourcompany" happened to match an existing placeholder-URL
regex; a plausible invented host would slip through and recreate ESQ1-302's
launch failure one step upstream, in the requirements form itself.

Adds services/dify_builder/agent/user_supplied.py (pure, no I/O): url_hosts,
is_user_supplied_url, CREDENTIAL_PLACEHOLDER_RE, is_user_supplied_secret,
trusted_text_for -- shared primitives for telling a literal the user actually
wrote from one an LLM invented, used by this task and consumed by later
tasks in the same plan.

build.analyze_goal now tells the model never to invent such a field's
default, and _scrub_invented_defaults deterministically blanks any top-level
field whose value contains a URL host, or a credential-shaped or
credential-keyed literal, not present in the goal text -- decided on hosts
and literal text, never on LLM prose.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-22 08:40:33 -07:00

..

agent

feat(agent): record E2B sandbox runtime usage (#42554)

2026-09-21 07:11:12 +00:00

auth

refactor(api): require active workspace in request context (#41280)

2026-09-02 06:54:47 +00:00

data_migration

refactor: reduce ambiguity in mcp queries (#42395)

2026-09-18 09:17:36 +00:00

dify_builder

fix(dify-builder): requirements analysis stops inventing endpoints and credentials

2026-09-22 08:40:33 -07:00

document_indexing_proxy

refactor(api): remove legacy billing enabled state (#41917)

2026-09-07 08:29:57 +00:00

enterprise

feat(rbac): agent RBAC/ACL scenes and resource-locator check bundles (#41768)

2026-09-07 04:39:43 +00:00

entities

Merge branch 'main' into feat/dify-builder

2026-09-17 17:01:34 +08:00

errors

feat: app deployment v2 (#41444)

2026-09-04 02:01:35 +00:00

openapi

refactor(openapi): route /openapi/v1 auth by subject (#41420)

2026-09-18 08:42:53 +00:00

plugin

fix(api): scope temporary capabilities to owners (#39863)

2026-08-07 09:21:13 +00:00

rag_pipeline

refactor(api): merge duplicated model builders in unit tests (#41549)

2026-09-18 05:10:25 +00:00

retention

fix(retention): harden V2 archive deletion recovery (#41358)

2026-09-19 07:54:35 +00:00

tools

refactor: reduce ambiguity in mcp queries (#42395)

2026-09-18 09:17:36 +00:00

trigger

fix: fix undo delete operation for webhook trigger node lead the url … (#42069)

2026-09-09 09:02:04 +00:00

workflow

refactor(agent): simplify Agent v2 output contract (#41062)

2026-08-21 11:55:25 +00:00

__init__.py

…

account_access_service.py

refactor(api): move OpenAPI account access behind application services (#41308)

2026-09-04 07:38:01 +00:00

account_activation_service.py

feat: new user add automatic add to app / dataset whitelist (#41363)

2026-08-27 08:51:05 +00:00

account_adapters.py

style(api): remove unnecessary type conversions in services, repositories and tests (#41856)

2026-09-07 15:54:53 +00:00

account_avatar_file_gateway.py

refactor(api): move account access behind application services (#40437)

2026-08-21 05:56:30 +00:00

account_avatar_service.py

refactor(api): move account access behind application services (#40437)

2026-08-21 05:56:30 +00:00

account_change_email_ports.py

refactor(api): extract change email state machine (#40439)

2026-08-21 08:13:23 +00:00

account_change_email_service.py

refactor(api): extract change email state machine (#40439)

2026-08-21 08:13:23 +00:00

account_deletion_feedback_service.py

refactor(api): finish account controller application boundary (#40440)

2026-08-21 08:46:06 +00:00

account_deletion_service.py

refactor(api): move account lifecycle into application services (#40438)

2026-08-21 08:05:43 +00:00

account_education_service.py

fix(console): stop advertising the education plan outside Dify Cloud (#41898)

2026-09-09 04:38:50 +00:00

account_email_registration_adapters.py

refactor(api): extract email registration application service (#41108)

2026-08-31 03:22:01 +00:00

account_email_registration_service.py

refactor(api): extract email registration application service (#41108)

2026-08-31 03:22:01 +00:00

account_email.py

feat(api): normalize additional email providers (#42112)

2026-09-11 02:41:35 +00:00

account_errors.py

refactor(api): move OpenAPI account access behind application services (#41308)

2026-09-04 07:38:01 +00:00

account_forgot_password_adapters.py

refactor(api): extract forgot password application service (#41111)

2026-09-03 01:38:59 +00:00

account_forgot_password_service.py

refactor(api): extract forgot password application service (#41111)

2026-09-03 01:38:59 +00:00

account_initialization_service.py

refactor(api): require active workspace in request context (#41280)

2026-09-02 06:54:47 +00:00

account_integration_service.py

refactor(api): move account access behind application services (#40437)

2026-08-21 05:56:30 +00:00

account_login_adapters.py

style(api): remove unnecessary type conversions in services, repositories and tests (#41856)

2026-09-07 15:54:53 +00:00

account_login_service.py

refactor(api): extract account login service and consolidate adapters (#41184)

2026-09-03 06:20:21 +00:00

account_oauth_adapters.py

refactor(api): decouple console OAuth flow from legacy account services (#41188)

2026-09-03 08:47:14 +00:00

account_oauth_service.py

refactor(api): decouple console OAuth flow from legacy account services (#41188)

2026-09-03 08:47:14 +00:00

account_password_hasher.py

refactor(api): extract forgot password application service (#41111)

2026-09-03 01:38:59 +00:00

account_password_service.py

refactor(api): move account access behind application services (#40437)

2026-08-21 05:56:30 +00:00

account_ports.py

refactor(api): move OpenAPI account access behind application services (#41308)

2026-09-04 07:38:01 +00:00

account_profile_service.py

refactor(api): add account profile application service (#40436)

2026-08-20 05:03:08 +00:00

account_security_gateway.py

refactor(api): extract forgot password application service (#41111)

2026-09-03 01:38:59 +00:00

account_service.py

fix(account): make case-fallback email lookup work in both directions (#42541)

2026-09-20 02:01:55 +00:00

advanced_prompt_template_service.py

refactor: replace bare dict with AdvancedPromptTemplateArgs TypedDict (#35056)

2026-04-13 13:05:23 +00:00

agent_app_feature_service.py

chore: clean Db session from service (#38227)

2026-07-08 03:07:27 +00:00

agent_app_sandbox_service.py

fix(agent): persist Chatflow Agent V2 memory by conversation_id (#41871)

2026-09-08 03:31:01 +00:00

agent_config_service.py

feat(agent): add roster package export foundation (#42066)

2026-09-17 07:05:02 +00:00

agent_llm_inner_service.py

feat(api): track credit usage contexts (#41181)

2026-08-25 10:21:32 +00:00

agent_service.py

fix: fix when tool execute in progress tool_meta miss tool_provider_type (#39513)

2026-07-24 11:35:12 +00:00

agent_tool_inner_service.py

chore: clean Db session from service (#38227)

2026-07-08 03:07:27 +00:00

annotation_service.py

fix(api): preserve literal NA in annotation CSV imports (#42221)

2026-09-12 04:55:53 +00:00

api_based_extension_service.py

chore: clean Db session from service (#38227)

2026-07-08 03:07:27 +00:00

api_token_service.py

feat: allow knowledge base API keys to be scoped to a single dataset (#37569)

2026-09-02 10:30:42 +00:00

app_creation_records.py

feat(agent): import roster packages through App routes (#42189)

2026-09-17 07:28:18 +00:00

app_definition_query_service.py

refactor(api): extract web app runtime bootstrap (#40949)

2026-08-20 05:05:31 +00:00

app_dsl_service.py

fix(app): include image icons in app packages (#42626)

2026-09-21 06:32:21 +00:00

app_generate_service.py

fix(dify-builder): stream native test runs after canvas refresh

2026-09-21 15:12:22 +08:00

app_import_source.py

feat(agent): support package imports from external URLs (#42425)

2026-09-17 12:54:40 +00:00

app_model_config_service.py

refactor: explicit DB session propagation across backend paths (#38559)

2026-07-15 06:48:28 +00:00

app_package_service.py

fix(app): include image icons in app packages (#42626)

2026-09-21 06:32:21 +00:00

app_ref_service.py

fix(api): bind scoped lookups to nested owner refs (#38470)

2026-07-15 09:31:09 +00:00

app_service.py

Merge branch 'main' into feat/dify-builder

2026-09-20 09:45:05 +08:00

app_site_service.py

refactor(api): require active workspace in request context (#41280)

2026-09-02 06:54:47 +00:00

app_statistic_query.py

refactor(api): extract app statistic queries from console controllers (#41557)

2026-09-04 09:15:51 +00:00

app_task_service.py

chore: reorg imports (#35308)

2026-04-16 08:50:02 +00:00

app_tracing_config_gateway.py

refactor(console): decouple app tracing configuration (#41576)

2026-09-07 02:47:00 +00:00

app_tracing_config_service.py

refactor(console): decouple app tracing configuration (#41576)

2026-09-07 02:47:00 +00:00

async_workflow_service.py

refactor(api): consolidate deployment edition handling (#40142)

2026-08-11 07:39:01 +00:00

attachment_service.py

chore: port isinstance to match case (#37271)

2026-06-18 00:18:03 +00:00

audio_service.py

feat(api): track credit usage contexts (#41181)

2026-08-25 10:21:32 +00:00

billing_portal_service.py

refactor(api): require active workspace in request context (#41280)

2026-09-02 06:54:47 +00:00

billing_service.py

refactor(api): trim workspace features response contract (#41948)

2026-09-08 05:42:22 +00:00

clear_free_plan_tenant_expired_logs.py

refactor(api): consolidate deployment edition handling (#40142)

2026-08-11 07:39:01 +00:00

code_based_extension_service.py

remove bare list, dict, Sequence, None, Any (#25058)

2025-09-06 03:32:23 +08:00

compliance_download_service.py

refactor(api): require active workspace in request context (#41280)

2026-09-02 06:54:47 +00:00

conversation_service.py

fix(agent): persist Chatflow Agent V2 memory by conversation_id (#41871)

2026-09-08 03:31:01 +00:00

conversation_variable_updater.py

chore: reorg imports (#35308)

2026-04-16 08:50:02 +00:00

credential_permission_service.py

chore: clean Db session from service (#38227)

2026-07-08 03:07:27 +00:00

credit_pool_service.py

feat(api): track credit usage contexts (#41181)

2026-08-25 10:21:32 +00:00

data_source_oauth_service.py

refactor(api): require active workspace in request context (#41280)

2026-09-02 06:54:47 +00:00

dataset_api_key_service.py

feat: allow knowledge base API keys to be scoped to a single dataset (#37569)

2026-09-02 10:30:42 +00:00

dataset_ref_service.py

fix(api): bind scoped lookups to nested owner refs (#38470)

2026-07-15 09:31:09 +00:00

dataset_service.py

perf(api): batch indexing status segment counts (#42191)

2026-09-11 07:43:16 +00:00

datasource_provider_service.py

feat(plugin-auth): visibility picker for OAuth credentials (#39840)

2026-08-17 02:41:26 +00:00

dsl_content.py

refactor(api): clarify DSL import and plugin migration boundaries (#38483)

2026-07-07 02:06:49 +00:00

dsl_version.py

refactor: cleanup duplicate code (#36173)

2026-05-14 10:34:31 +00:00

email_code_login_challenge.py

fix(auth): harden email code login verification (#40960)

2026-08-19 06:57:47 +00:00

end_user_service.py

chore(models): add Mapped annotations to EndUser and ApiToken (#42146)

2026-09-11 17:07:04 +00:00

explore_banner_query_service.py

refactor: make explore localization request-driven (#41798)

2026-09-04 06:03:46 +00:00

external_knowledge_service.py

fix(api): report has_more from the page the query served (#42323)

2026-09-16 07:45:48 +00:00

feature_query_service.py

refactor(api): require active workspace in request context (#41280)

2026-09-02 06:54:47 +00:00

feature_service_gateway.py

refactor(api): decouple system features and web adapters (#40772)

2026-09-01 11:50:52 +00:00

feature_service.py

Merge branch 'main' into feat/dify-builder

2026-09-09 15:55:44 +08:00

feedback_service.py

fix(api): end_date filter in feedback export excludes the entire end date (#40114)

2026-08-10 03:27:56 +00:00

file_grant_gateways.py

feat: app deployment v2 (#41444)

2026-09-04 02:01:35 +00:00

file_grant_service.py

feat: app deployment v2 (#41444)

2026-09-04 02:01:35 +00:00

file_request_service.py

feat(agent): separate CLI file URL audiences (#39952)

2026-08-04 13:14:02 +00:00

file_service.py

refactor(api): merge duplicated model builders in unit tests (#41549)

2026-09-18 05:10:25 +00:00

hit_testing_service.py

refactor: explicit DB session propagation across backend paths (#38559)

2026-07-15 06:48:28 +00:00

human_input_delivery_test_service.py

chore: port isinstance to match case (#37271)

2026-06-18 00:18:03 +00:00

human_input_file_upload_service.py

refactor(api): extract human input file upload persistence (#41716)

2026-09-07 03:21:33 +00:00

human_input_service.py

chore(api): upgrade graphon to v0.6.0, migrate HITL logic back to Dify (#38247)

2026-07-03 03:45:21 +00:00

icon_configuration.py

fix(api): handle invalid app icon references (#41977)

2026-09-09 02:56:40 +00:00

init_validation_service.py

refactor(api): extract init validation into layered application service (#40046)

2026-08-12 08:42:09 +00:00

inner_mail_service.py

refactor(api): decouple system features and web adapters (#40772)

2026-09-01 11:50:52 +00:00

installed_app_service.py

refactor(api): decouple system features and web adapters (#40772)

2026-09-01 11:50:52 +00:00

knowledge_fs_operations.py

feat(dataset): add crawl source selection (#39325)

2026-07-24 07:11:48 +00:00

knowledge_fs_proxy.py

feat(dataset): expose New RAG KnowledgeFS contracts (#39314)

2026-07-23 01:48:36 +00:00

knowledge_retrieval_inner_service.py

refactor: thread explicit sessions through app retrieval paths (#38309)

2026-07-02 17:00:47 +00:00

legacy_model_type_migration.py

ci: Update pyrefly dependency version to 1.3.0 (#42445)

2026-09-18 02:16:47 +00:00

message_file_preview_service.py

refactor(service-api): extract file preview application service (#41732)

2026-09-07 08:59:18 +00:00

message_service.py

fix(api): bound suggested question generation latency (#41705)

2026-09-03 05:02:09 +00:00

metadata_service.py

fix(api): bind dataset operations to owners (#40149)

2026-08-11 16:37:14 +00:00

model_load_balancing_service.py

feat: support azure keyvault (#39933)

2026-08-07 00:42:13 +00:00

model_provider_service.py

fix(api): remove omitted tenant default models (#42572)

2026-09-20 09:19:51 +00:00

notification_gateway.py

refactor(api): decouple onboarding and notification services (#40759)

2026-08-31 04:37:07 +00:00

notification_service.py

refactor: pass notification language explicitly (#41770)

2026-09-04 01:52:30 +00:00

notion_data_source_gateway.py

refactor(api): thin OAuth controllers and extract application services (#40692)

2026-08-26 07:33:37 +00:00

oauth_device_flow.py

refactor(openapi): route /openapi/v1 auth by subject (#41420)

2026-09-18 08:42:53 +00:00

oauth_server_service.py

refactor(api): thin OAuth controllers and extract application services (#40692)

2026-08-26 07:33:37 +00:00

operation_service.py

fix: bound OperationService billing requests (#37425)

2026-06-22 06:45:03 +00:00

partner_tenant_binding_service.py

refactor(api): standardize console billing portal errors (#41055)

2026-08-24 01:55:48 +00:00

plugin_file_upload_gateway.py

refactor(api): extract plugin file upload application service (#41808)

2026-09-08 03:42:32 +00:00

plugin_file_upload_service.py

refactor(api): extract plugin file upload application service (#41808)

2026-09-08 03:42:32 +00:00

quota_service.py

fix: replace bare except with except Exception in core agent, storage and vector backends (#40801)

2026-08-15 00:56:09 +00:00

rbac_agent_access_service.py

feat(rbac): agent RBAC/ACL scenes and resource-locator check bundles (#41768)

2026-09-07 04:39:43 +00:00

rbac_resource_service.py

refactor(api): pass session explicitly into RBACResourceService (#37403) (#42248)

2026-09-15 12:45:34 +00:00

recommended_app_catalog_gateway.py

refactor(api): replace legacy recommended app retrieval stack (#40395)

2026-08-20 13:13:43 +00:00

recommended_app_query_service.py

refactor: make explore localization request-driven (#41798)

2026-09-04 06:03:46 +00:00

remote_file_service.py

refactor(api): centralize remote file handling (#41627)

2026-09-03 06:00:13 +00:00

saved_message_service.py

chore: clean Db session from service (#38227)

2026-07-08 03:07:27 +00:00

schema_definition_service.py

refactor(api): decouple setup and spec endpoints (#40104)

2026-08-08 11:52:15 +00:00

setup_adapters.py

refactor(api): standardize session factory wiring (#41085)

2026-08-24 01:57:17 +00:00

setup_service.py

refactor(api): decouple setup and spec endpoints (#40104)

2026-08-08 11:52:15 +00:00

skill_management_service.py

feat: skill support duplicate and export use the latest draft (#42424)

2026-09-17 09:52:25 +00:00

snippet_dsl_service.py

fix(api): reject ownerless pending DSL imports (#40107)

2026-09-07 10:59:09 +00:00

snippet_generate_service.py

refactor: explicit DB session propagation across backend paths (#38559)

2026-07-15 06:48:28 +00:00

snippet_service.py

refactor(models): pass session into WorkflowNodeExecutionModel accessors (#41968)

2026-09-08 09:31:08 +00:00

step_by_step_tour_service.py

refactor(api): require active workspace in request context (#41280)

2026-09-02 06:54:47 +00:00

summary_index_service.py

fix(api): fix tencent summary vector deadlock (#41916)

2026-09-07 08:31:08 +00:00

system_feature_service.py

refactor(api): decouple system features and web adapters (#40772)

2026-09-01 11:50:52 +00:00

tag_application_service.py

refactor(api): require active workspace in request context (#41280)

2026-09-02 06:54:47 +00:00

tag_service.py

refactor(api): update tag name with a single UPDATE statement (#42449)

2026-09-18 03:22:44 +00:00

telemetry_service.py

refactor(api): consolidate deployment edition handling (#40142)

2026-08-11 07:39:01 +00:00

tool_file_download_service.py

refactor(api): extract tool file download service (#41790)

2026-09-08 02:51:11 +00:00

trial_app_usage.py

refactor(api): isolate trial app usage writes (#40208)

2026-08-20 13:13:42 +00:00

turnstile_service.py

fix(auth): harden email code login verification (#40960)

2026-08-19 06:57:47 +00:00

upload_file_delivery_service.py

refactor(api): extract upload file delivery service (#41772)

2026-09-08 02:03:24 +00:00

variable_truncator.py

fix(api): honor array-element limit and byte budget for list[File] in VariableTruncator (#39218) (#39220)

2026-07-27 02:12:57 +00:00

vector_service.py

feat(api): track credit usage contexts (#41181)

2026-08-25 10:21:32 +00:00

vector_space_admission_service.py

refactor(api): remove legacy billing enabled state (#41917)

2026-09-07 08:29:57 +00:00

web_app_runtime_query_service.py

fix(api): handle invalid app icon references (#41977)

2026-09-09 02:56:40 +00:00

web_conversation_service.py

chore: clean Db session from service (#38227)

2026-07-08 03:07:27 +00:00

web_passport_gateways.py

feat: app deployment v2 (#41444)

2026-09-04 02:01:35 +00:00

web_passport_service.py

refactor(api): decouple system features and web adapters (#40772)

2026-09-01 11:50:52 +00:00

webapp_access_query_service.py

refactor(api): reuse web app access queries for permissions (#40984)

2026-08-20 02:27:49 +00:00

webapp_auth_service.py

refactor(api): decouple system features and web adapters (#40772)

2026-09-01 11:50:52 +00:00

website_service.py

fix(api): bound JinaReader and adaptive-crawl HTTP timeouts (#39859) (#39860)

2026-08-02 02:49:17 +00:00

workflow_app_log_query_service.py

refactor(api): isolate workflow app log queries (#41509)

2026-09-04 10:06:46 +00:00

workflow_collaboration_service.py

fix(api): enforce app-scoped access on indirect resources (#40893)

2026-08-21 00:52:39 +00:00

workflow_comment_service.py

feat: collaboration (#30781)

2026-04-16 02:21:04 +00:00

workflow_draft_sync_service.py

fix(builder): avoid layout conflicts and serialize draft updates (#42601)

2026-09-21 09:48:02 +08:00

workflow_draft_variable_service.py

fix(api): use resource tenant for draft variable files (#39307)

2026-07-21 02:07:47 +00:00

workflow_event_snapshot_service.py

feat(workflow): support human input in loop and iteration (#39243)

2026-08-03 02:24:18 +00:00

workflow_generator_service.py

feat(api): track credit usage contexts (#41181)

2026-08-25 10:21:32 +00:00

workflow_node_execution_trace_service.py

refactor(models): pass session into WorkflowNodeExecutionModel accessors (#41968)

2026-09-08 09:31:08 +00:00

workflow_ref_service.py

fix(api): scope nested resource lookups by owner refs (#38177)

2026-06-30 08:19:58 +00:00

workflow_restore.py

fix: adding a restore API for version control on workflow draft (#33582)

2026-03-20 14:54:23 +08:00

workflow_run_service.py

refactor(models): pass session into WorkflowNodeExecutionModel accessors (#41968)

2026-09-08 09:31:08 +00:00

workflow_service.py

refactor(api): decouple system features and web adapters (#40772)

2026-09-01 11:50:52 +00:00

workflow_statistic_query_service.py

refactor(api): require active workspace in request context (#41280)

2026-09-02 06:54:47 +00:00

workflow_version_number_service.py

feat: app deployment v2 (#39829)

2026-08-12 01:55:36 +00:00

workspace_member_query_service.py

refactor(api): require active workspace in request context (#41280)

2026-09-02 06:54:47 +00:00

workspace_member_role_resolver.py

refactor(api): extract workspace member listing into layered service (#39974)

2026-08-06 01:08:39 +00:00

workspace_plan_gateway.py

refactor(api): consolidate deployment edition handling (#40142)

2026-08-11 07:39:01 +00:00

workspace_query_service.py

refactor(api): consolidate deployment edition handling (#40142)

2026-08-11 07:39:01 +00:00

workspace_service.py

refactor(api): remove legacy billing enabled state (#41917)

2026-09-07 08:29:57 +00:00