Skip to content

v0.2.0 - Safer auth, cookie-complete authoring

Latest
Latest

Choose a tag to compare

View all tags
@alexjiaguo alexjiaguo released this 02 Sep 14:06
· 1 commit to main since this release
v0.2.0
664bdb0

What shipped

Cookie+CSRF is now the full authoring path. MCP hosts can log in without the CLI, HTTP MCP is locked down off localhost, and cookie-only sessions can run, stop, upload, and manage workspaces. 153 tools across 18 namespaces.

New Features

  • MCP login tools: auth.import_cookies, auth.login_console, and auth.set_tokens so agents can authenticate without dropping to the CLI.
  • Cookie-complete runs: published run/stop, file upload, dependency checks, and workspace get/switch/members work with console cookies (OpenAPI is fallback).
  • Plugin lifecycle: plugin.get, plugin.install, and plugin.uninstall.
  • Chat and completion: app.chat and app.complete over the console SSE surface.
  • Node last-run: workflow.node_last_run for draft debugging.
  • Non-interactive cookies: DIFY_CONSOLE_COOKIE and --console-cookie (Cookie header or cookie-editor JSON).

Improvements

  • HTTP MCP lock: binds 127.0.0.1 by default. Non-loopback binds (including Docker) require DIFYWF_MCP_TOKEN. Host allowlist, 2MB body cap, /health stays open for probes.
  • Secret store: ~/.difywf is 0700 / files 0600. On macOS, cookies and tokens prefer the OS keychain unless DIFYWF_HOME is set.
  • Draft sync: omitting env/conversation variables keeps current draft values instead of wiping them. graph_json is accepted. Stale hash is retryable VALIDATION_FAILED.
  • Uploads: {name, content_b64, mime?} is sent as multipart FormData.
  • Export secrets: app.export include_secret=true requires confirm=true.
  • Workspace switch persists workspace_id in the local store.
  • Audit log: nested secret/graph redaction, mode 0600.
  • Timeouts: HTTP 60s / SSE 300s (DIFYWF_HTTP_TIMEOUT_MS / DIFYWF_SSE_TIMEOUT_MS).

Safety

  • Confirm gates added for copy/convert, trigger create/enable, feature replace, variable create, snippet import confirm, and plugin install/uninstall.
  • Code nodes default to confirm (DIFYWF_CODE_NODES=confirm|allow|forbid).
  • Private http-request URLs warn; private yaml_url imports are blocked unless DIFYWF_ALLOW_PRIVATE_URL=1.
  • difywf mcp only accepts serve. --output-file reports the real ok status.

Breaking changes

  • HTTP MCP: default bind is 127.0.0.1, not 0.0.0.0. Docker sets DIFYWF_MCP_HOST=0.0.0.0 and requires DIFYWF_MCP_TOKEN.
  • Tag/tool readback failures now return SERVER_ERROR instead of DSL_VERSION_MISMATCH.

Stats

  • 153 tools, 18 namespaces
  • 99 unit tests (all passing)
  • Typecheck clean
  • MCP stdio + Streamable HTTP smoke in CI

See the README for setup, including DIFY_CONSOLE_COOKIE and HTTP MCP tokens.

Assets 2
Loading