NexaFlow 1.0.3 universal 20260707-121229

NexaFlow 1.0.3 - Security, reliability, and regression hardening

This release supersedes v1.0.2-20260707-120508 and includes the same security/reliability app build plus a final regression-test fix for real XLSX smoke files whose metric catalog does not contain the hard-coded Chinese transaction metrics.

Security hardening

• Hardened the DuckDB read-only SQL validator against local file-reading functions such as read_csv_auto, read_parquet, parquet_scan, csv_scan, and glob.
• Escaped SQL LIKE patterns and removed NUL characters from generated SQL identifiers/literals.
• Migrated sensitive workspace fields to macOS Keychain on save: AI API key, Confluence bearer token, Tavily keys, external reference source API keys, DingTalk client secrets, Jira tokens, and Tableau PAT tokens.
• Added schemaVersion to workspace JSON for future migrations.
• Sanitized external reference HTTP failures so raw response bodies are no longer shown in user-facing status text.
• Required valid https:// base URLs for Confluence, Jira, and Tableau credentialed requests.

Reliability and data handling

• Added shared URLSession retry/backoff for Confluence, Jira, DingTalk, Tableau, web/RSS/search API, and Tavily collection requests.
• Reduced default AI request timeout from 600s to 180s.
• Fixed streaming AI validation retry behavior so failed validation uses a corrected prompt instead of retrying the same invalid output path.
• Made unknown/internal errors non-retryable by default to prevent retry storms.
• Added an overall default deadline for external reference collection runs.
• Replaced whole-file source fingerprint reads with chunked SHA256 hashing.
• Enforced import file-size limits inside CSV/XLS/XLSX parsers.
• Wrapped local file/folder imports with security-scoped resource access for current-session sandbox compatibility.
• Made Word .docx export atomic by replacing the destination only after a complete temporary ZIP is written.
• Added operational storage caps for reference items, DingTalk document items, and Jira evidence records.
• Improved numeric parsing for common currency, European decimal, scientific notation, percent, and negative-parentheses formats.

Regression and packaging fixes

• Fixed the real XLSX smoke test to validate generic import/manifest/fact-table construction first, and only run transaction-metric assertions when the workbook actually contains 交易人数 / 交易金额 / 交易笔数.
• Made package_standard_dmg_in_terminal.command portable by resolving the project root from the script location.
• Made package_dmg.sh version-aware via NEXAFLOW_RELEASE_VERSION, defaulting this release to 1.0.3.

Validation

• swift build passed.
• swift build -c release passed before packaging.
• swift run --disable-sandbox IterationPilotRegressionTests passed: 70 passed, 0 failed.
• NEXAFLOW_DEBUG_SNAPSHOT_TERMINATE_AFTER_EXPORT=1 ./script/build_and_run.sh --verify passed and exported 4 debug snapshots.
• Standard DMG packaged successfully.

Artifact

• DMG: NexaFlow-1.0.3-universal-20260707-121229.dmg
• SHA256: 90f327aa3d575033fb5ba3408c3bcf8dd6888002d75d064f99d27b8640a949a8

Migration note

Legacy workspace.json files that already contain plaintext credentials are migrated when the app loads and next saves the workspace. After installing this release, open NexaFlow and save/update settings once to force the local workspace file to be rewritten without plaintext secrets.

NexaFlow 1.0.2 universal 20260707-120508

NexaFlow 1.0.2 - Security and reliability hardening

This release focuses on closing the reported security, persistence, retry, and packaging risks in the local analysis/runtime stack.

Security hardening

• Hardened the DuckDB read-only SQL validator against file-reading table functions such as read_csv_auto, read_parquet, parquet_scan, csv_scan, and glob, while still allowing normal SELECT / WITH evidence queries.
• Escaped LIKE wildcard patterns consistently and removed NUL characters from generated SQL identifiers/literals.
• Moved sensitive workspace fields into macOS Keychain on save: AI API key, Confluence bearer token, global Tavily key, external reference source API keys, DingTalk client secrets, Jira tokens, and Tableau PAT tokens.
• Kept backward compatibility for legacy workspace JSON: existing plaintext secrets are still decoded, then written to Keychain and omitted from the next saved JSON.
• Added schemaVersion to the workspace payload for safer future migrations.
• Sanitized external reference HTTP failures so raw response bodies are logged privately and no longer shown in user-facing status text.
• Tightened Confluence, Jira, and Tableau base URL validation to require valid https:// URLs before sending credentials.

Reliability and retry behavior

• Added shared URLSession retry/backoff for Confluence, Jira, DingTalk, Tableau, web/RSS/search API, and Tavily collection requests. Retries are limited to transient network errors and 408/409/425/429/5xx responses.
• Reduced default AI request timeout from 600s to 180s to keep the AI queue from being blocked for ten minutes by a hung endpoint.
• Fixed streaming AI validation retry behavior: validation failures now generate and use a corrected prompt instead of retrying the same invalid output path.
• Changed unknown/internal errors to non-retryable by default, preventing retry storms for parser, serialization, or state errors.
• Added a default overall deadline for external reference collection runs.

Data import, export, and storage

• Replaced whole-file SHA256 fingerprint reads with chunked file hashing to reduce memory spikes during large local imports.
• Enforced the import file-size policy inside CSV/XLS/XLSX parsers, not just in UI selection flow.
• Wrapped local file/folder imports with security-scoped resource access for better sandbox compatibility during the current session.
• Made Word .docx export atomic by writing a temporary archive first and replacing the destination only after successful ZIP creation.
• Added storage caps for large operational collections such as reference items, DingTalk document items, and Jira evidence records.
• Improved numeric parsing for common currency/percentage/European decimal/scientific/negative-parentheses formats.

Packaging and release workflow

• Made package_standard_dmg_in_terminal.command portable by resolving the project root from the script location instead of using a local developer path.
• Made package_dmg.sh version-aware via NEXAFLOW_RELEASE_VERSION, defaulting this release to 1.0.2.

Validation

• swift build passed.
• swift build -c release passed.
• swift run --disable-sandbox IterationPilotRegressionTests passed: 70 passed, 0 failed. Real XLSX smoke remains opt-in via NEXAFLOW_REAL_XLSX_SMOKE_PATH.
• NEXAFLOW_DEBUG_SNAPSHOT_TERMINATE_AFTER_EXPORT=1 ./script/build_and_run.sh --verify passed and exported 4 debug snapshots.
• Standard DMG packaged successfully.

Artifact

• DMG: NexaFlow-1.0.2-universal-20260707-120508.dmg
• SHA256: 90f327aa3d575033fb5ba3408c3bcf8dd6888002d75d064f99d27b8640a949a8

Migration note

Old workspace files that already contain plaintext credentials are migrated when the app loads and next saves the workspace. After installing this release, open NexaFlow and save/update settings once to force the local workspace.json to be rewritten without plaintext secrets.

NexaFlow 1.0.1 universal 20260706-200556

版本定位

这是 NexaFlow 1.0 的补丁版本，重点修复连接器错误信息泄露、DuckDB SQL LIKE 匹配语义、钉钉 URL 构造、若干强解包和异步任务生命周期问题。建议所有正在使用 Confluence、Jira、DingTalk 或本地 SQL 分析能力的用户升级。

下载

• macOS 安装包：NexaFlow-1.0.1-universal-20260706-200556.dmg
• 架构：Universal binary，支持 Apple Silicon 与 Intel Mac
• 最低系统：macOS 13.0
• DMG SHA256：acf996222a74d8e30c5df0905cb9f629174b687e075f90d4999ce270962de205
• 文件大小：54,010,995 bytes，约 52 MB

主要更新

安全与隐私

• Confluence 失败提示不再把完整请求 URL 和响应体展示到 UI，避免页面 ID、查询参数或服务端错误细节外泄。
• Jira 失败提示不再展示响应体、用户名、token 或 Basic Auth base64 凭证。
• Confluence/Jira 的调试信息改为写入系统日志，并将 URL/响应体按 private 字段记录，用户界面只显示状态码和处理建议。
• DuckDB 指标优先级 SQL 的 LIKE pattern 现在会转义反斜杠、单引号、% 和 _，并使用 ESCAPE '\\'，避免通配符改变匹配语义。

连接器稳定性

• DingTalk 文档分页接口不再强制解包 URL；Space ID 会按 path segment 做百分号编码，非法输入会返回明确错误。
• Confluence 本地 pages.json 导入移除了开发机硬编码路径，改为记住上次选择目录。
• Jira/Confluence/DingTalk 的错误文案更偏向可操作提示，减少把底层实现细节暴露给业务用户。

运行时可靠性

• DuckDB SET threads TO 1 失败时不再静默忽略；现在会记录 warning，DEBUG 构建下触发断言，便于及早发现本地计算环境问题。
• 静态正则从 try! 改为显式预条件失败，若未来改坏 pattern，崩溃信息会指出具体静态正则。
• Excel 列号转换和图标生成脚本去除不必要强制解包。
• 引用源、知识源、字段字典等 UI 异步任务改为弱捕获 store，降低窗口/状态对象生命周期被后台任务延长的风险。

测试与验证

本版本发布前已完成以下验证：

• swift build --disable-sandbox --product IterationPilot 通过。
• swift run --disable-sandbox IterationPilotRegressionTests 通过，68 passed，0 failed。
• script/non_gui_regression.sh 通过，包含 debug 构建、回归测试、arm64/x86_64 release 构建与 universal binary 检查。
• script/build_and_run.sh --verify 通过，实际启动 NexaFlow 并生成 4 张 UI 验证截图。
• script/package_dmg.sh 成功生成标准压缩 DMG。

升级影响

• 本次没有引入 workspace 数据迁移；现有本地工作区、数据包、知识库、连接器配置应保持兼容。
• Confluence/Jira 错误信息会比上一版更简洁；需要排查底层请求细节时请查看 macOS 系统日志。
• Confluence pages.json 导入不再默认跳到开发机路径；首次导入需要手动选择文件，之后会记住上次目录。

安装说明

1. 下载 NexaFlow-1.0.1-universal-20260706-200556.dmg。
2. 打开 DMG，将 NexaFlow.app 拖入 Applications。
3. 如果 macOS Gatekeeper 提示无法直接打开，请使用 Finder 右键点击 NexaFlow 并选择“打开”。当前构建为 Apple Development 签名，未做 notarization；面向公开分发时建议补充公证流程。

对应提交

• GitHub commit：544705f3150b87a01e3abc658386025b2f01b2ee
• 本地 monorepo commit：55730a6 Harden IterationPilot connectors and SQL runtime

NexaFlow 1.0 universal 20260706-154224

NexaFlow 1.0 universal

Universal macOS DMG for Apple Silicon and Intel Macs.

Highlights

• AI analysis workspace for business analytics, product operations, and data-driven decisions.
• Local table ingestion, metric computation, evidence tracing, and report generation.
• Analysis harness with answer validation, number tracing, coverage snapshots, and trace timeline.
• Connector-oriented workflows for external evidence and knowledge sources.

Install

1. Download NexaFlow-1.0-universal-20260706-154224.dmg.
2. Open the DMG.
3. Drag NexaFlow.app to Applications.
4. On first launch, macOS may require right-click → Open because this build is not notarized.

Integrity

• File: NexaFlow-1.0-universal-20260706-154224.dmg
• SHA256: 57f2ec25c49d051a4d79a81a067513eed766bd940abbaf5db2ff9eee05c0ba60
• Audit: no key-like secrets found; internal Confluence defaults removed before build.

Known Notes

• Requires your own AI/API credentials.
• macOS 13 or later is recommended.