Workflows ship two expression languages in adjacent fields. Agent
`prompt_template` and end `output_template` are Jinja2, so `{{query}}` is
correct there. State and condition `expression` fields are bare CEL,
where the same string is a parse error.
Nothing told users this. docs/content/Agents/nodes.mdx documented the
pre-CEL Set State node with `{{variable_name}}` examples and Set /
Increment / Append operations that no longer exist — "CEL" appeared
nowhere in the docs. The builder's own placeholder was `input.foo + 1`,
referencing an `input` namespace that is not in workflow state, while the
panel beside it advertised `{{ agent.variable }}`.
There was also no validation anywhere: neither validateWorkflow nor
validate_workflow_structure looked at state nodes at all, and conditions
were only checked for a non-empty string. A workflow containing
`{{query}}` saved and published clean, then aborted on the first message
with a bare caret dump that sanitize_api_error collapsed into "An error
occurred … please try again later" — advice that sends the user round the
same loop, which is what the 2026-08-01 report shows.
Adds validate_cel_expression (compile-only, since state is built at run
time and unresolved names are not knowable when saving) and wires it into
the workflow save path for both node types, plus the half-configured
state operations the engine silently skips. `{{ }}` gets a targeted hint,
raised only after compilation has already failed so valid CEL that
contains braces — `x == "{{y}}"`, or a nested map literal — is not
rejected.
celpy errors are now summarized: undeclared-reference messages embed a
repr of the entire activation, thousands of characters including the
user's own query, and others interpolate the offending state value.
Quoted fragments that are not bare identifiers are redacted, since
config errors now bypass sanitize_api_error to reach the user, and a
shared agent's runner is not its owner.
Docs rewritten with a table of which field takes which syntax, CEL
examples for Set State, and the Condition node section that basics.mdx
has been linking to all along.
Added button to rotate api key. This is required for better UX, now user has to remake agent if key is lost.
A migration is needed to keep track of proper usage + to not leave any orphan entries.
Address Copilot review on #2600:
- pass a useCallback handler to useOutsideAlerter so the global mousedown
listener isn't torn down/re-added on every WorkflowBuilder render
- remove trailing spaces after {displayName} in AgentPageHeader
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Token accounting:
- Drain each tool round's provider stream to exhaustion before running
tools and recursing, so the usage decorator persists exactly one
token_usage row per LLM call, at call end. Previously every round's
generator was abandoned mid-iteration and flushed together at request
teardown, writing N near-identical rows stamped with the final
round's provider counts (duplicate billing).
- Consume the Chat Completions include_usage terminal chunk (it arrives
after finish_reason and was never read) so streamed calls record
provider-exact token counts instead of tiktoken estimates.
- Claim provider-reported usage once per call (_last_usage_claimed) so
a late-finalized generator can never adopt another call's counts.
Oversized-context guards:
- Enforce Responses API function_call/function_call_output pairing in
the input builder (drop unpaired items; bypassed for store-mode
previous_response_id chaining where calls are matched server-side).
- Hard pre-send context gate: shrink oversized tool results and refuse
payloads that cannot fit the model's window before dispatch, so a
hopeless request is never sent or billed.
- Cap a single tool result entering the LLM context
(TOOL_RESULT_MAX_TOKENS, default 20000); the tool journal and
persistence keep the full result. Applied on the resume/continuation
path too.
- Skip the fallback attempt when the payload cannot fit the fallback
model's context window (10% estimation slack).
- Compression: never save a compression point that does not reduce
tokens; bound oversized verbatim fields kept after a compression
point (COMPRESSION_RECENT_FIELD_MAX_TOKENS, default 8000).
Robustness fixes from review:
- Google parallel function calls: complete index-less ToolCalls are no
longer merged into one another (dict arguments raised TypeError on
+=; second call could execute with the first call's arguments).
- Trailing-frame failures after a delivered answer no longer error the
stream or restream the whole answer from the fallback
(_stream_reached_finish).
- In-memory compression falls back to minimal pruning when the summary
is not smaller than the original.
- keep<=0 guard in the middle-truncation helpers (a tiny cap returned
marker + full text).
Frontend: tooltip on the Analytics tokens stat card explaining that
agent tool loops re-send conversation context on every step.
An assistant message with several produced artifacts rendered one chip each in a
non-wrapping flex row, so 3+ chips overflowed and the bubble showed a horizontal
scrollbar. Add flex-wrap + gap-y-2 (the existing per-chip mr-2 keeps the
horizontal spacing) so the chips wrap to the next line, matching the other
artifact-chip render branch.
Add Material Symbols-style SVG icons (terminal / document / document-scanner) for
code_executor, artifact_generator, and read_document so they render with an icon
like the other tools. The ToolIcon import.meta.glob resolves tool_<name>.svg by
backend tool name automatically — no registration needed.
Enable code_executor and artifact_generator by default in chats (added to
DEFAULT_CHAT_TOOLS) — they load via the synthetic-id path user- and
conversation-scoped like scheduler, and persist artifacts (no user_tools FK).
Make read_document an internal agent-builtin flagged workflow_only so it appears
only in the workflow builder, not the classic agent picker or the Add-Tool
catalog (reuses the builtin synthetic-id path; still run-scoped and authz-gated).
Per decision, default-on code_executor runs sandboxed code without an approval
prompt (the sandbox is the trust boundary); this is documented in settings and
the threat model, and multi-tenant deployments should add per-tenant isolation
(Daytona / gVisor / egress policy).
Make the doc-driven Preview flow usable and surface every produced artifact:
- A Preview submit with attachments but no text now runs the workflow (opt-in on
MessageInput; no filler text is injected), so a doc-driven workflow can be run
by attaching its documents.
- The builder's global Escape no longer tears down the whole Preview/drawer, and
no longer fires from inside text fields.
- The Preview drawer has a visible close button, and the upload toast moves off
the attach/send controls (to the left) while the Preview is open.
- A turn that produces multiple artifacts now renders one chip per artifact
(labelled by tool, indexed when several), instead of exposing only the last.
The code node's Input files and the agent node's Documents now render the same
NodeDocumentsControl: an All/None/Choose toggle, a multiselect of upstream
document/artifact refs, and a free-text add-ref escape (a typed A1/id appears as
a removable chip). The control owns its toggle state so Choose is reachable from
an empty selection — retiring the per-node parent flag. File passing stays
agent-only; the code node keeps its inputs field name and stages the selected
refs as files in the sandbox.
Clicking "Choose…" with nothing selected now opens the document picker. The
mode was derived purely from the stored input_documents, so an empty selection
read back as None and the picker never appeared — leaving per-node document
selection unreachable unless a value was already set. An explicit per-node flag
now keeps Choose mode active even when empty, without leaking across nodes.
An input_documents entry with no matching upstream option (a renamed or deleted
upstream output variable, or a literal ref) now appears as a removable chip in
the agent node's Choose-mode document selector instead of silently vanishing,
so the stored selection stays visible and editable.
Adds withChosenDocumentOptions to merge stored selections into the multiselect
options, with tests.
The agent-node panel gains a Documents section (All input docs / None / Choose
upstream document variables) and a file-passing selector (auto / native /
extract), writing the input_documents and file_passing config the engine
consumes. Selections persist as bare state-variable names so they resolve
against run state; the toggle, chosen docs, and file-passing mode re-derive from
the stored config on reload. Reuses the existing multiselect, select, and
upstream-variable enumeration.
Known minor: an input_documents entry whose upstream variable was renamed or
deleted is preserved in config but not shown as a removable chip in Choose mode.
Add the run input-documents variable to the workflow builder's variable
dropdown (workflow input) and the artifact-by-id lookup to both the workflow
builder and the agent prompt builder, so the variables exposed by the shared
template namespaces are discoverable. agent.input_documents is workflow-only
(injected from run state) and stays out of the agent builder, which would
render it empty.
Let workflow runs consume and produce documents end to end: bridge uploaded
attachments into run-scoped artifacts so nodes receive the input documents
(with a per-run cap and server-computed size/sha256, and the run row pre-created
so produced artifacts are authorized during the run); emit the run id to the
client and add a builder panel that lists, previews, and downloads a run's
artifacts; and allow attaching documents to a Preview run via the existing
upload flow.
Also fixes issues a compliance workflow surfaced: attachment ownership now keys
on the raw identity instead of a sanitized one (the sanitized form could not be
read back and could collide across users); workflow code nodes read prior state
from a state.json data file instead of templating it into the program, so
untrusted document content can never be interpolated into executed code;
structured node output wrapped in code fences is recovered; and the live
speech-to-text ownership check compares the raw identity.
Expose the workflow code node in the builder UI: a draggable palette entry, a
canvas node, and a config panel for the code, inputs, output variable, timeout,
and an optional JSON schema (validated before save). The panel serializes to the
same config the engine reads, so a code node built in the UI runs and produces an
artifact reference; workflows without code nodes load unchanged.
Render produced-artifact bytes inline when a version has no embedded spec:
HTML and SVG in the existing sandboxed iframe (with the restrictive CSP),
images inline via a blob URL, and Markdown/CSV/JSON/plain text as escaped text;
office documents and PDFs keep the download card. Bytes are fetched through the
existing authenticated download path, version-aware, with object URLs revoked on
change. Untrusted HTML/SVG renders only inside the scriptless sandboxed iframe
and Markdown is rendered without raw HTML, so artifact content cannot script the
app.
Extend the artifact sidebar with a document/file view: a version selector,
authenticated download honoring Content-Disposition (following the backend
redirect to a presigned URL when configured), and version restore. Preview is
chosen by kind - html, svg, and mermaid render inside a sandboxed iframe with a
restrictive CSP (mermaid via its own sandboxed render so untrusted diagram text
never reaches the app DOM), office documents and PDFs show a download card, and
code or data render as text. Wires the new artifact endpoints into the API
service and leaves the existing notes/todo path unchanged.
Alex