| #370 |
MEDIUM: _save_state not called automatically before sleep/commit
## Issue
The _save_state() method in engine/durable_context.py:1462-1496 persists executed_tasks, f...
|
closed |
medium |
2025-12-11 21:40 |
- |
|
| #369 |
MEDIUM: Circuit breaker cache uses file system flag for reset
## Issue
Circuit breaker cache reset in engine/tools/shell_command.py:63-84 relies on flag file /tm...
|
closed |
medium |
2025-12-11 21:39 |
- |
|
| #368 |
MEDIUM: Silent encryption failure (fail-open security)
## Issue
In engine/db.py:131-147, encryption configuration failures are silently swallowed:
```pyt...
|
closed |
medium |
2025-12-11 21:39 |
- |
|
| #367 |
MEDIUM: Connection leak in get_raw_db_connection docstring example
## Issue
The docstring for get_raw_db_connection() in engine/db.py:515-547 shows improper usage:
`...
|
closed |
medium |
2025-12-11 21:39 |
- |
|
| #366 |
HIGH: TenantCache TTL creates stale tenant resolution
## Issue
TenantCache in engine/orchestrator.py:55-110 has 5-minute TTL. If a workflow run is delete...
|
closed |
high |
2025-12-11 21:39 |
- |
|
| #365 |
HIGH: Global determinism state shared across workflows
## Issue
Global flags in engine/durable_context.py:39-43 are NOT thread-safe and shared across all ...
|
closed |
high |
2025-12-11 21:39 |
- |
|
| #364 |
HIGH: ForEach/While loop checkpoints not persisted to database
## Issue
ForEach and While loop operators save checkpoints to ctx._checkpoints_cache but do NOT cal...
|
closed |
high |
2025-12-11 21:39 |
- |
|
| #363 |
CRITICAL: sleeping_tasks.discard() called on dict - AttributeError
## Issue
In engine/durable_context.py:1389, the code calls discard() on sleeping_tasks which is a d...
|
closed |
critical |
2025-12-11 21:39 |
- |
|
| #362 |
CRITICAL: Heartbeat updates not committed to database
## Issue
The heartbeat service in engine/services/heartbeat_service.py:179-207 updates heartbeats w...
|
closed |
critical |
2025-12-11 21:39 |
- |
|
| #361 |
CRITICAL: ctx.now is non-deterministic - breaks replay guarantees
## Issue
The ctx.now property in engine/durable_context.py:486-503 returns datetime.now(timezone.ut...
|
closed |
critical |
2025-12-11 21:39 |
- |
|
| #360 |
CRITICAL: DataShard script storage uses workflow_name+version instead of definition_hash - causes stale data collisions
## Problem
When storing Python DSL scripts in DataShard, the key is based on workflow_name + version...
|
closed |
critical |
2025-12-11 10:26 |
- |
|
| #359 |
ForEach operator runs sequentially, not in parallel
## Problem
The ForEachOperator in engine/interpreters/operators.py:614 uses a sequential for loop:
...
|
closed |
high |
2025-12-11 09:00 |
- |
|
| #358 |
Implement storage tool with S3 backend and user upload capability
## Summary
Implement a new `storage` tool that enables workflows to:
1. Store workflow-generated fi...
|
closed |
high |
2025-12-11 06:12 |
- |
|
| #357 |
code_executor: Use Docker sandbox with auto-detection
## Issue
code_executor.py and shell_command.py run untrusted code without sandboxing.
## Sandbox Im...
|
closed |
high |
2025-12-10 08:31 |
- |
|
| #356 |
LLM tool: Use Secret Manager for API keys
## Issue
llm.py only reads API keys from environment variables, not from Secret Manager.
## Current...
|
closed |
medium |
2025-12-10 08:16 |
- |
|
| #355 |
Remove hardcoded mock data from http_request.py
## Issue
http_request.py lines 146-178 contain hardcoded mock data for offline testing.
## Current ...
|
closed |
high |
2025-12-10 08:16 |
- |
|
| #354 |
CRITICAL: http_request.py - Add SSRF Protection
## Issue
The http_request.py tool has no URL validation, allowing Server-Side Request Forgery (SSRF)...
|
closed |
critical |
2025-12-10 08:16 |
- |
|
| #353 |
Security & Implementation Review: Built-in Tools
## Tools Security Review (Issue #353)
### CRITICAL Issues Found and Fixed
- **#354 SSRF in http_req...
|
closed |
critical |
2025-12-10 08:12 |
- |
|
| #352 |
Guidance: Built-in Tools vs Marketplace Apps
## Overview
Define clear guidelines for when functionality should be a built-in tool vs a marketplac...
|
open |
medium |
2025-12-10 06:40 |
- |
|
| #351 |
New Built-in Tool: SMS Sending (tools.sms.send)
## Overview
Implement SMS sending capability as a built-in tool, parallel to tools.email.send.
## J...
|
open |
high |
2025-12-10 06:40 |
- |
|