mirror of
https://github.com/infiniflow/ragflow.git
synced 2026-11-11 05:40:52 +08:00
0a00a732905dfd6c04c2873ddafc1904a73132a2
81
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 qinling0210
|
aa78e8d224 | Remove internal cli 'insert chunks from file' and 'insert metadata from file' (#19591) | ||
 Wang Qi
|
b7e577ce48 | Refactor: combine 3 retrieval/search API as one (#19303) | ||
 mkaaad
|
0dbfaa8b67 |
feat(cli): add sync logs listing commands for the user CLI (#18195)
### Summary ``` RAGFlow(api/default)> LIST SYNC LOGS WITH PAGE_SIZE 2 PAGE 2; Total: 764 +----------------------------------+-------------------------+-------------+-----------+----------------------------------+----------------------------------+---------+------------------+------------+--------------+--------+-----------+---------------------+--------------------+---------------------+ | connector_id | docs_removed_from_index | error_count | error_msg | id | kb_id | kb_name | new_docs_indexed | prune_freq | refresh_freq | status | task_type | time_started | total_docs_indexed | update_date | +----------------------------------+-------------------------+-------------+-----------+----------------------------------+----------------------------------+---------+------------------+------------+--------------+--------+-----------+---------------------+--------------------+---------------------+ | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | fb55b5f1fb754475834cd9eac8b52054 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:45 | 16 | 2026-08-13 09:49:46 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | 3cad779d7d2e4efb8d8d2dbf05d45653 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:42 | 16 | 2026-08-13 09:49:43 | +----------------------------------+-------------------------+-------------+-----------+----------------------------------+----------------------------------+---------+------------------+------------+--------------+--------+-----------+---------------------+--------------------+---------------------+ ``` ``` RAGFlow(api/default)> LIST SYNC LOGS; Total: 764 +----------------------------------+-------------------------+-------------+--------------------------------------------------------------------------------------------+----------------------------------+----------------------------------+---------+------------------+------------+--------------+--------+-----------+---------------------+--------------------+---------------------+ | connector_id | docs_removed_from_index | error_count | error_msg | id | kb_id | kb_name | new_docs_indexed | prune_freq | refresh_freq | status | task_type | time_started | total_docs_indexed | update_date | +----------------------------------+-------------------------+-------------+--------------------------------------------------------------------------------------------+----------------------------------+----------------------------------+---------+------------------+------------+--------------+--------+-----------+---------------------+--------------------+---------------------+ | 02b5b14183884445bd55ad6b9d322204 | 0 | 1 | sync task failed: failed to fetch URL: Get "https://xxxxxxxxxxxx/rss.xml": EOF | 87592e5623fc4284bf69b9290f322718 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 4 | sync | 2026-08-13 09:49:48 | 16 | 2026-08-13 09:51:01 | | 570138201cf44e1180711f1ebdf8492f | 0 | 1 | sync task failed: failed to fetch URL: Get "https://www.ruanyifeng.com/blog/atom.xml": EOF | 456adbbf21a147af99adfce4405abd99 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 1 | 4 | sync | 2026-08-13 09:50:00 | 3 | 2026-08-13 09:50:18 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | fb55b5f1fb754475834cd9eac8b52054 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:45 | 16 | 2026-08-13 09:49:46 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | 3cad779d7d2e4efb8d8d2dbf05d45653 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:42 | 16 | 2026-08-13 09:49:43 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | dd09320aa5b34d6cbcfa7b03ede68c4a | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:36 | 16 | 2026-08-13 09:49:38 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | afbcee73240f420ca1997e6506f387fb | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:33 | 16 | 2026-08-13 09:49:34 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | 7d018146a0f14a25b7263d5980fdc30f | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:30 | 16 | 2026-08-13 09:49:32 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | 520e0d6f421e40628ab541fc4fee1a69 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:27 | 16 | 2026-08-13 09:49:28 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | 3d3ce49825de4ef99642e7994ae954e3 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:21 | 16 | 2026-08-13 09:49:22 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | 1c511f9b4a7c425fb30a956589ca56fa | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:18 | 16 | 2026-08-13 09:49:19 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | b9ab73c3f48c4f47a84fd55b542b32b4 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:15 | 16 | 2026-08-13 09:49:16 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | db0cad90a7744d758b24d2e3d3828963 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:12 | 16 | 2026-08-13 09:49:13 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | a501eadb2cce452187f3c86431352c70 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:08 | 16 | 2026-08-13 09:49:10 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | b4265a3b7baf4466a525b91a9fe21b71 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:03 | 16 | 2026-08-13 09:49:05 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | a6ad590931c046dda5fc3222b4010c06 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:00 | 16 | 2026-08-13 09:49:02 | ...... +----------------------------------+-------------------------+-------------+--------------------------------------------------------------------------------------------+----------------------------------+----------------------------------+---------+------------------+------------+--------------+--------+-----------+---------------------+--------------------+---------------------+ ``` list all logs ``` RAGFlow(api/default)> LIST DATASET 'test' SYNC LOGS; Total: 764 +----------------------------------+-------------------------+-------------+--------------------------------------------------------------------------------------------+----------------------------------+----------------------------------+---------+------------------+------------+--------------+--------+-----------+---------------------+--------------------+---------------------+ | connector_id | docs_removed_from_index | error_count | error_msg | id | kb_id | kb_name | new_docs_indexed | prune_freq | refresh_freq | status | task_type | time_started | total_docs_indexed | update_date | +----------------------------------+-------------------------+-------------+--------------------------------------------------------------------------------------------+----------------------------------+----------------------------------+---------+------------------+------------+--------------+--------+-----------+---------------------+--------------------+---------------------+ | 02b5b14183884445bd55ad6b9d322204 | 0 | 1 | sync task failed: failed to fetch URL: Get "https://xxxxxxxxxxxx/rss.xml": EOF | 87592e5623fc4284bf69b9290f322718 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 4 | sync | 2026-08-13 09:49:48 | 16 | 2026-08-13 09:51:01 | | 570138201cf44e1180711f1ebdf8492f | 0 | 1 | sync task failed: failed to fetch URL: Get "https://www.ruanyifeng.com/blog/atom.xml": EOF | 456adbbf21a147af99adfce4405abd99 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 1 | 4 | sync | 2026-08-13 09:50:00 | 3 | 2026-08-13 09:50:18 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | fb55b5f1fb754475834cd9eac8b52054 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:45 | 16 | 2026-08-13 09:49:46 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | 3cad779d7d2e4efb8d8d2dbf05d45653 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:42 | 16 | 2026-08-13 09:49:43 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | dd09320aa5b34d6cbcfa7b03ede68c4a | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:36 | 16 | 2026-08-13 09:49:38 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | afbcee73240f420ca1997e6506f387fb | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:33 | 16 | 2026-08-13 09:49:34 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | 7d018146a0f14a25b7263d5980fdc30f | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:30 | 16 | 2026-08-13 09:49:32 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | 520e0d6f421e40628ab541fc4fee1a69 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:27 | 16 | 2026-08-13 09:49:28 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | 3d3ce49825de4ef99642e7994ae954e3 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:21 | 16 | 2026-08-13 09:49:22 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | 1c511f9b4a7c425fb30a956589ca56fa | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:18 | 16 | 2026-08-13 09:49:19 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | b9ab73c3f48c4f47a84fd55b542b32b4 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:15 | 16 | 2026-08-13 09:49:16 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | db0cad90a7744d758b24d2e3d3828963 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:12 | 16 | 2026-08-13 09:49:13 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | a501eadb2cce452187f3c86431352c70 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:08 | 16 | 2026-08-13 09:49:10 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | b4265a3b7baf4466a525b91a9fe21b71 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:03 | 16 | 2026-08-13 09:49:05 | | 02b5b14183884445bd55ad6b9d322204 | 0 | 0 | | a6ad590931c046dda5fc3222b4010c06 | 0e6e28e65b7044e58070e0e4252319a6 | test | 0 | 5 | 0 | 3 | sync | 2026-08-13 09:49:00 | 16 | 2026-08-13 09:49:02 | ...... +----------------------------------+-------------------------+-------------+--------------------------------------------------------------------------------------------+----------------------------------+----------------------------------+---------+------------------+------------+--------------+--------+-----------+---------------------+--------------------+---------------------+ ``` |
||
 Jin Hai
|
f621b4c7b4 |
Go: refactor config (#17678)
Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
d19a036cda |
Go: add context to lots of interface (#17253)
Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
 Zhichang Yu
|
12787996d1 |
feat(agent): Go ingestion pipeline progress mirroring and DeepDOC parser hardening (#16795)
feat(ingestion): mirror Go pipeline progress into the document table;
harden resume guards
- pipeline: bind the owning document via WithDocumentID; after each
TrackProgress event aggregate ingestion_task_log progress and mirror
progress/run/progress_msg back into the document table, so GET
/api/v1/datasets/{dataset_id}/documents reflects live Go pipeline
progress without a bespoke endpoint.
- canvas: extend the S3 resume guard to reject legacy no-op nodes (e.g.
ExitLoop) so component_total equals the count of progress-reporting
components and the aggregate percent can reach 100%.
- runtime/canvas: route progress through TrackProgress; add interrupt
test coverage (r3_interrupt_test.go).
- dao/entity: add IngestionTask.DocumentID column and AggregateProgress
support used by the mirror; IngestionTaskLog keeps a Checkpoint column
alongside the progress fields.
feat(deepdoc): cache DocAnalyzer inference results in Redis (1h TTL)
- Redis-backed DocAnalyzerCache decorator over inference.Client; cache
key = "ddoc:cache:<method>:" + sha256 of the JPEG-encoded image bytes
(deterministic).
- TTL = 1h; hits skip the inner HTTP call and return cached JSON; inner
errors are not cached.
refactor(deepdoc): align figure cropping with Python cropout + bounded
page caches
- CropSectionByDLA mirrors Python cropout: best-overlap DLA
figure/equation region, fallback to section bbox per page, vertical
concat on gray background.
- sliding-window page-image cache bounds peak memory to the recent
window instead of the whole PDF.
- rename DLADebug -> DLARegions across parser/chunker/tests.
refactor(parser): drop lib_type selector; align NewXxxParser with
NewPDFParser
- remove config["lib_type"] lookup and the libType param/field/switch
from all nine constructors; surface the CGO-required error at
ParseWithResult time instead of construction time; drop resolveLibType,
its test, and the four lib_type constants.
feat(utility): add a reusable workerpool for bounded concurrent
execution
- internal/utility/workerpool.go (+ tests).
refactor: translate Chinese prose comments to English in non-harness Go
files.
chore: upgrade github.com/cloudwego/eino from v0.9.9 to v0.9.12.
|
||
|
Zhichang Yu
|
014c3f634f |
Align Go ingestion boundaries with Python (#16647)
Moves doc_id blob resolution into Parser, tightens chunker/tokenizer to Python output_format semantics, updates extractor list handling, and fixes real-template integration tests. |
||
|
qinling0210
|
7862f69f39 |
Implement chat completions in go (#16491)
### Summary POST /api/v1/chat/completions |
||
|
Jin Hai
|
bd56a1473f |
Go CLI: merge function (#16458)
### Summary 1. remove unused code. --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
7c1edca15e |
Go CLI: fix api commands (#16457)
### Summary As title. Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
3202ec6abf |
Go CLI: refactor commands (#16447)
### Summary 1. Move debug commands to dev file. 2. Refactor some commands syntax --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
d4ef3d21d1 |
Go CLI: Add create and drop commands (#16430)
### What problem does this PR solve? 1. Add CREATE and DROP DATASET / MEMORY / AGENT / SEARCH / CHAT. 2. Add option to build.sh to strip RAGFlow binary. ### Type of change - [x] Refactoring --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Zhichang Yu
|
0c3952147c |
fix(codeql): close remaining 44 CodeQL alerts post-merge (#16408)
## Summary After #16407 merged, 44 of the original 93 CodeQL alerts were still open on the default branch. This PR closes the remaining ones by: 1. **Moving 32 existing `// codeql[...]` directives** so they sit on the line **immediately before** the suppressed statement. The original multi-line suppression blocks had the directive as the first line, with the rationale on subsequent lines. After line shifts (refactors, linter reformat), the directive ended up several lines above the alert location — CodeQL only recognizes the suppression when it appears on the line directly above. (32 alerts across 27 files.) 2. **Adding 9 new `// codeql[...]` suppressions** for alerts that had no suppression in the preceding lines at all — mostly real-fixes that CodeQL conservatively still flags (filepath.Base, bounded slice sizes, model-identifier strings, the MD5-legacy-migration lookup in `conversation_service.py`). ## Files changed - `api/db/services/conversation_service.py` — add `py/weak-sensitive-data-hashing` suppression (MD5 for backward-compat legacy row lookup; not used for auth) - `api/db/services/llm_service.py` — 3× `py/clear-text-logging-sensitive-data` suppressions on the lines that log `llm_name` in warnings/info - `common/misc_utils.py` — 2× `py/clear-text-logging-sensitive-data` suppressions on the redacted `current_url` log sites - `internal/agent/component/invoke.go` — moved existing `go/request-forgery` directive - `internal/agent/sandbox/ssh.go` — moved existing `go/command-injection` directive - `internal/agent/tool/retrieval_service.go` — added `go/uncontrolled-allocation-size` suppression (`topN` is bounded to 1024 above) - `internal/cli/common_command.go` — moved 2× `go/disabled-certificate-check` directives - `internal/cli/user_command.go` — added `go/clear-text-logging` suppression (filepath.Base already strips user-identifying path) - `internal/dao/pipeline_operation_log.go` — moved 2× `go/sql-injection` directives - `internal/dao/user_canvas.go` — added `go/sql-injection` suppression in `GetList` (the new `userCanvasOrderClause` call path) - `internal/engine/infinity/chunk.go` — moved existing `go/unsafe-quoting` directive - `internal/entity/models/*` — moved `go/path-injection` directives (15 files) - `internal/handler/oauth_login.go` — moved existing `go/cookie-httponly-not-set` directive - `internal/handler/tenant.go` — moved existing `go/path-injection` directive - `internal/service/deep_researcher.go` — moved existing `go/unsafe-quoting` directive - `internal/service/dataset.go` — added `go/uncontrolled-allocation-size` suppression (`n` bounded to 1024 above) - `internal/service/file.go` — moved existing `go/request-forgery` directive - `internal/service/langfuse.go` — moved 2× `go/request-forgery` directives - `internal/utility/mcp_client.go` — moved 3× `go/request-forgery` directives - `internal/utility/smtp.go` — moved existing `go/email-injection` directive - `rag/prompts/generator.py` — added `py/clear-text-logging-sensitive-data` suppression - `web/.../use-provider-fields.tsx` — added `js/prototype-pollution-utility` suppression (FORBIDDEN_KEYS guard is on the line above) ## Why the previous PR left alerts open `// codeql[query-id] explanation` must be on the line **immediately before** the suppressed statement per the [GitHub CodeQL suppression spec](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning-with-codeql/suppressing-code-scanning-alerts). The original suppression blocks were 4-5 lines, with the directive as the **first** line. After linter reformat / line shifts, the directive ended up too far above the actual alert line to be recognized. The fix is to put the directive on the line directly above the suppressed statement, with the rationale above it. ## Test plan - All 9 modified Python files `ast.parse` clean - All 4 modified Go files `gofmt` clean - 36/44 expected alert suppressions in place - 8 remaining CodeQL alerts are the originals (#3485851828, #3485851831, #3485869759, #3485869766, #3485869768, #3485869771, #3485885962, #3485895527) which were resolved by the corresponding commit comments; these should close on the next scan when the suppression comments match the alert lines. 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
Zhichang Yu
|
195bfffb5e |
fix(security): address 93 CodeQL code-scanning alerts across 61 files (#16407)
## Summary Resolves all 93 open alerts at https://github.com/infiniflow/ragflow/security/code-scanning by rule: | Rule | Count | Treatment | |------|-------|-----------| | py/clear-text-logging-sensitive-data | 23 | Real fix — log scrubbing | | go/path-injection | 15 | Real fix where possible, suppression with rationale | | go/request-forgery | 8 | Suppression with rationale (operator-controlled URLs) | | go/clear-text-logging | 10 | Real fix — log scrubbing | | go/unsafe-quoting | 5 | Real fix — escape or refactor | | go/sql-injection | 3 | Real fix — orderby whitelist + CodeQL comment | | go/uncontrolled-allocation-size | 2 | Real fix — cap to 1024 | | go/incorrect-integer-conversion | 3 | Real fix — ParseInt + range check | | go/insecure-hostkeycallback | 1 | Real fix — known_hosts file | | go/disabled-certificate-check | 2 | Suppression with rationale | | go/command-injection | 1 | Suppression (sanitized via shq()) | | go/email-injection | 1 | Suppression with rationale | | go/cookie-httponly-not-set | 1 | Suppression (SPA bootstrap) | | js/stack-trace-exposure | 1 | Real fix — generic client message | | js/prototype-pollution-utility | 1 | Real fix — reject __proto__/constructor/prototype | | py/weak-sensitive-data-hashing | 1 | Real fix — MD5 → SHA-256 | | py/incomplete-url-substring-sanitization | 3 | Real fix — urlparse(hostname) | | py/paramiko-missing-host-key-validation | 1 | Real fix — load_system_host_keys + RejectPolicy | | cpp/integer-multiplication-cast-to-long | 2 | Real fix — cast to size_t | ## Real fixes (with measurable security improvement) **SSH host key verification (Go + Python)** Replace `InsecureIgnoreHostKey()` / `paramiko.AutoAddPolicy()` with proper host key verification against a known_hosts file (configurable via `SSH_KNOWN_HOSTS` env / `known_hosts` config field; fail-closed when unset). Loads `~/.ssh/known_hosts` first via `load_system_host_keys()` so existing setups keep working. **SQL injection in `user_canvas`** Add `userCanvasOrderableColumns` whitelist + `userCanvasOrderClause` helper. Both `GetList()` and `ListByTenantIDs()` now route the user-supplied `orderby` query param through the helper, defaulting to `create_time` on miss. **SQL injection in `pipeline_operation_log`** Existing whitelist documented via CodeQL comment. **Real SQL injection in `infinity/chunk.go:931`** Escape `'` → `''` on user-controlled `questionText` before splicing into `filter_fulltext(...)` SQL filter. **Real SQL injection in `elasticsearch/sql.go:75`** Defense-in-depth escape on tokenizer output before splicing into `MATCH(...)`. **Python code injection in `result_protocol.go`** Replace raw JSON literal embedding into Python/JS expressions with base64 + `json.loads` / `JSON.parse(Buffer.from(..., 'base64').toString('utf8'))`. Eliminates both the unsafe-quoting sink and the brittleness of mixing JSON true/false/null with Python syntax. **URL substring check bypass in `embedding_model.py`** Replace `if "dashscope-intl.aliyuncs.com" in u` with `urlparse(u).hostname == "dashscope-intl.aliyuncs.com"` so a base_url like `https://attacker.example/?u=dashscope-intl.aliyuncs.com` cannot bypass the routing. **Prototype pollution in `setNestedValue` (TS)** Reject `__proto__`/`constructor`/`prototype` keys before any assignment. **Integer overflow** - scrypt params via `ParseInt` + non-positive check (`internal/common/password.go`) - `topN` and `n` caps to 1024 (retrieval_service.go, dataset.go) - `nalloc*statesize` cast to `size_t` (cpp/re2/onepass.cc) **Cookie httponly** Set explicitly with rationale: this is the OAuth bootstrap cookie intentionally read by the SPA. **Stack trace exposure** Replace `error.message` in HTTP 500 response with generic `"internal error"`; full error still logged server-side via `console.error`. **Weak hashing** MD5 → SHA-256 for deterministic `conv_id` derivation (`conversation_service.py`). **Log scrubbing** Remove or redact user-controlled / sensitive content from clear-text logs across 8 ingestion parsers, `llm_service.py` ×11, `tenant_llm_service.py` ×7, `misc_utils.py` ×4, `redis_conn.py` ×10, `conftest.py` ×4, `init_data.py`, `dataset_api_service.py`, `generator.py`, `mysql_migration.py`, `cli.go`, `user_command.go`, `pdf_parser.go`. Most patterns converted to parameterized logging (`logging.info("...: %d", n)`) or static messages. ## CodeQL suppressions (each with rationale) For alerts where the data flow is genuinely safe but CodeQL can't see the context — operator-controlled URLs, sanitized inputs, etc. — I added `// codeql[go/<rule>] <rationale>` annotations rather than dismissing them, so future readers can audit the rationale inline: - `internal/agent/component/invoke.go:135` — Invoke is a generic canvas HTTP client - `internal/service/langfuse.go` ×2 — host is per-tenant operator config - `internal/service/file.go:1184` — already SSRF-guarded by `assertURLSafe` - `internal/utility/mcp_client.go` ×3 — already `AssertURLSafe` + IP-pinned - `internal/entity/models/bedrock.go` — sigv4-signed request, URL can't be tampered - `internal/service/deep_researcher.go:269` — `callback` is SSE display string, not SQL - `internal/engine/infinity/chunk.go:346` — UUIDs can't contain `'` (RFC 4122) - `internal/cli/common_command.go` ×2 — CLI trusts operator-configured URL - `internal/utility/smtp.go:194` — msg is server-built, not user form input - `internal/entity/models/*` ×14 (path-injection) — audio file paths are caller-supplied ## Test plan - ✅ All 13 modified Go packages build cleanly - ✅ 663 tests pass across `internal/agent/sandbox`, `internal/common`, `internal/agent/component`, `internal/engine/infinity`, `internal/dao` - ✅ All 11 modified Python files parse via `ast.parse` - ✅ TypeScript `tsc --noEmit` clean on the modified `use-provider-fields.tsx` - ✅ `node --check` clean on the modified JS file 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
Jin Hai
|
f763044889 |
Go CLI: Fix show admin server and api server (#16382)
### What problem does this PR solve? RAGFlow(api/default)> show admin server; RAGFlow(api/default)> show api server 'default'; RAGFlow(admin)> show admin server; RAGFlow(admin)> show api server 'default'; ### Type of change - [x] Bug Fix (non-breaking change which fixes an issue) --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
8bc27d8df1 |
Go CLI: fix show variable (#16370)
### What problem does this PR solve? ``` RAGFlow(api/default)> show var 'mail.port'; +-----------+-----------+--------------+-------+ | data_type | name | setting_type | value | +-----------+-----------+--------------+-------+ | integer | mail.port | config | 30 | +-----------+-----------+--------------+-------+ ``` ### Type of change - [x] Bug Fix (non-breaking change which fixes an issue) --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
dbefadd86a | Go CLI: refactor (#16355) | ||
|
Jin Hai
|
edfa9be67f | Go CLI: fix list provider instance tasks (#16345) | ||
|
Jin Hai
|
17b066e6ae |
Go CLI: fix list dataset files by dataset name (#16341)
### What problem does this PR solve? ``` RAGFlow(api/default)> list dataset 'ccc' files; Total: 1 ``` ### Type of change - [x] Bug Fix (non-breaking change which fixes an issue) Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
7ef4a4a06a |
Go CLI: list provider instance models, sync and list provider (#16311)
### What problem does this PR solve? ``` RAGFlow(api/default)> list provider 'zhipu-ai' instance 'test' models sync; +------------+---------------+------------+-------------+------------------+---------------------------------------------+ | dimensions | max_dimension | max_tokens | model_types | name | thinking | +------------+---------------+------------+-------------+------------------+---------------------------------------------+ | | | 128000 | [chat] | glm-4.5@z-ai | map[clear_thinking:true default_value:true] | | | | 128000 | [chat] | glm-4.5-air@z-ai | map[clear_thinking:true default_value:true] | | | | 202752 | [chat] | glm-4.6@z-ai | map[clear_thinking:true default_value:true] | | | | 202752 | [chat] | glm-4.7@z-ai | map[clear_thinking:true default_value:true] | | | | 202752 | [chat] | glm-5@z-ai | map[clear_thinking:true default_value:true] | | | | 200000 | [chat] | glm-5-turbo@z-ai | map[clear_thinking:true default_value:true] | | | | 202752 | [chat] | glm-5.1@z-ai | map[clear_thinking:true default_value:true] | | | | | [chat] | glm-5.2@z-ai | | +------------+---------------+------------+-------------+------------------+---------------------------------------------+ RAGFlow(api/default)> list provider 'zhipu-ai' instance 'test' models; RAGFlow(api/default)> list dataset 'aaa' ingestion tasks; RAGFlow(api/default)> list dataset '0abe79f9423311f1ad8d38a74640adcc' documents; ``` --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
1fc02606ea |
Go CLI: fix key commands (#16306)
### What problem does this PR solve? ``` RAGFlow(api/default)> set key 'ragflow-JgnarFSCUiV99oOvvMDei7ZzZg1cVlqGd1AMHrHeKE4'; SUCCESS RAGFlow(api/default)> unset key; SUCCESS RAGFlow(api/default)> list provider 'zhipu-ai' instances; RAGFlow(api/default)> list providers; RAGFlow(api/default)> list available providers; RAGFlow(api/default)> list provider 'zhipu-ai' instance 'test' models; ``` ### Type of change - [x] Bug Fix (non-breaking change which fixes an issue) --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
9624f70b22 |
Go CLI: refactor (#16299)
``` RAGFlow(api/default)> list dataset 'e93ab2c04ad111f1b17438a74640adcc' documents; Total: 1 RAGFlow(api/default)> list datasets; RAGFlow(api/default)> list chats; Total: 2 RAGFlow(api/default)> list agents; Total: 1 RAGFlow(api/default)> list searches; Total: 1 RAGFlow(api/default)> list keys; +----------------------------------+---------------+----------------------------------+-----------------------------------------------------+---------------+ | beta | create_time | tenant_id | token | update_time | +----------------------------------+---------------+----------------------------------+-----------------------------------------------------+---------------+ | GKsLEdSUkl76gJz1k_4fJpSQRIlWsiki | 1782285917523 | 2ba4881420fa11f19e9c38a74640adcc | ragflow-JgnarFSCUiV99oOvvMDei7ZzZg1cVlqGd1AMHrHeKE4 | 1782285917523 | +----------------------------------+---------------+----------------------------------+-----------------------------------------------------+---------------+ RAGFlow(api/default)> create key; SUCCESS RAGFlow(api/default)> drop key 'ragflow-aA4R7AuUD158yh2LDh7IDBiqwOKFDKeTwUSQSLVdPdM'; SUCCESS ``` --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
e15130534f |
Go: default public key (#16265)
### What problem does this PR solve? Provider default public key for CLI ### Type of change - [x] Refactoring Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
dec2ce4a60 | Go CLI: admin model framework (#16252) | ||
|
Jin Hai
|
b661e9c19e |
Go CLI: admin list providers (#16243)
### What problem does this PR solve? ``` RAGFlow(admin)> list providers; +----------------------+-------------------------------------------------------------+ | command | error | +----------------------+-------------------------------------------------------------+ | list_model_providers | 'list model providers' is implemented in enterprise edition | +----------------------+-------------------------------------------------------------+ RAGFlow(admin)> add provider 'zhipu-ai'; +-------------+-----------------------------------------------------------+ | field | value | +-------------+-----------------------------------------------------------+ | command | add_model_provider | | error | 'add model provider' is implemented in enterprise edition | | provider_id | admin | | user_id | zhipu-ai | +-------------+-----------------------------------------------------------+ RAGFlow(admin)> delete provider 'zhipu-ai'; +-------------+--------------------------------------------------------------+ | field | value | +-------------+--------------------------------------------------------------+ | command | delete_model_provider | | error | 'delete model provider' is implemented in enterprise edition | | provider_id | admin | | user_id | zhipu-ai | +-------------+--------------------------------------------------------------+ RAGFlow(admin)> add provider 'zhipu-ai' instance 'instance1'; +---------------+-----------------------------------------------------------+ | field | value | +---------------+-----------------------------------------------------------+ | command | add_model_instance | | error | 'add model instance' is implemented in enterprise edition | | instance_name | instance1 | | provider_id | zhipu-ai | | user_id | admin | +---------------+-----------------------------------------------------------+ RAGFlow(admin)> delete provider 'zhipu-ai' instance 'test' +-------------+--------------------------------------------------------------+ | field | value | +-------------+--------------------------------------------------------------+ | instances | [test] | | provider_id | zhipu-ai | | user_id | admin | | command | delete_model_provider | | error | 'delete model instance' is implemented in enterprise edition | +-------------+--------------------------------------------------------------+ RAGFlow(admin)> add provider 'zhipu-ai' instance 'instance1' model 'xxx'; +---------------+--------------------------------------------------+ | field | value | +---------------+--------------------------------------------------+ | command | add_model | | error | 'add model' is implemented in enterprise edition | | instance_name | instance1 | | model_names | [xxx] | | provider_id | zhipu-ai | | user_id | admin | +---------------+--------------------------------------------------+ RAGFlow(admin)> delete provider 'zhipu-ai' instance 'test' model 'xxx'; +---------------+------------------------------------------------------+ | field | value | +---------------+------------------------------------------------------+ | command | delete_model_provider | | error | 'delete models' is implemented in enterprise edition | | instance_name | test | | models | [xxx] | | provider_id | zhipu-ai | | user_id | admin | +---------------+------------------------------------------------------+ ``` ### Type of change - [x] New Feature (non-breaking change which adds functionality) --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
qinling0210
|
563d855780 |
Implement OpenAI chat completions in GO (#16177)
### What problem does this PR solve? Implement OpenAI chat completions in GO POST /api/v1/openai/<chat_id>/chat/completions OpenAI chat cli: internal/development.md ### Type of change - [x] Refactoring |
||
|
Jin Hai
|
32d5c0039b |
Go: refactor model API to accept model id (#15999)
### What problem does this PR solve? Not not only model_name@instance_name@provider_name is acceptable, but also model_id is acceptable. ### Type of change - [x] New Feature (non-breaking change which adds functionality) --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
e89afbae21 |
Go: file parser config (#15989)
### What problem does this PR solve? Add parser config ### Type of change - [x] New Feature (non-breaking change which adds functionality) Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
234f1b7cff |
Go: add office_oxide and parse docx file. (#15976)
### What problem does this PR solve? As title. ### Type of change - [x] New Feature (non-breaking change which adds functionality) --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
115b730d07 |
Go: parse ingestion DSL (#15938)
PR #15938 ### Type of change - [x] New Feature (non-breaking change which adds functionality) --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
e96bc37d06 |
Go: use NATS as the message queue (#15327)
### What problem does this PR solve? ``` RAGFlow(admin)> mq publish 'msg2'; SUCCESS RAGFlow(admin)> mq publish 'msg3'; SUCCESS RAGFlow(admin)> mq list; +---------+---------------+ | message | subject | +---------+---------------+ | msg1 | tasks.RAGFLOW | | msg2 | tasks.RAGFLOW | | msg3 | tasks.RAGFLOW | +---------+---------------+ RAGFlow(admin)> mq pull 2; +---------+---------------+ | message | subject | +---------+---------------+ | msg1 | tasks.RAGFLOW | | msg2 | tasks.RAGFLOW | +---------+---------------+ RAGFlow(admin)> mq pull noack; +---------+---------------+ | message | subject | +---------+---------------+ | abc | tasks.RAGFLOW | +---------+---------------+ RAGFlow(admin)> mq show +-------------------+----------------+--------+---------------+---------------+-------------------+---------------+ | ack_pending_count | consumer_count | memory | message_count | pending_count | redelivered_count | waiting_count | +-------------------+----------------+--------+---------------+---------------+-------------------+---------------+ | 2 | 1 | 0 | 2 | 0 | 1 | 0 | +-------------------+----------------+--------+---------------+---------------+-------------------+---------------+ RAGFlow(admin)> list ingestors; +--------------+-------------------------------------------+--------+ | host | name | status | +--------------+-------------------------------------------+--------+ | 192.168.1.38 | ingestor-8f0e4bd5650a4ac58b0151969fbf6935 | alive | +--------------+-------------------------------------------+--------+ RAGFlow(admin)> list ingestion tasks; +----------------------------------+----------------------------------+-----------+------+-------------+----------------------------------+ | document_id | id | status | step | user | user_id | +----------------------------------+----------------------------------+-----------+------+-------------+----------------------------------+ | ffe64fae423411f1a2d938a74640adcc | 90d3d0f6528941c1ac8eb0360effccc4 | COMPLETED | 5 | aaa@aaa.com | 2ba4881420fa11f19e9c38a74640adcc | +----------------------------------+----------------------------------+-----------+------+-------------+----------------------------------+ RAGFlow(admin)> remove ingestion tasks '90d3d0f6528941c1ac8eb0360effccc4'; +---------+----------------------------------+ | delete | task_id | +---------+----------------------------------+ | success | 90d3d0f6528941c1ac8eb0360effccc4 | +---------+----------------------------------+ RAGFlow(admin)> stop ingestion tasks 'e89e20d9a25848a1b79bd9345ddbfe1d'; +----------+----------------------------------+ | status | task_id | +----------+----------------------------------+ | STOPPING | e89e20d9a25848a1b79bd9345ddbfe1d | +----------+----------------------------------+ # Publish a message RAGFlow(admin)> mq publish 'cdd'; SUCCESS # List current tasks in the message queue RAGFlow(admin)> mq list +----------------------------------+---------------+ | message | subject | +----------------------------------+---------------+ | 7ce392a3c1624cd2be4b5276e8825059 | tasks.RAGFLOW | +----------------------------------+---------------+ # Consume a task from the message queue RAGFlow(admin)> mq pull +------+-----+----------------+ | ack | id | type | +------+-----+----------------+ | true | cdd | ingestion_test | +------+-----+----------------+ # User mode # List ingestion tasks, followed by dataset id RAGFlow(user)> list ingestion tasks from '0abe79f9423311f1ad8d38a74640adcc'; +---------------------------+---------------+----------------------------------+----------------------------------+----------------------------------+--------+-----------+---------------------------+---------------+----------------------------------+ | create_date | create_time | dataset_id | document_id | id | schema | status | update_date | update_time | user_id | +---------------------------+---------------+----------------------------------+----------------------------------+----------------------------------+--------+-----------+---------------------------+---------------+----------------------------------+ | 2026-05-30T20:21:06+08:00 | 1780143666289 | 0abe79f9423311f1ad8d38a74640adcc | ffe64fae423411f1a2d938a74640adcc | 8d758cd14a8b4ba8ab505003fb52017d | | COMPLETED | 2026-05-30T20:21:26+08:00 | 1780143686431 | 2ba4881420fa11f19e9c38a74640adcc | +---------------------------+---------------+----------------------------------+----------------------------------+----------------------------------+--------+-----------+---------------------------+---------------+----------------------------------+ RAGFlow(user)> list ingestion tasks; +---------------------------+---------------+----------------------------------+----------------------------------+----------------------------------+--------+-----------+---------------------------+---------------+----------------------------------+ | create_date | create_time | dataset_id | document_id | id | schema | status | update_date | update_time | user_id | +---------------------------+---------------+----------------------------------+----------------------------------+----------------------------------+--------+-----------+---------------------------+---------------+----------------------------------+ | 2026-06-02T19:02:31+08:00 | 1780398151417 | 0abe79f9423311f1ad8d38a74640adcc | ffe64fae423411f1a2d938a74640adcc | e89e20d9a25848a1b79bd9345ddbfe1d | | COMPLETED | 2026-06-02T19:02:52+08:00 | 1780398172208 | 2ba4881420fa11f19e9c38a74640adcc | +---------------------------+---------------+----------------------------------+----------------------------------+----------------------------------+--------+-----------+---------------------------+---------------+----------------------------------+ # Create an ingestion task # First argument is document id, second argument is dataset id RAGFlow(user)> start ingestion 'ffe64fae423411f1a2d938a74640adcc' from '0abe79f9423311f1ad8d38a74640adcc'; +----------------------------------+-------------------------------------------+ | document_id | result | +----------------------------------+-------------------------------------------+ | ffe64fae423411f1a2d938a74640adcc | task_id: 8d758cd14a8b4ba8ab505003fb52017d | +----------------------------------+-------------------------------------------+ # Pause an ingestion task, first argument is ingestion id RAGFlow(user)> stop ingestion '8d758cd14a8b4ba8ab505003fb52017d'; +---------------------------+---------------+----------------------------------+----------------------------------+----------------------------------+--------+-----------+---------------------------+---------------+----------------------------------+ | create_date | create_time | dataset_id | document_id | id | schema | status | update_date | update_time | user_id | +---------------------------+---------------+----------------------------------+----------------------------------+----------------------------------+--------+-----------+---------------------------+---------------+----------------------------------+ | 2026-05-30T20:21:06+08:00 | 1780143666289 | 0abe79f9423311f1ad8d38a74640adcc | ffe64fae423411f1a2d938a74640adcc | 8d758cd14a8b4ba8ab505003fb52017d | | COMPLETED | 2026-05-30T20:21:26+08:00 | 1780143686431 | 2ba4881420fa11f19e9c38a74640adcc | +---------------------------+---------------+----------------------------------+----------------------------------+----------------------------------+--------+-----------+---------------------------+---------------+----------------------------------+ # Delete an ingestion task RAGFlow(api/default)> remove ingestion tasks 'f366450a27d54677aec1c7090add30f0'; +---------+----------------------------------+ | remove | task_id | +---------+----------------------------------+ | success | f366450a27d54677aec1c7090add30f0 | +---------+----------------------------------+ ``` ### Type of change - [x] New Feature (non-breaking change which adds functionality) --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
ca00d23aac |
Go: add parse and chunk command (#15936)
### What problem does this PR solve? Two commands are used for ingestion file testing ``` RAGFlow(api/default)> chunk 'file' with 'dsl'; Chunk file: file, DSL: dsl SUCCESS RAGFlow(api/default)> parse file 'filename' chat 'xxx'; Success to parse local file "filename", vision: , chat: xxx, asr: , ocr: , embedding: , doc_parse: SUCCESS ``` ### Type of change - [x] New Feature (non-breaking change which adds functionality) Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
 Yingfeng
|
01a2a44766 |
Clean CLI for filesystem (#15838)
### Type of change - [x] Refactoring |
||
|
Jin Hai
|
d02eb6b596 |
Go: refactor CLI (#15728)
### What problem does this PR solve? ``` RAGFlow(user)> add api server 'ccc' host '127.0.0.1:9980'; SUCCESS RAGFlow(user)> list api server; +------------+---------------+-----------------+---------+-------------+---------------+ | api_server | api_server_ip | api_server_port | auth | user_name | user_password | +------------+---------------+-----------------+---------+-------------+---------------+ | ccc | 127.0.0.1 | 9980 | no auth | | | | default | 127.0.0.1 | 9384 | login | aaa@aaa.com | *** | +------------+---------------+-----------------+---------+-------------+---------------+ RAGFlow(user)> delete api server 'ccc'; SUCCESS RAGFlow(user)> list api server; +------------+---------------+-----------------+---------+ | api_server | api_server_ip | api_server_port | auth | +------------+---------------+-----------------+---------+ | default | 127.0.0.1 | 9384 | no auth | +------------+---------------+-----------------+---------+ RAGFlow(user)> show admin server; +--------------+-------+ | field | value | +--------------+-------+ | admin_server | N/A | +--------------+-------+ RAGFlow(user)> add admin server host '127.0.0.1:9880'; SUCCESS RAGFlow(user)> show admin server; +-------------------+-----------+ | field | value | +-------------------+-----------+ | admin_server_ip | 127.0.0.1 | | admin_server_port | 9880 | | auth | no auth | +-------------------+-----------+ RAGFlow(user)> delete admin server; SUCCESS RAGFlow(user)> show admin server; +--------------+-------+ | field | value | +--------------+-------+ | admin_server | N/A | +--------------+-------+ RAGFlow(user)> show current +-----------------+-------------+ | field | value | +-----------------+-------------+ | api_server_port | 9384 | | user_name | aaa@aaa.com | | user_password | *** | | mode | api | | verbose | false | | api_server | default | | api_server_ip | 127.0.0.1 | | auth | login | | output | table | | interactive | true | +-----------------+-------------+ ``` ### Type of change - [x] Refactoring --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
qinling0210
|
c960dc2a4c |
Refine handling of POST /api/v1/datasets/search in GO (#15583)
### What problem does this PR solve? Refine handling of POST /api/v1/datasets/search in GO ### Type of change - [x] Refactoring |
||
 Hz_
|
1deb1313d2 |
feat(go-cli): support batch model add/remove and optional embedding dimension (#15631)
## Summary This PR improves the Go CLI in two areas: 1. It adds batch model management support, allowing multiple models to be added or removed in a single command. 2. It makes the `dimension` argument optional for the `embed text` command. These changes keep the existing single-model and explicit-dimension behaviors compatible while making the CLI more convenient for common workflows. ## What Changed ### 1. Batch model add/remove support The CLI now supports operating on multiple model names provided in a single quoted string. Supported commands include: ``` add model 'x1 x2 x3' to provider 'vllm' instance 'test' with tokens 1024 chat think vision, token 2048 chat, token 1024 think vision; drop model 'x1 x2 x3' from 'vllm' 'test'; remove model 'x1 x2 x3' from 'vllm' 'test'; ``` For add model, each config segment after with is matched to the corresponding model name by position. Example mapping: - x1 -> tokens 1024, chat + vision, thinking=true - x2 -> tokens 2048, chat - x3 -> tokens 1024, vision, thinking=true The existing single-model syntax remains supported. ### 2. Optional embedding dimension Previously, the Go CLI required dimension to be explicitly provided for embed text. Before: embed text 'what is rag' 'who are you' with 'model@test@provider' dimension 8192; Now both forms are supported: embed text 'what is rag' 'who are you' with 'model@test@provider' dimension 8192; embed text 'what is rag' 'who are you' with 'model@test@provider'; When omitted, the CLI leaves dimension unset and relies on provider/backend behavior. ## Tests Added parser tests covering: - Multiple models with multiple config segments - Model type deduplication - Model/config count mismatch - Drop/remove multiple models - Optional embedding dimension parsing |
||
|
Jin Hai
|
e1f19f6679 |
Go: fix gitee balance api (#15554)
``` RAGFlow(user)> create provider 'gitee' instance 'intl' key 'api-token' url 'https://ai.gitee.com/v1' region 'intl'; SUCCESS ``` --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Hz_
|
9799f33549 |
GOCli check provider region (#15474)
## Summary - add CLI command `CHECK PROVIDER 'provider_name' REGION 'region_name' KEY 'api_key';` - route the command through CLI parser and command dispatcher - call `GET /api/v1/providers/:provider_name/connection` with `region` and `api_key` ## Testing - `go test ./internal/cli/...` - manually verified CLI command parsing and request flow |
||
|
qinling0210
|
af85aa9c7b |
Implement Elasticsearch functions in GO (#15160)
### What problem does this PR solve? Implement Elasticsearch functions in GO (except for Search) ### Type of change - [x] Refactoring |
||
|
Jin Hai
|
f8c626bbc8 |
Go: add ingestion server (#15094)
### What problem does this PR solve? 1. Go ingestion server will connected with admin server with gRPC stream 2. Go ingestion server will be responsible for ingestion tasks ``` RAGFlow(admin)> list ingestors; +-----------------+-----------+----------------------------------+---------------------------+----------+------------+--------------+--------+------------+---------------+ | address | cpu_usage | id | last_heartbeat | name | process_id | rss_usage | status | task_count | vms_usage | +-----------------+-----------+----------------------------------+---------------------------+----------+------------+--------------+--------+------------+---------------+ | 127.0.0.1:58564 | 0 | bdd1870eea2646e0aacb8a2cd3307aa2 | 2026-05-24T18:16:17+08:00 | ingestor | 680152 | 212.72265625 | active | 0 | 2589.12109375 | +-----------------+-----------+----------------------------------+---------------------------+----------+------------+--------------+--------+------------+---------------+ RAGFlow(admin)> start ingestion 'abc'; +----------------------------------+ | task_id | +----------------------------------+ | e714777639ca4760ab427b5f211e81ad | +----------------------------------+ RAGFlow(admin)> stop ingestion 'f7bd39d0a724457eb5fdce6d81699776'; +----------------------------------+ | task_id | +----------------------------------+ | f7bd39d0a724457eb5fdce6d81699776 | +----------------------------------+ RAGFlow(admin)> list tasks; +-----+----------------------------------+-------+------+----------------------------------+---------------------------+------------+------------+ | ETA | assign_to | error | from | id | last_update | start_time | status | +-----+----------------------------------+-------+------+----------------------------------+---------------------------+------------+------------+ | 0 | 17937da188b84f23a5c10bb87588944b | | CLI | eae6431da72a40e796cff3a03008091b | 2026-05-24T19:46:03+08:00 | | COMPLETED | | 0 | 17937da188b84f23a5c10bb87588944b | | CLI | 6cccdd174bd049ecb05a774bbb47593f | 2026-05-24T19:46:03+08:00 | | COMPLETED | | 0 | 17937da188b84f23a5c10bb87588944b | | CLI | ef360d777e57485799adb96b30f2b4b8 | 2026-05-24T19:46:03+08:00 | | CANCELED | | 0 | 17937da188b84f23a5c10bb87588944b | | CLI | bcc5c5448cb64de48b6b6171c36fb790 | 2026-05-24T19:46:03+08:00 | | CANCELED | | 0 | 17937da188b84f23a5c10bb87588944b | | CLI | bfc25384c43a443294fe2da979a38ac2 | 2026-05-24T19:46:03+08:00 | | DISPATCHED | | 0 | 17937da188b84f23a5c10bb87588944b | | CLI | 84960537b85d413b8990a9efd5952d67 | 2026-05-24T19:46:04+08:00 | | DISPATCHED | | 0 | 17937da188b84f23a5c10bb87588944b | | CLI | 3d223c1b51e24b36861a3bfb2f1d58d4 | 2026-05-24T19:46:03+08:00 | | CANCELED | | 0 | 17937da188b84f23a5c10bb87588944b | | CLI | e433b0e356b846c89c301621a3c54494 | 2026-05-24T19:46:03+08:00 | | COMPLETED | | 0 | 17937da188b84f23a5c10bb87588944b | | CLI | 7c93a3880f074ebd8eca14e6b51bb7ef | 2026-05-24T19:46:03+08:00 | | COMPLETED | | 0 | 17937da188b84f23a5c10bb87588944b | | CLI | df2e4ef51aaf4390bff9a23f2692486e | 2026-05-24T19:46:04+08:00 | | DISPATCHED | | 0 | 17937da188b84f23a5c10bb87588944b | | CLI | 7377c53010194ef7a83aa206698d66ff | 2026-05-24T19:46:05+08:00 | | DISPATCHED | | 0 | 17937da188b84f23a5c10bb87588944b | | CLI | df64d1a1f9d348e3a2f174c4d7d69e73 | 2026-05-24T19:46:05+08:00 | | DISPATCHED | | 0 | 17937da188b84f23a5c10bb87588944b | | CLI | b59834512e2847e1bdf13ace04b8a456 | 2026-05-24T19:46:06+08:00 | | DISPATCHED | | 0 | 17937da188b84f23a5c10bb87588944b | | CLI | 0064bb0ab69344028d1ecfda053826f4 | 2026-05-24T19:46:03+08:00 | | QUEUED | +-----+----------------------------------+-------+------+----------------------------------+---------------------------+------------+------------+ ``` ### Type of change - [x] New Feature (non-breaking change which adds functionality) --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
qinling0210
|
dbef3e361f |
Update chunk/metadata cli (#15055)
### What problem does this PR solve? Update chunk/metadata cli ### Type of change - [ ] Refactoring |
||
 Haruko386
|
db9e782747 |
Go: implement provider: MinerU (#14990)
### What problem does this PR solve? Implement MinerU Provider **The following functionalities are now supported:** **MinerU** ---- - [x] Parse file - [x] Show task - [ ] ~~List tasks~~ **Verified examples from the CLI:** ```plaintext RAGFlow(user)> parse with 'vlm@test@mineru' file 'https://arxiv.org/pdf/2505.09358' +--------------------------------------+ | task_id | +--------------------------------------+ | 142ac8ea-d9d0-4a68-a2d1-d3af67635dc9 | +--------------------------------------+ RAGFlow(user)> show 'test@mineru' task '142ac8ea-d9d0-4a68-a2d1-d3af67635dc9' +--------------------------------------------+-------+ | content | index | +--------------------------------------------+-------+ | Task is running... Progress: 17 / 18 pages | 0 | +--------------------------------------------+-------+ RAGFlow(user)> show 'test@mineru' task '142ac8ea-d9d0-4a68-a2d1-d3af67635dc9' +--------------------------------------------------------------------------------------------+-------+ | content | index | +--------------------------------------------------------------------------------------------+-------+ | https://cdn-mineru.openxlab.org.cn/pdf/2026-05-18/142ac8ea-d9d0-4a68-a2d1-d3af67635dc9.zip | 0 | +--------------------------------------------------------------------------------------------+-------+ ``` ### Type of change - [x] Bug Fix (non-breaking change which fixes an issue) - [x] New Feature (non-breaking change which adds functionality) - [x] Refactoring |
||
|
Haruko386
|
c2863173b0 |
Go: implement TTS, ASR for Siliconflow and TTs for StepFun (#14944)
### What problem does this PR solve?
This PRimplement TTS, ASR for Siliconflow and TTs for StepFun
**The following functionalities are now supported:**
**SiliConFlow:**
- [x] Text To Speech
- [x] Audio To Text
- [x] Stream Audio To Text
**StrepFun:**
- [x] Audio To Text
- [x] Stream Audio To Text
**Verified examples from the CLI:**
```plaintext
# SiliconFlow
RAGFlow(user)> tts with 'FunAudioLLM/CosyVoice2-0.5B@test@Siliconflow' text 'hello? show yourself' play format 'wav' param '{"voice": "fnlp/MOSS-TTSD-v0.5:alex"}'
SUCCESS
RAGFlow(user)> asr with 'FunAudioLLM/SenseVoiceSmall@test@siliconflow' audio './internal/test.wav' param ''
+----------------------------------------------------------------------------------------------------------------------+
| text |
+----------------------------------------------------------------------------------------------------------------------+
| The examination and testimony of the experts enabled the commission to conclude that five shots may have been fired. |
+----------------------------------------------------------------------------------------------------------------------+
RAGFlow(user)> stream asr with 'FunAudioLLM/SenseVoiceSmall@test@siliconflow' audio './internal/test.wav' param ''
+----------------------------------------------------------------------------------------------------------------------+
| text |
+----------------------------------------------------------------------------------------------------------------------+
| The examination and testimony of the experts enabled the commission to conclude that five shots may have been fired. |
+----------------------------------------------------------------------------------------------------------------------+
```
### Type of change
- [x] Bug Fix (non-breaking change which fixes an issue)
- [x] New Feature (non-breaking change which adds functionality)
|
||
|
Jin Hai
|
335dd5a263 |
Go: add cli command, list dataset documents (#14948)
### What problem does this PR solve? ``` +---------------------+----------------------------------+-------------+-----------------+---------+--------+------+ | created_at | id | meta_fields | name | size | status | type | +---------------------+----------------------------------+-------------+-----------------+---------+--------+------+ | 2026-05-08 19:35:08 | f6aa38bb4ad111f1ba6338a74640adcc | map[] | abc.pdf | 3387987 | 1 | pdf | +---------------------+----------------------------------+-------------+-----------------+---------+--------+------+ ``` ### Type of change - [x] New Feature (non-breaking change which adds functionality) --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
3a5df08c76 |
Go: add file parse command (#14892)
### What problem does this PR solve? ``` RAGFlow(user)> ocr with 'hunyuanocr@test@gitee' file './picture.png' +----------------------------------------------------------+ | text | +----------------------------------------------------------+ | 生活不是等待风暴过去，而是学会在雨中翩翩起舞。 ——佚名 | +----------------------------------------------------------+ RAGFlow(user)> list 'test@gitee' tasks; +---------+----------------------------------+ | status | task_id | +---------+----------------------------------+ | success | C3FX4MQNKY5MGC6ZFMIXIAMJKHCEBQB5 | +---------+----------------------------------+ RAGFlow(user)> show 'test@gitee' task 'C3FX4MQNKY5MGC6ZFMIXIAMJKHCEBQB5'; +------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------+ | content | index | +------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------+ | # PDF 1: Purpose of RAGFlow RAGFlow is an open source Retrieval-Augmented Generation (RAG) engine designed to turn raw documents into reliable context for large language models.Its purpose is to make it practical to build an Al assistant that can ans... | 1 | +------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------+ ``` ### Type of change - [x] New Feature (non-breaking change which adds functionality) --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Haruko386
|
106f4b777e |
Go: implement TTS for fishaudio, openrouter and asr for fishaudio (#14926)
### What problem does this PR solve?
This PR implement TTS for FishAudio and MiniMax provider and ASR for
FishAudio
**The following functionalities are now supported:**
**FishAudio:**
- [x] Text To Speech
- [x] Stream Text To Speech
- [x] Audio To Text
**OpenRouter:**
- [x] Text To Speech
**Verified examples from the CLI:**
```plaintext
**FishAudio**
RAGFlow(user)> tts with 's1@test@fishaudio' text 'He who desires but acts not, breeds pestilence.' play format 'wav' save './internal' param '{"reference_id": "90e65eaaf50e4470b8e6d43ee6afd7d5", "temperature": 0.7, "top_p": 0.7, "prosody": {"speed": 1, "volume": 0, "normalize_loudness": true}, "chunk_length": 300, "normalize": true, "sample_rate": 44100, "mp3_bitrate": 128, "latency": "normal", "max_new_tokens": 1024, "repetition_penalty": 1.2, "min_chunk_length": 50, "condition_on_previous_chunks": true, "early_stop_threshold": 1}'
Saved to directory: /home/infiniflow/Documents/development/ragflow/internal/s1_output.wav
SUCCESS
RAGFlow(user)> stream tts with 's1@test@fishaudio' text 'He who desires but acts not, breeds pestilence.' play format 'wav' save './internal' param '{"reference_id": "90e65eaaf50e4470b8e6d43ee6afd7d5", "temperature": 0.7, "top_p": 0.7, "prosody": {"speed": 1, "volume": 0, "normalize_loudness": true}, "chunk_length": 300, "normalize": true, "sample_rate": 44100, "mp3_bitrate": 128, "latency": "normal", "max_new_tokens": 1024, "repetition_penalty": 1.2, "min_chunk_length": 50, "condition_on_previous_chunks": true, "early_stop_threshold": 1}'
Saved to directory: /home/infiniflow/Documents/development/ragflow/internal/s1_output.wav
SUCCESS
RAGFlow(user)> asr with 'transcribe-1@test@fishaudio' audio './internal/test.wav' param '{"language": "en", "ignore_timestamps": true}'
+----------------------------------------------------------------------------------------------------------------------+
| text |
+----------------------------------------------------------------------------------------------------------------------+
| The examination and testimony of the experts enabled the commission to conclude that five shots may have been fired. |
+----------------------------------------------------------------------------------------------------------------------+
```
### Type of change
- [x] Bug Fix (non-breaking change which fixes an issue)
- [x] New Feature (non-breaking change which adds functionality)
- [x] Refactoring
|
||
|
Haruko386
|
ef46005ef1 |
Go: implement TTS for MiniMax provider and CLI testing for TTS (#14911)
### What problem does this PR solve?
This PR implement TTS for MiniMax provider and CLI testing for TTS
**The following functionalities are now supported:**
**MiniMax:**
- [x] Chat / Stream Chat
- [x] Embedding
- [x] Rerank
- [x] Model listing
- [x] Provider connection checking
- [x] Text To Speech
- [ ] OCRFile
- [ ] ~~Audio To Text~~
- [ ] ~~Balance~~
**Verified examples from the CLI:**
```plaintext
RAGFlow(user)> tts with 'speech-2.8-hd@test@minimax' text 'He who desires but acts not, breeds pestilence.' play format 'wav' save './internal' param '{"voice_setting": {"voice_id": "English_radiant_girl", "speed": 1, "vol": 1, "pitch": 0}, "audio_setting": {"sample_rate": 32000, "bitrate": 128000, "format": "wav", "channel": 1}, "output_format": "hex"}'
Saved to directory: /home/infiniflow/Documents/development/ragflow/internal/speech-2.8-hd_output.wav
SUCCESS
RAGFlow(user)> stream tts with 'speech-2.8-hd@test@minimax' text 'He who desires but acts not, breeds pestilence.' play format 'wav' save './internal' param '{"voice_setting": {"voice_id": "English_radiant_girl", "speed": 1, "vol": 1, "pitch": 0}, "audio_setting": {"sample_rate": 32000, "bitrate": 128000, "format": "wav", "channel": 1}, "output_format": "hex"}'
Saved to directory: /home/infiniflow/Documents/development/ragflow/internal/speech-2.8-hd_output.wav
SUCCESS
```
Set `Play` to play audio in CLI
Set `Save` `PATH_TO_SAVE` to save file
Set `format` to save file in wav or mp3
Set `Param` align with official request body
### Type of change
- [x] New Feature (non-breaking change which adds functionality)
|
||
|
Jin Hai
|
b18640d228 |
Go: fix OCR command (#14891)
### What problem does this PR solve? RAGFlow(user)> ocr with 'hunyuanocr@test@gitee' file './picture.png' +----------------------------------------------------------+ | text | +----------------------------------------------------------+ | 生活不是等待风暴过去，而是学会在雨中翩翩起舞。 ——佚名 | +----------------------------------------------------------+ ### Type of change - [x] Bug Fix (non-breaking change which fixes an issue) --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
d08bf02d9b |
Go: add ASR, TTS, OCR command (#14836)
### What problem does this PR solve? ``` RAGFlow(user)> asr with 'glm-asr-2512@test@zhipu-ai' audio './speech.wav'; CLI error: zhipu, no such method RAGFlow(user)> stream asr with 'glm-asr-2512@test@zhipu-ai' audio './speech.wav'; CLI error: zhipu, no such method RAGFlow(user)> tts with 'glm-tts@test@zhipu-ai' text 'how are you'; CLI error: zhipu, no such method RAGFlow(user)> stream tts with 'glm-tts@test@zhipu-ai' text 'how are you'; CLI error: zhipu, no such method RAGFlow(user)> ocr with 'glm-ocr@test@zhipu-ai' file './test.log'; CLI error: zhipu, no such method ``` ### Type of change - [x] New Feature (non-breaking change which adds functionality) Signed-off-by: Jin Hai <haijin.chn@gmail.com> |
||
|
Jin Hai
|
c55e23e7e2 |
Go: refactor embedding interface (#14757)
### What problem does this PR solve? Provide embedding index according to the input text ### Type of change - [x] Refactoring --------- Signed-off-by: Jin Hai <haijin.chn@gmail.com> |