flujo-ai 3.31.0 → 3.34.0

package/.next/types/routes.d.ts

@@ -2,7 +2,7 @@
 // Do not edit this file manually
 
 type AppRoutes = "/" | "/chat" | "/docs" | "/executions" | "/flows" | "/mcp" | "/models" | "/packages" | "/settings" | "/waves"
-type AppRouteHandlerRoutes = "/api/approvals" | "/api/approvals/[id]" | "/api/backup" | "/api/browse" | "/api/bugs/enhance" | "/api/cwd" | "/api/encryption/secure" | "/api/env" | "/api/flow" | "/api/flow/[id]" | "/api/flow/[id]/versions" | "/api/flow/[id]/versions/[versionId]" | "/api/flow/compile" | "/api/flow/generate" | "/api/flow/improve" | "/api/flow/prompt-renderer" | "/api/flow/quick-chat" | "/api/flow/repair" | "/api/git" | "/api/init" | "/api/local-models/capability" | "/api/local-models/pull" | "/api/local-models/suggest" | "/api/mcp-registry" | "/api/mcp-registry/spotlight" | "/api/mcp/app-sandbox" | "/api/mcp/cancel" | "/api/mcp/oauth-capability" | "/api/mcp/servers" | "/api/mcp/servers/[name]" | "/api/mcp/servers/[name]/prompts" | "/api/mcp/servers/[name]/prompts/get" | "/api/mcp/servers/[name]/resources" | "/api/mcp/servers/[name]/resources/read" | "/api/mcp/servers/[name]/status" | "/api/mcp/servers/[name]/tools" | "/api/mcp/servers/[name]/tools/[toolName]" | "/api/mcp/test-connection" | "/api/mcp/test-connection/stream" | "/api/model" | "/api/model/[id]" | "/api/model/provider" | "/api/model/test" | "/api/oauth/callback" | "/api/oauth/initiate" | "/api/oauth/reset" | "/api/packages/build" | "/api/packages/derive-secrets" | "/api/packages/install" | "/api/packages/install/status" | "/api/packages/installed" | "/api/packages/resolve" | "/api/packages/scan-targets" | "/api/packages/search" | "/api/packages/uninstall" | "/api/planned-executions" | "/api/planned-executions/[id]" | "/api/planned-executions/[id]/run" | "/api/planned-executions/[id]/runs" | "/api/planned-executions/preview-schedule" | "/api/planned-executions/reconcile" | "/api/registry/auth" | "/api/registry/auth/resend" | "/api/registry/auth/reset" | "/api/registry/oauth/callback" | "/api/registry/oauth/initiate" | "/api/registry/publish" | "/api/registry/settings" | "/api/restore" | "/api/runs/active" | "/api/storage" | "/api/update" | "/api/waves" | "/api/webhooks/[id]" | "/mcp-flows" | "/mcp-proxy/[server]" | "/v1/chat/completions" | "/v1/chat/conversations" | "/v1/chat/conversations/[conversationId]" | "/v1/chat/conversations/[conversationId]/breakpoints" | "/v1/chat/conversations/[conversationId]/cancel" | "/v1/chat/conversations/[conversationId]/debug/continue" | "/v1/chat/conversations/[conversationId]/debug/step" | "/v1/chat/conversations/[conversationId]/edit-state" | "/v1/chat/conversations/[conversationId]/events" | "/v1/chat/conversations/[conversationId]/inject" | "/v1/chat/conversations/[conversationId]/resources" | "/v1/chat/conversations/[conversationId]/respond" | "/v1/chat/events" | "/v1/models"
+type AppRouteHandlerRoutes = "/api/approvals" | "/api/approvals/[id]" | "/api/backup" | "/api/browse" | "/api/bugs/enhance" | "/api/cwd" | "/api/encryption/secure" | "/api/env" | "/api/flow" | "/api/flow/[id]" | "/api/flow/[id]/versions" | "/api/flow/[id]/versions/[versionId]" | "/api/flow/compile" | "/api/flow/generate" | "/api/flow/generator" | "/api/flow/improve" | "/api/flow/prompt-renderer" | "/api/flow/quick-chat" | "/api/flow/repair" | "/api/git" | "/api/init" | "/api/local-models/capability" | "/api/local-models/pull" | "/api/local-models/suggest" | "/api/mcp-registry" | "/api/mcp-registry/spotlight" | "/api/mcp/app-sandbox" | "/api/mcp/cancel" | "/api/mcp/oauth-capability" | "/api/mcp/servers" | "/api/mcp/servers/[name]" | "/api/mcp/servers/[name]/prompts" | "/api/mcp/servers/[name]/prompts/get" | "/api/mcp/servers/[name]/resources" | "/api/mcp/servers/[name]/resources/read" | "/api/mcp/servers/[name]/status" | "/api/mcp/servers/[name]/tools" | "/api/mcp/servers/[name]/tools/[toolName]" | "/api/mcp/test-connection" | "/api/mcp/test-connection/stream" | "/api/model" | "/api/model/[id]" | "/api/model/provider" | "/api/model/test" | "/api/oauth/callback" | "/api/oauth/initiate" | "/api/oauth/reset" | "/api/packages/build" | "/api/packages/derive-secrets" | "/api/packages/install" | "/api/packages/install/status" | "/api/packages/installed" | "/api/packages/resolve" | "/api/packages/scan-targets" | "/api/packages/search" | "/api/packages/uninstall" | "/api/planned-executions" | "/api/planned-executions/[id]" | "/api/planned-executions/[id]/run" | "/api/planned-executions/[id]/runs" | "/api/planned-executions/preview-schedule" | "/api/planned-executions/reconcile" | "/api/registry/auth" | "/api/registry/auth/resend" | "/api/registry/auth/reset" | "/api/registry/feedback" | "/api/registry/oauth/callback" | "/api/registry/oauth/initiate" | "/api/registry/packages" | "/api/registry/publish" | "/api/registry/settings" | "/api/restore" | "/api/runs/active" | "/api/storage" | "/api/telemetry/daily-active" | "/api/update" | "/api/waves" | "/api/webhooks/[id]" | "/mcp-flows" | "/mcp-proxy/[server]" | "/v1/chat/completions" | "/v1/chat/conversations" | "/v1/chat/conversations/[conversationId]" | "/v1/chat/conversations/[conversationId]/breakpoints" | "/v1/chat/conversations/[conversationId]/cancel" | "/v1/chat/conversations/[conversationId]/debug/continue" | "/v1/chat/conversations/[conversationId]/debug/step" | "/v1/chat/conversations/[conversationId]/edit-state" | "/v1/chat/conversations/[conversationId]/events" | "/v1/chat/conversations/[conversationId]/inject" | "/v1/chat/conversations/[conversationId]/resources" | "/v1/chat/conversations/[conversationId]/respond" | "/v1/chat/events" | "/v1/models"
 type PageRoutes = never
 type LayoutRoutes = "/"
 type RedirectRoutes = never
@@ -26,6 +26,7 @@ interface ParamMap {
   "/api/flow/[id]/versions/[versionId]": { "id": string; "versionId": string; }
   "/api/flow/compile": {}
   "/api/flow/generate": {}
+  "/api/flow/generator": {}
   "/api/flow/improve": {}
   "/api/flow/prompt-renderer": {}
   "/api/flow/quick-chat": {}
@@ -76,13 +77,16 @@ interface ParamMap {
   "/api/registry/auth": {}
   "/api/registry/auth/resend": {}
   "/api/registry/auth/reset": {}
+  "/api/registry/feedback": {}
   "/api/registry/oauth/callback": {}
   "/api/registry/oauth/initiate": {}
+  "/api/registry/packages": {}
   "/api/registry/publish": {}
   "/api/registry/settings": {}
   "/api/restore": {}
   "/api/runs/active": {}
   "/api/storage": {}
+  "/api/telemetry/daily-active": {}
   "/api/update": {}
   "/api/waves": {}
   "/api/webhooks/[id]": { "id": string; }

package/.next/types/validator.ts

@@ -254,6 +254,15 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../src/app/api/flow/generator/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/flow/generator">> = Specific
+  const handler = {} as typeof import("../../src/app/api/flow/generator/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../src/app/api/flow/improve/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/api/flow/improve">> = Specific
@@ -713,6 +722,15 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../src/app/api/registry/feedback/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/registry/feedback">> = Specific
+  const handler = {} as typeof import("../../src/app/api/registry/feedback/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../src/app/api/registry/oauth/callback/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/api/registry/oauth/callback">> = Specific
@@ -731,6 +749,15 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../src/app/api/registry/packages/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/registry/packages">> = Specific
+  const handler = {} as typeof import("../../src/app/api/registry/packages/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../src/app/api/registry/publish/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/api/registry/publish">> = Specific
@@ -776,6 +803,15 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../src/app/api/telemetry/daily-active/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/telemetry/daily-active">> = Specific
+  const handler = {} as typeof import("../../src/app/api/telemetry/daily-active/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../src/app/api/update/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/api/update">> = Specific

package/README.md

@@ -6,17 +6,21 @@
 
 *Click to watch*
 
-## ⚡ Quick Install (recommended)
-
-One command installs everything FLUJO needs (Git, Node.js, Python, uv), clones FLUJO, builds it, and sets up a global `flujo` command. This is the recommended way to run FLUJO — MCP servers get all their runtimes too.
-
-**Windows** — press Start, type powershell, press Enter, copy & paste the command below and press Enter again:
-
-```powershell
-irm https://raw.githubusercontent.com/mario-andreschak/FLUJO/main/scripts/install.ps1 | iex
-```
-
-**Linux / macOS** — paste into a terminal:
+## ⚡ Quick Install (recommended)
+
+The installer sets up everything FLUJO needs (Git, Node.js, Python, uv), clones FLUJO, builds it, and creates a global `flujo` command. This is the recommended way to run FLUJO — MCP servers get all their runtimes too.
+
+**Windows installer (recommended)** — click below to download the latest `flujo-setup.exe`:
+
+[![Download Setup.exe — Windows Installer](docs/images/readme/download-setup.png)](https://github.com/mario-andreschak/FLUJO/releases/latest/download/flujo-setup.exe)
+
+**Windows PowerShell** — alternatively, press Start, type powershell, press Enter, copy & paste the command below and press Enter again:
+
+```powershell
+irm https://raw.githubusercontent.com/mario-andreschak/FLUJO/main/scripts/install.ps1 | iex
+```
+
+**Linux / macOS** — paste into a terminal:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/mario-andreschak/FLUJO/main/scripts/install.sh | bash
@@ -42,9 +46,17 @@ For *anything* that you struggle with (MCP Installation, Application Issues, Usa
 # FLUJO
 
 [![MIT License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-3.31.0-green.svg)](package.json)
-
-FLUJO is an open-source, local-first platform for building **MCP-powered AI workflows**. It brings together model management, Model-Context-Protocol (MCP) servers, a visual flow builder, and a chat interface in one app — so you can wire models and tools together, run them headlessly on triggers, and expose the result to other apps, without giving up control of your keys and data.
+[![Version](https://img.shields.io/badge/version-3.34.0-green.svg)](package.json)
+
+FLUJO is an open-source, local-first platform for building **MCP-powered AI workflows**. It brings together model management, Model-Context-Protocol (MCP) servers, a visual flow builder, and a chat interface in one app — so you can wire models and tools together, run them headlessly on triggers, and expose the result to other apps, without giving up control of your keys and data.
+
+FLUJO shares one anonymous daily-active pulse by default. The payload is limited
+to the app version, platform, install method, UTC date, and a random identifier
+that changes every day; it contains no flows, prompts, models, keys, filenames,
+account details, or permanent installation identifier. A daily in-app notice
+discloses the check. Sharing and the notice can be controlled independently
+under **Settings → Privacy & Usage**. Set `FLUJO_TELEMETRY_URL` to point at a
+self-hosted compatible collector.
 
 ![FLUJO Overview](docs/images/readme/home.png)
 
@@ -236,8 +248,11 @@ Then open http://localhost:4200.
   `docker-compose.yml`).
 - **Claude Subscription** in-container: generate a token on your host with
   `claude setup-token` and pass it as `CLAUDE_CODE_OAUTH_TOKEN`.
-- **fileWatch triggers**: bind-mount the host folder you want to watch into the
-  container (see the commented volume example in `docker-compose.yml`).
+- **fileWatch triggers**: bind-mount the host folder you want to watch into the
+  container (see the commented volume example in `docker-compose.yml`).
+- **MCP Apps**: Compose also publishes the isolated sandbox origin on
+  `http://localhost:4201`, loopback-only. Keep both `4200` and `4201` mappings
+  when using interactive MCP Apps.
 
 > ⚠️ **Security:** FLUJO has no authentication layer and its git API runs
 > commands on the server, so the port is bound to **localhost only** by default.
@@ -271,8 +286,28 @@ checks:
 > ⚠️ **Security precondition:** only set this when **nothing untrusted can reach
 > FLUJO's port at those names**. The DNS-rebinding protection is still enforced
 > — an attacker page's Origin never matches these entries — but widening the
-> trusted-host set is only safe on a private network fronted by your own
-> authenticating proxy.
+> trusted-host set is only safe on a private network fronted by your own
+> authenticating proxy.
+
+#### MCP Apps behind HTTPS
+
+MCP Apps must run on a different origin from FLUJO. For a hosted HTTPS install,
+give the sandbox its own HTTPS origin (for example
+`https://flujo-apps.example.internal`) and have the trusted proxy TLS-terminate
+that origin to the container's plain HTTP port `4201`. Configure:
+
+```text
+FLUJO_MCP_APP_SANDBOX_PUBLIC_URL=https://flujo-apps.example.internal/sandbox.html
+FLUJO_MCP_APP_HOST_ORIGINS=https://flujo.example.internal
+```
+
+`FLUJO_MCP_APP_HOST_ORIGINS` is a comma-separated allowlist of exact
+`http(s)://host[:port]` origins permitted to embed the sandbox. Preserve the
+browser's `Referer` header through the proxy; the sandbox checks it against this
+allowlist and pins its `frame-ancestors` CSP to that exact origin. Do not serve
+the sandbox beneath FLUJO's own origin, and do not point the browser directly at
+port `4201` from an HTTPS page—the listener expects TLS termination at the
+separate proxy origin.
 
 ### Run via npx (npm package)
 
@@ -306,6 +341,11 @@ $env:FLUJO_DIR = "D:\Apps\FLUJO"; $env:FLUJO_START = "1"; irm https://raw.github
 
 See [`scripts/install.ps1`](scripts/install.ps1) for all options.
 
+Prefer a graphical installer? Download `flujo-setup.exe` from the
+[latest release](https://github.com/mario-andreschak/FLUJO/releases/latest) — it's a
+wizard around the same `install.ps1` script above (see
+[`installer/flujo-setup.iss`](installer/flujo-setup.iss)).
+
 ### One-line install (Linux / macOS)
 
 The same for Linux and macOS — installs the prerequisites (Git, Node.js, Python,

package/next.config.mjs

@@ -7,8 +7,8 @@ import { fileURLToPath } from 'url';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 /** @type {import('next').NextConfig} */
-const nextConfig = {
-  /* config options here */
+const nextConfig = {
+  /* config options here */
   // Pin the workspace root to this project. Without this, a stray
   // package-lock.json in a parent dir (e.g. the user's home folder) makes
   // Next infer the wrong root and install/resolve deps like typescript in the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flujo-ai",
-  "version": "3.31.0",
+  "version": "3.34.0",
   "bin": {
     "flujo": "bin/flujo.mjs"
   },
@@ -17,12 +17,13 @@
     "turbo": "node scripts/launch-next.mjs dev --turbopack -p 4200",
     "build": "next build",
     "start": "node scripts/launch-next.mjs start -p 4200",
+    "check:parallel-mcp:no-oauth": "node scripts/check-parallel-mcp-no-oauth.mjs",
     "lint": "next lint",
     "test": "jest",
     "test:watch": "jest --watch",
     "prepublishOnly": "npm run build",
     "version": "node scripts/sync-version.mjs && git add -A src README.md githubpages/index.html",
-    "release": "npm version minor -m \"Bump version to %s\" && npm publish"
+    "release": "node scripts/release.mjs"
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.186",