- Add extract_to() utility function for auto-detecting archive formats (.zip, .tar.gz, .tar.bz2, .tar.xz, .tgz) and extracting with automatic destination cleanup
- Refactor Dockerfile to use slim debian base with install script, reducing image complexity and improving build reproducibility
- Update Dockerfile.dev to match production environment (Go 1.25 with full toolchain) while adding preset workflow initialization
- Update trivy binary registry metadata from v0.69.0 to v0.69.1 with direct platform-specific download URLs replacing dual curl installation script
- Add sarif_functions.go with SARIF format parsing and vulnerability extraction (parse_sarif, extract_sarif_results, count_sarif_by_level)
- Add comprehensive sarif_functions_test.go with 239 lines of test coverage
- Add SARIF-sourced vulnerabilities to seed database including findings from Semgrep, Trivy, Kingfisher, and Bearer tools
- Add Bearer API key detection SARIF sample for test data
- Support asset_type='repo' for code-level findings from static analysis tools
- Integrate sarif functions into goja_runtime and function constants
- Test data includes real-world SARIF reports demonstrating container, dependency, and secret detection findings
- Implemented detect_language() function that analyzes directory structure to identify dominant programming language
- Detects language by file extension mapping (26+ supported languages: Go, Python, JS, TS, Rust, Java, etc.)
- Falls back to shebang detection for extensionless files (e.g., shell scripts)
- Intelligently skips non-source directories (node_modules, vendor, test, .git, etc.)
- Includes comprehensive test coverage for pure/mixed projects, edge cases, and shebang patterns
- Updated function registry and goja runtime to expose detect_language to workflows
- Add is_file, is_dir, is_git functions for type validation
- Add is_compress function to detect compressed file extensions
- Implement pure Go wget with parallel segmented downloads (>1MB files)
- Add git_clone_subfolder with ZIP fallback for GitHub repos
- Add helper utilities: ZIP extraction, directory/file copying
- Add SkipWorkspace option to skip output dirs in empty-target mode
- Fix workflow preference loading order for --module-url flag
- Add 20+ comprehensive tests for all new functions
- Add lock-free ResultCollector for parallel execution with atomic operations, eliminating mutex contention for pre-allocated slices
- Implement circuit breaker pattern (internal/retry/circuit_breaker) with configurable thresholds and half-open recovery state for fault tolerance
- Introduce json-iterator replacement (internal/json) for 2-6x faster JSON operations while maintaining stdlib compatibility
- Add lazy template rendering (RenderLazy) with variable reference caching for 50-80% faster rendering on large contexts
- Implement memory-efficient buffer pooling (bufpool) with 10MB pre-allocated reusable buffers for reduced GC pressure
- Add LoadFlowWithModules for parallel module pre-loading using errgroup, improving startup time for complex flows
- Add VarRefCache with LRU eviction for variable extraction caching
- Add streaming output support for foreach loops to process large datasets without memory accumulation
- Fix json import compatibility in llm_executor and db_functions
- Update test fixtures with correct YAML field names (call→function, run→command)
- Add empty_target preference to allow running workflows without explicit target
- Implement FlowName template variable for module context awareness
- Optimize cdnDelete, SyncUpload, SyncDownload with worker pool concurrency
- Load workflow preferences early for --empty-target CLI flag support
- Add unit tests for preferences and E2E tests for FlowName functionality
- Update linter to recognize ModuleName and FlowName as built-in variables
- Add RunClient for submitting runs to server with priority support (low, normal, high, critical)
- Implement --run-priority and --server-url CLI flags for server submission mode
- Add RunPriority and RunMode fields to database Run model for persistence
- Update CreateRunRequest with priority and run_mode validation
- Implement runServerSubmission() to submit workflows with priority to server API
- Comprehensive E2E tests for run endpoints with priority validation and multiple targets
- Add foreach-preprocess test workflow with variable_pre_process support
- Enhanced cdnDelete to recursively delete folders with per-file tracking and error counts
- Added optional 'json' mode parameter to cdnSyncUpload/cdnSyncDownload for output format control
- Implemented real-time sync event callbacks for progress visualization with colored terminal output
- Added bash() as primary function with exec_cmd() as alias for backward compatibility
- Introduced SyncEvent type for action tracking (uploading/downloaded/skipped/deleted/error)
- Updated function tests to support new mode parameter
- Convert all CDN function return values to JSON strings for consistent Goja interop (cdnSyncUpload, cdnSyncDownload, cdnList, cdnStat)
- Add glob pattern matching support to cdnList with wildcard character support (*, ?, [])
- Implement new cdnRead function to read file content directly from cloud storage
- Add TelegramChannelMap config field to support channel aliases (#channel_name)
- Implement 4 new notification functions for sending to specific channels:
- notify_telegram_channel(channel, message): send markdown message to channel
- send_telegram_file_channel(channel, path, caption?): send file to channel
- notify_message_as_file_telegram(path): read and send file as message
- notify_message_as_file_telegram_channel(channel, path): read and send file to channel
- Enhance telegram.go with channel resolution logic supporting both named channels and numeric IDs
- Update function registry with documentation and examples for new functions
- Add path expansion support (~, $HOME) to file operations for better usability
- Update example config with telegram_channel_map documentation
- Update Next.js build IDs and chunk hashes in workflow upload static files
- Replace deprecated 'input' field syntax with new exports-style variables in event triggers (e.g., 'Target: event_data.value' instead of type/field/name)
- Simplify parameter override syntax in test workflows (remove nested 'default' structure)
Add new utility function to reset processed event logs back to
unprocessed state, enabling event reprocessing with optional
filtering by workspace and topic pattern (glob syntax).
Major features:
- Add run registry for tracking active runs with PID management
- Add API-based run cancellation with process termination
- Add event trigger input vars syntax for multi-variable extraction
- Add filter_functions with utility function support in triggers
- Add event envelope injection for full event context in workflows
- Add write coordinator for batched database operations
API improvements:
- Add logout endpoint and diffs endpoints for assets/vulnerabilities
- Add step-results listing endpoint
- Update schedule model with target, workspace, params fields
- Change run_id to run_uuid across API responses
Performance:
- Add compiled JS program caching for 60-80% faster loop conditions
- Add parallel shard rendering for 20-40% faster workflow startup
- Add memory-mapped I/O for large file line counting
- Add efficient output buffer combining in runners
- Add mtime-based cache invalidation for workflow loader
Other changes:
- Rename trigger field from trigger to triggers in workflow YAML
- Disable pongo2 HTML autoescape for shell command templates
- Update JWT expiration default to 1440 minutes (1 day)
- Change CORS default to reflect-origin for credentials support
- Add source_type field to events (run, eval, api)
- Skip copying core Unix tools to external-binaries
j3ssie