flowdrop 1.3.0

[1.3.0] - 2026-04-28

Added

• New flowdrop_chat module (lifecycle: experimental): Chat backend for conversational workflow orchestration, supporting two processing modes:
  • Built-in LLM mode with ChatLlmClient (Ollama, Anthropic), ChatService orchestration, and SystemPromptBuilder that injects slim workflow state and node type definitions into system prompts.
  • Workflow-based mode that delegates chat handling to a FlowDrop workflow, with GetNodeTypes and BuildSystemPrompt node processors and default chat processor workflows shipped as recipe content.
  • Chat API controller and routing with configurable endpoint config.
  • Admin settings form for provider and mode configuration.
  • SystemPromptBuilder::nodeTypesJson() API for retrieving slim node type definitions from a node.
  • Unit tests for ChatService and SystemPromptBuilder.
  • Note: flowdrop_chat requires drupal/flowdrop_ai_provider (currently dev-1.0.x), which is not pulled automatically by composer require drupal/flowdrop. Install it separately: composer require drupal/flowdrop_ai_provider:dev-1.0.x@dev before enabling this submodule.
  • hook_uninstall() deletes all chat history memory records when the module is uninstalled.
• FlowDropNodeTypeManagerInterface: New public service interface for the node type manager. FQCN aliases are registered for FlowDropNodeTypeManagerInterface and all three flowdrop_chat services (ChatServiceInterface, SystemPromptBuilderInterface, ChatLlmClientInterface), enabling $container->get(ServiceInterface::class) lookups alongside the existing string-ID approach.
• TextProcessor node: New node type for common text utilities, with documentation in the Text & Output reference.
• HtmlToMarkdown node processor: Converts HTML input to Markdown, with unit test coverage.
• MarkdownExtractor node processor: Extracts structured data from Markdown content.
• MarkdownToHtml node processor: Converts Markdown input to HTML.
• Tolerant parse mode for json_to_data: New mode that recovers from partial or malformed JSON, improving robustness in LLM output pipelines.
• visual_type and supported_visual_types exposed in node type API data, enabling richer frontend rendering hints.
• Dashboard-layout library (#3583166): Replaces fullscreen-layout on admin pages with a dedicated dashboard layout, removing the unintended white background.
• Plugin dependency declarations on flowdrop_node_type config entities (#3583422): Config entities now declare the module dependencies of their executor plugins, so exported configuration installs cleanly on a fresh site.
• Plugin-driven select for memory_backend: Replaces the freeform textfield with a validated select populated from registered memory backends; prompt templates are validated on save.
• Workflow description length limit: Enforces a 1000-character maximum on the workflow description field.

Changed

• Drupal-side JavaScript modernized: Pipeline monitor drops jQuery in favor of core/once, and the remaining Drupal-side JS uses arrow functions and tidied JSDoc.
• Frontend library bumped to @flowdrop/flowdrop 1.8.1.

Fixed

• Fixed ChatService::getHistory() and clearHistory() operating on the wrong memory store in workflow processing mode (they now return early when processing_mode is workflow).
• Fixed memory_backend config defaulting to null instead of 'entity' when unset.
• Fixed flowdrop_ui_components clobbering the persisted theme preference on initialization, which caused light/dark mode to flicker back to default on page load.
• Fixed TranslatableMarkup not cast to string before display in the pipeline form, causing render errors on some labels and descriptions.
• Fixed workflow API controllers swallowing HTTP exceptions instead of re-throwing them, masking 4xx/5xx responses with generic 500s.
• Fixed chat API not returning workflowId as conversationId in the response payload.
• Fixed toolbar icons not rendering under the Drupal Navigation module (#3583239): adds Navigation-module CSS selectors (.toolbar-link--*, .toolbar-button--icon--*) and a hook_page_attachments that attaches the toolbar library on every page (gated on administer flowdrop), since Navigation does not invoke hook_toolbar().
• Removed developer console statements from Drupal-side JS components.

Security

• Workflow API hardening: Added ID conflict check on import, complexity limits on submitted workflows, and random IDs to prevent enumeration.
• Workflow list builder: Sanitize the sort query parameter to prevent injection of unintended sort columns.
• Chat API rate limiting and observability: Flood control on chat endpoints, payload size limit, and audit logging of chat requests.
• Chat prompt-injection hardening:
  • Sanitize non-JSON workflowState payloads before injecting into the system prompt.
  • XML-encode chat history before injection.
  • Remove client-supplied history and enforce a per-message length limit.
• Reduced error-message disclosure: Avoid exposing the configured model ID in chat error responses.
• Chat API workflowState size limit: Array-typed workflowState payloads now enforce the same complexity limits as the workflow API (max 500 nodes, 1000 edges), closing a DoS vector where the string-only size check could be bypassed by sending an array.
• Workflow export documentation: Warn users that exported workflow configuration may contain sensitive values.