v0.5.99: local dev improvements, live workflow logs in terminal

[waleedlatif1]

• fix(security): allow HTTP for localhost and loopback addresses (fix(security): allow HTTP for localhost and loopback addresses #3304)
• fix(parallel): correct active state pulsing and duration display for parallel subflow blocks (fix(parallel): correct active state pulsing and duration display for parallel subflow blocks #3305)
• feat(terminal): expandable child workflow blocks in console (feat(terminal): expandable child workflow blocks in console #3306)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Feb 23, 2026 8:18am

[greptile-apps]

Greptile Summary

This PR implements three significant improvements for local development and workflow execution visualization:

Security Enhancement

• Modified URL validation to allow HTTP protocol for localhost and loopback addresses (localhost, 127.0.0.1, ::1) while maintaining HTTPS requirement for external URLs
• Enables local development workflows without requiring HTTPS setup

Parallel Workflow Fixes

• Implemented reference counting for active blocks to prevent premature state clearing when parallel branches execute the same block
• Fixed duration calculation: parallel branches now show wall-clock time while loop iterations show cumulative time
• Ensures blocks remain visually active until all parallel invocations complete

Child Workflow Visualization

• Added expandable workflow block nodes in terminal console with full nested hierarchy support
• Introduced per-invocation childWorkflowInstanceId to correctly correlate child block events across loop iterations
• Implemented MAX_SSE_CHILD_DEPTH limit (3 levels) to prevent performance issues with deeply nested workflows
• Added block:childWorkflowStarted event for pre-association of running entries before child execution begins

Critical Issues Found

• Loopback detection only checks exact IPs (127.0.0.1, ::1) but misses the full 127.0.0.0/8 range - addresses like 127.0.0.2 or 127.1.2.3 would be incorrectly rejected

Confidence Score: 3/5

• Safe to merge after fixing loopback range detection logic
• The PR contains well-structured features with proper type safety and comprehensive test updates. However, the localhost security logic has a critical bug where only exact loopback IPs are checked instead of the full 127.0.0.0/8 range, which could break legitimate local development scenarios using addresses like 127.0.0.2 or 127.1.1.1
• Security validation files need loopback range fix: apps/sim/lib/core/security/input-validation.ts and apps/sim/lib/core/security/input-validation.server.ts

Important Files Changed

Filename	Overview
apps/sim/lib/core/security/input-validation.ts	Allows HTTP for localhost/loopback addresses while maintaining HTTPS requirement for external URLs
apps/sim/lib/core/security/input-validation.server.ts	DNS validation now permits localhost and loopback IPs with proper detection logic
apps/sim/app/workspace/[workspaceId]/w/[workflowId]/utils/workflow-execution-utils.ts	Added ref counting for active blocks in parallel workflows and child workflow context handling
apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/terminal/terminal.tsx	Added WorkflowNodeRow component for expandable child workflow blocks in terminal console
apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/terminal/utils.ts	Added workflow node tree building logic with proper duration calculation for parallel vs serial execution
apps/sim/executor/handlers/workflow/workflow-handler.ts	Propagates callbacks to child workflows with unique instance IDs for correlation in nested executions

Sequence Diagram

sequenceDiagram
    participant Client as Client/Terminal
    participant API as Workflow API
    participant Executor as Workflow Executor
    participant Handler as WorkflowHandler
    participant ChildExec as Child Workflow
    participant Console as Console Store
    
    Client->>API: Execute workflow (SSE stream)
    API->>Executor: Start execution with callbacks
    Executor->>Handler: Execute workflow block
    
    Note over Handler: Generate unique instanceId
    Handler->>Console: onChildWorkflowInstanceReady(instanceId)
    Console-->>Client: Update entry with instanceId
    
    Handler->>ChildExec: Start child with callbacks & context
    Note over ChildExec: depth <= MAX_SSE_CHILD_DEPTH
    
    loop For each child block
        ChildExec->>Console: onBlockStart(childWorkflowContext)
        Console-->>Client: Add console entry with parentBlockId
        ChildExec->>ChildExec: Execute block
        ChildExec->>Console: onBlockComplete(childWorkflowContext)
        Console-->>Client: Update with childWorkflowInstanceId
    end
    
    ChildExec-->>Handler: Return result with instanceId
    Handler-->>Executor: Return workflow block output
    Executor->>Console: onBlockComplete(instanceId)
    Console-->>Client: Mark workflow block complete
    
    Note over Client: Tree builder groups children<br/>by instanceId for display

Loading

_{Last reviewed commit: 69ec70a}

[greptile-apps]

_{22 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}