V4.14.9

Upgrade Guide

1. Environment Variable Updates

Rename the following FastGPT environment variables — SANDBOX_URL and SANDBOX_TOKEN are now CODE_SANDBOX_URL and CODE_SANDBOX_TOKEN:

# Old
SANDBOX_URL=<code sandbox address>
SANDBOX_TOKEN=<code sandbox credential (can be empty; auth was added in 4.14.8)>
# New
CODE_SANDBOX_URL=<code sandbox address>
CODE_SANDBOX_TOKEN=<code sandbox credential>

Internal-network security checks are now disabled by default. To re-enable them, set the environment variable CHECK_INTERNAL_IP=true (applies to fastgpt, fastgpt-pro, and fastgpt-sandbox).

2. Update Images

FastGPT image tag: v4.14.9.1
FastGPT Commercial Edition image tag: v4.14.9.1
fastgpt-plugin image tag: v0.5.5
mcp_server — no update required
sandbox image tag: v4.14.9.1
AIProxy — no update required

The /api/core/chat/getPaginationRecords endpoint now returns a useAgentSandbox: boolean field indicating whether the AI sandbox tool was used in the current conversation turn. The llmModuleAccount and historyPreviewLength fields will be removed soon — please migrate away from them as soon as possible.

New Features

Added AI Sandbox — attach a sandbox tool to the AI for richer operations. (Currently available on the cloud service only; a lightweight self-hosted deployment will ship in the next release.)
Publish channels now support WeChat personal accounts.
AgentV2 context now adapts to the paused state.
Introduced a logger SDK with Metrics tracking.
Updating a single Knowledge Base entry now also refreshes the collection's update timestamp.
Form file inputs now support opening files for preview.

Improvements

API-based Knowledge Base sync now has additional fallback methods for retrieving file names.
Added SSRF protection to the HTTP tool.
Improved compatibility with more MCP JsonSchema fields — older versions could not handle mixed-type fields.
Optimized parts of the workflow runtime pool logic to reduce computational complexity.
Replaced DFS with Tarjan's SCC algorithm for edge grouping in the workflow runtime, resolving issues where complex cyclic workflows failed to run.
System toolsets no longer display a version number (since they have no selectable versions).

Bug Fixes

When a workflow nested a plugin, plugin execution details were not properly preserved. Also cleaned up all tool-type prefixes.
Updating and saving an MCP toolset could prevent it from being called correctly (due to an incorrect toolId lookup).
The search box was missing from the API Knowledge Base file list.
Workflow variable values containing special characters ($.) caused incorrect value substitution.
Referencing an agent tool in a workflow caused a version retrieval error.
When switching from a model that supports certain parameters to one that does not, the unsupported parameters were not removed, causing model invocation failures.
Closing a shared link's display status caused AI responses in the chat history to render incorrectly.
Re-opening the preview dialog in workflow preview mode lost form input content.
Custom fields in subscription plans were not applied.
The login endpoint had an async session issue that produced error logs.
The condition evaluator was missing selectable conditions for the arrayAny type.
Video/audio custom file type workflows were missing file link variables at the start node.
User input messages were not escaped to Markdown format.
Fixed partial context concatenation errors in AgentV2.

Code Improvements

Fixed a monorepo issue in Commercial Edition development where different React references required a full package reinstall.