Workflow with uninstalled plugin nodes can be published, causing runtime failure

[lyzno1]

Self Checks

• I have read the Contributing Guide and Language Policy.
• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
• Please do not modify this template :) and fill in all the required fields.

Dify version

main branch (latest)

Cloud or Self Hosted

Self Hosted (Source)

Steps to reproduce

1. Create a new workflow
2. Add a Tool node (or DataSource node, or TriggerPlugin node) that uses a plugin
3. Uninstall the plugin from Plugins page (or import a workflow that contains nodes using plugins you don't have installed)
4. Go back to the workflow - the node shows a locked overlay with "Install from Marketplace" button (this is correct)
5. Click "Publish" button
6. The workflow is published successfully (this is the bug)
7. Try to run the published workflow
8. The workflow fails with ToolProviderNotFoundError at runtime

✔️ Expected Behavior

When a workflow contains nodes with uninstalled plugins, the publish operation should be blocked. The checklist panel should display these nodes as having errors (like "Plugin is not installed"), preventing the user from publishing an invalid workflow.

❌ Actual Behavior

The workflow can be published even when it contains nodes with uninstalled plugins. The frontend checkValid function returns no error because the tool schema is empty when the plugin is not installed, causing all validation to be skipped. The checklist panel does not show any warning for these nodes.

The workflow only fails at runtime when trying to execute, which is a poor user experience as the user has already published the workflow.

Root cause analysis:

1. getToolCheckParams in web/app/components/workflow/utils/tool.ts returns empty formSchemas when the plugin is not installed (since currCollection and currTool are both undefined)
2. checkValid in node's default.ts validates required fields against the schema, but since the schema is empty, no validation errors are reported
3. The checklist (useChecklist hook) does not check for _pluginInstallLocked status on plugin-dependent nodes
4. handleCheckBeforePublish also does not check for this status

This issue affects three node types:

• Tool nodes
• DataSource nodes
• TriggerPlugin nodes

[dosubot]

You’ve correctly identified the root cause: the validation logic for Tool, DataSource, and TriggerPlugin nodes is schema-driven, and when a plugin is uninstalled, the schema is empty—so all validation is skipped and publishing is allowed. The relevant functions (getToolCheckParams, checkValid, useChecklist, and handleCheckBeforePublish) do not check for plugin installation status or the _pluginInstallLocked flag, which is why the checklist and pre-publish validation miss these cases and workflows with missing plugins can be published, leading to runtime errors like ToolProviderNotFoundError (source).

To fix this, you’ll want to update the checklist and pre-publish validation logic to explicitly check for plugin installation status (for example, by inspecting _pluginInstallLocked or similar flags on plugin-dependent nodes). If a node is locked due to a missing plugin, the checklist should show an error and publishing should be blocked, even if the schema is empty. This will prevent invalid workflows from being published and improve the user experience.

Let me know if you want a more detailed breakdown of where to add these checks or how to structure the error messages in the UI.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}