mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-24 19:04:04 +08:00
cloud-dev-toggle
17889 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| 71d3438d2a |
fix: frozen vertices crash with TypeError when no cache service available (#12409)
* fix: return CacheMiss() from fallback cache func so frozen vertices rebuild when no cache service Fixes #12408 * fix: address review feedback on frozen vertex fix - Use graph.arun() in test to exercise the process() path - Make set_cache_func in process() return True for consistency with astep() * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 5ea4cfcac2 |
fix: add missing ownership checks in projects API (GHSA-rpf3-3973-4gjr) (#12462)
* fix: enforce ownership check on flow assignment and paginated project read (GHSA-rpf3-3973-4gjr)
Prevent authenticated users from reassigning flows they don't own by adding
`Flow.user_id == current_user.id` to the UPDATE statements in `create_project`.
Also fix the paginated path in `read_project` which was missing the same filter,
allowing cross-user flow exfiltration via the `?page=&size=` query parameters.
* test: add security regression tests for GHSA-rpf3-3973-4gjr
- test_create_project_cannot_steal_other_users_flow: asserts that
flows_list in create_project does not move flows owned by another user
- test_read_project_paginated_does_not_leak_other_users_flows: asserts
that paginated GET /projects/{id} only returns flows owned by the
requesting user
* test: improve security test naming and style for project ownership checks
Remove advisory IDs from test names and docstrings, rename helper and
test functions to match the existing codebase conventions.
* [autofix.ci] apply automated fixes
* fix: address ruff linting errors in ownership security tests
* test: add coverage for legitimate flows_list and paginated read assignments
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Carlos Coelho <80289056+carlosrcoelho@users.noreply.github.com>
|
|||
| cde9f23001 |
feat: deployment page and stepper UI with watsonx Orchestrate integration (#12303)
* feat: deployment page list
* feat: add deployment stepper modal with context-based state management
Implement a multi-step deployment creation flow with 4 steps (Provider,
Type, Attach Flows, Review). State is centralized in a scoped
DeploymentStepperContext to avoid prop-drilling across step components.
Includes bug fixes for version re-selection and connection pre-selection.
* feat: replace mock flows and versions with real API data in deployment stepper
Fetch real flows from the API (scoped to current folder) and versions
per-flow lazily when selected. Enrich selectedVersionByFlow context to
store versionTag alongside versionId so the review step can display it
without re-fetching. Remove MOCK_FLOWS_WITH_VERSIONS from mock-data.
* refactor: improve deployment stepper code quality and conventions
Rename all new deployment files to kebab-case per project conventions,
fix context re-render issues with useMemo/useCallback, replace raw
Tailwind colors with design tokens, add missing data-testid and ARIA
attributes, fix Deploy button disabled on review step, and move shared
FlowTabType to a dedicated types file.
* refactor: align deployment provider types and UI to backend contracts
- Rename ProviderInstance -> ProviderAccount to match backend naming
- Update ProviderAccount fields to match DeploymentProviderAccountGetResponse (provider_key, provider_url, provider_tenant_id, created_at, updated_at)
- Update ProviderCredentials fields to match DeploymentProviderAccountCreateRequest (provider_key, provider_url, api_key)
- Rename all "instance" UI terminology to "environment" (tabs, labels, components)
- Auto-select watsonx Orchestrate on mount as the only supported provider
- Remove Kubernetes from mock providers; update mock data to use watsonx_orchestrate only
* feat: add react-query hooks for deployments and provider accounts with mock data
- Add useGetProviderAccounts hook (GET /deployments/providers) replacing direct MOCK_PROVIDER_INSTANCES import in step-provider.tsx
- Add useGetDeployments hook (GET /deployments) replacing direct MOCK_DEPLOYMENTS import in deployments-page.tsx
- Replace fake setTimeout loading state with hook isLoading state
- Register DEPLOYMENTS and DEPLOYMENT_PROVIDER_ACCOUNTS URL constants
- Real API calls are commented out with TODO markers for easy swap when backend is ready
* chore: remove stale biome-ignore suppression in step-attach-flows
* fix: replace button role=radio with semantic input type=radio in ProviderCard
* fix: replace button role=radio with semantic radio inputs across deployment stepper
- Extract RadioSelectItem component (label + sr-only input + checkbox indicator)
used by version, connection, and environment selectors
- Fix step-type.tsx type cards with label/input pattern (matching ProviderCard)
- Add role="radiogroup" wrapper to EnvironmentList
- Fix envVars key: use stable crypto.randomUUID() id instead of array index
* feat: add name field to provider accounts, multi-select connections, and real API call
- Add `name` field to ProviderAccount, ProviderCredentials, and mock data
- Switch connection selection from single to multi-select (CheckboxSelectItem)
- Allow creating new connections inline from the attach flows step
- Lift connections state up to DeploymentStepperContext
- Move ConnectionItem type from step-attach-flows to shared types.ts
- Wire up real API call in useGetProviderAccounts (remove mock)
* feat: wire deploy button and populate deployments page with real API data
- Add usePostDeployment and usePostProviderAccount mutation hooks
- Wire Deploy button in stepper modal: creates provider account if needed,
then POSTs to /api/v1/deployments with WXO provider_data shape
- Fix environment_variables payload: wrap values as { value, source: "raw" }
to satisfy EnvVarValueSpec schema
- Fix connection app_id: prefix with conn_ so WXO name validation passes
(names must start with a letter)
- Multi-select connections with checkbox UI; persist connections in context
so they survive back/forward navigation
- Update Deployment type to match API response shape; remove mock fields
(url, status, health, lastModifiedBy)
- Wire useGetDeployments to real API; load provider ID from useGetProviderAccounts
- Update deployments table to display real fields: name, type, attached_count,
provider name, updated_at
* refactor: extract DeploymentsContent component to eliminate nested ternary
* feat: add Test Deployment chat modal for deployed agents
Implements a chat interface to test deployments directly from the UI.
Wires up two entry points: the stepper modal "Test" button (inline
transition) and the deployments table play button (standalone dialog).
- Add usePostDeploymentExecution and useGetDeploymentExecution hooks
hitting POST/GET /api/v1/deployments/executions
- Build test-deployment-modal: ChatHeader, ChatMessages, ChatInput,
ChatMessageBubble with user/bot avatars, loading dots, tool traces
- useDeploymentChat hook: recursive setTimeout polling (max 30 × 1.5s),
thread_id persistence for multi-turn, watsonx response parsing
(response_type/type text, wxo_thread_id extraction)
- Stepper modal transitions inline to TestDeploymentContent on Test click
- Deployments table play button opens standalone TestDeploymentModal
* feat: add syntax highlighting to chat code blocks using SimplifiedCodeTabComponent
* feat: add action menu and icon-based type badge to deployments table
- Add dropdown action menu (Duplicate, Update, Delete) to each row
- Replace left-border type badge with icon-based badge (Bot for Agent, Plug for MCP)
* refactor: remove connected status from provider card in stepper
* feat: auto-detect flow env vars in deployment connection form
- Add POST /deployments/variables/detections backend endpoint that scans
flow version data for credential fields (load_from_db=True globals and
password=True fallbacks) and returns detected variable names
- Derive meaningful env var names from the model field's category when no
global variable is linked (e.g. OPENAI_API_KEY from category "OpenAI")
- Add DetectEnvVarsRequest/DetectedEnvVar/DetectEnvVarsResponse schemas
- Add usePostDetectDeploymentEnvVars frontend mutation hook
- Pre-populate Create Connection env var rows with detected keys/values
when attaching a flow version; global variable selections render as tags
via InputComponent with global variable picker support
* feat: add empty state and smart default tab for available connections
- Default to "Create Connection" tab when no connections exist
- Show empty state with icon, description, and shortcut link when
the Available Connections tab has no items
* feat: redesign review step with two-column layout and env vars section
Match new design reference with Deployment/Attached Flows columns
and a masked Configuration section showing env variable keys.
* feat: integrate delete deployment with loading state and fix test modal flow
- Add useDeleteDeployment hook (DELETE /deployments/{id}, refetches list)
- Show spinner + faded row while deletion is in progress; fix race where
deleteTarget was cleared before isPending resolved by using separate deletingId state
- Redesign StepDeployStatus with animated spinner, ping ring, and success checkmark
- After deploy, "Test" closes the stepper and opens the standalone TestDeploymentModal
(consistent UI, correct providerId, chat reset on close)
- Prevent closing the stepper modal while deployment is in progress
* refactor: address PR review concerns for deployment UI
- Split step-attach-flows.tsx (656→274 lines) into FlowListPanel,
VersionPanel, and ConnectionPanel sub-components
- Extract Watsonx parser utilities into watsonx-result-parsers.ts,
reducing use-deployment-chat.ts from 384 to 277 lines
- Surface detectEnvVars errors via setErrorData instead of silently
resetting state
- Add EnvVarEntry named type to types.ts, replacing inline shape
repeated across two files
- Move import json to module level in deployments.py (PEP 8)
- Fix URL construction in useGetDeploymentExecution to use axios
params option, consistent with other hooks
- Remove commented-out MOCK_CONNECTIONS dead code
- Add TODO comment to hardcoded "watsonx-orchestrate" provider key
* refactor: apply React best practices and remove mock data from deployment UI
- Fix barrel imports: import directly from source files in deployments-page,
step-provider, and step-attach-flows
- Replace useEffect auto-select with derived effectiveFlowId in step-attach-flows
- Fix async state init bug for environmentTab using useRef guard pattern
- Fix stale closure in handleAddEnvVar with functional setState
- Wrap useState initial value in lazy initializer for envVars
- Wrap all 8 handlers in useCallback; wrap panel components in memo()
- Remove mock-data.ts; move PROVIDERS constant inline to step-provider
- Drop MOCK_CONNECTIONS (was empty array) from context
- Simplify step-provider UI: remove provider selection radio group since
only one provider exists; show watsonx Orchestrate as a static display
* feat: add Deploy button to canvas toolbar
Adds a primary-colored Deploy button at the far right of the canvas toolbar.
Clicking it saves the flow, creates a version snapshot, and opens the
deployment stepper modal with the current flow and version pre-selected in
the Attach Flows step, including auto-detection of environment variable keys.
* chore: disable ENABLE_DEPLOYMENTS feature flag
* fix: forward LANGFLOW_FEATURE_WXO_DEPLOYMENTS env var to frontend
The feature flag was reading from import.meta.env but the variable
was never injected by Vite's define config, so the deployments
feature was always disabled regardless of the .env value.
* feat: implement providers tab with environment list
Replace the "coming soon" placeholder in the Providers sub-tab with a
real table showing existing provider accounts (name, URL, provider key,
created date) fetched from the API, including loading skeleton and
empty state.
* feat: add provider creation modal with tab-aware action button
Create AddProviderModal with name, API key, and URL fields matching
the deploy modal. The top-right button now switches between
"New Deployment" and "New Environment" based on the active sub-tab.
* feat: implement provider account deletion with confirmation modal
Add useDeleteProviderAccount hook, wire it through ProvidersContent
and ProvidersTable with loading/disabled row state on delete, and
reuse DeleteConfirmationModal for the confirmation flow.
* fix: correct provider_key to watsonx-orchestrate and add API key visibility toggle
Fix the provider_key value sent to the API. Add eye/eye-off toggle
to the API Key input in both the add provider modal and the deploy
stepper's provider step.
* feat: navigate to deployments tab and open test modal after canvas deploy
After a successful deployment from the canvas deploy button, clicking
"Test" navigates to the deployments tab and auto-opens the test modal.
Also adds eye toggle to the deploy stepper's API Key field.
* Add llm config to deployment creation workflow
* [autofix.ci] apply automated fixes
* feat: add useGetDeploymentLlms query hook
Add missing query hook for the GET /deployments/llms endpoint,
resolving the broken import in step-type.tsx.
* Create provider env inline of step
Ensures the list llm call has an authed provider account to use
* feat: add extensibility for wxo tools in deployments api (#12425)
* feat(deployments): surface tool_ids in WXO API for explicit tool control
- Fix bind to reuse existing WXO tools via attachment lookup instead of
always creating new ones
- Add tool_id-based operations (bind_tool, unbind_tool, remove_tool_by_id)
alongside existing flow_version_id operations
- Add PATCH /deployments/snapshots/{provider_snapshot_id} endpoint to
update snapshot content with a new flow version (blast-radius bounded
to Langflow-tracked tools only)
- Add update_snapshot method to WXO adapter
- Enrich flow version list with deployment info (tool_id, tool_name,
app_ids) via FlowVersionReadWithDeployments API schema
- Surface tool_id in WatsonxApiToolAppBinding responses; flow_version_id
becomes optional for tool-id-based operations
* Revert "feat: Add Langflow Assistant chat panel for component generation (#11636)"
This reverts commit
|
|||
| 094b4c3882 |
fix: Accept appropriate types in OpenSearch mm (#12547)
* fix: Accept appropriate types in OpenSearch mm * [autofix.ci] apply automated fixes * Update opensearch_multimodal.py * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes (attempt 3/3) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 6ac84d4745 |
fix: Indefinitely loading KB page for errors (#12295)
* fix indefinitely loading KB page * [autofix.ci] apply automated fixes * retry for 5XX error * [autofix.ci] apply automated fixes * improved testcase name --------- Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Carlos Coelho <80289056+carlosrcoelho@users.noreply.github.com> Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> |
|||
| f30b291f80 |
fix: Replace aiofile with aiofiles to prevent caio context leak under concurrent execution (#12525)
* fix: replace aiofile with aiofiles to prevent caio context leak under concurrent execution aiofile uses caio (kernel AIO) which creates contexts in a global dict that are never cleaned up. Under concurrent execution these accumulate until the OS aio-max-nr limit is exhausted, causing SystemError(11, 'Resource temporarily unavailable'). aiofiles uses thread pools instead and does not have this issue. Migrates all aiofile.async_open usages across both backend and lfx packages to aiofiles.open. Based on #12433 by @manav2000, extended to cover all remaining usages. Co-Authored-By: manav2000 <manav2000@users.noreply.github.com> * test: add concurrent write-then-read regression test for caio EAGAIN fix Exercises the exact failure pattern from #12414: multiple concurrent save-then-immediately-read operations on the storage service. This would previously trigger SystemError(11, EAGAIN) after ~150-200 runs with the aiofile/caio backend. Co-Authored-By: manav2000 <manav2000@users.noreply.github.com> * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) --------- Co-authored-by: manav2000 <manav2000@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 23eebd037d |
fix: Restore MCP tool dropdown visibility when adding component from sidebar (#12550)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| ca5fe56e1b |
feat(agentics): Refactor bundle components to agenerate/amap/areduce pattern for Langflow 1.9 (#12518)
Co-authored-by: Alfio Gliozzo <gliozzo@us.ibm.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 8c50fca825 |
feat(playground): Add auth gate, session persistence and token display to shareable playground (#12519)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 4f9beebc00 |
fix: add trailing newline to component_index.json (#12545)
The build_component_index.py script was generating component_index.json without a trailing newline, causing CI failures when autofix.ci tried to add the missing newline. This fix ensures the generated JSON file always ends with a newline character, following POSIX text file standards. Fixes the 'No newline at end of file' error in the update-component-index workflow job. |
|||
| dbd31e0472 |
fix: Preserve MCP tool selection on flow reload (#12363)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 74f17b40e0 | fix(ui): Fix update banner hidden behind canvas controls (#12527) | |||
| 6938fd1d17 | fix: Display proper error messages and strip null params from tool calls (#12437) | |||
| a2e2b44087 |
feat: add telemetry service to lfx MCP server (#12422)
* feat: add telemetry service to lfx MCP server Replace the no-op telemetry stub with a real async implementation that sends lightweight analytics to Scarf via GET query params. - New schema.py with MCPToolPayload and standard payload types - TelemetryService with async queue, httpx client, DO_NOT_TRACK support - @_tracked decorator on all 31 MCP tools for automatic tracking - Failure-safe: suppress(BaseException) ensures telemetry never breaks tools - Worker guards against task_done without get, flush has 5s timeout * fix: address telemetry review feedback - Replace str(exc)[:200] with type(exc).__name__ to avoid leaking sensitive user data in GET query params sent to Scarf - Manage telemetry lifecycle via FastMCP lifespan hook instead of lazy module-level singleton that never called stop() - Change duration tracking from int(seconds) to milliseconds to preserve sub-second granularity - Update tests to exercise start/stop lifecycle, DO_NOT_TRACK gating, enqueue behavior, and teardown after start --------- Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| 4b64f20b3a |
docs: investigate deprecated macOS support and impact on Langflow (LE-265) (#12477)
docs: add deprecated macOS support investigation (LE-265) |
|||
| f4a3e5fd08 |
fix: Search beyond the first page of users (#12203)
* fix: Search beyond the first page of users * Add a test for search functionality * Update users.py * Update index.tsx * Update index.tsx * Update auto-login-off.spec.ts * Update auto-login-off.spec.ts * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 13bfd4f8bc |
docs: investigate PyTorch macOS AMD64 + Python 3.13 CI failure (LE-172) (#12469)
* docs: add PyTorch macOS AMD64 + Python 3.13 investigation (LE-172) Investigate why the experimental CI job fails on macOS x86_64 + Python 3.13. Root cause: PyTorch dropped macOS Intel wheel builds after v2.2.2 (before Python 3.13 existed). The altk and langchain-huggingface extras pull in torch without platform guards, causing installation failures. Includes analysis of dependency chains, lockfile resolution behavior, and 4 actionable options (A-D) with tradeoffs for the team to decide on. * fix: exclude torch-dependent extras on macOS x86_64 (LE-172) Add platform exclusion markers to altk and langchain-huggingface extras to prevent torch from being pulled in on macOS Intel where no wheel exists. This matches the existing pattern used for easyocr and docling extras. PyTorch dropped macOS x86_64 binary support after v2.2.2, so these features cannot work on Intel Macs regardless. |
|||
| c6b87e7595 |
fix: preserve nested dictionaries in MCP tool parameters (#11970)
* fix: preserve nested dictionaries in MCP tool parameters (#9881) When MCP tool schemas define object-type fields without explicit properties, the system now treats them as free-form dictionaries (dict[str, Any]) instead of creating empty Pydantic models. This preserves nested data structures that were previously being lost during validation. Before this fix: Input: {'msg': {'linear': {'x': 1}}} Output: {'msg': {}} # nested data lost! After this fix: Input: {'msg': {'linear': {'x': 1}}} Output: {'msg': {'linear': {'x': 1}}} # preserved! Changes: - Modified parse_type() in json_schema.py to detect objects without properties and use dict[str, Any] instead of creating empty BaseModel subclasses - Added regression test test_nested_dict_preservation_issue_9881() - All existing tests pass (94 passed, 7 skipped) Fixes #9881 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) --------- Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| f8aa12d404 |
fix(ci): add missing SDK build step to cross-platform workflow_dispatch (#12536)
The build-if-needed job (used for workflow_dispatch) was not building the langflow-sdk package. Since lfx depends on langflow-sdk>=0.1.0 and langflow-sdk is not yet published to PyPI, all test jobs failed during lfx installation with 'No solution found'. Changes: - Build langflow-sdk wheel in build-if-needed job - Upload SDK artifact and output sdk-artifact-name - Update SDK download conditions with build-if-needed fallback - Update SDK+LFX combined/individual install conditions to properly route through the combined installer when both are available |
|||
| f557b06c3b |
fix: upgrade vulnerable dependencies with override enforcement (#12526)
security: upgrade vulnerable dependencies with override enforcement - Add security overrides for orjson, gunicorn, pypdf, nltk, markdown, dynaconf, pillow - Update base pyproject.toml: pillow>=12.0.0, pypdf>=6.9.0 - Selective upgrade: only orjson (3.11.7->3.11.8) and pillow (11.3.0->12.2.0) - Resolves 7/8 flagged CVEs (diskcache awaiting upstream fix) - Defense-in-depth: TOML minimums + override enforcement Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> |
|||
| 4ee94e6ce6 |
fix(ci): add missing lfx build step to cross-platform workflow_dispatch (#12524)
The build-if-needed job (used by workflow_dispatch) was missing the lfx package build, causing all cross-platform tests to fail with: 'No solution found: lfx>=0.4.0 required but only <=0.3.4 available' Changes: - Build lfx wheel in build-if-needed job - Upload lfx artifact (adhoc-dist-lfx) - Add lfx-artifact-name to job outputs - Update all test jobs to fallback to build-if-needed outputs for lfx artifact (matching existing base/main pattern) |
|||
| 1e61ac4ebe |
Merge remote-tracking branch 'origin/release-1.8.4'
# Conflicts: # src/backend/base/langflow/api/v1/chat.py # src/backend/tests/unit/test_chat_endpoint.py1.9.0 |
|||
| 7f44894b77 |
Merge remote-tracking branch 'origin/release-1.8.3'
# Conflicts: # src/backend/tests/unit/test_unified_models.py |
|||
| 2fa3b360d0 |
Merge remote-tracking branch 'origin/release-1.8.2'
# Conflicts: # .secrets.baseline # pyproject.toml # src/backend/base/langflow/initial_setup/starter_projects/Hybrid Search RAG.json # src/backend/base/langflow/initial_setup/starter_projects/Knowledge Retrieval.json # src/backend/base/langflow/initial_setup/starter_projects/Research Translation Loop.json # src/backend/base/langflow/initial_setup/starter_projects/Vector Store RAG.json # src/backend/base/langflow/services/database/models/traces/model.py # src/backend/base/langflow/services/tracing/native.py # src/backend/base/pyproject.toml # src/backend/tests/unit/services/tracing/test_native_tracer.py # src/frontend/package-lock.json # src/frontend/package.json # src/frontend/src/components/core/playgroundComponent/chat-view/chat-header/components/chat-sidebar.tsx # src/frontend/src/components/core/playgroundComponent/chat-view/chat-header/components/session-selector.tsx # src/frontend/src/components/core/playgroundComponent/chat-view/chat-header/hooks/use-edit-session-info.ts # src/frontend/src/components/core/playgroundComponent/chat-view/chat-header/hooks/use-get-add-sessions.ts # src/frontend/src/components/core/playgroundComponent/sliding-container/components/flow-page-sliding-container.tsx # src/frontend/src/components/ui/__tests__/dialog.test.tsx # src/frontend/src/components/ui/sidebar.tsx # src/frontend/src/modals/addMcpServerModal/index.tsx # src/frontend/src/pages/FlowPage/components/flowSidebarComponent/components/__tests__/sidebarSegmentedNav.test.tsx # src/frontend/src/pages/FlowPage/components/flowSidebarComponent/components/sidebarSegmentedNav.tsx # src/frontend/src/pages/FlowPage/components/flowSidebarComponent/helpers/__tests__/disable-item.test.ts # src/frontend/src/pages/FlowPage/components/flowSidebarComponent/helpers/__tests__/get-disabled-tooltip.test.ts # src/frontend/src/pages/FlowPage/components/flowSidebarComponent/index.tsx # src/frontend/tests/core/integrations/Market Research.spec.ts # src/frontend/tests/core/regression/general-bugs-invalid-json-upload.spec.ts # src/frontend/tests/core/regression/session-deletion-data-leakage.spec.ts # src/lfx/pyproject.toml # src/lfx/src/lfx/_assets/component_index.json # src/lfx/src/lfx/_assets/stable_hash_history.json # src/lfx/src/lfx/base/models/unified_models.py # src/lfx/src/lfx/components/deactivated/ingestion.py # uv.lock |
|||
| cabaa2ef19 |
feat: add LANGFLOW_MCP_BASE_URL config for MCP server URL override (#12523)
* feat: add mcp_base_url to config endpoint for MCP server URL override Add LANGFLOW_MCP_BASE_URL setting that the frontend uses as a fallback when building MCP server URLs in the UI configuration JSON. This allows deployments behind reverse proxies to specify the correct external URL. Priority chain: mcp_base_url > api.defaults.baseURL > window.location.origin * test: add tests for mcp_base_url config and URL fallback priority |
|||
| 2f6400db89 |
fix: enforce IDOR protection on v2 workflow job endpoints (#12398)
* fix: enforce ownership check and pass user_id in workflow job creation - Add _assert_job_owner helper that raises 403 for non-owners (legacy jobs with user_id=None are allowed through) - Move ownership check before job type check in stop_workflow to avoid leaking job.type to non-owners - Pass user_id to create_job in both sync and background execution paths - Add user_id parameter to JobService.create_job signature * test: add ownership and legacy job coverage for workflow endpoints - Add TestWorkflowIDORProtection class with tests for 403 on cross-user access - Add test for stop_workflow with legacy user_id=None job (should not return 403) * fix: pass user_id to create_job in knowledge_bases ingestion endpoint Prevents IDOR vulnerability where ingestion jobs created without user_id would bypass ownership checks, matching the fix applied to workflow jobs. * refactor: move job ownership check to JobService layer Moves _assert_job_owner from workflow.py into JobService.assert_job_owner so any future job-consuming endpoint can reuse the check without duplicating logic. Both get_workflow_status and stop_workflow now delegate to the service. * test: fix mocks for assert_job_owner after service layer refactor MagicMock blocks attributes starting with 'assert' by default. Added explicit mock_service.assert_job_owner = MagicMock() to each test that mocks get_job_service so the ownership check is a no-op for tests not focused on IDOR behavior. * refactor: enforce job ownership at SQL level, remove assert_job_owner Move IDOR ownership check from application layer into the DB query. `get_job_by_job_id` now accepts an optional `user_id` and filters by `job_id AND (user_id = ? OR user_id IS NULL)`, so unauthorized access returns 404 instead of 403. Removes `JobService.assert_job_owner`. - Strengthen legacy-job test assertions (!=403 → ==200) - Add missing GET test for non-WORKFLOW job type → 404 |
|||
| acf2ae0605 |
fix: Accept inputs for the URL component (#12474)
* fix: Accept inputs for the URL component * [autofix.ci] apply automated fixes * Update src/lfx/tests/unit/components/data_source/test_url_component.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * rebuild comp index * Update component_index.json * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> |
|||
| 66c206740e |
fix: upgrade fastmcp to 3.2.0 to fix SSRF vulnerability (CVE) (#12516)
security: upgrade fastmcp to 3.2.0 to fix SSRF vulnerability (CVE) Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> |
|||
| 8d01ba4240 |
feat: add var to block custom component execution (#11893)
* add var to block custom component execution
* [autofix.ci] apply automated fixes
* swaps generic check for a specific legacy name check for prompt
* [autofix.ci] apply automated fixes
* Add missing endpoint checks
* fix language
* Add flow validation and tests
* [autofix.ci] apply automated fixes
* Add a few more tests and validation to other endpoints
* clean up test and import logic
* [autofix.ci] apply automated fixes
* ensure flow is saved after upgrade
* Use hash instead of code
* Fix review issues: type safety, error handling, and test coverage
- Change ComponentCache hash fields to None default (was {}) to make
"not yet loaded" explicit in the type system and eliminate the error-prone
`or None` pattern at 8+ callsites
- Narrow frontend 403 suppression to only match custom component errors,
preventing unrelated auth/permission 403s from being swallowed
- Add console.warn logging to waitForNodeUpdates timeout, saveFlow catch,
and 403 suppression paths for debuggability
- Document security invariants (build_vertex cache-hit, nodes-without-code)
- Add server-side logging to MCP validation failures
- Add TestBuildCodeHashLookups test class (9 tests) for _build_code_hash_lookups
* remove divider when new cust comp button is removed
* syntax fix in ui
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* DRY
* [autofix.ci] apply automated fixes
* fix imports
* add field order to script updates
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix: harden custom component lockdown across api, lfx, and editor
- enforce custom-component validation before lfx and backend flow execution
- normalize legacy built-in aliases like Prompt and URL during validation and refresh
- surface blocked custom nodes in the editor without mutating persisted edited state
- prevent empty-flow save/build hangs when custom components are disabled
- add regression coverage for api, lfx, starter project refresh, and frontend guards
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* Add legacy type mapping back for prompt component
* Fix missing import and add real run tests
* fix(flow): Centralize custom component validation
Route payload and prebuilt graph checks through one shared validator so
backend and lfx execution surfaces enforce the same custom-component
policy.
Keep Graph.from_payload as the fresh-build guard, revalidate cached and
script-loaded graphs before execution, and extend coverage for MCP,
workflow reconstruction, agentic flows, and real lfx runs.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
* remove useless function
* remove double validation cases
* remove outdated hash history refs
* fix(frontend): preserve custom component recovery paths
Clear dismissed state after successful bulk restores and make the toolbar Code entrypoint follow config transitions.
Add regressions for bulk restore cleanup, toolbar config changes, and single-node restore of dismissed outdated components.
* fix(frontend): Block uploaded custom components in editor
Surface uploaded CustomComponent nodes as blocked when custom
components are disabled so the editor warns before build
and refresh paths hit backend rejections.
Recompute component warnings when config loads and tighten
the disabled-mode guard so allowed custom components are
not treated as blocked.
* Add parser to legacy type analysis
* fix: update components on render consolidate config reads
Replace scattered useGetConfig reads with useUtilityStore
for a single source of truth.
- chat.py: use elif so request data validation skips stale DB flow;
reorder build_public_tmp to check public access before validation
- flow_validation.py: surface loader failures instead of swallowing them
- use-get-types.ts: recompute componentsToUpdate after templates load
- Frontend: read allowCustomComponents from utilityStore in code area,
sidebar, and node toolbar components
* Add tiny guard to not update on zero length nodes
* DRY ref for compute update function
* Remove redundant validations (for now)
* refactor: replace string-matching error classification with CustomComponentValidationError
Introduce CustomComponentValidationError(ValueError) so API handlers can
catch validation errors by type instead of matching error message strings.
This eliminates the fragile is_custom_component_validation_error_message
function and makes error routing explicit across all endpoints.
- Add CustomComponentValidationError in flow_validation.py
- check_flow_and_raise now raises CustomComponentValidationError
- Replace all is_custom_component_validation_error_message call sites
with except CustomComponentValidationError in chat.py, endpoints.py,
openai_responses.py, mcp_utils.py, and flow_executor.py
- Add except RuntimeError -> 503 in build_flow for startup race
- Remove redundant validation in session/service.py load_session
- Update all test assertions to use the new exception type
* Add beta flag to env var
* Use raw graph data to extract and better exc handling
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* obfuscate exceptoin details
* log error message
* ruff
* fix be test
* [autofix.ci] apply automated fixes
* fix tests
* [autofix.ci] apply automated fixes
* tests
* [autofix.ci] apply automated fixes
* enhance hash checks to allow cust components to run
* Add comment
* Add comment
* [autofix.ci] apply automated fixes
* ruff
* Update more tests
* [autofix.ci] apply automated fixes
* be tests
* be tests
* [autofix.ci] apply automated fixes
* revert changes to fe tests that were causing failures'
* comp index?
* comp index?
* comp index?
* changes FE tests to expect 5 necessary updates after prompt comp was added to checks
* update one more fe test with new error message
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: OpenAI Codex <noreply@openai.com>
|
|||
| d6c2ec3ab7 |
feat: Remove deprecated Astra Assistants to support latest docling package versions (#12442)
* feat: Latest docling package versions * [autofix.ci] apply automated fixes * Template updates * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Update uv.lock * Update uv.lock * Template update * Revert the changes to starter projects * Revert the changes to starter projects * Update component_index.json * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Update test_dynamic_import_integration.py * Update component_index.json * Restore versioned docs * Lessen the scope of the version updates * Update component_index.json * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 7e74d33ae7 |
docs: enhance Agentics documentation with embedded video (#12272)
docs: enhance Agentics documentation with embedded video and full paper citations - Add embedded YouTube tutorial video at the top of the page - Add introductory text for the video - Group research papers under Publications section - Add full academic citations for both Agentics papers - Remove redundant schema table from introduction - Improve overall readability and structure Co-authored-by: Alfio Gliozzo <gliozzo@us.ibm.com> Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com> |
|||
| c1bffa8f4f |
docs: Flow DevOps Toolkit SDK (#12472)
* flow-devops-sdk-basic-usage * peer-review * shorthand-for-sidebars |
|||
| e555e470d9 |
fix: Cherry-pick nightly SDK build fixes to main (#12491)
* fix: Build and install the langflow-sdk for lfx (fixes nightly) (#12481) * fix: Build and install the langflow-sdk for lfx * Publish sdk as a nightly * Update ci.yml * Update python_test.yml * Update ci.yml * fix: Properly grep for the langflow version (#12486) * fix: Properly grep for the langflow version * Mount the sdk where needed * Skip the sdk * [autofix.ci] apply automated fixes * Update setup.py * fix(docker): Remove broken npm self-upgrade from Docker images (#12309) * fix: replace grep -oP with sed for Node.js version extraction in Docker builds (#12331) The grep -oP (PCRE regex) command fails in the python:3.12.12-slim-trixie Docker base image because PCRE support is not available in the slim variant. This replaces grep -oP with portable sed -nE in all 5 Dockerfiles and adds an empty version guard to fail fast with a clear error message instead of producing a broken download URL. --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com> Co-authored-by: vjgit96 <vijay.katuri@ibm.com> |
|||
| ed3820bced |
docs: increase padding for sidebars icons (#12480)
increase-padding-for-sidebar-icons |
|||
| 3ee4bd57eb |
docs: test harness for api reference code samples (#12338)
* curl-examples-and-tests * move-curl-examples * docs-add-existing-js-and-python-examples * add-python-and-js-examples * use-code-snippet-not-code-block * remove-unused-ts-files * add-gitignore-for-docs-pycache * test-api-commands-with-langflow-env-var * add-fixtures-and-makefile-tests-pass * no-action * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * block-ruff-check-for-docs-examples * add-horizontal-scrolling-and-pin-copy-button --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 32c72b02e4 |
fix(mcp): stop sending API key as Bearer token in MCP client (#12441)
* fix(mcp): Stop sending API key as Bearer token in MCP client (#12349) * fix: replace unnecessary dict comprehension with dict() call * Update test_mcp_client.py --------- Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| 6eaa938535 |
fix: add SSRF protection to URL component (PVR0699081) (#11996)
* fix: add SSRF protection to URL component (PVR0699081) Add Server-Side Request Forgery (SSRF) protection to the URL component by integrating the existing validate_url_for_ssrf function. This prevents the component from being used to access internal resources like localhost, private IP ranges, and cloud metadata endpoints. The fix uses warn_only=True for backwards compatibility, matching the behavior of the API Request component. Full blocking will be enabled in the next major version (2.0). * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix: enforce SSRF blocking and add env variables to .env.example - Change warn_only=False to actually block internal URLs when SSRF protection is enabled - Add LANGFLOW_SSRF_PROTECTION_ENABLED and LANGFLOW_SSRF_ALLOWED_HOSTS to .env.example - Update tests to reflect blocking mode When LANGFLOW_SSRF_PROTECTION_ENABLED=true, requests to private IPs, localhost, and cloud metadata endpoints will be blocked. * fix: correct .env.example to show empty default for SSRF protection The default is false, so .env.example should be empty (not true). * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix: add SSRF protection to URL component (PVR0699081) Add Server-Side Request Forgery (SSRF) protection to the URL component by integrating the existing validate_url_for_ssrf function. This prevents the component from being used to access internal resources like localhost, private IP ranges, and cloud metadata endpoints. The fix uses warn_only=True for backwards compatibility, matching the behavior of the API Request component. Full blocking will be enabled in the next major version (2.0). * fix: enforce SSRF blocking and add env variables to .env.example - Change warn_only=False to actually block internal URLs when SSRF protection is enabled - Add LANGFLOW_SSRF_PROTECTION_ENABLED and LANGFLOW_SSRF_ALLOWED_HOSTS to .env.example - Update tests to reflect blocking mode When LANGFLOW_SSRF_PROTECTION_ENABLED=true, requests to private IPs, localhost, and cloud metadata endpoints will be blocked. * fix: correct .env.example to show empty default for SSRF protection The default is false, so .env.example should be empty (not true). * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 68642a8a86 |
fix: Properly grep for the langflow version (#12486)
* fix: Properly grep for the langflow version * Mount the sdk where needed * Skip the sdk |
|||
| 63e6a1d269 |
fix: upgrade dependencies to address CVE vulnerabilities (#12470)
security: upgrade dependencies to address CVE vulnerabilities Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> |
|||
| abd772f780 |
fix: Build and install the langflow-sdk for lfx (fixes nightly) (#12481)
* fix: Build and install the langflow-sdk for lfx * Publish sdk as a nightly * Update ci.yml * Update python_test.yml * Update ci.yml |
|||
| cea8b1aa12 |
feat: flow event polling for real-time MCP agent activity (#12340)
* feat: add Langflow MCP Client settings page
Add a new settings page that shows coding agents how to connect to
Langflow via the lfx.mcp client. Includes setup instructions and
JSON config for Bob (IBM) and Claude Code.
* fix: clipboard guard and per-button copied state in MCP client page
- Guard navigator.clipboard availability before calling writeText
- Track copied state per button (command vs json) so visual feedback
matches the action the user took
* feat: add flow events queue for MCP agent activity polling
In-memory event queue service with cursor-based polling endpoint
at GET/POST /api/v1/flows/{flow_id}/events. Enables the frontend
to detect when MCP agents modify flows in near real-time.
* feat: emit flow events from MCP tools and add notify_done tool
Each mutating MCP tool now posts an event to the flow events queue
after successful PATCH. Adds notify_done tool for explicit settle
signaling to the frontend.
* feat: add frontend flow event polling with canvas locking and toast
- useFlowEvents hook with adaptive polling (5s idle, 1s active)
- Canvas locks with "Agent is working..." badge during agent activity
- Flow reloads and summary toast on settle
* test: add tests for flow events hook and MCP event emission
- 9 frontend tests for useFlowEvents hook (polling, accumulation, settle, errors)
- 4 lfx tests for LangflowClient.post_event (payload, defaults, error suppression)
- 7 lfx tests for MCP tool event emission (add/remove/configure/connect/disconnect/notify_done)
* fix: add flow ownership check and fix thread-safety in event queue
Endpoints now verify the authenticated user owns the flow before
allowing event reads or writes. Also copies the event list inside
the lock to prevent concurrent mutation during iteration.
* fix: log warnings on event posting and polling failures
Replace silent error suppression with logger.warning (backend) and
console.warn (frontend) so failures are diagnosable while keeping
best-effort semantics.
* fix: show toast only on successful flow reload after agent settle
Move toast into reloadFlow's onSuccess callback so users aren't told
about changes that failed to load. Also fixes stale closure by adding
missing useEffect dependencies.
* test: improve coverage for flow events
- Add cursor-ahead-of-events tests for get_since settle logic
- Add flow ownership 404 test for events endpoints
- Add event emission tests for freeze/unfreeze/layout/update_flow_from_spec
- Use real flow IDs (from created flows) in API tests
* test: add edge case coverage for flow events
- flow_settled before cursor should not trigger settlement
- create_flow_from_spec emits flow_settled after batch
- Polling resumes at idle interval after settle
- Simultaneous events + settled in single poll
* fix: UX improvements for agent activity polling
- Clear events after settle to prevent stale toast messages
- Truncate toast to 3 summaries max ("and N more")
- Block keyboard shortcuts (undo/redo/copy/paste/cut) during agent lock
- Poll immediately on mount (no 5s blind spot)
- Add concurrency guard to prevent overlapping polls
- Guard against setState on unmounted component
* test: add Playwright E2E test for agent events banner
Verifies that posting events via the API triggers the "Agent is
working..." banner on the canvas, and that a flow_settled event
dismisses it.
* refactor: consolidate lfx event tests into parameterized tests
- Server tests: 10 identical copy-paste classes -> 1 parameterized test
covering 9 tools, assertions check event type not exact summary
- Client tests: merge redundant exception tests, test multiple error
types in one test
- Keep distinct tests for create_flow_from_spec and notify_done since
they have unique behavior (batch settle vs explicit settle)
* fix: UX improvements for agent events banner
- Show latest event summary in banner (e.g. "Agent: Added Memory")
- Slide-in entrance and slide-out exit animations
- Minimum 2s display time so banner doesn't flash
- Freeze banner text during exit animation
- Text eases in when new events arrive
* fix: canvas reload, locking, and toast formatting
- Use applyFlowToCanvas for proper canvas reload on settle
- Zoom to fit after reload instead of zooming to 200%
- Lock icon shows "Agent Working" during agent activity
- ReactFlow nodesDraggable/nodesConnectable respect agent lock
- Toast shows grouped summary (e.g. "Agent removed 3 components")
- Events preserved for consumer, cleared via clearEvents callback
* fix: handle AUTO_LOGIN nullable user_id, remove double processFlows, fix pluralization
- _verify_flow_owner now accepts flows with user_id=None (AUTO_LOGIN)
- Remove redundant processFlows call (applyFlowToCanvas handles it)
- Toast says "connections" not "components" for connection events
* refactor: minor cleanup from code review
- Remove unused FlowEventType export (only used internally)
- Simplify nested ternary in toast pluralization
* chore: remove test artifact
* fix: harden flow events service and address review findings
- Rewrite FlowEventsService to use diskcache for cross-worker
event visibility (replaces in-memory dict)
- Add Literal constraint and max_length to FlowEventCreate API model
- Restore manual lock toggle (disabled during agent activity),
serialize saves to prevent race conditions
- Add AbortController to post-settle flow reload to prevent
stale responses from overwriting wrong canvas
- Clear agent-working state on terminal poll errors (401/403/404)
so UI doesn't get permanently stuck
- Make notify_done report warning status on delivery failure
- Emit settle event on create_flow_from_spec rollback
- Fix E2E test banner text assertion to match actual render
- Add 14 new tests: cross-worker visibility, validation 422s,
terminal error unlock, notify_done warning, rollback settle
* fix: resolve CI failures in MemoizedCanvasControls and notify_done tests
- Add waitFor() to lock toggle tests for async handleToggleLock
- Patch logger in notify_done failure test to avoid I/O on closed file
- Replace any[] with unknown[] in test mock type
* fix: address remaining review feedback from erichare
- Fix stale closure in banner effect using bannerVisibleRef
- Add runtime event type validation in FlowEventsService.append()
- Document diskcache ephemeral storage and multi-tab limitations
|
|||
| 4e8c5e7e0e |
feat: add Langflow MCP Client settings page (#12321)
* feat: add Langflow MCP Client settings page Add a new settings page that shows coding agents how to connect to Langflow via the lfx.mcp client. Includes setup instructions and JSON config for Bob (IBM) and Claude Code. * fix: clipboard guard and per-button copied state in MCP client page - Guard navigator.clipboard availability before calling writeText - Track copied state per button (command vs json) so visual feedback matches the action the user took |
|||
| 103ef7dcfa | fix: Close popup when navigating to MCP settings (#12358) | |||
| e6846ea6e7 |
feat(ui): Add "Connect other models" option for model-type handles (#12466)
* Display proper error messages and strip null params from tool calls * add connect other models option * fix model provider selection state * fix tests and ruff * revert mcp changes * [autofix.ci] apply automated fixes * fix handle not appearing properly * fix jest test * [autofix.ci] apply automated fixes * address qa fixes * add tests to validate be and fe * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * ruff style and checker * fix tests failuer --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 4bdc87dcc1 |
fix: Import and Statistics fixes for Knowledge Bases (#12446)
* fix: Access the appropriate attribute for chroma * Fix display of chunk metadata * [autofix.ci] apply automated fixes * Add some unit tests * Update ingestion.py * [autofix.ci] apply automated fixes * Review updates * Update component_index.json * Fix bug with ingestion * [autofix.ci] apply automated fixes * Update test_ingestion.py * Update test_ingestion.py --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Carlos Coelho <80289056+carlosrcoelho@users.noreply.github.com> |
|||
| b0a8662d24 |
docs: add CI optimization analysis for pre-release builds (#12207)
- Analyze 45-60 min CI bottleneck for pre-release builds - Document that both PyPI publishing and Docker builds wait for CI - Recommend skip_ci parameter with safeguards for urgent releases - Show 50% time savings (100 min → 50 min) for pre-releases - Include risk assessment and implementation guidelines Addresses LE-517 |
|||
| 45325f6376 |
feat: Langflow SDK and Flow DevOps API Toolkit (#12245)
* feat(sdk): add langflow-sdk Python client package * feat(lfx): add Flow DevOps CLI toolkit * feat(api): add flow upsert, export normalization, ZIP upload * chore: CI coverage merge, Docker fixes, dependency updates * Address CQ5 review / import bug * Update test_status_command.py * Update test_status_command.py * Fix more tests * Review edits * Review edits * Fix tests * Follow up review updates * Refactor common client code * Update templates and comp index * [autofix.ci] apply automated fixes * Update test_database.py * Updates from review comments * Fix push interface to match the rest * Update push.py * Update push.py --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 61bc076ab3 |
fix: restore langflow-logo-color-black-solid.svg removed in docs release (#12447)
Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com> |
|||
| a2d3c18569 |
feat: MCP server UX improvements, batch, and spec-based flow creation (#12205)
* feat: add pure flow-builder utilities to lfx
Add flow_builder subpackage with pure functions for manipulating
flow JSON dicts — component ops, edge creation with ReactFlow
handle format, topological layout, and dynamic field detection.
* feat: add MCP server for operating Langflow via REST API
FastMCP server exposing 15 tools across auth, flow, component,
connection, and execution groups. Agents can create flows, add
and configure components, wire connections, and run flows against
a Langflow server through MCP tool calls.
* feat: add langflow-mcp-client console script entry point
* fix: use dict comprehension in setup.py to fix PERF403 lint
* fix: address PR review feedback on MCP client
- Add asyncio.Lock to prevent race condition in _client() under
concurrent access
- Handle 204 No Content responses in delete() instead of calling
resp.json() on empty body
- Fix weak assertion in test_default_values
* feat: auto-enable tool_mode when connecting component_as_tool
describe_component_type now shows component_as_tool as an output
for any component with tool_mode-capable outputs. When an agent
connects via component_as_tool, tool_mode is auto-enabled — no
extra step needed.
* refactor: move MCP server from langflow-base to lfx
The MCP server has no langflow dependencies — only httpx, mcp,
and lfx.graph.flow_builder. Moving it to lfx.mcp makes it usable
without installing langflow. Entry point: lfx-mcp.
* feat: improve MCP server UX for agents
- describe_component_type separates advanced fields from core ones
- search_component_types accepts output_type filter
- list_flows accepts query filter and includes ASCII graph repr
- get_flow_info includes ASCII graph repr
- add duplicate_flow tool
- add list_starter_projects tool
* feat: add use_starter_project tool and tests for new features
- use_starter_project creates a flow from a starter template by name
(starter projects aren't fetchable by ID via /flows/)
- Tests for duplicate_flow, starter projects, graph repr, advanced
fields, and output_type search
* docs: improve MCP tool descriptions for agent clarity
- Add server-level instructions with typical workflow guide
- Remove internal implementation details from tool descriptions
- Add cross-references between related tools
- Mention component_as_tool and graph diagrams where relevant
* docs: address subagent review feedback on tool descriptions
- Document return values for create_flow, add_component
- Clarify empty-query behavior for search_component_types
- Distinguish get_component_info (instance) vs describe_component_type (type)
- Explain connection type compatibility in instructions
- Clarify configure_component trigger field behavior
- State disconnect_components default when filters omitted
* feat: add batch tool for multi-action requests
Execute multiple actions in one call with $N.field references
to chain results. An agent can build a complete flow in a single
request instead of 6+ round trips.
* feat: add create_flow_from_spec tool for compact text-based flow creation
Accepts a compact text spec with nodes, edges (using real port names),
and config sections. Agents generate a simple string instead of
constructing nested JSON. Tool mode auto-enabled for component_as_tool.
Handles Prompt Template dynamic variables by parsing {var} from
template text and creating input fields. Cleans up flows on failure.
Type coercion for numeric/boolean config values.
* feat: add build_flow validation and create_flow_from_spec
build_flow validates flows by building the graph server-side.
create_flow_from_spec accepts a compact text spec with nodes,
edges, and config. Validates by default (optional).
Handles Prompt Template dynamic {variables}, auto-enables tool_mode
for component_as_tool, cleans up on failure, coerces config types.
* fix: isolate session state and harden MCP server
* fix: move test_flow_builder into tests/unit so CI collects coverage
* fix: address PR review feedback
- Fix test fixture to use contextvars instead of stale module attributes
- Raise ValueError on malformed spec lines instead of silently dropping
- Disambiguate duplicate component types in flow_graph_repr
- Narrow except Exception to ImportError in flow_graph_repr
- Add action-index context to batch error messages
- Fix stale/inaccurate docstrings (group count, "| ", field_name, category, build_flow)
- Mention create_flow_from_spec in MCP instructions
* feat: stream run_flow events via MCP progress notifications
run_flow now consumes Langflow's SSE stream and relays token events
to the MCP client via report_progress. Falls back to a regular POST
if the stream yields no result.
* test: add streaming integration tests for run_flow and stream_post
* chore: rebuild component index
* [autofix.ci] apply automated fixes
* fix: handle Message dicts in str field param processing, add MCP logger
param_handler's str case called unescape_string on list elements without
type checking. On subsequent agent calls, chat history stores Message dicts
in the list, causing 'dict' object has no attribute 'replace'.
Added _coerce_str_value that extracts .text from Message/Data/dict objects.
Added lfx logger to MCP server with streaming fallback warning.
* feat: add flow builder tools, propose_field_edit, and flow_to_spec_summary
- builder.py: builds flow dicts from text specs using local component
registry with granular error handling per build phase
- flow_builder_tools.py: 9 Langflow components for agent tooling
(search, describe, get_field_value, propose_field_edit, add_component,
remove_component, connect_components, configure_component, build_flow)
- propose_field_edit generates validated JSON Patches with dry-run
- flow_to_spec_summary converts flow dicts to compact summaries with IDs
- Module-level event queue for real-time UI updates during streaming
* [autofix.ci] apply automated fixes
* feat: add get_build_results and get_component_output MCP tools
Exposes per-component build data from the vertex_builds table:
- get_build_results: returns all component outputs, validity, and errors
from the last run -- useful for debugging which component failed
- get_component_output: inspect a specific component's output from the
last run to trace where the pipeline broke
* feat: add flow management, iteration, and discovery MCP tools
Response improvements:
- spec_summary (component IDs + connection ports) in get_flow_info/list_flows
- Merged components() tool: search or describe in one call
Flow management tools:
- validate_flow: polls build results with timeout, structured per-component errors
- rename_flow: update name/description
- export_flow: serialize to JSON with sensitive field redaction
- update_flow_from_spec: declarative update with reference validation
Component iteration tools:
- freeze_component / unfreeze_component: skip re-execution during iteration
- layout_flow_tool: re-layout after modifications
Security: export_flow redacts API keys via redact_node before exposing to LLM.
Includes 18 integration tests covering all new tools.
* refactor: extract shared _node_id and validate_spec_references
- _utils.py: shared node_id helper (was duplicated in component.py and layout.py)
- spec.py: validate_spec_references extracted from three copies in
create_flow_from_spec, update_flow_from_spec, and build_flow_from_spec
* fix: add trailing slash to /api_key endpoint in MCP client login
The FastAPI endpoint redirects /api_key to /api_key/ (307) and httpx
drops the POST body on redirect, causing API key creation to fail
silently during login.
* fix: isolate session state and harden MCP server
contextvars alone lose state between stdio tool calls. Add module-level
fallback so login credentials persist across calls while still
supporting per-session isolation for SSE transport.
* feat: improve MCP server UX for agents
- describe_component_type separates advanced fields from core ones
- search_component_types accepts output_type filter
- list_flows accepts query filter and includes ASCII graph repr
- get_flow_info includes ASCII graph repr
- add duplicate_flow tool
- add list_starter_projects tool
* feat: add use_starter_project tool and tests for new features
- use_starter_project creates a flow from a starter template by name
(starter projects aren't fetchable by ID via /flows/)
- Tests for duplicate_flow, starter projects, graph repr, advanced
fields, and output_type search
* docs: improve MCP tool descriptions for agent clarity
- Add server-level instructions with typical workflow guide
- Remove internal implementation details from tool descriptions
- Add cross-references between related tools
- Mention component_as_tool and graph diagrams where relevant
* docs: address subagent review feedback on tool descriptions
- Document return values for create_flow, add_component
- Clarify empty-query behavior for search_component_types
- Distinguish get_component_info (instance) vs describe_component_type (type)
- Explain connection type compatibility in instructions
- Clarify configure_component trigger field behavior
- State disconnect_components default when filters omitted
* feat: add batch tool for multi-action requests
Execute multiple actions in one call with $N.field references
to chain results. An agent can build a complete flow in a single
request instead of 6+ round trips.
* feat: add create_flow_from_spec tool for compact text-based flow creation
Accepts a compact text spec with nodes, edges (using real port names),
and config sections. Agents generate a simple string instead of
constructing nested JSON. Tool mode auto-enabled for component_as_tool.
Handles Prompt Template dynamic variables by parsing {var} from
template text and creating input fields. Cleans up flows on failure.
Type coercion for numeric/boolean config values.
* feat: add build_flow validation and create_flow_from_spec
build_flow validates flows by building the graph server-side.
create_flow_from_spec accepts a compact text spec with nodes,
edges, and config. Validates by default (optional).
Handles Prompt Template dynamic {variables}, auto-enables tool_mode
for component_as_tool, cleans up on failure, coerces config types.
* fix: address PR review feedback
- Fix test fixture to use contextvars instead of stale module attributes
- Raise ValueError on malformed spec lines instead of silently dropping
- Disambiguate duplicate component types in flow_graph_repr
- Narrow except Exception to ImportError in flow_graph_repr
- Add action-index context to batch error messages
- Fix stale/inaccurate docstrings (group count, "| ", field_name, category, build_flow)
- Mention create_flow_from_spec in MCP instructions
* feat: stream run_flow events via MCP progress notifications
run_flow now consumes Langflow's SSE stream and relays token events
to the MCP client via report_progress. Falls back to a regular POST
if the stream yields no result.
* test: add streaming integration tests for run_flow and stream_post
* chore: rebuild component index
* [autofix.ci] apply automated fixes
* fix: handle Message dicts in str field param processing, add MCP logger
param_handler's str case called unescape_string on list elements without
type checking. On subsequent agent calls, chat history stores Message dicts
in the list, causing 'dict' object has no attribute 'replace'.
Added _coerce_str_value that extracts .text from Message/Data/dict objects.
Added lfx logger to MCP server with streaming fallback warning.
* feat: add flow builder tools, propose_field_edit, and flow_to_spec_summary
- builder.py: builds flow dicts from text specs using local component
registry with granular error handling per build phase
- flow_builder_tools.py: 9 Langflow components for agent tooling
(search, describe, get_field_value, propose_field_edit, add_component,
remove_component, connect_components, configure_component, build_flow)
- propose_field_edit generates validated JSON Patches with dry-run
- flow_to_spec_summary converts flow dicts to compact summaries with IDs
- Module-level event queue for real-time UI updates during streaming
* [autofix.ci] apply automated fixes
* feat: add get_build_results and get_component_output MCP tools
Exposes per-component build data from the vertex_builds table:
- get_build_results: returns all component outputs, validity, and errors
from the last run -- useful for debugging which component failed
- get_component_output: inspect a specific component's output from the
last run to trace where the pipeline broke
* feat: add flow management, iteration, and discovery MCP tools
Response improvements:
- spec_summary (component IDs + connection ports) in get_flow_info/list_flows
- Merged components() tool: search or describe in one call
Flow management tools:
- validate_flow: polls build results with timeout, structured per-component errors
- rename_flow: update name/description
- export_flow: serialize to JSON with sensitive field redaction
- update_flow_from_spec: declarative update with reference validation
Component iteration tools:
- freeze_component / unfreeze_component: skip re-execution during iteration
- layout_flow_tool: re-layout after modifications
Security: export_flow redacts API keys via redact_node before exposing to LLM.
Includes 18 integration tests covering all new tools.
* refactor: extract shared _node_id and validate_spec_references
- _utils.py: shared node_id helper (was duplicated in component.py and layout.py)
- spec.py: validate_spec_references extracted from three copies in
create_flow_from_spec, update_flow_from_spec, and build_flow_from_spec
* fix: update test fixture to use contextvars-based server API
The mcp_client fixture was accessing mcp_server_module._client and
._registry directly, but these were replaced with contextvars
(_client_var, _shared_client, _set_client, etc.) in the server
module refactor.
* [autofix.ci] apply automated fixes
* fix: address review feedback on MCP server PR
- Move flow_builder_tools out of components/ into mcp/ (fixes test_get_all)
- Extract _set_frozen() helper to deduplicate freeze/unfreeze
- Add missing tools to batch _TOOL_MAP
- Fix sensitive field detection to use word-boundary matching
- Unify redaction logic via shared is_sensitive_field()
- Log skipped non-JSON SSE lines in stream_post
- Rebuild component index
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* fix: gracefully handle server refresh failure in configure_component
When a real_time_refresh field (e.g. model_name) is configured before
its dependency (e.g. api_key), the server-side refresh fails. Instead
of propagating a raw RuntimeError, the value is saved locally and a
warning is returned telling the agent to set the credential first.
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Keval718 <kevalvirat@gmail.com>
Co-authored-by: Eric Hare <ericrhare@gmail.com>
|
|||
| c08a465e16 |
docs: block custom components with env var (#12413)
* initial-changes * fix-broken-links * Apply suggestions from code review Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com> Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com> --------- Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com> |
