* feat: add customOpenUrl utility for secure external link handling
Extract window.open with noopener/noreferrer into a reusable customization
utility and use it in ProviderConfigurationForm. Also converts to type-only
imports where applicable.
* fix: use existing function
* fix: use custom open tab function
* fix: upgrade playwright to 1.58.0 to address Chromium CVEs
- Add playwright>=1.58.0 to override-dependencies in pyproject.toml
- Update uv.lock: playwright 1.49.0 -> 1.58.0, pyee 12.0.0 -> 13.0.1
- Fixes CVE-2026-2313, CVE-2026-2314, CVE-2026-2315, CVE-2026-2319,
CVE-2026-2321, CVE-2026-2441, CVE-2026-2648, CVE-2026-2649
- Ensures Docker builds download updated Chromium with security patches
* fix: update npm to latest version to address brace-expansion CVE-2026-33750
- Add npm update after Node.js installation in Dockerfile
- Fixes CVE-2026-33750 in system npm's brace-expansion dependency
- System npm had brace-expansion 2.0.2, update gets 5.0.5+
- Low risk change: npm is backward compatible, only affects CLI tool
* revert: remove npm update from Dockerfile
- npm update attempts were causing CI build failures
- Bundled npm has issues but updating it is proving problematic
- Focus on playwright CVE fix which is the primary concern
- brace-expansion CVE-2026-33750 is lower priority (DoS only)
* chore: sync uv.lock files
sync uv.lock files
* fix(mcp): dedupe edges in connect_components (#12701)
* fix(mcp): make add_connection idempotent to avoid duplicate edges
connect_components used to append a new edge unconditionally. Because
the edge id is deterministic from source/target/handles, calling it for
a pair the flow already had wired up (UI-then-MCP, batch retry, or just
a repeat call) produced a second edge with the same id, double-wiring
the flow at runtime.
Before appending, scan the existing edges for one with the same id and
return that instead. Different outputs/inputs between the same pair
still produce distinct ids and remain supported.
* test(mcp): cover dedupe against UI-saved edges, broaden match key
Older Langflow UIs saved edges with an `xy-edge__` id prefix instead of
the current `reactflow__edge-`, so an id-based dedup would miss the
UI-then-MCP case for any flow that came from an older version. Switch
the existence check to a structural one (source, target, sourceHandle
name, targetHandle fieldName) so the same logical connection dedupes
regardless of id format.
Add a fixture-driven test that loads MemoryChatbotNoLLM.json (an
xy-edge-prefixed flow) and replays each connection through
add_connection, asserting the edge count does not grow.
* fix(mcp): validate_flow fast-fails and reports partial errors (#12697)
* fix(mcp): validate_flow fast-fails and reports partial errors
validate_flow polled /monitor/builds for up to 30 seconds waiting for
every component to finish before reporting errors. When a component
fails early (for example a missing required field), downstream
components never run, so the loop waited out the full window and
returned just "Build timed out: N/M components completed" with no
actionable context.
- Short-circuit as soon as any completed build reports valid: false;
return those errors immediately instead of polling on.
- On timeout, include the errors from the builds that did complete
plus a component_count so the caller can see progress.
- Extract _collect_build_errors so the poll loop and timeout branch
share the same error shape.
* fix(mcp): stream validate_flow build inline instead of polling
The previous implementation triggered an async build and polled
/monitor/builds, which depended on FastAPI BackgroundTasks firing the
log_vertex_build calls after the trigger request had returned. Under
ASGI test transport these tasks never run, so /monitor/builds stayed
empty and validate_flow timed out with component_count=0.
Switch to event_delivery=direct so the build streams its events back
inside the same request:
- Drive the build via client.stream_post and aggregate per-vertex
results from end_vertex events.
- Fast-fail on the first vertex with valid=false, since downstream
vertices depend on it and would not produce useful information.
- Surface top-level error events as a single flow-level error.
- Replace _collect_build_errors with _extract_vertex_error, which
reads the structured error payload from the end_vertex outputs.
Update the lfx unit tests to use the streaming shape and tighten the
backend integration test to assert real success now that the build
actually runs end to end under ASGI.
* fix(graph): make end_all_traces_in_context Python 3.10 compatible
The implementation called asyncio.create_task(coro, context=context),
but the context= keyword was added to create_task in Python 3.11. On
3.10 it raised TypeError. The bug was latent because nothing in the
test suite previously consumed a streaming build response far enough
for Starlette to dispatch the post-response BackgroundTasks where this
code lives. The validate_flow streaming change exposes it.
On 3.10, route the create_task call through context.run so the new
Task copies the captured context as its current context, matching the
isolation the 3.11 path provides via the context= kwarg.
Add a regression test that asserts end_all_traces sees the value of a
contextvar set before the context was captured, even after the caller
mutates that var.
* fix: failing wxo list llm test (#12700)
patch service layer and update failing test
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* Try to fix the missing typer import
---------
Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local>
Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com>
Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@logspace.ai>
Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Eric Hare <ericrhare@gmail.com>
* fix(mcp): validate_flow fast-fails and reports partial errors
validate_flow polled /monitor/builds for up to 30 seconds waiting for
every component to finish before reporting errors. When a component
fails early (for example a missing required field), downstream
components never run, so the loop waited out the full window and
returned just "Build timed out: N/M components completed" with no
actionable context.
- Short-circuit as soon as any completed build reports valid: false;
return those errors immediately instead of polling on.
- On timeout, include the errors from the builds that did complete
plus a component_count so the caller can see progress.
- Extract _collect_build_errors so the poll loop and timeout branch
share the same error shape.
* fix(mcp): stream validate_flow build inline instead of polling
The previous implementation triggered an async build and polled
/monitor/builds, which depended on FastAPI BackgroundTasks firing the
log_vertex_build calls after the trigger request had returned. Under
ASGI test transport these tasks never run, so /monitor/builds stayed
empty and validate_flow timed out with component_count=0.
Switch to event_delivery=direct so the build streams its events back
inside the same request:
- Drive the build via client.stream_post and aggregate per-vertex
results from end_vertex events.
- Fast-fail on the first vertex with valid=false, since downstream
vertices depend on it and would not produce useful information.
- Surface top-level error events as a single flow-level error.
- Replace _collect_build_errors with _extract_vertex_error, which
reads the structured error payload from the end_vertex outputs.
Update the lfx unit tests to use the streaming shape and tighten the
backend integration test to assert real success now that the build
actually runs end to end under ASGI.
* fix(graph): make end_all_traces_in_context Python 3.10 compatible
The implementation called asyncio.create_task(coro, context=context),
but the context= keyword was added to create_task in Python 3.11. On
3.10 it raised TypeError. The bug was latent because nothing in the
test suite previously consumed a streaming build response far enough
for Starlette to dispatch the post-response BackgroundTasks where this
code lives. The validate_flow streaming change exposes it.
On 3.10, route the create_task call through context.run so the new
Task copies the captured context as its current context, matching the
isolation the 3.11 path provides via the context= kwarg.
Add a regression test that asserts end_all_traces sees the value of a
contextvar set before the context was captured, even after the caller
mutates that var.
* fix(mcp): make add_connection idempotent to avoid duplicate edges
connect_components used to append a new edge unconditionally. Because
the edge id is deterministic from source/target/handles, calling it for
a pair the flow already had wired up (UI-then-MCP, batch retry, or just
a repeat call) produced a second edge with the same id, double-wiring
the flow at runtime.
Before appending, scan the existing edges for one with the same id and
return that instead. Different outputs/inputs between the same pair
still produce distinct ids and remain supported.
* test(mcp): cover dedupe against UI-saved edges, broaden match key
Older Langflow UIs saved edges with an `xy-edge__` id prefix instead of
the current `reactflow__edge-`, so an id-based dedup would miss the
UI-then-MCP case for any flow that came from an older version. Switch
the existence check to a structural one (source, target, sourceHandle
name, targetHandle fieldName) so the same logical connection dedupes
regardless of id format.
Add a fixture-driven test that loads MemoryChatbotNoLLM.json (an
xy-edge-prefixed flow) and replays each connection through
add_connection, asserting the edge count does not grow.
The Python function layout_flow_tool was advertised to MCP clients
under its raw function name (layout_flow_tool) while the batch tool
map dispatched it under layout_flow. A caller copying tool names from
the MCP tool list could not drive batch without translating the name.
Pass name="layout_flow" to the decorator so the external MCP name
matches the batch dispatch key. The Python symbol stays layout_flow_tool
to avoid a clash with the layout_flow helper imported from
lfx.graph.flow_builder.layout.
Added a test that asserts every batch tool_map key is an actual MCP
tool name, so future drift between the two surfaces gets caught.
* feat(deployments): verify wxO credentials against instance API
- Probe GET /v1/orchestrate/models after IAM token to validate URL+key
- Add POST /deployments/providers/verify-credentials for connection tests
- Extend unit tests for models probe and WxO client stub
* fix(api): rename verify endpoint and redact 422 request input
Rename the deployment provider credential verification route to /deployments/providers/verify and sanitize RequestValidationError responses so raw request payloads are not echoed back in 422 errors. Update route/tests accordingly, including regression coverage for input redaction.
* revert(api): remove verification endpoint follow-up changes
Keep this PR focused on wxO adapter tenant validation via model-list fetch and drop API-layer validation endpoint and request-redaction changes.
* fix(wxo): resolve list_llms rebase conflict with adapter seam
Keep release default-model merge behavior while preserving fetch_models_adapter usage, and update list_llms expectations in tests.
* [autofix.ci] apply automated fixes
---------
Co-authored-by: Hamza Rashid <hzarashid@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com>
* fix(frontend): improve deployment stepper visibility in light mode
Step labels were using text-muted-foreground which is nearly invisible
in light mode. Changed to text-foreground with font-medium for active
steps. Also added overlayClassName prop to DialogContent to allow
per-dialog backdrop customization, used to lighten the deployment
modal backdrop in light mode.
* fix(frontend): add backdrop blur to deployment stepper modal
---------
Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com>
The determine-sdk-version job was missing the 'uv sync' step that creates
the cache, causing the 'Post Setup Environment' step to fail with:
'cache path does not exist on disk'
This matches the pattern used in determine-lfx-version job (line 247) and
the nightly build workflow (line 104-105).
Fixes the SDK build failure in release workflow dry run.
load_registry iterated data.values(), discarding the category
group keys from /api/v1/all. Every component ended up with
category: "", which made the components(category=...) MCP tool
filter return empty results for every category.
Iterate data.items() instead and inject the category name onto
each component's entry so search_registry's category filter works.
* refactor: rename deployment executions to runs at the API boundary
Rename the deployment sub-resource from "executions" to "runs" across
the API layer, frontend hooks, and tests. Internal adapter/service code
retains its own execution terminology — only the public-facing surface
changes.
- URL paths: /{deployment_id}/executions -> /{deployment_id}/runs
- Path param: execution_id -> run_id
- Route functions: create_deployment_execution -> create_deployment_run,
get_deployment_execution -> get_deployment_run
- Schema classes: ExecutionCreateRequest -> RunCreateRequest,
ExecutionCreateResponse -> RunCreateResponse,
ExecutionStatusResponse -> RunStatusResponse
- provider_data field: execution_id -> id
- Frontend hooks: usePostDeploymentExecution -> usePostDeploymentRun,
useGetDeploymentExecution -> useGetDeploymentRun
- Frontend types: DeploymentExecutionRequest -> DeploymentRunRequest,
DeploymentExecutionResponse -> DeploymentRunResponse
* fix: rename remaining execution references to runs in FE and schema docs
Complete the executions→runs rename at the API layer by updating
local variables, user-facing error strings, test mock names, and
schema docstrings that still referenced "execution".
* make schema for runs to wxo
* harden validation
* clean up stale refs to old /executions endpoint
* fix(loop): drive iteration from item_output when done is not connected
Extract the loop body execution into an idempotent `_iterate` helper
that both `item_output` and `done_output` invoke. On release-1.9.0,
`_should_process_output` only runs outputs whose name is in the
vertex's outgoing edge source names, so `done_output` never ran when
nothing was connected to `done` and the subgraph iteration never
happened.
`_iterate` caches aggregated results and cached exceptions in ctx so
repeat calls (when both outputs are wired) run the subgraph exactly
once and surface the same failure on re-entry. `item_output` is now
async, calls `_iterate` before stopping the item branch, and returns
a Data payload listing the dispatched items so the inspector shows
real content instead of an empty string.
Add regression tests covering the item-only topology, the classic
both-outputs-connected topology, empty input, cached error re-raise,
and per-run ctx isolation.
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix(loop): emit item output as DataFrame so UI renders it as a table
Wrapping the iterated rows in a `Data` payload with `count` / `items`
keys caused the Item inspector to render as JSON instead of as a
tabular view. Return the rows as a DataFrame, mirroring the Mock Data
component pattern, so the inspector uses its table renderer.
* feat(loop): emit summary logs for each run
Add start, complete, skipped, and error log entries from `_iterate` so
the component's Logs tab shows a per-run summary with row counts and
total elapsed time. Failures include the elapsed duration and the
error message.
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix(loop): address review comments
- Refresh Research Translation Loop starter flow's saved item-output
schema (JSON -> Table) to match item_output now returning a DataFrame.
- Clarify the test_ctx_isolation_across_runs docstring: production
rebuilds the graph per request, so ctx is effectively per-run; reusing
a single Graph instance across runs is intentionally not exercised.
- Update _iterate's docstring to describe the actual ctx scope rather
than claiming graph-instance-level reset semantics that the framework
does not provide.
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix(loop): stabilize chat output inspection test
* fix(loop): align starter project with item output contract
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* fix: upgrade playwright to 1.58.0 to address Chromium CVEs
- Add playwright>=1.58.0 to override-dependencies in pyproject.toml
- Update uv.lock: playwright 1.49.0 -> 1.58.0, pyee 12.0.0 -> 13.0.1
- Fixes CVE-2026-2313, CVE-2026-2314, CVE-2026-2315, CVE-2026-2319,
CVE-2026-2321, CVE-2026-2441, CVE-2026-2648, CVE-2026-2649
- Ensures Docker builds download updated Chromium with security patches
* fix: update npm to latest version to address brace-expansion CVE-2026-33750
- Add npm update after Node.js installation in Dockerfile
- Fixes CVE-2026-33750 in system npm's brace-expansion dependency
- System npm had brace-expansion 2.0.2, update gets 5.0.5+
- Low risk change: npm is backward compatible, only affects CLI tool
* revert: remove npm update from Dockerfile
- npm update attempts were causing CI build failures
- Bundled npm has issues but updating it is proving problematic
- Focus on playwright CVE fix which is the primary concern
- brace-expansion CVE-2026-33750 is lower priority (DoS only)
* CI: Filter cuga/playwright dependency conflict in release workflow
- Filter cuga/playwright conflict (we override playwright>=1.58.0 for CVE fixes)
- Still fails CI if other genuine dependency issues are detected
- Applied to both base and main package build steps
---------
Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local>
* feat: validate duplicate tool names at deployment review step
Add early detection of duplicate WXO tool names before deployment,
preventing users from hitting a 409 error only at deploy time.
- Add `GET /snapshots/check-names` endpoint using SDK's
`get_drafts_by_names()` for fast server-side lookup
- Add `check_tool_names_exist()` to WXO service adapter
- Show inline validation error with alert banner on the review step
card when a tool name already exists in the provider
- Block deploy button while duplicate names exist
- Also detect batch duplicates (same name on multiple flows)
- Use `keepPreviousData` to prevent error flicker on re-validation
* fix: update duplicate tool name error message
* refactor: use snapshot list endpoint with name filter instead of dedicated check-names endpoint
Replace the dedicated `/snapshots/check-names` endpoint with a
`provider_snapshot_names` query parameter on the existing
`GET /deployments/snapshots` endpoint. This keeps the API surface
smaller and follows the existing list-with-filter pattern.
* test: add tests for snapshot name filter and duplicate tool name validation
- Add validation on provider_snapshot_names: min_length=1 on Query param,
strip whitespace and reject empty entries in SnapshotListParams
- Backend unit tests: 5 validation tests + 3 adapter list_snapshots
name-filter tests + 1 route handler test
- Frontend unit tests: 4 tests for useCheckToolNames hook
- Frontend E2E tests: 3 Playwright tests for duplicate tool name
detection, unique name acceptance, and error clearing on edit
- Fix step-review unit test mock to include new context fields
* feat: standardize snapshot name filtering to names query param
Rename deployment snapshot filtering from provider_snapshot_names to names across backend and frontend callers.
Add trimmed non-empty + dedup validation, enforce deployment_id/name-filter mutual exclusivity, and normalize WXO snapshot names with expanded unit coverage.
* chore: restore package-lock.json from release-1.9.0
* fix(frontend): limit deployment creation retry to 1
Reduce usePostDeployment mutation retry from default 3 to 1 to avoid
excessive 409 requests when deploying.
* feat(frontend): check duplicate tool names on deployment update
When editing a deployment, pre-existing flows with renamed tool names
are now validated against the provider for duplicates. Previously only
new flows were checked, allowing renamed tools to collide silently.
Expose initialToolNameByFlow from stepper context so step-review can
detect name changes and include them in the provider duplicate check.
* fix(frontend): replace nested button with div role=button in flow list
Outer button element contained inner detach/undo buttons, causing
"button cannot be a descendant of button" console error.
---------
Co-authored-by: Hamza Rashid <hzarashid@gmail.com>
* fix: agent icon color adjustment
* only show environment selector when more that one, adjust spacing
* adjustments to spacing
* fixed context shift
* added space between connections and scrollbar
* content & small updates
* fix: update test for connection panel
* [autofix.ci] apply automated fixes
* conditional padding change
* fix how visibleDeployments is filtered
* updated test
* fix: update deployments content
* updated content
* queryKey matches the API params
* updated approach to avoid extra API calls
* [autofix.ci] apply automated fixes
* add a small space between available connections
* fix: improve memo deps, simplify empty state, harden formatDate, fix test assertions
- Use providers array instead of providers.length in useMemo dep
- Collapse duplicate DeploymentsEmptyState branches
- Add explicit locale and invalid date guard to formatDate
- Fix add-provider-modal test for split text elements
- Add test asserting providerIdsToQuery is decoupled from selection
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Viktor Avelino <viktor.avelino@gmail.com>
Co-authored-by: Viktor Avelino <64113566+viktoravelino@users.noreply.github.com>
fix(frontend): auto-populate global variable key-value pairs when creating a connection
updateDetectedEnvVars expected objects with key/global_variable_name
fields, but the backend detection endpoint returns a flat string array
of variable names. Simplified the function to accept string[] directly,
using each name as both the env var key and the global variable binding.
* Enforce unique tool to flow version relationship
* fix: harden deployment snapshot attachment conflict handling
- add typed attachment conflict exceptions in attachment CRUD and map only those conflicts to HTTP 409 in deployment create/update routes
- update snapshot patch flow to bulk-update all attachment rows by provider_snapshot_id, commit inside the guarded block, and keep compensating provider rollback on DB failure
- document race-condition caveats around app-level snapshot/flow-version guards and add targeted warning/info logs for conflict and post-provider DB anomalies
- add/expand unit tests for attachment bulk update behavior, typed conflict exceptions, and snapshot route commit-failure compensation path
- align watsonx conflict-detail wording and corresponding mapper tests for tool/connection/agent duplicate-resource messages
---------
Co-authored-by: Hamza Rashid <hzarashid@gmail.com>
* feat: add langflow-sdk build and publish support to release workflow
Add support for building and publishing the langflow-sdk package in the
release workflow, mirroring the nightly build support added in #12491.
Changes:
- Add `release_sdk` workflow input for controlling SDK release
- Add `determine-sdk-version` job with first-release PyPI handling
- Add `build-sdk` job with version verification and import testing
- Add `publish-sdk` job that publishes SDK to PyPI before LFX
- Update `build-lfx` to download SDK artifact and test both wheels together
- Update `build-base` and `build-main` to use SDK wheel as find-links
- Pass SDK artifact to cross-platform tests
- Add validation: releasing LFX requires releasing SDK
- Add pre-release version handling for SDK and LFX's SDK dependency
* Update release.yml
* Update release.yml
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* feat: add SHA-256 hash-based API key lookup
Replace the O(n) full table scan in check_key with an indexed
SHA-256 hash column for O(1) lookup. Legacy keys without a hash
fall back to decrypt-and-compare and get their hash backfilled
on first successful match.
- Add api_key_hash column to ApiKey model (nullable, indexed)
- Hash stored at key creation time
- Migration adds column and backfills hashes for existing keys
- Fail closed when multiple keys share the same hash
- Remove unused fernet_obj parameter from decrypt_api_key
* fix(migration): skip hashing duplicate-plaintext API keys
Two-pass backfill: decrypt all rows, group by plaintext, then hash only
unique-plaintext rows. Duplicate-plaintext groups are left with NULL
hash so the runtime fast-path lookup cannot return multiple matches and
fail closed. The runtime slow-path matches and backfills exactly one
row per group on first use; remaining NULL rows become harmless
orphans.
Logs counts only (no key IDs or plaintexts) to avoid leaking
operational info via deployment logs.
Extracts _backfill_hashes helper for testing; adds 9 unit tests.
---------
Co-authored-by: Eric Hare <ericrhare@gmail.com>
Extract shared `add_base64_padding` and `ensure_fernet_key` functions
to eliminate duplicated key derivation logic between AuthService and
auth/utils.py.
Fix `_add_padding` adding 4 `=` characters instead of 0 when key length
is a multiple of 4, which broke Fernet key derivation for 44-char keys.
Change `%s` to `%r` in decryption failure logs so InvalidToken exceptions
(which have no message string) render as `InvalidToken()` instead of
empty strings.
Replace queue.get_nowait() with asyncio.wait_for(queue.get(), timeout=5.0)
to properly wait for async events in the queue, preventing QueueEmpty errors
in Python 3.13.
Fixes flaky test failure in release workflow.
* fix(ui): refactor connection panel and fix search empty state rendering
Extract connection state management into useConnectionPanelState hook
and search/list UI into ConnectionSearchList component. Fixes bug where
blank list items rendered before the empty state when search returned
no results.
* fix(ui): prevent modal jump when clicking connection items in Chrome
Chrome scrolls the nearest scrollable ancestor when focusing sr-only
inputs inside labels. Adding relative + overflow-hidden to the label
contains the scroll-into-view behavior within the label bounds.
fix: allow booleans, numbers, etc. in root-level tweaks (#11830)
Widen the Tweaks schema to accept bool, int, and float values alongside
str and dict, so scalar tweaks like {"stream": false} are no longer
rejected by Pydantic validation.
bool is listed before int in the union to prevent Pydantic from coercing
booleans to integers (since bool is a subclass of int).
Adds unit tests for boolean and numeric root-level tweaks, as well as
direct Tweaks Pydantic model validation tests.
Co-authored-by: Alex Kuligowski <alekuligowski@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: preserve resource-specific conflict mapping in wxo deployment flow
- rename DeploymentConflictError to ResourceConflictError (with a backward-compatible alias) and propagate resource/resource_name across deployment error handling
- extend raise_for_status_and_detail to accept explicit conflict hints and only infer resource/resource_name from provider detail as a fallback
- update deployment mappers/helpers to use resource/resource_name and format conflict details from structured fields
- add explicit conflict metadata at known wxo catch/re-raise points (connection/tool/agent paths) and enforce hint passing through raise_as_deployment_error
- prevent create/update top-level handlers from over-tagging conflicts as agent when downstream errors are tool/connection conflicts
- centralize create-agent provider error translation via raise_as_deployment_error
- add/adjust unit tests for route handlers, mapper conflict formatting, wxo service conflict propagation, and lfx deployment exception behavior (including Simple_Agent regression)
* remove DeploymentConflictError shim
* pass resource_name only on creation paths
* allow None
* fix(deployments): simplify conflict mapping and tighten error handling
Remove conflict-hint inference fallback, keep pass-through conflict detail formatting, tighten ClientAPIException status extraction, and drop temporary debug prints in deployment error paths.
* fix(deployments): simplify conflict hint mapping and align test expectations
Remove redundant conflict-hint normalization in deployment exceptions, clarify base mapper conflict-detail docs, and improve invalid flow-version guidance. Update watsonx deployment tests to assert current service-layer conflict/resource and exception-chain behavior.
* get rid of tool name fallbacks
* hard code fallback message
* fix: display proper tool name and description in tool mode output
When a component runs as a tool (connected to an Agent), the output modal
now shows the proper tool name, description, and tags instead of "Tool 1".
This builds tool metadata from the component's output method name and
description for proper display in the ToolOutputDisplay component.
* test: add unit tests for tool mode event emission
Add tests to verify that components running in tool mode properly emit
events to the frontend for logs visibility and tool metadata display.
* [autofix.ci] apply automated fixes
* fix: use public accessor for component logs instead of private attribute
Add get_logs() method to Component class and use it in component_tool.py
to fix Ruff SLF001 (private-member-access) violation flagged by CodeRabbit.
* fix: emit real-time log SSE events for components running in tool mode
- Set _current_output = TOOL_OUTPUT_NAME in tool wrappers so self.log()
fires and logs are attributed to the component_as_tool output
- Register on_log event in EventManager with thread-safe queue enqueue
via call_soon_threadsafe for sync tools running in thread executor
- Register on_log in production event manager (JobQueueService)
- Add appendLogToFlowPool Zustand action to incrementally add logs
- Handle "log" SSE event in buildUtils to update flowPool in real-time
- Fix displayOutputPreview to also check data.logs[outputName].length
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* fix: address PR review issues for tool mode logs visibility
- Fix TypeError: add output_name param to _build_output_function and
_build_output_async_function (called with 4 args but only took 3)
- Fix double-dispatch bug in event_manager.send_event: separate loop
detection from queue dispatch to avoid misdiagnosing queue RuntimeErrors
- Improve event_manager error handling: warn on QueueFull, error with
traceback on unexpected failures, warn when loop is unavailable
- Fix TypeScript type: VertexDataTypeAPI.logs uses LogsLogType[] (array)
and remove the 3 as any casts in appendLogToFlowPool
- Add input validation in buildUtils.ts log event handler to guard
against undefined keys corrupting the flow pool
- Add server-side logger.error on tool execution failure with exc_info
- Fix tests: replace end_vertex assertions (never emitted by tool path)
with build_end/log assertions; add LoggingCalculator subclass to test
real-time log event emission
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* [autofix.ci] apply automated fixes
* fix: store tool mode logs under component_as_tool output key
- In get_tools(), pass TOOL_OUTPUT_NAME instead of output.name to
_build_output_function/_build_output_async_function so self.log()
events are stored under 'component_as_tool' key in flowPool, matching
what the component_as_tool output's inspect modal reads
- Fix emptyOutput in NodeOutputfield to return false when logs exist,
preventing disabledInspectButton being vacuously true when outputs={}
- Fix TypeScript undefined index type on internalOutputName in both
displayOutputPreview and emptyOutput checks
* fix: address ruff violations and test failures in tool mode logs
- Fix ruff I001/SIM117/F401/TRY003/EM101 violations in test_component_toolkit.py
- Replace private _event_manager/_current_output access with public setters in component_tool.py
- Add set_current_output() public method to Component
- Fix send_event() to call put_nowait directly in sync context (no event loop)
- Fix _build_output_function/async to use getattr default fallback for non-component methods
- Fix tests to use constructor-based _id to survive __deepcopy__
- Add TypeError guard in _get_method_return_type for mocked methods
- Remove incorrect pytest.raises(ToolException) since handle_tool_error=True swallows it
* fix: handle array logs in switchOutputView and guard build_end/log events
- Export onEvent for testability
- Guard build_end event against missing data.id to prevent state corruption
- Type results as OutputLogType | LogsLogType[] in SwitchOutputView to handle
tool mode logs arriving as an array
- Guard resultType/resultMessage against array case to prevent crashes
- Add tests for onEvent log/build_end paths and appendLogToFlowPool store method
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* refactor: simplify /variables/detections to return only verified global variable names
Drop the two-tier detection model (load_from_db + password-field heuristics)
in favor of a single source: fields with load_from_db=True. Candidates are
cross-checked against the user's existing global variables before being
returned, preventing accidental secret leakage via template values.
- Remove DetectedEnvVar model and unresolved_ids from the response
- Flatten response to list[str] of verified global variable names
- Fail fast (404/422) on missing or malformed flow versions
- Add min_length=1 validation on flow_version_ids
- Update frontend types and consumers to match simplified response
* refactor: batch flow-version loading for variable detection
Reduce /variables/detections query fanout by fetching flow versions in one CRUD call and validating IDs up front in the request schema. Add a bounded filter-size guard in flow_version CRUD, keep payload-shape validation explicit in the endpoint, and align unit/API tests with the new batch helper path.
- Deduplicate DetectVarsRequest.flow_version_ids via schema validation
- Add get_flow_version_entries_by_ids() with MAX_VERSION_ID_FILTER_SIZE guard
- Replace per-ID flow-version lookups in detect_env_vars with one batch fetch
- Update detect-env-vars unit tests to mock the batch helper and cover dedup/validation paths
- Add CRUD guard test for oversized ID filters
- Update variable endpoint tests to patch get_flow_version_entries_by_ids
* feat(templates): replace AstraDB with native Knowledge Base in Vector Store RAG starter project
Swaps the AstraDB vector store components for Langflow's native
KnowledgeIngestion and KnowledgeBase components, removing the need
for external Astra credentials. Updates README and Load Data notes
to reflect the new components, removes the disconnected AstraDB node,
and updates the template tags accordingly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: clean up hardcoded local state from template export
- clear REDACTED api_key placeholder
- clear hardcoded knowledge_base name "release"
- clear hardcoded model options (populated dynamically at runtime)
* Sanitize the KB options
* Sanitize the KB options
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: ogabrielluiz <gabriel@langflow.org>
Co-authored-by: Eric Hare <ericrhare@gmail.com>
