mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-24 13:52:34 +08:00
rtce
18161 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| d70757976c |
chore: bump toml and package.json versions
bump toml and package.json versions |
|||
| b06f810f53 |
docs: add chroma cloud provider (#13122)
docs-add-chroma-cloud-provider |
|||
| 3e694305f9 |
fix: separate docling chunking dependencies (#13411)
* separate docling chunking * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix nitpicks * [autofix.ci] apply automated fixes * remove langchain docling dependency * add docling image description as an optional dep * [autofix.ci] apply automated fixes * fix line too long * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 7c01482fa1 |
fix(ci): lockstep langflow-nightly and langflow-base-nightly versions (forward-port #13413) (#13416)
fix(ci): lockstep langflow-nightly and langflow-base-nightly versions Forward-port of #13413 (merged to release-1.10.0) to main. pypi_nightly_tag.py now derives a single shared dev number from max(dev across BOTH langflow-nightly and langflow-base-nightly PyPI histories) + 1 (restricted to the root base_version) and emits it twice in `both` mode. nightly_build.yml reads the release and base tags from one invocation (single PyPI snapshot) and fails closed on mismatch, so the latest langflow-nightly always pins a langflow-base-nightly[complete]==X.Y.Z.devN that was built and published in the same run (no more uninstallable nightly). Safe to land now: the nightly create-nightly-tag job checks out the latest release-* branch for the script while taking the run-block from the triggering ref (main for scheduled runs). release-1.10.0 already carries the new script (via #13413), so main's `both` run-block matches it, and future release branches cut from main inherit the lockstep script. Adds scripts/ci/test_pypi_nightly_tag.py + .github/workflows/ci-scripts-test.yml and the update_pyproject_combined.py lockstep-invariant note. |
|||
| a875c1dfcf |
feat: sync wxO agent name and description with db (#13026)
* feat: add wxO agent name to api list items * feat: expose wxO agent metadata in deployment provider data Add a validated Watsonx Orchestrate deployment item provider_data contract that carries agent name, display name, description, tool IDs, environments, and detail-only LLM metadata. Use that shared contract in the adapter service and API mapper so list, get, sync, and snapshot binding paths parse provider metadata consistently and fail with structured internal errors when the adapter payload is invalid. Update unit coverage for list/get shaping, sync provider_data, optional LLM handling, empty tool IDs, and contract validation failures. * feat(deployments): rename deployment label to display name Rename deployment DB/local contracts from name to display_name so resource_key remains the provider identity and duplicate display labels are allowed. - Add Alembic migration to rename deployment.name, drop provider-scoped display-name uniqueness, preserve resource_key uniqueness, and restore downgraded names safely. - Update Deployment model, CRUD create/update/list/count paths, related attachment queries, validation, and conflict messages for display_name. - Remove deployment display-name conflict checks so duplicate labels can coexist under the same provider account. - Reject local DB names filters unless load_from_provider=true, keeping names as provider technical-name filtering only. - Update deployment API route handling and base/watsonx mapper response shaping to read display_name from local rows. - Update backend unit and integration tests across deployment CRUD, route handlers, mappers, sync, telemetry, flow/project responses, names filters, and attachment paths. * Update deployment API contract to use display_name Rename deployment REST request and response fields from name to display_name for Langflow-tracked deployments while preserving provider-only names filtering for load_from_provider=true. Map display_name through create, update, get, list, and status responses, and document that stored/displayed deployment names are synced from the provider. Update deployment mappers and route tests for the new contract, including rejection of DB-mode names filtering and integration coverage for local display_name responses versus provider name payloads. * feat: sync provider deployment display metadata - Rename deployment-facing name semantics toward display_name while preserving resource_key as the stable provider identity - Add provider metadata extraction contracts for list/get sync and wire routes through shared sync helpers - Sync provider-owned display_name and description into local deployment rows on list/get - Preserve updated_at during provider metadata sync so read reconciliation does not look like a local edit - Decouple wxO technical agent names from user-facing display labels by generating langflow_agent_<id> names - Stop changing wxO technical name when updating display_name or description - Remove duplicated display_name and description from wxO provider_data for Langflow-tracked responses - Require wxO provider display metadata instead of falling back to technical names - Wrap malformed wxO get metadata as deployment errors instead of leaking KeyError - Update deployment attachment listing/counting to ignore orphaned flow-version links - Normalize LFX deployment create/update names with non-empty string constraints - Add real SQLite CRUD coverage for metadata sync and orphaned attachment filtering - Add deployment integration coverage for get/list provider metadata sync into DB rows - Add wxO mapper, service, route, and schema tests for display metadata, generated technical names, and update behavior * feat: align deployment API with provider display names - Move tracked wxO deployment create/update labels out of top-level request fields and into `provider_data.display_name`. - Remove top-level `display_name` from tracked deployment list, get, create, and update responses so provider-owned labels are returned through `provider_data`. - Add wxO `provider_data.name` for the provider technical agent name and `provider_data.display_name` for the user-facing agent label in create/update/get/list response shaping. - Remove deployment-list `names` filtering from the REST route, mapper list params, synced list helper, DB list/count helpers, LFX list schema, and wxO service query params. - Change existing wxO agent onboarding to fetch the provider resource first and create only the local Langflow tracking row. - Reject create-time mutations when `provider_data.existing_agent_id` is used, including display/LLM/tool/flow changes and explicit description updates. - Seed local deployment `display_name` and `description` for existing-agent onboarding from provider metadata instead of request fields. - Add provider-specific mapper hooks to build local `Deployment` models and local update kwargs from validated provider payloads. - Add `create_deployment_from_model` so routes can persist mapper-built deployment rows without duplicating provider-specific field extraction. - Require `provider_data.display_name`, `provider_data.llm`, and at least one flow/tool operation for new wxO agent creation. - Preserve metadata-only update support while routing wxO display-name updates through `provider_data.display_name` and description updates through the public description field. - Include wxO technical deployment names in adapter create/update result payloads so API responses can expose provider technical names alongside display labels. - Truncate provider-synced deployment descriptions to the deployment description limit before storing local metadata. - Remove the tracked deployment status route/schema and mark wxO status lookup as not configured instead of inferring health from draft-agent metadata. - Tighten LFX update validation by rejecting explicit null technical names while still allowing explicit null descriptions. - Keep wxO config and snapshot list responses as validated provider payloads instead of collapsing empty payloads to null. - Update backend and LFX tests for provider-data display labels, removed top-level display names, removed deployment-name filters, existing-agent onboarding, status route removal, metadata sync truncation, and update validation. * add changes from mapper base * feat: generate managed wxO technical names - Generate Langflow-managed wxO agent technical names as `lf_<normalized_display_name>_<short_uuid>` - Reject display labels that cannot contribute a normalized name segment instead of falling back silently - Generate a fresh wxO technical name when an agent display label changes - Keep update payload branching explicit so description, LLM, and name updates only send intended fields - Use update retry semantics for wxO agent updates - Make wxO name validation errors use explicit field labels such as `Connection app id`, `Tool name`, and `Agent name` - Update wxO adapter and mapper tests for managed technical names and resource-specific validation messages * fix: separate wxO deployment technical names from labels - Keep adapter-level deployment name fields as provider technical names. - Move wxO user-facing labels to provider_data.display_name. - Let the wxO adapter generate Langflow-managed technical names when spec.name is omitted. - Use the langflow_ prefix with fresh UUID suffixes for generated wxO technical names. - Strictly validate explicit technical names without rewriting them. - Reject explicit null or blank values for technical name, display name, LLM, and description updates. - Allow symbol-only display names by falling back to the resource type for generated names. - Clarify fallback naming errors when both display name and resource cannot produce a valid segment. - Add display_name support to wxO create and update payload contracts. - Align mapper create and rollback behavior with adapter-owned technical name generation. - Preserve rollback behavior for blank descriptions by mapping them to null. - Update LFX deployment schemas for optional adapter name fields. - Fix the deployment rename migration dependency to keep Alembic on a single head. - Update deployment and wxO tests for the new name contract and validation behavior. * refactor: separate wxO tool display and technical names - Replace user-facing wxO tool label inputs with tool_display_name in create, update, and rename payload contracts. - Remove mapper-side wxO tool technical-name normalization and validation, so user labels are no longer treated as provider technical names. - Add wxO flow-artifact provider-data validation that requires tool_display_name and generates provider_data.tool_name when omitted. - Keep provider_data.tool_name as the adapter-owned wxO technical name and provider_data.tool_display_name as the user-facing label. - Use generated provider_data.tool_name as the raw tool correlation key for tools.raw_payloads and operations[*].tool.name_of_raw. - Keep top-level raw BaseFlowArtifact.name separate from wxO technical names instead of overloading it for provider correlation. - Add mapper-local grouped flow-tool payload data containing display_name, provider_data, and raw_name for each flow version. - Build wxO flow tool provider_data through the adapter payload slot instead of a mapper-owned artifact schema. - Add create/update adapter payload builder helpers that validate provider payloads through the configured adapter slots. - Convert adapter-bound payload validation failures during mapper construction into internal contract errors rather than client 422s. - Remove the generic base mapper create-flow-artifact provider-data helper because wxO now owns provider-specific tool metadata. - Update create flow mapping to derive default tool_display_name from the flow name and generate technical tool names internally. - Update update flow mapping to derive tool_display_name for raw flow payloads and emit rename_tool only for existing attached tools. - Preserve bind, unbind, attach, remove, and rename operation behavior while switching raw selectors to generated technical names. - Add flow-version provider-data shaping that exposes app_ids, technical tool_name, and user-facing tool_display_name. - Require snapshot/list item provider data to include both technical name and display name so corrupt provider data fails fast. - Update deployment flow-version schema documentation to tell clients to display provider_data.tool_display_name and treat provider_data.tool_name as technical metadata. - Update wxO create/update planning to key raw tools by provider_data.tool_name instead of BaseFlowArtifact.name. - Update wxO tool creation to set wxO name from provider_data.tool_name and wxO display_name from provider_data.tool_display_name. - Remove redundant downstream None checks for tool_name and tool_display_name after schema validation guarantees them. - Remove the raw-tool-name helper and direct None filtering now that tool_name is generated by the provider-data schema. - Rename provider rename operation payload from new_name to tool_display_name. - Generate technical names for rename updates from tool_display_name rather than using the display label as the provider name. - Load current agent tools once during update apply and reuse that tool map for connection deltas, renames, and connection pre-seeding. - Consolidate existing-tool connection deltas and renames into one helper with separate delta and rename loops and one provider update batch. - Ensure a tool with both connection changes and a display-name rename is updated once using a single merged writable payload. - Preserve rollback snapshots for existing tools before connection or rename mutations are applied. - Pre-seed resolved connection ids from loaded agent tool bindings while letting explicit operation resolution overwrite provider-seeded values. - Keep later provider binding values for duplicate app ids during pre-seeding, matching explicit update overwrite semantics. - Add snapshot provider-data extraction in the wxO service that carries technical name, display name, and Langflow connection bindings. - Update mapper tests for create raw tool payloads, display-name overrides, generated technical names, raw correlation, and rename operations. - Update adapter schema tests for raw tool pools keyed by generated provider technical names and required display-name provider data. - Update service/update tests for rename batching, loaded-tool reuse, connection delta preservation, rollback behavior, and ownership checks. - Update snapshot and flow-version response tests to assert both technical and display tool metadata. * feat(deployments): sync provider display metadata - BE `api/v1`, `mappers/deployments`: Source local deployment create and update metadata from provider adapter results so `display_name` and `description` stay aligned with authoritative provider state. - BE `mappers/deployments`, `database/models/deployment`: Replace the removed deployment metadata schema with mapper-owned CRUD kwargs for list/get/update sync while preserving flexible provider-specific metadata handling. - BE `mappers/deployments`, `database/models/deployment`: Add description truncation with structured callsite/provider logging and log actual DB metadata sync writes with changed fields and before/after lengths. - BE `database/models/deployment`: Keep DB metadata sync focused on real changes so provider descriptions truncated locally do not cause unnecessary writes when cached values already match. - BE `services/adapters/deployment/watsonx_orchestrate`: Update wxO create/update result contracts to include provider display metadata, technical `name`, descriptions, and snapshot/tool binding details consistently. - BE `services/adapters/deployment/watsonx_orchestrate`: Build wxO create agent payloads once before provider create, carry the resolved provider description into create results, and keep wxO description fallback behavior explicit. - Both BE `services/adapters/deployment/watsonx_orchestrate` and FE `deploymentsPage`: Separate wxO technical names from user-facing display labels across adapter results, UI payloads, and tests. - FE `controllers/API/queries/deployments`, `deploymentsPage`: Move deployment create/update payloads to `provider_data.display_name` and `tool_display_name`, removing stale top-level `name` and `tool_name` usage. - FE `deploymentsPage`, `deploy-choice-dialog`: Default tool display names to the flow name instead of generated technical suffixes, and use keyed selected flow versions to distinguish repeated flow attachments. - FE `deploymentsPage`, `deploy-choice-dialog`: Update deployment attachment and deploy-choice dialog flows to use selected-flow-version keys, provider tool display names, and current flow names consistently. - FE `controllers/API/queries/deployments`, `deploymentsPage`: Remove provider name-check hooks, wxO name-normalization helpers, and related validation tests now that display names are not technical identifiers. - FE `deploymentsPage`: Relax deployment display-name validation to require only non-empty input, allow edit-mode display-name changes, and send changed display labels through `provider_data.display_name`. - FE `deploymentsPage`: Make deployment display/technical-name helpers null-safe when provider data is missing, with resource-key fallbacks for table, details, delete, and test flows. - FE `deploymentsPage`: Update deployments page UI to render display names separately from technical names and avoid exposing descriptions in table rows. - FE `controllers/API/queries/deployments`: Align create, patch, list, and attachment query types with provider metadata and `tool_display_name` contracts. - LFX `services/adapters/deployment`: Align deployment create results with the provider metadata contract by carrying type, technical name, and description instead of stale config/snapshot result fields. - BE `database/models/deployment`: Add a TODO for DB-level length enforcement of provider-synced display metadata. - Tests `src/backend/tests`, `src/frontend/**/__tests__`, `src/lfx/tests`: Add/update coverage for provider metadata sync, truncation, update persistence, response shaping, display-name validation, keyed attachments, and nullable provider data. * fix: tighten watsonx deployment payload contracts - Remove snapshot-name filtering from deployment snapshot listing: - Drop the `names` query parameter from the API route. - Remove `snapshot_names` from `SnapshotListParams`. - Remove wxO snapshot-name normalization and service lookup paths. - Remove direct E2E scenarios and unit coverage for snapshot-name listing. - Make wxO deployment provider data match the provider API contract: - Require wxO agent list/detail payloads to include `tools` and `llm`. - Read `agent["tools"]` and `agent["llm"]` directly instead of defaulting or normalizing missing provider fields. - Include `llm` in deployment list/provider-data shaping. - Preserve provider-owned strings instead of silently stripping or dropping blanks in result payloads. - Tighten wxO API and adapter payload validation: - Replace ad hoc string validators with shared non-empty string annotations where appropriate. - Reject explicit `null` for update scalar fields such as `llm` and `display_name`. - Require non-empty provider ids, tool ids, app ids, model names, environments, and execution ids in wxO payload schemas. - Fix wxO update payload patch semantics: - Build provider update bodies using `model_fields_set` so omitted `llm` and `display_name` stay omitted. - Keep `exclude_unset=True` for validated update payload serialization. - Preserve LLM-only update behavior without emitting omitted scalar fields as explicit nulls. - Simplify wxO update planning and rollback: - Remove `extract_agent_tool_ids` and rely on the wxO agent `tools` field directly. - Fetch only existing tools that update operations mutate or rename. - Stop pre-seeding connection bindings from unrelated attached tools; operation app ids now resolve through explicit update operations. - Adjust wxO deployment listing behavior: - Treat singular `environment` as a strict local filter. - Leave plural provider parameters as provider passthrough. - Rename deployments table header from `Name` to `Display Name`. - Update tests for the new contracts: - Remove snapshot-name route, mapper, service, and E2E coverage. - Add/update coverage for required `llm`, required provider metadata, null update scalar rejection, stale snapshot handling, and provider-owned string preservation. - Update frontend table header expectations. * direct key access in tool logs * fix(deployments): preserve full deployment descriptions - Remove provider metadata sync logging that emitted deployment identifiers and field length changes. - Remove description truncation from deployment mapper contracts and Watsonx metadata mapping. - Remove the deployment description max-length cap from LFX schemas, Langflow API schemas, and database CRUD validation. - Pass provider descriptions through unchanged during create, update, list, and get metadata sync flows. - Update backend, integration, and LFX tests to assert long descriptions are accepted and preserved. * refactor(deployments): centralize mapper payload slot validation - Move shared API request and adapter slot parsing into BaseDeploymentMapper. - Add provider label enforcement so mapper subclasses fail fast when error text cannot identify the provider. - Add outer request validation support for provider_data slots and map validation failures to 422 responses. - Move wxO existing-agent description conflict validation into the wxO create payload contract. - Update wxO mapper call sites to use the shared base parsing helpers. - Add focused tests for provider label enforcement, slot error mapping, outer request validation, and existing-agent description conflicts. * fix downgrade migration to actually recover unique constraint for the name column * fix(deployments): clarify wxo deployment name labels - Rename user-facing wxO deployment display-name labels from "Display Name" to "Name" across the deployment form, review step, table, loading state, and details modal. - Label the provider-backed technical identifier as "Technical Name" in deployment details so it is distinct from the editable display name. - Restore deployment descriptions under the deployment name in the deployments table. - Align validation copy and frontend tests with the updated label behavior. * fix(deployments): validate snapshot patch project scope - Reuse the existing deployment project-scope validator in the snapshot patch route before resolving provider credentials or mutating wxO artifacts. - Enforce that replacement flow versions belong to the tracked deployment project while keeping different-flow snapshot updates allowed. - Add route coverage proving project validation uses the deployment row's project_id and short-circuits before provider adapter work. - Update stale wxO mapper and sync test expectations for the current provider-data contract and mapper error messages. - Verified backend deployment tests and isolated lfx deployment tests are green. * test(deployments): align list integration tests with current API Update deployment list integration tests after removal of the names query parameter and list items without a top-level display_name. Assert synced display names via refreshed DB rows and provider entries instead of response fields that no longer exist. * rename test file * rename test file * fix(deployments): tighten wxo provider metadata contract Trust required wxO API fields directly, remove duplicate deployment names from provider_data, and keep mapper output sourcing names from top-level deployment metadata. * fix(deployments): preserve provider display names in db Keep deployment display names exactly as received while still rejecting blank values, and continue normalizing resource keys for DB lookups. * fix(deployments): align patch payload and display_name schema Send provider_data.llm only when changed in deployment PATCH payloads, preserving granular update behavior and no-op fallback semantics. Keep deployment.display_name nullable across migration/model paths and align wxO snapshot tests with the required display_name provider contract. * fix test * chore: remove updates to e2e adapter tests, defer to a follow up PR * refactor(deployments): simplify wxO provider list shaping Flatten provider list entries directly from adapter provider_data and validate once via parse_adapter_slot on deployment_list_result. Remove redundant per-item schema validation, id strip filtering, and description guesswork; require provider_data to be a dict and let canonical item fields override provider payload. * simplify downgrade migration to always append deploymend id to the name * fix(wxo): keep mapper imports free of IBM SDK via payloads Move Watsonx naming and field validation helpers into payloads.py so mapper -> payloads no longer imports utils.py and its IBM client deps. Point core modules and tests at the shared payload helpers and leave utils.py for runtime error/utility helpers only. * fix(watsonx): lazy adapter package imports and explicit registration Move adapter registration into register.py so importing payloads or the mapper does not load optional IBM SDK modules via package __init__.py. Use lazy package exports for service and types, dedupe update result IDs in WatsonxDeploymentUpdateResultData, and use direct BaseFlowArtifact field access in flow tool creation. * fix(test): align Watsonx guards with lazy package imports Skip SDK-backed service tests via importorskip on IBM packages instead of importing the lightweight watsonx_orchestrate package. Run schema and mapper tests against payloads directly and remove obsolete module-level skips so Py 3.10 CI can collect SDK-free Watsonx tests. * fix(test): skip explicit Watsonx modules without IBM SDK Guard Watsonx-named schema and mapper test modules by importing WatsonxOrchestrateDeploymentService, which exercises the lazy package export and fails when optional IBM SDK dependencies are unavailable. * fix(test): align deployment E2E mocks and review-step expectations Add provider_data.display_name to deployment mocks so delete and edit tests match getDeploymentDisplayName. Update review-step Playwright tests for display-name behavior that no longer blocks deploy on duplicates or numeric flow names. * fix ff test * fix(deployments): hide technical name in details and fix migration chain Show only the display name in the deployment info grid. Point the display_name rename migration at f6b3ce6845d4 so Alembic ordering is correct. * fix down revision * fix ruff * fix playwright test * fix(deployments): send only changed PATCH fields and trust API display names Stop re-sending unchanged description on update and skip the PATCH when there are no changes. Resolve UI labels from provider_data.display_name only, without resource_key or technical name fallbacks. * fix(deployments): restore i18n labels and polish edit-save UX Restore deployments.labelName/columnName and related keys instead of hardcoded English. Show an em dash when display_name is missing, remove dead toolNameErrors code, and toast when edit save has no changes. * fix(deployments): scope snapshot list and patch to deployment owner Remove the actor-owned provider lookup before deployment resolution so collaborators with READ on a shared deployment can list snapshots. Validate replacement flow versions under owner_id on snapshot PATCH, not the actor. * fix(test): deployment edit E2E and Biome import order Edit stepper skips PATCH when there are no changes, so the E2E test updates the deployment name before submit. Organize imports in select-gpt-model.ts for Biome. * fix(deployments): align provider metadata sync with RBAC owner scope Match metadata batch updates on (deployment id, owner user_id) so shared deployment list/get sync writes in the owner's namespace. Stop rolling back the outer session when attachment sync fails on GET so provider display_name/description sync is preserved. Group list attachment reconcile by deployment owner and use row.user_id for stale deletes. * fix(test): align deployment sync mocks with row owner scope Add user_id to deployment row mocks so list_deployments_synced tests match per-owner delete and metadata batch behavior. Remove unused imports in the deployment step-type component. * [autofix.ci] apply automated fixes * revert(deployments): restore rollback, direct metadata keys, single-owner list sync Per PR review: bring back outer session rollback on GET attachment-sync failure, fail fast on provider metadata dict access, and use a single user_id for list attachment reconcile (N+1 per-owner grouping deferred). Owner-scoped metadata batch updates in CRUD are unchanged. * update down revision * fix(frontend): remove unused i18n import in step-review utils Drop leftover import after refactor so Biome check passes. --------- Co-authored-by: himavarshagoutham <himavarshajan17@gmail.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| af38e99852 |
fix: Resolve API keys from global variable before .env (#13408)
resolve env variable from global vars or .env |
|||
| 82f3fa10d4 |
docs: memory base feature and component (#13094)
* developer-page * release-notes-and-sidebar * memory-base-component * fix-broken-link * use-absolute-links * peer-review * fix-broken-link * docs: include additional preprocessing examples * docs: memory base typo |
|||
| be7edcbda1 | chore: unconstrained lfx version for bundles (#13415) | |||
| dbe482c800 |
fix(ci): lockstep langflow-nightly and langflow-base-nightly versions (#13413)
* fix(ci): lockstep langflow-nightly and langflow-base-nightly versions
The nightly pipeline computed each package's .devN number independently
(pypi_nightly_tag.py queried each package's own PyPI history and
incremented separately), while langflow-nightly pins an exact
langflow-base-nightly[complete]==X.Y.Z.devN dependency. Because
langflow-nightly publishes on more nights than langflow-base-nightly,
the two counters drift (live: dev54 vs dev48). Each time base lags a
publish while main succeeds, the newest langflow-nightly pins a base
dev that does not exist yet, so 'uv pip install langflow-nightly'
becomes unsatisfiable and silently falls back to a weeks-old version.
Fix: version the two packages in lockstep. pypi_nightly_tag.py now
derives a single shared dev number from max(dev across BOTH packages'
PyPI histories) + 1 (restricted to the root base_version), so main and
base always get the identical tag and main's exact pin always
references a base version built and published in the same run. The tag
is computed in a single invocation ('both' mode) so the release and
base tags cannot drift across separate calls.
Also hardens tag computation: 404 / network / malformed responses for
either package now contribute nothing instead of crashing, a
base-version bump resets the dev counter cleanly, and non-dev/final
releases never advance it.
Adds scripts/ci/test_pypi_nightly_tag.py (unit tests) and a
ci-scripts-test.yml workflow to run scripts/ci tests on PRs.
* fix(ci): fail closed on non-404 PyPI errors in nightly tag computation
_all_dev_numbers() previously returned [] for ANY failure (network error,
non-404 HTTP status, malformed 200), which is unsafe: _shared_nightly_version()
takes max(dev)+1 across both packages, so a transient lookup failure on the
higher-versioned package silently LOWERS the next tag. E.g. if the langflow-nightly
lookup fails while langflow-base-nightly reports dev48, the script would emit
v1.10.0.dev49 even though langflow-nightly already published through dev54 — the
workflow then force-recreates an old git tag and fails publishing an already-existing
PyPI version.
Fail closed: only a true 404 (package has no releases) contributes []; network
errors, 5xx/non-404 statuses, and malformed 200s now raise so the nightly job aborts
before mutating tags. Adds tests for malformed/5xx/network failures and a direct
regression test for the higher-package-lookup-failure scenario.
* Update scripts/ci/test_pypi_nightly_tag.py
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Update test_pypi_nightly_tag.py
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
|
|||
| 58a75ffb0d |
feat(ci): reduce macOS Intel CI matrix and add macOS support documentation (#13328)
feat(ci): reduce macOS Intel CI matrix and add macOS support docs - Remove Python 3.10 from macOS Intel stable CI matrix (keep 3.12 only) - Add comprehensive macOS support documentation - Document Python 3.14 support status (limited on Intel, no PyTorch) - Reduces CI costs by ~$5-7 per run (~$1,800-2,500/year) Implements LE-781 recommendations R2 and R3 from LE-265 investigation. Related: LE-265, PR #12477 |
|||
| 663fa5ed0a |
docs: fixes for consulting advantage (#13300)
* docs: lock mcp server management * docs: restrict custom components to superusers * docs: embedded mode to hide UI elements * docs: add custom component admin restriction |
|||
| d4013e30b8 |
feat(i18n): translate missing frontend strings across Memories, Knowledge Base, toasts, and notifications (#13279)
* feat(i18n): translate missing frontend strings for flow list and DB Providers page - Wrap "Edited X ago" timestamp in flow list with t() using new mainPage.editedAgo and mainPage.timeElapsed.* keys (plural forms) - Add settings.nav.dbProviders and settings.dbProviders.* keys covering page title, description, badges, button labels, and all toast messages - Wire useTranslation into DBProvidersPage, ProviderListItem, ProviderConfigurationPanel, TextFieldRow, BooleanFieldRow, and dbProviderInputComponent - Download updated translations for fr, ja, es, de, pt, zh-Hans Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(i18n): translate DB provider descriptions and config field labels Add translation keys for all provider descriptions (Chroma Local, Chroma Cloud, OpenSearch, Astra DB, MongoDB Atlas, Postgres pgvector) and all configField labels and helperTexts (API Key, Tenant, Database, Region, Cluster URL, Username, Password, index/vector/text fields, TLS toggles). Use dynamic key lookup with defaultValue fallback so new providers degrade gracefully. Download updated translations for all six locales. * [autofix.ci] apply automated fixes * feat(i18n): translate missing strings in Memories, Knowledge Base, toasts, and notifications - Translate untranslated strings in Knowledge Base upload modal (DB Provider label/description, Metadata section) - Translate all Memories feature strings (sidebar, create modal, detail header, chunk table, empty states) - Wire all hardcoded toast/notification strings through t() across 14 files (flow store, model provider, deployments, update components, shortcuts, file manager, dict/JSON editors, utils) - Delete orphaned alerts_constants.tsx (all imports already removed) - Add ~100 new keys to en.json across memory, errors, deployments, shortcuts, updateComponents, and files namespaces - Upload to GP and download all 6 translated locale files (fr, ja, es, de, pt, zh-Hans) * fix(i18n): translate Memories tooltip in left panel nav * fix(ui): left-align card description text on empty page * feat(i18n): translate hardcoded strings across UI components and update locale files Wraps ~100 hardcoded strings in t() calls across 45 source files covering voice assistant, deployments, flow build, playground, assistant panel, knowledge base ingestion, inspection panel, IO modal, and more. Adds corresponding keys to en.json and syncs all locale files (fr, de, es, pt, ja, zh-Hans) via the GP pipeline. Also fixes a React 19 RefObject<T | null> type mismatch in visual-variants.ts. * [autofix.ci] apply automated fixes * fix(i18n): translate shortcut success/error messages with proper name i18n Added shortcuts.successChanged and shortcuts.successReset keys so success toasts display the translated shortcut name via shortcuts.name.* lookup. Updated EditShortcutButton to use existing translated error keys and the new success keys with toCamelCase name resolution. * fix(i18n): translate "or visit" and "+N more" in file upload modal * fix(i18n): translate NoteNode context menu and fix missing vector store RAG note translations - Add t() calls to NoteNode select-items.tsx for Duplicate/Copy/Docs/Delete menu items - Fix docsUnavailable notice string in NoteToolbarComponent - Download missing fr/ja translations for template_notes.vector_store_rag keys from GP * fix(i18n): translate Delete label in edge context menu * fix(i18n): translate Version History Export/Delete menu and preview overlay strings - VersionListItem: replace hardcoded Export/Delete with t("flow.menu.*") - VersionPreviewOverlay: replace hardcoded Current Flow, Previewing, (Read-Only), Loading preview... with t("version.*") calls - Add 4 new keys to en.json; upload to GP and download all locale translations * fix(i18n): translate hardcoded strings in Update Components modal Replace Component/Update Type headers, Breaking label, and modal title with t() calls; add 5 new keys to en.json and sync all locale translations * fix(i18n): translate assistant panel hardcoded strings - model-selector: replace "Loading..." and "Select model" with t() calls - assistant-panel.constants: convert getAssistantPlaceholder() to use i18n.t() with 5 keyed placeholder variants - messages.ts: replace 48 hardcoded progress/thinking strings with i18n key arrays (8 thinking + 5 groups × 8 progress); VALIDATION_FAILED/RETRYING arrays were dead code and removed - Add 55 new keys to en.json; upload to GP and download all locale translations * [autofix.ci] apply automated fixes * fix(i18n): update sidebarSegmentedNav test to expect i18n key for memories The memories nav item was updated to use "memory.sidebarTitle" as its label/tooltip i18n key, but the test still expected the old hardcoded "Memories" string. * fix(i18n): replace deleted alerts_constants import with t() calls in PageComponent The release-1.10.0 merge re-introduced an import from alerts_constants which was deleted in Phase 1 of the i18n migration. This crashed the Vite dev server, causing all Playwright tests to fail on startup. Also fixes Biome import order in use-session-history.ts from the merge conflict resolution. * fix(i18n): restore ASSISTANT_PLACEHOLDERS export and translate formatDate fallback - Re-export ASSISTANT_PLACEHOLDERS as translated strings computed from keys so getAssistantPlaceholder() returns from the array (restores test contract) - formatDate() now returns i18n.t("memory.never") instead of "" for the empty-date fallback --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| fefa4262ae | docs: bump python version reqs to 3.14 and add release note (#13289) | |||
| 31b7a4cd05 |
fix: improve trace search functionality (#13383)
* improve trace search functionality * [autofix.ci] apply automated fixes --------- Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 4a700dc5d1 |
fix(playground): expand session checkbox click target to full row height (#13349)
* fix(playground): expand session checkbox click target to full row height The selectable-row checkbox wrapper was ``w-4 h-4`` (16x16 px) but the row is ``h-8`` (32 px). The 8 px band above and the 8 px band below the visible icon were dead zones that bubbled to the row's ``toggleVisibility`` and navigated to the session instead of toggling selection — exactly the accidental-navigation UX the bug ticket describes. Grow the wrapper to ``w-4 h-8`` so the click target captures the full row height. Width stays narrow so the text alignment is unchanged; the icon itself stays ``h-4 w-4``, centered via the existing ``flex items-center justify-center``. Visual position is identical. Adds ``__tests__/session-selector-checkbox-click-target.test.tsx`` (3 cases): wrapper className guard (h-8 + w-4, not h-4), click on the wrapper outside the icon triggers selection without bubbling to toggleVisibility, and click on the inner icon still toggles selection. * test(playground): drop checkbox-click-target test file (not needed per review) * [autofix.ci] apply automated fixes * test: align session-selector checkbox assertions with full-height click target --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 2f682eb020 |
docs: agent improvements (#13269)
* docs: add structured output for agents * docs: add structured output note * docs: clarify both agent outputs and add release notes * docs: when langflow sends events to the playground and chat history |
|||
| 4e6981368c |
fix(traces): full-height trace panel, and status badge position (#13385)
* fix(traces): full-height trace panel, and status badge position * [autofix.ci] apply automated fixes --------- Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 3f62caff8f |
test(e2e): Replace non-terminal waits to fix flaky Windows specs (#13407)
* fix assistant test on windows * improve slider component test |
|||
| 39bb3a12ca |
ci: isolate bundle installs from the core release gate; lazy-import ibm-db (#13402)
* ci: isolate bundle installs from the core release gate; lazy-import ibm-db
Two follow-ups to wiring lfx-ibm (and future native-dep bundles) into the
nightly/release pipeline.
1. cross-platform-test.yml: split the monolithic "Install packages from
wheel" step (in both the stable and experimental jobs) into three:
- core install (SDK/LFX + langflow-base) -- release gate
- per-bundle bundle install -- NON-BLOCKING (continue-on-error), reports
per-bundle pass/fail to the GitHub step summary
- langflow main install -- release gate
A bundle whose dependency has no wheel on a tested platform is now reported
as "failed (non-blocking)" instead of failing the whole nightly/release
publish. Local bundle wheels are still installed before main, so langflow
resolves its bundle deps from the freshly-built wheels rather than PyPI.
NOTE: a bundle that langflow hard-depends on is still pulled (and thus
gated) by the main install; to make a bundle optional on a platform, also
add a PEP 508 marker to its dependency line in langflow's pyproject.toml.
2. lfx-ibm: import ibm_db_dbi lazily inside DB2VS.__init__ (db2vs.py) instead
of at module top level, mirroring db2_vector.build_vector_store. ibm-db
ships no linux/aarch64 wheel, so the bundle now imports on that arch (only
the DB2 vector store is inert there; the watsonx components keep working).
Guard the driver-dependent test modules (test_db2vs, test_db2_vector) with
a module-level skip when ibm_db_dbi is unavailable, matching the existing
watsonx test pattern so they no longer error at collection on linux/aarch64.
Verified locally: 59 DB2 tests pass with ibm-db present; with ibm-db absent
the bundle imports cleanly, DB2 use raises a clean ImportError, and the
guarded test modules skip (9 passed, 2 skipped, 0 errors). actionlint adds no
new shellcheck findings vs HEAD; ruff check/format clean.
* fix: Remove long comments for bundle deps (#13403)
* [autofix.ci] apply automated fixes
* ci: revert bundle-install restructure to blocking; add ibm-db import regression test
Addresses two review findings on the lfx-ibm bundle changes.
1. Revert the cross-platform-test.yml bundle-install restructure. The
non-blocking per-bundle step could let the main install satisfy a hard-dep
bundle from PyPI (the index was not disabled), masking a broken local build,
and it never actually protected hard-dep bundles -- main re-gates them
anyway. Restore the original blocking, install-by-path step (local bundle
wheels install before main, so the gate is reliable and PyPI cannot
substitute). Document the real isolation lever for a genuinely
platform-optional bundle -- a PEP 508 marker on its dependency line in the
root pyproject -- in src/bundles/PORTING.md.
2. The module-level skip hid the importability regression the lazy import was
meant to guard. Add test_optional_dependency.py: it simulates ibm-db's
absence and asserts db2vs + the bundle package import and that DB2 use
raises a clean ImportError -- it runs on every platform, including the
x86_64 CI runners. Replace the module-level skips in test_db2vs.py /
test_db2_vector.py with class-level skipif on the DB2-driver test classes
only, so the helper tests and the module-level imports still run (and assert
importability) where ibm-db is absent.
Verified: with ibm-db present, 112 bundle tests pass. With ibm-db uninstalled
(the real linux/aarch64 case, find_spec -> None), 67 pass / 45 skip / 0 errors
-- the regression tests and helper tests run, only the driver-dependent classes
skip. actionlint reports no new findings; ruff check/format clean.
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
|
|||
| 60e2ea874d |
feat: add MCP timeout configuration support (#12999)
* feat: add per-component MCP tool execution timeout override - Add mcp_tool_execution_timeout global setting (180s default) - Add FloatInput in MCP component for per-component timeout override - Update MCPStdioClient and MCPStreamableHttpClient to accept timeout parameter - Implement timeout fallback logic: component → global → 180s default - Add comprehensive unit tests for timeout configuration This complements the mcp_server_timeout setting (PR #12996) by allowing per-component customization of tool execution timeouts, supporting long-running MCP operations (>30s). Related to customer issue TS021996258 (Verizon). * fix: preserve client timeout and validate negative values - Only update client timeout when tool_execution_timeout is not None - Properly set timeout on mcp_sse_client when used as alias - Add validation to reject negative timeout values in MCP component - Add comprehensive tests for timeout preservation, SSE client, and validation Fixes issues where: 1. Passing None would overwrite existing client timeouts 2. mcp_sse_client wouldn't receive timeout updates 3. Negative timeout values were accepted without validation * feat: add configurable MCP tool execution timeout with backward compatibility - Add mcp_tool_execution_timeout setting (default: 180s) for long-running MCP tools - Implement 3-tier timeout fallback: component > global setting > max(mcp_server_timeout, 180) - Include timeout in cache keys to prevent stale cached tools from bypassing per-component timeouts - Add comprehensive test suite (33 tests) covering timeout configuration, backward compatibility, and cache behavior - Preserve existing deployments: when mcp_tool_execution_timeout is unset, falls back to max(mcp_server_timeout, 180) Fixes: TS021996258 (Verizon - long-running MCP tool timeouts) Co-authored-by: autofix.ci <autofix@autofix.ci> * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] * [autofix.ci] apply automated fixes (attempt 2/3) * fix: align mcp timeout coverage and component validation * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] * fix(mcp): resolve timeout execution bugs and add validation testing * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] --------- Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> Co-authored-by: autofix.ci <autofix@autofix.ci> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| f8ada15e2a |
feat(components): Add IBM DB2 Vector Store component (#13237)
* feat(ibm): add DB2 Vector Store component Add comprehensive IBM DB2 Vector Store integration for Langflow. Components Added: - DB2VectorStoreComponent: Main vector store component - DB2VS: LangChain-compatible vector store implementation - DB2 security validators: Input validation and sanitization Features: - Vector similarity search (Similarity, MMR, Similarity Score Threshold) - Secure connection handling with input validation - Metadata filtering for complex data types - Duplicate detection support - Batch document ingestion Test Coverage: - 41 unit tests (38 passing, 3 skipped) - Component integration tests - Security validation tests - DB2VS class tests Documentation: - Comprehensive developer guidelines * refactor(db2): simplify component to match Chroma patterns - Remove complex data ingestion (CSV, DataFrame, dict, Message handling) - Add _add_documents_to_vector_store() method matching Chroma - Add similarity_score_threshold search type - Simplify data ingestion from 220 to 45 lines (80% reduction) - Add 5 new tests (similarity_search, mmr_search, search_with_different_types, duplicate_handling, metadata_filtering) - All 41 tests passing (38 passed, 3 skipped) BREAKING CHANGE: Component now only accepts Data objects for ingestion. * ci: fix CI failures - update component index and starter projects - Regenerate component_index.json with DB2 component - Update all starter projects with new component registry - Fix ruff formatting issues * ci: trigger CI re-run to fix merge issue * ci: add merge conflict resolution for component_index.json in autofix workflow Handle merge conflicts in the Update Component Index job by: - Automatically resolving component_index.json conflicts using --theirs strategy - Failing if non-generated files have conflicts (requires manual resolution) - Completing the merge after resolving generated file conflicts This prevents the workflow from failing when component_index.json has conflicts during PR updates, as this file is auto-generated and can be safely regenerated. * fix: Remove DB2SQLComponent reference from IBM components - Removed DB2SQLComponent from __init__.py as the db2_sql.py module doesn't exist - This fixes the test_all_modules_importable test failure - Fixes CI failure in Unit Tests - Python 3.14 - Group 5 * revert: Remove unrelated starter project JSON changes * revert: Remove unrelated CI workflow and formatting changes * docs: add DB2 Vector Store .mdx documentation following Chroma DB structure * fix: address CodeRabbit review comments - add __init__.py docstring and implement score threshold filtering - Added docstring to src/backend/tests/unit/components/__init__.py to fix Ruff INP001 error - Added FloatInput score_threshold parameter (default 0.5) to DB2 Vector Store component - Implemented threshold filtering in similarity_score_threshold search mode - Filters results to only include documents with relevance scores >= threshold * chore: remove auto-generated and unnecessary files from PR - Remove uv.lock (dependency lock file - auto-generated) - Remove src/frontend/package-lock.json (frontend lock file - auto-generated) - Remove src/lfx/src/lfx/_assets/component_index.json (auto-generated by CI) - Remove .secrets.baseline (security baseline - auto-generated) - Remove starter_projects JSON (auto-generated example) - Remove tweaks_builder.py (unrelated test helper) Per DEVELOPMENT.md guidelines, these files should not be committed by contributors. * chore: restore auto-generated files to keep PR focused on DB2 component * fix(ci): update auto-generated files and fix docs build - Update component index with new IBM DB2 components (363 components, 97 modules) - Update frontend package-lock.json - Fix docs build by removing reference to missing image in bundles-db2.mdx Fixes CI failures: - Update Component Index - Update Starter Projects - Test Docs Build * feat(db2): add SSL/TLS support to DB2 Vector Store component - Add SSL/TLS encryption support for DB2 database connections - Add SSL certificate validation and download functionality - Support local certificate files (.crt, .pem, .cer) and URLs - Add optional certificate password support for encrypted keystores - Implement automatic cleanup of temporary downloaded certificates - Add comprehensive error handling and logging for SSL connections - Update component_index.json with new SSL configuration inputs - Update package-lock.json dependencies Security improvements: - Validate certificate paths and file permissions - Support system default CA certificates (recommended for IBM Cloud DB2) - Redact sensitive information in error messages - Clean up temporary files on connection failure This enhancement enables secure encrypted connections to DB2 databases, which is recommended for production environments. * [autofix.ci] apply automated fixes * refactor(db2): minimize metadata storage in DB2 vector store - Clear metadata before storage to reduce unnecessary data (file_path, filename, etc.) - Return only text content during retrieval for cleaner results - Optimize list comprehension for better performance (PERF401, RET504) * test: remove skipped tests from DB2 vector store test suite - Removed version compatibility tests for versions where component didn't exist - Changed file_names_mapping to return empty list for new component - Overrode base class version tests to prevent skips - Fixed linting issues (hardcoded passwords, nested with statements) - All 40 tests now pass with 0 skipped tests * fix(tests): update DB2 vector store test description format Fixes test_component_metadata assertion to match the actual component description format. The test was failing due to line wrapping differences in the multi-line description string. Fixes CI failure in PR #13163 * [autofix.ci] apply automated fixes * chore: trigger CI re-run to resolve flaky test failures * fix(tests): mark OpenAI-dependent test as api_key_required to prevent CI failures * restructure as new bundle package * [autofix.ci] apply automated fixes * fix(ibm): improve DB2 Vector Store component reliability and validation * fix: implement SSL/TLS toggle functionality for DB2 Vector Store - Add update_build_config method to dynamically show/hide SSL certificate fields - SSL certificate path and password fields now only visible when use_ssl is enabled - Improves UX by hiding irrelevant fields when SSL is disabled - Update component_index.json with new component configuration - All 38 existing tests pass --------- Co-authored-by: Dhruv Chaturvedi <dhruv_insights@mac.lkw-in.ibm.com> Co-authored-by: Dhruv Chaturvedi <dhruv_insights@Dhruvs-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: priyanshu-krishnan1 <priyanshu.krishnan1@ibm.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| f400102088 |
ci: disable pip/venv DB migration test while langflow-nightly is pip-uninstallable
The PyPI langflow-nightly is currently pip-uninstallable: its core bundle deps (lfx-arxiv, lfx-duckduckgo) pin stable lfx>=0.5.0,<0.6.0, but stable lfx tops out at 0.4.4 (the 0.5.0 line ships only as lfx-nightly, a separate package name that cannot satisfy an lfx pin). So the pip/venv migration job fails at the install step. The Docker Compose migration job is unaffected (it runs the prebuilt nightly image) and stays enabled. Re-enable once either a stable lfx 0.5.x is published to PyPI or nightly bundle variants pinning lfx-nightly are published and langflow-nightly depends on them. |
|||
| 30b89779b7 |
ci: disable pip/venv DB migration test while langflow-nightly is pip-uninstallable
The PyPI langflow-nightly is currently pip-uninstallable: its core bundle deps (lfx-arxiv, lfx-duckduckgo) pin stable lfx>=0.5.0,<0.6.0, but stable lfx tops out at 0.4.4 (the 0.5.0 line ships only as lfx-nightly, a separate package name that cannot satisfy an lfx pin). So the pip/venv migration job fails at the install step. The Docker Compose migration job is unaffected (it runs the prebuilt nightly image) and stays enabled. Re-enable once either a stable lfx 0.5.x is published to PyPI or nightly bundle variants pinning lfx-nightly are published and langflow-nightly depends on them.1.9.5 |
|||
| fb4dfd49fd |
ci: sync workflow fixes from main into release-1.10.0 (fix broken nightly) (#13400)
ci: sync workflow fixes from main into release-1.10.0 Brings the latest CI/workflow fixes from main into release-1.10.0 so the nightly build is unblocked and the two branches share the same hardening. Most important fix: release_nightly.yml's "Verify Nightly Name and Version" step now uses the anchored grep '^langflow(-nightly)?[[:space:]]' instead of 'grep langflow | grep -v langflow-base | grep -v langflow-sdk'. The old filter started matching two packages once the langflow-stepflow workspace package was added, so the name became multi-line and the check failed (this is what broke the nightly build). Also carries main's fixes for cross-platform install (--prerelease=if-necessary-or-explicit), docker build workflows, db-migration-validation, and the backend test timeout bump (30 -> 40). 3-way merged from the common ancestor, so release-only changes are preserved; no release-only feature workflows are modified. |
|||
| 601a3e30e2 |
ci: port safe workflow fixes from release-1.10.0 to main (#13401)
* ci: port safe workflow fixes from release-1.10.0 to main Reconciles the workflow/CI improvements that landed on release-1.10.0 back into main, EXCLUDING workflows that depend on release-only features not yet present on main. Ported (verified no release-only dependencies): - test-coverage-advisor.yml (new; advisory-only, fully self-contained) - ci.yml, nightly_build.yml, db-migration-validation.yml (incl. the #13249 enhancements), python_test.yml (Python 3.14 support), cross-platform-test.yml (--prerelease=if-necessary-or-explicit), lint-js.yml, py_autofix.yml, typescript_test.yml Held back (depend on features that only exist on release-1.10.0): - extension-migration-checks.yml (extensions / src/bundles / scripts/migrate) - gp-backend-check.yml (release-only scripts/gp/*.py + backend locales/en.json) - regression-stub.yml (release-only regressions/ tracking) - gp-download.yml / gp-upload.yml backend-translation steps (release-only scripts/gp/{download,upload}.py) These converge with main once release-1.10.0 ships. 3-way merged from the common ancestor; the diff was verified to introduce zero references to release-only paths. * test: add cache_dir to Settings EXPECTED_FIELDS snapshot The diskcache-removal change added a `cache_dir` field to the cache settings group, but the field-count guard in test_settings_composition.py (EXPECTED_FIELDS, frozen by the settings split in #13141) was never updated. As a result test_field_count_unchanged failed on main with `assert 106 == 105`. Add "cache_dir" to the snapshot so it matches the live Settings model (106 fields). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
|||
| b70acb9f9a |
test: cover cross-user cache pollution on deprecated vertices endpoint (supplied-data path) (#13398)
The deprecated POST /api/v1/build/{flow_id}/vertices endpoint was reported to let an
authenticated non-owner write attacker-controlled graph data into another flow's
server-side cache (cross-user graph cache pollution). On release-1.10.0 this is already
remediated: retrieve_vertices_order and build_vertex gained a current_user parameter, an
owner-or-public flow lookup, and ensure_flow_permission(EXECUTE) that run before the
build-and-cache branch (added in #13153). The modern /build/{flow_id}/flow consumer path
is owner-gated as well.
Existing tests cover the cross-user no-data path. This adds explicit coverage for the
reported supplied-data path: a second user POSTing a schema-valid FlowDataRequest for
another user's private flow receives 404 because the ownership guard fires before
build_and_cache_graph_from_data / set_cache(str(flow_id), ...), so no graph is cached
under the victim flow id.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
|||
| cb7b838d45 |
feat: Add DB migration validation workflow for nightly builds (#13249)
* feat: Add DB migration validation workflow for nightly builds (LE-1259) - Implements automated DB migration testing for nightly builds - Tests two scenarios: pip/venv and Docker Compose migrations - Validates migration from stable to nightly versions - Verifies data persistence (witness flows) across migrations - Integrated into nightly_build.yml workflow - Includes Slack notifications for migration test results This addresses the critical blocker identified by QA team for ensuring safe database migrations in production deployments. * docs: Add DB migration validation documentation - Comprehensive guide for LE-1259 implementation - Detailed test scenarios and execution details - Environment configuration and success criteria - Monitoring and troubleshooting guidelines - Placed in docs/docs/Deployment/ for easy access * fix: address PR review comments for DB migration validation - Use actual nightly tag from create-nightly-tag output instead of hardcoded :latest - Wire POSTGRES_VERSION env var into postgres service image tag - Remove unnecessary checkout steps from both migration jobs - Update step name from 'Create witness flow and credentials' to 'Create witness flow' - Add -f flag to curl commands for fail-fast behavior - Add flow creation verification with error handling - Fix version extraction logic to properly test nightly build instead of PyPI latest - Remove deprecated docker-compose version field - Remove duplicate Slack notification job (consolidated in nightly_build.yml) Addresses all 9 issues identified by @ogabrielluiz in PR review * docs: remove implementation summary from user-facing docs Per @ogabrielluiz review feedback, this file reads as an implementation summary (Jira ticket, branch name, 'Next Steps', 'Files Changed: 2') rather than user-facing documentation. The Deployment section is for end-user docs, and this content is better suited for the PR description. Also not added to sidebars.js, so would be an orphan page. * fix(workflows): address 6 issues from Gabriel's second review of DB migration validation Fixes all remaining issues identified in PR #13249 review: 1. Remove schedule trigger - only works on default branch, would cause duplicate runs 2. Fix postgres service image - hardcode to postgres:16 (env context not available in services) 3. Add curl fail-fast flags - use -fsSL for immediate failure on errors 4. Add flow ID verification - check witness data creation succeeded before proceeding 5. Remove orphaned Slack JSON - cleanup leftover from removed notify-results job 6. Fix version extraction - strip 'v' prefix for pip install (${VERSION#v}) 7. Fix Docker image reference in nightly_build.yml - pass full image path with tag 8. Fix success notification - check migration validation didn't fail All changes validated locally: - YAML syntax validation passed - Docker Compose config validated - Tag manipulation logic tested (v prefix handling) - Curl command structure verified - Test credentials marked with pragma allowlist secret comments Related: LE-1259, PR #13249 Depends on: PR #13212 (Docker volume permissions fix) * fix(ci): address all PR review blockers for DB migration validation workflow - Add auto_login token auth to all 4 API call sites (Create/Verify witness in both jobs) - Add credential witness (POST /api/v1/variables/ with type: Credential) to prove encrypted-column migrations ran correctly - Verify witness variable persists after upgrade in both jobs - Strip 'v' prefix from nightly Docker tag before docker-compose sed replacement - Fix langflow.__version__ crash - use importlib.metadata instead - Remove deprecated 'version: 3.8' from inline docker-compose YAML - Remove bogus LANGFLOW_SUPERUSER/LANGFLOW_SUPERUSER_PASSWORD env vars - Remove LANGFLOW_SKIP_AUTH_AUTO_LOGIN (only works on nightly, not stable images) - Fix shellcheck SC2016/SC2102 issues flagged by actionlint - Mark test credential values with pragma allowlist secret (false positives) - Update .secrets.baseline with known false positives in new workflow file * fix(ci): remove duplicate db-migration-validation job after merge * fix(ci): include default_fields in witness variable payloads * fix(ci): handle compressed API responses in witness verification * fix(ci): uninstall stable langflow before installing nightly in pip-venv job langflow and langflow-nightly both own the same site-packages/langflow/ namespace via a shared langflow-base dependency. Without an explicit uninstall, the stable copy wins at runtime and python -m langflow still boots the old version - meaning no nightly migration is exercised and the test produces a false positive. Explicitly uninstall langflow + langflow-base before the nightly install so the namespace is fully handed over to the nightly package. --------- Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| 2bfa634dfb |
feat: flow builder assistant with real-time canvas updates (#12575)
* add agentic api backend
* [autofix.ci] apply automated fixes
* add docs to feature
* ruff and test fixes
* ruff fixes
* fix lfx tests
* fix ruff style
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* refactor code improvements
* add rate limit to tests
* [autofix.ci] apply automated fixes
* new canvas control
* chat UI skeleton v0
* add empty state when doesnt have model provider
* add generating code statuses
* assist panel doc
* add stop button to cancel flow generation
* view code dialog
* add translation json flow and stop button on inputchat
* add floating state of the chat
* refacator frontend codes
* assistant docs.
* add execution from .py file
* update docs
* fix verbose error
* improve disabled placeholder
* unify placeholder messages
* start chat state closed
* add canvas behavior
* fix model selection and position chat
* dialog z100
* [autofix.ci] apply automated fixes
* docs update
* change crypto to uuid regular
* fix inexistent assistant
* chore: removed old unused implmentation
remoced old FF and all it's UI components
* add memory to flow..
* add prompt on agent
* [autofix.ci] apply automated fixes
* cherry-pick first commit
* cherry pick commit changes canvas
* code improvements
* fix session id null and close button
* add tests suite
* fix await error
* ruff style and checker
* feat: add pure flow-builder utilities to lfx
Add flow_builder subpackage with pure functions for manipulating
flow JSON dicts — component ops, edge creation with ReactFlow
handle format, topological layout, and dynamic field detection.
* feat: add MCP server for operating Langflow via REST API
FastMCP server exposing 15 tools across auth, flow, component,
connection, and execution groups. Agents can create flows, add
and configure components, wire connections, and run flows against
a Langflow server through MCP tool calls.
* feat: add langflow-mcp-client console script entry point
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix: use dict comprehension in setup.py to fix PERF403 lint
* fix: address PR review feedback on MCP client
- Add asyncio.Lock to prevent race condition in _client() under
concurrent access
- Handle 204 No Content responses in delete() instead of calling
resp.json() on empty body
- Fix weak assertion in test_default_values
* feat: auto-enable tool_mode when connecting component_as_tool
describe_component_type now shows component_as_tool as an output
for any component with tool_mode-capable outputs. When an agent
connects via component_as_tool, tool_mode is auto-enabled — no
extra step needed.
* refactor: move MCP server from langflow-base to lfx
The MCP server has no langflow dependencies — only httpx, mcp,
and lfx.graph.flow_builder. Moving it to lfx.mcp makes it usable
without installing langflow. Entry point: lfx-mcp.
* feat: improve MCP server UX for agents
- describe_component_type separates advanced fields from core ones
- search_component_types accepts output_type filter
- list_flows accepts query filter and includes ASCII graph repr
- get_flow_info includes ASCII graph repr
- add duplicate_flow tool
- add list_starter_projects tool
* feat: add use_starter_project tool and tests for new features
- use_starter_project creates a flow from a starter template by name
(starter projects aren't fetchable by ID via /flows/)
- Tests for duplicate_flow, starter projects, graph repr, advanced
fields, and output_type search
* docs: improve MCP tool descriptions for agent clarity
- Add server-level instructions with typical workflow guide
- Remove internal implementation details from tool descriptions
- Add cross-references between related tools
- Mention component_as_tool and graph diagrams where relevant
* docs: address subagent review feedback on tool descriptions
- Document return values for create_flow, add_component
- Clarify empty-query behavior for search_component_types
- Distinguish get_component_info (instance) vs describe_component_type (type)
- Explain connection type compatibility in instructions
- Clarify configure_component trigger field behavior
- State disconnect_components default when filters omitted
* feat: add batch tool for multi-action requests
Execute multiple actions in one call with $N.field references
to chain results. An agent can build a complete flow in a single
request instead of 6+ round trips.
* improvements UIUX
* change css canvas controls
* feat: add create_flow_from_spec tool for compact text-based flow creation
Accepts a compact text spec with nodes, edges (using real port names),
and config sections. Agents generate a simple string instead of
constructing nested JSON. Tool mode auto-enabled for component_as_tool.
Handles Prompt Template dynamic variables by parsing {var} from
template text and creating input fields. Cleans up flows on failure.
Type coercion for numeric/boolean config values.
* feat: add build_flow validation and create_flow_from_spec
build_flow validates flows by building the graph server-side.
create_flow_from_spec accepts a compact text spec with nodes,
edges, and config. Validates by default (optional).
Handles Prompt Template dynamic {variables}, auto-enables tool_mode
for component_as_tool, cleans up on failure, coerces config types.
* fix: isolate session state and harden MCP server
* pannel execution
* [autofix.ci] apply automated fixes
* fix: move test_flow_builder into tests/unit so CI collects coverage
* improve code gen
* [autofix.ci] apply automated fixes
* fix: address PR review feedback
- Fix test fixture to use contextvars instead of stale module attributes
- Raise ValueError on malformed spec lines instead of silently dropping
- Disambiguate duplicate component types in flow_graph_repr
- Narrow except Exception to ImportError in flow_graph_repr
- Add action-index context to batch error messages
- Fix stale/inaccurate docstrings (group count, "| ", field_name, category, build_flow)
- Mention create_flow_from_spec in MCP instructions
* feat: stream run_flow events via MCP progress notifications
run_flow now consumes Langflow's SSE stream and relays token events
to the MCP client via report_progress. Falls back to a regular POST
if the stream yields no result.
* test: add streaming integration tests for run_flow and stream_post
* chore: rebuild component index
* fix: Remove code execution from assistant validation path (#12244)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* [autofix.ci] apply automated fixes
* fix: handle Message dicts in str field param processing
param_handler's str case called unescape_string on each list element
without checking if the element was a string. On subsequent agent calls,
chat history stores Message dicts in the list, causing
'dict' object has no attribute 'replace'.
Added _coerce_str_value helper that extracts .text from Message/Data/dict
objects before unescaping. Includes 4 regression tests.
* feat: add flow builder tools and propose_field_edit with JSON Patch
- builder.py: builds flow dicts from text specs using local component registry
- flow_builder_tools.py: 9 Langflow components for agent tooling
- propose_field_edit generates validated JSON Patches with dry-run verification
- flow_to_spec_summary converts flow dicts to compact summaries with IDs
- Module-level event queue for real-time UI updates during streaming
* feat: flow builder assistant with intent routing
- flow_builder_assistant.py: Python-based agent flow with 9 tools
- model_config.py: shared model config extracted from translation_flow
- Intent classifier recognizes build_flow, edit, and inspect requests
- Updated LangflowAssistant.json prompt to mention flow building
- 18 tests including graph construction and intent classification
* feat: SSE event pipeline for flow building and editing
- New SSE events: flow_update, flow_preview, flow_action (edit_field)
- assistant_service drains tool events during streaming for real-time updates
- Current flow context injected into all agent requests from DB
- Event consumer forwards flow_preview events through the pipeline
- extract_flow_json for text-based flow detection (fallback path)
* feat: frontend flow preview, edit cards, and real-time canvas updates
- FlowAction type for edit_field proposals with JSON Patch
- FlowEditCarousel: paginated Accept/Dismiss cards for field edits
- AssistantFlowPreview: mini ReactFlow canvas for new flow previews
- SSE handler dispatches flow_update and flow_preview events
- Chat hook applies flow_update events to canvas via setNodes/setEdges
- edit_field events stored as flowActions on messages for user review
- Strips flow_json blocks from visible chat content
* chore: add lfx logger to MCP server, log streaming fallback
* fix: resolve merge issues and harden flow builder state management
- Restore build_flow intent in translation prompt and LangflowAssistant system prompt
- Remove duplicate TYPE_CHECKING block from assistant_service.py (merge artifact)
- Add build_flow to intent classification plaintext fallback
- Add reset_working_flow to streaming finally block (lifecycle leak)
- Replace module-level globals with contextvars for concurrency safety
in both components/tools and mcp flow_builder_tools
- Remove dead _save_working_flow (ThreadPoolExecutor in async antipattern)
- Handle remove_component and configure flow_update actions in frontend
- Log warning when flow JSON fallback triggers instead of tool events
- Add tests for build_flow/off_topic plaintext fallback and contextvar isolation
* feat: improve flow builder UX and consolidate tool implementations
- Add worked examples to flow builder prompt (new flow + edit flow)
- Add build_flow guardrail: returns error when canvas already has components
- Change ConfigureComponent to accept JSON params dict (batch updates)
- Remove duplicate flow_builder_tools.py from components/tools
(was breaking test_get_all); single source in lfx.mcp.flow_builder_tools
- Update prompt to explicitly guide build vs edit tool selection
* fix: set_flow replaces canvas instead of appending, Python 3.10 compat
set_flow was using paste() which appends nodes with new IDs, causing
duplicates. Now uses setNodes/setEdges to replace canvas contents.
Also fixes asyncio.Barrier usage (3.11+) in concurrency test and
makes ConfigureComponent accept params as dict or JSON string since
tool frameworks may pass either.
* fix: soften build_flow guardrail and harden intent fallback parser
build_flow no longer hard-blocks on non-empty canvas. Users can now
create new flows while an existing one is open -- the prompt already
guides the agent to prefer edit tools when components exist.
Intent classification fallback now uses a strict regex pattern matching
quoted JSON values ("intent": "build_flow") instead of bare substring
matching, preventing prompt-echo misroutes on weaker models.
* feat: lock canvas while assistant is processing
Syncs the assistant panel's isProcessing state to the
assistantManagerStore so the canvas locks (effectiveLocked) while the
assistant is building or modifying the flow, preventing the user from
dragging nodes during real-time updates.
* feat: flow builder assistant with real-time canvas updates
Add flow builder assistant that builds and modifies flows directly on
the user's canvas via agent tools. SSE event pipeline streams
flow_update and flow_preview events for real-time canvas rendering.
- Flow builder tools: search, describe, add, remove, connect, configure,
build_flow, propose_field_edit with JSON Patch
- Intent classification with build_flow routing
- Per-request state isolation via contextvars
- Strict regex fallback parser for intent classification
- Canvas lock while assistant is processing
- Frontend handles add, remove, connect, configure, set_flow actions
- Flow preview and edit card components
* fix connection llm mcp
* [autofix.ci] apply automated fixes
* add flow visualization on assistant
* add manage files to assistant
* [autofix.ci] apply automated fixes
* update documentation about file
* [autofix.ci] apply automated fixes (attempt 2/3)
* reasoning thinking v0
* flow builder improvement
* [autofix.ci] apply automated fixes
* add patch to canvas, improve cache and harness
* ruff style and checker fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix tests
* fix jest tests
* UI ux improvements
* [autofix.ci] apply automated fixes
* ruff style and checker
* improve sec and harness
* ux warning banner tag assistant
* improve flow builder UI UX
* json updates
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* disable preview for many component
* fix message preview
* MCP and agent improvements
* ruff style and chceker
* fix ux display on generating artifacts
* guard rails and deterministic results improvements
* ruff style and checker
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* split flow_builder_tools, force per-user file isolation, add timeouts and guard rails
* ruff style and checker
* ruff style and checker
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* add model alert
* add padding on warning text
* [autofix.ci] apply automated fixes
* fix frontend tests
* fix credentials detection
* refactor playwright tests: remove duplicate tests and add good practices
* add send playground rule
* fix import dotenv
* fix fe tests
* fix light mode
* fix run flow test
* fix tests failing
* fix folder deletion test
* fix e2e tests
* constant text on tests
* fix publish test
* fix publish tests
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* test: standardize new-project-flow helper into utils/flow
Follow-up to the cz/playwright-tests-refactor merge — align the
new-project-flow helper our branch added with the refactor's directory
and constants conventions:
- Move tests/utils/new-project-flow.ts -> tests/utils/flow/, next to the
refactor's open-blank-flow / open-starter-project helpers; update the
15 import sites.
- Use TID / TIMEOUTS constants inside the helper instead of raw
test-id strings and literal 30000 timeouts, matching open-blank-flow.
- Drop an unused zoomOut import in auto-login-off.spec.ts.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test: assert New Flow button by test-id, not substring text match
The merge resolution kept the refactor's `expect(...).toBeVisible()`
assertion but on `getByText("New Flow")`, which is a substring match —
it also matches flow cards named "New Flow (N)" and throws a strict-mode
violation once such flows exist. Our previous side used a no-op
`.isVisible()` that silently masked it.
Assert on `getByTestId(TID.newProjectBtn)` instead: unambiguous,
DB-state independent, and consistent with the refactor's test-id-first
convention. Verified — actionsMainPage-shard-1 (3/3) and run-flow now
pass against a populated database.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix windows utf open
* assistant message fixes
* [autofix.ci] apply automated fixes
* add tests to validate
* [autofix.ci] apply automated fixes
* bugfixes round 2
* ruff style and checker
* qa fixes
* parse serialized model
* improvement on agent tool usage
* [autofix.ci] apply automated fixes
* ruff style and checker
* [autofix.ci] apply automated fixes
* fix sidebar nav test
* backend tests fixes
* fix tests and change model provider to open dialog
* performance improvements
* [autofix.ci] apply automated fixes
* ruff style and checker fix
* tests fixes
* fix error handling test
* test user overlay
* fix test tool mixin
* last improvements
* ruff style fix
* [autofix.ci] apply automated fixes
* fix user test agentic
* QA fixes round 7
* fix assistant gpt 5.4
* [autofix.ci] apply automated fixes
---------
Co-authored-by: cristhianzl <cristhian.lousa@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Edwin Jose <edwin.jose@datastax.com>
Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com>
Co-authored-by: Rodrigo Nader <rodrigonader@MacBook-Pro-de-Rodrigo.local>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
|||
| 23e6e8ebba |
feat(authz): add DI dependencies and permission decorators (#13368)
* feat(authz): add DI dependencies and permission decorators Address PR #13153 feedback by introducing FastAPI authorized-flow dependencies for route handlers and requires_flow_permission for non-HTTP paths such as helpers.load_flow. * feat(authz): add RequireFlowCreate dependency for POST /flows/ Move create_flow CREATE authorization into a FastAPI Depends so the route signature declares protection like read/update/delete. * [autofix.ci] apply automated fixes * fix(authz): resolve ruff lint failures on route-pattern branch Fix undefined User type, unused decorator assignment, FAST003 path params, and related test lint issues so the Ruff style check passes in CI. * [autofix.ci] apply automated fixes * fix: couple small nits * chore: drop unrelated component_index.json drift from PR * [autofix.ci] apply automated fixes * refactor(authz): drop OptionalAuthorizedReadFlow; note_translations returns 404 GET /flows/{id}/note_translations now uses AuthorizedReadFlow, so a missing or inaccessible flow yields 404 instead of 200 {} — matching GET /flows/{id} and the rest of the flow API. The owner-scoped uniform 404 is itself UUID-privacy-preserving, so the special-cased empty body added no real privacy over the existing posture. The sole frontend caller (NoteNode) already treats an error as "no translations" and renders the original text. Removes get_optional_authorized_flow_for_read and the OptionalAuthorizedReadFlow alias, and updates the i18n + route-guard tests to assert the 404. --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> Co-authored-by: Debojit Kaushik <Kaushik.debojit@gmail.com> |
|||
| e3dc9d966f |
fix: bundle event inconsistency and other fixes (#13374)
* Bug fixes for events toasts inconsistency, keyspace argument silent failure, API_KEY expiry timestamp being timezone unaware. * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| ca63f9099d |
fix: Respect OpenAI embeddings API base for Knowledge Base (#13380)
* fix: respect OpenAI embeddings API base * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 5ca53ef994 |
fix: Add defense in depth user_id filter to handle list tools MCP handler (#13373)
* feat(mcp): add defense-in-depth user_id filter to handle_list_tools for consistency with other MCP handlers * [autofix.ci] apply automated fixes --------- Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| c9fe220d63 |
feat(memory): add inline docs link to preprocessing instructions tooltip (#13352)
* feat(memory): add inline docs link to preprocessing instructions tooltip * add tooltip link for example * remove duplicate key --------- Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com> |
|||
| c0b4b05d41 |
docs: update database tables (#13254)
update-database-tables |
|||
| aafce557aa |
feat(authz): admin APIs, share-aware build_flow, and base service additions (#13371)
* feat(authz): add roles, role-assignments, teams, and me/permissions APIs
Completes the OSS admin surface for RBAC: full CRUD on authz_role,
authz_role_assignment, authz_team, and authz_team_member tables, plus a
per-user effective-permissions endpoint backing the frontend permission gate.
Plugin (enterprise Casbin) is invalidated on every write so the next enforce
sees the change.
New endpoints:
* GET/POST/PATCH/DELETE /api/v1/authz/roles -- custom-role CRUD with parent
cycle detection, system-role protection, and FK-aware delete (409 when
assignments still reference the role).
* GET/POST/DELETE /api/v1/authz/role-assignments -- list filterable by
user/role/domain; superuser-only for write, self-read allowed.
* GET/POST/PATCH/DELETE /api/v1/authz/teams + GET/POST/DELETE
/api/v1/authz/teams/{id}/members -- backs the share-with-team flow and
the team admin UI.
* POST /api/v1/authz/me/permissions -- returns per-resource allowed actions
for the current user (capped at 500 ids), backs the FE permission gate.
Base service additions (lfx.services.authorization.base):
* list_visible_resource_ids -- plugin SQL prefilter for list endpoints; OSS
returns None ("no prefilter, fall through to filter_visible_resources").
* get_effective_permissions -- default impl uses batch_enforce so plugins
inherit it for free; Casbin plugin can override for a tighter query.
* fix(authz): make build_flow share-aware so shared flows can be run by non-owners
The build_flow handler was loading flows with an owner-OR-public SQL filter,
short-circuiting the ensure_flow_permission(EXECUTE) check on private flows
shared with the current user. The existing in-code comment flagged this as a
Phase 3 prerequisite for cross-user build support.
Switch to the share-aware load helper (_read_flow / authorized_or_owner_scoped):
* When the registered authorization plugin signals SUPPORTS_CROSS_USER_FETCH
(enterprise Casbin), the row loads by id alone and the plugin decides via
enforce(). OSS pass-through keeps the historical owner-only behavior.
* PUBLIC flows are still buildable by any authenticated user in both modes
(preserved via the explicit access_type=PUBLIC fallback).
* Plugin deny is translated to 404 (not 403) via deny_to_404 so the response
is indistinguishable from "flow does not exist" and the caller cannot
enumerate UUIDs by probing for 403 vs 404.
* test(authz): cover new admin routes and share-aware build_flow
Pins the security floor and validation behavior added in the prior commits so
they don't silently regress. Uses the existing fake async session + stub authz
service pattern from test_authz_share_routes.py.
test_authz_admin_routes.py (17 tests):
* /authz/roles -- superuser gate on create, persist + invalidate_all, 409 on
name conflict, system-role protection on update + delete, self-parent and
parent-cycle rejection, 409 when deleting a role with active assignments.
* /authz/role-assignments -- non-superuser blocked from listing other users'
assignments; self-list allowed; 404 when user_id is unknown; create
invokes invalidate_user(target).
* /authz/teams -- superuser gate on create, add_member invokes
invalidate_user(target), duplicate add returns 409.
* /authz/me/permissions -- correct per-resource shape, 400 when over 500
ids, empty request returns empty.
test_chat_build_flow_authz.py (5 tests):
* Owner happy path preserved.
* Plugin 403 deny converted to 404 (UUID privacy).
* Unknown flow + no PUBLIC fallback -> 404.
* Share-aware load miss + PUBLIC fallback hits -> success.
* Non-403 errors (e.g. 500) pass through with status preserved.
Total: 22 new tests, all passing locally.
* fix(authz): normalize, dedupe, and cap the actions list on /authz/me/permissions
The resource_ids cap (500) bounded one side of the cartesian product, but the
actions list was unbounded. A client could submit actions=["read"] * 100000
and trigger a 50M-entry batch_enforce, plus the same action in different
casings ("READ", "read") would have been treated as distinct entries.
Add a field_validator on EffectivePermissionsRequest.actions that:
* strips whitespace and lowercases each entry
* de-duplicates while preserving order
* caps the result at 10 unique actions (headroom over the 6 known actions:
read, write, execute, delete, create, manage)
* returns None when the normalized list is empty so the handler still falls
back to _DEFAULT_ACTIONS
Over-cap requests raise ValidationError (HTTP 422 at the request boundary),
which matches Pydantic conventions for input shape problems and differs from
the resource_ids cap (HTTP 400 in the handler) by design -- bound-violation
on list size is structurally a validation error, not application logic.
6 new tests: normalization+dedupe, empty-collapses-to-None, over-cap rejection,
50-entry dedupe stays under cap, None stays None, handler sees normalized list.
* fix(authz): default /authz/role-assignments list to caller's own assignments
The gate `if user_id is None or user_id != current_user.id` required superuser
whenever user_id was omitted, so any non-superuser calling
GET /authz/role-assignments with no query params got 403 even though the
docstring promised "Users may query their own assignments".
Resolve user_id to current_user.id when omitted, then only gate superuser when
the resolved id differs from the caller. The query is now always filtered by
the resolved user_id, so admins doing cross-user lookups make one call per
user instead of relying on an unscoped see-all.
Adds test_list_assignments_no_user_id_defaults_to_self pinning the new
behavior. The other two assignment-list tests (self with explicit user_id,
non-superuser blocked from another user) remain unchanged and still pass.
* fix(authz): use model_fields_set so PATCH /authz/roles can clear nullable fields
The "if payload.<field> is not None" guards made it impossible to clear
description or parent_role_id via PATCH -- an explicit "description": null
in the body was indistinguishable from omitting the field, leaving the old
value in place.
Switch to presence checks via payload.model_fields_set:
* description: nullable on the DB side, so an explicit null clears the field.
* parent_role_id: nullable + SET NULL on cascade; null removes the parent.
* name: NOT NULL + unique on the DB side. The presence check applies, but
an explicit null is rejected at the boundary with HTTP 400 so the caller
sees a clear error instead of an opaque 409 "Name conflict" from the
IntegrityError catch block below.
* permissions: nullable=False (default_factory=list) on the DB side. An
empty list is the natural "clear"; null is rejected with HTTP 400.
6 new tests: clear description via null, clear parent via null, omitted
fields untouched, reject null name, clear permissions via empty list,
reject null permissions.
Adds _make_role_row helper so SimpleNamespace fakes carry every field
that RoleRead.model_validate expects (workspace_id, created_at, created_by).
* fix(authz): use model_fields_set so PATCH /authz/teams can clear description
The "if payload.description is not None" guard made the description field
unclearable via PATCH -- an explicit "description": null was indistinguishable
from omitting the field, leaving the old value in place.
Switch to a presence check via payload.model_fields_set so null clears the
field, while omission still leaves the row alone. The DB column is nullable,
so None is a legitimate value here.
Scope intentionally narrow: team_name and adom_name are NOT NULL on the DB
side (null would crash on commit) and is_active is bool (null doesn't model
any state), so they keep the existing is-not-None guards.
Adds 2 tests: clear via explicit null, omission leaves value untouched.
Adds _make_team_row helper for parity with _make_role_row.
* fix(authz): validate batch_enforce result length in get_effective_permissions
The default get_effective_permissions impl built `requests` as a cartesian
product of resource_ids x actions, called batch_enforce, then sliced the
flat result back into per-resource action lists. If a plugin's batch_enforce
returned the wrong number of results -- contract violation -- the slicing
silently produced incorrect mappings:
* too-short flat: later resources got `[]` (out-of-bounds slice returns empty
in Python) instead of their real permissions
* too-long flat: tail entries silently dropped
The inner `zip(..., strict=True)` only caught the per-slice mismatch when a
slice happened to be too short, not the global length mismatch.
Validate `len(flat) == len(requests)` immediately after the call and raise
ValueError with expected/actual counts so plugin authors find the contract
break at the first wrong call, not via mysteriously-empty permission lists.
Adds two lfx tests:
* default impl returns full action list per resource (no enforcement)
* mocked batch_enforce returning a wrong-sized list raises ValueError
* fix: remove EE references
* fix: harden authz admin APIs based on PR review
- Pin permission slug format to canonical <resource>:<action> and validate
RoleCreate/RoleUpdate at the API boundary so bad slugs cannot land in
authz_role.permissions and silently fail policy sync.
- Tighten RoleAssignmentCreate: domain_type is a Literal and a model
validator enforces domain_id consistency (required for org/workspace/
project, forbidden for global).
- Restore _resolve_casbin_domain re-export for plugin backward compat.
- Audit-log policy-changing admin writes (role CRUD, role-assignment
create/delete, team CRUD, team membership add/remove) so privilege
grants are visible alongside enforcement decisions.
- Invalidate authorization cache when a team's adom_name or is_active
changes; pure display edits still skip the flush.
* review feedback
* [autofix.ci] apply automated fixes
* fix(authz): harden build_flow and expose authz_enabled on config
Block non-owners from overriding flow graph data on shared builds,
revert unrelated component_index.json churn, and surface
LANGFLOW_AUTHZ_ENABLED on public and authenticated config responses
for EE UI gating.
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: himavarshagoutham <himavarshajan17@gmail.com>
Co-authored-by: Himavarsha <40851462+HimavarshaVS@users.noreply.github.com>
|
|||
| e2ef18104b |
chore(frontend): Clean up biome violations on release-1.10.0 (#13375)
fix biome lint |
|||
| b63e98ba06 |
feat(memory): default session filter to All Sessions and add it as a selectable dropdown option (#13350)
* feat(memory): default session filter to All Sessions and add it as a selectable dropdown option * [autofix.ci] apply automated fixes * add translation * [autofix.ci] apply automated fixes * improve translations * [autofix.ci] apply automated fixes * improve translations * [autofix.ci] apply automated fixes * fix testcase * [autofix.ci] apply automated fixes --------- Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com> |
|||
| 2b8ded4664 |
fix(chat): align message card surfaces (#13354)
* fix(chat): align message card surfaces * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| e4d5190be4 |
chore(ci): Fix 403 in DB migration validation witness flow (#13376)
fix auto login migration validation |
|||
| 6b2ca4bcd8 | fix: restore qdrant deps and migration workflow | |||
| e840293b9e | fix: read langflow version from package metadata | |||
| ebb20c58b0 |
fix: Restore custom Agent prompts in starter projects (#13282)
* fix templates prompts * add regression test * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 1e75a269c8 |
fix: Run Flow mutable state leak (#13340)
* fix: isolate Run Flow component state * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] * chore: wake ci * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix: tune component template copying * [autofix.ci] apply automated fixes * fix: preserve explicit load-from-db state * fix: file component error in run flow * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 104a83c83c |
docs: lfx bundles (#13142)
* docs-initial-overview-bundles-content * fix-broken-link * remove-production-page * docs: check bundles against code and cleanup * docs: fix links |
|||
| a7b8170d53 |
fix: Force streaming on AgentComponent regardless of toggle (#13358)
* fix streaming default true on release * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * add robust tests around streaming to avoid any future errors * [autofix.ci] apply automated fixes * improve fe flaky tests * fix outdated action test * fix flaky outdated action tst --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 1bb95275a5 |
docs: openrouter promoted to global provider (#13271)
docs: check openrouter content and add global |
|||
| e694bbcdff |
docs: troubleshooting for container mismatch (#13217)
* add-troubleshooting-for-container-mismatch * grep-for-volume-name * fix-spacing * danger-admonition |
|||
| b410b54294 | chore: update starter projects | |||
| 8c7fe0ac3a |
chore: bump versions
bump package versions |
|||
| 9b7486efe8 |
docs: macos support matrix (#13363)
* docs: macos support matrix * docs: fix linking errors and clarify limitations * cleanup |
