Give v2-workflows sync and the langflow stream protocol one parser. The
stream now emits a normalized "output" event per terminal output carrying
an OutputEvent (the ComponentOutput shape sync returns in outputs[id], plus
component_id). A shared build_component_output() backs both the sync
converter and the adapter, and the build loop ships authoritative vertex
metadata as an additive output_meta key on end_vertex (existing consumers
read build_data and ignore it).
This is access-pattern parity (one parser, same fields, same terminal set),
not byte-identical content: the stream reuses the v1 build path whose
display serialization differs from sync's run_graph output.
Let a sync caller name the output(s) they want via output_ids so
output.text resolves deterministically (reason=single) on multi-output
flows instead of going null. Selection is steer-only: it picks the
answer among the named outputs without filtering the outputs map.
Invalid ids are rejected with 422 before the flow runs (and before any
job row is created), so a typo costs no compute. Resolution considers
selected outputs that actually fired, so branching flows resolve to
whichever candidate ran.
Replace the flat output_text shortcut with an `output` object carrying the
resolved text answer plus a `reason` that explains why it resolved that way
(single/multiple/none/non_string/failed), so a null answer is always
diagnosable instead of silently None. `reason` follows the LLM-domain
finish_reason/stop_reason convention, distinct from the lifecycle status.
Also add `display_name` to each ComponentOutput (the stable component id
stays the dict key) and a computed `has_errors` flag derived from errors.
Pin the sync-response shortcuts on the v2 workflows endpoint:
- output_text surfaces the lone ChatOutput/TextOutput text and stays None for
non-output message nodes, data-only flows, and multi-text flows
- session_id echoes the resolved session; the error response exposes neither
- each outputs entry exposes only {type, status, content, metadata}, with the
component id carried by the dict key
Also drop the component_id kwarg the converter passed to ComponentOutput, which
has no such field and silently dropped it.
The synchronous /api/v2/workflows response keyed every result under its
component id, so reading the answer meant knowing an id you can't predict.
Surface two additive fields:
- output_text: the flow's single text answer (ChatOutput/TextOutput). None
when the flow has zero or multiple text outputs, so callers read outputs
rather than the shortcut guessing which channel is the answer.
- session_id: echoes the resolved session so chat/memory callers can
continue the same thread (v1 /run returned this; v2 had dropped it).
outputs is unchanged, so this is non-breaking.
Rebased onto release-1.10.0. The base independently rebuilt the v2
workflows backend (RBAC, body globals, share-aware fetch); keep our
forward design and conform its auth to that work:
1. Auth: keep get_current_user_for_workflow (session-or-API-key authN
that does not hold a DB connection during the inline run, avoiding
the SQLite lock contention api_key_security would cause) and enforce
the base's RBAC on top: ensure_flow_permission(EXECUTE) before run,
(READ) before status reconstruct, with widen_for_shares fetch.
2. Port the base's request-body globals onto the v2 WorkflowRunRequest.
The X-LANGFLOW-GLOBAL-VAR-* headers stay supported (the Responses API
passes globals that way); body globals win on conflict. Converters
echo the effective globals via effective_globals.
3. Public endpoint keeps the v1 build_public_tmp posture
(access_type==PUBLIC, run-as-owner); RBAC applies to the
authenticated endpoint only.
4. Preserve the base's post-build KB-cache invalidation in the AG-UI
build path.
The endpoint, AG-UI bridge, pluggable stream adapters, public endpoint,
and re-attach are unchanged.
* docs: remove 1.8 env vars
* docs: link out to deployment guide
* docs: redis queue
* fix-links-and-combine-env-vars-table
* docs: cleanup
* peer-review
* peer-review
* Apply suggestions from code review
Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>
* move-prereqs
---------
Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>
* fix: remove src/backend/base/uv.lock and Dockerfile references
- Deleted src/backend/base/uv.lock (monorepo should have only one uv.lock at root)
- Removed COPY ./src/backend/base/uv.lock lines from all Dockerfiles:
- docker/build_and_push.Dockerfile
- docker/build_and_push_base.Dockerfile
- docker/build_and_push_ep.Dockerfile
- docker/build_and_push_with_extras.Dockerfile
- docker/dev.Dockerfile
Fixes LE-1093
* fix: remove stale base uv.lock regeneration paths
* feat(LE-906): Config/settings plumbing
- Add 7 new boolean settings: custom_component_admin_only, embedded_mode,
hide_logout_button, hide_new_project_button, hide_new_flow_button,
hide_starter_projects, mcp_servers_locked (all default: false)
- All settings configurable via LANGFLOW_* env vars
- Expose all flags through ConfigResponse schema
- Fix hide_getting_started_progress to read from settings not env
- Add frontend type definitions for all 7 flags
- Initialize utility store with all new flags
- Implement hydration logic for new flags in config hook
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix(LE-906): address PR1 review feedback
- replace internal ICA wording with neutral embedded-mode language
- add settings field for hide_getting_started_progress
- map hide_getting_started_progress from settings in ConfigResponse
- add regression test for embedded_mode hide-flag cascade
- revert unrelated component_index drift from PR scope
* fix(LE-906): address remaining PR1 Gabriel comments
* docs/test(LE-906): clarify embedded_mode scope for QA
- Clarify in settings docs that embedded_mode cascades UI hide flags only
- Keep mcp_servers_locked and custom_component_admin_only as explicit opt-ins
- Add config test assertions that security flags do not auto-cascade
* feat(LE-906): Embedded UI visibility changes
- Hide logout button from account menu when hideLogoutButton flag enabled
- Hide new flow button from header when hideNewFlowButton flag enabled
- Hide new project button from sidebar when hideNewProjectButton flag enabled
- Hide starter projects tab from templates modal when hideStarterProjects enabled
- All UI gates read from utility store (flags populated from server config)
- Supports embedded/iframe mode integration where standalone UI elements are hidden
- Pure frontend changes: no backend dependencies, no breaking changes
- Respects embedded_mode umbrella flag when individual hide flags set
* fix(LE-906): restore overwritten header components and keep embedded UI gates
* [autofix.ci] apply automated fixes
* feat(LE-906): hide new flow entry points
* fix(LE-906): address PR4 review comments from Gabriel
* fix(LE-906): resolve PR4 biome lint failures
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* feat(LE-906): Custom component admin gating + fix field refresh side effect
- Add custom_component_admin_only gate to POST /custom_component endpoint
- Only admin users can CREATE new custom component code when flag enabled
- Remove admin gate from POST /custom_component/update endpoint
* This endpoint handles field metadata refresh (e.g., model provider changes)
* Normal users need access to refresh available models/options
* Gate on creation prevents harmful code, not on field refresh operations
- Use hardened feature-flag checks with getattr(..., False) is True pattern
- Fixes side effect where normal users couldn't refresh field metadata
(e.g., couldn't change LLM models when provider config changes)
- Gate applies only to creation of NEW custom components, not metadata updates
* fix(LE-906): address PR3 review feedback
- remove stale placeholder commentary from custom_component/update
- enforce admin-only restriction for truly custom code updates
- keep known-template refresh/update path available for non-admin users
- add endpoint tests for allow/block behavior under admin-only mode
- revert unrelated component_index drift from PR scope
* feat(LE-906): tighten custom component admin gating
* fix(LE-906): tighten custom-component admin gate carveouts
* [autofix.ci] apply automated fixes
* fix(LE-906): address PR3 review comments from Gabriel
- Rename create-side known-template refresh test for accurate intent
- Strengthen superuser coverage with novel-code create case and update case
- Revert unrelated starter project dependency version drift (OpenDsStar)
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* feat(LE-906): MCP lock enforcement + UI/tests
- Add mcp_servers_locked gate to POST /{project_id}/install endpoint
- Extend lock check to PATCH /{project_id} endpoint for auth settings updates
- Non-superuser requests blocked with 403 when flag is enabled
- Add hardened feature-flag checks using getattr(..., False) is True pattern
to prevent MagicMock truthiness in tests
- Update AddMcpServerModal to show locked message when mcp_servers_locked=true
- Fix JSX structure in modal (missing fragment wrapper)
- All MCP modifications now gated when mcp_servers_locked flag enabled
* fix(LE-906): address PR2 review feedback
- add is_mcp_servers_locked helper with MagicMock-safe semantics and rationale
- add regression tests for explicit-true vs MagicMock placeholder behavior
- add missing mcp.modal.lockedTitle/lockedDescription i18n keys across locales
- remove debug leftover test_page.html
- revert unrelated component_index drift from PR scope
* fix(LE-906): enforce MCP lock in v2 servers
* fix(LE-906): address PR2 review comments from Gabriel
- Remove duplicate is_mcp_servers_locked helper from v1/mcp_projects.py;
import from api/v2/mcp instead so unit tests protect production code
- Retarget test imports to langflow.api.v2.mcp.is_mcp_servers_locked
- Add test_v2_mcp_servers_unlocked_allows_non_superuser_add_patch_delete
to cover the flag-off case (non-superuser can CRUD when gate is off)
* fix(LE-906): make MCP lock configurable in PR2
- Declare mcp_servers_locked in Settings so LANGFLOW_MCP_SERVERS_LOCKED is honored
- Add regression test to assert Settings exposes and reads mcp lock env var
* chore(ci): trigger PR2 CI
* feat(LE-906): Config/settings plumbing
- Add 7 new boolean settings: custom_component_admin_only, embedded_mode,
hide_logout_button, hide_new_project_button, hide_new_flow_button,
hide_starter_projects, mcp_servers_locked (all default: false)
- All settings configurable via LANGFLOW_* env vars
- Expose all flags through ConfigResponse schema
- Fix hide_getting_started_progress to read from settings not env
- Add frontend type definitions for all 7 flags
- Initialize utility store with all new flags
- Implement hydration logic for new flags in config hook
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix(LE-906): address PR1 review feedback
- replace internal ICA wording with neutral embedded-mode language
- add settings field for hide_getting_started_progress
- map hide_getting_started_progress from settings in ConfigResponse
- add regression test for embedded_mode hide-flag cascade
- revert unrelated component_index drift from PR scope
* fix(LE-906): address remaining PR1 Gabriel comments
* docs/test(LE-906): clarify embedded_mode scope for QA
- Clarify in settings docs that embedded_mode cascades UI hide flags only
- Keep mcp_servers_locked and custom_component_admin_only as explicit opt-ins
- Add config test assertions that security flags do not auto-cascade
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
The PyPI langflow-nightly is pip-installable again, so the temporary
`if: false` guard added on 2026-05-28 is no longer needed.
#13418 (release-1.10.0) and its forward-port #13419 (main) gave the
extension bundles their own nightly track: langflow-nightly now depends on
lfx-arxiv-nightly / lfx-duckduckgo-nightly / lfx-ibm-nightly, which pin
lfx-nightly==0.5.0.dev* instead of an unsatisfiable stable lfx>=0.5.0,<0.6.0.
Verified against the published dev57 wheels: a dry-run resolve of
langflow-nightly[postgresql] succeeds (549 packages, exit 0), pulling
lfx-nightly==0.5.0.dev57 via the *-nightly bundle variants.
Previously, on first load with no saved language preference, the app
used navigator.language as the fallback, causing users with Portuguese
(pt-PT / pt-BR) or other non-English browser locales to see the UI in
that language automatically. The expected behavior is that English is
always the default; users can change the language explicitly via
settings.
Co-authored-by: Antônio Alexandre Borges Lima <104531655+AntonioABLima@users.noreply.github.com>
Three name-generation tests monkeypatched `uuid4` on the watsonx_orchestrate `utils` module, but `uuid4` is imported and used in `payloads.py` (build_langflow_wxo_resource_name). Python resolves the name against the defining module's globals, so patching utils raised AttributeError. Point the patches at payloads_module and drop the now-unused utils_module import.
* fix(i18n): translate custom component nodes and fix missing RAG template notes in ja/fr
- Add translate_component_node() helper to i18n.py and call it from
custom_component and custom_component_update endpoints so canvas
interactions (tool mode toggle, field edits) no longer revert node
labels to English when a non-English locale is active.
- Sync ja.json and fr.json from GP: both locales were missing
template_notes.vector_store_rag.* keys, causing the Vector Store RAG
README note to always render in English.
* fix(i18n): translate Toolset output and UpdateAllComponents banner strings
- Extract the shared tool-mode output ("Toolset") via a sentinel norm
"_toolmode" in extract_backend_strings.py so the dynamic output
injected on every component when tool mode is enabled is covered by
a single shared translation key instead of being silently skipped.
- Update translate_component_node() to use the "_toolmode" norm when
the output name is "component_as_tool", resolving the key correctly
for all components.
- Wrap all hardcoded strings in UpdateAllComponents/index.tsx with t()
(summary banner, Dismiss/Dismiss All, Review All/Update All buttons).
- Add 15 new updateComponents.* keys to frontend en.json with i18next
_one/_other plural variants; upload and download all locale files.
- Sync all backend and frontend locale files from GP.
* fix(i18n): sync backend locale files with Toolset translations from GP
* fix(i18n): translate Retry button in server connection error dialog
* [autofix.ci] apply automated fixes
* fix(i18n): inline lfx.base constants in extract_backend_strings to fix CI
The GP script test environment mocks lfx.components but does not install
the full lfx package, so `from lfx.base.tools.constants import ...` raised
ModuleNotFoundError. Inline the two constants directly, matching the pattern
already used in bake_note_keys.py.
* [autofix.ci] apply automated fixes
* fix(i18n): address PR review — blockedPlural scheme, TOOL_OUTPUT_NAME constant, translation error isolation
- I1: Replace {{blockedPlural}} English-suffix hack in UpdateAllComponents with two
separate t() calls (blockedCannotRun + andMustBeUpdated), each driven by its own
count parameter, giving proper _one/_other pluralization for both counts independently.
Remove broken blockedAndMustUpdate_one/other keys from all 6 non-English locales
(de/es/fr/ja/pt/zh-Hans) so they fall back cleanly to English until re-translated
via the GP pipeline.
- I3: Replace magic string "component_as_tool" in i18n.py with TOOL_OUTPUT_NAME
imported from lfx.base.tools.constants — the canonical source of truth.
- I4: Move translate_component_node() calls outside the main try/except in both
custom_component and custom_component_update endpoints; wrap each in a narrow
try/except that logs and falls through to the untranslated node, so an i18n bug
can no longer fail a successful component update with HTTP 400.
* fix(i18n): translate update-components modal strings and preserve custom field display_names
- Translate hardcoded strings in UpdateComponentModal (title, column
headers "Component"/"Update Type", "Breaking" label) — adds 5 new
keys under updateComponent.* and downloads translations for all locales
- Fix custom component field display_names reverting on reload: extend
build_component_display_names to collect all known locale translations
per input field; syncNodeTranslations now checks the known-translation
set before overwriting a field's display_name — user-customized values
(not present in any locale file) are left untouched while standard
translatable values continue to update correctly on locale switch
- Update ComponentDisplayNamesType to include per-field translation sets
* fix(i18n): correct updateComponent.breaking translation key
Change English source from "Breaking" to "Breaking Change" so GP
produces correct translations (all locales were getting "Breaking News"
variants). zh-Hans now correctly shows 重大变更, consistent with the
existing breakingUpdateDesc body text.
* chore(i18n): re-download frontend translations after reverting breaking key to "Breaking"
* fix(i18n): extract and translate FileComponent description
The extraction script silently skipped @property descriptors when reading
description from component classes. Add a fallback to _base_description
for components that use a dynamic @property description.
Unify _base_description with the string used inside get_tool_description()
so there is a single source of truth, then re-run extract/upload/download
to add the missing translations for FileComponent description and Knowledge
component strings across all locales.
* fix(ui): redesign outdated-components banner with title + list layout
Replace long sentence-style summary with bold "Flow needs review" title
and short per-condition bullet lines. Change Dismiss All button from
link to outline variant. Add 3 new i18n keys and sync all locale translations.
* fix(i18n): add missing backend locale translations for de, es, pt, zh-Hans
Regenerated via GP download script after merging release-1.10.0 changes.
* [autofix.ci] apply automated fixes
* fix(i18n): resolve ruff lint errors in i18n utils and endpoints
* fix(lint): suppress SLF001 for internal class attribute access in FileComponent
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes
* starter templates
* fix(tests): update outdated-banner assertions to match redesigned layout
* [autofix.ci] apply automated fixes
* fix(docs): restore accidentally deleted memory-base docs from release-1.10.0
* fix(credentials): restore DB-first API key resolution and tests from release-1.10.0
* [autofix.ci] apply automated fixes
* fix(i18n): revert fetchErrorComponent key to common.retry (out of scope)
* [autofix.ci] apply automated fixes
* chore(i18n): sync backend and frontend locale files from GP
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Antônio Alexandre Borges Lima <104531655+AntonioABLima@users.noreply.github.com>
The nightly tagger renames lfx -> lfx-nightly, but the extension bundles
were published as stable lfx-<name> wheels pinning lfx>=0.5.0. So
langflow-nightly depended on the stable lfx-arxiv (etc.), which dragged in
lfx>=0.5.0 -- a version only published under the lfx-nightly name. Installing
the nightly therefore failed:
Because only lfx<=0.4.5 is available and lfx-arxiv==0.1.0 depends on
lfx>=0.5.0, ... your requirements are unsatisfiable.
Give the bundles their own nightly track, mirroring lfx/base/main:
- update_lfx_version.py now renames each src/bundles/* package to
lfx-<name>-nightly, versions it <base>.dev<N> (sharing lfx's dev number),
and repoints the root langflow deps + [tool.uv.sources] workspace entries
at the -nightly names. Each bundle's own lfx dep was already repinned to
lfx-nightly==<dev>. Only the [project] name/version change -- entry points
and the import package stay as lfx_<name>, so extension discovery is intact.
- release_nightly.yml publishes the nightly bundle wheels to PyPI and gates
publish-nightly-main on them, so langflow-nightly's exact == pins always
reference bundles published in the same run.
No build/test/Docker changes needed: the bundles are already built and
committed under the nightly tag, the cross-platform test resolves them via
--find-links, and Docker builds from the regenerated workspace lock.
* feat(security): add failed login logging with IP tracking and comprehensive tests
* fix: remove PII from login logs and fix structlog format
* docs: agent improvements (#13269)
* docs: add structured output for agents
* docs: add structured output note
* docs: clarify both agent outputs and add release notes
* docs: when langflow sends events to the playground and chat history
* fix(playground): expand session checkbox click target to full row height (#13349)
* fix(playground): expand session checkbox click target to full row height
The selectable-row checkbox wrapper was ``w-4 h-4`` (16x16 px) but the
row is ``h-8`` (32 px). The 8 px band above and the 8 px band below
the visible icon were dead zones that bubbled to the row's
``toggleVisibility`` and navigated to the session instead of toggling
selection — exactly the accidental-navigation UX the bug ticket
describes.
Grow the wrapper to ``w-4 h-8`` so the click target captures the full
row height. Width stays narrow so the text alignment is unchanged; the
icon itself stays ``h-4 w-4``, centered via the existing
``flex items-center justify-center``. Visual position is identical.
Adds ``__tests__/session-selector-checkbox-click-target.test.tsx``
(3 cases): wrapper className guard (h-8 + w-4, not h-4), click on the
wrapper outside the icon triggers selection without bubbling to
toggleVisibility, and click on the inner icon still toggles selection.
* test(playground): drop checkbox-click-target test file (not needed per review)
* [autofix.ci] apply automated fixes
* test: align session-selector checkbox assertions with full-height click target
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* fix: improve trace search functionality (#13383)
* improve trace search functionality
* [autofix.ci] apply automated fixes
---------
Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* test: fix test_login_logs_real_output_format to use mocking
- Updated test to use patch() instead of capsys for consistency
- Verifies structlog kwargs format (not nested extra dict)
- All 7 login logging tests now passing
---------
Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local>
Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>
Co-authored-by: keval shah <kevalvirat@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: olayinkaadelakun <olayinka.adelakun@ibm.com>
Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local>
* feat: add wxO agent name to api list items
* feat: expose wxO agent metadata in deployment provider data
Add a validated Watsonx Orchestrate deployment item provider_data contract that carries agent name, display name, description, tool IDs, environments, and detail-only LLM metadata.
Use that shared contract in the adapter service and API mapper so list, get, sync, and snapshot binding paths parse provider metadata consistently and fail with structured internal errors when the adapter payload is invalid. Update unit coverage for list/get shaping, sync provider_data, optional LLM handling, empty tool IDs, and contract validation failures.
* feat(deployments): rename deployment label to display name
Rename deployment DB/local contracts from name to display_name so resource_key remains the provider identity and duplicate display labels are allowed.
- Add Alembic migration to rename deployment.name, drop provider-scoped display-name uniqueness, preserve resource_key uniqueness, and restore downgraded names safely.
- Update Deployment model, CRUD create/update/list/count paths, related attachment queries, validation, and conflict messages for display_name.
- Remove deployment display-name conflict checks so duplicate labels can coexist under the same provider account.
- Reject local DB names filters unless load_from_provider=true, keeping names as provider technical-name filtering only.
- Update deployment API route handling and base/watsonx mapper response shaping to read display_name from local rows.
- Update backend unit and integration tests across deployment CRUD, route handlers, mappers, sync, telemetry, flow/project responses, names filters, and attachment paths.
* Update deployment API contract to use display_name
Rename deployment REST request and response fields from name to display_name for Langflow-tracked deployments while preserving provider-only names filtering for load_from_provider=true. Map display_name through create, update, get, list, and status responses, and document that stored/displayed deployment names are synced from the provider.
Update deployment mappers and route tests for the new contract, including rejection of DB-mode names filtering and integration coverage for local display_name responses versus provider name payloads.
* feat: sync provider deployment display metadata
- Rename deployment-facing name semantics toward display_name while preserving resource_key as the stable provider identity
- Add provider metadata extraction contracts for list/get sync and wire routes through shared sync helpers
- Sync provider-owned display_name and description into local deployment rows on list/get
- Preserve updated_at during provider metadata sync so read reconciliation does not look like a local edit
- Decouple wxO technical agent names from user-facing display labels by generating langflow_agent_<id> names
- Stop changing wxO technical name when updating display_name or description
- Remove duplicated display_name and description from wxO provider_data for Langflow-tracked responses
- Require wxO provider display metadata instead of falling back to technical names
- Wrap malformed wxO get metadata as deployment errors instead of leaking KeyError
- Update deployment attachment listing/counting to ignore orphaned flow-version links
- Normalize LFX deployment create/update names with non-empty string constraints
- Add real SQLite CRUD coverage for metadata sync and orphaned attachment filtering
- Add deployment integration coverage for get/list provider metadata sync into DB rows
- Add wxO mapper, service, route, and schema tests for display metadata, generated technical names, and update behavior
* feat: align deployment API with provider display names
- Move tracked wxO deployment create/update labels out of top-level request fields and into `provider_data.display_name`.
- Remove top-level `display_name` from tracked deployment list, get, create, and update responses so provider-owned labels are returned through `provider_data`.
- Add wxO `provider_data.name` for the provider technical agent name and `provider_data.display_name` for the user-facing agent label in create/update/get/list response shaping.
- Remove deployment-list `names` filtering from the REST route, mapper list params, synced list helper, DB list/count helpers, LFX list schema, and wxO service query params.
- Change existing wxO agent onboarding to fetch the provider resource first and create only the local Langflow tracking row.
- Reject create-time mutations when `provider_data.existing_agent_id` is used, including display/LLM/tool/flow changes and explicit description updates.
- Seed local deployment `display_name` and `description` for existing-agent onboarding from provider metadata instead of request fields.
- Add provider-specific mapper hooks to build local `Deployment` models and local update kwargs from validated provider payloads.
- Add `create_deployment_from_model` so routes can persist mapper-built deployment rows without duplicating provider-specific field extraction.
- Require `provider_data.display_name`, `provider_data.llm`, and at least one flow/tool operation for new wxO agent creation.
- Preserve metadata-only update support while routing wxO display-name updates through `provider_data.display_name` and description updates through the public description field.
- Include wxO technical deployment names in adapter create/update result payloads so API responses can expose provider technical names alongside display labels.
- Truncate provider-synced deployment descriptions to the deployment description limit before storing local metadata.
- Remove the tracked deployment status route/schema and mark wxO status lookup as not configured instead of inferring health from draft-agent metadata.
- Tighten LFX update validation by rejecting explicit null technical names while still allowing explicit null descriptions.
- Keep wxO config and snapshot list responses as validated provider payloads instead of collapsing empty payloads to null.
- Update backend and LFX tests for provider-data display labels, removed top-level display names, removed deployment-name filters, existing-agent onboarding, status route removal, metadata sync truncation, and update validation.
* add changes from mapper base
* feat: generate managed wxO technical names
- Generate Langflow-managed wxO agent technical names as `lf_<normalized_display_name>_<short_uuid>`
- Reject display labels that cannot contribute a normalized name segment instead of falling back silently
- Generate a fresh wxO technical name when an agent display label changes
- Keep update payload branching explicit so description, LLM, and name updates only send intended fields
- Use update retry semantics for wxO agent updates
- Make wxO name validation errors use explicit field labels such as `Connection app id`, `Tool name`, and `Agent name`
- Update wxO adapter and mapper tests for managed technical names and resource-specific validation messages
* fix: separate wxO deployment technical names from labels
- Keep adapter-level deployment name fields as provider technical names.
- Move wxO user-facing labels to provider_data.display_name.
- Let the wxO adapter generate Langflow-managed technical names when spec.name is omitted.
- Use the langflow_ prefix with fresh UUID suffixes for generated wxO technical names.
- Strictly validate explicit technical names without rewriting them.
- Reject explicit null or blank values for technical name, display name, LLM, and description updates.
- Allow symbol-only display names by falling back to the resource type for generated names.
- Clarify fallback naming errors when both display name and resource cannot produce a valid segment.
- Add display_name support to wxO create and update payload contracts.
- Align mapper create and rollback behavior with adapter-owned technical name generation.
- Preserve rollback behavior for blank descriptions by mapping them to null.
- Update LFX deployment schemas for optional adapter name fields.
- Fix the deployment rename migration dependency to keep Alembic on a single head.
- Update deployment and wxO tests for the new name contract and validation behavior.
* refactor: separate wxO tool display and technical names
- Replace user-facing wxO tool label inputs with tool_display_name in create, update, and rename payload contracts.
- Remove mapper-side wxO tool technical-name normalization and validation, so user labels are no longer treated as provider technical names.
- Add wxO flow-artifact provider-data validation that requires tool_display_name and generates provider_data.tool_name when omitted.
- Keep provider_data.tool_name as the adapter-owned wxO technical name and provider_data.tool_display_name as the user-facing label.
- Use generated provider_data.tool_name as the raw tool correlation key for tools.raw_payloads and operations[*].tool.name_of_raw.
- Keep top-level raw BaseFlowArtifact.name separate from wxO technical names instead of overloading it for provider correlation.
- Add mapper-local grouped flow-tool payload data containing display_name, provider_data, and raw_name for each flow version.
- Build wxO flow tool provider_data through the adapter payload slot instead of a mapper-owned artifact schema.
- Add create/update adapter payload builder helpers that validate provider payloads through the configured adapter slots.
- Convert adapter-bound payload validation failures during mapper construction into internal contract errors rather than client 422s.
- Remove the generic base mapper create-flow-artifact provider-data helper because wxO now owns provider-specific tool metadata.
- Update create flow mapping to derive default tool_display_name from the flow name and generate technical tool names internally.
- Update update flow mapping to derive tool_display_name for raw flow payloads and emit rename_tool only for existing attached tools.
- Preserve bind, unbind, attach, remove, and rename operation behavior while switching raw selectors to generated technical names.
- Add flow-version provider-data shaping that exposes app_ids, technical tool_name, and user-facing tool_display_name.
- Require snapshot/list item provider data to include both technical name and display name so corrupt provider data fails fast.
- Update deployment flow-version schema documentation to tell clients to display provider_data.tool_display_name and treat provider_data.tool_name as technical metadata.
- Update wxO create/update planning to key raw tools by provider_data.tool_name instead of BaseFlowArtifact.name.
- Update wxO tool creation to set wxO name from provider_data.tool_name and wxO display_name from provider_data.tool_display_name.
- Remove redundant downstream None checks for tool_name and tool_display_name after schema validation guarantees them.
- Remove the raw-tool-name helper and direct None filtering now that tool_name is generated by the provider-data schema.
- Rename provider rename operation payload from new_name to tool_display_name.
- Generate technical names for rename updates from tool_display_name rather than using the display label as the provider name.
- Load current agent tools once during update apply and reuse that tool map for connection deltas, renames, and connection pre-seeding.
- Consolidate existing-tool connection deltas and renames into one helper with separate delta and rename loops and one provider update batch.
- Ensure a tool with both connection changes and a display-name rename is updated once using a single merged writable payload.
- Preserve rollback snapshots for existing tools before connection or rename mutations are applied.
- Pre-seed resolved connection ids from loaded agent tool bindings while letting explicit operation resolution overwrite provider-seeded values.
- Keep later provider binding values for duplicate app ids during pre-seeding, matching explicit update overwrite semantics.
- Add snapshot provider-data extraction in the wxO service that carries technical name, display name, and Langflow connection bindings.
- Update mapper tests for create raw tool payloads, display-name overrides, generated technical names, raw correlation, and rename operations.
- Update adapter schema tests for raw tool pools keyed by generated provider technical names and required display-name provider data.
- Update service/update tests for rename batching, loaded-tool reuse, connection delta preservation, rollback behavior, and ownership checks.
- Update snapshot and flow-version response tests to assert both technical and display tool metadata.
* feat(deployments): sync provider display metadata
- BE `api/v1`, `mappers/deployments`: Source local deployment create and update metadata from provider adapter results so `display_name` and `description` stay aligned with authoritative provider state.
- BE `mappers/deployments`, `database/models/deployment`: Replace the removed deployment metadata schema with mapper-owned CRUD kwargs for list/get/update sync while preserving flexible provider-specific metadata handling.
- BE `mappers/deployments`, `database/models/deployment`: Add description truncation with structured callsite/provider logging and log actual DB metadata sync writes with changed fields and before/after lengths.
- BE `database/models/deployment`: Keep DB metadata sync focused on real changes so provider descriptions truncated locally do not cause unnecessary writes when cached values already match.
- BE `services/adapters/deployment/watsonx_orchestrate`: Update wxO create/update result contracts to include provider display metadata, technical `name`, descriptions, and snapshot/tool binding details consistently.
- BE `services/adapters/deployment/watsonx_orchestrate`: Build wxO create agent payloads once before provider create, carry the resolved provider description into create results, and keep wxO description fallback behavior explicit.
- Both BE `services/adapters/deployment/watsonx_orchestrate` and FE `deploymentsPage`: Separate wxO technical names from user-facing display labels across adapter results, UI payloads, and tests.
- FE `controllers/API/queries/deployments`, `deploymentsPage`: Move deployment create/update payloads to `provider_data.display_name` and `tool_display_name`, removing stale top-level `name` and `tool_name` usage.
- FE `deploymentsPage`, `deploy-choice-dialog`: Default tool display names to the flow name instead of generated technical suffixes, and use keyed selected flow versions to distinguish repeated flow attachments.
- FE `deploymentsPage`, `deploy-choice-dialog`: Update deployment attachment and deploy-choice dialog flows to use selected-flow-version keys, provider tool display names, and current flow names consistently.
- FE `controllers/API/queries/deployments`, `deploymentsPage`: Remove provider name-check hooks, wxO name-normalization helpers, and related validation tests now that display names are not technical identifiers.
- FE `deploymentsPage`: Relax deployment display-name validation to require only non-empty input, allow edit-mode display-name changes, and send changed display labels through `provider_data.display_name`.
- FE `deploymentsPage`: Make deployment display/technical-name helpers null-safe when provider data is missing, with resource-key fallbacks for table, details, delete, and test flows.
- FE `deploymentsPage`: Update deployments page UI to render display names separately from technical names and avoid exposing descriptions in table rows.
- FE `controllers/API/queries/deployments`: Align create, patch, list, and attachment query types with provider metadata and `tool_display_name` contracts.
- LFX `services/adapters/deployment`: Align deployment create results with the provider metadata contract by carrying type, technical name, and description instead of stale config/snapshot result fields.
- BE `database/models/deployment`: Add a TODO for DB-level length enforcement of provider-synced display metadata.
- Tests `src/backend/tests`, `src/frontend/**/__tests__`, `src/lfx/tests`: Add/update coverage for provider metadata sync, truncation, update persistence, response shaping, display-name validation, keyed attachments, and nullable provider data.
* fix: tighten watsonx deployment payload contracts
- Remove snapshot-name filtering from deployment snapshot listing:
- Drop the `names` query parameter from the API route.
- Remove `snapshot_names` from `SnapshotListParams`.
- Remove wxO snapshot-name normalization and service lookup paths.
- Remove direct E2E scenarios and unit coverage for snapshot-name listing.
- Make wxO deployment provider data match the provider API contract:
- Require wxO agent list/detail payloads to include `tools` and `llm`.
- Read `agent["tools"]` and `agent["llm"]` directly instead of defaulting or normalizing missing provider fields.
- Include `llm` in deployment list/provider-data shaping.
- Preserve provider-owned strings instead of silently stripping or dropping blanks in result payloads.
- Tighten wxO API and adapter payload validation:
- Replace ad hoc string validators with shared non-empty string annotations where appropriate.
- Reject explicit `null` for update scalar fields such as `llm` and `display_name`.
- Require non-empty provider ids, tool ids, app ids, model names, environments, and execution ids in wxO payload schemas.
- Fix wxO update payload patch semantics:
- Build provider update bodies using `model_fields_set` so omitted `llm` and `display_name` stay omitted.
- Keep `exclude_unset=True` for validated update payload serialization.
- Preserve LLM-only update behavior without emitting omitted scalar fields as explicit nulls.
- Simplify wxO update planning and rollback:
- Remove `extract_agent_tool_ids` and rely on the wxO agent `tools` field directly.
- Fetch only existing tools that update operations mutate or rename.
- Stop pre-seeding connection bindings from unrelated attached tools; operation app ids now resolve through explicit update operations.
- Adjust wxO deployment listing behavior:
- Treat singular `environment` as a strict local filter.
- Leave plural provider parameters as provider passthrough.
- Rename deployments table header from `Name` to `Display Name`.
- Update tests for the new contracts:
- Remove snapshot-name route, mapper, service, and E2E coverage.
- Add/update coverage for required `llm`, required provider metadata, null update scalar rejection, stale snapshot handling, and provider-owned string preservation.
- Update frontend table header expectations.
* direct key access in tool logs
* fix(deployments): preserve full deployment descriptions
- Remove provider metadata sync logging that emitted deployment identifiers and field length changes.
- Remove description truncation from deployment mapper contracts and Watsonx metadata mapping.
- Remove the deployment description max-length cap from LFX schemas, Langflow API schemas, and database CRUD validation.
- Pass provider descriptions through unchanged during create, update, list, and get metadata sync flows.
- Update backend, integration, and LFX tests to assert long descriptions are accepted and preserved.
* refactor(deployments): centralize mapper payload slot validation
- Move shared API request and adapter slot parsing into BaseDeploymentMapper.
- Add provider label enforcement so mapper subclasses fail fast when error text cannot identify the provider.
- Add outer request validation support for provider_data slots and map validation failures to 422 responses.
- Move wxO existing-agent description conflict validation into the wxO create payload contract.
- Update wxO mapper call sites to use the shared base parsing helpers.
- Add focused tests for provider label enforcement, slot error mapping, outer request validation, and existing-agent description conflicts.
* fix downgrade migration to actually recover unique constraint for the name column
* fix(deployments): clarify wxo deployment name labels
- Rename user-facing wxO deployment display-name labels from "Display Name" to "Name" across the deployment form, review step, table, loading state, and details modal.
- Label the provider-backed technical identifier as "Technical Name" in deployment details so it is distinct from the editable display name.
- Restore deployment descriptions under the deployment name in the deployments table.
- Align validation copy and frontend tests with the updated label behavior.
* fix(deployments): validate snapshot patch project scope
- Reuse the existing deployment project-scope validator in the snapshot patch route before resolving provider credentials or mutating wxO artifacts.
- Enforce that replacement flow versions belong to the tracked deployment project while keeping different-flow snapshot updates allowed.
- Add route coverage proving project validation uses the deployment row's project_id and short-circuits before provider adapter work.
- Update stale wxO mapper and sync test expectations for the current provider-data contract and mapper error messages.
- Verified backend deployment tests and isolated lfx deployment tests are green.
* test(deployments): align list integration tests with current API
Update deployment list integration tests after removal of the names
query parameter and list items without a top-level display_name.
Assert synced display names via refreshed DB rows and provider
entries instead of response fields that no longer exist.
* rename test file
* rename test file
* fix(deployments): tighten wxo provider metadata contract
Trust required wxO API fields directly, remove duplicate deployment names from provider_data, and keep mapper output sourcing names from top-level deployment metadata.
* fix(deployments): preserve provider display names in db
Keep deployment display names exactly as received while still rejecting blank values, and continue normalizing resource keys for DB lookups.
* fix(deployments): align patch payload and display_name schema
Send provider_data.llm only when changed in deployment PATCH payloads, preserving granular update behavior and no-op fallback semantics. Keep deployment.display_name nullable across migration/model paths and align wxO snapshot tests with the required display_name provider contract.
* fix test
* chore: remove updates to e2e adapter tests, defer to a follow up PR
* refactor(deployments): simplify wxO provider list shaping
Flatten provider list entries directly from adapter provider_data and
validate once via parse_adapter_slot on deployment_list_result. Remove
redundant per-item schema validation, id strip filtering, and description
guesswork; require provider_data to be a dict and let canonical item
fields override provider payload.
* simplify downgrade migration to always append deploymend id to the name
* fix(wxo): keep mapper imports free of IBM SDK via payloads
Move Watsonx naming and field validation helpers into payloads.py so
mapper -> payloads no longer imports utils.py and its IBM client deps.
Point core modules and tests at the shared payload helpers and leave
utils.py for runtime error/utility helpers only.
* fix(watsonx): lazy adapter package imports and explicit registration
Move adapter registration into register.py so importing payloads or the
mapper does not load optional IBM SDK modules via package __init__.py.
Use lazy package exports for service and types, dedupe update result IDs
in WatsonxDeploymentUpdateResultData, and use direct BaseFlowArtifact
field access in flow tool creation.
* fix(test): align Watsonx guards with lazy package imports
Skip SDK-backed service tests via importorskip on IBM packages instead of
importing the lightweight watsonx_orchestrate package. Run schema and mapper
tests against payloads directly and remove obsolete module-level skips so
Py 3.10 CI can collect SDK-free Watsonx tests.
* fix(test): skip explicit Watsonx modules without IBM SDK
Guard Watsonx-named schema and mapper test modules by importing
WatsonxOrchestrateDeploymentService, which exercises the lazy package export
and fails when optional IBM SDK dependencies are unavailable.
* fix(test): align deployment E2E mocks and review-step expectations
Add provider_data.display_name to deployment mocks so delete and edit
tests match getDeploymentDisplayName. Update review-step Playwright tests
for display-name behavior that no longer blocks deploy on duplicates or
numeric flow names.
* fix ff test
* fix(deployments): hide technical name in details and fix migration chain
Show only the display name in the deployment info grid. Point the
display_name rename migration at f6b3ce6845d4 so Alembic ordering is correct.
* fix down revision
* fix ruff
* fix playwright test
* fix(deployments): send only changed PATCH fields and trust API display names
Stop re-sending unchanged description on update and skip the PATCH when
there are no changes. Resolve UI labels from provider_data.display_name
only, without resource_key or technical name fallbacks.
* fix(deployments): restore i18n labels and polish edit-save UX
Restore deployments.labelName/columnName and related keys instead of
hardcoded English. Show an em dash when display_name is missing, remove
dead toolNameErrors code, and toast when edit save has no changes.
* fix(deployments): scope snapshot list and patch to deployment owner
Remove the actor-owned provider lookup before deployment resolution so
collaborators with READ on a shared deployment can list snapshots. Validate
replacement flow versions under owner_id on snapshot PATCH, not the actor.
* fix(test): deployment edit E2E and Biome import order
Edit stepper skips PATCH when there are no changes, so the E2E test
updates the deployment name before submit. Organize imports in
select-gpt-model.ts for Biome.
* fix(deployments): align provider metadata sync with RBAC owner scope
Match metadata batch updates on (deployment id, owner user_id) so shared
deployment list/get sync writes in the owner's namespace. Stop rolling
back the outer session when attachment sync fails on GET so provider
display_name/description sync is preserved. Group list attachment
reconcile by deployment owner and use row.user_id for stale deletes.
* fix(test): align deployment sync mocks with row owner scope
Add user_id to deployment row mocks so list_deployments_synced tests
match per-owner delete and metadata batch behavior. Remove unused
imports in the deployment step-type component.
* [autofix.ci] apply automated fixes
* revert(deployments): restore rollback, direct metadata keys, single-owner list sync
Per PR review: bring back outer session rollback on GET attachment-sync
failure, fail fast on provider metadata dict access, and use a single
user_id for list attachment reconcile (N+1 per-owner grouping deferred).
Owner-scoped metadata batch updates in CRUD are unchanged.
* update down revision
* fix(frontend): remove unused i18n import in step-review utils
Drop leftover import after refactor so Biome check passes.
---------
Co-authored-by: himavarshagoutham <himavarshajan17@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* fix(ci): lockstep langflow-nightly and langflow-base-nightly versions
The nightly pipeline computed each package's .devN number independently
(pypi_nightly_tag.py queried each package's own PyPI history and
incremented separately), while langflow-nightly pins an exact
langflow-base-nightly[complete]==X.Y.Z.devN dependency. Because
langflow-nightly publishes on more nights than langflow-base-nightly,
the two counters drift (live: dev54 vs dev48). Each time base lags a
publish while main succeeds, the newest langflow-nightly pins a base
dev that does not exist yet, so 'uv pip install langflow-nightly'
becomes unsatisfiable and silently falls back to a weeks-old version.
Fix: version the two packages in lockstep. pypi_nightly_tag.py now
derives a single shared dev number from max(dev across BOTH packages'
PyPI histories) + 1 (restricted to the root base_version), so main and
base always get the identical tag and main's exact pin always
references a base version built and published in the same run. The tag
is computed in a single invocation ('both' mode) so the release and
base tags cannot drift across separate calls.
Also hardens tag computation: 404 / network / malformed responses for
either package now contribute nothing instead of crashing, a
base-version bump resets the dev counter cleanly, and non-dev/final
releases never advance it.
Adds scripts/ci/test_pypi_nightly_tag.py (unit tests) and a
ci-scripts-test.yml workflow to run scripts/ci tests on PRs.
* fix(ci): fail closed on non-404 PyPI errors in nightly tag computation
_all_dev_numbers() previously returned [] for ANY failure (network error,
non-404 HTTP status, malformed 200), which is unsafe: _shared_nightly_version()
takes max(dev)+1 across both packages, so a transient lookup failure on the
higher-versioned package silently LOWERS the next tag. E.g. if the langflow-nightly
lookup fails while langflow-base-nightly reports dev48, the script would emit
v1.10.0.dev49 even though langflow-nightly already published through dev54 — the
workflow then force-recreates an old git tag and fails publishing an already-existing
PyPI version.
Fail closed: only a true 404 (package has no releases) contributes []; network
errors, 5xx/non-404 statuses, and malformed 200s now raise so the nightly job aborts
before mutating tags. Adds tests for malformed/5xx/network failures and a direct
regression test for the higher-package-lookup-failure scenario.
* Update scripts/ci/test_pypi_nightly_tag.py
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Update test_pypi_nightly_tag.py
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
feat(ci): reduce macOS Intel CI matrix and add macOS support docs
- Remove Python 3.10 from macOS Intel stable CI matrix (keep 3.12 only)
- Add comprehensive macOS support documentation
- Document Python 3.14 support status (limited on Intel, no PyTorch)
- Reduces CI costs by ~$5-7 per run (~$1,800-2,500/year)
Implements LE-781 recommendations R2 and R3 from LE-265 investigation.
Related: LE-265, PR #12477
* feat(i18n): translate missing frontend strings for flow list and DB Providers page
- Wrap "Edited X ago" timestamp in flow list with t() using new
mainPage.editedAgo and mainPage.timeElapsed.* keys (plural forms)
- Add settings.nav.dbProviders and settings.dbProviders.* keys covering
page title, description, badges, button labels, and all toast messages
- Wire useTranslation into DBProvidersPage, ProviderListItem,
ProviderConfigurationPanel, TextFieldRow, BooleanFieldRow, and
dbProviderInputComponent
- Download updated translations for fr, ja, es, de, pt, zh-Hans
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(i18n): translate DB provider descriptions and config field labels
Add translation keys for all provider descriptions (Chroma Local,
Chroma Cloud, OpenSearch, Astra DB, MongoDB Atlas, Postgres pgvector)
and all configField labels and helperTexts (API Key, Tenant, Database,
Region, Cluster URL, Username, Password, index/vector/text fields, TLS
toggles). Use dynamic key lookup with defaultValue fallback so new
providers degrade gracefully. Download updated translations for all
six locales.
* [autofix.ci] apply automated fixes
* feat(i18n): translate missing strings in Memories, Knowledge Base, toasts, and notifications
- Translate untranslated strings in Knowledge Base upload modal (DB Provider label/description, Metadata section)
- Translate all Memories feature strings (sidebar, create modal, detail header, chunk table, empty states)
- Wire all hardcoded toast/notification strings through t() across 14 files (flow store, model provider, deployments, update components, shortcuts, file manager, dict/JSON editors, utils)
- Delete orphaned alerts_constants.tsx (all imports already removed)
- Add ~100 new keys to en.json across memory, errors, deployments, shortcuts, updateComponents, and files namespaces
- Upload to GP and download all 6 translated locale files (fr, ja, es, de, pt, zh-Hans)
* fix(i18n): translate Memories tooltip in left panel nav
* fix(ui): left-align card description text on empty page
* feat(i18n): translate hardcoded strings across UI components and update locale files
Wraps ~100 hardcoded strings in t() calls across 45 source files covering
voice assistant, deployments, flow build, playground, assistant panel,
knowledge base ingestion, inspection panel, IO modal, and more. Adds
corresponding keys to en.json and syncs all locale files (fr, de, es, pt,
ja, zh-Hans) via the GP pipeline.
Also fixes a React 19 RefObject<T | null> type mismatch in visual-variants.ts.
* [autofix.ci] apply automated fixes
* fix(i18n): translate shortcut success/error messages with proper name i18n
Added shortcuts.successChanged and shortcuts.successReset keys so success
toasts display the translated shortcut name via shortcuts.name.* lookup.
Updated EditShortcutButton to use existing translated error keys and the
new success keys with toCamelCase name resolution.
* fix(i18n): translate "or visit" and "+N more" in file upload modal
* fix(i18n): translate NoteNode context menu and fix missing vector store RAG note translations
- Add t() calls to NoteNode select-items.tsx for Duplicate/Copy/Docs/Delete menu items
- Fix docsUnavailable notice string in NoteToolbarComponent
- Download missing fr/ja translations for template_notes.vector_store_rag keys from GP
* fix(i18n): translate Delete label in edge context menu
* fix(i18n): translate Version History Export/Delete menu and preview overlay strings
- VersionListItem: replace hardcoded Export/Delete with t("flow.menu.*")
- VersionPreviewOverlay: replace hardcoded Current Flow, Previewing, (Read-Only),
Loading preview... with t("version.*") calls
- Add 4 new keys to en.json; upload to GP and download all locale translations
* fix(i18n): translate hardcoded strings in Update Components modal
Replace Component/Update Type headers, Breaking label, and modal title
with t() calls; add 5 new keys to en.json and sync all locale translations
* fix(i18n): translate assistant panel hardcoded strings
- model-selector: replace "Loading..." and "Select model" with t() calls
- assistant-panel.constants: convert getAssistantPlaceholder() to use i18n.t()
with 5 keyed placeholder variants
- messages.ts: replace 48 hardcoded progress/thinking strings with i18n key arrays
(8 thinking + 5 groups × 8 progress); VALIDATION_FAILED/RETRYING arrays were
dead code and removed
- Add 55 new keys to en.json; upload to GP and download all locale translations
* [autofix.ci] apply automated fixes
* fix(i18n): update sidebarSegmentedNav test to expect i18n key for memories
The memories nav item was updated to use "memory.sidebarTitle" as its
label/tooltip i18n key, but the test still expected the old hardcoded
"Memories" string.
* fix(i18n): replace deleted alerts_constants import with t() calls in PageComponent
The release-1.10.0 merge re-introduced an import from alerts_constants which
was deleted in Phase 1 of the i18n migration. This crashed the Vite dev server,
causing all Playwright tests to fail on startup.
Also fixes Biome import order in use-session-history.ts from the merge conflict
resolution.
* fix(i18n): restore ASSISTANT_PLACEHOLDERS export and translate formatDate fallback
- Re-export ASSISTANT_PLACEHOLDERS as translated strings computed from keys
so getAssistantPlaceholder() returns from the array (restores test contract)
- formatDate() now returns i18n.t("memory.never") instead of "" for the
empty-date fallback
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* fix(playground): expand session checkbox click target to full row height
The selectable-row checkbox wrapper was ``w-4 h-4`` (16x16 px) but the
row is ``h-8`` (32 px). The 8 px band above and the 8 px band below
the visible icon were dead zones that bubbled to the row's
``toggleVisibility`` and navigated to the session instead of toggling
selection — exactly the accidental-navigation UX the bug ticket
describes.
Grow the wrapper to ``w-4 h-8`` so the click target captures the full
row height. Width stays narrow so the text alignment is unchanged; the
icon itself stays ``h-4 w-4``, centered via the existing
``flex items-center justify-center``. Visual position is identical.
Adds ``__tests__/session-selector-checkbox-click-target.test.tsx``
(3 cases): wrapper className guard (h-8 + w-4, not h-4), click on the
wrapper outside the icon triggers selection without bubbling to
toggleVisibility, and click on the inner icon still toggles selection.
* test(playground): drop checkbox-click-target test file (not needed per review)
* [autofix.ci] apply automated fixes
* test: align session-selector checkbox assertions with full-height click target
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* docs: add structured output for agents
* docs: add structured output note
* docs: clarify both agent outputs and add release notes
* docs: when langflow sends events to the playground and chat history
* ci: isolate bundle installs from the core release gate; lazy-import ibm-db
Two follow-ups to wiring lfx-ibm (and future native-dep bundles) into the
nightly/release pipeline.
1. cross-platform-test.yml: split the monolithic "Install packages from
wheel" step (in both the stable and experimental jobs) into three:
- core install (SDK/LFX + langflow-base) -- release gate
- per-bundle bundle install -- NON-BLOCKING (continue-on-error), reports
per-bundle pass/fail to the GitHub step summary
- langflow main install -- release gate
A bundle whose dependency has no wheel on a tested platform is now reported
as "failed (non-blocking)" instead of failing the whole nightly/release
publish. Local bundle wheels are still installed before main, so langflow
resolves its bundle deps from the freshly-built wheels rather than PyPI.
NOTE: a bundle that langflow hard-depends on is still pulled (and thus
gated) by the main install; to make a bundle optional on a platform, also
add a PEP 508 marker to its dependency line in langflow's pyproject.toml.
2. lfx-ibm: import ibm_db_dbi lazily inside DB2VS.__init__ (db2vs.py) instead
of at module top level, mirroring db2_vector.build_vector_store. ibm-db
ships no linux/aarch64 wheel, so the bundle now imports on that arch (only
the DB2 vector store is inert there; the watsonx components keep working).
Guard the driver-dependent test modules (test_db2vs, test_db2_vector) with
a module-level skip when ibm_db_dbi is unavailable, matching the existing
watsonx test pattern so they no longer error at collection on linux/aarch64.
Verified locally: 59 DB2 tests pass with ibm-db present; with ibm-db absent
the bundle imports cleanly, DB2 use raises a clean ImportError, and the
guarded test modules skip (9 passed, 2 skipped, 0 errors). actionlint adds no
new shellcheck findings vs HEAD; ruff check/format clean.
* fix: Remove long comments for bundle deps (#13403)
* [autofix.ci] apply automated fixes
* ci: revert bundle-install restructure to blocking; add ibm-db import regression test
Addresses two review findings on the lfx-ibm bundle changes.
1. Revert the cross-platform-test.yml bundle-install restructure. The
non-blocking per-bundle step could let the main install satisfy a hard-dep
bundle from PyPI (the index was not disabled), masking a broken local build,
and it never actually protected hard-dep bundles -- main re-gates them
anyway. Restore the original blocking, install-by-path step (local bundle
wheels install before main, so the gate is reliable and PyPI cannot
substitute). Document the real isolation lever for a genuinely
platform-optional bundle -- a PEP 508 marker on its dependency line in the
root pyproject -- in src/bundles/PORTING.md.
2. The module-level skip hid the importability regression the lazy import was
meant to guard. Add test_optional_dependency.py: it simulates ibm-db's
absence and asserts db2vs + the bundle package import and that DB2 use
raises a clean ImportError -- it runs on every platform, including the
x86_64 CI runners. Replace the module-level skips in test_db2vs.py /
test_db2_vector.py with class-level skipif on the DB2-driver test classes
only, so the helper tests and the module-level imports still run (and assert
importability) where ibm-db is absent.
Verified: with ibm-db present, 112 bundle tests pass. With ibm-db uninstalled
(the real linux/aarch64 case, find_spec -> None), 67 pass / 45 skip / 0 errors
-- the regression tests and helper tests run, only the driver-dependent classes
skip. actionlint reports no new findings; ruff check/format clean.
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* feat(ibm): add DB2 Vector Store component
Add comprehensive IBM DB2 Vector Store integration for Langflow.
Components Added:
- DB2VectorStoreComponent: Main vector store component
- DB2VS: LangChain-compatible vector store implementation
- DB2 security validators: Input validation and sanitization
Features:
- Vector similarity search (Similarity, MMR, Similarity Score Threshold)
- Secure connection handling with input validation
- Metadata filtering for complex data types
- Duplicate detection support
- Batch document ingestion
Test Coverage:
- 41 unit tests (38 passing, 3 skipped)
- Component integration tests
- Security validation tests
- DB2VS class tests
Documentation:
- Comprehensive developer guidelines
* refactor(db2): simplify component to match Chroma patterns
- Remove complex data ingestion (CSV, DataFrame, dict, Message handling)
- Add _add_documents_to_vector_store() method matching Chroma
- Add similarity_score_threshold search type
- Simplify data ingestion from 220 to 45 lines (80% reduction)
- Add 5 new tests (similarity_search, mmr_search, search_with_different_types, duplicate_handling, metadata_filtering)
- All 41 tests passing (38 passed, 3 skipped)
BREAKING CHANGE: Component now only accepts Data objects for ingestion.
* ci: fix CI failures - update component index and starter projects
- Regenerate component_index.json with DB2 component
- Update all starter projects with new component registry
- Fix ruff formatting issues
* ci: trigger CI re-run to fix merge issue
* ci: add merge conflict resolution for component_index.json in autofix workflow
Handle merge conflicts in the Update Component Index job by:
- Automatically resolving component_index.json conflicts using --theirs strategy
- Failing if non-generated files have conflicts (requires manual resolution)
- Completing the merge after resolving generated file conflicts
This prevents the workflow from failing when component_index.json has conflicts
during PR updates, as this file is auto-generated and can be safely regenerated.
* fix: Remove DB2SQLComponent reference from IBM components
- Removed DB2SQLComponent from __init__.py as the db2_sql.py module doesn't exist
- This fixes the test_all_modules_importable test failure
- Fixes CI failure in Unit Tests - Python 3.14 - Group 5
* revert: Remove unrelated starter project JSON changes
* revert: Remove unrelated CI workflow and formatting changes
* docs: add DB2 Vector Store .mdx documentation following Chroma DB structure
* fix: address CodeRabbit review comments - add __init__.py docstring and implement score threshold filtering
- Added docstring to src/backend/tests/unit/components/__init__.py to fix Ruff INP001 error
- Added FloatInput score_threshold parameter (default 0.5) to DB2 Vector Store component
- Implemented threshold filtering in similarity_score_threshold search mode
- Filters results to only include documents with relevance scores >= threshold
* chore: remove auto-generated and unnecessary files from PR
- Remove uv.lock (dependency lock file - auto-generated)
- Remove src/frontend/package-lock.json (frontend lock file - auto-generated)
- Remove src/lfx/src/lfx/_assets/component_index.json (auto-generated by CI)
- Remove .secrets.baseline (security baseline - auto-generated)
- Remove starter_projects JSON (auto-generated example)
- Remove tweaks_builder.py (unrelated test helper)
Per DEVELOPMENT.md guidelines, these files should not be committed by contributors.
* chore: restore auto-generated files to keep PR focused on DB2 component
* fix(ci): update auto-generated files and fix docs build
- Update component index with new IBM DB2 components (363 components, 97 modules)
- Update frontend package-lock.json
- Fix docs build by removing reference to missing image in bundles-db2.mdx
Fixes CI failures:
- Update Component Index
- Update Starter Projects
- Test Docs Build
* feat(db2): add SSL/TLS support to DB2 Vector Store component
- Add SSL/TLS encryption support for DB2 database connections
- Add SSL certificate validation and download functionality
- Support local certificate files (.crt, .pem, .cer) and URLs
- Add optional certificate password support for encrypted keystores
- Implement automatic cleanup of temporary downloaded certificates
- Add comprehensive error handling and logging for SSL connections
- Update component_index.json with new SSL configuration inputs
- Update package-lock.json dependencies
Security improvements:
- Validate certificate paths and file permissions
- Support system default CA certificates (recommended for IBM Cloud DB2)
- Redact sensitive information in error messages
- Clean up temporary files on connection failure
This enhancement enables secure encrypted connections to DB2 databases,
which is recommended for production environments.
* [autofix.ci] apply automated fixes
* refactor(db2): minimize metadata storage in DB2 vector store
- Clear metadata before storage to reduce unnecessary data (file_path, filename, etc.)
- Return only text content during retrieval for cleaner results
- Optimize list comprehension for better performance (PERF401, RET504)
* test: remove skipped tests from DB2 vector store test suite
- Removed version compatibility tests for versions where component didn't exist
- Changed file_names_mapping to return empty list for new component
- Overrode base class version tests to prevent skips
- Fixed linting issues (hardcoded passwords, nested with statements)
- All 40 tests now pass with 0 skipped tests
* fix(tests): update DB2 vector store test description format
Fixes test_component_metadata assertion to match the actual component
description format. The test was failing due to line wrapping differences
in the multi-line description string.
Fixes CI failure in PR #13163
* [autofix.ci] apply automated fixes
* chore: trigger CI re-run to resolve flaky test failures
* fix(tests): mark OpenAI-dependent test as api_key_required to prevent CI failures
* restructure as new bundle package
* [autofix.ci] apply automated fixes
* fix(ibm): improve DB2 Vector Store component reliability and validation
* fix: implement SSL/TLS toggle functionality for DB2 Vector Store
- Add update_build_config method to dynamically show/hide SSL certificate fields
- SSL certificate path and password fields now only visible when use_ssl is enabled
- Improves UX by hiding irrelevant fields when SSL is disabled
- Update component_index.json with new component configuration
- All 38 existing tests pass
---------
Co-authored-by: Dhruv Chaturvedi <dhruv_insights@mac.lkw-in.ibm.com>
Co-authored-by: Dhruv Chaturvedi <dhruv_insights@Dhruvs-MacBook-Pro.local>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: priyanshu-krishnan1 <priyanshu.krishnan1@ibm.com>
Co-authored-by: Eric Hare <ericrhare@gmail.com>
The PyPI langflow-nightly is currently pip-uninstallable: its core bundle
deps (lfx-arxiv, lfx-duckduckgo) pin stable lfx>=0.5.0,<0.6.0, but stable
lfx tops out at 0.4.4 (the 0.5.0 line ships only as lfx-nightly, a separate
package name that cannot satisfy an lfx pin). So the pip/venv migration job
fails at the install step.
The Docker Compose migration job is unaffected (it runs the prebuilt nightly
image) and stays enabled. Re-enable once either a stable lfx 0.5.x is
published to PyPI or nightly bundle variants pinning lfx-nightly are
published and langflow-nightly depends on them.
