1201 Commits

Author	SHA1	Message	Date
Eric Hare	4a8b47e46a	Merge remote-tracking branch 'origin/release-1.10.1' into release-1.11.0 ... # Conflicts: # .secrets.baseline # pyproject.toml # src/backend/base/langflow/initial_setup/starter_projects/Pokédex Agent.json # src/backend/base/langflow/initial_setup/starter_projects/Structured Data Analysis Agent.json # src/backend/base/langflow/services/auth/service.py # src/backend/base/langflow/services/job_queue/service.py # src/backend/base/pyproject.toml # src/backend/tests/unit/components/models_and_agents/test_cuga_agent.py # src/backend/tests/unit/test_redis_job_queue_service.py # src/bundles/lfx-bundles/src/lfx_bundles/deepseek/deepseek.py # src/bundles/lfx-bundles/src/lfx_bundles/glean/glean_search_api.py # src/bundles/lfx-bundles/src/lfx_bundles/homeassistant/home_assistant_control.py # src/bundles/lfx-bundles/src/lfx_bundles/homeassistant/list_home_assistant_states.py # src/bundles/lfx-bundles/src/lfx_bundles/huggingface/huggingface_inference_api.py # src/bundles/lfx-bundles/src/lfx_bundles/lmstudio/lmstudioembeddings.py # src/bundles/lfx-bundles/src/lfx_bundles/xai/xai.py # src/frontend/package-lock.json # src/frontend/package.json # src/lfx/pyproject.toml # src/lfx/src/lfx/_assets/component_index.json # src/lfx/src/lfx/components/files_and_knowledge/filesystem.py # src/lfx/tests/unit/components/tools/test_filesystem_deny_list.py # uv.lock	2026-06-23 17:22:13 -07:00
Eric Hare	7896b9f7f1	feat(bundles): metapackage split (Phase A) — engine-only lfx, lfx-bundles long tail, 5 graduated partner packages (#13563) ... * feat(extension): add manifest-less lfx.bundles discovery + precedence tier Foundation for the bundle metapackage split (1.11). Adds a third @official-slot discovery source: a distribution declaring the [project.entry-points."lfx.bundles"] group ships a package whose immediate subdirectories are each a manifest-less bundle, folder-walked and registered at @official with no extension.json (the langchain-community model). - new loader/_bundles_root.py::load_lfx_bundles_extensions, mirroring discover_inline_bundles but sourcing roots from the lfx.bundles entry-point group via find_spec and reusing _load_bundle_directory - discovery precedence becomes installed > seed > lfx_bundles > dev > inline so a manifest-shipping lfx-<provider> always shadows the same-named provider in the metapackage (lets a provider graduate with no lockstep release), emitting the existing bundle-shadowed warning - new bundle-discovery-malformed warning code, emitted on warnings (never flips ok / aborts startup) for unresolvable declarations and invalid provider folder names - exported via loader/__init__ and the lfx.extension PEP-562 lazy surface 10 new tests in test_load_lfx_bundles.py; full extension unit suite (449) passes; ruff + format clean; mypy clean on the new module. * docs(bundles): changelog entry for the lfx.bundles discovery surface The BUNDLE_API.md changelog gate diffs each PR's branch against main, so the entry covering this PR's surface additions (lfx.bundles discovery, the lfx_bundles precedence tier, bundle-discovery-malformed) must live on this branch, not only further up the stack. Text is verbatim from the graduate-partners commit so the stacked merge dedupes trivially. * fix(extension): reject plain-module lfx.bundles targets; correct validate wording CodeRabbit review fixes on #13563: - _spec_package_dir no longer falls back to a plain module's parent directory -- a single-file entry-point target now emits the bundle-discovery-malformed warning instead of folder-walking unrelated sibling directories as bundles (+ regression test) - BUNDLE_API.md / loader docstring no longer say manifest-less providers are 'exempt from lfx extension validate'; they are not valid validator input (validate requires a manifest and reports manifest-not-found) * fix(extension): review fixes — shadowed metapackage providers never import; typed manifest-less reload refusal Review findings on #13563: - A manifest-less provider whose bundle name is already claimed by a higher-precedence @official source (installed/seed) is now skipped WITHOUT importing: all @official sources share the _lfx_ext.official.<bundle>.* sys.modules namespace, so importing the losing copy overwrote the winner's live modules even though _resolve_bundle_shadowing dropped its components afterwards. The orchestrator passes the claimed-name map (built by the new _claimed_official_bundles helper, mirroring the resolver's winner rule); the skipped copy still emits the typed bundle-shadowed warning. This collision is the expected post-graduation state, not an error. - Manifest-less records now carry a manifestless provenance flag (additive field on LoadResult + BundleRecord). The reload pipeline refuses them with the new typed reload-manifestless-unsupported code instead of routing through load_extension and failing with a misleading manifest-not-found. Hot reload of metapackage providers is a process-restart concern (pip-installed content); a loader-based reload path can follow if QA wants it. BUNDLE_API.md changelog entry extended for both surface changes. * fix(extension): harden lfx.bundles discovery per review — broad find_spec guard, namespace portions, per-mode error codes Review findings from ogabrielluiz on #13563: - find_spec on a dotted declaration imports the PARENT package, whose __init__ can raise anything; a non-Import error escaped the old catch tuple and (through the palette cache's catch-all) wiped every source's components for the boot. Catch Exception and degrade to the malformed sentinel; comment corrected. - Namespace packages: walk ALL submodule_search_locations portions (one root per portion) instead of only locations[0], and dedupe resolved roots by path so duplicate entry-point declarations (or overlapping portions) never walk a directory twice and self-shadow. _spec_package_dir -> _spec_package_dirs. - Split bundle-discovery-malformed into one code per failure mode, mirroring the inline tier: bundles-provider-name-invalid (rename the directory), bundles-root-unreadable (check permissions), keeping bundle-discovery-malformed for unresolvable declarations (fix the entry-point). Same-tier duplicates get duplicate-lfx-bundles-provider instead of overloading bundle-shadowed, whose rendered template (format_extension_error renders templates, not ad-hoc messages) was wrong on both counts for that case. - The claimed-bundles cross-source skip now emits bundle-shadowed on errors (matching _resolve_bundle_shadowing) so filtering by code never mixes severities; bundle-shadowed is already in the CLI warn-only set. 3 new regression tests (raising parent package, namespace portions, duplicate entry points); BUNDLE_API changelog updated. * feat(bundles): create lfx-bundles metapackage skeleton (#13564) * feat(bundles): add lfx-bundles metapackage skeleton Creates the manifest-less lfx-bundles distribution (the langchain-community model) that the long-tail providers will move into. Empty skeleton for now; the bulk move (scripts/migrate/consolidate_bundles.py) populates the provider folders + per-provider extras later. - src/bundles/lfx-bundles: a single pyproject declaring the lfx.bundles entry-point (lfx_bundles = "lfx_bundles"), an lfx>=1.10.0,<2.0.0 pin, and a generated (currently empty) `all` extra; plus a bare lfx_bundles namespace package and a README documenting the model + install stories - wired into the root workspace via the existing bundle marker blocks: dep lfx-bundles[all]>=1.0,<2.0, uv source, and member - hyphen dir name so release.yml's src/bundles/*/pyproject.toml glob builds it with zero workflow change Verified: the wheel builds (entry_points.txt carries the lfx.bundles group); load_lfx_bundles_extensions (PR-1) discovers the entry point and the empty skeleton registers zero providers with no error. * fix(ci): nightly bundle rename follows [extras] refs and self-refs Two gaps in update_bundle_versions.py around extras suffixes, both fatal or silently wrong for the first nightly carrying the lfx-bundles metapackage: - update_root_pyproject_for_bundle's dep regex required the version specifier immediately after the name, so "lfx-bundles[all]>=1.0,<2.0" (a MAIN dep) was left unrewritten while the workspace member was renamed to lfx-bundles-nightly; uv lock then tries to resolve stable lfx-bundles from PyPI, where it does not exist. The same gap silently left "lfx-docling[local]>=0.1.0" optional-dep refs pointing at the stable distribution. The regex now tolerates an [extras] group and carries it into the replacement. - rename_bundle_pyproject skipped self-referencing extras, so the metapackage's generated `all` extra kept 45 "lfx-bundles[<provider>]" members after the rename, pulling the stable distribution (same lfx_bundles import package, install collision) once published. Self refs now follow the rename, idempotently. Tests drive the real script module, mirroring test_bundle_lfx_pin.py. This closes the PR-2 audit item flagged when the metapackage was introduced. The canonical-pre-release cutover would retire the nightly rename entirely; until it lands, the rename must be correct. * fix(bundles): address review — drop orphaned nightly bundle-rename script, fix README install stories - Delete scripts/ci/update_bundle_versions.py and its tests: the nightly bundle-rename track it served was retired by the canonical pre-release cutover (src/bundles/NIGHTLY.md) and no workflow or Makefile target on main or any release branch invokes it. Stale doc references in sync_bundle_lfx_pin.py and test_bundle_lfx_pin.py updated to match. - README: split the install section into what works today (langflow, bare lfx) vs what arrives with the bulk move / engine-only split (lfx[bundles], per-provider lfx-bundles[<provider>] extras), and note the generated all extra is empty until the first provider tranche lands. * ci(bundles): cross-bundle test matrix (lfx contract axis) (#13566) * ci(bundles): add cross-bundle test matrix (lfx contract axis) Tests every extracted bundle (the lfx-bundles metapackage + each graduated lfx-<provider>) against the lfx contract surface it depends on -- overdue since 1.10 left 4 independently-versioned bundles depending on lfx. - .github/workflows/cross-bundle-test.yml: discovers bundles via the same src/bundles/*/pyproject.toml glob release.yml uses, then per (bundle x python 3.10/3.13): installs the in-repo lfx + the bundle, imports the declared entry-point package, asserts lfx.bundles discovery is error-free (for the metapackage), runs `lfx extension validate` for manifest bundles, and runs the bundle's own tests/. - Triggers: pull_request (src/bundles, src/lfx), workflow_dispatch, a weekly schedule, and workflow_call. The lfx-minor axis seeds with the in-repo lfx (the 1.10 line is unpublished); when minors publish, add the version dimension (oldest+latest get full tests, every supported minor gets contract-smoke) per the epic's cost-control shape. Verified: the workflow YAML parses and the contract-smoke logic imports a real bundle (lfx_arxiv) cleanly. * fix(ci): cross-bundle smoke tolerates extras-less SDK degradation Review findings on the cross-bundle matrix: - CRITICAL: the contract smoke asserted zero discovery errors, but the CI venv installs lfx-bundles WITHOUT per-provider extras, so providers whose modules import their SDK at top level degrade with module-import-failed -- the expected graceful-degradation contract. The smoke now fails only on structural codes and reports the degraded-module count. (Graduated partner bundles carry their deps directly, not as extras, so their steps are unaffected.) - the scheduled run now actually delivers the exhaustive grid the header promised (all supported Pythons on schedule; oldest+latest on PRs) - concurrency group with cancel-in-progress on PRs so stacked bundle PRs don't queue N-bundles x N-pythons jobs per push * ci(bundles): tomli fallback for the py3.10 cross-bundle smoke tomllib is stdlib only from Python 3.11, so the contract-smoke heredoc failed with ModuleNotFoundError on every py3.10 matrix leg. Install the tomli backport into the smoke venv and import it as a fallback. * fix(test): coherent sys.modules restore in the ibm without_ibm_db fixture The cross-bundle matrix's py3.10 leg exposed test-ordering pollution in the ibm bundle suite: without_ibm_db monkeypatch-deleted three lfx_ibm modules and re-imported them mid-test, but entries created during the test survive teardown (delitem with raising=False records nothing for keys it didn't find) and re-imported parents never regain the submodule attribute bindings that mock.patch target resolution walks on Python 3.10 (3.11+ mock resolves via sys.modules and tolerates the incoherence). Two fixture uses in sequence left the tree inconsistent and 29 later watsonx tests failed with AttributeError on the package. Snapshot, drop, and restore the entire lfx_ibm module tree wholesale instead. Full suite now passes on both 3.10 and 3.13. * feat(lfx): add lfx[bundles] extra and keep lfx engine-only (#13565) * feat(bundles): add lfx-bundles metapackage skeleton Creates the manifest-less lfx-bundles distribution (the langchain-community model) that the long-tail providers will move into. Empty skeleton for now; the bulk move (scripts/migrate/consolidate_bundles.py) populates the provider folders + per-provider extras later. - src/bundles/lfx-bundles: a single pyproject declaring the lfx.bundles entry-point (lfx_bundles = "lfx_bundles"), an lfx>=1.10.0,<2.0.0 pin, and a generated (currently empty) `all` extra; plus a bare lfx_bundles namespace package and a README documenting the model + install stories - wired into the root workspace via the existing bundle marker blocks: dep lfx-bundles[all]>=1.0,<2.0, uv source, and member - hyphen dir name so release.yml's src/bundles/*/pyproject.toml glob builds it with zero workflow change Verified: the wheel builds (entry_points.txt carries the lfx.bundles group); load_lfx_bundles_extensions (PR-1) discovers the entry point and the empty skeleton registers zero providers with no error. * feat(lfx): add lfx[bundles] extra and keep lfx engine-only lfx ships no bundles by default. The new optional extra pulls the long-tail metapackage for users who want the provider components without the full langflow server install. - src/lfx/pyproject.toml: [project.optional-dependencies] bundles = ["lfx-bundles[all]>=1.0,<2.0"]; intentionally NO lfx[all] - pip install lfx -> engine only pip install "lfx[bundles]" -> engine + the lfx-bundles long tail (documented as a headless/serverless deployment footnote, not a headline) Verified against the built lfx wheel METADATA: lfx-bundles appears only under `extra == "bundles"`, never in core Requires-Dist, so the engine-only default is preserved. * fix(ci): nightly bundle rename follows [extras] refs and self-refs Two gaps in update_bundle_versions.py around extras suffixes, both fatal or silently wrong for the first nightly carrying the lfx-bundles metapackage: - update_root_pyproject_for_bundle's dep regex required the version specifier immediately after the name, so "lfx-bundles[all]>=1.0,<2.0" (a MAIN dep) was left unrewritten while the workspace member was renamed to lfx-bundles-nightly; uv lock then tries to resolve stable lfx-bundles from PyPI, where it does not exist. The same gap silently left "lfx-docling[local]>=0.1.0" optional-dep refs pointing at the stable distribution. The regex now tolerates an [extras] group and carries it into the replacement. - rename_bundle_pyproject skipped self-referencing extras, so the metapackage's generated `all` extra kept 45 "lfx-bundles[<provider>]" members after the rename, pulling the stable distribution (same lfx_bundles import package, install collision) once published. Self refs now follow the rename, idempotently. Tests drive the real script module, mirroring test_bundle_lfx_pin.py. This closes the PR-2 audit item flagged when the metapackage was introduced. The canonical-pre-release cutover would retire the nightly rename entirely; until it lands, the rename must be correct. * ci(bundles): freeze lfx/components against new top-level providers (#13567) * feat(bundles): add lfx-bundles metapackage skeleton Creates the manifest-less lfx-bundles distribution (the langchain-community model) that the long-tail providers will move into. Empty skeleton for now; the bulk move (scripts/migrate/consolidate_bundles.py) populates the provider folders + per-provider extras later. - src/bundles/lfx-bundles: a single pyproject declaring the lfx.bundles entry-point (lfx_bundles = "lfx_bundles"), an lfx>=1.10.0,<2.0.0 pin, and a generated (currently empty) `all` extra; plus a bare lfx_bundles namespace package and a README documenting the model + install stories - wired into the root workspace via the existing bundle marker blocks: dep lfx-bundles[all]>=1.0,<2.0, uv source, and member - hyphen dir name so release.yml's src/bundles/*/pyproject.toml glob builds it with zero workflow change Verified: the wheel builds (entry_points.txt carries the lfx.bundles group); load_lfx_bundles_extensions (PR-1) discovers the entry point and the empty skeleton registers zero providers with no error. * ci(bundles): freeze lfx/components against new top-level providers After the metapackage split, new providers go to lfx-bundles (or a graduated lfx-<provider>), never in-tree. Adds an additions-only CI gate. - scripts/ci/check_components_frozen.py: stdlib gate comparing the live top-level dir listing of src/lfx/src/lfx/components/ against a committed baseline; fails on any directory not in the baseline. Removals are allowed so M4 shim cleanup (which shrinks the set) never trips it. - scripts/ci/frozen_component_dirs.txt: the 111-dir baseline. - .github/workflows/lint-py.yml: new freeze-components job runs the gate (stdlib-only, no uv sync). Verified locally: passes on the baseline, fails (exit 1) on a simulated new provider directory with an actionable message, passes again after cleanup. * fix(ci): freeze gate counts only dirs shipping __init__.py Review finding: a stray directory holding only __pycache__ bytecode (left behind by a branch switch) tripped the additions-only gate locally. A directory without __init__.py is not a provider; ignore it. * fix(ci): nightly bundle rename follows [extras] refs and self-refs Two gaps in update_bundle_versions.py around extras suffixes, both fatal or silently wrong for the first nightly carrying the lfx-bundles metapackage: - update_root_pyproject_for_bundle's dep regex required the version specifier immediately after the name, so "lfx-bundles[all]>=1.0,<2.0" (a MAIN dep) was left unrewritten while the workspace member was renamed to lfx-bundles-nightly; uv lock then tries to resolve stable lfx-bundles from PyPI, where it does not exist. The same gap silently left "lfx-docling[local]>=0.1.0" optional-dep refs pointing at the stable distribution. The regex now tolerates an [extras] group and carries it into the replacement. - rename_bundle_pyproject skipped self-referencing extras, so the metapackage's generated `all` extra kept 45 "lfx-bundles[<provider>]" members after the rename, pulling the stable distribution (same lfx_bundles import package, install collision) once published. Self refs now follow the rename, idempotently. Tests drive the real script module, mirroring test_bundle_lfx_pin.py. This closes the PR-2 audit item flagged when the metapackage was introduced. The canonical-pre-release cutover would retire the nightly rename entirely; until it lands, the rename must be correct. * feat(bundles): move 45 long-tail providers into lfx-bundles + graduate 5 partner packages (#13568) * feat(bundles): add lfx-bundles metapackage skeleton Creates the manifest-less lfx-bundles distribution (the langchain-community model) that the long-tail providers will move into. Empty skeleton for now; the bulk move (scripts/migrate/consolidate_bundles.py) populates the provider folders + per-provider extras later. - src/bundles/lfx-bundles: a single pyproject declaring the lfx.bundles entry-point (lfx_bundles = "lfx_bundles"), an lfx>=1.10.0,<2.0.0 pin, and a generated (currently empty) `all` extra; plus a bare lfx_bundles namespace package and a README documenting the model + install stories - wired into the root workspace via the existing bundle marker blocks: dep lfx-bundles[all]>=1.0,<2.0, uv source, and member - hyphen dir name so release.yml's src/bundles/*/pyproject.toml glob builds it with zero workflow change Verified: the wheel builds (entry_points.txt carries the lfx.bundles group); load_lfx_bundles_extensions (PR-1) discovers the entry point and the empty skeleton registers zero providers with no error. * feat(bundles): consolidate first long-tail tranche into lfx-bundles Adds scripts/migrate/consolidate_bundles.py (the inverse of port_bundle.py -- moves in-tree providers into the manifest-less lfx-bundles metapackage) and runs it on a verified 5-provider tranche: tavily, exa, wikipedia, yahoosearch, wolframalpha. Per provider the script: - moves src/lfx/src/lfx/components/<p>/ -> lfx_bundles/<p>/ (lowercase names); - leaves a fail-soft import shim (first line `# lfx-bundles-shim`) so `from lfx.components.<p> import X` keeps working when lfx-bundles is installed, and raises an actionable ImportError otherwise; - merges the provider's third-party deps into a PEP 685-normalized lfx-bundles extra and regenerates the `all` aggregate. Dep parity holds: `uv sync` is a no-op because those deps were already pulled via langflow-base[complete]; - appends the 4-entry migration block per Component class (28 entries) so saved flows referencing lfx.components.<p>.<Class> migrate to ext:<p>:<Class>@official. To avoid double registration, the in-tree component walk (_load_components_dynamically) now skips shimmed provider dirs, and component_index.json is regenerated (355->348 components, 95->90 modules); the moved providers load only at @official via lfx.bundles discovery. Verified: discovery finds all 5 at @official with no errors; shims resolve; `import lfx.components` still works; the index drops the 7 moved component entries (residual `tools`-category name refs resolve via the shim); ruff clean. First tranche proves the engine; the remaining long-tail scales by extending PROVIDER_DEPS (each provider's deps verified individually -- the careful part). * feat(bundles): consolidate 30-provider tranche 2 into lfx-bundles Extends PROVIDER_DEPS with 30 individually-verified providers and runs the consolidation: vector stores (chroma, clickhouse, couchbase, milvus, mongodb, pgvector, pinecone, qdrant, supabase, upstash, weaviate), model providers (groq, mistral, ollama, perplexity, sambanova), and tools/memory/data (apify, assemblyai, confluence, firecrawl, git, glean, icosacomputing, mem0, needle, scrapegraph, serpapi, unstructured, youtube, zep). Dep verification (the careful part): every spec comes from langflow-base's per-provider extras or its direct dependencies; langchain-community providers carry the wrapper plus the SDK the wrapper lazy-imports (e.g. pgvector, atlassian-python-api); requests is declared explicitly where imported (it is only transitive in today's env); pinecone keeps its python_version<'3.14' marker verbatim. Tranche excludes: providers with langflow imports (vlmrun), provider-specific lfx.base dirs (composio/huggingface/langwatch), case- sensitive names (FAISS/Notion), the openai-SDK family (azure/aiml/deepseek/ litellm/lmstudio/novita/openrouter/vllm/xai/cometapi -- cleaner after PR-8), and the partner set. Dep parity verified at the resolution level: the uv.lock diff is +220 lines of lfx-bundles extras metadata with ZERO packages added or removed (`name =` diff empty), so pip install langflow resolves the identical set. Also: 192 append-only migration entries (48 classes x 4, zero bare-name ambiguities); component_index.json regenerated 348->300 components / 90->60 modules (exactly the moved set, no stale standalone entries); mongodb_atlas.py SLF001 per-file-ignore and the mem0/mongodb detect-secrets baseline entries migrated to the new paths (lint/secrets exceptions travel with moved files); 35 bundles now discover at @official with 55 components; shims verified across categories; 449 extension tests pass. * feat(bundles): consolidate openai-SDK family tranche 3 into lfx-bundles 10 providers that ride the langchain-openai wrapper, deferred from tranche 2 until the partner graduation settled the openai-SDK dep story: aiml, azure, cometapi, deepseek, litellm, lmstudio, novita, openrouter, vllm, xai. Dep verification: every provider declares langchain-openai>=1.1.6; the openai SDK is declared only where a component imports it directly (aiml, deepseek, litellm, lmstudio, vllm, xai -- wrapper-transitive elsewhere); requests declared where imported (cometapi, deepseek, novita, xai); lmstudio's lazy NVIDIAEmbeddings path gets langchain-nvidia-ai-endpoints~=1.0.0. The litellm component drives LiteLLM-served endpoints through the OpenAI client and does NOT import the litellm package -- langflow-base's litellm extra stays put. These providers use the lazy _dynamic_imports __init__ shape; it survives the move unchanged (import_mod resolves via __spec__.parent and lfx.components._importing remains a core helper). Dep parity: uv.lock diff has zero package additions/removals (all specs already resolved via langflow-base[complete]). Also: 56 append-only migration entries (14 classes x 4, zero ambiguities); component_index.json regenerated 300->286 components / 60->50 modules (exactly the moved set); detect-secrets baseline re-keyed; 45 bundles now discover at @official with 69 components; shims verified (azure/xai/litellm/deepseek); ruff clean. * fix(ci): nightly bundle rename follows [extras] refs and self-refs Two gaps in update_bundle_versions.py around extras suffixes, both fatal or silently wrong for the first nightly carrying the lfx-bundles metapackage: - update_root_pyproject_for_bundle's dep regex required the version specifier immediately after the name, so "lfx-bundles[all]>=1.0,<2.0" (a MAIN dep) was left unrewritten while the workspace member was renamed to lfx-bundles-nightly; uv lock then tries to resolve stable lfx-bundles from PyPI, where it does not exist. The same gap silently left "lfx-docling[local]>=0.1.0" optional-dep refs pointing at the stable distribution. The regex now tolerates an [extras] group and carries it into the replacement. - rename_bundle_pyproject skipped self-referencing extras, so the metapackage's generated `all` extra kept 45 "lfx-bundles[<provider>]" members after the rename, pulling the stable distribution (same lfx_bundles import package, install collision) once published. Self refs now follow the rename, idempotently. Tests drive the real script module, mirroring test_bundle_lfx_pin.py. This closes the PR-2 audit item flagged when the metapackage was introduced. The canonical-pre-release cutover would retire the nightly rename entirely; until it lands, the rename must be correct. * feat(bundles): graduate partner set to standalone lfx-<provider> packages (#13573) * feat(bundles): graduate partner set to standalone lfx-<provider> packages Extracts the five partner/flagship providers into manifest-shipping distributions: lfx-openai, lfx-anthropic, lfx-amazon, lfx-datastax, lfx-cohere. Each ships extension.json (lfx.compat ["1"]), a langflow.extensions entry-point, an lfx>=1.10.0,<2.0.0 pin, and is wired into the root workspace marker blocks. Zero flow impact by the bundle-name invariant: ext:<provider>:<Class>@official ids are unchanged. Mechanics: - adopts the five-phase scripts/migrate/port_bundle.py from feat/bundle-mass-extraction (handles shared-base moves, consumer rewrites, surgical index updates, migration-table appends) and runs it per partner with --migration-release 1.11.0 - datastax's shared lfx.base.datastax moves into lfx_datastax.base; its backend unit tests move to src/bundles/datastax/tests (74 pass); its ruff per-file-ignore and its check_component_env_writes ALLOWLIST entry travel; 10 repo consumers rewritten (incl. the vector_store_rag starter project) - amazon_bedrock_converse.py legacy langflow.* imports rewritten to the lfx.* equivalents (thin re-export aliases; behavior-identical) pre-extraction - runtime deps pinned from langflow-base's extras / direct deps (wrapper- guaranteed SDKs stay transitive, parity-exact); --remove-base-extra dropped the openai/anthropic/cohere/aws extras from langflow-base[complete] in favor of the bundle pins; the astradb extra stays (also used outside datastax) - in-tree dirs replaced with marker shims pointing at lfx_<p>.components.<p> (skipped by the in-tree walk; legacy from lfx.components.<p> imports keep working); lfx/components/__init__.py entries kept, consistent with the consolidated providers - validate.py: accept classes whose base is a *derived* Component base (LCVectorStoreComponent / LCToolComponent / ...) -- they inherit the class-level outputs declaration and only override the output method, which the AST-only check could not see; bare Component subclasses keep the strict build/outputs requirement (+ regression test) - BUNDLE_API.md changelog entries added for the branch's surface changes: the lfx.bundles manifest-less discovery group + precedence tier + bundle-discovery-malformed code (from the foundation PR) and the validator acceptance above - 100 append-only migration entries (20 classes x 5 partners x 4 shapes); component_index.json surgically updated 300->280 components / 60->55 modules, sha256 recomputed and verified - detect-secrets baseline re-keyed for moved partner files Dep parity: lock diff adds only the five lfx-* package names; no third-party package added or removed. One benign transitive re-resolution: anthropic SDK 0.105.2 -> 0.109.0 (allowed by langchain-anthropic's range on both sides). Verified: all five register at @official via the installed-manifest tier (extension_id/distribution = lfx-<p>, 20 components); manifest-less lfx_bundles unchanged (35 bundles, disjoint); all 5 shims import; engine-safe; `lfx extension validate` passes for all five; 450 extension unit tests, 60 pilot-upgrade migration tests, 74 moved datastax tests pass; ruff clean. * fix(bundles): shim lfx.base.datastax so stored-flow imports keep resolving The datastax graduation moved lfx.base.datastax into lfx_datastax.base, but saved flows and starter templates (Hybrid Search RAG, TemplateAssistant) embed `from lfx.base.datastax.astradb_base import AstraDBBaseComponent` inside their stored component code fields, which is re-executed verbatim at flow build time. Without a shim that import raises ModuleNotFoundError and the flows fail to build (test-starter-projects red). Mirror the lfx.components shim contract: module-aliasing to lfx_datastax.base, narrow except that only translates a missing bundle (transitive dep failures re-raise untouched), marker-tagged single-file dir, removed at M4 together with the components shims. * chore(bundles): bounded version ranges for curated lfx-* packages (#13576) langflow's pyproject is the release-coordination point now that lfx and the lfx-* bundles release independently. Every curated lfx-* dependency declares a BOUNDED range (>=A,<B), never an exact pin -- exact pins in reusable library metadata create resolver conflicts for downstreams that depend on a different version. Exact pins for reproducibility live in uv.lock and the release-build manifests. - the 4 pilots + 5 graduated partners: >=0.1.0 -> >=0.1.0,<1.0.0 (bundles follow their own 0.1.x cadence) - lfx-bundles[all]>=1.0,<2.0 unchanged (versions with the metapackage contract) - the three lfx-docling[...] optional-dependency refs bounded the same way - policy documented inline in the bundle-deps marker block; the cross-bundle CI matrix verifies the ranges resolve together across the supported lfx axis Verified: uv lock resolves with zero package/version changes (bounds are metadata-only today); the nightly rename's dep regex already matches the bounded form. * test(bundles): lock the in-tree shim contract + breakage audit (#13577) * chore(bundles): bounded version ranges for curated lfx-* packages langflow's pyproject is the release-coordination point now that lfx and the lfx-* bundles release independently. Every curated lfx-* dependency declares a BOUNDED range (>=A,<B), never an exact pin -- exact pins in reusable library metadata create resolver conflicts for downstreams that depend on a different version. Exact pins for reproducibility live in uv.lock and the release-build manifests. - the 4 pilots + 5 graduated partners: >=0.1.0 -> >=0.1.0,<1.0.0 (bundles follow their own 0.1.x cadence) - lfx-bundles[all]>=1.0,<2.0 unchanged (versions with the metapackage contract) - the three lfx-docling[...] optional-dependency refs bounded the same way - policy documented inline in the bundle-deps marker block; the cross-bundle CI matrix verifies the ranges resolve together across the supported lfx axis Verified: uv lock resolves with zero package/version changes (bounds are metadata-only today); the nightly rename's dep regex already matches the bounded form. * test(bundles): lock the in-tree shim contract + breakage audit Locks the five-point contract for the 50 lfx-bundles import shims under lfx/components/ (45 metapackage + 5 graduated partners): 1. first line is the `# lfx-bundles-shim` marker (keys the in-tree walk's double-registration skip); 2. a shim dir is exactly one __init__.py -- no impls, no deps; 3. sys.modules module-aliasing (submodule trees resolve); 4. bundle missing -> actionable ModuleNotFoundError whose wording is part of the contract ("pip install lfx-bundles" / "pip install lfx-<p>"); 5. a missing *transitive* dep re-raises untouched. Test shape (env-adaptive by design -- the lfx test env prunes the venv, so nothing here assumes bundles are installed): - source-level sweep of every real shim, parameterized (no imports); - hermetic mechanism tests against a synthetic shim + synthetic target (alias-resolves / locked-message / transitive-reraise); - the walk-skip detector and the marker sweep must agree exactly; - one adaptive live test on lfx.components.tavily exercising whichever branch the running env is in. 106 tests pass in the pruned lfx env (where the live test exercises the bare-engine locked-message branch). Breakage audit (gh code search, recorded in the PR): ~20-25 public repos reference lfx.components.*; the majority are langflow forks (vendored tree, unaffected by packaging). Genuine library consumers exist and the moved providers have real surface (openai: 11 external repos, datastax: 17) -- covered by the shims wherever bundles are co-installed (every `pip install langflow`). Decision: deprecation warnings NOT warranted now; revisit at M4 (shim removal), where one loud minor release before removal is the right shape. * test(bundles): extend the shim contract sweep to lfx.base shims The datastax graduation moved lfx.base.datastax into lfx_datastax.base and left a module-aliasing shim behind (stored flow code fields embed the legacy import and are re-executed verbatim at build time). Sweep lfx/base for marker shims with the same source-level contract as the components sweep: one-file stub, module-aliasing to the bundle's base subpackage, narrow name-checked except, locked install message. * docs(bundles): install shapes, override rule, bundle_api_version (#13578) Documents the deliberately small user-facing rule surface of the metapackage split (1.11): - extensions-overview.mdx: the two install stories (pip install langflow = everything, same as today; pip install lfx = engine only, bring your own bundles); the bundle-name-is-identity invariant; the current package table (lfx-bundles metapackage + the 5 partner packages + the 4 pilots); the legacy-import shim behavior with the locked ModuleNotFoundError wording and the migration recipe for direct lfx users (switch to lfx[bundles] or pin lfx-<provider> packages); the override rule ("ship a manifest -- a manifest always wins", with the bundle-shadowed warning); bundle_api_version as the single compat number (lfx.compat ["1"]; manifest-less packages ride their PEP 508 lfx pin) and the no-version-arithmetic rule. - deployment-lfx-compatibility.mdx: lfx[bundles] as the headless/serverless deployment footnote (engine + lfx-bundles[all]; slimmer per-provider alternative; intentionally no lfx[all]). Both files verified MDX-safe (no unbackticked angle brackets). * fix(bundles): stack-review fixes — symlink containment, idempotency, docs accuracy (#13579) * chore(bundles): bounded version ranges for curated lfx-* packages langflow's pyproject is the release-coordination point now that lfx and the lfx-* bundles release independently. Every curated lfx-* dependency declares a BOUNDED range (>=A,<B), never an exact pin -- exact pins in reusable library metadata create resolver conflicts for downstreams that depend on a different version. Exact pins for reproducibility live in uv.lock and the release-build manifests. - the 4 pilots + 5 graduated partners: >=0.1.0 -> >=0.1.0,<1.0.0 (bundles follow their own 0.1.x cadence) - lfx-bundles[all]>=1.0,<2.0 unchanged (versions with the metapackage contract) - the three lfx-docling[...] optional-dependency refs bounded the same way - policy documented inline in the bundle-deps marker block; the cross-bundle CI matrix verifies the ranges resolve together across the supported lfx axis Verified: uv lock resolves with zero package/version changes (bounds are metadata-only today); the nightly rename's dep regex already matches the bounded form. * test(bundles): lock the in-tree shim contract + breakage audit Locks the five-point contract for the 50 lfx-bundles import shims under lfx/components/ (45 metapackage + 5 graduated partners): 1. first line is the `# lfx-bundles-shim` marker (keys the in-tree walk's double-registration skip); 2. a shim dir is exactly one __init__.py -- no impls, no deps; 3. sys.modules module-aliasing (submodule trees resolve); 4. bundle missing -> actionable ModuleNotFoundError whose wording is part of the contract ("pip install lfx-bundles" / "pip install lfx-<p>"); 5. a missing *transitive* dep re-raises untouched. Test shape (env-adaptive by design -- the lfx test env prunes the venv, so nothing here assumes bundles are installed): - source-level sweep of every real shim, parameterized (no imports); - hermetic mechanism tests against a synthetic shim + synthetic target (alias-resolves / locked-message / transitive-reraise); - the walk-skip detector and the marker sweep must agree exactly; - one adaptive live test on lfx.components.tavily exercising whichever branch the running env is in. 106 tests pass in the pruned lfx env (where the live test exercises the bare-engine locked-message branch). Breakage audit (gh code search, recorded in the PR): ~20-25 public repos reference lfx.components.*; the majority are langflow forks (vendored tree, unaffected by packaging). Genuine library consumers exist and the moved providers have real surface (openai: 11 external repos, datastax: 17) -- covered by the shims wherever bundles are co-installed (every `pip install langflow`). Decision: deprecation warnings NOT warranted now; revisit at M4 (shim removal), where one loud minor release before removal is the right shape. * docs(bundles): install shapes, override rule, bundle_api_version Documents the deliberately small user-facing rule surface of the metapackage split (1.11): - extensions-overview.mdx: the two install stories (pip install langflow = everything, same as today; pip install lfx = engine only, bring your own bundles); the bundle-name-is-identity invariant; the current package table (lfx-bundles metapackage + the 5 partner packages + the 4 pilots); the legacy-import shim behavior with the locked ModuleNotFoundError wording and the migration recipe for direct lfx users (switch to lfx[bundles] or pin lfx-<provider> packages); the override rule ("ship a manifest -- a manifest always wins", with the bundle-shadowed warning); bundle_api_version as the single compat number (lfx.compat ["1"]; manifest-less packages ride their PEP 508 lfx pin) and the no-version-arithmetic rule. - deployment-lfx-compatibility.mdx: lfx[bundles] as the headless/serverless deployment footnote (engine + lfx-bundles[all]; slimmer per-provider alternative; intentionally no lfx[all]). Both files verified MDX-safe (no unbackticked angle brackets). * fix(bundles): review fixes — symlink containment, idempotency, docs accuracy Fixes from the multi-agent stack review (kept as a separate PR so the reviewed PRs' diffs stay frozen for QA's independent pass): - _bundles_root.py: directory-level symlink containment — a provider dir that resolves outside the bundle root is skipped with a typed bundle-discovery-malformed warning, mirroring the seed-directory walk's is_within rule (+ regression test). Anchors the trust boundary to the installed package tree. - consolidate_bundles.py: migration-append idempotency guard — entries are deduped on full content so a partially-failed earlier run cannot duplicate rows on re-run (table stays append-only). - langflow-base pyproject: documented WHY the aws extra is deliberately retained after the lfx-amazon graduation (boto3 also backs the server's own S3 storage backend and lfx's S3 ingestion — review suggested removing it; that would regress S3 storage support). - extensions-overview.mdx: note that `lfx extension list` shows manifest-shipping extensions only; manifest-less packages load at startup but are not listed. 93 loader+migration tests pass (incl. the new symlink test); ruff clean. * refactor(bundles): stabilize import_mod as a public BUNDLE_API utility The lazy-import helper that bundle packages call from their __getattr__-based __init__.py files lived at lfx.components._importing -- an internal path with no stability contract, imported by 35 separately-installed bundle __init__ files (30 lfx-bundles providers + the 5 graduated partners). - canonical home is now lfx.utils.lazy_import.import_mod (code unchanged); lfx.components._importing re-exports it so in-tree callers and any external code on the old path keep working - all 35 bundle-side imports rewritten to the stable path - BUNDLE_API.md: surface table entry + changelog (additive) - contract tests: re-export identity, both call forms, the AttributeError conversion Verified: identity holds across both paths; lazy __init__ loads work through the new path for both bundle families; 110 tests pass; ruff clean. * fix(bundles): tombstone the broken legacy ZepChatMemory build method (#13580) build_message_history targeted the zep-python v1 SDK (ZepClient + zep_python.langchain.ZepChatMessageHistory); both were removed in zep-python 2.x and the zep extra pins 2.0.2, so the method has been unable to run for as long as the pin has existed -- its ImportError guard misleadingly told users to 'pip install zep-python' (already installed). The component is legacy=True with helpers.Memory as its designated replacement, so rather than hand-write a new integration against the 2.x SDK, the method now raises a clear RuntimeError pointing at the Message History component. Flow identity is preserved: class/component name, display_name, description, inputs and the memory output are byte-identical, so saved flows keep loading, i18n locale keys are unchanged, and migration_table.json needs no edits. New bundle tests pin the stub contract (identity, actionable error, no zep_python import). * test(bundles): extend the shim contract sweep to lfx.base shims The datastax graduation moved lfx.base.datastax into lfx_datastax.base and left a module-aliasing shim behind (stored flow code fields embed the legacy import and are re-executed verbatim at build time). Sweep lfx/base for marker shims with the same source-level contract as the components sweep: one-file stub, module-aliasing to the bundle's base subpackage, narrow name-checked except, locked install message. * test(bundles): extras-drift guard for the lfx-bundles metapackage Risk-2 of the metapackage split: the generated `all` extra and the per-provider extras must never drift by hand-edit, or `pip install langflow` silently loses a provider's deps. Guard the four invariants: extras <-> provider dirs (PEP 685-normalized), `all` == the exact self-ref set, normalized keys collision-free, and the metapackage provider set disjoint from the graduated partner distributions. * fix(extension): symlink-escaped providers reject with path-escape, matching the documented contract The lfx.bundles provider containment check (stack-review symlink fix) emitted bundle-discovery-malformed, whose template and hint describe a broken entry-point declaration. The changelog's path-safety entry already documents symlink escapes as path-escape on every other discovery path; use the same code here. Also resolves the semantic merge conflict with the per-mode code split (the removed _malformed_error location kwarg). * fix(tests): repoint lfx tests off moved providers; complete provider fallback map CI fail-fast had been masking these: the LFX test job runs in an engine-only env where openai/anthropic/chroma are now bundle-package shims, so every test that used them as the example category failed on all Python versions (3.14 just reported first), and the backend Group 2 leg failed collecting test_lfx_bundles_extras.py on Python 3.10. - flow_requirements: complete _PROVIDER_PACKAGE_FALLBACKS for the nine moved model providers (OpenAI, Anthropic, Amazon Bedrock, Groq, Google Generative AI, SambaNova, IBM watsonx.ai, Ollama + existing Azure OpenAI). In engine-only installs MODEL_PROVIDERS_DICT registers only in-tree providers, so the dynamic source-inspection path cannot resolve moved providers; the static fallbacks keep lfx run/serve requirements inference working. A dict hit still wins. - test_dynamic_imports / test_import_utils: use composio (still-in-tree lazy category with its SDK absent in the bare env) as the example category instead of openai/anthropic/chroma; patch import_module at its canonical home lfx.utils.lazy_import. - flow-builder tests (build_flow_from_spec, flow_builder_tools, propose_field_edit): specs use LanguageModelComponent (in-tree) instead of OpenAIModel. - test_lfx_bundles_extras: tomli fallback for Python 3.10 (tomllib is stdlib 3.11+; pytest guarantees tomli on <3.11). Full lfx unit suite: 4550 passed. Backend extras+pin tests: 24 passed. * fix(tests): repoint MCP client-server tests off graduated OpenAIModel key Same fail-fast-masked class as 14dfa7f268, backend side: since the partner graduation, extension components register in /api/v1/all under their namespaced ids (ext:openai:OpenAIModelComponent@official), so the bare 'OpenAIModel' key these tests hardcoded no longer exists on any Python version (the 'py3.14-only' Group 2 failure was the only leg that ran; 3.10 was cancelled by fail-fast). The MCP feature itself is fine — search returns the namespaced ids and add_component accepts them. - Use LanguageModelComponent (in-tree, stable bare key; SecretStr api_key, real_time_refresh fields, advanced 'stream', LanguageModel output) for the redaction/configure/search/describe/spec tests. - configure_dynamic_field: model_name -> api_key (the refresh field on LanguageModelComponent). - prompt-template-variables spec: drop the model node — server-side validation builds the graph and a model without an API key fails its build; the test's subject is the dynamic {var} fields. Full file: 69 passed. * Update test_mongodb_atlas.py * Frontend tests * Frontend test updates * fix: restore loading.py and tableAutoCellRender to base-branch state Commit 9df9475615 ('Frontend test updates') accidentally reverted both files to their pre-#9902 state, removing the no_env_fallback contract in load_from_env_vars / update_table_params_with_load_from_db_fields, the defensive params.pop('code') in build_custom_component, and the localValue/updateGlobalVariableCell handling in tableAutoCellRender. The base branch's regression tests (test_loading_no_env_fallback.py, test_loading_custom_component_code_param.py, tableAutoCellRender index.test.tsx) were kept, so the reversion failed them. * ci(bundles): make freeze gate reachable on PRs; review follow-ups - Move the freeze-components job from lint-py.yml (workflow_call/ workflow_dispatch only -- never invoked, so the gate could not block a PR) into extension-migration-checks.yml, which already triggers on pull_request for src/lfx/src/lfx/components/**. Add the gate's script and baseline to the path filter. - Add timeout-minutes to the cross-bundle-test jobs so a hung install or test leg cannot occupy a runner for the 360-minute default. - _discover_shimmed_component_dirs: read only the first line of each __init__.py instead of the whole file -- the shim marker contract is line 1 (enforced by test_shim_source_contract), and this prevents a non-shim file with the marker after leading blank lines from being misclassified and silently skipped from the in-tree walk. * fix(bundles): restore legacy-name resolution for ext components; sync starter projects Saved flows reference moved providers by their legacy palette identity -- either the bare class name (TavilySearchComponent) or the component's name attribute (AstraDB, Chroma, needle, OllamaModel). After the provider move neither resolved to a current template on the backend: - lfx.utils.component_aliases now derives the bare class name (and its Component-stripped form) from ext:<bundle>:<Class>@<slot> keys, mirroring the frontend's getTemplateAliases. Ext templates carry name=None / _type='Component', so the key is the only source. - _decorate_template_with_extension now stamps template['name'] with the component's legacy identity (name attr, falling back to class name). In-tree palette entries expose it as the dict key; ext entries are keyed by namespaced id, so without this both alias maps lose the only bridge from node types like 'AstraDB' to the current template. Without these, the starter-project updater could not match moved-provider nodes, so their embedded code stayed one whitespace change behind the bundle sources -- every such flow showed the update-all banner, and because tool-mode nodes' saved outputs ([component_as_tool]) differ from the template's natural outputs the update was flagged breaking, opening the confirmation modal instead of toasting 'successfully updated': deterministic timeouts in the starter-project Playwright specs (shards 29/30/36/37). Regenerated the 13 affected starter projects with scripts/ci/update_starter_projects.py (idempotent; code_hash hex strings in the regenerated JSONs are detect-secrets false positives). Also converts test_groq_integration.py to the captured-module patch.object pattern (same module-identity trap as test_mongodb_atlas: dotted-name @patch can land on a different materialization of the moved module than the one that defined the class, leaving the real get_groq_models in the instance's globals -- order-dependent failure in unit-test Group 5). * fix(bundles): keep importable module paths in starter projects The starter-project updater syncs node metadata from the live templates (NODE_FORMAT_ATTRIBUTES includes 'metadata'), and ext components report their runtime sys.modules namespace there (_lfx_ext.official.<p>.<m>) -- a path that only exists inside a running extension loader. Persisting it broke test_template_field_order_matches_component in both template jobs ('No module named _lfx_ext'): the test imports metadata.module to instantiate the component, and the migration table likewise keys on the legacy lfx.components.<provider> form that the bundle shims keep importable. _merge_node_metadata now preserves the node's stored module when the live template's is a runtime _lfx_ext.* path, while still syncing the rest of the metadata (e.g. dependencies). Starter projects regenerated from the pre-pollution state with the fixed updater: the only diff vs the previous regen is the 20 module lines reverting to the legacy importable form. Regression tests added for both merge directions. * feat: add Oracle integration (#13502) * Add Oracle Integration * [autofix.ci] apply automated fixes * Fix styleUtils problem * fix(oracledb): address review feedback * fix(oracledb): apply formatting * Fix component index * refactor(oracledb): convert Oracle integration to lfx-oracle extension bundle Port the in-tree lfx.components.oracledb provider into a standalone Extension Bundle distribution (src/bundles/oracle, dist lfx-oracle, package lfx_oracle, bundle name 'oracle') per src/bundles/PORTING.md: - Move the four components + connection helper into the bundle; deps (oracledb, langchain-oracledb, langchain-community) move from the langflow-base[oracledb] extra into the bundle's pyproject - Add migration-table entries mapping legacy bare class names and lfx.components.oracledb.* import paths to ext:oracle:<Class>@official - Add test_pilot_oracle_upgrade.py integration coverage (mirrors ibm) - Move backend unit tests into src/bundles/oracle/tests with bundle import paths; drop the empty ComponentTestBaseWithoutClient version-fixture scaffolding (component is new in 1.11.0) - Declare explicit outputs on OracleVectorStoreComponent (mirrors LCVectorStoreComponent) so lfx extension validate passes - Regenerate component index (oracledb category removed) and uv.lock; wire workspace member/dep/source in root pyproject - Frontend sidebar entry renamed oracledb -> oracle; docs page renamed to bundles-oracle following the extracted-bundle convention --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> * feat(lfx): fail-fast dependency preflight for `lfx run` (#13680) Detect a flow's required third-party packages before the graph load and fail fast with an actionable `pip install ...` message when any are missing, instead of a deep ModuleNotFoundError mid-build. Addresses the 'export a flow, run it on a bare pip install lfx, it fails' confusion introduced by the bundle split. - flow_requirements: add find_missing_dependencies / _is_installed / format_missing_dependencies_error (best-effort, reuses the existing flow analyzer). - run.base: _preflight_dependencies helper + check_dependencies gate in run_flow (JSON flows only; .py uses PEP 723; fail-open on analysis errors so a runnable flow is never blocked by the check itself). - CLI: --check-dependencies/--no-check-dependencies on `lfx run`. - tests: unit (find_missing_dependencies/format) + integration (run_flow + _preflight_dependencies). * feat(bundles): move spider + toolguard provider components into lfx-bundles Two provider components were still living inside otherwise-core directories (file-level stragglers from the metapackage split). Both are portable (lfx-only imports) and gated by dedicated optional SDKs, so they belong in the lfx-bundles metapackage rather than lfx core: - SpiderTool (langchain_utilities/spider.py) -> lfx_bundles/spider/, dep spider-client (`spider` extra). - PoliciesComponent + policies/ submodule (models_and_agents) -> lfx_bundles/toolguard/, dep toolguard (`toolguard` extra). Changes: - Move the files into lfx_bundles/<name>/; rewrite policies' absolute self-imports (lfx.components.models_and_agents.policies -> lfx_bundles.toolguard.policies). - Drop SpiderTool / PoliciesComponent from the core langchain_utilities / models_and_agents lazy-import registries. - Add `spider` and `toolguard` extras to lfx-bundles pyproject + the generated `all` aggregate; uv.lock re-resolved (uv lock --check clean). - Append migration entries (4 per class) mapping the historical lfx.components.* paths to ext🕷️SpiderTool@official / ext:toolguard:PoliciesComponent@official so saved flows migrate. - Regenerate component_index.json (both classes drop out of core; 263 components / 45 categories). - Repoint the toolguard policies tests to lfx_bundles.toolguard (60 pass). The toolguard deadlock-warmer (_warm_circular_imports) is unaffected: it warms toolguard.runtime directly and runs single-threaded before the unified component fan-out that loads bundle components. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] * feat(bundles): consolidate cleanlab, twelvelabs, jigsawstack into lfx-bundles First directory-level batch of the core-tail consolidation (validates the consolidate_bundles.py path end-to-end after the spider/toolguard file-level extractions). All three are flat, lfx-only, single-SDK providers: - cleanlab -> lfx_bundles/cleanlab (cleanlab-tlm) 3 components - twelvelabs -> lfx_bundles/twelvelabs (twelvelabs) 7 components - jigsawstack -> lfx_bundles/jigsawstack (jigsawstack) 11 components Via scripts/migrate/consolidate_bundles.py --apply: moves each dir into the metapackage + leaves a fail-soft shim, merges per-provider extras and regen `all`, appends the 4-entry migration block per class (84 entries, 0 ambiguous). Component index regenerated (45->42 categories, 263->242 core components); uv.lock re-resolved; twelvelabs test repointed to lfx_bundles.twelvelabs (passes). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(bundles): consolidate vector/datastore + community-wrapper providers into lfx-bundles Second directory-level batch (8 providers, 12 components) via consolidate_bundles.py --apply: - baidu (qianfan + langchain-community), redis (redis + community), elastic (elasticsearch + langchain-elasticsearch + opensearch-py) - bing, cloudflare, maritalk, searchapi, vectara (langchain-community REST wrappers) Moves each dir into lfx-bundles + fail-soft shim, merges per-provider extras and regen `all`, appends 4-entry migration block per class (48 entries, 0 ambiguous). Component index regenerated (42->34 categories, 242->230 core components); uv.lock re-resolved. Test fixups: - Repoint baidu/elastic/searchapi backend tests to lfx_bundles.<provider>. - test_dynamic_imports (lfx isolated suite) used the now-bundled searchapi as its fixture; bundles aren't installed in the engine-only lfx env, so switch it to the core langchain_utilities.FakeEmbeddingsComponent (same langchain_community optional-import path). 131 shim tests + 21 dynamic-import tests pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * [autofix.ci] apply automated fixes * feat(bundles): consolidate homeassistant, olivya, agentql REST providers into lfx-bundles Third batch (3 providers, 4 components) via consolidate_bundles.py --apply. These are thin REST wrappers with no dedicated vendor SDK: - homeassistant (requests) -> lfx_bundles/homeassistant 2 components - olivya (httpx, lfx core) -> lfx_bundles/olivya 1 component - agentql (httpx, lfx core) -> lfx_bundles/agentql 1 component Moves + shims + per-provider extras + `all` regen; 16 migration entries (0 ambiguous). Component index 34->31 categories, 230->226 components; uv.lock re-resolved. No tests reference these providers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(bundles): consolidate google, vertexai, altk, codeagents into lfx-bundles Fourth directory-level batch (4 providers, 14 components) via consolidate_bundles.py. google/vertexai (langchain-google-*), altk (agent-lifecycle-toolkit), codeagents (smolagents + OpenDsStar); platform/py markers copied verbatim from langflow-base extras. 56 migration entries (0 ambiguous); index 31->27 categories, 226->212 components. Backend tests repointed; starter projects embedding moved components regenerated via the validator. SKIP=detect-secrets: only flags are regenerated code_hash hex (false positives). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(lfx): decouple dynamic-import unit tests from soon-to-be-bundled providers test_dynamic_imports.py and test_import_utils.py used composio/nvidia/huggingface as the "lazy category whose SDK is absent in the engine-only lfx env" fixture. That couples the import-mechanism tests to specific providers — they have broken each time a provider graduated to a bundle (openai/anthropic/chroma -> composio, now composio et al.). Switch to stable in-tree core categories: - files_and_knowledge.KnowledgeComponent for the "missing-dep" path (its module imports langchain_chroma / langflow, absent in bare lfx) — works for both the import_mod direct calls and the lfx.components hierarchy access. - helpers / processing for the "imports cleanly" and "module not found" paths. No behavior change; 43 tests pass in the isolated lfx env. This unblocks moving composio, huggingface, nvidia, cuga into lfx-bundles without breaking these tests. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(bundles): consolidate composio, huggingface, nvidia, cuga into lfx-bundles Fifth batch (4 providers, 71 components) via consolidate_bundles.py --apply, unblocked by the prior dynamic-import test decoupling: - composio -> lfx_bundles/composio (composio + composio-langchain) 63 components - huggingface -> lfx_bundles/huggingface (langchain-huggingface[marker], huggingface-hub, community) 2 components - nvidia -> lfx_bundles/nvidia (langchain-nvidia-ai-endpoints, nv-ingest-client[py3.12], gassist[win32]) 5 components - cuga -> lfx_bundles/cuga (cuga; platform/py markers) 1 component Markers copied verbatim from langflow-base extras (uv lock --check clean). 284 migration entries (0 ambiguous); component index 27->23 categories, 212->141 components. Tests: relocate the dedicated lfx-isolated tests for the now-bundled components to the backend suite (test_nvidia_component.py, test_cuga_session_id_fallback.py) repointed to lfx_bundles.<provider>; repoint backend composio/huggingface/cuga imports + a cuga patch target; pragma a fake test api_key. 43 decoupled lfx import tests pass post-move. SKIP=detect-secrets: only flags are regenerated component_index code_hash hex (false positives). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * [autofix.ci] apply automated fixes * feat(bundles): consolidate langwatch evaluator into lfx-bundles langwatch -> lfx_bundles/langwatch (1 component). The LangWatchComponent is a pure httpx REST wrapper (its only non-core touchpoint is lfx.base.langwatch.utils, which is also httpx-based) — the langwatch SDK extra in langflow-base is for the tracing service, not this component, so the bundle declares no extra deps. Moves + shim + `all` regen; 4 migration entries (0 ambiguous). Component index 23->22 categories, 141->140 components. Backend langwatch test repointed (16 passed). SKIP=detect-secrets: only flags are regenerated component_index code_hash hex (false positives). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(bundles): consolidate FAISS, Notion into lfx-bundles (lowercase-slug support) Uppercase source dirs need lowercase bundle slugs (BUNDLE_NAME_RE is lowercase-only). Enhance consolidate_bundles.py with bundle_slug(provider) = provider.lower(): the bundle dir, ext id, shim target, and extra key use the lowercased slug, while the migration import_path keeps the historical lfx.components.<Provider> casing so saved flows still resolve. Identity for already-lowercase providers (no change to prior entries). - FAISS -> lfx_bundles/faiss (faiss-cpu[py-split] + langchain-community) 1 component - Notion -> lfx_bundles/notion (requests + Markdown) 8 components test_bundle_shims.py: derive the expected bundle name by lowercasing the shim dir name (FAISS shim aliases lfx_bundles.faiss) — 159 shim tests pass. Relocate the lfx-isolated FAISS test to backend/vectorstores (repointed to lfx_bundles.faiss.faiss). 36 migration entries (0 ambiguous); index 22->20 categories, 140->131 components. SKIP=detect-secrets: regenerated code_hash hex. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(bundles): fold vectorstores LocalDBComponent into the chroma bundle The lone LocalDBComponent is Chroma-backed (eager `from langchain_chroma import Chroma`), so it belongs in the existing `chroma` bundle rather than a new one — its deps are already covered by the chroma extra (no new deps). - Move vectorstores/local_db.py -> lfx_bundles/chroma/local_db.py; register LocalDBComponent in the chroma bundle's lazy registry. - Replace lfx.components.vectorstores with a CROSS-BUNDLE shim aliasing lfx_bundles.chroma (dir != bundle). - Migration: lfx.components.vectorstores[.local_db].LocalDBComponent -> ext:chroma:LocalDBComponent@official (4 entries, 0 ambiguous). - test_bundle_shims.py: add a cross-bundle map {vectorstores: chroma} so the shim contract validates (161 shim tests pass). - Repoint the backend LocalDB test (import + patch target) to lfx_bundles.chroma; test_all_modules_importable resolves it via the shim. Component index 20->19 categories, 131->130 components. SKIP=detect-secrets: regenerated code_hash hex (false positives). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * [autofix.ci] apply automated fixes * feat(bundles): remove unbundleable vlmrun + notdiamond components from lfx core Per the core-tail audit, four providers couldn't be bundled. vlmrun (imports `from langflow`, violating the lfx engine boundary) and notdiamond (its `notdiamond` SDK isn't in the lockfile or any extra, so it can't run) have no engine references, no starter flows, and no migration-table entries — they're effectively dead in every distribution, so remove them outright. (crewai and agentics are kept: crewai is woven into 3 starter-project example flows, and the core Agent hard-depends on agentics.helpers.model_config — both need deliberate upstream/refactor work, not deletion.) - Delete src/lfx/.../components/{vlmrun,notdiamond}/ and drop them from the lfx.components top-level registry (TYPE_CHECKING / _dynamic_imports / __all__). - Regenerate component index (19->17 categories, 130->128 components) and backend locales (orphan keys removed; extract_backend_strings --check OK). - Repoint test_dynamic_imports.test_import_error_handling off the deleted notdiamond to the core processing category (43 lfx import tests pass). SKIP=detect-secrets: only flags are regenerated component_index code_hash hex. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(lfx): tie flow-builder search 'returns all' to registry size The hardcoded `count > 100` assertion predated the bundle-extraction work, which deliberately moves non-legacy components out of lfx core (now 66 non-legacy of 128 indexed). Assert the empty-query count equals the full non-legacy registry instead — the durable 'no query == every component the registry exposes' contract that survives future bundle moves. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(bundles): deterministic component alias resolution + sidebar slug casing after bundle move Moving agentql/composio and the long tail into lfx-bundles made two shared-label resolutions order-dependent and left two sidebar slugs mis-cased, surfacing as red CI on the starter-projects template tests and the bundles-sidebar e2e. - flatten_components_with_aliases: register every component's identity aliases (registry key / ext class name / name) before any component's display_name alias, so a component's own class identity always wins its key regardless of registry iteration order. A single setdefault pass previously let the Composio 'AgentQL'/'SerpAPI' wrappers (display_name) shadow the standalone components (class name) depending on load order, so update_starter_projects wrote the wrong metadata.module into the AgentQL starter node. - Correct the AgentQL node module in News Aggregator.json and Price Deal Finder.json back to lfx.components.agentql.agentql_api.AgentQL. - SIDEBAR_BUNDLES: lowercase the Notion/FAISS name slugs to match the lowercase bundle category names so both bundles render in the sidebar again (display_name and icons unchanged). - Add order-independence regression tests for the identity/display tiers. * test(weaviate): patch the class's own module, not a fixed string path The Weaviate component moved into lfx-bundles, so weaviate.py is now reachable under several module identities (the lfx.components.weaviate shim, lfx_bundles.weaviate.weaviate, and the runtime _lfx_ext.* copy). On Python 3.10, unittest.mock resolves a dotted patch target via a getattr walk that follows the shim's package alias to a *different* module object than the one the imported class actually lives in, so patching 'lfx.components.weaviate.weaviate.WeaviateVectorStore' missed the object the component body reads -> 'WeaviateVectorStore called 0 times' when an earlier test in the group forced the alternate identity. Resolve the module from the imported class (sys.modules[Cls.__module__]) and patch.object it directly, bypassing dotted-string resolution. Same fix for AuthApiKey. Order/identity-independent on all Python versions. * test(ollama,perplexity): patch the class's own module, not a fixed string path The Ollama and Perplexity components moved into lfx-bundles, so ollama.py and perplexity.py are now reachable under several module identities (the lfx.components.<x>.<x> shim, the canonical lfx_bundles.<x>.<x>, and the runtime _lfx_ext.* ext-loader copy). On Python 3.10, unittest.mock resolves a dotted patch target via a getattr walk that follows the shim's package alias to a *different* module object than the one the imported class / component body actually use, so patching e.g. "lfx.components.ollama.ollama.ChatOllama" missed the object the body reads -> "mock called 0 times" depending on suite order. Resolve the module from the imported class (sys.modules[Cls.__module__]) and patch.object it directly, bypassing dotted-string resolution: - perplexity: ChatPerplexity -> patch.object(_PERPLEXITY_MODULE, ...) - ollama: ChatOllama / logger -> patch.object(_OLLAMA_MODULE, ...) - ollama: ChatOllamaComponent._parse_json_response -> patch.object(ChatOllamaComponent, ...) (the imported class itself) - ollama: httpx.AsyncClient.get/post -> patched on the global httpx (a single class object, identity-independent), dropping the shim prefix Same fix as the Weaviate test (064069b6bb). Order/identity-independent on all Python versions; the langchain_ollama / lfx.utils.util / socket patches target stable modules and are left unchanged. * fix(locales): restore en.json keys for still-shipping spider/policies components The spider (SpiderTool) and toolguard (PoliciesComponent) components live in lfx-bundles and still ship in the palette, but their 44 en.json keys were pruned while all 6 translated locales (de/es/fr/ja/pt/zh-Hans) retained them. The extractor walks only lfx.components, so bundle-only components with no compat shim get dropped from en.json on regeneration. Left as-is, the next GP upload/download cycle would strip ~264 existing translations (44 keys x 6 langs) for two components that are still in the palette. Restore the 25 spidertool + 19 policies keys to re-align en.json with the translated locales. (Durable fix — making the extractor walk src/bundles and/or adding lfx.components shims for these two providers — is a follow-up, since spider.py eager-imports its SDK and a shim alone won't make it walkable.) * chore(deps): drop dead astradb/graph-retriever extras and langchain-aws from langflow-base After datastax/amazon graduated to lfx-datastax/lfx-amazon, langflow-base still declared astradb (langchain-astradb), graph-retriever (langchain-graph-retriever, graph-retriever) and langchain-aws in its aws extra -- all pulled into the complete aggregate -- though zero core .py files import them (the consuming components moved to the bundles, which re-declare the same deps). This duplicated the SDKs in every pip install langflow and was inconsistent with the openai/anthropic/cohere extras already removed in this PR. Remove the astradb and graph-retriever extras and their complete refs, and drop langchain-aws from the aws extra (boto3 stays -- it backs langflow-base's own S3 storage, not just the amazon components). Regenerate uv.lock; closure unchanged, the SDKs still resolve via lfx-datastax/lfx-amazon. * ci(extension-migration): enforce component os.environ-write lint in CI check_component_env_writes.py guards against components writing to process-global os.environ (which bleeds one caller's credential into other requests on a warm worker). It was wired only as a pre-commit hook, bypassable via git commit -n, web-UI commits, or uninstalled hooks. Add it as a stdlib-only job in extension-migration-checks.yml next to freeze-components, so the credential-bleed guard is enforced in CI regardless of local pre-commit. * test(bundles): cover migration-table completeness, preflight provider path, frozen gate Three test-coverage gaps from the metapackage split, all green on the current tree: - migration-table completeness: parametrized sweep asserting every lfx_bundles provider component class (196 across 72 providers) is reachable via migration_table.json as an ext:<provider>:<Class>@ target, so a provider moved into a bundle without a table entry fails CI instead of silently breaking saved flows. Includes a negative control. - dependency preflight provider path: drives find_missing_dependencies and _preflight_dependencies through a node with a model/agent_llm provider field so the _PROVIDER_PACKAGE_FALLBACKS path (the only working provider-dep source in engine-only installs) is exercised. - frozen-components gate: unit tests for check_components_frozen.py covering additions (fail), removals (allowed), and the init/pycache/dotdir and comment-parsing rules. * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] * fix(locales): make spider/toolguard i18n keys survive regen via shims The earlier restore of the 44 spider/policies en.json keys was reverted by the gp-backend-check bot: it auto-regenerates en.json on every push to this PR (the PR-level path filter matches the bundle moves under lfx/components) and the bundle-blind extractor could not reproduce the keys. Make them durable the way every other moved provider does: - Add lfx.components.spider and lfx.components.toolguard '# lfx-bundles-shim' packages re-pointing to lfx_bundles.{spider,toolguard}, so the extractor (which walks lfx.components) emits SpiderTool/PoliciesComponent keys again. - Lazy-import spider's SDK (from spider.spider import Spider moved into crawl()) so SpiderTool is importable for extraction/registration without spider-client, matching the lazy pattern weaviate/zep already use (toolguard was already lazy). - Add spider/toolguard to scripts/ci/frozen_component_dirs.txt so the additions-only freeze gate accepts the new shim dirs. - Restore the 44 keys to en.json. Verified the extractor now reproduces exactly the 44 keys (25 spidertool + 19 policies), so the bot keeps them instead of dropping them. Bundle components are dynamic-only (not in component_index.json), so no index regen is needed. * chore(bundles): declare astrapy in lfx-datastax; align lfx-ibm manifest version - lfx-datastax imports astrapy directly (astrapy.DataAPIClient/Database in the astra components) but only pulled it transitively via langchain-astradb. Declare it explicitly, pinned to match langflow-base's astrapy extra (>=2.1.0,<3.0.0). - lfx-ibm's extension.json reported version 0.1.0 while pyproject.toml is 0.1.1; the loader uses the manifest version, so bump it to 0.1.1 to match. Regenerate uv.lock (closure unchanged; astrapy was already resolved transitively). * refactor(migrate): guard consolidate against subdir data loss; fix alias docstring - consolidate_bundles.move_provider copies only top-level *.py but rmtree's the whole source tree, so a provider with a subpackage would have its subdir silently destroyed and never migration-mapped. Refuse with a clear error instead of half-moving (port_bundle.py handles nested layouts). No current PROVIDER_DEPS entry has a subdir, so this is a defensive guard. - component_aliases: the order-independence docstrings overclaimed. Scope the guarantee to identity-beats-display (and real-key-beats-alias) and note that two components contributing the same identity alias remain first-wins by iteration order. * ci(gp-backend): regen en.json on src/bundles/** edits The gp-backend-check bot regenerates locales/en.json on PR changes, but its path filter only watched src/lfx/src/lfx/components/**. Bundle component strings reach core en.json through the lfx/components/<provider> import shims (e.g. spider, toolguard), so editing a bundle's display_name/description/info under src/bundles/** would not re-trigger the extractor and en.json could silently drift from the translated locales. Add src/bundles/** to the trigger so bundle-side string edits keep en.json aligned; regen is diff-gated, so non-string bundle edits remain a no-op. * fix(bundles): Policies in Models & Agents core; Spider in bundles sidebar Policies (toolguard) component: - Move PoliciesComponent + policies/ helpers out of the lfx-bundles consolidated metapackage back into lfx/components/models_and_agents core (restores the main/release-1.11.0 layout); register it in the category __init__ and restore the core-path tests. - toolguard stays an optional langflow-base extra (langflow-base[toolguard], pulled in via [complete]); the component imports it lazily, so a bare lfx install still loads/inspects it. - Remove the lfx-bundles toolguard provider (dir + extra + [all] entry), the lfx core import shim, and the frozen_component_dirs.txt entry; drop the 4 ext:toolguard migration entries; regenerate component_index (128 -> 129) and uv.lock. Spider: - Add spider to SIDEBAR_BUNDLES so it renders in the Bundles section like arXiv instead of falling into the default categories (it was missing from the list while peer lfx-bundles providers were present). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(bundles): fix error-tier mirror claim, list-time discovery note, metapackage README Addresses three documentation nits from the PR #13563 re-review: - errors.py: the lfx.bundles diagnostics comment claimed a full mirror of the inline tier's split, but only the duplicate case matches. name-invalid and root-unreadable are warning-only here where their inline counterparts are hard errors (ok=False). Tighten the comment to match actual behavior. - BUNDLE_API.md: note that manifest-less lfx.bundles providers are invisible to `lfx extension list` (discover_all_extensions walks only installed + seed; load_lfx_bundles_extensions runs in the startup component-loading path), so the precedence story isn't read as a list-time property. - lfx-bundles/README.md: the bulk move has landed on this branch (71 providers, populated per-provider extras, generated `all`), so drop the "empty skeleton / available later" framing and document the final state. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(bundles): surface pip-install guidance for missing SDKs on the server run path A flow loaded through the UI/API on an engine-only `lfx` (no bundles) failed deep in the vertex build with a bare `Error creating class. ModuleNotFoundError(No module named 'langchain_chroma')`. The actionable install guidance only existed on the `lfx run` preflight and the legacy import shim; the server run path (simple_run_flow -> run_graph_internal -> graph.arun()) had neither. Both vertex-build error formatters (lfx's `format_exception_message`, used by graph.arun(), and langflow's, used by the build/chat endpoints) now detect a plain ModuleNotFoundError in the cause chain and attach the same `pip install <package>` guidance the CLI gives, mapping the missing import to its PyPI distribution via the existing requirements resolver. Bundle-shim "components moved to ..." messages are left untouched (their message does not start with "No module named"), so graduated providers stay actionable. * fix(bundles): surface curated shim message over its raw cause in exception formatter get_causing_exception walked to the deepest __cause__, so a graduated provider's curated "components moved to ..." ModuleNotFoundError (raised `from` the raw "No module named 'lfx_<x>'") was unwrapped past it. The formatter then regenerated bare "pip install lfx-<x>" guidance, dropping the curated text — including the "or pip install langflow, which bundles it" clause. Both get_causing_exception copies (lfx + langflow) now stop at the first ModuleNotFoundError whose message is not a raw "No module named ..." (the curated shim error), and module_not_found_hint surfaces that curated message verbatim. Plain SDK import errors are unchanged. Adds regression tests reproducing the real 3-level cause chain on both formatters; the old test used a truncated chain that hid this. * fix(bundles): cover OpenRouter/IBM WatsonX in Orchestrate requirements detection (#13732) fix(bundles): cover OpenRouter/IBM WatsonX in wxO requirements detection The bundle split removed the langchain provider SDKs from lfx's own dependency tree, which makes flow→requirements detection load-bearing for Watsonx Orchestrate deployments: the runner installs only `lfx` + the packages `generate_requirements_from_flow` emits, so a provider missing from the resolution tables yields an empty requirements set and the deployed flow fails to import its model class. Two unified-selectable providers were unresolved: - OpenRouter (runs on ChatOpenAI) was in no resolution table -> []. - "IBM WatsonX" (catalog casing) only matched the legacy "IBM watsonx.ai" key; langchain-ibm landed only by an embedding-path coincidence. Add both to _PROVIDER_PACKAGE_FALLBACKS (keyed by the exact catalog strings) so every provider in MODEL_PROVIDER_METADATA resolves. Tests: - TestBundleSeparationOrchestrate in test_flow_requirements.py: catalog coverage guard, OpenRouter/IBM regressions, and split-contract guards (bundle dists and langchain imports must stay out of lfx's tree). - End-to-end artifact tests in test_watsonx_orchestrate.py asserting a bundle-provider flow emits the langchain SDK (not lfx-openai/lfx-bundles) and that requirements.txt pins lfx as its first line. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * Backend format * Format again * [autofix.ci] apply automated fixes * fix(bundles): pin datastax ruff line-length to 120 to stop format tug-of-war The datastax bundle's pyproject.toml declares a [tool.ruff.lint.per-file-ignores] table, which makes ruff treat the directory as a standalone config root. It never restated line-length, so ruff fell back to its default of 88 there. As a result `make format_backend` (per-directory config discovery) wrapped lines to 88 while the pre-commit ruff-format hook (run with --config pyproject.toml, forcing the repo-wide 120) unwrapped them back, leaving the two formatters fighting forever. Restate line-length = 120 so both config-resolution paths agree. Use the explicit line-length rather than extend=../../../pyproject.toml to avoid pulling in the root lint ruleset, which the bundle intentionally does not enforce. * fix(bundles): relocate notdiamond + vlmrun into lfx-bundles Both providers were dropped during the bulk long-tail move with no bundle and no compatibility shim, removing them from the registry, component_index, migration table and locales. That breaks saved flows using the NotDiamond Router or VLM Run Transcription nodes (vlmrun ships in langflow[complete]), contradicting the zero-user-facing-change goal. Relocate both the same way as the other long-tail providers: - move implementations into src/bundles/lfx-bundles/src/lfx_bundles/ - restore lfx.components.{notdiamond,vlmrun} marker shims - re-register both in lfx/components/__init__.py - add per-provider extras (vlmrun -> vlmrun[all]) and the 'all' aggregate - add migration_table targets ext:{notdiamond,vlmrun}:<Class>@official - restore the 32 en.json strings; refresh uv.lock * docs(lfx): correct dependency-preflight scope to lfx run only The preflight is wired into 'lfx run'; 'lfx serve' has its own module-not-found hint at request time and does not call it. --------- Co-authored-by: Elif Sema Balcioglu <elifsemabalcioglu@gmail.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-06-23 19:37:10 +00:00
Mendon Kissling	0300305dc5	docs: fix empty see also sections in extensions (#13774) ... * docs: fix empty see also sections in extensions * docs: update 1.10x version	2026-06-22 13:22:53 -07:00
Cristhian Zanforlin Lousa	f39416b806	fix: make IBM WatsonX models selectable and runnable in the Langflow Assistant (#13771) ... * fix ibm models integration on assistant * update assistant docs * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	2026-06-22 19:55:48 +00:00
Eric Hare	2b4e720e36	fix: stop temp_dirs masking startup errors; fail-fast on unresolvable SQLite path (#13634) (#13729) ... fix: fail-fast on unresolvable SQLite path; stop temp_dirs masking startup errors Addresses #13634 (Bug 2 in full; Bug 1 diagnostics + docs — relative-path normalization deferred to a separate design decision per maintainer triage). - main.py: bind `temp_dirs = []` before the lifespan `try` so the shutdown `finally` cleanup never raises UnboundLocalError and masks the real startup error when failure occurs before bundle loading. - database/service.py: add get_sqlite_database_file_path() and check_sqlite_database_path(), surfacing an actionable error (resolved path, CWD anchoring, absolute-path guidance) when a SQLite DB's parent directory is missing — instead of the opaque "Error creating DB and tables". Diagnostics only: no path normalization, no directory creation, no rejection of currently-working relative paths. - database/utils.py: run the check in initialize_database() before creation. - docs: note that SQLite LANGFLOW_DATABASE_URL paths should be absolute. - tests: regression coverage for both bugs. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-19 15:29:51 -07:00
Mendon Kissling	2ff192129a	docs: add lfx-nextplaid bundle (#13679)	2026-06-19 17:11:25 +00:00
Rakshith Ramprakash	e5d42e54fc	feat: upgrade Firecrawl to v2 SDK and extract into the lfx-firecrawl extension bundle (#13495) ... * Upgrade Firecrawl components to firecrawl-py v2 + add Search component Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Upgrade Firecrawl components to firecrawl-py v2 + add Search component Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Upgrade Firecrawl components to firecrawl-py v2 + add Search component Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Upgrade Firecrawl components to firecrawl-py v2 + add Search component Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Upgrade Firecrawl components to firecrawl-py v2 + add Search component Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Upgrade Firecrawl components to firecrawl-py v2 + add Search component Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Upgrade Firecrawl components to firecrawl-py v2 + add Search component Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: add Firecrawl Search API to the bundle page Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * [autofix.ci] apply automated fixes * fix(firecrawl): D205 docstring + defensive .get('data') in crawl Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(firecrawl): D205 docstring in scrape Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(firecrawl): use list.extend in map (PERF401) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: add unit tests for Firecrawl v2 components Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * [autofix.ci] apply automated fixes * test: align Firecrawl component tests with lfx _attributes pattern Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * [autofix.ci] apply automated fixes * refactor(firecrawl): remove deprecated extract endpoint component Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(firecrawl): remove deprecated extract endpoint component Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: drop extract component test (extract endpoint removed) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: remove Firecrawl Extract API section (deprecated) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * [autofix.ci] apply automated fixes * fix(firecrawl): map Search component to Firecrawl icon, drop Extract The frontend icon map in styleUtils.ts still referenced the removed FirecrawlExtractApi and lacked the new FirecrawlSearchApi, so the Search node would not render the Firecrawl logo. * chore: regenerate component index for Firecrawl v2 (Search added, Extract removed) * refactor(firecrawl): extract components into the lfx-firecrawl extension bundle Port the firecrawl provider out of lfx.components into a standalone Extension Bundle at src/bundles/firecrawl (distribution: lfx-firecrawl), following src/bundles/PORTING.md: - Move the v2-SDK components (Scrape, Crawl, Map, Search) to src/bundles/firecrawl/src/lfx_firecrawl/components/firecrawl/ and remove the in-tree provider + its lfx.components registration. - Own the firecrawl-py>=4,<5 pin in the bundle; drop it from langflow-base. - Wire the workspace (root pyproject deps/sources/members) and uv.lock. - Append migration-table entries (bare name, both import paths, pre-a slot) for the four classes; FirecrawlExtractApi gets no entries since the v2 SDK removed the extract endpoint and the component was dropped. - Regenerate the component index (firecrawl category removed) and locales/en.json (54 firecrawl keys move out of core). - Bundle-local unit tests + test_pilot_firecrawl_upgrade integration test; update Dockerfile bundle enumeration comments. * fix(lfx): repair migration table entry fused during release-1.11.0 merge The release-1.11.0 back-merge collided the FirecrawlSearchApi legacy_slot entry with the NextPlaidVectorStoreComponent bare_class_name entry, mashing both into a single object with duplicate 'target' keys, populating two of {bare_class_name, import_path, legacy_slot}. That fails the MigrationTable validator (entries.51) and broke the lfx loader tests. Split it into the two intended entries so each populates exactly one key-field. Restores the FirecrawlSearchApi and NextPlaidVectorStoreComponent quads (60 entries total, +16 vs base). Append-only and bare-name guards pass. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Eric Hare <ericrhare@gmail.com>	2026-06-17 12:55:01 +00:00
Mendon Kissling	bb930e2ffe	docs: build docker from source (#13041) ... * docs-add-build-from-source-and-refresh * peer review * peer-review * peer-review * peer-review	2026-06-15 17:16:28 +00:00
Mendon Kissling	02319696dc	feat: add docs feedback components (#13627) ... * add-docs-page-feedback-component * make-buttons-same-size	2026-06-12 18:03:54 +00:00
Mendon Kissling	538bcf3845	feat: docs page copy-as-markdown keyboard shortcut (#13628) ... * add-copy-page-keyboard-shortcut * peer-review	2026-06-12 16:58:50 +00:00
Antônio Alexandre Borges Lima	415323ec6d	docs: migrate code blocks to native Prism and restyle API reference pages (#13299) ... * docs: migrate code blocks from CodeSnippet to native Prism Replace the custom CodeSnippet component (@code-hike/lighter) with Docusaurus's native @theme/CodeBlock across all MDX files (current and versioned docs). Add bash to additionalLanguages and swizzle prism-include-languages.js to add custom token highlighting for shell commands and flags. Remove @code-hike/mdx dependency. * docs: improve inline code styling Darken inline code background, increase horizontal padding to 0.4em, fix vertical alignment, and remove border in light mode. * docs: address PR review — fix code slice regression and CSS/regex polish - Inline RecursiveCharacterTextSplitter inputs and methods as literal code blocks in concepts-components.mdx (current + 1.8.0 + 1.9.0), restoring the focused slices lost when migrating from CodeSnippet - Scope bash-plain Prism regex to unambiguous CLI subcommands only, removing generic bash builtins (run, add, get, set, start, stop, etc.) - Merge duplicate .theme-code-block CSS rules into a single declaration * fix(docs): prevent horizontal scroll on API docs pages The Redoc two-column layout (sidebar 300px + api-content 1300px) totals 1600px, expanding .main-wrapper beyond narrower viewports because it has overflow:visible. Clips at .main-wrapper using the html.plugin-redoc class that Docusaurus adds on API pages only. * fix(docs): API docs sidebar and layout fixes - Disable Redoc built-in search (disableSearch: true) - Pin sidebar top to navbar height (top: 60px) so it never hides behind navbar - Remove hardcoded #111 background from dark mode sidebar * fix(docs): render markdown correctly in API docs descriptions The _clean_descriptions function was converting newlines to <br> tags, mixing HTML with Markdown. CommonMark stops parsing Markdown headings (###) inside HTML blocks, causing them to appear as literal text in Redoc. Replace the <br> conversion with a simple strip() so descriptions remain pure Markdown and Redoc renders headings, lists, and code blocks correctly. * feat(docs): align API docs colors with Langflow brand - Set primaryColor to #F471B5 (Langflow pink) - Add HTTP method badge colors matching Langflow palette - Set schema.linesColor and requireLabelColor to brand pink - Set inline code color to pink, headers to #e3e3e3 - Set sidebar background to #18181b (matches frontend dark bg) - Set rightPanel background to #0d0d0f, codeBlock to #161618 - Refactor: move color config from CSS to theme.theme where safe - Remove dead search input CSS (search disabled via disableSearch:true) - Consolidate duplicate .menu-content rules * wip(docs): API docs styling — colors, components, light/dark themes * fix(docs): fix Response samples h3 title padding and refactor HTTP method button CSS * feat(docs): add sidebar dark background, active item styles, and right panel color adjustments * fix(docs): add sidebar borders and remove operation divider border * fix(docs): fix expanded response background and align dark/light theme colors * refactor(docs): standardize selectors, comments and remove duplicate rules in redocusaurus.css * refactor(docs): apply PR review — CSS custom properties, version pin, dom version comments, fix overflow * fix(docs): fix Redocly badge visibility covered by sidebar background * fix(docs): extend sidebar border-right to Redocly badge area * refactor(docs): replace hardcoded #ffffff label color with --redoc-text-label variable * fix(docs): lighten inline code background in API docs dark theme Redoc's default typography.code.backgroundColor (rgba(38, 50, 56, 0.05)) is nearly invisible over the dark background. Override it with rgba(255, 255, 255, 0.05) in dark theme only, excluding pre > code so code sample blocks stay unaffected. * feat(docs): align docs primary pink with API spec brand color Use #f471b5 (API spec primaryColor) as --ifm-color-primary in dark theme and #e44fa0 (slightly darkened for contrast on white) in light theme. Remove dark-theme pink overrides in sidebar.css (#ff6ad0 CTA and hsla(329, 55%, 68%) active TOC link) — they compensated for the old muted pink and are redundant now that the primary itself is bright. * feat(docs): lighten dark theme text colors for better readability Bump body text (#a8a8b0 -> #bcbcc4), headings (#cdcdd4 -> #dcdce2) and sidebar menu (#8a8a92 -> #9c9ca4) one step brighter. * chore(docs): add IBM Equal Access accessibility-checker setup Add accessibility-checker as devDependency with aceconfig.js (policy IBM_Accessibility, JSON reports in docs/a11y-results/, gitignored). Scan with: npx achecker <url> against a built docs site. * fix(docs): WCAG AA contrast and ARIA fixes across docs and API reference Validated with IBM Equal Access scans (light theme): home, quickstart and component pages at 0 violations; /api from 3382 down to 167 (all remaining are Redoc-internal DOM: schema table headers, svg/select labels). Docs site: - Light primary pink #d11074 — passes 4.5:1 on white and inline-code bg - Light Prism palette darkened per-token to pass 4.5:1 on #f9f9fd - TabItem swizzled to give tabpanels an accessible name (aria-label) - codeBlockA11y client module: scrollable code blocks get role=region + unique label; non-scrollable ones lose the needless tabindex API reference (Redocusaurus): - redocA11y client module: role=main on api-content, role=navigation on sidebar — fixes 1924 aria_content_in_landmark violations - HTTP method badges and response chips darkened to pass with white text - Light-theme overrides: accessible pink #cd1072 for links, required markers, constraint chips, schema tree lines; darker grays for utility buttons and type labels (incl. 0.7-opacity wrapper fix) - Sidebar active/hover items use regular text color, method badges keep their own colors; expandable property names match non-expandable ones * fix(docs): WCAG AA contrast fixes for dark theme Validated with IBM Equal Access scans in dark mode (temporary colorMode.defaultMode flip during scanning): home, quickstart and component pages at 0 violations; /api matches light at 167 remaining (all Redoc-internal DOM: table headers, svg/select labels). - Code block comments/line numbers #4a5060 -> #798197 (4.56:1 on #18181a) - Redoc dark sample tokens: boolean/null #e95c59, number #5392b8 - Status-code tabs: lift docusaurus-theme-redoc's #303846 !important selected-tab rule with a higher-specificity override - oneOf variant buttons: dark text in both themes (their white/pink backgrounds are theme-independent) - redocA11y client module: patch response chip colors (success green / error red) to dark-accessible variants when data-theme=dark — a single Redoc theme color cannot pass on both light and dark derived backgrounds, and status is only distinguishable by computed color * fix(docs): resolve remaining Redoc-internal accessibility violations Extend the redocA11y client module with semantic patches for Redoc DOM the theme cannot reach (validated: 0 IBM Equal Access violations on all scanned pages in both light and dark themes): - Decorative svg chevrons/arrows: aria-hidden=true (svg_graphics_labelled) - Content-type dropdowns: aria-label (input_label_exists) - Schema field tables (2-col name|description layout, no <th> anywhere): role=presentation — content reads in DOM order; role=rowheader on <td> is invalid ARIA inside a native table (table_headers_exists/related) - Semantic patches run on the next animation frame after DOM changes so Redoc's lazy-rendered operations are covered immediately; the heavier color patch stays debounced * ci(docs): gate docs accessibility with IBM Equal Access scans Add test-docs-accessibility job to docs_test.yml (rides the existing docs/** path filter from ci.yml): build + scan 4 representative pages (home, quickstart, component page, /api) in light theme, then flip colorMode.defaultMode to dark, rebuild and scan again. - scripts/a11y-ci.sh: serves the build and runs npx achecker per page with one retry to absorb Redoc lazy-render timing flakes; any real violation fails the job (failLevels: violation) - aceconfig.js: pin ruleArchive to 19May2026 so IBM rule updates don't break CI without a deliberate bump * ci(docs): fix Chrome sandbox launch on Ubuntu 24.04 runners Ubuntu 24.04 restricts unprivileged user namespaces via AppArmor, which prevents puppeteer's Chrome (used by the IBM checker) from starting its sandbox. Re-enable them with the documented sysctl workaround instead of weakening the browser with --no-sandbox. * fix(docs): align response status code with description text Redoc sets vertical-align: top and a smaller line-height on the status code <strong> inside response buttons, leaving "200" visually higher than "Successful Response". Align both to the shared text baseline. * refactor(docs): apply PR review feedback - redocA11y: match only real Redoc routes (/api, /api/workflow) — a bare startsWith("/api") also matched docs pages like /api-request and leaked one body MutationObserver per navigation - codeBlockA11y: also observe the hidden attribute — Docusaurus tabs toggle panels via hidden (no childList mutation), so scrollable blocks inside an initially hidden tab were never re-evaluated for tabindex - Extract Prism themes to src/prismThemes.js (docusaurus.config.js was past the 600-line red flag) - concepts-components.mdx (current + 1.9.0 + 1.8.0): comment pointing hardcoded snippets to recursive_character.py to mitigate drift Validated: clean build + IBM Equal Access scans 4/4 passing. * replace-openapi-file-with-1.10 * migrate-prism-changes-to-1.10-version * a11y-script-dont-block --------- Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>	2026-06-12 13:58:04 +00:00
Eric Hare	0195a132e2	Merge release-1.10.0 into main ... Non-squash union back-merge, ahead of cutting release-1.11.0 / release-1.10.1. - Preserves main's settings-mixin refactor (#13141): release-1.10.0's 40 new settings ported into the per-group mixins, verified field-for-field and behaviorally against release's monolith. - Keeps main's model-handling (#13191, auto-merged). - CI workflows, docling deps, component index, starter projects, AGENTS.md, .secrets.baseline resolved to release-1.10.0. main: 1.9.6 -> 1.10.0.	2026-06-09 13:16:48 -07:00
Eric Hare	9690e69e86	fix(security): remove the disabled Python Code Structured tool component (#13560) ... * fix(security): remove the disabled Python Code Structured tool component Follow-up to #13538, which neutered PythonCodeStructuredTool to a non-executable stub "for one release cycle, full removal later." This completes that removal. - Delete the component and its registration in lfx.components.tools. - Drop its entry from the component index (num_components 355 -> 354, sha256 recomputed surgically) and from stable_hash_history.json. - Remove its 18 i18n keys from every locale file. - Replace the dedicated stub unit test with a removal test in test_dynamic_import_integration.py. - Add a regressions entry to regressions/1.10.x.yaml. The unauthenticated public-build RCE fix (report H1-3754930) is unaffected: PythonCodeStructuredTool stays in CODE_EXECUTION_COMPONENT_TYPES, so build_public_tmp still rejects any saved or crafted flow that carries the type. instantiate_class execs the node's stored `code` field regardless of whether the class still exists, so the type-name block -- not the class -- is what closes the path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: document removal * docs: typo * Apply suggestion from @mendonk Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>	2026-06-09 10:16:36 -07:00
Mendon Kissling	d7804149d8	docs: LF assistant ampersand and dot selectors (#13544) ... * docs-lf-assistant-dot-selector * docs-add-lfx-matrix-to-1.10-version	2026-06-09 13:04:49 +00:00
Mendon Kissling	4339011b6d	docs: lfx compatibility matrix and lfx serve updates (#13518) ... * docs-add-existing-changes * fix-combining-of-glyphs * docs-lfx-compatibility * peer-review	2026-06-08 18:26:12 +00:00
Mendon Kissling	2411d8036e	docs: build OpenAPI spec and cut version 1.10 (#13537) ... * build-api * bump-version-to-1.10 * fix-broken-links	2026-06-08 18:25:14 +00:00
Mendon Kissling	7ad65e83df	docs: add code agents and file processing components (#13285) ... * add-code-agents-and-file-ingestion-components * docs: add release note for code agents * Apply suggestions from code review Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com> --------- Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>	2026-06-08 15:14:47 +00:00
Mendon Kissling	ba16577079	docs: JSON logging structure and grafana integration (#13251) ... * initial-cherry-pick * docs-move-config-to-logging * update-logging paths-and-clarify-behavior * fix-other-relative-link * peer-review	2026-06-08 14:21:27 +00:00
Mendon Kissling	922c6f2e34	docs: gunicorn worker configuration (#13511) ... * docs-add-gunicorn-config * docs-env-vars-gunicorn-configuration * align-links-with-title * fix-links * mismatched-timeout-values * Apply suggestions from code review Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com> * peer-review --------- Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>	2026-06-05 18:02:34 +00:00
Mendon Kissling	af942d8c81	docs: add env vars for login endpoint rate limiting (#13489) ... docs-add-env-vars-for-login-endpoint	2026-06-04 14:10:56 +00:00
Cristhian Zanforlin Lousa	685d12adab	feat: mention canvas components in the assistant input (#13486) ... * @-mention canvas components in the assistant input * fix suggestion width * add translation * 70% resizeble chat * add field search on assistant @ * update docs	2026-06-03 21:20:37 +00:00
Mendon Kissling	984c96a97b	docs: firecrawl component (#13487) ... docs-firecrawl-component	2026-06-03 18:50:49 +00:00
Eric Hare	c84498fffc	fix(conditional-router): route Text Input when Case True/False are blank (#13389) ... * fix(conditional-router): route Text Input when Case True/False are blank The If-Else component's Case True and Case False fields are optional overrides. When left blank, the MessageInput resolved them to an empty Message, so the matched branch emitted a blank message instead of the original Text Input. Fall back to input_text when the override message is empty, so the incoming message is passed through to the True/False branch as expected. Fixes #13387 * fix(conditional-router): use Message(text=) for empty stopped-branch output The non-matched (stopped/excluded) branches returned Message(content=""), but 'content' is not a Message field — it was stored as an arbitrary data key, leaving .text empty. Use Message(text="") so the empty output is a proper empty Message. * [autofix.ci] apply automated fixes * fix(conditional-router): preserve non-text Message overrides A Case True/False override can be a real Message with empty .text but a meaningful payload (files or content blocks). The fallback helper treated any Message with falsy .text as blank and replaced it with the input text, dropping that payload. Only fall back to input_text when the override carries no payload at all (no text, no files, no content_blocks); otherwise preserve the override as-is. * fix: address review comments * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	2026-06-03 17:51:36 +00:00
Mendon Kissling	16f733102e	docs: wxo deploy updates (#13345) ... * align-with-example-video * docs: move wxo up in sidebars * include-beta-and-and-ff-warning * agent-language * sidebars * cleanup * docs-peer-review	2026-06-02 22:27:18 +00:00
Mendon Kissling	7ee0501690	docs: bundle separation and component updates (#13472) ... * docs-add-bundles-and-instructions * docs-text-io-legacy * docs-add-internationalization-release-note * docs-remove-unpublished-pages * docs-use-bash-for-code-blocks-on-sdk-page * peer-review	2026-06-02 21:31:36 +00:00
Eric Hare	5120b7705a	fix: Move Docling components into bundle (#13442) ... * feat: move docling components to bundle * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] * chore: wake CI * fix: trim docling chunking extra * Update test_endpoints.py * Update test_pilot_docling_upgrade.py * fix: show friendly component label in build banner for bundle nodes Extension-bundle components have namespaced node ids of the form ext:<bundle>:<ClassName>@<slot>-<uuid>. The flow-build status banner rendered that raw id, which overflowed the fixed-width (530px) container and collided with the elapsed-time counter. Collapse namespaced ids to <ComponentName>-<uuid> (matching the built-in ComponentName-UUID label) via a new getRunningNodeLabel helper; built-in node ids are returned unchanged. Covered by unit tests. --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-06-02 12:33:38 -07:00
Eric Hare	e65ced99cc	Merge release-1.9.6 into release-1.10.0	2026-06-02 09:58:24 -07:00
Eric Hare	e02838799d	Merge release-1.9.6 into main	2026-06-02 09:50:54 -07:00
Mendon Kissling	3dbfe9fdb8	docs: lf assistant flow building example (#13445) ... * docs: assistant example * add-prereq-for-custom-components * Apply suggestions from code review Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com> --------- Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>	2026-06-02 14:45:51 +00:00
Jordan Frazier	a41aa3a4bf	feat: add custom comp execution override (#13177) ... * Add custom comp exeuction override flag * fix(settings): handle comma-separated LANGFLOW_COMPONENTS_PATH in override enforcement CustomSource splits comma-separated env vars into individual list entries before the field validator runs, so the raw env var string was never found in self.components_path when multiple paths were specified. Split the env var by comma and strip each entry individually. Add a test covering the multi-path case. * update doc * fix(settings): scope components_index_path stripping to env-sourced value Mirror the components_path handling and only clear components_index_path when it matches LANGFLOW_COMPONENTS_INDEX_PATH, addressing review feedback on the override enforcer.	2026-06-02 14:28:44 +00:00
Gabriel Luiz Freitas Almeida	e2d17a6d84	feat(logging): production-grade structured logs for Grafana/Loki (#13164) ... * feat(logging): production-grade structured logs for Grafana/Loki Make langflow and lfx log output viable for ingestion by Grafana/Loki and other observability tools when run in JSON mode (LANGFLOW_LOG_ENV=container). Core changes in src/lfx/src/lfx/log/logger.py: - Preserve exceptions in JSON output via structlog.processors.ExceptionRenderer with ExceptionDictTransformer. Tracebacks now emit as a structured exception array (exc_type, exc_value, frames) instead of being dropped. - show_locals defaults to OFF; opt-in via LANGFLOW_LOG_TRACE_LOCALS=true so frame locals can't leak API keys, env, or request bodies in shipped logs. - Add service metadata (service / version / environment) from LANGFLOW_SERVICE_NAME / LANGFLOW_VERSION / LANGFLOW_ENVIRONMENT. - Add logger name to every record so Grafana can filter by source. - Add optional OpenTelemetry trace_id / span_id correlation. Import is resolved once at module load; runtime calls are wrapped so a flaky tracer SDK can never break logging. - Add default-on PII redaction for password, token, api_key, authorization, cookie, etc. Walks nested dicts, lists, and tuples up to depth 4. Extra keys via LANGFLOW_LOG_REDACT_KEYS. - Add per-logger level overrides via LANGFLOW_LOG_LEVELS="name=LEVEL,...". Malformed entries (typos like WARN instead of WARNING) raise UserWarning instead of silently dropping. - Use ISO 8601 UTC timestamps. - Install a stdlib InterceptHandler on the root logger in JSON modes so uvicorn, sqlalchemy, httpx, langchain, asyncio etc. emit a single unified JSON stream. Forwards exc_info and stack_info. emit() is wrapped to route any error through handleError so a malformed third-party log call cannot raise into the request path. Install is idempotent: re-running configure() updates the level instead of stacking handlers. Not installed in pretty mode so dev terminals don't get duplicate lines. - Reset cached loggers at the start of configure() so modules that captured a logger before configure() ran pick up the new processor chain. - Preserve the get_logger() name through PrintLogger so add_logger_name can attach it. Tests in src/backend/tests/unit/test_logger.py: - Cover structured tracebacks, PII redaction (top-level, nested, list, tuple, depth limit), logger name, stdlib intercept forwarding exc_info and stack_info, intercept idempotency, intercept-not-installed in pretty mode, malformed-args safety net, service info defaults and env overrides, malformed LANGFLOW_LOG_LEVELS warning, container_csv exception text, show_locals default off (verified by absence of the secret value, not just the key) and opt-in. * docs(observability): Grafana + Loki reference stack and env-var docs Adds a self-contained Loki + Promtail + Grafana docker-compose stack under deploy/observability/grafana-loki/ with a pre-provisioned dashboard that demonstrates the production logging features: structured tracebacks, PII redaction, service/version/environment labels, and the stdlib intercept path. Anyone running Langflow in JSON mode can point Promtail at their log file and get a working board on first run. Also documents the new env vars (LANGFLOW_SERVICE_NAME, LANGFLOW_VERSION, LANGFLOW_ENVIRONMENT, LANGFLOW_LOG_LEVELS, LANGFLOW_LOG_REDACT_KEYS, LANGFLOW_LOG_TRACE_LOCALS) in docs/docs/Develop/logging.mdx and adds a new page docs/docs/Develop/observability-grafana-loki.mdx covering JSON output shape, structured exceptions, stdlib routing, and OpenTelemetry trace correlation. Registered in the Observability sidebar category. * docs(observability): rename dashboard to 'Langflow Logs' * docs(observability): fix broken link from logging guide to Grafana/Loki page The logging guide linked to the new Grafana/Loki page with an absolute path (/observability-grafana-loki). Since the page is new and only exists in the next docs version, the absolute link resolved to a non-existent root-version route and failed the Docusaurus broken-link check. Use a version-aware relative .mdx link instead. * docs(observability): clarify stdout requirement for unified JSON logs The Grafana/Loki guide told users to set LANGFLOW_LOG_FILE, but the stdlib intercept that routes uvicorn/sqlalchemy/httpx/langchain into the JSON stream is only installed on the stdout path, so those library logs landed in the file as plain text and the json parse stage could not label them. Point the guide at stdout (redirected to the scraped file) and note the file-mode limitation. Also document that the JSON format is platform-agnostic and works with any JSON-ingesting backend including IBM Instana, whose OpenTelemetry-based Python tracer (3.0+) correlates logs to traces via trace_id/span_id. * fix(logging): render stdlib logs as redacted JSON in file mode In JSON mode with LANGFLOW_LOG_FILE set, the stdlib intercept was skipped to avoid a recursion loop, so third-party loggers (uvicorn, sqlalchemy, httpx, asyncio) wrote plain text straight to the file. Those lines bypassed both JSON rendering and PII redaction, so secrets in their structured fields landed in the file verbatim and Loki could not parse or label them. Route JSON file output through a structlog ProcessorFormatter on the rotating handler: foreign stdlib records are enriched via foreign_pre_chain (ExtraAdder + redaction) and rendered as JSON alongside application logs, while the RotatingFileHandler keeps log rotation. The stdout path is unchanged. Also forward stdlib extra fields through InterceptHandler so the stdout path redacts them too, keeping both paths consistent. Update the Grafana/Loki deploy guide to reflect that LANGFLOW_LOG_FILE now produces a single redacted JSON stream. * fix(logging): retrieval buffer captures the message text add_serialized stored the rendered message under the 'message' key, but SizedLogBuffer.write only read 'event'/'msg'/'text', so every entry returned by the /logs and /logs-stream endpoints had an empty message. Read 'message' first and keep the other keys as fallbacks for records written in other shapes.	2026-06-01 20:23:31 +00:00
Eric Hare	cc6cdf9297	fix(tracing): warn clearly when LangWatch is unavailable on Python 3.14 (Docker) (#13410) ... fix(tracing): warn clearly when LangWatch is unavailable on Python 3.14 The official Docker images run Python 3.14, but the `langwatch` package caps its requires-python at <3.14, so it is excluded from the image. With LANGWATCH_API_KEY set, the tracer hit an ImportError and disabled itself with only a cryptic, per-run `logger.exception`, so users saw no traces and no actionable explanation (works on PyPI/desktop, which run Python 3.10-3.13). Emit a single, version-aware warning when the langwatch package is missing despite the API key being set, and document the Python 3.14 / Docker limitation in the LangWatch integration guide.	2026-06-01 19:27:43 +00:00
Mendon Kissling	7e321059db	docs: redis worker queue (#13386) ... * docs: remove 1.8 env vars * docs: link out to deployment guide * docs: redis queue * fix-links-and-combine-env-vars-table * docs: cleanup * peer-review * peer-review * Apply suggestions from code review Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com> * move-prereqs --------- Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>	2026-06-01 16:35:25 +00:00
Mendon Kissling	727b73bb7c	docs: non-feature fixes and updates for 1.10 (#13396) ... * docs-clarify-server-vs-tool-precedence * docs: forward key header to nested mcp server * docs: webhook auth default behavior * peer-review	2026-05-29 20:19:19 +00:00
Mendon Kissling	b06f810f53	docs: add chroma cloud provider (#13122) ... docs-add-chroma-cloud-provider	2026-05-29 18:34:42 +00:00
Lucas Oliveira	3e694305f9	fix: separate docling chunking dependencies (#13411) ... * separate docling chunking * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix nitpicks * [autofix.ci] apply automated fixes * remove langchain docling dependency * add docling image description as an optional dep * [autofix.ci] apply automated fixes * fix line too long * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	2026-05-29 15:33:49 -03:00
Mendon Kissling	82f3fa10d4	docs: memory base feature and component (#13094) ... * developer-page * release-notes-and-sidebar * memory-base-component * fix-broken-link * use-absolute-links * peer-review * fix-broken-link * docs: include additional preprocessing examples * docs: memory base typo	2026-05-29 17:52:22 +00:00
vjgit96	58a75ffb0d	feat(ci): reduce macOS Intel CI matrix and add macOS support documentation (#13328) ... feat(ci): reduce macOS Intel CI matrix and add macOS support docs - Remove Python 3.10 from macOS Intel stable CI matrix (keep 3.12 only) - Add comprehensive macOS support documentation - Document Python 3.14 support status (limited on Intel, no PyTorch) - Reduces CI costs by ~$5-7 per run (~$1,800-2,500/year) Implements LE-781 recommendations R2 and R3 from LE-265 investigation. Related: LE-265, PR #12477	2026-05-29 16:20:10 +00:00
Mendon Kissling	663fa5ed0a	docs: fixes for consulting advantage (#13300) ... * docs: lock mcp server management * docs: restrict custom components to superusers * docs: embedded mode to hide UI elements * docs: add custom component admin restriction	2026-05-29 16:03:50 +00:00
Mendon Kissling	fefa4262ae	docs: bump python version reqs to 3.14 and add release note (#13289)	2026-05-29 15:07:12 +00:00
Mendon Kissling	2f682eb020	docs: agent improvements (#13269) ... * docs: add structured output for agents * docs: add structured output note * docs: clarify both agent outputs and add release notes * docs: when langflow sends events to the playground and chat history	2026-05-29 14:28:21 +00:00
Dhruv Chaturvedi	f8ada15e2a	feat(components): Add IBM DB2 Vector Store component (#13237) ... * feat(ibm): add DB2 Vector Store component Add comprehensive IBM DB2 Vector Store integration for Langflow. Components Added: - DB2VectorStoreComponent: Main vector store component - DB2VS: LangChain-compatible vector store implementation - DB2 security validators: Input validation and sanitization Features: - Vector similarity search (Similarity, MMR, Similarity Score Threshold) - Secure connection handling with input validation - Metadata filtering for complex data types - Duplicate detection support - Batch document ingestion Test Coverage: - 41 unit tests (38 passing, 3 skipped) - Component integration tests - Security validation tests - DB2VS class tests Documentation: - Comprehensive developer guidelines * refactor(db2): simplify component to match Chroma patterns - Remove complex data ingestion (CSV, DataFrame, dict, Message handling) - Add _add_documents_to_vector_store() method matching Chroma - Add similarity_score_threshold search type - Simplify data ingestion from 220 to 45 lines (80% reduction) - Add 5 new tests (similarity_search, mmr_search, search_with_different_types, duplicate_handling, metadata_filtering) - All 41 tests passing (38 passed, 3 skipped) BREAKING CHANGE: Component now only accepts Data objects for ingestion. * ci: fix CI failures - update component index and starter projects - Regenerate component_index.json with DB2 component - Update all starter projects with new component registry - Fix ruff formatting issues * ci: trigger CI re-run to fix merge issue * ci: add merge conflict resolution for component_index.json in autofix workflow Handle merge conflicts in the Update Component Index job by: - Automatically resolving component_index.json conflicts using --theirs strategy - Failing if non-generated files have conflicts (requires manual resolution) - Completing the merge after resolving generated file conflicts This prevents the workflow from failing when component_index.json has conflicts during PR updates, as this file is auto-generated and can be safely regenerated. * fix: Remove DB2SQLComponent reference from IBM components - Removed DB2SQLComponent from __init__.py as the db2_sql.py module doesn't exist - This fixes the test_all_modules_importable test failure - Fixes CI failure in Unit Tests - Python 3.14 - Group 5 * revert: Remove unrelated starter project JSON changes * revert: Remove unrelated CI workflow and formatting changes * docs: add DB2 Vector Store .mdx documentation following Chroma DB structure * fix: address CodeRabbit review comments - add __init__.py docstring and implement score threshold filtering - Added docstring to src/backend/tests/unit/components/__init__.py to fix Ruff INP001 error - Added FloatInput score_threshold parameter (default 0.5) to DB2 Vector Store component - Implemented threshold filtering in similarity_score_threshold search mode - Filters results to only include documents with relevance scores >= threshold * chore: remove auto-generated and unnecessary files from PR - Remove uv.lock (dependency lock file - auto-generated) - Remove src/frontend/package-lock.json (frontend lock file - auto-generated) - Remove src/lfx/src/lfx/_assets/component_index.json (auto-generated by CI) - Remove .secrets.baseline (security baseline - auto-generated) - Remove starter_projects JSON (auto-generated example) - Remove tweaks_builder.py (unrelated test helper) Per DEVELOPMENT.md guidelines, these files should not be committed by contributors. * chore: restore auto-generated files to keep PR focused on DB2 component * fix(ci): update auto-generated files and fix docs build - Update component index with new IBM DB2 components (363 components, 97 modules) - Update frontend package-lock.json - Fix docs build by removing reference to missing image in bundles-db2.mdx Fixes CI failures: - Update Component Index - Update Starter Projects - Test Docs Build * feat(db2): add SSL/TLS support to DB2 Vector Store component - Add SSL/TLS encryption support for DB2 database connections - Add SSL certificate validation and download functionality - Support local certificate files (.crt, .pem, .cer) and URLs - Add optional certificate password support for encrypted keystores - Implement automatic cleanup of temporary downloaded certificates - Add comprehensive error handling and logging for SSL connections - Update component_index.json with new SSL configuration inputs - Update package-lock.json dependencies Security improvements: - Validate certificate paths and file permissions - Support system default CA certificates (recommended for IBM Cloud DB2) - Redact sensitive information in error messages - Clean up temporary files on connection failure This enhancement enables secure encrypted connections to DB2 databases, which is recommended for production environments. * [autofix.ci] apply automated fixes * refactor(db2): minimize metadata storage in DB2 vector store - Clear metadata before storage to reduce unnecessary data (file_path, filename, etc.) - Return only text content during retrieval for cleaner results - Optimize list comprehension for better performance (PERF401, RET504) * test: remove skipped tests from DB2 vector store test suite - Removed version compatibility tests for versions where component didn't exist - Changed file_names_mapping to return empty list for new component - Overrode base class version tests to prevent skips - Fixed linting issues (hardcoded passwords, nested with statements) - All 40 tests now pass with 0 skipped tests * fix(tests): update DB2 vector store test description format Fixes test_component_metadata assertion to match the actual component description format. The test was failing due to line wrapping differences in the multi-line description string. Fixes CI failure in PR #13163 * [autofix.ci] apply automated fixes * chore: trigger CI re-run to resolve flaky test failures * fix(tests): mark OpenAI-dependent test as api_key_required to prevent CI failures * restructure as new bundle package * [autofix.ci] apply automated fixes * fix(ibm): improve DB2 Vector Store component reliability and validation * fix: implement SSL/TLS toggle functionality for DB2 Vector Store - Add update_build_config method to dynamically show/hide SSL certificate fields - SSL certificate path and password fields now only visible when use_ssl is enabled - Improves UX by hiding irrelevant fields when SSL is disabled - Update component_index.json with new component configuration - All 38 existing tests pass --------- Co-authored-by: Dhruv Chaturvedi <dhruv_insights@mac.lkw-in.ibm.com> Co-authored-by: Dhruv Chaturvedi <dhruv_insights@Dhruvs-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: priyanshu-krishnan1 <priyanshu.krishnan1@ibm.com> Co-authored-by: Eric Hare <ericrhare@gmail.com>	2026-05-29 02:58:30 +00:00
Gabriel Luiz Freitas Almeida	2bfa634dfb	feat: flow builder assistant with real-time canvas updates (#12575) ... * add agentic api backend * [autofix.ci] apply automated fixes * add docs to feature * ruff and test fixes * ruff fixes * fix lfx tests * fix ruff style * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * refactor code improvements * add rate limit to tests * [autofix.ci] apply automated fixes * new canvas control * chat UI skeleton v0 * add empty state when doesnt have model provider * add generating code statuses * assist panel doc * add stop button to cancel flow generation * view code dialog * add translation json flow and stop button on inputchat * add floating state of the chat * refacator frontend codes * assistant docs. * add execution from .py file * update docs * fix verbose error * improve disabled placeholder * unify placeholder messages * start chat state closed * add canvas behavior * fix model selection and position chat * dialog z100 * [autofix.ci] apply automated fixes * docs update * change crypto to uuid regular * fix inexistent assistant * chore: removed old unused implmentation remoced old FF and all it's UI components * add memory to flow.. * add prompt on agent * [autofix.ci] apply automated fixes * cherry-pick first commit * cherry pick commit changes canvas * code improvements * fix session id null and close button * add tests suite * fix await error * ruff style and checker * feat: add pure flow-builder utilities to lfx Add flow_builder subpackage with pure functions for manipulating flow JSON dicts — component ops, edge creation with ReactFlow handle format, topological layout, and dynamic field detection. * feat: add MCP server for operating Langflow via REST API FastMCP server exposing 15 tools across auth, flow, component, connection, and execution groups. Agents can create flows, add and configure components, wire connections, and run flows against a Langflow server through MCP tool calls. * feat: add langflow-mcp-client console script entry point * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix: use dict comprehension in setup.py to fix PERF403 lint * fix: address PR review feedback on MCP client - Add asyncio.Lock to prevent race condition in _client() under concurrent access - Handle 204 No Content responses in delete() instead of calling resp.json() on empty body - Fix weak assertion in test_default_values * feat: auto-enable tool_mode when connecting component_as_tool describe_component_type now shows component_as_tool as an output for any component with tool_mode-capable outputs. When an agent connects via component_as_tool, tool_mode is auto-enabled — no extra step needed. * refactor: move MCP server from langflow-base to lfx The MCP server has no langflow dependencies — only httpx, mcp, and lfx.graph.flow_builder. Moving it to lfx.mcp makes it usable without installing langflow. Entry point: lfx-mcp. * feat: improve MCP server UX for agents - describe_component_type separates advanced fields from core ones - search_component_types accepts output_type filter - list_flows accepts query filter and includes ASCII graph repr - get_flow_info includes ASCII graph repr - add duplicate_flow tool - add list_starter_projects tool * feat: add use_starter_project tool and tests for new features - use_starter_project creates a flow from a starter template by name (starter projects aren't fetchable by ID via /flows/) - Tests for duplicate_flow, starter projects, graph repr, advanced fields, and output_type search * docs: improve MCP tool descriptions for agent clarity - Add server-level instructions with typical workflow guide - Remove internal implementation details from tool descriptions - Add cross-references between related tools - Mention component_as_tool and graph diagrams where relevant * docs: address subagent review feedback on tool descriptions - Document return values for create_flow, add_component - Clarify empty-query behavior for search_component_types - Distinguish get_component_info (instance) vs describe_component_type (type) - Explain connection type compatibility in instructions - Clarify configure_component trigger field behavior - State disconnect_components default when filters omitted * feat: add batch tool for multi-action requests Execute multiple actions in one call with $N.field references to chain results. An agent can build a complete flow in a single request instead of 6+ round trips. * improvements UIUX * change css canvas controls * feat: add create_flow_from_spec tool for compact text-based flow creation Accepts a compact text spec with nodes, edges (using real port names), and config sections. Agents generate a simple string instead of constructing nested JSON. Tool mode auto-enabled for component_as_tool. Handles Prompt Template dynamic variables by parsing {var} from template text and creating input fields. Cleans up flows on failure. Type coercion for numeric/boolean config values. * feat: add build_flow validation and create_flow_from_spec build_flow validates flows by building the graph server-side. create_flow_from_spec accepts a compact text spec with nodes, edges, and config. Validates by default (optional). Handles Prompt Template dynamic {variables}, auto-enables tool_mode for component_as_tool, cleans up on failure, coerces config types. * fix: isolate session state and harden MCP server * pannel execution * [autofix.ci] apply automated fixes * fix: move test_flow_builder into tests/unit so CI collects coverage * improve code gen * [autofix.ci] apply automated fixes * fix: address PR review feedback - Fix test fixture to use contextvars instead of stale module attributes - Raise ValueError on malformed spec lines instead of silently dropping - Disambiguate duplicate component types in flow_graph_repr - Narrow except Exception to ImportError in flow_graph_repr - Add action-index context to batch error messages - Fix stale/inaccurate docstrings (group count, "| ", field_name, category, build_flow) - Mention create_flow_from_spec in MCP instructions * feat: stream run_flow events via MCP progress notifications run_flow now consumes Langflow's SSE stream and relays token events to the MCP client via report_progress. Falls back to a regular POST if the stream yields no result. * test: add streaming integration tests for run_flow and stream_post * chore: rebuild component index * fix: Remove code execution from assistant validation path (#12244) Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * [autofix.ci] apply automated fixes * fix: handle Message dicts in str field param processing param_handler's str case called unescape_string on each list element without checking if the element was a string. On subsequent agent calls, chat history stores Message dicts in the list, causing 'dict' object has no attribute 'replace'. Added _coerce_str_value helper that extracts .text from Message/Data/dict objects before unescaping. Includes 4 regression tests. * feat: add flow builder tools and propose_field_edit with JSON Patch - builder.py: builds flow dicts from text specs using local component registry - flow_builder_tools.py: 9 Langflow components for agent tooling - propose_field_edit generates validated JSON Patches with dry-run verification - flow_to_spec_summary converts flow dicts to compact summaries with IDs - Module-level event queue for real-time UI updates during streaming * feat: flow builder assistant with intent routing - flow_builder_assistant.py: Python-based agent flow with 9 tools - model_config.py: shared model config extracted from translation_flow - Intent classifier recognizes build_flow, edit, and inspect requests - Updated LangflowAssistant.json prompt to mention flow building - 18 tests including graph construction and intent classification * feat: SSE event pipeline for flow building and editing - New SSE events: flow_update, flow_preview, flow_action (edit_field) - assistant_service drains tool events during streaming for real-time updates - Current flow context injected into all agent requests from DB - Event consumer forwards flow_preview events through the pipeline - extract_flow_json for text-based flow detection (fallback path) * feat: frontend flow preview, edit cards, and real-time canvas updates - FlowAction type for edit_field proposals with JSON Patch - FlowEditCarousel: paginated Accept/Dismiss cards for field edits - AssistantFlowPreview: mini ReactFlow canvas for new flow previews - SSE handler dispatches flow_update and flow_preview events - Chat hook applies flow_update events to canvas via setNodes/setEdges - edit_field events stored as flowActions on messages for user review - Strips flow_json blocks from visible chat content * chore: add lfx logger to MCP server, log streaming fallback * fix: resolve merge issues and harden flow builder state management - Restore build_flow intent in translation prompt and LangflowAssistant system prompt - Remove duplicate TYPE_CHECKING block from assistant_service.py (merge artifact) - Add build_flow to intent classification plaintext fallback - Add reset_working_flow to streaming finally block (lifecycle leak) - Replace module-level globals with contextvars for concurrency safety in both components/tools and mcp flow_builder_tools - Remove dead _save_working_flow (ThreadPoolExecutor in async antipattern) - Handle remove_component and configure flow_update actions in frontend - Log warning when flow JSON fallback triggers instead of tool events - Add tests for build_flow/off_topic plaintext fallback and contextvar isolation * feat: improve flow builder UX and consolidate tool implementations - Add worked examples to flow builder prompt (new flow + edit flow) - Add build_flow guardrail: returns error when canvas already has components - Change ConfigureComponent to accept JSON params dict (batch updates) - Remove duplicate flow_builder_tools.py from components/tools (was breaking test_get_all); single source in lfx.mcp.flow_builder_tools - Update prompt to explicitly guide build vs edit tool selection * fix: set_flow replaces canvas instead of appending, Python 3.10 compat set_flow was using paste() which appends nodes with new IDs, causing duplicates. Now uses setNodes/setEdges to replace canvas contents. Also fixes asyncio.Barrier usage (3.11+) in concurrency test and makes ConfigureComponent accept params as dict or JSON string since tool frameworks may pass either. * fix: soften build_flow guardrail and harden intent fallback parser build_flow no longer hard-blocks on non-empty canvas. Users can now create new flows while an existing one is open -- the prompt already guides the agent to prefer edit tools when components exist. Intent classification fallback now uses a strict regex pattern matching quoted JSON values ("intent": "build_flow") instead of bare substring matching, preventing prompt-echo misroutes on weaker models. * feat: lock canvas while assistant is processing Syncs the assistant panel's isProcessing state to the assistantManagerStore so the canvas locks (effectiveLocked) while the assistant is building or modifying the flow, preventing the user from dragging nodes during real-time updates. * feat: flow builder assistant with real-time canvas updates Add flow builder assistant that builds and modifies flows directly on the user's canvas via agent tools. SSE event pipeline streams flow_update and flow_preview events for real-time canvas rendering. - Flow builder tools: search, describe, add, remove, connect, configure, build_flow, propose_field_edit with JSON Patch - Intent classification with build_flow routing - Per-request state isolation via contextvars - Strict regex fallback parser for intent classification - Canvas lock while assistant is processing - Frontend handles add, remove, connect, configure, set_flow actions - Flow preview and edit card components * fix connection llm mcp * [autofix.ci] apply automated fixes * add flow visualization on assistant * add manage files to assistant * [autofix.ci] apply automated fixes * update documentation about file * [autofix.ci] apply automated fixes (attempt 2/3) * reasoning thinking v0 * flow builder improvement * [autofix.ci] apply automated fixes * add patch to canvas, improve cache and harness * ruff style and checker fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix tests * fix jest tests * UI ux improvements * [autofix.ci] apply automated fixes * ruff style and checker * improve sec and harness * ux warning banner tag assistant * improve flow builder UI UX * json updates * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * disable preview for many component * fix message preview * MCP and agent improvements * ruff style and chceker * fix ux display on generating artifacts * guard rails and deterministic results improvements * ruff style and checker * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * split flow_builder_tools, force per-user file isolation, add timeouts and guard rails * ruff style and checker * ruff style and checker * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * add model alert * add padding on warning text * [autofix.ci] apply automated fixes * fix frontend tests * fix credentials detection * refactor playwright tests: remove duplicate tests and add good practices * add send playground rule * fix import dotenv * fix fe tests * fix light mode * fix run flow test * fix tests failing * fix folder deletion test * fix e2e tests * constant text on tests * fix publish test * fix publish tests * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * test: standardize new-project-flow helper into utils/flow Follow-up to the cz/playwright-tests-refactor merge — align the new-project-flow helper our branch added with the refactor's directory and constants conventions: - Move tests/utils/new-project-flow.ts -> tests/utils/flow/, next to the refactor's open-blank-flow / open-starter-project helpers; update the 15 import sites. - Use TID / TIMEOUTS constants inside the helper instead of raw test-id strings and literal 30000 timeouts, matching open-blank-flow. - Drop an unused zoomOut import in auto-login-off.spec.ts. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test: assert New Flow button by test-id, not substring text match The merge resolution kept the refactor's `expect(...).toBeVisible()` assertion but on `getByText("New Flow")`, which is a substring match — it also matches flow cards named "New Flow (N)" and throws a strict-mode violation once such flows exist. Our previous side used a no-op `.isVisible()` that silently masked it. Assert on `getByTestId(TID.newProjectBtn)` instead: unambiguous, DB-state independent, and consistent with the refactor's test-id-first convention. Verified — actionsMainPage-shard-1 (3/3) and run-flow now pass against a populated database. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix windows utf open * assistant message fixes * [autofix.ci] apply automated fixes * add tests to validate * [autofix.ci] apply automated fixes * bugfixes round 2 * ruff style and checker * qa fixes * parse serialized model * improvement on agent tool usage * [autofix.ci] apply automated fixes * ruff style and checker * [autofix.ci] apply automated fixes * fix sidebar nav test * backend tests fixes * fix tests and change model provider to open dialog * performance improvements * [autofix.ci] apply automated fixes * ruff style and checker fix * tests fixes * fix error handling test * test user overlay * fix test tool mixin * last improvements * ruff style fix * [autofix.ci] apply automated fixes * fix user test agentic * QA fixes round 7 * fix assistant gpt 5.4 * [autofix.ci] apply automated fixes --------- Co-authored-by: cristhianzl <cristhian.lousa@gmail.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Edwin Jose <edwin.jose@datastax.com> Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com> Co-authored-by: Rodrigo Nader <rodrigonader@MacBook-Pro-de-Rodrigo.local> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-28 18:18:00 -03:00
Mendon Kissling	c0b4b05d41	docs: update database tables (#13254) ... update-database-tables	2026-05-28 18:12:03 +00:00
Mendon Kissling	104a83c83c	docs: lfx bundles (#13142) ... * docs-initial-overview-bundles-content * fix-broken-link * remove-production-page * docs: check bundles against code and cleanup * docs: fix links	2026-05-27 20:16:19 +00:00
Mendon Kissling	1bb95275a5	docs: openrouter promoted to global provider (#13271) ... docs: check openrouter content and add global	2026-05-27 18:40:35 +00:00
Mendon Kissling	e694bbcdff	docs: troubleshooting for container mismatch (#13217) ... * add-troubleshooting-for-container-mismatch * grep-for-volume-name * fix-spacing * danger-admonition	2026-05-27 18:40:16 +00:00
Mendon Kissling	9b7486efe8	docs: macos support matrix (#13363) ... * docs: macos support matrix * docs: fix linking errors and clarify limitations * cleanup	2026-05-27 18:19:56 +00:00
Eric Hare	5e86ab6c5f	feat: accept v2 workflow globals in request body (#13351) ... * fix: accept v2 workflow globals in request body * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * review feedback --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	2026-05-27 13:01:00 -07:00
Eric Hare	6923ca24c4	Merge release-1.9.4 into main ... # Conflicts: # .secrets.baseline # src/lfx/src/lfx/_assets/component_index.json # src/lfx/src/lfx/services/settings/base.py	2026-05-27 08:43:43 -07:00