langgraph-api 0.12.0.dev20__tar.gz → 0.12.0.dev21__tar.gz

{langgraph_api-0.12.0.dev20 → langgraph_api-0.12.0.dev21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langgraph-api
-Version: 0.12.0.dev20
+Version: 0.12.0.dev21
 Author-email: Will Fu-Hinthorn <will@langchain.dev>, Josh Rogers <josh@langchain.dev>, Parker Rule <parker@langchain.dev>
 License: Elastic-2.0
 License-File: LICENSE

langgraph_api-0.12.0.dev21/langgraph_api/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.12.0.dev21"

{langgraph_api-0.12.0.dev20 → langgraph_api-0.12.0.dev21}/langgraph_api/api/assistants.py

@@ -497,10 +497,14 @@ async def patch_assistant(
 @retry_db
 async def delete_assistant(request: ApiRequest) -> Response:
     """Delete an assistant by ID.
-
-    Query params:
-        delete_threads: If "true", delete all threads where
-            metadata.assistant_id matches this assistant.
+    ---
+    summary: Delete an assistant by ID.
+    description: |
+        Delete an assistant by ID.
+
+        Query params:
+            delete_threads: If "true", delete all threads where
+                metadata.assistant_id matches this assistant.
     """
     assistant_id = request.path_params["assistant_id"]
     validate_uuid(assistant_id, "Invalid assistant ID: must be a UUID")

{langgraph_api-0.12.0.dev20 → langgraph_api-0.12.0.dev21}/langgraph_api/api/event_streaming.py

@@ -97,25 +97,27 @@ def _make_manager(thread_id: str, send_event: Any = None) -> ThreadRunManager:
 
 async def _thread_events(request: Request) -> Response:
     """SSE stream scoped to a thread.
+    ---
+    summary: SSE stream scoped to a thread.
+    description: |
+        Body is an ``EventStreamRequest``:
 
-    Body is an ``EventStreamRequest``:
-
-        {
-          "channels": ["values", "messages", ...],
-          "namespaces": [["ns1"], ["ns2", "child"]],   // optional
-          "depth": 2,                                     // optional
-          "since": 42                                     // optional seq
-        }
-
-    On reconnect, clients pass the last ``seq`` they received as
-    ``since`` in the body. Buffered events with ``seq > since`` are
-    replayed before the stream goes live. The endpoint is POST-only, so
-    browser-native ``EventSource`` auto-resume (``Last-Event-ID``)
-    doesn't apply — clients drive resume explicitly via the body.
-
-    The filter applies for the lifetime of the connection; closing the
-    connection unsubscribes. No state is persisted server-side beyond the
-    connection.
+            {
+              "channels": ["values", "messages", ...],
+              "namespaces": [["ns1"], ["ns2", "child"]],   // optional
+              "depth": 2,                                     // optional
+              "since": 42                                     // optional seq
+            }
+
+        On reconnect, clients pass the last ``seq`` they received as
+        ``since`` in the body. Buffered events with ``seq > since`` are
+        replayed before the stream goes live. The endpoint is POST-only, so
+        browser-native ``EventSource`` auto-resume (``Last-Event-ID``)
+        doesn't apply — clients drive resume explicitly via the body.
+
+        The filter applies for the lifetime of the connection; closing the
+        connection unsubscribes. No state is persisted server-side beyond the
+        connection.
     """
     thread_id = request.path_params["thread_id"]
     try:
@@ -297,11 +299,13 @@ async def _thread_events(request: Request) -> Response:
 
 async def _thread_command(request: Request) -> Response:
     """Handle a single protocol command scoped to a thread.
-
-    Commands are stateless in the HTTP transport: a fresh manager is
-    created, the command is dispatched, and results are returned. For
-    ``run.start`` this creates/resumes a run; subsequent event streaming
-    happens over a separate ``POST .../stream`` connection.
+    ---
+    summary: Handle a single protocol command scoped to a thread.
+    description: |
+        Commands are stateless in the HTTP transport: a fresh manager is
+        created, the command is dispatched, and results are returned. For
+        ``run.start`` this creates/resumes a run; subsequent event streaming
+        happens over a separate ``POST .../stream`` connection.
     """
     thread_id = request.path_params["thread_id"]
     try:

{langgraph_api-0.12.0.dev20 → langgraph_api-0.12.0.dev21}/langgraph_api/api/store.py

@@ -35,11 +35,11 @@ def _validate_namespace(namespace: tuple[str, ...]) -> Response | None:
 async def handle_event(
     action: str,
     value: Any,
-) -> None:
+) -> Auth.types.FilterType | None:
     ctx = get_auth_ctx()
     if not ctx:
-        return
-    await _handle_event(
+        return None
+    return await _handle_event(
         Auth.types.AuthContext(
             user=ctx.user,
             permissions=ctx.permissions,
@@ -143,7 +143,13 @@ async def search_items(request: ApiRequest):
         "query": query,
         "refresh_ttl": payload.get("refresh_ttl"),
     }
-    await handle_event("search", handler_payload)
+    auth_filter = await handle_event("search", handler_payload)
+    if auth_filter:
+        existing = handler_payload.get("filter")
+        if existing:
+            handler_payload["filter"] = {"$and": [existing, auth_filter]}
+        else:
+            handler_payload["filter"] = auth_filter
     items = await (await get_store()).asearch(
         handler_payload["namespace"],
         filter=handler_payload["filter"],

{langgraph_api-0.12.0.dev20 → langgraph_api-0.12.0.dev21}/langgraph_api/api/ui.py

@@ -1,6 +1,8 @@
+import html
 import json
 import os
 import re
+from urllib.parse import quote
 
 from anyio import open_file
 from orjson import loads
@@ -21,6 +23,16 @@ class UiSchema(TypedDict):
 _UI_SCHEMAS_CACHE: dict[str, UiSchema] | None = None
 
 
+def _quote_path_segment(value: str) -> str:
+    """Encode a dynamic URL path segment for safe HTML attribute use."""
+    return quote(value, safe="")
+
+
+def _html_safe_json_arg(value: object) -> str:
+    """Serialize a value for a JavaScript argument inside an HTML attribute."""
+    return html.escape(json.dumps(value), quote=True)
+
+
 async def load_ui_schemas() -> dict[str, UiSchema]:
     """Load and cache UI schema mappings from JSON file."""
     global _UI_SCHEMAS_CACHE
@@ -40,7 +52,6 @@ async def load_ui_schemas() -> dict[str, UiSchema]:
 async def handle_ui(request: ApiRequest) -> Response:
     """Serve UI HTML with appropriate script/style tags."""
     graph_id = request.path_params["graph_id"]
-    host = request.headers.get("host")
     message = await request.json(schema=None)
 
     # Load UI file paths from schema
@@ -54,24 +65,20 @@ async def handle_ui(request: ApiRequest) -> Response:
         basename = os.path.basename(filepath)
         ext = os.path.splitext(basename)[1]
 
-        # Use http:// protocol if accessing a localhost service
-        def is_host(needle: str) -> bool:
-            if not isinstance(host, str):
-                return False
-            return host.startswith(needle + ":") or host == needle
-
-        protocol = "http:" if is_host("localhost") or is_host("127.0.0.1") else ""
         valid_js_name = re.sub(r"[^a-zA-Z0-9]", "_", graph_id)
+        asset_url = (
+            f"/ui/{_quote_path_segment(graph_id)}/{_quote_path_segment(basename)}"
+        )
+        safe_asset_url = html.escape(asset_url, quote=True)
 
         if ext == ".css":
-            result.append(
-                f'<link rel="stylesheet" href="{protocol}//{host}/ui/{graph_id}/{basename}" />'
-            )
+            result.append(f'<link rel="stylesheet" href="{safe_asset_url}" />')
         elif ext == ".js":
-            safe_name = json.dumps(message["name"]).replace("'", "&#39;")
+            safe_name = _html_safe_json_arg(message["name"])
             result.append(
-                f'<script src="{protocol}//{host}/ui/{graph_id}/{basename}" '
-                f"onload='__LGUI_{valid_js_name}.render({safe_name}, \"{{{{shadowRootId}}}}\")'>"
+                f'<script src="{safe_asset_url}" '
+                f"onload='__LGUI_{valid_js_name}.render("
+                f'{safe_name}, "{{{{shadowRootId}}}}")\'>'
                 "</script>"
             )
 

{langgraph_api-0.12.0.dev20 → langgraph_api-0.12.0.dev21}/langgraph_api/event_streaming/service.py

@@ -623,6 +623,12 @@ class ThreadRunManager:
                         "no_such_interrupt",
                         "Interrupt namespace does not match the pending interrupt.",
                     )
+                # WS can surface ``input.requested`` before postgres/gRPC
+                # persists the thread-row interrupt. Reuse the HTTP settle
+                # barrier before enqueueing the resume run.
+                if not thread_state_fetched:
+                    thread_state_ids = await self._collect_settled_interrupt_ids()
+                    thread_state_fetched = True
                 continue
             # HTTP fallback: the persisted lookup surfaces interrupts by id
             # only, so trust the client-claimed namespace and validate by

{langgraph_api-0.12.0.dev20 → langgraph_api-0.12.0.dev21}/langgraph_api/js/client.http.mts

@@ -40,7 +40,8 @@ const logger = createLogger({
   ],
 });
 
-const HTTP_PORT = 5557;
+// Pinned by the Python parent (see remote.py); base port is the fallback.
+const HTTP_PORT = Number(process.env.LANGGRAPH_JS_GRAPH_HTTP_PORT) || 5557;
 
 const wrapHonoApp = (app: Hono) => {
   // We do this to avoid importing Hono from server dependencies

{langgraph_api-0.12.0.dev20 → langgraph_api-0.12.0.dev21}/langgraph_api/js/client.mts

@@ -221,8 +221,9 @@ async function getOrExtractSchema(graphId: string) {
   return GRAPH_SCHEMA[graphId];
 }
 
-const GRAPH_PORT = 5556;
-const REMOTE_PORT = 5555;
+// Pinned by the Python parent (see remote.py); base ports are the fallback.
+const GRAPH_PORT = Number(process.env.LANGGRAPH_JS_GRAPH_PORT) || 5556;
+const REMOTE_PORT = Number(process.env.LANGGRAPH_JS_REMOTE_PORT) || 5555;
 
 const RunnableConfigSchema = z.object({
   tags: z.array(z.string()).optional(),

{langgraph_api-0.12.0.dev20 → langgraph_api-0.12.0.dev21}/langgraph_api/js/remote.py

@@ -40,6 +40,7 @@ from starlette.exceptions import HTTPException
 from starlette.requests import HTTPConnection, Request
 from starlette.routing import Route
 
+from langgraph_api import config as lg_config
 from langgraph_api import store as api_store
 from langgraph_api.auth.custom import DotDict, ProxyUser
 from langgraph_api.config import LANGGRAPH_AUTH, LANGGRAPH_AUTH_TYPE
@@ -53,9 +54,40 @@ from langgraph_api.utils import get_auth_ctx, get_user_id
 
 logger = structlog.stdlib.get_logger(__name__)
 
-REMOTE_PORT = 5555
-GRAPH_PORT = 5556
-GRAPH_HTTP_PORT = 5557
+# Loopback ports between the Python parent and its JS subprocess. Containers
+# colocated in one pod share a network namespace, so each entrypoint gets its
+# own range (via the offset below); LANGGRAPH_JS_*_PORT overrides any port.
+_BASE_REMOTE_PORT = 5555
+_BASE_GRAPH_PORT = 5556
+_BASE_GRAPH_HTTP_PORT = 5557
+
+
+def _js_port_offset(*, is_queue: bool) -> int:
+    """Port offset per entrypoint so colocated containers don't collide.
+
+    The queue worker and API server can run as separate containers in a single
+    pod (shared network namespace), so the queue worker gets its own range.
+    """
+    return 10 if is_queue else 0
+
+
+def _resolve_js_port(base: int, offset: int, override: str | None) -> int:
+    """Explicit env override wins; otherwise base port plus entrypoint offset."""
+    if override:
+        return int(override)
+    return base + offset
+
+
+_JS_PORT_OFFSET = _js_port_offset(is_queue=lg_config.IS_QUEUE_ENTRYPOINT)
+REMOTE_PORT = _resolve_js_port(
+    _BASE_REMOTE_PORT, _JS_PORT_OFFSET, os.getenv("LANGGRAPH_JS_REMOTE_PORT")
+)
+GRAPH_PORT = _resolve_js_port(
+    _BASE_GRAPH_PORT, _JS_PORT_OFFSET, os.getenv("LANGGRAPH_JS_GRAPH_PORT")
+)
+GRAPH_HTTP_PORT = _resolve_js_port(
+    _BASE_GRAPH_HTTP_PORT, _JS_PORT_OFFSET, os.getenv("LANGGRAPH_JS_GRAPH_HTTP_PORT")
+)
 SSL = ssl.create_default_context(cafile=certifi.where())
 
 if (port := int(os.getenv("PORT", "8080"))) and port in (GRAPH_PORT, REMOTE_PORT):
@@ -510,6 +542,10 @@ async def run_js_process(paths_str: str | None, watch: bool = False):
                     "NODE_ENV": "development" if watch else "production",
                     "CHOKIDAR_USEPOLLING": "true",
                     **os.environ,
+                    # Pin the child to the parent's resolved ports.
+                    "LANGGRAPH_JS_REMOTE_PORT": str(REMOTE_PORT),
+                    "LANGGRAPH_JS_GRAPH_PORT": str(GRAPH_PORT),
+                    "LANGGRAPH_JS_GRAPH_HTTP_PORT": str(GRAPH_HTTP_PORT),
                 },
             )
             logger.info(
@@ -567,6 +603,10 @@ async def run_js_http_process(
                     "NODE_ENV": "development" if watch else "production",
                     "CHOKIDAR_USEPOLLING": "true",
                     **os.environ,
+                    # Pin the child to the parent's resolved ports.
+                    "LANGGRAPH_JS_REMOTE_PORT": str(REMOTE_PORT),
+                    "LANGGRAPH_JS_GRAPH_PORT": str(GRAPH_PORT),
+                    "LANGGRAPH_JS_GRAPH_HTTP_PORT": str(GRAPH_HTTP_PORT),
                 },
             )
 

{langgraph_api-0.12.0.dev20 → langgraph_api-0.12.0.dev21}/langgraph_api/metrics_otlp.py

@@ -11,6 +11,7 @@ from typing import TYPE_CHECKING, Any, Literal
 import structlog
 
 from langgraph_api import __version__, config, metadata
+from langgraph_api.http_metrics_utils import HTTP_LATENCY_BUCKETS
 
 if TYPE_CHECKING:
     from opentelemetry.exporter.otlp.proto.http.metric_exporter import (
@@ -74,6 +75,15 @@ METRIC_TIER_INFO = 2
 METRIC_TIER_DEBUG = 3
 METRIC_TIER_DEEP_DEBUG = 4
 
+# Legacy /metrics used HTTP_LATENCY_BUCKETS in seconds. OTLP record_latency()
+# stores milliseconds, so convert (drop +Inf — OTel adds the overflow bucket).
+# Apply to every latency metric: OTel defaults max out at 10000ms (~10s), which
+# caps p95/p99 for long HTTP polls (/join), run queue waits (300s alerts), and
+# run execution (30m alerts).
+HTTP_LATENCY_BUCKETS_MS: tuple[float, ...] = tuple(
+    b * 1000 for b in HTTP_LATENCY_BUCKETS if b != float("inf")
+)
+
 MetricType = Literal["counter", "histogram", "latency", "gauge"]
 
 
@@ -614,8 +624,17 @@ class OTelMetricsReporter:
                 name=name, description=metric.description
             )
         elif metric.metric_type in {"histogram", "latency"}:
+            # All latency metrics use legacy second-scale buckets (as ms).
+            # Non-latency histograms (bytes, counts) keep OTel defaults.
+            advisory = (
+                list(HTTP_LATENCY_BUCKETS_MS)
+                if metric.metric_type == "latency"
+                else None
+            )
             instrument = self._meter.create_histogram(
-                name=name, description=metric.description
+                name=name,
+                description=metric.description,
+                explicit_bucket_boundaries_advisory=advisory,
             )
         else:
             # Gauges are handled via observable instruments (see _set_gauge).

{langgraph_api-0.12.0.dev20 → langgraph_api-0.12.0.dev21}/langgraph_api/release_tags.py

@@ -73,10 +73,13 @@ def compute_python_publish_tags(
     ecr_prefix: str,
     img_api_dh: str,
     img_svr_dh: str,
+    fips: bool = False,
 ) -> list[str]:
     """Compute Python publish tags with workflow-compatible behavior."""
     py_version = _require_non_empty("py_version", py_version)
     distro = _require_non_empty("distro", distro)
+    if fips and distro != "wolfi":
+        raise ValueError("fips is only supported for wolfi images")
     sha = _require_non_empty("sha", sha)
     ver_patch = _require_non_empty("ver_patch", ver_patch)
     ver_major = _require_non_empty("ver_major", ver_major)
@@ -92,6 +95,8 @@ def compute_python_publish_tags(
         raise ValueError("gcr_projects must include at least one project")
 
     suf = _python_suffix(distro)
+    if fips:
+        suf = f"{suf}-fips"
     pyfrag = f"py{py_version}"
     runtime_alias = (
         f"{py_version}{suf}" if channel == "stable" else f"{channel}-{pyfrag}{suf}"
@@ -184,9 +189,12 @@ def compute_js_publish_tags(
     ar_project: str,
     ecr_prefix: str,
     img_js_dh: str,
+    fips: bool = False,
 ) -> list[str]:
     """Compute JS publish tags with workflow-compatible behavior."""
     node_version = _require_non_empty("node_version", node_version)
+    if fips and tag_suffix != "wolfi":
+        raise ValueError("fips is only supported for wolfi images")
     sha = _require_non_empty("sha", sha)
     ver_patch = _require_non_empty("ver_patch", ver_patch)
     ar_project = _require_non_empty("ar_project", ar_project)
@@ -199,6 +207,8 @@ def compute_js_publish_tags(
         raise ValueError("gcr_projects must include at least one project")
 
     suffix = f"-{tag_suffix}" if tag_suffix else ""
+    if fips:
+        suffix = f"{suffix}-fips"
     repo_base = "langgraphjs-api" if licensed else "langgraphjs-api-unlicensed"
     runtime_alias = (
         f"{node_version}{suffix}"

langgraph_api-0.12.0.dev20/langgraph_api/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.12.0.dev20"