langgraph-api 0.17.0.dev5__tar.gz → 0.17.0rc2__tar.gz

{langgraph_api-0.17.0.dev5 → langgraph_api-0.17.0rc2}/Makefile

@@ -43,7 +43,7 @@ TEST ?= tests/ ../runtime_inmem/tests/
 # has no [tool.pytest] — dropping pythonpath (e.g. apply_prerelease_version).
 PYTEST_ROOT_ARGS := --rootdir=. -c pyproject.toml
 PYTEST_WORKERS ?= 0
-AUTH_TEST ?= "tests/integration_tests/test_custom_auth.py"
+AUTH_TEST ?= tests/integration_tests/test_custom_auth.py tests/integration_tests/test_auth_mcp.py
 LANGGRAPH_HTTP ?= {"disable_mcp": false, "disable_a2a": false}
 LANGGRAPH_AES_KEY ?= '1234567890123456'
 BG_JOB_TIMEOUT_SECS ?= 86400
@@ -128,7 +128,13 @@ test-auth:
 test-with-server:
 	@bash -euo pipefail -c '$(MAKE) $(START_TARGET) LANGGRAPH_HTTP='\''$(LANGGRAPH_HTTP)'\'' & \
 	pid=$$!; \
-	cleanup() { kill $$pid >/dev/null 2>&1 || true; }; \
+	cleanup() { \
+		if [ -r /proc/$$pid/winpid ]; then \
+			taskkill //F //T //PID "$$(cat /proc/$$pid/winpid)" >/dev/null 2>&1 || true; \
+		else \
+			kill $$pid >/dev/null 2>&1 || true; \
+		fi; \
+	}; \
 	trap cleanup EXIT; \
 	for i in $$(seq 1 $(SERVER_START_TIMEOUT_SECS)); do \
 		if curl -sf "$(SERVER_HEALTH_URL)" >/dev/null; then \

{langgraph_api-0.17.0.dev5 → langgraph_api-0.17.0rc2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langgraph-api
-Version: 0.17.0.dev5
+Version: 0.17.0rc2
 Author-email: Will Fu-Hinthorn <will@langchain.dev>, Josh Rogers <josh@langchain.dev>, Parker Rule <parker@langchain.dev>
 License: Elastic-2.0
 License-File: LICENSE
@@ -35,7 +35,7 @@ Requires-Dist: structlog<26,>=24.1.0
 Requires-Dist: tenacity>=8.0.0
 Requires-Dist: truststore>=0.1
 Requires-Dist: uuid-utils>=0.16.2
-Requires-Dist: uvicorn>=0.26.0
+Requires-Dist: uvicorn>=0.29.0
 Requires-Dist: uvloop>=0.18.0; platform_system != 'Windows'
 Requires-Dist: watchfiles>=0.13
 Requires-Dist: websockets>=13.0

{langgraph_api-0.17.0.dev5 → langgraph_api-0.17.0rc2}/benchmark/README.md

@@ -132,7 +132,7 @@ thread depth. `delta_turns` measures it: one thread per VU, one turn per iterati
 `benchmark-delta.yml` runs two cells nightly in one k6 run (`DELTA_CELLS`): every VU turns a
 plain-channel thread and a `benchmark_delta_messages` thread (a message list, snapshot every 50,
 the deepagents setting) in rotation, `ITERATIONS` fixed so both reach 1,400 turns.
-`delta-report.js` posts write, read and storage at the last turn and puts the by-depth tables
+`delta-report.js` posts turn, write, read and data at the last turn and puts the by-depth tables
 in the thread; `REPORTS.md` explains the post. The cells below stay available for manual runs.
 
 | Cell | Env |
@@ -173,7 +173,7 @@ At every `VERIFY_EVERY` turn it also times the cold `GET /threads/{thread_id}/st
 `state_read_duration` (the read path alone; a turn is one save plus the read before it), and
 reads `GET /threads/{thread_id}/storage` and records
 `thread_storage_bytes` tagged by depth bucket and graph, so the control and delta cells can
-be compared on the bytes they occupy, which is what the feature exists to reduce.
+be compared on the bytes they store, which is what the feature exists to reduce.
 
 ## Outputs
 

{langgraph_api-0.17.0.dev5 → langgraph_api-0.17.0rc2}/benchmark/REPORTS.md

@@ -142,12 +142,17 @@ once every 50 turns, at its own offset in that interval, so the reads cover
 the whole climb between two snapshots instead of the moment right after one.
 Storage (`GET /threads/{id}/storage`) is read at turns 350, 700, 1050 and 1400.
 
-**The table.** Both setups at turn 1400: `write` is the median checkpoint
-save, timed by the worker between the graph's two steps; `read` is the median
-cold read, timed to the server's first byte; `MB` is the thread's storage.
-Lower is better for all three. `last 10` is the delta value over tonight and
-the nine nights before it. A metric outside its usual range over five or more
-nights gets a ⚠️ line above the table.
+**The table.** Both setups at turn 1400: `turn` is the average successful
+turn (`POST /runs/wait`), what a user waits for; `write` is the average
+checkpoint save, timed by the worker between the graph's two steps. Both are
+averages so that a delta thread's snapshot, written on one turn in 50, counts:
+a median never sees it. `read` is the median cold read, timed to the server's
+first byte. `data` is the thread's stored data in MB as
+`GET /threads/{id}/storage` reports it: the stored size of the checkpoint,
+metadata and blob values (`pg_column_size`), without keys, row headers or
+indexes, so not disk use. Lower is better for every row. `last 10` is the
+delta value over tonight and the nine nights before it. A metric outside its
+usual range over five or more nights gets a ⚠️ line above the table.
 
 **Pass bar.** Request errors under 1% and success over 99%. Two correctness
 checks turn the dot yellow on any failure: at turn 2 each thread confirms
@@ -155,9 +160,9 @@ delta is on (or off, for `base`), because a too-old langgraph silently
 degrades a `DeltaChannel` to a plain one; and every cold read is compared with
 what the run returned.
 
-**Thread.** Write, read and MB at turns 350, 700, 1050 and 1400, with `gain`:
-how many times better delta is (`same` within 15%, below `1.0x` when delta is
-worse). Then the run's size, failures and correctness checks.
+**Thread.** Turn, write, read and data at turns 350, 700, 1050 and 1400, with
+`gain`: how many times better delta is (`same` within 15%, below `1.0x` when
+delta is worse). Then the run's size, failures and correctness checks.
 
 ## Changing a report
 

{langgraph_api-0.17.0.dev5 → langgraph_api-0.17.0rc2}/benchmark/delta-report.js

@@ -21,8 +21,8 @@ export const CELLS = [
   { cell: 'delta_50', label: 'delta' },
 ];
 
-/** Nights measured another way (one cell per job, a bytes channel) do not compare with these. */
-export const DESIGN = 'paired-messages';
+/** Nights measured another way (one cell per job, a bytes channel, a median write) do not compare with these. */
+export const DESIGN = 'paired-messages-mean';
 
 /** Tonight plus the nine nights before it, as in the daily report. */
 const NIGHTS = 10;
@@ -30,13 +30,19 @@ const NIGHTS = 10;
 /** The thread's growth tables, one row per this many turns. Matches STORAGE_EVERY in the workflow. */
 export const ROW_EVERY = 350;
 
-/** Metric key, label, printer. All three are lower-is-better. */
+/** Metric key, label, printer, unit. All are lower-is-better. */
 const METRICS = [
-  ['saveMs', 'write', (v) => (isNumber(v) ? (v / 1000).toFixed(2) : '-')],
-  ['readP50Ms', 'read', (v) => (isNumber(v) ? (v / 1000).toFixed(2) : '-')],
-  ['bytes', 'MB', formatMb],
+  ['turnMeanMs', 'turn', formatSeconds, 's'],
+  ['saveMeanMs', 'write', formatSeconds, 's'],
+  ['readP50Ms', 'read', formatSeconds, 's'],
+  ['bytes', 'data', formatMb, 'MB'],
 ];
 
+/** From 10 s on, one decimal: five characters would fill the column and touch the one before it. */
+function formatSeconds(v) {
+  return isNumber(v) ? (v / 1000).toFixed(v >= 10_000 ? 1 : 2) : '-';
+}
+
 function formatMb(v) {
   if (!isNumber(v)) return '-';
   const mb = v / 1024 / 1024;
@@ -56,6 +62,10 @@ function percentile(sorted, p) {
   return sorted[Math.min(sorted.length - 1, Math.max(0, Math.ceil(sorted.length * p) - 1))];
 }
 
+function mean(values) {
+  return values.length > 0 ? values.reduce((sum, v) => sum + v, 0) / values.length : null;
+}
+
 export function bucketStart(bucket) {
   const n = parseInt(String(bucket).split('-')[0], 10);
   return Number.isFinite(n) ? n : Number.MAX_SAFE_INTEGER;
@@ -91,9 +101,12 @@ export function aggregateSamples(points) {
   for (const depth of new Set([...Object.keys(turns), ...Object.keys(reads), ...Object.keys(saves), ...Object.keys(bytes)])) {
     buckets[depth] = {
       turns: (turns[depth] ?? []).length,
+      // Averages, so a delta thread's snapshot turn counts: one write in 50
+      // saves the whole value, and a median never sees it.
+      turnMeanMs: mean(turns[depth] ?? []),
+      saveMeanMs: mean(saves[depth] ?? []),
       // One cold read per thread per bucket is few samples, so the median only.
       readP50Ms: percentile((reads[depth] ?? []).sort((a, b) => a - b), 0.5),
-      saveMs: percentile((saves[depth] ?? []).sort((a, b) => a - b), 0.5),
       bytes: bytes[depth] ?? null,
     };
   }
@@ -228,11 +241,11 @@ function failureReason(run) {
 export function cellChanges(cell, depth, history) {
   const tonight = cell.buckets?.[depth];
   const changes = [];
-  for (const [key, label, format] of METRICS) {
+  for (const [key, label, format, unit] of METRICS) {
     const past = history.map((night) => night[cell.cell]?.buckets?.[depth]?.[key]).filter(isNumber);
     const flagged = flaggedChange(tonight?.[key], past, { higherIsBetter: false });
     if (!flagged) continue;
-    changes.push({ key, better: flagged.better, text: `${cell.label} ${label} ${formatMove(format(flagged.median), format(tonight[key]), flagged.deltaPct, key === 'bytes' ? 'MB' : 's')}` });
+    changes.push({ key, better: flagged.better, text: `${cell.label} ${label} ${formatMove(format(flagged.median), format(tonight[key]), flagged.deltaPct, unit)}` });
   }
   return changes;
 }
@@ -241,7 +254,7 @@ export function cellChanges(cell, depth, history) {
 export function gain(base, cell) {
   if (!isNumber(base) || !isNumber(cell) || base <= 0 || cell <= 0) return '-';
   const ratio = base / cell;
-  // About the night-to-night noise on these medians; closer reads as a tie.
+  // About the night-to-night noise on these numbers; closer reads as a tie.
   if (ratio > 0.85 && ratio < 1.15) return 'same';
   return ratio >= 10 ? `${Math.round(ratio)}x` : `${ratio.toFixed(1)}x`;
 }
@@ -266,9 +279,8 @@ export function growthTables(cells) {
   const depths = Object.keys(base.buckets)
     .filter((d) => bucketEnd(d) % ROW_EVERY === 0 && delta.buckets[d])
     .sort(byDepth);
-  const titles = { saveMs: 'write s', readP50Ms: 'read s', bytes: 'MB' };
-  return METRICS.filter(([key]) => depths.some((d) => isNumber(base.buckets[d][key]))).map(([key, , format]) => {
-    const lines = ['```', titles[key], `${'turn'.padEnd(5)}${'base'.padStart(6)}${'delta'.padStart(6)}${'gain'.padStart(6)}`];
+  return METRICS.filter(([key]) => depths.some((d) => isNumber(base.buckets[d][key]))).map(([key, label, format, unit]) => {
+    const lines = ['```', `${label} ${unit}`, `${'turn'.padEnd(5)}${'base'.padStart(6)}${'delta'.padStart(6)}${'gain'.padStart(6)}`];
     for (const d of depths) {
       const [b, x] = [base.buckets[d][key], delta.buckets[d][key]];
       lines.push(`${depthLabel(d).padEnd(5)}${format(b).padStart(6)}${format(x).padStart(6)}${gain(b, x).padStart(6)}`);
@@ -321,7 +333,7 @@ export function buildReport(run, context = {}) {
     lines.push('*No turn was finished by every user on both cells.*');
   }
   if (depth && !anyBytes(run.cells[0])) {
-    lines.push('_No MB row: the deployment runs an API without `GET /threads/{id}/storage` yet._');
+    lines.push('_No data row: the deployment runs an API without `GET /threads/{id}/storage` yet._');
   }
   if (history.length < MIN_HISTORY_NIGHTS) lines.push(`_${history.length} of ${MIN_HISTORY_NIGHTS} nights of history, no change flags yet_`);
   lines.push(footer('delta-channel', artifactUrl));

{langgraph_api-0.17.0.dev5 → langgraph_api-0.17.0rc2}/benchmark/delta-report.test.js

@@ -9,19 +9,21 @@ import { PHONE_WIDTH, footer, widestCodeLine } from './slack.js';
 const MB = 1024 * 1024;
 const point = (metric, depth, value, cell) => ({ metric, value, tags: { depth, ...(cell ? { cell } : {}) } });
 
-test('aggregates cold read, write and end-of-bucket bytes per depth', () => {
+test('turn and write are averages so a snapshot write counts, read is the median, bytes the largest reading', () => {
   const buckets = aggregateSamples([
     point('turn_duration', '1-50', 100),
     point('turn_duration', '1-50', 300),
     point('checkpoint_save', '1-50', 30),
+    point('checkpoint_save', '1-50', 30),
+    point('checkpoint_save', '1-50', 600),
     point('thread_storage_bytes', '1-50', 1024),
     point('thread_storage_bytes', '1-50', 4096),
     point('state_read_duration', '1-50', 50),
     point('state_read_duration', '1-50', 70),
     point('turn_duration', '51-100', 900),
   ]);
-  assert.deepEqual(buckets['1-50'], { turns: 2, readP50Ms: 50, saveMs: 30, bytes: 4096 });
-  assert.deepEqual(buckets['51-100'], { turns: 1, readP50Ms: null, saveMs: null, bytes: null });
+  assert.deepEqual(buckets['1-50'], { turns: 2, turnMeanMs: 200, saveMeanMs: 220, readP50Ms: 50, bytes: 4096 });
+  assert.deepEqual(buckets['51-100'], { turns: 1, turnMeanMs: 900, saveMeanMs: null, readP50Ms: null, bytes: null });
 });
 
 test('samples from one run split by the cell the runner tagged them with', () => {
@@ -31,21 +33,21 @@ test('samples from one run split by the cell the runner tagged them with', () =>
     point('checkpoint_save', '1-50', 999),
   ]);
   assert.deepEqual(Object.keys(byCell).sort(), ['control', 'delta_50']);
-  assert.equal(byCell.control['1-50'].saveMs, 300);
-  assert.equal(byCell.delta_50['1-50'].saveMs, 60);
+  assert.equal(byCell.control['1-50'].saveMeanMs, 300);
+  assert.equal(byCell.delta_50['1-50'].saveMeanMs, 60);
 });
 
-const bucket = (saveMs, readP50Ms, bytes) => ({ turns: 1000, saveMs, readP50Ms, bytes });
+const bucket = (turnMeanMs, saveMeanMs, readP50Ms, bytes) => ({ turns: 1000, turnMeanMs, saveMeanMs, readP50Ms, bytes });
 
 function run({ base = {}, delta = {}, summary, stepOutcome = 'success' } = {}) {
-  const b = { save: 310, read: 110, bytes: 980 * MB, ...base };
-  const d = { save: 60, read: 100, bytes: 22 * MB, ...delta };
-  const rows = (s, r, bytes) => ({
-    '301-350': bucket(s / 4, r * 0.6, bytes / 16),
-    '651-700': bucket(s / 2, r * 0.7, bytes / 4),
-    '1001-1050': bucket(s * 0.75, r * 0.9, bytes / 2),
-    '1301-1350': bucket(s, r, null),
-    '1351-1400': bucket(s, r, bytes),
+  const b = { turn: 1600, save: 310, read: 110, bytes: 980 * MB, ...base };
+  const d = { turn: 1400, save: 60, read: 100, bytes: 22 * MB, ...delta };
+  const rows = (t, s, r, bytes) => ({
+    '301-350': bucket(t / 4, s / 4, r * 0.6, bytes / 16),
+    '651-700': bucket(t / 2, s / 2, r * 0.7, bytes / 4),
+    '1001-1050': bucket(t * 0.75, s * 0.75, r * 0.9, bytes / 2),
+    '1301-1350': bucket(t, s, r, null),
+    '1351-1400': bucket(t, s, r, bytes),
   });
   return {
     stepOutcome,
@@ -58,8 +60,8 @@ function run({ base = {}, delta = {}, summary, stepOutcome = 'success' } = {}) {
             thresholds: { http_req_failed: { 'rate<0.01': { ok: true } } },
           },
     cells: [
-      { cell: 'control', label: 'base', buckets: rows(b.save, b.read, b.bytes) },
-      { cell: 'delta_50', label: 'delta', buckets: rows(d.save, d.read, d.bytes) },
+      { cell: 'control', label: 'base', buckets: rows(b.turn, b.save, b.read, b.bytes) },
+      { cell: 'delta_50', label: 'delta', buckets: rows(d.turn, d.save, d.read, d.bytes) },
     ],
   };
 }
@@ -75,19 +77,27 @@ test('a clean night is the verdict, one table at the last turn, and a footer', (
     '_at turn 1400_',
     '```',
     '       base delta last 10',
+    'turn   1.60 1.40 ▄▄▄▄▄▄▄▄▄▄',
     'write  0.31 0.06 ▄▄▄▄▄▄▄▄▄▄',
     'read   0.11 0.10 ▄▄▄▄▄▄▄▄▄▄',
-    'MB      980 22.0 ▄▄▄▄▄▄▄▄▄▄',
+    'data    980 22.0 ▄▄▄▄▄▄▄▄▄▄',
     '```',
     footer('delta-channel', 'https://github.com/x/y/actions/runs/1'),
   ]);
   assert.ok(widestCodeLine(text) <= PHONE_WIDTH, 'the table fits a phone');
 });
 
+test('a turn of ten seconds or more keeps a space before it', () => {
+  const { text } = buildReport(run({ delta: { turn: 10500 } }), base);
+  assert.match(text, /^turn   1\.60 10\.5 /m);
+});
+
 test('the thread shows each metric as the threads grow, with the gain at every row', () => {
   const { thread } = buildReport(run(), base);
   assert.match(thread[0], /^\*As the thread grows\*$/m);
+  assert.match(thread[0], /^turn s\nturn\s+base\s+delta\s+gain\n350\s+0\.40\s+0\.35\s+same$/m, 'a whole turn gains less than its write');
   assert.match(thread[0], /^write s\nturn\s+base\s+delta\s+gain\n350\s+0\.08\s+0\.01\s+5\.2x$/m);
+  assert.match(thread[0], /^data MB$/m);
   assert.match(thread[0], /^1400\s+0\.11\s+0\.10\s+same$/m, 'read within 15% is a tie');
   assert.match(thread[0], /^1400\s+980\s+22\.0\s+45x$/m);
   assert.doesNotMatch(thread[0], /^1350/m, 'rows are every 350 turns only');
@@ -120,15 +130,16 @@ test('history keeps only nights measured with this design, newest first', () =>
   write('100', { design: DESIGN, cells: { control: { tag: 'older' } } });
   write('300', { design: DESIGN, cells: { control: { tag: 'newer' } } });
   write('200', { cells: { control: { tag: 'one job per cell' } } });
+  write('250', { design: 'paired-messages', cells: { control: { tag: 'median write' } } });
   assert.deepEqual(loadDeltaHistory(dir).map((night) => night.control.tag), ['newer', 'older']);
 });
 
-test('without storage readings the MB row is left out and the post says why', () => {
+test('without storage readings the data row is left out and the post says why', () => {
   const r = run();
   for (const c of r.cells) for (const b of Object.values(c.buckets)) b.bytes = null;
   const { text } = buildReport(r, base);
-  assert.doesNotMatch(text, /^MB/m);
-  assert.match(text, /^_No MB row: the deployment runs an API without `GET \/threads\/\{id\}\/storage` yet\._$/m);
+  assert.doesNotMatch(text, /^data/m);
+  assert.match(text, /^_No data row: the deployment runs an API without `GET \/threads\/\{id\}\/storage` yet\._$/m);
 });
 
 test('a run with no results is red and says why', () => {
@@ -156,8 +167,8 @@ test('storage missing at the compared turn shows as a dash, not as an API withou
   const r = run();
   for (const c of r.cells) c.buckets['1351-1400'].bytes = null;
   const { text } = buildReport(r, base);
-  assert.match(text, /^MB\s+-\s+- /m);
-  assert.doesNotMatch(text, /No MB row/);
+  assert.match(text, /^data\s+-\s+- /m);
+  assert.doesNotMatch(text, /No data row/);
 });
 
 test('gain says how many times better delta is, and a tie as same', () => {
@@ -171,7 +182,7 @@ test('gain says how many times better delta is, and a tie as same', () => {
 test('growth tables skip a metric no row measured', () => {
   const r = run();
   for (const c of r.cells) for (const b of Object.values(c.buckets)) b.bytes = null;
-  assert.equal(growthTables(r.cells).length, 2);
+  assert.equal(growthTables(r.cells).length, 3);
 });
 
 test('a single downloaded artifact is read from the results directory itself', async () => {
@@ -181,5 +192,5 @@ test('a single downloaded artifact is read from the results directory itself', a
   writeFileSync(path.join(dir, 'raw_data_1.json'), `${JSON.stringify(sample)}\n`);
   const run = await collectRun(dir);
   assert.equal(run.stepOutcome, 'success');
-  assert.equal(run.cells.find((c) => c.cell === 'delta_50').buckets['1-50'].saveMs, 30);
+  assert.equal(run.cells.find((c) => c.cell === 'delta_50').buckets['1-50'].saveMeanMs, 30);
 });

{langgraph_api-0.17.0.dev5 → langgraph_api-0.17.0rc2}/constraints.txt

@@ -9,7 +9,7 @@ langsmith>=0.7.31
 orjson>=3.9.7
 httpx>=0.25.0
 tenacity>=8.0.0
-uvicorn>=0.26.0
+uvicorn>=0.29.0
 sse-starlette>=2.1.3,<4.0.0
 uvloop>=0.18.0
 httptools>=0.5.0

langgraph_api-0.17.0rc2/langgraph_api/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.17.0rc2"

{langgraph_api-0.17.0.dev5 → langgraph_api-0.17.0rc2}/langgraph_api/api/event_streaming.py

@@ -28,6 +28,7 @@ from uuid import uuid4
 
 import orjson
 import structlog
+from starlette.exceptions import HTTPException
 from starlette.responses import Response
 from starlette.websockets import WebSocketDisconnect
 
@@ -38,8 +39,11 @@ from langgraph_api.feature_flags import IS_POSTGRES_OR_GRPC_BACKEND
 from langgraph_api.route import ApiRoute, ApiWebSocketRoute
 from langgraph_api.serde import json_dumpb
 from langgraph_api.sse import EventSourceResponse
+from langgraph_api.utils import validate_uuid
 
 if TYPE_CHECKING:
+    from collections.abc import Mapping
+
     from starlette.requests import Request
     from starlette.websockets import WebSocket
 
@@ -91,7 +95,12 @@ def _json_response(content: Any, *, status_code: int = 200) -> Response:
     )
 
 
-def _make_manager(thread_id: str, send_event: Any = None) -> ThreadRunManager:
+def _make_manager(
+    thread_id: str,
+    send_event: Any = None,
+    *,
+    headers: Mapping[str, str] | None = None,
+) -> ThreadRunManager:
     # Auth context is propagated via ``ApiRoute``'s ``with_user`` wrapper
     # — ops reads it off the context var, so we don't thread it through
     # the manager explicitly.
@@ -100,6 +109,7 @@ def _make_manager(thread_id: str, send_event: Any = None) -> ThreadRunManager:
         runs=Runs,
         threads=Threads,
         send_event=send_event,
+        headers=headers,
     )
 
 
@@ -135,8 +145,12 @@ async def _thread_events(request: Request) -> Response:
         If reading the thread's event stream fails, the server ends the
         stream with a final ``event: error`` frame carrying a protocol error
         (``"type": "error"``, ``"id": null``, ``"error": "unknown_error"``).
+
+        A thread the caller isn't allowed to read returns 403 or 404 before
+        the stream starts, and a malformed thread ID returns 422.
     """
     thread_id = request.path_params["thread_id"]
+    thread_uuid = validate_uuid(thread_id, "Invalid thread ID: must be a UUID")
     try:
         body = orjson.loads(await request.body())
     except Exception:
@@ -209,6 +223,10 @@ async def _thread_events(request: Request) -> Response:
         else None
     )
 
+    # Checked here, before the 200, because clients retry a 200 that ends in
+    # an error instead of giving up.
+    auth_filters = await Threads.Stream.check_thread_stream_auth(thread_uuid)
+
     # Bounded LRU dedup: ``recent_eids`` is the eviction order, ``delivered``
     # is the O(1) membership view. When the deque hits its cap, the oldest
     # entry rolls off; we mirror that on ``delivered`` to keep them in sync.
@@ -256,7 +274,7 @@ async def _thread_events(request: Request) -> Response:
     # outbound events; the thread-level reader always replays from the
     # beginning so namespace-scoped projections see history. See
     # ``ThreadRunManager.start_thread_stream`` for the rationale.
-    manager.start_thread_stream()
+    manager.start_thread_stream(auth_filters=auth_filters)
 
     async def body_iter():
         try:
@@ -353,7 +371,7 @@ async def _thread_command(request: Request) -> Response:
             status_code=400,
         )
 
-    manager = _make_manager(thread_id)
+    manager = _make_manager(thread_id, headers=request.headers)
     try:
         resp = await manager.handle_command(payload)
         return _json_response(resp)
@@ -369,20 +387,51 @@ async def _thread_command(request: Request) -> Response:
 # ---------------------------------------------------------------------------
 
 
+async def _close_for_failed_access_check(websocket: WebSocket, exc: Exception) -> None:
+    if isinstance(exc, HTTPException) and exc.status_code < 500:
+        await websocket.close(code=4000 + exc.status_code)
+        return
+    logger.exception("Thread stream access check failed")
+    await websocket.send_text(_THREAD_STREAM_FAILED_DATA.decode())
+    await websocket.close(code=1011, reason="thread stream ended")
+
+
 async def _thread_websocket(websocket: WebSocket) -> None:
     """Full-duplex protocol connection scoped to a thread.
 
     Supports ``run.start``, ``input.respond``, ``subscription.subscribe``,
     ``subscription.unsubscribe``, ``agent.getTree``.
+
+    A 4xx from the thread's access check closes the socket with 4000 plus the
+    status (4403, 4422). A 404 can be a thread the client minted and has yet
+    to create, so the socket then waits for a ``run.start``, which checks
+    access like any run start, and closes with 4404 if another command comes
+    first. Any other failure of the check, a 5xx included, gets the stream
+    error frame and a 1011 close, as when the stream fails later.
     """
     thread_id = websocket.path_params["thread_id"]
+    # Browsers report a refused upgrade only as a 1006 close, so accept first
+    # to make the close code readable.
     await websocket.accept()
+    try:
+        thread_uuid = validate_uuid(thread_id, "Invalid thread ID: must be a UUID")
+    except HTTPException as exc:
+        await _close_for_failed_access_check(websocket, exc)
+        return
+    awaiting_thread = False
+    auth_filters: Any = None
+    try:
+        auth_filters = await Threads.Stream.check_thread_stream_auth(thread_uuid)
+    except Exception as exc:
+        if not (isinstance(exc, HTTPException) and exc.status_code == 404):
+            await _close_for_failed_access_check(websocket, exc)
+            return
+        awaiting_thread = True
 
     async def ws_send_event(event: dict[str, Any]) -> None:
         await websocket.send_text(orjson.dumps(event).decode("utf-8"))
 
     manager = _make_manager(thread_id, send_event=ws_send_event)
-    manager.start_thread_stream()
 
     # Watchdog: when the thread-stream consumer stops, send the error frame
     # (if it wasn't cancelled) and close the socket, instead of leaving the
@@ -397,7 +446,11 @@ async def _thread_websocket(websocket: WebSocket) -> None:
         with contextlib.suppress(Exception):
             await websocket.close(code=1011, reason="thread stream ended")
 
-    watchdog = asyncio.create_task(_stream_watchdog())
+    def start_stream(filters: Any) -> asyncio.Task[None]:
+        manager.start_thread_stream(auth_filters=filters)
+        return asyncio.create_task(_stream_watchdog())
+
+    watchdog = None if awaiting_thread else start_stream(auth_filters)
 
     try:
         while True:
@@ -430,16 +483,30 @@ async def _thread_websocket(websocket: WebSocket) -> None:
                 )
                 continue
 
+            if awaiting_thread and payload["method"] != "run.start":
+                await websocket.close(code=4404)
+                return
             response = await manager.handle_command(payload)
             await websocket.send_text(orjson.dumps(response).decode("utf-8"))
+            if awaiting_thread and response.get("type") == "success":
+                try:
+                    auth_filters = await Threads.Stream.check_thread_stream_auth(
+                        thread_uuid
+                    )
+                except Exception as exc:
+                    await _close_for_failed_access_check(websocket, exc)
+                    return
+                watchdog = start_stream(auth_filters)
+                awaiting_thread = False
     except WebSocketDisconnect:
         pass
     except Exception:
         logger.exception("Protocol WebSocket error")
     finally:
-        watchdog.cancel()
-        with contextlib.suppress(asyncio.CancelledError, Exception):
-            await watchdog
+        if watchdog is not None:
+            watchdog.cancel()
+            with contextlib.suppress(asyncio.CancelledError, Exception):
+                await watchdog
         await manager.close()
 
 

{langgraph_api-0.17.0.dev5 → langgraph_api-0.17.0rc2}/langgraph_api/api/threads.py

@@ -96,6 +96,16 @@ async def create_thread(
     return ApiResponse(thread)
 
 
+def _exclude_metadata_kwargs(payload: dict) -> dict:
+    """Normalize `exclude_metadata` (object or list of objects) into ops kwargs."""
+    exclude_metadata = payload.get("exclude_metadata")
+    if exclude_metadata is None:
+        return {}
+    if isinstance(exclude_metadata, dict):
+        exclude_metadata = [exclude_metadata]
+    return {"exclude_metadata": exclude_metadata}
+
+
 @retry_db
 async def search_threads(
     request: ApiRequest,
@@ -133,6 +143,7 @@ async def search_threads(
     # it would extract from ciphertext (wrong) and we'll redo it anyway.
     storage_extract = None if needs_python_extract else extract
 
+    exclude_kwargs = _exclude_metadata_kwargs(payload)
     async with connect() as conn:
         threads_iter, next_offset = await Threads.search(
             conn,
@@ -146,6 +157,7 @@ async def search_threads(
             sort_order=payload.get("sort_order"),
             select=storage_select,
             extract=storage_extract,
+            **exclude_kwargs,
         )
     threads, response_headers = await get_pagination_headers(
         threads_iter, next_offset, offset
@@ -180,6 +192,7 @@ async def count_threads(
             status=payload.get("status"),
             values=payload.get("values"),
             metadata=payload.get("metadata"),
+            **_exclude_metadata_kwargs(payload),
         )
     return ApiResponse(count)
 

{langgraph_api-0.17.0.dev5 → langgraph_api-0.17.0rc2}/langgraph_api/asyncio.py

@@ -1,11 +1,17 @@
 import asyncio
 import concurrent.futures
-from collections.abc import AsyncIterator, Coroutine
-from contextlib import AbstractAsyncContextManager, asynccontextmanager, suppress
+from collections.abc import AsyncIterator, Coroutine, Generator
+from contextlib import (
+    AbstractAsyncContextManager,
+    asynccontextmanager,
+    contextmanager,
+    suppress,
+)
 from functools import partial
 from typing import Any, Generic, TypeVar
 
 import structlog
+import uvicorn
 
 T = TypeVar("T")
 
@@ -343,3 +349,24 @@ class AsyncQueue(Generic[T], asyncio.Queue[T]):
                     # the call.  Wake up the next in line.
                     self._wakeup_next(self._getters)
                 raise
+
+
+class NoSignalServer(uvicorn.Server):
+    """uvicorn server that leaves the process signal handlers alone.
+
+    uvicorn's own SIGTERM handler exits on the first signal, which would
+    short-circuit the queue's graceful shutdown. This server runs until the
+    task awaiting ``serve()`` is cancelled.
+    """
+
+    @contextmanager
+    def capture_signals(self) -> Generator[None, None, None]:
+        yield
+
+    async def serve(self, sockets: list | None = None) -> None:
+        try:
+            await super().serve(sockets)
+        except asyncio.CancelledError:
+            if self.started:
+                await self.shutdown(sockets)
+            raise