langgraph-api 0.18.0.dev2__tar.gz → 0.18.0.dev4__tar.gz

{langgraph_api-0.18.0.dev2 → langgraph_api-0.18.0.dev4}/Makefile

@@ -67,6 +67,7 @@ START_TARGET ?= start-license-oss
 TEST_TARGET ?= test-license-oss
 SERVER_HEALTH_URL ?= http://127.0.0.1:9123/ok
 SERVER_START_TIMEOUT_SECS ?= 30
+SERVER_STOP_TIMEOUT_SECS ?= 10
 
 ifeq ($(LANGGRAPH_HTTP),fastapi)
 	HTTP_CONFIG := {"app": "./tests/graphs/my_router.py:app", "disable_mcp": false, "disable_a2a": false, "mount_prefix": "/my-cool/api"}
@@ -126,16 +127,25 @@ test-auth:
 	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_AUTH='{"path": "./tests/graphs/fastapi_jwt_auth.py:auth"}' REDIS_URI=_FAKE DATABASE_URI=:memory: MIGRATIONS_PATH=__inmem__ uv run pytest -v $(PYTEST_ROOT_ARGS) $(XDIST_ARGS) $(AUTH_TEST)
 
 test-with-server:
-	@bash -euo pipefail -c '$(MAKE) $(START_TARGET) LANGGRAPH_HTTP='\''$(LANGGRAPH_HTTP)'\'' & \
-	pid=$$!; \
+	@bash -euo pipefail -c 'set -m; \
+	$(MAKE) $(START_TARGET) LANGGRAPH_HTTP='\''$(LANGGRAPH_HTTP)'\'' & \
+	server_pgid=$$!; \
+	set +m; \
 	cleanup() { \
-		if [ -r /proc/$$pid/winpid ]; then \
-			taskkill //F //T //PID "$$(cat /proc/$$pid/winpid)" >/dev/null 2>&1 || true; \
-		else \
-			kill $$pid >/dev/null 2>&1 || true; \
+		if [ -r /proc/$$server_pgid/winpid ]; then \
+			taskkill //F //T //PID "$$(cat /proc/$$server_pgid/winpid)" >/dev/null 2>&1 || true; \
+			return 0; \
 		fi; \
+		kill -- -$$server_pgid 2>/dev/null || return 0; \
+		for i in $$(seq 1 $(SERVER_STOP_TIMEOUT_SECS)); do \
+			kill -0 -- -$$server_pgid 2>/dev/null || return 0; \
+			sleep 1; \
+		done; \
+		kill -KILL -- -$$server_pgid 2>/dev/null || true; \
 	}; \
 	trap cleanup EXIT; \
+	trap "exit 130" INT; \
+	trap "exit 143" TERM; \
 	for i in $$(seq 1 $(SERVER_START_TIMEOUT_SECS)); do \
 		if curl -sf "$(SERVER_HEALTH_URL)" >/dev/null; then \
 			break; \
@@ -373,26 +383,22 @@ start-test-a2a-tck-watch:
 		"$(MAKE) start" \
 		"sleep $(TCK_STARTUP_DELAY) && npx nodemon --watch langgraph_api/api/a2a.py --ext py --exec '$(MAKE) test-a2a-tck-must'"
 
-# MCP Conformance Test targets
-# Uses the official MCP conformance test suite (https://github.com/modelcontextprotocol/conformance)
-# Requires a running server: make start (in another terminal)
-
+MCP_CONFORMANCE := npx @modelcontextprotocol/conformance@0.2.0-alpha.12
 MCP_CONFORMANCE_URL ?= http://localhost:9123/mcp
-MCP_CONFORMANCE_SUITE ?= active
-MCP_CONFORMANCE_BASELINE ?= ../mcp-conformance-baseline.yml
-MCP_STARTUP_DELAY ?= 10
+MCP_CONFORMANCE_REVISIONS := 2025-11-25 2026-07-28
 
 test-mcp-conformance:
-	npx @modelcontextprotocol/conformance@0.1.13 server \
+	$(MAKE) -k $(addprefix test-mcp-conformance-,$(MCP_CONFORMANCE_REVISIONS))
+
+test-mcp-conformance-%:
+	$(MCP_CONFORMANCE) server \
 		--url $(MCP_CONFORMANCE_URL) \
-		--suite $(MCP_CONFORMANCE_SUITE) \
-		--expected-failures $(MCP_CONFORMANCE_BASELINE) \
+		--requirements $* \
+		--expected-failures ../mcp-conformance-baseline-$*.yml \
 		--verbose
 
 start-test-mcp-conformance:
-	npx concurrently -k -s first \
-		"$(MAKE) start" \
-		"sleep $(MCP_STARTUP_DELAY) && $(MAKE) test-mcp-conformance"
+	$(MAKE) test-with-server TEST_TARGET=test-mcp-conformance
 
 list-mcp-scenarios:
-	npx @modelcontextprotocol/conformance list --server
+	$(MCP_CONFORMANCE) list --server

{langgraph_api-0.18.0.dev2 → langgraph_api-0.18.0.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langgraph-api
-Version: 0.18.0.dev2
+Version: 0.18.0.dev4
 Author-email: Will Fu-Hinthorn <will@langchain.dev>, Josh Rogers <josh@langchain.dev>, Parker Rule <parker@langchain.dev>
 License: Elastic-2.0
 License-File: LICENSE

{langgraph_api-0.18.0.dev2 → langgraph_api-0.18.0.dev4}/benchmark/REPORTS.md

@@ -47,12 +47,12 @@ server version staging is on, which is the API version in the first line.
 |---|---|---|---|
 | `wait` | `wait_write` | start a run and wait for its result (`POST /runs/wait`): run execution and checkpointing | 1,000 |
 | `stream` | `stream_write` | start a run and read its event stream to the end (`POST /runs/stream`) | 1,000 |
-| `search` | `threads_search` | create two threads, set their metadata, then search for them by it: database and metadata search | 300 |
+| `search` | `threads_search_metadata` | create two threads, set their metadata, then search for them by it: database and metadata search | 300 |
 
 Tables use the one-word row names so they fit a phone; the lines above the
 table use the runner names.
 
-`threads_search` does not delete the threads it creates; the deployment's
+`threads_search_metadata` does not delete the threads it creates; the deployment's
 60-minute thread TTL removes them, so each night searches a table of about
 that run's threads, not a growing history.
 

langgraph_api-0.18.0.dev4/langgraph_api/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.18.0.dev4"

{langgraph_api-0.18.0.dev2 → langgraph_api-0.18.0.dev4}/langgraph_api/api/a2a.py

@@ -2090,6 +2090,19 @@ async def handle_message_send(
                     "message": "Invalid params: 'configuration' must be an object",
                 }
             }
+        for field in ("returnImmediately", "blocking"):
+            if configuration.get(field) is not None and not isinstance(
+                configuration[field], bool
+            ):
+                return {
+                    "error": {
+                        "code": ERROR_CODE_INVALID_PARAMS,
+                        "message": f"Invalid params: '{field}' must be a boolean",
+                    }
+                }
+        return_immediately = configuration.get("returnImmediately")
+        if return_immediately is None:
+            return_immediately = configuration.get("blocking") is False
         history_length = configuration.get("historyLength")
         if history_error := _validate_history_length(history_length):
             return {
@@ -2308,6 +2321,36 @@ async def handle_message_send(
         context_id = str(run["thread_id"])
         if task_id is None:
             task_id = _make_task_id(context_id, str(run["run_id"]))
+        if return_immediately:
+            immediate_task: dict[str, Any] = {
+                "kind": "task",
+                "id": task_id,
+                "contextId": context_id,
+                "status": {
+                    "state": _task_state_for_run(run),
+                    "timestamp": _run_timestamp(run),
+                },
+            }
+            if history_length is not None and history_length != 0:
+                run_messages = await _load_run_messages(
+                    context_id, str(run["run_id"]), request.headers
+                )
+                if not run_messages.messages:
+                    run_messages = RunMessages(input_content.get("messages", []), 0)
+                if task_start_id:
+                    task_ids_by_start_id.setdefault(task_start_id, task_id)
+                immediate_task["history"] = _convert_messages_to_a2a_format(
+                    run_messages.stamped(task_id),
+                    task_id,
+                    context_id,
+                    history_length=history_length,
+                    history_scope=history_scope,
+                    a2ui=a2ui,
+                    task_ids_by_start_id=task_ids_by_start_id,
+                )
+            return {"result": {"task": immediate_task}}
+
+        if existing_task_id is None:
             try:
                 runs = await _list_context_runs(
                     client, context_id=context_id, headers=request.headers
@@ -2489,6 +2532,48 @@ async def handle_tasks_get(
         lg_status = run_info.get("status", "unknown")
         a2a_state = task.state
 
+        if a2a_state in ("TASK_STATE_COMPLETED", "TASK_STATE_INPUT_REQUIRED"):
+            states, before = await asyncio.gather(
+                get_client().threads.get_history(
+                    context_id,
+                    limit=1,
+                    metadata={"run_id": str(run_info["run_id"])},
+                    headers=request.headers,
+                ),
+                _latest_messages(
+                    context_id,
+                    {"run_id": str(run_info["run_id"]), "source": "input"},
+                    request.headers,
+                ),
+            )
+            result = dict(states[0]["values"]) if states else {}
+            messages = result.get("messages", []) or []
+            run_messages = (
+                RunMessages.between(before, messages)
+                if before is not None
+                else RunMessages(messages, None)
+            )
+            if "messages" in result:
+                result["messages"] = run_messages.stamped(task_id)
+            if a2a_state == "TASK_STATE_INPUT_REQUIRED":
+                result["__interrupt__"] = (
+                    states[0].get("interrupts", []) if states else []
+                )
+            response = await _create_task_response(
+                task_id=task_id,
+                context_id=context_id,
+                result=result,
+                assistant_id=assistant_id,
+                a2ui=_a2ui_context_for_run(run_info),
+                history_length=history_length,
+                history_scope=history_scope,
+                task_ids_by_start_id=task.task_ids_by_start_id,
+                turn=run_messages.added,
+            )
+            task_response = response["result"]["task"]
+            task_response["status"]["timestamp"] = task.status_timestamp
+            return {"result": task_response}
+
         thread_history = []
         if history_length != 0:
             try:
@@ -2532,16 +2617,7 @@ async def handle_tasks_get(
         if history_length != 0:
             task_response["history"] = thread_history
 
-        # Add result message if completed
-        if a2a_state == "TASK_STATE_COMPLETED":
-            task_response["status"]["message"] = {
-                "kind": "message",
-                "role": "ROLE_AGENT",
-                "parts": [{"kind": "text", "text": "Task completed successfully"}],
-                "messageId": str(uuid.uuid4()),
-                "taskId": task_id,
-            }
-        elif a2a_state == "TASK_STATE_FAILED":
+        if a2a_state == "TASK_STATE_FAILED":
             task_response["status"]["message"] = {
                 "kind": "message",
                 "role": "ROLE_AGENT",
@@ -2554,6 +2630,13 @@ async def handle_tasks_get(
 
         return {"result": task_response}
 
+    except InvalidAgentResponseError as e:
+        return {
+            "error": {
+                "code": ERROR_CODE_INVALID_AGENT_RESPONSE,
+                "message": str(e),
+            }
+        }
     except Exception as e:
         await logger.aexception(
             f"Error in tasks/get for task {params.get('id')}: {e!s}", exc_info=True

{langgraph_api-0.18.0.dev2 → langgraph_api-0.18.0.dev4}/langgraph_api/api/event_streaming.py

@@ -28,6 +28,7 @@ from uuid import uuid4
 
 import orjson
 import structlog
+from starlette.exceptions import HTTPException
 from starlette.responses import Response
 from starlette.websockets import WebSocketDisconnect
 
@@ -38,8 +39,11 @@ from langgraph_api.feature_flags import IS_POSTGRES_OR_GRPC_BACKEND
 from langgraph_api.route import ApiRoute, ApiWebSocketRoute
 from langgraph_api.serde import json_dumpb
 from langgraph_api.sse import EventSourceResponse
+from langgraph_api.utils import validate_uuid
 
 if TYPE_CHECKING:
+    from collections.abc import Mapping
+
     from starlette.requests import Request
     from starlette.websockets import WebSocket
 
@@ -91,7 +95,13 @@ def _json_response(content: Any, *, status_code: int = 200) -> Response:
     )
 
 
-def _make_manager(thread_id: str, send_event: Any = None) -> ThreadRunManager:
+def _make_manager(
+    thread_id: str,
+    send_event: Any = None,
+    *,
+    headers: Mapping[str, str] | None = None,
+    replay_buffer: bool = True,
+) -> ThreadRunManager:
     # Auth context is propagated via ``ApiRoute``'s ``with_user`` wrapper
     # — ops reads it off the context var, so we don't thread it through
     # the manager explicitly.
@@ -100,6 +110,8 @@ def _make_manager(thread_id: str, send_event: Any = None) -> ThreadRunManager:
         runs=Runs,
         threads=Threads,
         send_event=send_event,
+        headers=headers,
+        replay_buffer=replay_buffer,
     )
 
 
@@ -135,8 +147,12 @@ async def _thread_events(request: Request) -> Response:
         If reading the thread's event stream fails, the server ends the
         stream with a final ``event: error`` frame carrying a protocol error
         (``"type": "error"``, ``"id": null``, ``"error": "unknown_error"``).
+
+        A thread the caller isn't allowed to read returns 403 or 404 before
+        the stream starts, and a malformed thread ID returns 422.
     """
     thread_id = request.path_params["thread_id"]
+    thread_uuid = validate_uuid(thread_id, "Invalid thread ID: must be a UUID")
     try:
         body = orjson.loads(await request.body())
     except Exception:
@@ -209,6 +225,10 @@ async def _thread_events(request: Request) -> Response:
         else None
     )
 
+    # Checked here, before the 200, because clients retry a 200 that ends in
+    # an error instead of giving up.
+    auth_filters = await Threads.Stream.check_thread_stream_auth(thread_uuid)
+
     # Bounded LRU dedup: ``recent_eids`` is the eviction order, ``delivered``
     # is the O(1) membership view. When the deque hits its cap, the oldest
     # entry rolls off; we mirror that on ``delivered`` to keep them in sync.
@@ -233,7 +253,10 @@ async def _thread_events(request: Request) -> Response:
         pending_events.append(event)
         flush_pending.set()
 
-    manager = _make_manager(thread_id, send_event=on_event)
+    # SSE never replays from the session's buffer: it has no subscribe or
+    # reconnect commands, and ``start_thread_stream`` replays from the
+    # thread's event stream.
+    manager = _make_manager(thread_id, send_event=on_event, replay_buffer=False)
 
     filter_sub = Subscription(
         id=str(uuid4()),
@@ -256,7 +279,7 @@ async def _thread_events(request: Request) -> Response:
     # outbound events; the thread-level reader always replays from the
     # beginning so namespace-scoped projections see history. See
     # ``ThreadRunManager.start_thread_stream`` for the rationale.
-    manager.start_thread_stream()
+    manager.start_thread_stream(auth_filters=auth_filters)
 
     async def body_iter():
         try:
@@ -353,7 +376,7 @@ async def _thread_command(request: Request) -> Response:
             status_code=400,
         )
 
-    manager = _make_manager(thread_id)
+    manager = _make_manager(thread_id, headers=request.headers)
     try:
         resp = await manager.handle_command(payload)
         return _json_response(resp)
@@ -369,20 +392,51 @@ async def _thread_command(request: Request) -> Response:
 # ---------------------------------------------------------------------------
 
 
+async def _close_for_failed_access_check(websocket: WebSocket, exc: Exception) -> None:
+    if isinstance(exc, HTTPException) and exc.status_code < 500:
+        await websocket.close(code=4000 + exc.status_code)
+        return
+    logger.exception("Thread stream access check failed")
+    await websocket.send_text(_THREAD_STREAM_FAILED_DATA.decode())
+    await websocket.close(code=1011, reason="thread stream ended")
+
+
 async def _thread_websocket(websocket: WebSocket) -> None:
     """Full-duplex protocol connection scoped to a thread.
 
     Supports ``run.start``, ``input.respond``, ``subscription.subscribe``,
     ``subscription.unsubscribe``, ``agent.getTree``.
+
+    A 4xx from the thread's access check closes the socket with 4000 plus the
+    status (4403, 4422). A 404 can be a thread the client minted and has yet
+    to create, so the socket then waits for a ``run.start``, which checks
+    access like any run start, and closes with 4404 if another command comes
+    first. Any other failure of the check, a 5xx included, gets the stream
+    error frame and a 1011 close, as when the stream fails later.
     """
     thread_id = websocket.path_params["thread_id"]
+    # Browsers report a refused upgrade only as a 1006 close, so accept first
+    # to make the close code readable.
     await websocket.accept()
+    try:
+        thread_uuid = validate_uuid(thread_id, "Invalid thread ID: must be a UUID")
+    except HTTPException as exc:
+        await _close_for_failed_access_check(websocket, exc)
+        return
+    awaiting_thread = False
+    auth_filters: Any = None
+    try:
+        auth_filters = await Threads.Stream.check_thread_stream_auth(thread_uuid)
+    except Exception as exc:
+        if not (isinstance(exc, HTTPException) and exc.status_code == 404):
+            await _close_for_failed_access_check(websocket, exc)
+            return
+        awaiting_thread = True
 
     async def ws_send_event(event: dict[str, Any]) -> None:
         await websocket.send_text(orjson.dumps(event).decode("utf-8"))
 
     manager = _make_manager(thread_id, send_event=ws_send_event)
-    manager.start_thread_stream()
 
     # Watchdog: when the thread-stream consumer stops, send the error frame
     # (if it wasn't cancelled) and close the socket, instead of leaving the
@@ -397,7 +451,11 @@ async def _thread_websocket(websocket: WebSocket) -> None:
         with contextlib.suppress(Exception):
             await websocket.close(code=1011, reason="thread stream ended")
 
-    watchdog = asyncio.create_task(_stream_watchdog())
+    def start_stream(filters: Any) -> asyncio.Task[None]:
+        manager.start_thread_stream(auth_filters=filters)
+        return asyncio.create_task(_stream_watchdog())
+
+    watchdog = None if awaiting_thread else start_stream(auth_filters)
 
     try:
         while True:
@@ -430,16 +488,30 @@ async def _thread_websocket(websocket: WebSocket) -> None:
                 )
                 continue
 
+            if awaiting_thread and payload["method"] != "run.start":
+                await websocket.close(code=4404)
+                return
             response = await manager.handle_command(payload)
             await websocket.send_text(orjson.dumps(response).decode("utf-8"))
+            if awaiting_thread and response.get("type") == "success":
+                try:
+                    auth_filters = await Threads.Stream.check_thread_stream_auth(
+                        thread_uuid
+                    )
+                except Exception as exc:
+                    await _close_for_failed_access_check(websocket, exc)
+                    return
+                watchdog = start_stream(auth_filters)
+                awaiting_thread = False
     except WebSocketDisconnect:
         pass
     except Exception:
         logger.exception("Protocol WebSocket error")
     finally:
-        watchdog.cancel()
-        with contextlib.suppress(asyncio.CancelledError, Exception):
-            await watchdog
+        if watchdog is not None:
+            watchdog.cancel()
+            with contextlib.suppress(asyncio.CancelledError, Exception):
+                await watchdog
         await manager.close()
 
 

langgraph_api-0.18.0.dev4/langgraph_api/api/mcp/_calls.py

@@ -0,0 +1,29 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Any
+
+from langgraph_api.api.mcp._protocol import ProtocolError
+
+if TYPE_CHECKING:
+    from collections.abc import Mapping
+
+
+@dataclass(frozen=True, slots=True)
+class ToolCall:
+    name: str
+    arguments: dict[str, Any]
+    context: dict[str, Any] | None
+
+    @classmethod
+    def of(cls, params: Mapping[str, Any]) -> ToolCall:
+        name = params.get("name")
+        arguments = params.get("arguments", {})
+        context = params.get("context")
+        if not isinstance(name, str) or not name:
+            raise ProtocolError(f"Unknown tool: {name}")
+        if not isinstance(arguments, dict) or (
+            context is not None and not isinstance(context, dict)
+        ):
+            raise ProtocolError("arguments and context must be objects")
+        return cls(name, arguments, context)

langgraph_api-0.18.0.dev4/langgraph_api/api/mcp/_constants.py

@@ -0,0 +1,28 @@
+MAX_ASSISTANTS = 1000
+DEFAULT_PAGE_SIZE = 100
+MAX_PAGE_OFFSET = 2**63 - 1
+MAX_CURSOR_LENGTH = len(str(MAX_PAGE_OFFSET))
+
+ERROR_CODE_INVALID_REQUEST = -32600
+ERROR_CODE_INVALID_PARAMS = -32602
+ERROR_CODE_METHOD_NOT_FOUND = -32601
+ERROR_CODE_HEADER_MISMATCH = -32020
+ERROR_CODE_UNSUPPORTED_VERSION = -32022
+
+LEGACY_PROTOCOL_VERSIONS = frozenset(
+    (
+        "2024-11-05",
+        "2025-03-26",
+        "2025-06-18",
+        "2025-11-25",
+    )
+)
+LATEST_LEGACY_PROTOCOL_VERSION = "2025-11-25"
+PROTOCOL_VERSION = "2026-07-28"
+SUPPORTED_PROTOCOL_VERSIONS = LEGACY_PROTOCOL_VERSIONS | {PROTOCOL_VERSION}
+
+PAUSED_TOOL_MESSAGE = (
+    "This tool paused to ask for human input, and this client can't answer it."
+)
+RUN_FAILED_MESSAGE = "The tool's run failed."
+INVALID_CURSOR_MESSAGE = "Invalid cursor"