langgraph-cli 0.4.7__tar.gz → 0.4.8__tar.gz

{langgraph_cli-0.4.7 → langgraph_cli-0.4.8}/Makefile

@@ -1,4 +1,4 @@
-.PHONY: test lint format test-integration update-schema
+.PHONY: test lint format test-integration update-schema bump-version
 
 ######################
 # TESTING AND COVERAGE
@@ -35,3 +35,6 @@ format format_diff:
 
 update-schema:
 	uv run python generate_schema.py
+
+bump-version:
+	uv run hatch version patch

{langgraph_cli-0.4.7 → langgraph_cli-0.4.8}/PKG-INFO

@@ -1,8 +1,11 @@
 Metadata-Version: 2.4
 Name: langgraph-cli
-Version: 0.4.7
+Version: 0.4.8
 Summary: CLI for interacting with LangGraph API
-Project-URL: Repository, https://www.github.com/langchain-ai/langgraph
+Project-URL: Source, https://github.com/langchain-ai/langgraph/tree/main/libs/cli
+Project-URL: Twitter, https://x.com/LangChainAI
+Project-URL: Slack, https://www.langchain.com/join-community
+Project-URL: Reddit, https://www.reddit.com/r/LangChain/
 License-Expression: MIT
 License-File: LICENSE
 Requires-Python: >=3.10

{langgraph_cli-0.4.7 → langgraph_cli-0.4.8}/generate_schema.py

@@ -15,6 +15,7 @@ import msgspec
 
 from langgraph_cli.schemas import (
     AuthConfig,
+    CacheConfig,
     CheckpointerConfig,
     Config,
     ConfigurableHeaderConfig,
@@ -26,6 +27,8 @@ from langgraph_cli.schemas import (
     StoreConfig,
     ThreadTTLConfig,
     TTLConfig,
+    WebhooksConfig,
+    WebhookUrlPolicy,
 )
 
 
@@ -111,11 +114,14 @@ def add_descriptions_to_schema(schema, cls):
                 SecurityConfig,
                 HttpConfig,
                 CorsConfig,
+                CacheConfig,
                 ThreadTTLConfig,
                 CheckpointerConfig,
                 SerdeConfig,
                 TTLConfig,
                 ConfigurableHeaderConfig,
+                WebhooksConfig,
+                WebhookUrlPolicy,
             ]:
                 if potential_cls.__name__ == def_name:
                     add_descriptions_to_schema(def_schema, potential_cls)

langgraph_cli-0.4.8/langgraph_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.4.8"

{langgraph_cli-0.4.7 → langgraph_cli-0.4.8}/langgraph_cli/config.py

@@ -154,7 +154,10 @@ def validate_config(config: Config) -> Config:
         "env": config.get("env", {}),
         "store": config.get("store"),
         "auth": config.get("auth"),
+        "encryption": config.get("encryption"),
         "http": config.get("http"),
+        # Pass through webhooks config so it can be injected into the image
+        "webhooks": config.get("webhooks"),
         "checkpointer": config.get("checkpointer"),
         "ui": config.get("ui"),
         "ui_config": config.get("ui_config"),
@@ -228,6 +231,14 @@ def validate_config(config: Config) -> Config:
                     f"Invalid auth.path format: '{auth_conf['path']}'. "
                     "Must be in format './path/to/file.py:attribute_name'"
                 )
+    # Validate encryption config
+    if encryption_conf := config.get("encryption"):
+        if "path" in encryption_conf:
+            if ":" not in encryption_conf["path"]:
+                raise ValueError(
+                    f"Invalid encryption.path format: '{encryption_conf['path']}'. "
+                    "Must be in format './path/to/file.py:attribute_name'"
+                )
     if http_conf := config.get("http"):
         if "app" in http_conf:
             if ":" not in http_conf["app"]:
@@ -614,6 +625,49 @@ def _update_auth_path(
     )
 
 
+def _update_encryption_path(
+    config_path: pathlib.Path, config: Config, local_deps: LocalDeps
+) -> None:
+    """Update encryption.path to use Docker container paths."""
+    encryption_conf = config.get("encryption")
+    if not encryption_conf or not (path_str := encryption_conf.get("path")):
+        return
+
+    module_str, sep, attr_str = path_str.partition(":")
+    if not sep or not module_str.startswith("."):
+        return  # Already validated or absolute path
+
+    resolved = config_path.parent / module_str
+    if not resolved.exists():
+        raise FileNotFoundError(
+            f"Encryption file not found: {resolved} (from {path_str})"
+        )
+    if not resolved.is_file():
+        raise IsADirectoryError(f"Encryption path must be a file: {resolved}")
+
+    # Check faux packages first (higher priority)
+    for faux_path, (_, destpath) in local_deps.faux_pkgs.items():
+        if resolved.is_relative_to(faux_path):
+            new_path = f"{destpath}/{resolved.relative_to(faux_path)}:{attr_str}"
+            encryption_conf["path"] = new_path
+            return
+
+    # Check real packages
+    for real_path in local_deps.real_pkgs:
+        if resolved.is_relative_to(real_path):
+            new_path = (
+                f"/deps/{real_path.name}/{resolved.relative_to(real_path)}:{attr_str}"
+            )
+            encryption_conf["path"] = new_path
+            return
+
+    raise ValueError(
+        f"Encryption file '{resolved}' not covered by dependencies.\n"
+        "Add its parent directory to the 'dependencies' array in your config.\n"
+        f"Current dependencies: {config['dependencies']}"
+    )
+
+
 def _update_http_app_path(
     config_path: pathlib.Path, config: Config, local_deps: LocalDeps
 ) -> None:
@@ -809,6 +863,8 @@ def python_config_to_docker(
     _update_graph_paths(config_path, config, local_deps)
     # Rewrite auth path, so it points to the correct location in the Docker container
     _update_auth_path(config_path, config, local_deps)
+    # Rewrite encryption path, so it points to the correct location in the Docker container
+    _update_encryption_path(config_path, config, local_deps)
     # Rewrite HTTP app path, so it points to the correct location in the Docker container
     _update_http_app_path(config_path, config, local_deps)
 
@@ -899,9 +955,16 @@ ADD {relpath} /deps/{name}
     if (auth_config := config.get("auth")) is not None:
         env_vars.append(f"ENV LANGGRAPH_AUTH='{json.dumps(auth_config)}'")
 
+    if (encryption_config := config.get("encryption")) is not None:
+        env_vars.append(f"ENV LANGGRAPH_ENCRYPTION='{json.dumps(encryption_config)}'")
+
     if (http_config := config.get("http")) is not None:
         env_vars.append(f"ENV LANGGRAPH_HTTP='{json.dumps(http_config)}'")
 
+    # Inject webhooks configuration if provided
+    if (webhooks_config := config.get("webhooks")) is not None:
+        env_vars.append(f"ENV LANGGRAPH_WEBHOOKS='{json.dumps(webhooks_config)}'")
+
     if (checkpointer_config := config.get("checkpointer")) is not None:
         env_vars.append(
             f"ENV LANGGRAPH_CHECKPOINTER='{json.dumps(checkpointer_config)}'"
@@ -1022,9 +1085,16 @@ def node_config_to_docker(
     if (auth_config := config.get("auth")) is not None:
         env_vars.append(f"ENV LANGGRAPH_AUTH='{json.dumps(auth_config)}'")
 
+    if (encryption_config := config.get("encryption")) is not None:
+        env_vars.append(f"ENV LANGGRAPH_ENCRYPTION='{json.dumps(encryption_config)}'")
+
     if (http_config := config.get("http")) is not None:
         env_vars.append(f"ENV LANGGRAPH_HTTP='{json.dumps(http_config)}'")
 
+    # Inject webhooks configuration if provided
+    if (webhooks_config := config.get("webhooks")) is not None:
+        env_vars.append(f"ENV LANGGRAPH_WEBHOOKS='{json.dumps(webhooks_config)}'")
+
     if (checkpointer_config := config.get("checkpointer")) is not None:
         env_vars.append(
             f"ENV LANGGRAPH_CHECKPOINTER='{json.dumps(checkpointer_config)}'"

{langgraph_cli-0.4.7 → langgraph_cli-0.4.8}/langgraph_cli/schemas.py

@@ -233,6 +233,27 @@ class SecurityConfig(TypedDict, total=False):
     """
 
 
+class CacheConfig(TypedDict, total=False):
+    cache_keys: list[str]
+    """Optional. List of header keys to use for caching.
+    
+    Example:
+        ["user_id", "workspace_id"]
+    """
+    ttl_seconds: int
+    """Optional. Time-to-live in seconds for cached items.
+    
+    Example:
+        3600
+    """
+    max_size: int
+    """Optional. Maximum size of the cache.
+    
+    Example:
+        100
+    """
+
+
 class AuthConfig(TypedDict, total=False):
     """Configuration for custom authentication logic and how it integrates into the OpenAPI spec."""
 
@@ -269,6 +290,37 @@ class AuthConfig(TypedDict, total=False):
             ]
         }
     """
+    cache: CacheConfig
+    """Optional. Cache configuration for the server.
+    
+    Example:
+        {
+            "cache_keys": ["user_id", "workspace_id"],
+            "ttl_seconds": 3600,
+            "max_size": 100
+        }
+    """
+
+
+class EncryptionConfig(TypedDict, total=False):
+    """Configuration for custom at-rest encryption logic.
+
+    Allows you to implement custom encryption for sensitive data stored in the database,
+    including metadata fields and checkpoint blobs.
+    """
+
+    path: str
+    """Required. Path to an instance of the Encryption() class that implements custom encryption handlers.
+
+    Format: "path/to/file.py:my_encryption"
+
+    Example:
+        {
+            "encryption": {
+                "path": "./encryption.py:my_encryption"
+            }
+        }
+    """
 
 
 class CorsConfig(TypedDict, total=False):
@@ -310,7 +362,7 @@ class CorsConfig(TypedDict, total=False):
     """
 
 
-class ConfigurableHeaderConfig(TypedDict):
+class ConfigurableHeaderConfig(TypedDict, total=False):
     """Customize which headers to include as configurable values in your runs.
 
     By default, omits x-api-key, x-tenant-id, and x-service-key.
@@ -321,7 +373,7 @@ class ConfigurableHeaderConfig(TypedDict):
     """
 
     includes: list[str] | None
-    """Headers to include (if not also matches against an 'exludes' pattern.
+    """Headers to include (if not also matched against an 'excludes' pattern).
 
     Examples:
         - 'user-agent'
@@ -367,7 +419,12 @@ class HttpConfig(TypedDict, total=False):
     Default is False.
     """
     disable_mcp: bool
-    """Optional. If `True`, /mcp routes are removed, disabling the MCP server.
+    """Optional. If `True`, /mcp routes are removed, disabling default support to expose the deployment as an MCP server.
+    
+    Default is False.
+    """
+    disable_a2a: bool
+    """Optional. If `True`, /a2a routes are removed, disabling default support to expose the deployment as an agent-to-agent (A2A) server.
     
     Default is False.
     """
@@ -377,6 +434,17 @@ class HttpConfig(TypedDict, total=False):
     Set to True to disable the following endpoints: /openapi.json, /info, /metrics, /docs.
     This will also make the /ok endpoint skip any DB or other checks, always returning {"ok": True}.
     
+    Default is False.
+    """
+    disable_ui: bool
+    """Optional. If `True`, /ui routes are removed, disabling the UI server.
+    
+    Default is False.
+    """
+    disable_webhooks: bool
+    """Optional. If `True`, webhooks are disabled. Runs created with an associated webhook will
+    still be executed, but the webhook event will not be sent.
+    
     Default is False.
     """
     cors: CorsConfig | None
@@ -409,6 +477,52 @@ class HttpConfig(TypedDict, total=False):
     Default is False. This flag only affects authentication behavior
     if `app` is provided and contains custom routes.
     """
+    mount_prefix: str
+    """Optional. URL prefix to prepend to all the routes.
+    
+    Example:
+        "/api"
+    """
+
+
+class WebhookUrlPolicy(TypedDict, total=False):
+    require_https: bool
+    """Enforce HTTPS scheme for absolute URLs; reject `http://` when true."""
+    allowed_domains: list[str]
+    """Hostname allowlist. Supports exact hosts and wildcard subdomains.
+
+    Use entries like "hooks.example.com" or "*.mycorp.com". The wildcard only
+    matches subdomains ("foo.mycorp.com"), not the apex ("mycorp.com"). When
+    empty or omitted, any public host is allowed (subject to SSRF IP checks).
+    """
+    allowed_ports: list[int]
+    """Explicit port allowlist for absolute URLs.
+
+    If set, requests must use one of these ports. Defaults are respected when
+    a port is not present in the URL (443 for https, 80 for http).
+    """
+    max_url_length: int
+    """Maximum permitted URL length in characters; longer inputs are rejected early."""
+    disable_loopback: bool
+    """Disallow relative URLs (internal loopback calls) when true."""
+
+
+class WebhooksConfig(TypedDict, total=False):
+    env_prefix: str
+    """Required prefix for environment variables referenced in header templates.
+
+    Acts as an allowlist boundary to prevent leaking arbitrary environment
+    variables. Defaults to "LG_WEBHOOK_" when omitted.
+    """
+    url: WebhookUrlPolicy
+    """URL validation policy for user-supplied webhook endpoints."""
+    headers: dict[str, str]
+    """Static headers to include with webhook requests.
+
+    Values may contain templates of the form "${{ env.VAR }}". On startup, these
+    are resolved via the process environment after verifying `VAR` starts with
+    `env_prefix`. Mixed literals and multiple templates are allowed.
+    """
 
 
 class Config(TypedDict, total=False):
@@ -524,15 +638,28 @@ class Config(TypedDict, total=False):
     """
 
     auth: AuthConfig | None
-    """Optional. Custom authentication config, including the path to your Python auth logic and 
+    """Optional. Custom authentication config, including the path to your Python auth logic and
     the OpenAPI security definitions it uses.
     """
 
+    encryption: EncryptionConfig | None
+    """Optional. Custom at-rest encryption config, including the path to your Python encryption logic.
+
+    Allows you to implement custom encryption for sensitive data stored in the database.
+    """
+
     http: HttpConfig | None
     """Optional. Configuration for the built-in HTTP server, controlling which custom routes are exposed
     and how cross-origin requests are handled.
     """
 
+    webhooks: WebhooksConfig | None
+    """Optional. Webhooks configuration for outbound event delivery.
+
+    Forwarded into the container as `LANGGRAPH_WEBHOOKS`. See `WebhooksConfig`
+    for URL policy and header templating details.
+    """
+
     ui: dict[str, str] | None
     """Optional. Named definitions of UI components emitted by the agent, each pointing to a JS/TS file.
     """
@@ -550,6 +677,7 @@ __all__ = [
     "StoreConfig",
     "CheckpointerConfig",
     "AuthConfig",
+    "EncryptionConfig",
     "HttpConfig",
     "MiddlewareOrders",
     "Distros",

{langgraph_cli-0.4.7 → langgraph_cli-0.4.8}/pyproject.toml

@@ -25,7 +25,10 @@ inmem = [
 ]
 
 [project.urls]
-Repository = "https://www.github.com/langchain-ai/langgraph"
+Source = "https://github.com/langchain-ai/langgraph/tree/main/libs/cli"
+Twitter = "https://x.com/LangChainAI"
+Slack = "https://www.langchain.com/join-community"
+Reddit = "https://www.reddit.com/r/LangChain/"
 
 [project.scripts]
 langgraph = "langgraph_cli.cli:cli"

{langgraph_cli-0.4.7 → langgraph_cli-0.4.8}/schemas/schema.json

@@ -99,6 +99,17 @@
               },
               "description": "Optional. Additional Docker instructions that will be appended to your base Dockerfile.\n\nUseful for installing OS packages, setting environment variables, etc."
             },
+            "encryption": {
+              "anyOf": [
+                {
+                  "$ref": "#/$defs/EncryptionConfig"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Optional. Custom at-rest encryption config, including the path to your Python encryption logic.\n\nAllows you to implement custom encryption for sensitive data stored in the database.\n"
+            },
             "env": {
               "anyOf": [
                 {
@@ -199,6 +210,17 @@
                 }
               ],
               "description": "Optional. Named definitions of UI components emitted by the agent, each pointing to a JS/TS file.\n"
+            },
+            "webhooks": {
+              "anyOf": [
+                {
+                  "$ref": "#/$defs/WebhooksConfig"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Optional. Webhooks configuration for outbound event delivery.\n\nForwarded into the container as `LANGGRAPH_WEBHOOKS`. See `WebhooksConfig`\nfor URL policy and header templating details.\n"
             }
           },
           "required": [
@@ -292,6 +314,17 @@
               },
               "description": "Optional. Additional Docker instructions that will be appended to your base Dockerfile.\n\nUseful for installing OS packages, setting environment variables, etc."
             },
+            "encryption": {
+              "anyOf": [
+                {
+                  "$ref": "#/$defs/EncryptionConfig"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Optional. Custom at-rest encryption config, including the path to your Python encryption logic.\n\nAllows you to implement custom encryption for sensitive data stored in the database.\n"
+            },
             "env": {
               "anyOf": [
                 {
@@ -391,6 +424,17 @@
                 }
               ],
               "description": "Optional. Named definitions of UI components emitted by the agent, each pointing to a JS/TS file.\n"
+            },
+            "webhooks": {
+              "anyOf": [
+                {
+                  "$ref": "#/$defs/WebhooksConfig"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Optional. Webhooks configuration for outbound event delivery.\n\nForwarded into the container as `LANGGRAPH_WEBHOOKS`. See `WebhooksConfig`\nfor URL policy and header templating details.\n"
             }
           },
           "required": [
@@ -405,6 +449,10 @@
       "description": "Configuration for custom authentication logic and how it integrates into the OpenAPI spec.",
       "type": "object",
       "properties": {
+        "cache": {
+          "$ref": "#/$defs/CacheConfig",
+          "description": "Optional. Cache configuration for the server.\n"
+        },
         "disable_studio_auth": {
           "type": "boolean",
           "description": "Optional. Whether to disable LangSmith API-key authentication for requests originating the Studio.\n\nDefaults to False, meaning that if a particular header is set, the server will verify the `x-api-key` header\nvalue is a valid API key for the deployment's workspace. If `True`, all requests will go through your custom\nauthentication logic, regardless of origin of the request.\n"
@@ -420,6 +468,29 @@
       },
       "required": []
     },
+    "CacheConfig": {
+      "title": "CacheConfig",
+      "type": "object",
+      "properties": {
+        "cache_keys": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Optional. List of header keys to use for caching.\n"
+        },
+        "max_size": {
+          "type": "integer",
+          "description": "Optional. Maximum size of the cache.\n"
+        },
+        "ttl_seconds": {
+          "type": "integer",
+          "description": "Optional. Time-to-live in seconds for cached items.\n"
+        }
+      },
+      "required": [],
+      "description": "dict() -> new empty dictionary\ndict(mapping) -> new dictionary initialized from a mapping object's\n    (key, value) pairs\ndict(iterable) -> new dictionary initialized as if via:\n    d = {}\n    for k, v in iterable:\n        d[k] = v\ndict(**kwargs) -> new dictionary initialized with the name=value pairs\n    in the keyword argument list.  For example:  dict(one=1, two=2)"
+    },
     "SecurityConfig": {
       "title": "SecurityConfig",
       "description": "Configuration for OpenAPI security definitions and requirements.\n\nUseful for specifying global or path-level authentication and authorization flows\n(e.g., OAuth2, API key headers, etc.).",
@@ -565,6 +636,17 @@
       },
       "required": []
     },
+    "EncryptionConfig": {
+      "title": "EncryptionConfig",
+      "description": "Configuration for custom at-rest encryption logic.\n\nAllows you to implement custom encryption for sensitive data stored in the database,\nincluding metadata fields and checkpoint blobs.",
+      "type": "object",
+      "properties": {
+        "path": {
+          "type": "string"
+        }
+      },
+      "required": []
+    },
     "HttpConfig": {
       "title": "HttpConfig",
       "description": "Configuration for the built-in HTTP server that powers your deployment's routes and endpoints.",
@@ -596,13 +678,17 @@
           ],
           "description": "Optional. Defines CORS restrictions. If omitted, no special rules are set and\ncross-origin behavior depends on default server settings.\n"
         },
+        "disable_a2a": {
+          "type": "boolean",
+          "description": "Optional. If `True`, /a2a routes are removed, disabling default support to expose the deployment as an agent-to-agent (A2A) server.\n\nDefault is False.\n"
+        },
         "disable_assistants": {
           "type": "boolean",
           "description": "Optional. If `True`, /assistants routes are removed from the server.\n\nDefault is False (meaning /assistants is enabled).\n"
         },
         "disable_mcp": {
           "type": "boolean",
-          "description": "Optional. If `True`, /mcp routes are removed, disabling the MCP server.\n\nDefault is False.\n"
+          "description": "Optional. If `True`, /mcp routes are removed, disabling default support to expose the deployment as an MCP server.\n\nDefault is False.\n"
         },
         "disable_meta": {
           "type": "boolean",
@@ -620,6 +706,14 @@
           "type": "boolean",
           "description": "Optional. If `True`, /threads routes are removed.\n\nDefault is False.\n"
         },
+        "disable_ui": {
+          "type": "boolean",
+          "description": "Optional. If `True`, /ui routes are removed, disabling the UI server.\n\nDefault is False.\n"
+        },
+        "disable_webhooks": {
+          "type": "boolean",
+          "description": "Optional. If `True`, webhooks are disabled. Runs created with an associated webhook will\nstill be executed, but the webhook event will not be sent.\n\nDefault is False.\n"
+        },
         "enable_custom_route_auth": {
           "type": "boolean",
           "description": "Optional. If `True`, authentication is enabled for custom routes,\nnot just the routes that are protected by default.\n(Routes protected by default include /assistants, /threads, and /runs).\n\nDefault is False. This flag only affects authentication behavior\nif `app` is provided and contains custom routes.\n"
@@ -648,6 +742,10 @@
             }
           ],
           "description": "Optional. Defines the order in which to apply server customizations.\n"
+        },
+        "mount_prefix": {
+          "type": "string",
+          "description": "Optional. URL prefix to prepend to all the routes.\n"
         }
       },
       "required": []
@@ -683,13 +781,10 @@
               "type": "null"
             }
           ],
-          "description": "Headers to include (if not also matches against an 'exludes' pattern.\n"
+          "description": "Headers to include (if not also matched against an 'excludes' pattern).\n"
         }
       },
-      "required": [
-        "excludes",
-        "includes"
-      ]
+      "required": []
     },
     "CorsConfig": {
       "title": "CorsConfig",
@@ -832,6 +927,63 @@
         }
       },
       "required": []
+    },
+    "WebhooksConfig": {
+      "title": "WebhooksConfig",
+      "type": "object",
+      "properties": {
+        "env_prefix": {
+          "type": "string",
+          "description": "Required prefix for environment variables referenced in header templates.\n\nActs as an allowlist boundary to prevent leaking arbitrary environment\nvariables. Defaults to \"LG_WEBHOOK_\" when omitted.\n"
+        },
+        "headers": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Static headers to include with webhook requests.\n\nValues may contain templates of the form \"${{ env.VAR }}\". On startup, these\nare resolved via the process environment after verifying `VAR` starts with\n`env_prefix`. Mixed literals and multiple templates are allowed.\n"
+        },
+        "url": {
+          "$ref": "#/$defs/WebhookUrlPolicy",
+          "description": "URL validation policy for user-supplied webhook endpoints."
+        }
+      },
+      "required": [],
+      "description": "dict() -> new empty dictionary\ndict(mapping) -> new dictionary initialized from a mapping object's\n    (key, value) pairs\ndict(iterable) -> new dictionary initialized as if via:\n    d = {}\n    for k, v in iterable:\n        d[k] = v\ndict(**kwargs) -> new dictionary initialized with the name=value pairs\n    in the keyword argument list.  For example:  dict(one=1, two=2)"
+    },
+    "WebhookUrlPolicy": {
+      "title": "WebhookUrlPolicy",
+      "type": "object",
+      "properties": {
+        "allowed_domains": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Hostname allowlist. Supports exact hosts and wildcard subdomains.\n\nUse entries like \"hooks.example.com\" or \"*.mycorp.com\". The wildcard only\nmatches subdomains (\"foo.mycorp.com\"), not the apex (\"mycorp.com\"). When\nempty or omitted, any public host is allowed (subject to SSRF IP checks).\n"
+        },
+        "allowed_ports": {
+          "type": "array",
+          "items": {
+            "type": "integer"
+          },
+          "description": "Explicit port allowlist for absolute URLs.\n\nIf set, requests must use one of these ports. Defaults are respected when\na port is not present in the URL (443 for https, 80 for http).\n"
+        },
+        "disable_loopback": {
+          "type": "boolean",
+          "description": "Disallow relative URLs (internal loopback calls) when true."
+        },
+        "max_url_length": {
+          "type": "integer",
+          "description": "Maximum permitted URL length in characters; longer inputs are rejected early."
+        },
+        "require_https": {
+          "type": "boolean",
+          "description": "Enforce HTTPS scheme for absolute URLs; reject `http://` when true."
+        }
+      },
+      "required": [],
+      "description": "dict() -> new empty dictionary\ndict(mapping) -> new dictionary initialized from a mapping object's\n    (key, value) pairs\ndict(iterable) -> new dictionary initialized as if via:\n    d = {}\n    for k, v in iterable:\n        d[k] = v\ndict(**kwargs) -> new dictionary initialized with the name=value pairs\n    in the keyword argument list.  For example:  dict(one=1, two=2)"
     }
   },
   "title": "LangGraph CLI Configuration",