lfx-toolguard 0.1.0__py3-none-any.whl

lfx_toolguard/__init__.py

@@ -0,0 +1,5 @@
+"""ToolGuard-powered Policies extension for Langflow."""
+
+from lfx_toolguard.components.models_and_agents import PoliciesComponent
+
+__all__ = ["PoliciesComponent"]

lfx_toolguard/components/__init__.py

@@ -0,0 +1 @@
+"""Component packages shipped by lfx-toolguard."""

lfx_toolguard/components/models_and_agents/__init__.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+from lfx.components._importing import import_mod
+
+if TYPE_CHECKING:
+    from .policies_component import PoliciesComponent
+
+__all__ = ["PoliciesComponent"]
+
+
+def __getattr__(attr_name: str) -> Any:
+    if attr_name not in __all__:
+        msg = f"module '{__name__}' has no attribute '{attr_name}'"
+        raise AttributeError(msg)
+    result = import_mod(attr_name, "policies_component", __spec__.parent)
+    globals()[attr_name] = result
+    return result
+
+
+def __dir__() -> list[str]:
+    return list(__all__)

lfx_toolguard/components/models_and_agents/policies/__init__.py

@@ -0,0 +1,3 @@
+# Supporting utilities for the ToolGuard Policies extension.
+
+__all__ = []

lfx_toolguard/components/models_and_agents/policies/guard_sync_utils.py

@@ -0,0 +1,98 @@
+"""Synchronize generated ToolGuard code with component inputs."""
+
+from pathlib import Path
+
+from lfx.io import CodeInput
+from lfx.log.logger import logger
+from toolguard.runtime.runtime import RESULTS_FILENAME
+
+GENERATED_GUARD_INFO_PREFIX = "Auto-generated ToolGuard code for "
+
+
+def is_generated_guard_field(field: dict) -> bool:
+    """Check if a field represents a generated guard code input.
+
+    Args:
+        field: Dictionary representing a component field/input
+
+    Returns:
+        True if the field is a generated guard code field, False otherwise
+    """
+    if not isinstance(field, dict):
+        return False
+    return (
+        field.get("type") == "code"
+        and field.get("dynamic") is True
+        and isinstance(field.get("info"), str)
+        and field.get("info", "").startswith(GENERATED_GUARD_INFO_PREFIX)
+    )
+
+
+def sync_generated_guard_code_inputs(
+    build_config: dict,
+    work_dir: Path,
+    step2_subdir: str,
+    project_name: str,
+) -> dict:
+    """Synchronize generated guard code files with component code inputs.
+
+    Scans the generated guard code directory and creates/updates CodeInput fields
+    in the build config for each Python file found. Removes stale fields for files
+    that no longer exist.
+
+    Args:
+        build_config: The component's build configuration dictionary
+        work_dir: Base working directory for the toolguard project
+        step2_subdir: Subdirectory name containing generated code (e.g., "Step_2")
+        project_name: Name of the project in snake_case format
+
+    Returns:
+        Updated build_config dictionary with synchronized code inputs
+    """
+    logger.debug("Syncing generated guard code files...")
+    generated_field_names = {key for key, value in build_config.items() if is_generated_guard_field(value)}
+
+    step2_dir = work_dir / step2_subdir
+    logger.debug(f"step2_dir = {step2_dir}")
+    logger.debug(f"step2_dir.exists() = {step2_dir.exists()}")
+    logger.debug(f"step2_dir.is_dir() = {step2_dir.is_dir()}")
+    if not step2_dir.exists() or not step2_dir.is_dir():
+        for field_name in generated_field_names:
+            build_config.pop(field_name, None)
+        return build_config
+
+    files = sorted(path for path in step2_dir.rglob("*") if path.is_file())
+
+    def include_file(relative_name) -> bool:
+        if relative_name.startswith(project_name) and relative_name.endswith(".py"):
+            return True
+        return relative_name == str(RESULTS_FILENAME)
+
+    next_generated_names: set[str] = set()
+
+    for file_path in files:
+        relative_name = file_path.relative_to(step2_dir).as_posix()
+        if not include_file(relative_name):
+            continue
+        logger.debug(f"Processing generated file: {relative_name}")
+        next_generated_names.add(relative_name)
+        try:
+            code_value = file_path.read_text(encoding="utf-8")
+        except OSError:
+            code_value = ""
+
+        code_input = CodeInput(
+            name=relative_name,
+            display_name=relative_name,
+            value=code_value,
+            info=f"{GENERATED_GUARD_INFO_PREFIX}{relative_name}",
+            dynamic=True,
+            advanced=True,
+        )
+        build_config[relative_name] = code_input.to_dict()
+
+    stale_field_names = generated_field_names - next_generated_names
+    for field_name in stale_field_names:
+        build_config.pop(field_name, None)
+
+    return build_config

lfx_toolguard/components/models_and_agents/policies/guarded_tool.py

@@ -0,0 +1,121 @@
+from __future__ import annotations
+
+import json
+from typing import TYPE_CHECKING
+
+from lfx.field_typing import Tool
+from lfx.log.logger import logger
+
+if TYPE_CHECKING:
+    from langchain_core.messages import ToolCall
+    from toolguard.runtime.runtime import ToolguardRuntime
+
+    from lfx_toolguard.components.models_and_agents.policies.tool_invoker import ToolInvoker
+
+
+def _is_policy_violation_exception(exc: Exception) -> bool:
+    try:
+        from toolguard.runtime import PolicyViolationException
+    except ImportError:
+        return False
+
+    return isinstance(exc, PolicyViolationException)
+
+
+class GuardedTool(Tool):
+    """A tool wrapper that applies ToolGuard policy validation before execution.
+
+    This component requires async execution as ToolGuard operates asynchronously.
+    The synchronous `run()` method is not supported and will raise NotImplementedError.
+    Always use `arun()` or async invocation methods.
+    """
+
+    _orig_tool: Tool
+    _tool_invoker: ToolInvoker
+    _toolguard: ToolguardRuntime
+
+    def __init__(self, tool: Tool, all_tools: list[Tool], toolguard: ToolguardRuntime):
+        from lfx_toolguard.components.models_and_agents.policies.tool_invoker import ToolInvoker
+
+        super().__init__(
+            name=tool.name,
+            description=tool.description,
+            args_schema=getattr(tool, "args_schema", None),
+            return_direct=getattr(tool, "return_direct", False),
+            func=self.run,
+            coroutine=self.arun,
+            tags=tool.tags,
+            metadata=tool.metadata,
+            verbose=True,
+        )
+        self._orig_tool = tool
+        self._tool_invoker = ToolInvoker(all_tools)
+        self._toolguard = toolguard
+
+    @property
+    def args(self) -> dict:
+        return self._orig_tool.args
+
+    def _parse_string_to_dict(self, value: str) -> dict:
+        """Parse a string as JSON, or wrap it in a dict if parsing fails."""
+        try:
+            return json.loads(value)
+        except json.JSONDecodeError:
+            return {"input": value}
+
+    def parse_input(self, tool_input: str | dict | ToolCall) -> dict:
+        # Handle string input - try to parse as JSON, fallback to wrapped input
+        if isinstance(tool_input, str):
+            return self._parse_string_to_dict(tool_input)
+
+        # Handle ToolCall dict format - extract and parse args
+        if isinstance(tool_input, dict) and "args" in tool_input:
+            args = tool_input["args"]
+            if isinstance(args, str):
+                return self._parse_string_to_dict(args)
+            return args if isinstance(args, dict) else {}
+
+        # Return dict as-is or empty dict for None/other types
+        return tool_input if isinstance(tool_input, dict) else {}
+
+    def run(self, tool_input: str | dict | ToolCall, config=None, **kwargs):
+        """Synchronous execution is not supported for GuardedTool.
+
+        ToolGuard requires async execution for policy validation. Please use the
+        async version `arun()` instead, or ensure your execution context supports
+        async tool invocation.
+
+        Raises:
+            NotImplementedError: Always raised as sync execution is not supported.
+        """
+        msg = (
+            "GuardedTool does not support synchronous execution. "
+            "ToolGuard requires async execution for policy validation. "
+            "Please use `arun()` instead or ensure your execution context supports async tool invocation."
+        )
+        raise NotImplementedError(msg)
+
+    async def arun(self, tool_input: str | dict | ToolCall, config=None, **kwargs):
+        args = self.parse_input(tool_input)
+        logger.debug(f"running toolguard for {self.name}")
+
+        with self._toolguard:
+            try:
+                await self._toolguard.guard_toolcall(self.name, args=args, delegate=self._tool_invoker)
+                return await self._orig_tool.arun(tool_input=args, config=config, **kwargs)
+            except Exception as ex:
+                if not _is_policy_violation_exception(ex):
+                    logger.exception("Unhandled exception in class GuardedTool.arun()")
+                    raise
+
+                message = getattr(ex, "message", str(ex))
+                logger.debug(f"exception: {message}")
+                return {
+                    "ok": False,
+                    "error": {
+                        "type": "PolicyViolationException",
+                        "code": "FAILURE",
+                        "message": message,
+                        "retryable": True,
+                    },
+                }

lfx_toolguard/components/models_and_agents/policies/llm_wrapper.py

@@ -0,0 +1,184 @@
+"""Language-model adapter used by the ToolGuard Policies extension."""
+
+from typing import Any
+
+from langchain_core.language_models.chat_models import BaseChatModel
+from langchain_core.messages import messages_from_dict
+from toolguard.buildtime.llm import LanguageModelBase
+
+
+class LangchainModelWrapper(LanguageModelBase):
+    """Wrapper for Langchain chat models to work with ToolGuard.
+
+    This wrapper handles:
+    - Message format conversion between ToolGuard and Langchain
+    - Automatic continuation when max tokens are reached
+    - Safe error handling and validation
+    """
+
+    MAX_CONTINUATIONS = 5  # Prevent infinite recursion
+    DEFAULT_MAX_OUT_TOKENS = 16000
+
+    def __init__(self, langchain_model: BaseChatModel):
+        """Initialize the wrapper with a Langchain chat model.
+
+        Args:
+            langchain_model: A Langchain BaseChatModel instance
+        """
+        self.langchain_model = langchain_model
+        if hasattr(self.langchain_model, "max_tokens") and getattr(self.langchain_model, "max_tokens", None) is None:
+            self.langchain_model.max_tokens = self.DEFAULT_MAX_OUT_TOKENS
+
+    def _convert_role(self, role: str) -> str:
+        """Convert ToolGuard role to Langchain message type.
+
+        Args:
+            role: The role from ToolGuard format ("user", "assistant", "system")
+
+        Returns:
+            Langchain message type ("human", "ai", "system")
+        """
+        role_mapping = {
+            "user": "human",
+            "assistant": "ai",
+            "system": "system",
+        }
+        return role_mapping.get(role, "system")
+
+    def _validate_messages(self, messages: list[dict]) -> None:
+        """Validate message format.
+
+        Args:
+            messages: List of message dictionaries
+
+        Raises:
+            ValueError: If messages are invalid
+        """
+        if not isinstance(messages, list):
+            msg = f"Messages must be a list, got {type(messages)}"
+            raise TypeError(msg)
+
+        for i, msg in enumerate(messages):
+            if not isinstance(msg, dict):
+                error_msg = f"Message at index {i} must be a dict, got {type(msg)}"
+                raise TypeError(error_msg)
+
+            if "role" not in msg:
+                error_msg = f"Message at index {i} missing 'role' field"
+                raise ValueError(error_msg)
+
+            if "content" not in msg:
+                error_msg = f"Message at index {i} missing 'content' field"
+                raise ValueError(error_msg)
+
+    def _extract_content(self, content: Any) -> str:
+        """Safely extract string content from various types.
+
+        Args:
+            content: Content that could be str, list, tuple, or None
+
+        Returns:
+            String representation of the content
+        """
+        if content is None:
+            return ""
+
+        if isinstance(content, str):
+            return content
+
+        if isinstance(content, (list, tuple)):
+            # Join list/tuple elements with space
+            return " ".join(str(item) for item in content)
+
+        return str(content)
+
+    async def generate(self, messages: list[dict], _recursion_depth: int = 0) -> str:
+        """Generate a response from the language model.
+
+        Args:
+            messages: List of message dicts with 'role' and 'content' keys
+            _recursion_depth: Internal counter to prevent infinite recursion
+
+        Returns:
+            Generated text response
+
+        Raises:
+            ValueError: If messages are invalid or response is malformed
+            RuntimeError: If max continuations exceeded or API call fails
+        """
+        # Validate inputs
+        self._validate_messages(messages)
+
+        # Check recursion depth
+        if _recursion_depth >= self.MAX_CONTINUATIONS:
+            msg = f"Maximum continuation depth ({self.MAX_CONTINUATIONS}) exceeded"
+            raise RuntimeError(msg)
+
+        # Convert messages to Langchain format
+        converted_messages = [
+            {
+                "type": self._convert_role(msg.get("role", "system")),
+                "data": {"content": self._extract_content(msg.get("content"))},
+            }
+            for msg in messages
+        ]
+
+        try:
+            lc_messages = messages_from_dict(converted_messages)
+        except Exception as exc:
+            msg = f"Failed to convert messages to Langchain format: {exc}"
+            raise ValueError(msg) from exc
+
+        # Call the language model
+        try:
+            response = await self.langchain_model.agenerate(
+                messages=[lc_messages],
+            )
+        except Exception as exc:
+            msg = f"Language model API call failed: {exc}"
+            raise RuntimeError(msg) from exc
+
+        # Safely extract response
+        if not response.generations or not response.generations[0]:
+            msg = "Empty response from language model"
+            raise ValueError(msg)
+
+        choice0 = response.generations[0][0]
+
+        if not hasattr(choice0, "message") or not hasattr(choice0.message, "content"):
+            msg = "Malformed response from language model"
+            raise ValueError(msg)
+
+        chunk = self._extract_content(choice0.text)
+
+        # Check if we need to continue due to max tokens
+        generation_info = getattr(choice0, "generation_info", None)
+        if generation_info and isinstance(generation_info, dict):
+            finish_reason = generation_info.get("finish_reason")
+
+            if finish_reason == "length":  # max tokens reached
+                resp_msg = {
+                    "role": "assistant",
+                    "content": chunk,
+                }
+                continue_msg = {
+                    "role": "user",
+                    "content": (
+                        "Continue the previous answer starting exactly from the last incomplete sentence. "
+                        "Do not repeat anything. Do not add any prefix."
+                    ),
+                }
+                next_messages = [
+                    *messages,
+                    resp_msg,
+                    continue_msg,
+                ]
+
+                # Recursive call with depth tracking
+                continuation = await self.generate(next_messages, _recursion_depth + 1)
+                return chunk + continuation
+
+        return chunk
+
+
+# Made with Bob

lfx_toolguard/components/models_and_agents/policies/module_utils.py

@@ -0,0 +1,22 @@
+"""Module-management helpers for the ToolGuard Policies extension."""
+
+import sys
+
+
+def unload_module(name: str) -> None:
+    """Remove a module and all its submodules from sys.modules.
+
+    This ensures complete cleanup of dynamically generated modules,
+    including any nested imports that may have been created.
+
+    Args:
+        name: The name of the module to unload
+    """
+    # Remove the main module
+    if name in sys.modules:
+        del sys.modules[name]
+
+    # Remove all submodules (e.g., module.submodule)
+    modules_to_remove = [mod_name for mod_name in sys.modules if mod_name.startswith(f"{name}.")]
+    for mod_name in modules_to_remove:
+        del sys.modules[mod_name]

lfx_toolguard/components/models_and_agents/policies/tool_invoker.py

@@ -0,0 +1,59 @@
+"""Tool invocation adapters for the ToolGuard Policies extension."""
+
+from typing import Any, TypeVar
+
+from langchain_core.messages import ToolMessage
+from lfx.field_typing.constants import BaseTool
+from lfx.log.logger import logger
+from mcp.types import CallToolResult
+from pydantic import BaseModel
+from toolguard.runtime import IToolInvoker
+
+T = TypeVar("T")
+
+
+class ToolInvoker(IToolInvoker):
+    _tools: dict[str, BaseTool]
+
+    def __init__(self, tools: list[BaseTool]) -> None:
+        self._tools = {tool.name: tool for tool in tools}
+
+    async def invoke(self, toolname: str, arguments: dict[str, Any], return_type: type[T]) -> T:
+        tool = self._tools.get(toolname)
+        if tool:
+            logger.info(f"invoking {toolname} internally")
+            res = await tool.ainvoke(input=arguments)
+
+            # ToolInvoker calls ainvoke without tool_call_id, so MCPStructuredTool
+            # returns the raw CallToolResult. The ToolMessage branch below is a
+            # defensive fallback in case that ever changes.
+            if isinstance(res, ToolMessage) and isinstance(res.artifact, CallToolResult):
+                res_dict = res.artifact.structuredContent
+            elif isinstance(res, CallToolResult):
+                res_dict = res.structuredContent
+            elif isinstance(res, list):
+                # Multimodal content (e.g. images) — no structured extraction applies.
+                return res  # type: ignore[return-value]
+            elif isinstance(res, dict) and "value" in res:
+                res_dict = res["value"]
+            else:
+                res_dict = res
+
+            # Only try to extract "result" key if res_dict is a dictionary
+            if isinstance(res_dict, dict):
+                res_dict = res_dict.get("result", res_dict)
+
+            if isinstance(res_dict, BaseModel):
+                res_dict = res_dict.model_dump()
+
+            if issubclass(return_type, BaseModel):
+                return return_type.model_validate(res_dict)
+            if return_type in (int, float, str, bool):
+                return return_type(res_dict)
+            return res_dict
+
+        msg = f"unknown tool {toolname}"
+        raise ValueError(msg)
+
+
+# Made with Bob

lfx_toolguard/components/models_and_agents/policies_component.py

@@ -0,0 +1,496 @@
+from __future__ import annotations
+
+import os
+import re
+import shutil
+from pathlib import Path
+from typing import TYPE_CHECKING, cast
+from uuid import uuid4
+
+from lfx.base.models import LCModelComponent
+from lfx.base.models.unified_models import (
+    get_language_model_options,
+    get_llm,
+    update_model_options_in_build_config,
+)
+from lfx.field_typing import LanguageModel, Tool
+from lfx.io import (
+    BoolInput,
+    HandleInput,
+    ModelInput,
+    MultilineInput,
+    Output,
+    SecretStrInput,
+    StrInput,
+    TabInput,
+)
+from lfx.log.logger import logger
+
+from lfx_toolguard.components.models_and_agents.policies.module_utils import unload_module
+
+if TYPE_CHECKING:
+    from lfx.inputs.inputs import InputTypes
+    from toolguard.buildtime import ToolGuardsCodeGenerationResult, ToolGuardSpec
+
+
+TOOLGUARD_WORK_DIR = Path(os.getenv("TOOLGUARD_WORK_DIR") or "tmp_toolguard")
+BUILDTIME_MODELS = ["gpt-5", "claude-sonnet"]  # currently inactive, we recommend but do not enforce
+STEP1 = "Step_1"
+STEP2 = "Step_2"
+MODE_GENERATE = "🛠️ Generate"
+MODE_GUARD = "🛡️ Guard"
+GENERATED_GUARD_INFO_PREFIX = "Auto-generated ToolGuard code for "
+
+_TOOLGUARD_INSTALL_HINT = (
+    "The 'toolguard' package is required to use PoliciesComponent. "
+    "Install the extension extra: `pip install 'lfx[toolguard]'`."
+)
+
+
+class PoliciesComponent(LCModelComponent):
+    """Component for building tool protection code from textual business policies and instructions.
+
+    This component uses ToolGuard to generate and apply policy-based guards to tools,
+    ensuring that tool execution complies with defined business policies.
+    Powered by ALTK ToolGuard (https://github.com/AgentToolkit/toolguard).
+
+    `toolguard` is supplied by the `lfx-toolguard` extension; imports happen
+    lazily inside methods so this component can be discovered and inspected even
+    when the extra isn't installed.
+    """
+
+    model_provider_policy_mode = "delegate"
+    display_name = "Policies"
+    description = """Component for building tool protection code from textual business policies and instructions.
+Powered by [ALTK ToolGuard](https://github.com/AgentToolkit/toolguard )"""
+    documentation: str = "https://github.com/AgentToolkit/toolguard"
+    icon = "shield-check"
+    name = "policies"
+    beta = True
+
+    inputs = cast(
+        "list[InputTypes]",
+        [
+            BoolInput(
+                name="enabled",
+                display_name="Enabled",
+                info="If `true` - guards tool calls. If `false`, skip policy validation.",
+                value=True,
+            ),
+            TabInput(
+                name="mode",
+                display_name="Activity",
+                options=[MODE_GENERATE, MODE_GUARD],
+                info=(
+                    "Generate new guard code or apply existing guard. "
+                    "Review generated files in the details panel on the right."
+                ),
+                value=MODE_GENERATE,
+                real_time_refresh=True,
+                tool_mode=True,
+            ),
+            MultilineInput(
+                name="project",
+                display_name="Policies Project",
+                info="Folder name of the generated code",
+                value="my_project",
+                # required=True,
+            ),
+            HandleInput(
+                name="in_tools",
+                display_name="Tools",
+                input_types=["Tool"],
+                is_list=True,
+                required=True,
+                info="These are the tools that the agent can use to help with tasks.",
+            ),
+            StrInput(
+                name="policies",
+                display_name="Policies",
+                info="One or more clear, well-defined and self-contained business policies",
+                is_list=True,
+                tool_mode=True,
+                placeholder="Add business policy...",
+                list_add_label="Add Policy",
+                # input_types=[],
+            ),
+            ModelInput(
+                name="model",
+                display_name="Language Model",
+                info=(
+                    "Select LLM for Policies buildtime. We recommend using "
+                    "Anthropic Claude-Sonnet series for this task."
+                ),
+                real_time_refresh=True,
+                required=True,
+            ),
+            SecretStrInput(
+                name="api_key",
+                display_name="API Key",
+                info="Model Provider API key",
+                required=False,
+                advanced=True,
+            ),
+        ],
+    )
+    outputs = [
+        Output(
+            display_name="Guarded Tools",
+            type_=Tool,
+            name="guarded_tools",
+            method="guard_tools",
+            # group_outputs=True,
+        ),
+    ]
+
+    @staticmethod
+    def _import_toolguard():
+        """Lazily import `toolguard` and the sibling helpers that depend on it.
+
+        Defined as a static method so it survives custom-component re-execution
+        via `create_class`, which only re-executes the class body, not arbitrary
+        module-level statements such as `try/except` import guards.
+        """
+        try:
+            from toolguard.buildtime import (
+                PolicySpecOptions,
+                ToolGuardsCodeGenerationResult,
+                generate_guard_specs,
+                generate_guards_code,
+            )
+            from toolguard.extra.langchain_to_oas import langchain_tools_to_openapi
+            from toolguard.runtime import load_toolguards, load_toolguards_from_memory
+            from toolguard.runtime.runtime import RESULTS_FILENAME
+
+            from lfx_toolguard.components.models_and_agents.policies.guard_sync_utils import (
+                sync_generated_guard_code_inputs,
+            )
+            from lfx_toolguard.components.models_and_agents.policies.guarded_tool import GuardedTool
+            from lfx_toolguard.components.models_and_agents.policies.llm_wrapper import LangchainModelWrapper
+        except ModuleNotFoundError as e:
+            raise ImportError(_TOOLGUARD_INSTALL_HINT) from e
+        return {
+            "PolicySpecOptions": PolicySpecOptions,
+            "ToolGuardsCodeGenerationResult": ToolGuardsCodeGenerationResult,
+            "generate_guard_specs": generate_guard_specs,
+            "generate_guards_code": generate_guards_code,
+            "langchain_tools_to_openapi": langchain_tools_to_openapi,
+            "load_toolguards": load_toolguards,
+            "load_toolguards_from_memory": load_toolguards_from_memory,
+            "RESULTS_FILENAME": RESULTS_FILENAME,
+            "sync_generated_guard_code_inputs": sync_generated_guard_code_inputs,
+            "GuardedTool": GuardedTool,
+            "LangchainModelWrapper": LangchainModelWrapper,
+        }
+
+    @property
+    def work_dir(self) -> Path:
+        """Return a path isolated by user, flow, component, and project."""
+        try:
+            user_id = self.user_id
+        except (AttributeError, ValueError):
+            user_id = None
+        try:
+            flow_id = self.flow_id
+        except (AttributeError, ValueError):
+            flow_id = None
+
+        vertex = getattr(self, "_vertex", None)
+        component_id = getattr(self, "_id", None) or getattr(vertex, "id", None)
+
+        user_namespace = self._to_snake_case(str(user_id)) if user_id and str(user_id) != "None" else "anonymous"
+        flow_namespace = self._to_snake_case(str(flow_id)) if flow_id else "standalone"
+        if component_id:
+            component_namespace = self._to_snake_case(str(component_id))
+        else:
+            instance_id = getattr(self, "_toolguard_instance_id", None)
+            if instance_id is None:
+                instance_id = uuid4().hex
+                self._toolguard_instance_id = instance_id
+            component_namespace = f"component_{instance_id}"
+        project_namespace = self._to_snake_case(self.project)
+        return TOOLGUARD_WORK_DIR / user_namespace / flow_namespace / component_namespace / project_namespace
+
+    def build_model(self) -> LanguageModel:
+        llm_model = get_llm(
+            model=self.model,
+            user_id=self.user_id,
+            api_key=self.api_key,
+            stream=False,
+        )
+        if llm_model is None:
+            msg = "No language model selected. Please choose a model to proceed."
+            raise ValueError(msg)
+        return llm_model
+
+    def update_build_config(self, build_config: dict, field_value: str, field_name: str | None = None):
+        """Dynamically update build config with user-filtered model options."""
+        updated_build_config = update_model_options_in_build_config(
+            component=self,
+            build_config=build_config,
+            cache_key_prefix="language_model_options",
+            get_options_func=get_language_model_options,
+            field_name=field_name,
+            field_value=field_value,
+        )
+        tg = self._import_toolguard()
+        py_module = self._to_snake_case(self.project)
+        return tg["sync_generated_guard_code_inputs"](
+            build_config=updated_build_config,
+            work_dir=self.work_dir,
+            step2_subdir=STEP2,
+            project_name=py_module,
+        )
+
+    async def _generate_guard_specs(self) -> list[ToolGuardSpec]:
+        tg = self._import_toolguard()
+        logger.debug("Starting step 1")
+        logger.debug(f"model = {self.model}")
+        llm = tg["LangchainModelWrapper"](self.build_model())
+        out_dir = self.work_dir / STEP1
+        if out_dir.exists():
+            shutil.rmtree(out_dir)
+        policy_text = "\n * ".join(self.policies)
+        open_api = tg["langchain_tools_to_openapi"](self.in_tools)
+
+        options = tg["PolicySpecOptions"](example_number=4)
+        specs = await tg["generate_guard_specs"](
+            policy_text=policy_text, tools=open_api, llm=llm, work_dir=out_dir, options=options
+        )
+        logger.debug("Step 1 Done")
+        return specs
+
+    async def _generate_guard_code(self, specs: list[ToolGuardSpec]) -> ToolGuardsCodeGenerationResult:
+        tg = self._import_toolguard()
+        logger.debug("Starting step 2")
+        out_dir = self.work_dir / STEP2
+        if out_dir.exists():
+            shutil.rmtree(out_dir)
+        llm = tg["LangchainModelWrapper"](self.build_model())
+        app_name = self._to_snake_case(self.project)
+        open_api = tg["langchain_tools_to_openapi"](self.in_tools)
+
+        gen_result = await tg["generate_guards_code"](
+            tools=open_api, tool_specs=specs, work_dir=out_dir, llm=llm, app_name=app_name
+        )
+        logger.debug("Step 2 Done")
+        return gen_result
+
+    def in_recommended_models(self, model_name: str):
+        return any(recommended in model_name for recommended in BUILDTIME_MODELS)
+
+    def validate_before_generate(self) -> None:
+        """Validate required inputs before generating guard code."""
+        if not self.project:
+            msg = "Policies: project cannot be empty!"
+            raise ValueError(msg)
+
+        if not any(self.policies):
+            msg = "Policies: policies cannot be empty!"
+            raise ValueError(msg)
+
+        if not self.in_tools:
+            msg = "Policies: in_tools cannot be empty!"
+            raise ValueError(msg)
+
+        # Only the model selection is mandatory. ``api_key`` is declared optional
+        # (required=False, advanced=True) and is frequently supplied by the model
+        # connection, an environment variable, or a global variable rather than by
+        # this field — requiring it here wrongly blocked valid setups with
+        # "model or api_key cannot be empty!". When credentials really are missing,
+        # ``build_model`` -> ``get_llm`` raises a clear provider-specific error.
+        if not self.model:
+            msg = "Policies: model cannot be empty!"
+            raise ValueError(msg)
+
+        # uncomment if willing to enforce certain models for buildtime
+        # if not self.in_recommended_models(self.model[0]["name"]):
+        #     msg = f"Policies: model {self.model[0]['name']} is not in recommended models: {BUILDTIME_MODELS}"
+        #     raise ValueError(msg)
+
+    async def generate(self):
+        specs = await self._generate_guard_specs()
+        res = await self._generate_guard_code(specs)
+
+        # if there was a previous version of the guard, remove it from python cache
+        unload_module(res.domain.app_name)
+
+    def _verify_cached_guards(self, code_dir: Path) -> None:
+        tg = self._import_toolguard()
+        # Validate cache exists before attempting to load
+        if not code_dir.exists():
+            msg = (
+                f"Policies: Cache directory not found at '{code_dir}'. "
+                f"Please run in 'Generate' mode first to create the guard code, "
+                f"or verify the project name is correct."
+            )
+            raise ValueError(msg)
+
+        try:
+            tg["load_toolguards"](code_dir)
+        except FileNotFoundError as exc:
+            msg = (
+                f"Policies: Required guard code files missing in '{code_dir}'. "
+                f"Please run in 'Generate' mode to create the guard code."
+            )
+            raise ValueError(msg) from exc
+        except Exception as exc:
+            msg = (
+                f"Policies: Failed to load guard code from '{code_dir}'. "
+                f"The cached code may be invalid or corrupted. "
+                f"Try running in 'Generate' mode to rebuild the guard code. "
+                f"Error: {exc!s}"
+            )
+            raise ValueError(msg) from exc
+
+    def _validate_before_using_cache(self, code_dir: Path) -> None:
+        if not self.in_tools:
+            msg = "Policies: in_tools cannot be empty!"
+            raise ValueError(msg)
+
+        self._verify_cached_guards(code_dir)
+
+    @staticmethod
+    def _template_field_key(file_name: str | Path) -> str:
+        r"""Normalize a generated file name to its node-template field key.
+
+        ``sync_generated_guard_code_inputs`` keys every generated CodeInput by the
+        file's POSIX relative path (``Path.relative_to(...).as_posix()``), so the
+        keys always use forward slashes. The toolguard result model stores
+        ``file_name`` as a :class:`pathlib.Path`, whose ``str()`` uses the OS
+        separator — backslashes on Windows. Reading back with ``str(file_name)``
+        therefore misses every key on Windows, ``attrs.get(...)`` returns ``None``
+        and the subsequent ``["value"]`` raised the cryptic
+        ``'NoneType' object is not subscriptable`` (issue #13727).
+
+        Normalizing through ``as_posix()`` is the exact inverse of how the keys are
+        written, so lookups match on every platform. ``replace("\\", "/")`` is a
+        belt-and-suspenders guard for the rare case where ``file_name`` is already a
+        string carrying Windows separators (e.g. a flow generated on Windows and
+        opened on POSIX, where ``PurePosixPath`` would not split on backslashes).
+        """
+        return Path(str(file_name).replace("\\", "/")).as_posix()
+
+    def make_toolguard_result(self) -> ToolGuardsCodeGenerationResult:
+        tg = self._import_toolguard()
+        attrs = self.get_vertex().data["node"]["template"]
+        if not attrs:
+            msg = "Policies: component template data is missing. This may indicate a corrupted flow state."
+            raise ValueError(msg)
+
+        def read_content(file_name: str | Path) -> str:
+            """Fetch a generated file's stored source from the node template.
+
+            Raises a clear, actionable error when the field is absent instead of
+            letting a missing key surface as ``'NoneType' object is not
+            subscriptable``. A missing field means the guard code was never
+            generated (or only the ``pass  # FIXME`` scaffold was produced), so the
+            fix is to re-run Generate.
+            """
+            key = self._template_field_key(file_name)
+            field = attrs.get(key)
+            if field is None:
+                msg = (
+                    f"Policies: generated guard file '{key}' is missing from the component. "
+                    f"Re-run in 'Generate' mode to (re)build the guard code before guarding."
+                )
+                raise ValueError(msg)
+            return field["value"]
+
+        result_str = read_content(tg["RESULTS_FILENAME"])
+        result = tg["ToolGuardsCodeGenerationResult"].model_validate_json(result_str)
+
+        result.domain.app_types.content = read_content(result.domain.app_types.file_name)
+        result.domain.app_api.content = read_content(result.domain.app_api.file_name)
+        result.domain.app_api_impl.content = read_content(result.domain.app_api_impl.file_name)
+
+        for tool in result.tools.values():
+            tool.guard_file.content = read_content(tool.guard_file.file_name)
+            for tool_item in tool.item_guard_files:
+                tool_item.content = read_content(tool_item.file_name)
+
+        return result
+
+    @staticmethod
+    def _code_execution_allowed() -> bool:
+        """Whether executing guard code is permitted by the deployment policy.
+
+        ToolGuard runs guard Python whose source comes from the component's
+        client-editable CodeInput template values (make_toolguard_result reads
+        attrs[...]["value"]) — these are NOT covered by the custom-component hash
+        gate. So when an operator locks the deployment down with
+        allow_custom_components=False, running that code must be refused too.
+
+        Fails closed to match validate_flow_for_current_settings: when the
+        settings layer is present but the service is unavailable (returns None),
+        execution is denied. Fail-open is reserved for the truly standalone case
+        where the settings layer cannot be imported at all (lfx used as a bare
+        library), which is a local/trusted context.
+        """
+        try:
+            from lfx.services.deps import get_settings_service
+        except ImportError:
+            # No settings layer at all (lfx used as a bare library) -> local/trusted.
+            return True
+
+        settings_service = get_settings_service()
+        if settings_service is None:
+            # Settings layer present but service unavailable: fail closed, matching
+            # validate_flow_for_current_settings (which raises in this case).
+            return False
+        return bool(getattr(settings_service.settings, "allow_custom_components", False))
+
+    async def guard_tools(self) -> list[Tool]:
+        if self.enabled:
+            # Refuse to execute guard code when allow_custom_components is disabled.
+            # Checked before importing/loading any toolguard runtime so
+            # the client-supplied CodeInput guard values are never exec'd.
+            if not self._code_execution_allowed():
+                msg = (
+                    "Policies/ToolGuard executes guard code, which is disabled because "
+                    "allow_custom_components is False. Set LANGFLOW_ALLOW_CUSTOM_COMPONENTS=true "
+                    "to enable this component."
+                )
+                raise ValueError(msg)
+            tg = self._import_toolguard()
+            mode = getattr(self, "mode", MODE_GENERATE)
+            if mode == MODE_GENERATE:
+                self.log(f"Start generating guard code at {self.work_dir}", name="info")
+                self.validate_before_generate()
+                await self.generate()
+                self.log(f"Policies code generation saved to {self.work_dir}", name="info")
+                self.log("Review the generated files in the details panel on the right.", name="info")
+
+            else:  # mode == "guard"
+                self.log(f"using cache from {self.work_dir}", name="info")
+                code_dir = self.work_dir / STEP2
+                self._validate_before_using_cache(code_dir)
+                try:
+                    tg_result = self.make_toolguard_result()
+                    tg_runtime = tg["load_toolguards_from_memory"](tg_result)
+                    guarded_tools = [tg["GuardedTool"](tool, self.in_tools, tg_runtime) for tool in self.in_tools]
+                    return cast("list[Tool]", guarded_tools)
+                except Exception as e:
+                    logger.exception(e)
+                    raise
+
+        return self.in_tools
+
+    @staticmethod
+    def _to_snake_case(human_name: str) -> str:
+        """Convert human-readable name to snake_case, sanitizing path traversal attempts."""
+        # Convert to lowercase
+        result = human_name.lower()
+
+        # Replace any non-alphanumeric character (including path traversal chars) with underscore
+        result = re.sub(r"[^a-z0-9]+", "_", result)
+
+        # Strip leading/trailing underscores
+        result = result.strip("_")
+
+        # Ensure the result contains at least one alphanumeric character
+        if not result or not re.search(r"[a-z0-9]", result):
+            msg = "Project name must contain at least one alphanumeric character"
+            raise ValueError(msg)
+
+        return result

lfx_toolguard/extension.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://schemas.langflow.org/extension/v1.json",
+  "id": "lfx-toolguard",
+  "version": "0.1.0",
+  "name": "ToolGuard",
+  "description": "Langflow Policies component powered by ToolGuard.",
+  "lfx": {
+    "compat": ["1"]
+  },
+  "bundles": [
+    {
+      "name": "toolguard",
+      "path": "components/models_and_agents"
+    }
+  ]
+}

lfx_toolguard-0.1.0.dist-info/METADATA

@@ -0,0 +1,27 @@
+Metadata-Version: 2.4
+Name: lfx-toolguard
+Version: 0.1.0
+Summary: Langflow Policies component powered by ToolGuard.
+Project-URL: Homepage, https://github.com/langflow-ai/langflow
+Project-URL: Documentation, https://docs.langflow.org/extensions
+Project-URL: Repository, https://github.com/langflow-ai/langflow
+Author-email: Langflow <contact@langflow.org>
+License: MIT
+Keywords: extension,langflow,lfx,policies,toolguard
+Requires-Python: <3.15,>=3.10
+Requires-Dist: lfx<2.0.0,>=1.12.0.dev0
+Requires-Dist: toolguard<1.0.0,>=0.2.20
+Description-Content-Type: text/markdown
+
+# lfx-toolguard
+
+`lfx-toolguard` is the standalone Langflow extension that provides the
+`PoliciesComponent` and its ToolGuard runtime integration.
+
+It is installed by the full `langflow` distribution. Users of `lfx` or
+`langflow-base` can opt in with the compatibility extras:
+
+```bash
+uv pip install "lfx[toolguard]"
+uv pip install "langflow-base[toolguard]"
+```

lfx_toolguard-0.1.0.dist-info/RECORD

@@ -0,0 +1,15 @@
+lfx_toolguard/__init__.py,sha256=qreGtNzZSuF6k7MonGtOBgXKb9hLtoZkMnTFNWjsbbs,164
+lfx_toolguard/extension.json,sha256=yj4JsDC4Pshgvc1Gn0A-F3qzyeXIJbFv3XH4kifTS_4,346
+lfx_toolguard/components/__init__.py,sha256=WBE0wiENOGy-akUpgu7CIt6xY0qrlV5TqY36qqY8Z48,51
+lfx_toolguard/components/models_and_agents/__init__.py,sha256=6dkEWM-dulGNLUXvEMmovECXx9k_XCGJYFlyW9qLA_k,588
+lfx_toolguard/components/models_and_agents/policies_component.py,sha256=LLAuT97rNFXIW4ynQgIVVBCXIr8WBZ61JRsMGr7m7EM,21195
+lfx_toolguard/components/models_and_agents/policies/__init__.py,sha256=Cl918DYZNMCENqmS2vN9KjrNE9b0KU-ssKIFb0b_Uz0,75
+lfx_toolguard/components/models_and_agents/policies/guard_sync_utils.py,sha256=l1s2vmhM3phFlrF9eVn5CfC8JoGZlAaJ4nWVGmYSj2A,3431
+lfx_toolguard/components/models_and_agents/policies/guarded_tool.py,sha256=AZrOB48gJCeoq8kWOTGYGDu56l9FJNp4CM2wY1KJmuw,4591
+lfx_toolguard/components/models_and_agents/policies/llm_wrapper.py,sha256=9vbYZHbCgXzBs2CPSLObbeboBemkEGRUZTQMHaDLRrY,6351
+lfx_toolguard/components/models_and_agents/policies/module_utils.py,sha256=W6r8qmc4Ii8RKm9nU9NSgqtl3KilJm5uB32UxLQUrQg,694
+lfx_toolguard/components/models_and_agents/policies/tool_invoker.py,sha256=cq47Et5uNwciqnj_HfCbOOUaPPBIR26dl88O1EbErWM,2224
+lfx_toolguard-0.1.0.dist-info/METADATA,sha256=m1Uf99ANFoOmJ59NRZhAQvBWOWuNDVSi-ZEAy_2nlag,934
+lfx_toolguard-0.1.0.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
+lfx_toolguard-0.1.0.dist-info/entry_points.txt,sha256=yA5YNui1QGLfAMvyE36XkEKS_GIKzhpYQjP8NDI6VcI,52
+lfx_toolguard-0.1.0.dist-info/RECORD,,

lfx_toolguard-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.31.0
+Root-Is-Purelib: true
+Tag: py3-none-any

lfx_toolguard-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[langflow.extensions]
+lfx-toolguard = lfx_toolguard