lfx 1.14.0.dev2__py3-none-any.whl → 1.14.0.dev4__py3-none-any.whl

lfx/_assets/component_index.json

@@ -5469,7 +5469,7 @@
           "icon": "folder",
           "legacy": true,
           "metadata": {
-            "code_hash": "ba7aa7c4c975",
+            "code_hash": "f34e352b2cbe",
             "component_class_name": "DirectoryComponent",
             "dependencies": {
               "dependencies": [
@@ -5523,7 +5523,7 @@
               "show": true,
               "title_case": false,
               "type": "code",
-              "value": "from pathlib import Path, PurePath, PureWindowsPath\n\nfrom lfx.base.data.utils import TEXT_FILE_TYPES, parallel_load_data, parse_text_file_to_data, retrieve_file_paths\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.io import BoolInput, IntInput, MessageTextInput, MultiselectInput\nfrom lfx.schema.data import Data\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.services.deps import get_settings_service\nfrom lfx.template.field.base import Output\nfrom lfx.utils.file_path_security import component_file_access_scopes, enforce_local_file_access\n\n\nclass DirectoryComponent(Component):\n    display_name = \"Directory\"\n    description = \"Recursively load files from a directory.\"\n    documentation: str = \"https://docs.langflow.org/directory\"\n    icon = \"folder\"\n    name = \"Directory\"\n    legacy = True\n    replacement = [\"files_and_knowledge.File\"]\n\n    inputs = [\n        MessageTextInput(\n            name=\"path\",\n            display_name=\"Path\",\n            info=\"Path to the directory to load files from. Defaults to current directory ('.')\",\n            value=\".\",\n            tool_mode=True,\n        ),\n        MultiselectInput(\n            name=\"types\",\n            display_name=\"File Types\",\n            info=\"File types to load. Select one or more types or leave empty to load all supported types.\",\n            options=TEXT_FILE_TYPES,\n            value=[],\n        ),\n        IntInput(\n            name=\"depth\",\n            display_name=\"Depth\",\n            info=\"Depth to search for files.\",\n            value=0,\n        ),\n        IntInput(\n            name=\"max_concurrency\",\n            display_name=\"Max Concurrency\",\n            advanced=True,\n            info=\"Maximum concurrency for loading files.\",\n            value=2,\n        ),\n        BoolInput(\n            name=\"load_hidden\",\n            display_name=\"Load Hidden\",\n            advanced=True,\n            info=\"If true, hidden files will be loaded.\",\n        ),\n        BoolInput(\n            name=\"recursive\",\n            display_name=\"Recursive\",\n            advanced=True,\n            info=\"If true, the search will be recursive.\",\n        ),\n        BoolInput(\n            name=\"silent_errors\",\n            display_name=\"Silent Errors\",\n            advanced=True,\n            info=\"If true, errors will not raise an exception.\",\n        ),\n        BoolInput(\n            name=\"use_multithreading\",\n            display_name=\"Use Multithreading\",\n            advanced=True,\n            info=\"If true, multithreading will be used.\",\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Loaded Files\", name=\"dataframe\", method=\"as_dataframe\"),\n    ]\n\n    @staticmethod\n    def _has_parent_reference(path: str) -> bool:\n        path_parts = (*PurePath(path).parts, *PureWindowsPath(path).parts)\n        return any(part == \"..\" for part in path_parts)\n\n    def _allowed_roots(self) -> list[Path]:\n        roots = {Path.cwd().resolve()}\n        configured_roots = getattr(get_settings_service().settings, \"directory_component_allowed_roots\", []) or []\n        for root in configured_roots:\n            if root:\n                roots.add(Path(root).expanduser().resolve())\n        return list(roots)\n\n    def _resolve_directory_path(self, path: str) -> str:\n        path = str(path or \".\").strip()\n        # Reject null bytes and parent references outright. A drive-absolute or UNC\n        # path (e.g. ``D:\\\\shared\\\\docs``) is NOT blanket-rejected here: canonicalization\n        # plus the ``_allowed_roots()`` containment check below decides whether it is\n        # allowed, so operator-configured roots on another drive remain reachable.\n        if \"\\x00\" in path or self._has_parent_reference(path):\n            msg = \"Directory path escapes the allowed root.\"\n            raise ValueError(msg)\n\n        resolved_path = Path(self.resolve_path(path)).expanduser().resolve()\n        if not any(resolved_path == root or resolved_path.is_relative_to(root) for root in self._allowed_roots()):\n            msg = \"Directory path escapes the allowed root.\"\n            raise ValueError(msg)\n        return str(resolved_path)\n\n    def load_directory(self) -> list[Data]:\n        path = self.path\n        types = self.types\n        depth = self.depth\n        max_concurrency = self.max_concurrency\n        load_hidden = self.load_hidden\n        recursive = self.recursive\n        silent_errors = self.silent_errors\n        use_multithreading = self.use_multithreading\n\n        resolved_path = self._resolve_directory_path(path)\n\n        # Security: confine directory reads to the storage dir in restricted (multi-tenant)\n        # mode so a tenant cannot recursively read arbitrary server directories.\n        resolved_path = str(enforce_local_file_access(resolved_path, scope_ids=component_file_access_scopes(self)))\n\n        # If no types are specified, use all supported types\n        if not types:\n            types = TEXT_FILE_TYPES\n\n        # Check if all specified types are valid\n        invalid_types = [t for t in types if t not in TEXT_FILE_TYPES]\n        if invalid_types:\n            msg = f\"Invalid file types specified: {invalid_types}. Valid types are: {TEXT_FILE_TYPES}\"\n            raise ValueError(msg)\n\n        valid_types = types\n\n        file_paths = retrieve_file_paths(\n            resolved_path, load_hidden=load_hidden, recursive=recursive, depth=depth, types=valid_types\n        )\n\n        loaded_data = []\n        if use_multithreading:\n            loaded_data = parallel_load_data(file_paths, silent_errors=silent_errors, max_concurrency=max_concurrency)\n        else:\n            loaded_data = [parse_text_file_to_data(file_path, silent_errors=silent_errors) for file_path in file_paths]\n\n        valid_data = [x for x in loaded_data if x is not None and isinstance(x, Data)]\n        self.status = valid_data\n        return valid_data\n\n    def as_dataframe(self) -> DataFrame:\n        return DataFrame(self.load_directory())\n"
+              "value": "from pathlib import Path, PurePath, PureWindowsPath\n\nimport lfx\nfrom lfx.base.data.utils import TEXT_FILE_TYPES, parallel_load_data, parse_text_file_to_data, retrieve_file_paths\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.io import BoolInput, IntInput, MessageTextInput, MultiselectInput\nfrom lfx.schema.data import Data\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.services.deps import get_settings_service\nfrom lfx.template.field.base import Output\nfrom lfx.utils.file_path_security import component_file_access_scopes, enforce_local_file_access\n\n\nclass DirectoryComponent(Component):\n    display_name = \"Directory\"\n    description = \"Recursively load files from a directory.\"\n    documentation: str = \"https://docs.langflow.org/directory\"\n    icon = \"folder\"\n    name = \"Directory\"\n    legacy = True\n    replacement = [\"files_and_knowledge.File\"]\n\n    inputs = [\n        MessageTextInput(\n            name=\"path\",\n            display_name=\"Path\",\n            info=\"Path to the directory to load files from. Defaults to current directory ('.')\",\n            value=\".\",\n            tool_mode=True,\n        ),\n        MultiselectInput(\n            name=\"types\",\n            display_name=\"File Types\",\n            info=\"File types to load. Select one or more types or leave empty to load all supported types.\",\n            options=TEXT_FILE_TYPES,\n            value=[],\n        ),\n        IntInput(\n            name=\"depth\",\n            display_name=\"Depth\",\n            info=\"Depth to search for files.\",\n            value=0,\n        ),\n        IntInput(\n            name=\"max_concurrency\",\n            display_name=\"Max Concurrency\",\n            advanced=True,\n            info=\"Maximum concurrency for loading files.\",\n            value=2,\n        ),\n        BoolInput(\n            name=\"load_hidden\",\n            display_name=\"Load Hidden\",\n            advanced=True,\n            info=\"If true, hidden files will be loaded.\",\n        ),\n        BoolInput(\n            name=\"recursive\",\n            display_name=\"Recursive\",\n            advanced=True,\n            info=\"If true, the search will be recursive.\",\n        ),\n        BoolInput(\n            name=\"silent_errors\",\n            display_name=\"Silent Errors\",\n            advanced=True,\n            info=\"If true, errors will not raise an exception.\",\n        ),\n        BoolInput(\n            name=\"use_multithreading\",\n            display_name=\"Use Multithreading\",\n            advanced=True,\n            info=\"If true, multithreading will be used.\",\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Loaded Files\", name=\"dataframe\", method=\"as_dataframe\"),\n    ]\n\n    @staticmethod\n    def _has_parent_reference(path: str) -> bool:\n        path_parts = (*PurePath(path).parts, *PureWindowsPath(path).parts)\n        return any(part == \"..\" for part in path_parts)\n\n    @staticmethod\n    def _bundled_components_root() -> Path:\n        # The component sources shipped with lfx are public, read-only package files that the\n        # Langflow Assistant reads wherever lfx is installed, whatever the working directory.\n        return (Path(lfx.__file__).parent / \"components\").resolve()\n\n    def _allowed_roots(self) -> list[Path]:\n        roots = {Path.cwd().resolve(), self._bundled_components_root()}\n        configured_roots = getattr(get_settings_service().settings, \"directory_component_allowed_roots\", []) or []\n        for root in configured_roots:\n            if root:\n                roots.add(Path(root).expanduser().resolve())\n        return list(roots)\n\n    def _resolve_directory_path(self, path: str) -> str:\n        path = str(path or \".\").strip()\n        # Reject null bytes and parent references outright. A drive-absolute or UNC\n        # path (e.g. ``D:\\\\shared\\\\docs``) is NOT blanket-rejected here: canonicalization\n        # plus the ``_allowed_roots()`` containment check below decides whether it is\n        # allowed, so operator-configured roots on another drive remain reachable.\n        if \"\\x00\" in path or self._has_parent_reference(path):\n            msg = \"Directory path escapes the allowed root.\"\n            raise ValueError(msg)\n\n        resolved_path = Path(self.resolve_path(path)).expanduser().resolve()\n        if not any(resolved_path == root or resolved_path.is_relative_to(root) for root in self._allowed_roots()):\n            msg = \"Directory path escapes the allowed root.\"\n            raise ValueError(msg)\n        return str(resolved_path)\n\n    def load_directory(self) -> list[Data]:\n        path = self.path\n        types = self.types\n        depth = self.depth\n        max_concurrency = self.max_concurrency\n        load_hidden = self.load_hidden\n        recursive = self.recursive\n        silent_errors = self.silent_errors\n        use_multithreading = self.use_multithreading\n\n        resolved_path = self._resolve_directory_path(path)\n\n        # Security: confine directory reads to the storage dir in restricted (multi-tenant)\n        # mode so a tenant cannot recursively read arbitrary server directories.\n        if not Path(resolved_path).is_relative_to(self._bundled_components_root()):\n            resolved_path = str(enforce_local_file_access(resolved_path, scope_ids=component_file_access_scopes(self)))\n\n        # If no types are specified, use all supported types\n        if not types:\n            types = TEXT_FILE_TYPES\n\n        # Check if all specified types are valid\n        invalid_types = [t for t in types if t not in TEXT_FILE_TYPES]\n        if invalid_types:\n            msg = f\"Invalid file types specified: {invalid_types}. Valid types are: {TEXT_FILE_TYPES}\"\n            raise ValueError(msg)\n\n        valid_types = types\n\n        file_paths = retrieve_file_paths(\n            resolved_path, load_hidden=load_hidden, recursive=recursive, depth=depth, types=valid_types\n        )\n\n        loaded_data = []\n        if use_multithreading:\n            loaded_data = parallel_load_data(file_paths, silent_errors=silent_errors, max_concurrency=max_concurrency)\n        else:\n            loaded_data = [parse_text_file_to_data(file_path, silent_errors=silent_errors) for file_path in file_paths]\n\n        valid_data = [x for x in loaded_data if x is not None and isinstance(x, Data)]\n        self.status = valid_data\n        return valid_data\n\n    def as_dataframe(self) -> DataFrame:\n        return DataFrame(self.load_directory())\n"
             },
             "depth": {
               "_input_type": "IntInput",
@@ -32518,6 +32518,6 @@
     "num_components": 130,
     "num_modules": 17
   },
-  "sha256": "efaa0601bd07c0b923e42faff8a4c27579aacfd0ca3c689b3e9ad978c1e17ab4",
-  "version": "1.14.0.dev2"
+  "sha256": "d6908e8a66b45d5c246e965258c469a724f6b114a7de55827005e0b6f8fab4e2",
+  "version": "1.14.0.dev4"
 }

lfx/base/models/model_remediation.py

@@ -58,10 +58,21 @@ REMEDIATIONS: tuple[Remediation, ...] = (
         providers=("OpenAI",),
     ),
     Remediation(
-        # Claude 5 rejects a temperature its 4.x siblings accept (GH-14291); markers
-        # stay narrow so an out-of-range value, which only the user can fix, surfaces.
+        # Models that only accept the default temperature reject an explicitly set
+        # one at call time: Claude 5 calls it "deprecated" (GH-14291), while OpenAI
+        # and Azure reasoning models (o-series, gpt-5*) answer with "'temperature'
+        # is not supported with this model" or "'temperature' does not support
+        # <value> ... Only the default (1) value is supported". Dropping temperature
+        # (→ provider default) is the fix for all of them. Markers stay narrow so a
+        # genuine out-of-range value ("temperature must be between 0 and 2"), which
+        # only the user can fix, still surfaces.
         name="temperature-unsupported",
-        markers=("`temperature` is deprecated", "temperature is deprecated"),
+        markers=(
+            "`temperature` is deprecated",
+            "temperature is deprecated",
+            "'temperature' is not supported",
+            "'temperature' does not support",
+        ),
         overrides={"temperature": None},
     ),
 )

lfx/components/files_and_knowledge/directory.py

@@ -1,5 +1,6 @@
 from pathlib import Path, PurePath, PureWindowsPath
 
+import lfx
 from lfx.base.data.utils import TEXT_FILE_TYPES, parallel_load_data, parse_text_file_to_data, retrieve_file_paths
 from lfx.custom.custom_component.component import Component
 from lfx.io import BoolInput, IntInput, MessageTextInput, MultiselectInput
@@ -82,8 +83,14 @@ class DirectoryComponent(Component):
         path_parts = (*PurePath(path).parts, *PureWindowsPath(path).parts)
         return any(part == ".." for part in path_parts)
 
+    @staticmethod
+    def _bundled_components_root() -> Path:
+        # The component sources shipped with lfx are public, read-only package files that the
+        # Langflow Assistant reads wherever lfx is installed, whatever the working directory.
+        return (Path(lfx.__file__).parent / "components").resolve()
+
     def _allowed_roots(self) -> list[Path]:
-        roots = {Path.cwd().resolve()}
+        roots = {Path.cwd().resolve(), self._bundled_components_root()}
         configured_roots = getattr(get_settings_service().settings, "directory_component_allowed_roots", []) or []
         for root in configured_roots:
             if root:
@@ -120,7 +127,8 @@ class DirectoryComponent(Component):
 
         # Security: confine directory reads to the storage dir in restricted (multi-tenant)
         # mode so a tenant cannot recursively read arbitrary server directories.
-        resolved_path = str(enforce_local_file_access(resolved_path, scope_ids=component_file_access_scopes(self)))
+        if not Path(resolved_path).is_relative_to(self._bundled_components_root()):
+            resolved_path = str(enforce_local_file_access(resolved_path, scope_ids=component_file_access_scopes(self)))
 
         # If no types are specified, use all supported types
         if not types:

lfx/extension/migration/rewrite.py

@@ -13,11 +13,11 @@ before constructing the graph.  The rewrite is intentionally tolerant:
     * Unknown shape (non-dict node, missing 'data' field) -> skipped, no
       error.  The caller's own validation handles malformed payloads.
 
-The rewriter mutates ``payload`` in place because the saved-flow object is
-already a freshly-decoded dict tree owned by the caller; copying every node
-just to swap one string per node is wasteful and would force callers to
-re-bind their reference.  This is the one mutation in the migration system;
-everything else is frozen Pydantic models.
+The rewriter mutates ``payload`` in place.  ``Graph.from_payload`` passes the
+normalized copy it builds from, so the caller's saved flow is never rewritten.
+Copying every node again just to swap one string per node would add a second
+copy and force callers to re-bind their reference.  This is the one mutation
+in the migration system, and everything else is frozen Pydantic models.
 
 The function returns a :class:`MigrationReport` with one record per node it
 visited so the caller (today: nothing; tomorrow: ``ExtensionEventsService``)

lfx/graph/graph/base.py

@@ -52,6 +52,7 @@ from lfx.services.authorization.base import ExecutionPrincipal
 from lfx.services.cache.utils import CacheMiss
 from lfx.services.deps import get_chat_service, get_tracing_service
 from lfx.utils.async_helpers import run_until_complete
+from lfx.utils.flow_code import normalize_code_for_import
 
 try:
     from opentelemetry import trace as otel_trace
@@ -1848,6 +1849,7 @@ class Graph:
             validate_flow_for_current_settings,
         )
 
+        payload = normalize_code_for_import(payload)
         if "data" in payload:
             payload = payload["data"]
         # Catalog identity is the exact, case-sensitive stored node.data.type.

lfx/load/load.py

@@ -15,6 +15,7 @@ from lfx.load.utils import replace_tweaks_with_env
 from lfx.log.logger import configure
 from lfx.processing.process import process_tweaks, run_graph
 from lfx.utils.async_helpers import run_until_complete
+from lfx.utils.flow_code import normalize_code_for_import
 from lfx.utils.flow_validation import CustomComponentValidationError, ensure_component_hash_lookups_loaded
 from lfx.utils.util import update_settings
 
@@ -76,7 +77,7 @@ async def aload_flow_from_json(
         msg = "Input must be either a file path (str) or a JSON object (dict)"
         raise TypeError(msg)
 
-    graph_data = flow_graph["data"]
+    graph_data = normalize_code_for_import(flow_graph)["data"]
     if tweaks is not None:
         graph_data = process_tweaks(graph_data, tweaks)
 

lfx/schema/workflow.py

@@ -511,26 +511,20 @@ class WorkflowResumeResponse(BaseModel):
     message: str | None = None
 
 
+# FastAPI registers ``model`` in components.schemas and emits oneOf $refs.
+# Inlining model_json_schema() leaves the discriminator mapping pointing at names
+# that are never created, which Redoc cannot resolve.
+WorkflowExecutionResult = Annotated[
+    WorkflowExecutionResponse | WorkflowJobResponse,
+    Field(discriminator="object"),
+]
+
 # OpenAPI response definitions
 WORKFLOW_EXECUTION_RESPONSES = {
     200: {
+        "model": WorkflowExecutionResult,
         "description": "Workflow execution response",
         "content": {
-            "application/json": {
-                "schema": {
-                    "oneOf": [
-                        WorkflowExecutionResponse.model_json_schema(),
-                        WorkflowJobResponse.model_json_schema(),
-                    ],
-                    "discriminator": {
-                        "propertyName": "object",
-                        "mapping": {
-                            "response": "#/components/schemas/WorkflowExecutionResponse",
-                            "job": "#/components/schemas/WorkflowJobResponse",
-                        },
-                    },
-                }
-            },
             "text/event-stream": {
                 "schema": WorkflowStreamEvent.model_json_schema(),
                 "description": "Server-sent events for streaming execution",

lfx/services/settings/groups/runtime.py

@@ -250,6 +250,8 @@ class RuntimeSettings(BaseModel):
     no inbound provider deliveries at all (a firewalled install using Track B
     listeners only); every ingress request then answers 404 exactly as an
     unknown trigger id does, so disabling it leaks nothing either."""
+    trigger_ingress_origin: str | None = None
+    """Operator-advertised HTTPS origin for push providers without OAuth callbacks."""
     trigger_ingress_max_body_bytes: int = Field(default=1_048_576, gt=0)
     """Per-route body cap for an ingress delivery, independent of the global
     request limit. Provider notifications are small - Graph basic notifications

lfx/upgrade/checker.py

@@ -6,6 +6,8 @@ from collections.abc import Mapping
 from dataclasses import dataclass, field
 from typing import Any, Literal
 
+from lfx.utils.flow_code import normalize_code_for_import
+
 COMPONENTS_TO_IGNORE_UPDATE: frozenset[str] = frozenset({"CustomComponent"})
 TRANSIENT_TEMPLATE_KEYS: frozenset[str] = frozenset({"is_refresh", "tools_metadata"})
 
@@ -278,6 +280,7 @@ def check_flow_compatibility(
             rebuilding the lookup when the caller also runs ``apply_safe_upgrades`` on the same
             registry.
     """
+    flow_data = normalize_code_for_import(flow_data)
     if registry is None:
         registry = build_registry_lookup(all_types_dict)
     statuses: list[NodeStatus] = []

lfx/utils/flow_code.py

@@ -0,0 +1,46 @@
+"""Normalize source code in exported flow payloads."""
+
+from collections.abc import Iterator
+from copy import deepcopy
+
+from lfx.utils.flow_envelope import split_flow_envelope
+
+
+def _code_fields(flow: dict) -> Iterator[dict]:
+    _, graph = split_flow_envelope(flow)
+    nodes = graph.get("nodes")
+    if not isinstance(nodes, list):
+        return
+    for node in nodes:
+        if not isinstance(node, dict):
+            continue
+        node_data = node.get("data")
+        if not isinstance(node_data, dict):
+            continue
+        component = node_data.get("node")
+        if not isinstance(component, dict):
+            continue
+        template = component.get("template")
+        if not isinstance(template, dict):
+            continue
+        for field_data in template.values():
+            if isinstance(field_data, dict) and field_data.get("type") == "code":
+                yield field_data
+
+
+def has_code_lines(flow: dict) -> bool:
+    """Return whether any code field still stores exported code as a list of lines."""
+    return any(isinstance(field_data.get("value"), list) for field_data in _code_fields(flow))
+
+
+def normalize_code_for_import(flow: dict) -> dict:
+    """Return a copy with exported code lines joined without losing trailing newlines."""
+    normalized = deepcopy(flow)
+    for field_data in _code_fields(normalized):
+        value = field_data.get("value")
+        if isinstance(value, list):
+            if not all(isinstance(line, str) for line in value):
+                msg = "Code lines must all be strings"
+                raise ValueError(msg)
+            field_data["value"] = "\n".join(value)
+    return normalized

lfx/utils/flow_requirements.py

@@ -42,6 +42,8 @@ from functools import lru_cache
 from pathlib import Path
 from types import MappingProxyType
 
+from lfx.utils.flow_code import normalize_code_for_import
+
 # ---------------------------------------------------------------------------
 # Standard-library module names (3.10+)
 # ---------------------------------------------------------------------------
@@ -548,7 +550,7 @@ def generate_requirements_from_flow(
     all_packages: set[str] = set()
     all_providers: set[str] = set()
 
-    data = flow.get("data", {})
+    data = normalize_code_for_import(flow).get("data", {})
     nodes = data.get("nodes", [])
 
     for node in nodes:

lfx/utils/flow_validation.py

@@ -9,6 +9,7 @@ from typing import TYPE_CHECKING, Any
 
 from lfx.log.logger import logger
 from lfx.utils.component_aliases import ComponentIdentityIndex, get_component_type_aliases
+from lfx.utils.flow_code import has_code_lines, normalize_code_for_import
 
 if TYPE_CHECKING:
     from lfx.services.catalog_policy import CatalogPolicySnapshot
@@ -276,11 +277,24 @@ def _extract_graph_payload(graph: Any) -> Mapping[str, Any] | None:
 
 
 def _extract_flow_data(target: Mapping[str, Any] | Any | None) -> dict[str, Any] | None:
-    """Normalize a flow payload or graph-like object to raw graph data."""
+    """Normalize a flow payload or graph-like object to raw graph data.
+
+    Downloaded flows store component code as lists of lines, and ``Graph.from_payload`` joins
+    them before it builds. Join them here as well, on a copy, so policy checks hash and sanitize
+    the source that will run. Lines that cannot be joined stay as they are, and the code checks
+    still block them.
+    """
     if isinstance(target, Mapping) or target is None:
-        return _normalize_flow_data(target)
+        flow_data = _normalize_flow_data(target)
+    else:
+        flow_data = _normalize_flow_data(_extract_graph_payload(target))
 
-    return _normalize_flow_data(_extract_graph_payload(target))
+    if flow_data is None or not has_code_lines(flow_data):
+        return flow_data
+    try:
+        return normalize_code_for_import(flow_data)
+    except ValueError:
+        return flow_data
 
 
 def _collect_catalog_component_keys(nodes: Any) -> set[str]:
@@ -1317,10 +1331,10 @@ def substitute_outdated_component_code_in_place(
     claim is likewise left untouched, so drift is never resolved into the *wrong* component —
     see :class:`SubstitutableComponentTypes`.
 
-    Mutates ``flow_data`` in place, matching ``Graph.from_payload``'s existing contract with
-    ``migrate_flow_payload``; callers that must preserve the stored flow (so the editor keeps
-    flagging the node as outdated) pass a copy. Returns ``display_name (id)`` labels for the
-    nodes that were swapped.
+    Mutates ``flow_data`` in place. ``Graph.from_payload`` passes the normalized copy it builds
+    from, so a stored flow is never changed there. Other callers that must preserve the stored
+    flow, so the editor keeps flagging the node as outdated, pass a copy. Returns
+    ``display_name (id)`` labels for the nodes that were swapped.
 
     When ``validate_public_execution`` is true, the exact post-substitution bytes are checked
     against the public code-execution policy using the same registry snapshot that supplied

{lfx-1.14.0.dev2.dist-info → lfx-1.14.0.dev4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lfx
-Version: 1.14.0.dev2
+Version: 1.14.0.dev4
 Summary: Langflow Executor - A lightweight CLI tool for executing and serving Langflow AI flows
 Author-email: Gabriel Luiz Freitas Almeida <gabriel@langflow.org>
 Requires-Python: <3.16,>=3.10
@@ -18,7 +18,8 @@ Requires-Dist: defusedxml<1.0.0,>=0.7.1
 Requires-Dist: docstring-parser<1.0.0,>=0.16
 Requires-Dist: emoji<3.0.0,>=2.14.1
 Requires-Dist: fastapi<1.0.0,>=0.135.0
-Requires-Dist: filelock<4.0.0,>=3.20.1
+Requires-Dist: filelock<4.2.0,>=4.1.0; python_version < '3.11'
+Requires-Dist: filelock<5.0.0,>=4.2.1; python_version >= '3.11'
 Requires-Dist: gunicorn>=22.0; sys_platform != 'win32'
 Requires-Dist: h2>=4.4.1
 Requires-Dist: httpx[http2]<1.0.0,>=0.24.0
@@ -27,7 +28,7 @@ Requires-Dist: jsonschema<5.0.0,>=4.20.0
 Requires-Dist: langchain-classic~=1.0.7
 Requires-Dist: langchain-core<2.0.0,>=1.2.28
 Requires-Dist: langchain~=1.3.0
-Requires-Dist: langflow-sdk==0.4.0.dev96
+Requires-Dist: langflow-sdk==0.4.0.dev98
 Requires-Dist: loguru<1.0.0,>=0.7.3
 Requires-Dist: markitdown<2.0.0,>=0.1.4; python_version < '3.15'
 Requires-Dist: mcp<2.0.0,>=1.30.0
@@ -77,7 +78,7 @@ Provides-Extra: sqlite
 Requires-Dist: apsw==3.53.4.0; extra == 'sqlite'
 Requires-Dist: sqlite-vec==0.1.9; extra == 'sqlite'
 Provides-Extra: toolguard
-Requires-Dist: lfx-toolguard<1.0.0,>=0.1.0; extra == 'toolguard'
+Requires-Dist: lfx-toolguard<1.0.0,>=0.3.0; extra == 'toolguard'
 Description-Content-Type: text/markdown
 
 # LFX - Langflow Executor

{lfx-1.14.0.dev2.dist-info → lfx-1.14.0.dev4.dist-info}/RECORD

@@ -10,7 +10,7 @@ lfx/preload.py,sha256=5YciPjPCRAZhiYKQYsLKcNO-phS9vBdo7VF46_khfms,13737
 lfx/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 lfx/settings.py,sha256=wnx4zkOLQ8mvampYsnnvVV9GvEnRUuWQpKFSbFTCIp4,181
 lfx/type_extraction.py,sha256=3gPIl9AMA8UquNG7E_Oh4_9nk5BGlUVuB97qjSuu5zg,2792
-lfx/_assets/component_index.json,sha256=YpTorqs3UaVLD-_5O-5DZaURIOWYPzCaRUdkwC9STdQ,2475661
+lfx/_assets/component_index.json,sha256=wxZAs85Loiu3Af6lq1dA2AQ1XI7eWJGnisWeYwnpe6c,2476122
 lfx/_assets/legacy_storage_sources.json,sha256=3OWkuQ30fWqBeuctyYOQUBZqEreC5kJhS9B6NfSGm8I,183917
 lfx/_assets/stable_hash_history.json,sha256=WZjooLc3zQgc1kUWF5aoWtYyOuTHT-qmh7ZtiFcEsUg,41694
 lfx/base/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -127,7 +127,7 @@ lfx/base/models/llm_callback_utils.py,sha256=0GLzdlUDxLOfF-oQsUykUDB1iaVpA2zOiAT
 lfx/base/models/model.py,sha256=WuQkDrq9RY7yU2SziiRj0UjIxTO46_ZXq8yXFNCeuo4,21896
 lfx/base/models/model_input_constants.py,sha256=5XUR9OLmukyYWGXem9o5suFYvhJNAWiEdNUPoR6COxk,12882
 lfx/base/models/model_metadata.py,sha256=OHuwAqav-ay77rtlfYqbzJ2ZIq--3fGZW3CJxQh3oFI,18934
-lfx/base/models/model_remediation.py,sha256=qcE-3L6Q3T_6nOLV72c62ZDo2s4bKDoXy6f5-_BJJqs,5997
+lfx/base/models/model_remediation.py,sha256=ONHZ_E35ZNS4n6ncb1yK4_fuT4f4zRKjdA91k7rkU_U,6585
 lfx/base/models/model_utils.py,sha256=-WXD2t9oBVk-t0oNNOon6GjHLSMpZE_8Zy1ShGVwbtA,58743
 lfx/base/models/models_dev_catalog.py,sha256=7OIOxizp_jcxh4INJnBD8uyOZDE7KGS_29EoD019b88,21839
 lfx/base/models/novita_constants.py,sha256=_mgBYGwpddUw4CLhLKJl-psOUzA_SQGHrfZJUNes6aI,1247
@@ -301,7 +301,7 @@ lfx/components/files_and_knowledge/__init__.py,sha256=uqO6FlF-J_cbv0w53e-6rc4nFI
 lfx/components/files_and_knowledge/_filesystem_isolation.py,sha256=dBSJSZUW0DAqtc3nbdFz2ElTuSWWXDQSk02x-eQNtlc,1669
 lfx/components/files_and_knowledge/_filesystem_namespace.py,sha256=9HOFQIZ75jqzIQ-73yapsMsGkilgRD6L-Ur2t2cLhlM,3022
 lfx/components/files_and_knowledge/_kb_paths.py,sha256=zUEQYM4kTexATtj1tZpdbGLwOmHJDbl1d_-G0jFNTPI,3719
-lfx/components/files_and_knowledge/directory.py,sha256=unqnxMl1iaJNCl6ZBm9H3izRdvJJghL-wNbWkVdD-f0,5954
+lfx/components/files_and_knowledge/directory.py,sha256=8041Kyy-EeDSdKA8YTuJcz_Xscte2OUUBolrn14SgFg,6405
 lfx/components/files_and_knowledge/file.py,sha256=GWu8GmX4aqjt_cDeH9f23QKt4oLUCmsKK4NZCQW_4ws,70528
 lfx/components/files_and_knowledge/filesystem.py,sha256=jwRPBZoe92ZZyGLOzg5h063uR0fOYH-OszsDBuQvGqQ,56709
 lfx/components/files_and_knowledge/ingestion.py,sha256=dabhpFeXDDMkgk9IdlUSriV4sncJwpyKsK4yaIrYiJU,1954
@@ -565,7 +565,7 @@ lfx/extension/loader/_types.py,sha256=FH6pEgb5zpIVXIIQg0XDPpVWDGWzb1vil0YXEzhYzR
 lfx/extension/migration/__init__.py,sha256=CwRSy0t3Bz2usgrKuuSGEr9iRBInoFFiQEJaiZOhY6U,1754
 lfx/extension/migration/loader.py,sha256=enDNoi7JMEmffGL4HmydYW40govunBMC2R3hcJsLlho,6081
 lfx/extension/migration/migration_table.json,sha256=V29p8LeSHX-YXZCJlnT2LHrZ-py3r3Q94DSHyMeR2f0,188056
-lfx/extension/migration/rewrite.py,sha256=lq8-bG05me0h3wUdKWmc-aRsVUuQ-J6i0KkMIDMnQtE,19872
+lfx/extension/migration/rewrite.py,sha256=O9T_Ggzk3tzGX4PgQ18fmwUkzGDaD1jvcP_2m3Ui8CM,19913
 lfx/extension/migration/schema.py,sha256=meM64U7p5IQHE2VIfsvLoO7Ue0AwvH716Sb4NQkvEkQ,16717
 lfx/field_typing/__init__.py,sha256=1SIlVWBB9WTTLUNSmiR0LdMNY2pGg_-jnCF4Ll6FlG4,1808
 lfx/field_typing/conditional_options.py,sha256=RmJXXv_Bxq_aavF9t9Daa7OsWrprZXL-BAAVJgizyzo,770
@@ -595,7 +595,7 @@ lfx/graph/flow_builder/layout.py,sha256=ZCdVrmJ-Fv2LMBq35Dd2LPx1sbncr9M0zGncTgyx
 lfx/graph/flow_builder/spec.py,sha256=9f8L3mlOtHgazqu1KR3vvQml0UjQleRdApzV-PIij3M,8264
 lfx/graph/graph/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 lfx/graph/graph/ascii.py,sha256=-jYWI_Zmz24mfLOxJrzIINZ0dbQgd9PXJfqwZa03xas,6211
-lfx/graph/graph/base.py,sha256=VjOcQua2VCvHUTXsCsZMPH2ryBJtrCzCm7t4Q4_rxvw,152454
+lfx/graph/graph/base.py,sha256=oP1pQHi5KdCl0gGGtENkE0getc1EXwLPE35Zui-JJOU,152565
 lfx/graph/graph/constants.py,sha256=jwjl4RydV_k_zawbI8FIgiLHeBBgH-cStVitxxSyXQs,1641
 lfx/graph/graph/runnable_vertices_manager.py,sha256=c-qQP3koKyAsIADDSONiiz4FIRIn6q5kAMX6EQIBBfA,6148
 lfx/graph/graph/schema.py,sha256=1a8pictdRVN6ByqpvhOYu7heDeVs7A3eGpZuYIF7kaY,1086
@@ -638,7 +638,7 @@ lfx/interface/initialize/loading.py,sha256=mRB7_N4xnS2e0oe5qiQ00SaDo0g-nzkC9CDmC
 lfx/io/__init__.py,sha256=Yihh5qVCVYJRDG3AjVpX2IQqEy-6FS7zbgHqlgKbjy4,1337
 lfx/io/schema.py,sha256=L6hE9SAJqbx9BH9wQU8zAjDSfa9XCni8C2S-oTyAgsw,15396
 lfx/load/__init__.py,sha256=y35GBUhVTOsG3GzL5UVL-RNAsu0D7T8MVPrNXoDMx7U,224
-lfx/load/load.py,sha256=hJSV_1_yjFasFM2BGOa9M8_i0jov5YPlnpLwgFksaqM,10924
+lfx/load/load.py,sha256=KGjG1oTECRZGe1kTwhxTMfmatf3ep_8QJtiO1fY4yzA,11009
 lfx/load/utils.py,sha256=4mJ3_sAt8DdBVIiOHV8aGJchglF2IYTbLAQfwUkcN8k,4543
 lfx/log/__init__.py,sha256=gJLNG2h6ptId2U9EyXHYmTlYNHESsSibmHhd3hPetRU,197
 lfx/log/_streams.py,sha256=UAX_39RvJslajjE9HwadPuUnbfjMUnglOKjVJlFFauw,1195
@@ -691,7 +691,7 @@ lfx/schema/serialize.py,sha256=Y7aL91w3BW4ZYkgdIHosUYdpIJUDku-SoqYoIQtwtGM,252
 lfx/schema/table.py,sha256=1RdMmk1vbzmPFW0JEGhP7WDDRtvUKH9lkDw5v-JWhSw,4668
 lfx/schema/token_usage.py,sha256=6FU_v0xc5Gd-AA7lv67Yvx2mEzN6GCRXLH8ik06VbJo,8166
 lfx/schema/validators.py,sha256=1SwbWr44uoIOsoWb1BxqvHq104SFh_jhLJVOKGTw4sE,4769
-lfx/schema/workflow.py,sha256=KyAkLFgKuxjQxDetIyRoVsU_MUBAI0Ec-FU59KeDjsE,21251
+lfx/schema/workflow.py,sha256=C2aVEx9fztyyD1ycIef1bb_NQGK-qvqvQXmZoEpiRKU,21002
 lfx/serialization/__init__.py,sha256=g-CG7Y--Eog6mSPMI7wqXh6J8lYygFthqmJWrCa3P7k,145
 lfx/serialization/constants.py,sha256=mAYNbapEPu9-KixSHVPCXUyM-bsFMjSoCc4ohkQGvQY,47
 lfx/serialization/serialization.py,sha256=NdcX7KXeP69tF4R1ABB2w4IFRKxrUFotyZVg04k78aU,12532
@@ -779,7 +779,7 @@ lfx/services/settings/groups/database.py,sha256=pkMJYWzeZjWTPkIRLvBz5Cf0m9sBhSnR
 lfx/services/settings/groups/mcp.py,sha256=hL0Id8I-w6NEtlCQxYuqUBkkukaJECvzxS4ooRX3tFo,10434
 lfx/services/settings/groups/observability.py,sha256=Q09KEmP0FUeD6gMacIspcbcNa8VTYQJafCxe1PqFTPs,2486
 lfx/services/settings/groups/paths.py,sha256=IwDpt28fCXyUPrS1HJs6ebELaAcaqLBMP04JtL7doWI,3796
-lfx/services/settings/groups/runtime.py,sha256=dsURg2kji3vYmjZGsyaLrMVMpJt_GHNAZFxt7mSEnDU,28055
+lfx/services/settings/groups/runtime.py,sha256=JxVFU3pmt8fEH1Cg_eQQxMzAhmeG1zizFSqjH5BP21I,28188
 lfx/services/settings/groups/security.py,sha256=Gu4yAdjmSyro0m5BX4WZAOwnmR8V8gTCMRcPpWEBkB8,28786
 lfx/services/settings/groups/server.py,sha256=k0qcRAD-mK11MDpjLDvL27-i2ltZafPPcb0MAkzwBVg,5281
 lfx/services/settings/groups/storage.py,sha256=uZgVWRFkI2wxZ5g3uoWyNKB2fclrGJ64OZ9bMrISWVM,628
@@ -837,7 +837,7 @@ lfx/type_extraction/__init__.py,sha256=8kKUjudbOHkYHVEOA14jD4A-9UUlG1lj1rznKuWoP
 lfx/type_extraction/type_extraction.py,sha256=B4P-eAfUD9i0NqohdntgU3NBLU_0jDc18L36lQsYhrY,2718
 lfx/upgrade/__init__.py,sha256=f4yVhS7B-nHW_tvUi3hzr4ZDSEwqRQRukCH_uniecDE,277
 lfx/upgrade/applier.py,sha256=xkbA-digcmmpdwVd1hYz0D7RLNmQIs6V53QWX1y_Z0M,3871
-lfx/upgrade/checker.py,sha256=jBg14O1egZgNeu6Ge8YuJUfOIVIN6dkYKsdyhB1B49g,13435
+lfx/upgrade/checker.py,sha256=4K-QRaj9W-0aMPoWKstsiZBxWHmA2IJ0eviY0tw3zWw,13547
 lfx/upgrade/cli_gate.py,sha256=SRfRleATX6klHzCTUu0kiF38OmEgof8UkBfDDo5sK1Y,4878
 lfx/upgrade/registry.py,sha256=rqOl9G3ucamM4bxSZY4WHR10Ivt6T-mDPNaQAhSvJKU,1975
 lfx/utils/__init__.py,sha256=X5mPJ2NuCxF0hobaFDBq4IGqpZFonPaIokeoFSHuX2E,881
@@ -852,9 +852,10 @@ lfx/utils/end_user_storage.py,sha256=M83ec39bI54yI14IW5dA-laysrLTcdxLhQyAXEjFSlE
 lfx/utils/env_var_security.py,sha256=cngMWWB-Wl3U1ypxHd_pvS_uHaNyKXgzOB3hcrOcEwA,4365
 lfx/utils/exceptions.py,sha256=xLkPFy5CgMiw8QyZc5UXgUjmBNY9MdJ4XXzaYAVcavQ,3190
 lfx/utils/file_path_security.py,sha256=8V-WYsQRFlgGvToeoUdCj1K-5-w_AMORaQY4LUlD23c,17616
+lfx/utils/flow_code.py,sha256=4R7UlXKHApJ4zPUIJt9qRAWOl2hWMlX5jK2MGKnX4ss,1664
 lfx/utils/flow_envelope.py,sha256=D0eCjaOyvQ5gWSqdsoL7hQwNKf_6fJTToC9yZNHNq8w,2302
-lfx/utils/flow_requirements.py,sha256=w7DbqD4oa4txnmYqpo8cIzAgS0-tXLy_qBpUywW3t2o,28671
-lfx/utils/flow_validation.py,sha256=ZhPRYxu6VoYdNKzYo5sA1brsj0raUBgrdCaS-5OeHuQ,104622
+lfx/utils/flow_requirements.py,sha256=AsioxS7ZlN7tB7H6Pbylt-eXByclVjS7MbMiN3AJXAU,28757
+lfx/utils/flow_validation.py,sha256=pHPygVg3-fer3HKgyarHiye5cPAUEW5BolIvtCBego0,105258
 lfx/utils/helpers.py,sha256=0LE0barnVp-8Y5cCoDRzhDzesvXqgiT7IXP6vtTSyGE,889
 lfx/utils/image.py,sha256=CaMGwpCCKxcu_pWmP7FZXwZ3kr1-ymGKjN92Bv_yr5k,3160
 lfx/utils/jq_security.py,sha256=mADEtPPbQvoQw88JOXB1Ig9Eh5uslijYw8U_ZPho7_U,8571
@@ -889,7 +890,7 @@ lfx/workflow/router.py,sha256=lrIDbrrE0XwI2fbfxpt8jb2jPSyxTpthUqUY1HXVVCo,24620
 lfx/workflow/adapters/__init__.py,sha256=8WyVggf_LacLJRJEUM6_4JLqM2EN-KogrbUEp1E8w00,5166
 lfx/workflow/adapters/agui.py,sha256=ZLLJJ-CQgB1ce8HhqjQt4AtR3a70MSweC5F5StUgW0c,3479
 lfx/workflow/adapters/langflow.py,sha256=0RT1uZWBz7O1JmOlfiQVruvXBIX8FPhXwGdLQchvJ5I,8845
-lfx-1.14.0.dev2.dist-info/METADATA,sha256=Y1YvsS_zBbtNgbk6Box-H02VzYNhS_S9rrjY_P3r-1g,35297
-lfx-1.14.0.dev2.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-lfx-1.14.0.dev2.dist-info/entry_points.txt,sha256=jKPaACW4536e5puzF8Po_sPx7_GvktOBvttxOwJiMMs,104
-lfx-1.14.0.dev2.dist-info/RECORD,,
+lfx-1.14.0.dev4.dist-info/METADATA,sha256=xbk4nzHr3j80nfYOVWkWrFXUthpg-rXzPDNw28ZDgFY,35385
+lfx-1.14.0.dev4.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+lfx-1.14.0.dev4.dist-info/entry_points.txt,sha256=jKPaACW4536e5puzF8Po_sPx7_GvktOBvttxOwJiMMs,104
+lfx-1.14.0.dev4.dist-info/RECORD,,