Skip to content

Conversation

@jordanrfrazier
Copy link
Collaborator

@jordanrfrazier jordanrfrazier commented Sep 24, 2025

Fixes issue where agent is streaming cumulative messages instead of partial.

Summary by CodeRabbit

  • New Features

    • Added a configurable option to enable/disable superuser creation via CLI.
    • Improved authentication settings descriptions and defaults for safer production use.
  • Bug Fixes

    • More reliable chat streaming: prevents duplicate final messages and correctly accumulates partial chunks.
    • Improved handling of mixed image/text inputs to avoid empty messages.
    • Filters out empty messages to reduce validation issues.
  • Documentation

    • Expanded security guidance on authentication, auto-login behavior, and secure deployment examples.
  • Tests

    • Added comprehensive CLI superuser tests covering production and auto-login scenarios.
  • Chores

    • Bumped backend and frontend versions to 1.5.1.

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Sep 24, 2025

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

Introduces an auth-gated superuser CLI flow with optional token validation, adds a setting to enable/disable the CLI, refines AUTO_LOGIN semantics, updates security guidance, adjusts agent streaming event handling and frontend accumulation, filters empty messages, tweaks tool arg default handling, adds a user CRUD helper, and bumps versions.

Changes

Cohort / File(s) Summary
Auth + Superuser CLI flow
src/backend/base/langflow/__main__.py, src/backend/base/langflow/services/settings/auth.py, src/backend/base/langflow/services/utils.py, src/backend/base/langflow/services/database/models/user/crud.py, src/backend/tests/unit/test_cli.py
Reworked superuser CLI with auth_token support, default creds handling under AUTO_LOGIN, ability to disable via ENABLE_SUPERUSER_CLI, audit/error handling; added get_all_superusers; tightened setup_superuser; comprehensive CLI tests.
Security docs
SECURITY.md
Expanded notes on AUTO_LOGIN/security, versioned behavior, API key/auth guidance, production configuration example, and superuser CLI security notes.
Env and settings
.env.example
Added LANGFLOW_ENABLE_SUPERUSER_CLI; clarified LANGFLOW_AUTO_LOGIN comment; minor formatting.
Agent streaming pipeline
src/backend/base/langflow/base/agents/events.py, src/backend/base/langflow/base/agents/agent.py, src/backend/base/langflow/base/agents/utils.py, src/frontend/src/modals/IOModal/components/chatView/components/chat-view.tsx, src/frontend/src/stores/messagesStore.ts
Introduced had_streaming flag; adjusted on_chain_end/stream behavior; filtered empty messages; refined input text extraction with images; frontend guards streaming updates and accumulates partial text safely.
Tooling minor fix
src/backend/base/langflow/components/tools/python_code_structured_tool.py
Stringifies constant default values for parsed function arguments.
Dataframe typing
src/backend/base/langflow/schema/dataframe.py
Added type ignore comment to bool without changing behavior.
Version bumps
pyproject.toml, src/backend/base/pyproject.toml, src/frontend/package.json
Bumped versions to 1.5.1 (root/frontend) and 0.5.1 (backend base).

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant Dev as Developer (CLI)
  participant CLI as langflow CLI
  participant Settings as SettingsService/AuthSettings
  participant DB as Database
  participant Auth as Token Validator
  participant Audit as Logger

  rect rgba(200,220,255,0.25)
  note over CLI,Settings: Superuser creation entry
  Dev->>CLI: langflow superuser [--username --password --auth-token]
  CLI->>Settings: Read AUTO_LOGIN, ENABLE_SUPERUSER_CLI
  alt ENABLE_SUPERUSER_CLI == false
    CLI-->>Dev: Exit(1): creation disabled
  else AUTO_LOGIN == true
    note over CLI: Force default username/password
    CLI->>DB: Check existing superusers
    alt First-time setup
      CLI->>DB: Create default superuser
      CLI->>DB: Create default folder
      CLI->>Audit: Log success
      CLI-->>Dev: Exit(0)
    else Additional superuser
      CLI-->>Dev: Exit(1): blocked in AUTO_LOGIN
    end
  else AUTO_LOGIN == false
    CLI->>DB: Check existing superusers
    alt Creating first superuser
      CLI->>Auth: Validate auth_token (JWT/API key)
      alt Valid and has superuser
        CLI->>DB: Create superuser
        CLI->>DB: Create default folder
        CLI->>Audit: Log success
        CLI-->>Dev: Exit(0)
      else Invalid/insufficient
        CLI->>Audit: Log failure
        CLI-->>Dev: Exit(1)
      end
    else Additional superuser
      CLI->>Auth: Validate auth_token (must be superuser)
      alt Valid superuser
        CLI->>DB: Create superuser
        CLI->>Audit: Log success
        CLI-->>Dev: Exit(0)
      else Invalid
        CLI->>Audit: Log failure
        CLI-->>Dev: Exit(1)
      end
    end
  end
  end
Loading
sequenceDiagram
  autonumber
  participant Backend as Agent/Event Handlers
  participant FE as ChatView
  participant Store as messagesStore

  note over Backend: on_chain_start
  Backend-->>FE: Initial message (state: running)

  par Streaming chunks
    loop For each chunk
      Backend-->>FE: on_chain_stream (chunk text, state: partial)
      FE->>Store: addMessage(partial)
      Store->>Store: append text to existing message
      FE->>FE: isStreamingUpdate only if both contents exist and grow
    end
  and Completion
    Backend-->>FE: on_chain_end (final)
    alt had_streaming == true
      note over FE: Skip final text send (already accumulated)
    else
      FE->>Store: finalize message with output text
    end
  end
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

Suggested labels

bug, size:XL, lgtm

Suggested reviewers

  • ogabrielluiz
  • deon-sanchez
  • Cristhianzl

Pre-merge checks and finishing touches

❌ Failed checks (2 warnings)
Check name Status Explanation Resolution
Title Check ⚠️ Warning The provided title only mentions the agent streaming fix, but the changeset also includes environment variable additions, security documentation updates, version bumps, CLI enhancements, and other unrelated modifications, so it does not accurately summarize the main scope of the PR. Please revise the title to reflect the full scope of changes or split this large PR into smaller, focused PRs each with a clear, concise title that highlights its core purpose.
Docstring Coverage ⚠️ Warning Docstring coverage is 46.15% which is insufficient. The required threshold is 80.00%. You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (1 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@jordanrfrazier jordanrfrazier changed the base branch from main to release-1.5.1 September 24, 2025 19:37
input_dict["input"].content = text_content
else:
# If no text content, convert to empty string to avoid empty message
input_dict["input"] = ""
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this handles some empty message errors I was seeing with bedrock - it raises an error if the content is none

@github-actions github-actions bot added bug Something isn't working and removed bug Something isn't working labels Sep 24, 2025
Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (6)
src/backend/base/langflow/schema/dataframe.py (1)

138-143: Use a targeted ignore for the override and keep the return annotation explicit.

# type: ignore[misc] silences every possible diagnostic on this definition. The mypy complaint here is specifically an override incompatibility, so we can scope the suppression to that and keep the function type‑checked. While you’re touching the line, please also retain the explicit -> bool return annotation so the intent stays clear.

-    def __bool__(self):  # type: ignore[misc]
+    def __bool__(self) -> bool:  # type: ignore[override]
.env.example (1)

78-82: Improve the description for clarity.

The comment references "LANGFLOW_AUTO_LOGIN" but then mentions "AUTO_LOGIN" without the prefix, which could be confusing.

Apply this diff to make the description more consistent:

-# Set LANGFLOW_AUTO_LOGIN to false if you want to disable auto login
+# Set LANGFLOW_AUTO_LOGIN to false if you want to disable auto login
 # and use the login form to login. LANGFLOW_SUPERUSER and LANGFLOW_SUPERUSER_PASSWORD
-# must be set if AUTO_LOGIN is set to false
+# must be set if LANGFLOW_AUTO_LOGIN is set to false
src/backend/base/langflow/services/utils.py (2)

79-79: Add explicit type annotation for consistency.

While the type annotation addition is good, consider importing SettingsService at the module level for consistency with other type hints in the codebase.

+from langflow.services.settings.manager import SettingsService
+
 async def setup_superuser(settings_service: SettingsService, session: AsyncSession) -> None:

90-92: Good validation, but consider a more specific error message.

The validation ensures both credentials are present, which is essential. Consider making the error message more specific about which credential is missing.

-    if not username or not password:
-        msg = "Username and password must be set"
-        raise ValueError(msg)
+    if not username:
+        msg = "Username must be set for superuser creation"
+        raise ValueError(msg)
+    if not password:
+        msg = "Password must be set for superuser creation"
+        raise ValueError(msg)
src/backend/base/langflow/__main__.py (1)

846-846: Consider implementing non-AUTO_LOGIN API key creation.

The TODO comment indicates a missing feature. For production deployments, users should be able to create API keys through the CLI with proper authentication.

Would you like me to help implement API key creation for non-AUTO_LOGIN scenarios? This could follow a similar pattern to the superuser creation flow with token-based authentication.

src/backend/base/langflow/base/agents/agent.py (1)

153-153: Consider optimizing list comprehension for readability.

The current implementation creates two separate list comprehensions for filtering. Consider using a single pass approach for better performance when dealing with large content lists.

Apply this diff to optimize the filtering:

-            image_dicts = [item for item in input_dict["input"].content if item.get("type") == "image"]
-            text_content = [item for item in input_dict["input"].content if item.get("type") != "image"]
+            image_dicts = []
+            text_content = []
+            for item in input_dict["input"].content:
+                if item.get("type") == "image":
+                    image_dicts.append(item)
+                else:
+                    text_content.append(item)
📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 925767d and e2ebbcc.

⛔ Files ignored due to path filters (2)
  • src/frontend/package-lock.json is excluded by !**/package-lock.json
  • uv.lock is excluded by !**/*.lock
📒 Files selected for processing (17)
  • .env.example (2 hunks)
  • SECURITY.md (1 hunks)
  • pyproject.toml (1 hunks)
  • src/backend/base/langflow/__main__.py (4 hunks)
  • src/backend/base/langflow/base/agents/agent.py (1 hunks)
  • src/backend/base/langflow/base/agents/events.py (7 hunks)
  • src/backend/base/langflow/base/agents/utils.py (1 hunks)
  • src/backend/base/langflow/components/tools/python_code_structured_tool.py (1 hunks)
  • src/backend/base/langflow/schema/dataframe.py (1 hunks)
  • src/backend/base/langflow/services/database/models/user/crud.py (1 hunks)
  • src/backend/base/langflow/services/settings/auth.py (1 hunks)
  • src/backend/base/langflow/services/utils.py (1 hunks)
  • src/backend/base/pyproject.toml (1 hunks)
  • src/backend/tests/unit/test_cli.py (2 hunks)
  • src/frontend/package.json (1 hunks)
  • src/frontend/src/modals/IOModal/components/chatView/components/chat-view.tsx (1 hunks)
  • src/frontend/src/stores/messagesStore.ts (2 hunks)
🧰 Additional context used
📓 Path-based instructions (9)
{src/backend/**/*.py,tests/**/*.py,Makefile}

📄 CodeRabbit inference engine (.cursor/rules/backend_development.mdc)

{src/backend/**/*.py,tests/**/*.py,Makefile}: Run make format_backend to format Python code before linting or committing changes
Run make lint to perform linting checks on backend Python code

Files:

  • src/backend/base/langflow/services/database/models/user/crud.py
  • src/backend/base/langflow/base/agents/agent.py
  • src/backend/base/langflow/schema/dataframe.py
  • src/backend/base/langflow/base/agents/utils.py
  • src/backend/base/langflow/components/tools/python_code_structured_tool.py
  • src/backend/base/langflow/base/agents/events.py
  • src/backend/tests/unit/test_cli.py
  • src/backend/base/langflow/services/settings/auth.py
  • src/backend/base/langflow/services/utils.py
  • src/backend/base/langflow/__main__.py
src/backend/base/langflow/services/database/models/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/backend_development.mdc)

Place database models in src/backend/base/langflow/services/database/models/

Files:

  • src/backend/base/langflow/services/database/models/user/crud.py
src/frontend/src/**/*.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (.cursor/rules/frontend_development.mdc)

src/frontend/src/**/*.{ts,tsx,js,jsx}: All frontend TypeScript and JavaScript code should be located under src/frontend/src/ and organized into components, pages, icons, stores, types, utils, hooks, services, and assets directories as per the specified directory layout.
Use React 18 with TypeScript for all UI components in the frontend.
Format all TypeScript and JavaScript code using the make format_frontend command.
Lint all TypeScript and JavaScript code using the make lint command.

Files:

  • src/frontend/src/modals/IOModal/components/chatView/components/chat-view.tsx
  • src/frontend/src/stores/messagesStore.ts
src/backend/base/langflow/components/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/backend_development.mdc)

src/backend/base/langflow/components/**/*.py: Add new backend components to the appropriate subdirectory under src/backend/base/langflow/components/
Implement async component methods using async def and await for asynchronous operations
Use asyncio.create_task for background work in async components and ensure proper cleanup on cancellation
Use asyncio.Queue for non-blocking queue operations in async components and handle timeouts appropriately

Files:

  • src/backend/base/langflow/components/tools/python_code_structured_tool.py
src/backend/**/components/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/icons.mdc)

In your Python component class, set the icon attribute to a string matching the frontend icon mapping exactly (case-sensitive).

Files:

  • src/backend/base/langflow/components/tools/python_code_structured_tool.py
src/backend/tests/unit/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/backend_development.mdc)

Test component integration within flows using create_flow, build_flow, and get_build_events utilities

Files:

  • src/backend/tests/unit/test_cli.py
src/backend/tests/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/testing.mdc)

src/backend/tests/**/*.py: Unit tests for backend code must be located in the 'src/backend/tests/' directory, with component tests organized by component subdirectory under 'src/backend/tests/unit/components/'.
Test files should use the same filename as the component under test, with an appropriate test prefix or suffix (e.g., 'my_component.py' → 'test_my_component.py').
Use the 'client' fixture (an async httpx.AsyncClient) for API tests in backend Python tests, as defined in 'src/backend/tests/conftest.py'.
When writing component tests, inherit from the appropriate base class in 'src/backend/tests/base.py' (ComponentTestBase, ComponentTestBaseWithClient, or ComponentTestBaseWithoutClient) and provide the required fixtures: 'component_class', 'default_kwargs', and 'file_names_mapping'.
Each test in backend Python test files should have a clear docstring explaining its purpose, and complex setups or mocks should be well-commented.
Test both sync and async code paths in backend Python tests, using '@pytest.mark.asyncio' for async tests.
Mock external dependencies appropriately in backend Python tests to isolate unit tests from external services.
Test error handling and edge cases in backend Python tests, including using 'pytest.raises' and asserting error messages.
Validate input/output behavior and test component initialization and configuration in backend Python tests.
Use the 'no_blockbuster' pytest marker to skip the blockbuster plugin in tests when necessary.
Be aware of ContextVar propagation in async tests; test both direct event loop execution and 'asyncio.to_thread' scenarios to ensure proper context isolation.
Test error handling by mocking internal functions using monkeypatch in backend Python tests.
Test resource cleanup in backend Python tests by using fixtures that ensure proper initialization and cleanup of resources.
Test timeout and performance constraints in backend Python tests using 'asyncio.wait_for' and timing assertions.
Test Langflow's Messag...

Files:

  • src/backend/tests/unit/test_cli.py
src/frontend/src/stores/**/*.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (.cursor/rules/frontend_development.mdc)

Use Zustand for state management in frontend stores.

Files:

  • src/frontend/src/stores/messagesStore.ts
src/frontend/@(package*.json|tsconfig.json|tailwind.config.*|vite.config.*)

📄 CodeRabbit inference engine (.cursor/rules/frontend_development.mdc)

Frontend configuration files such as package.json, tsconfig.json, and Tailwind/Vite configs must be maintained and updated as needed.

Files:

  • src/frontend/package.json
🧠 Learnings (1)
📚 Learning: 2025-07-18T18:27:12.609Z
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/frontend_development.mdc:0-0
Timestamp: 2025-07-18T18:27:12.609Z
Learning: Applies to src/frontend/@(package*.json|tsconfig.json|tailwind.config.*|vite.config.*) : Frontend configuration files such as package.json, tsconfig.json, and Tailwind/Vite configs must be maintained and updated as needed.

Applied to files:

  • src/frontend/package.json
🧬 Code graph analysis (6)
src/backend/base/langflow/services/database/models/user/crud.py (2)
src/backend/base/langflow/services/database/models/user/model.py (1)
  • User (25-51)
src/backend/tests/unit/api/v2/test_mcp_servers_file.py (2)
  • exec (46-59)
  • all (38-39)
src/backend/base/langflow/base/agents/utils.py (1)
src/backend/base/langflow/memory.py (1)
  • messages (298-302)
src/backend/base/langflow/base/agents/events.py (2)
src/backend/base/langflow/schema/message.py (1)
  • Message (39-288)
src/backend/base/langflow/schema/log.py (1)
  • SendMessageFunctionType (16-29)
src/backend/tests/unit/test_cli.py (2)
src/backend/base/langflow/__main__.py (1)
  • _create_superuser (653-763)
src/backend/tests/conftest.py (1)
  • active_super_user (486-511)
src/backend/base/langflow/services/utils.py (2)
src/backend/tests/unit/api/v2/test_mcp_servers_file.py (1)
  • settings_service (95-96)
src/backend/base/langflow/services/settings/manager.py (1)
  • SettingsService (13-49)
src/backend/base/langflow/__main__.py (5)
src/backend/base/langflow/services/database/models/api_key/crud.py (1)
  • check_key (52-61)
src/backend/base/langflow/services/auth/utils.py (2)
  • get_current_user_by_jwt (160-218)
  • create_super_user (285-305)
src/backend/base/langflow/services/deps.py (3)
  • get_db_service (133-142)
  • get_settings_service (117-130)
  • session_scope (157-179)
src/backend/base/langflow/services/database/models/user/crud.py (1)
  • get_all_superusers (65-69)
src/backend/base/langflow/initial_setup/setup.py (1)
  • get_or_create_default_folder (1022-1056)
🔇 Additional comments (29)
src/backend/base/langflow/components/tools/python_code_structured_tool.py (1)

301-302: LGTM! Improved string consistency for constant defaults.

The change to stringify constant values via str(default.value) when the value is not None ensures consistent string representation in the parsed function argument structures. This addresses potential type inconsistencies while properly handling None values.

src/frontend/package.json (1)

3-3: Version bump aligned with coordinated release.

The version increment from 1.5.0 to 1.5.1 is consistent with the broader coordinated version bump across the repository (frontend, backend, and root project files). This aligns with the PR's objective to fix agent streaming behavior.

src/backend/base/pyproject.toml (1)

3-3: Backend version bump coordinated with release.

The version change from 0.5.0 to 0.5.1 is consistent with the coordinated version upgrade across the project. The dependency and configuration remain unchanged, focusing this release on functional fixes rather than dependency updates.

pyproject.toml (1)

3-3: Root project version bump coordinated with release.

The version change from 1.5.0.post1 to 1.5.1 properly coordinates with the frontend and backend version bumps, indicating this is a cohesive release addressing the agent streaming issues described in the PR title.

.env.example (1)

84-87: Good security-focused environment variable addition.

The new LANGFLOW_ENABLE_SUPERUSER_CLI variable provides essential security controls for production deployments, allowing administrators to disable CLI-based superuser creation. The descriptive comment clearly explains its purpose.

SECURITY.md (2)

53-63: Comprehensive security documentation for authentication changes.

The new documentation clearly explains the evolution of authentication requirements and provides actionable guidance for users upgrading from pre-1.5 versions. The versioning information and deprecation timeline for LANGFLOW_SKIP_AUTH_AUTO_LOGIN is well-documented.


64-95: Excellent production security guidelines.

The superuser creation security section provides comprehensive guidance with clear security measures and a complete production configuration example. This addresses the security concerns around CLI-based superuser creation mentioned in the environment variables.

src/frontend/src/stores/messagesStore.ts (2)

21-31: Core fix for agent streaming cumulative token issue.

This change correctly addresses the PR's main objective. The logic now differentiates between:

  • Partial streaming messages: Accumulates text via updateMessageText while preserving other properties
  • Complete messages: Replaces the message entirely via updateMessagePartial

This prevents cumulative token replacement and enables proper incremental streaming as intended.


72-72: Defensive programming for text concatenation.

The addition of || "" prevents potential undefined + chunk scenarios during streaming, ensuring robust text accumulation. This complements the partial message handling logic.

src/frontend/src/modals/IOModal/components/chatView/components/chat-view.tsx (1)

229-230: Enhanced streaming detection logic.

The additional truthiness checks for both currentMessageContent and lastMessageContent prevent false positives in streaming detection when either content is missing. This works in conjunction with the messagesStore changes to ensure proper streaming behavior.

src/backend/base/langflow/services/settings/auth.py (2)

30-37: Well-documented security-focused field definition.

The transformation of AUTO_LOGIN from a simple boolean to a Field with comprehensive security warnings is excellent. The description clearly indicates this is a development-only feature and warns about production security implications.


43-47: Essential security control for CLI access.

The new ENABLE_SUPERUSER_CLI setting provides critical security control for production environments, allowing administrators to completely disable CLI-based superuser creation. The field definition and documentation are clear and security-focused.

src/backend/base/langflow/base/agents/events.py (5)

56-56: Unused parameter had_streaming in handle_on_chain_start.

The had_streaming parameter is added to maintain API consistency but is never used in the function body. Consider whether this parameter should be utilized or if it was intended only for API uniformity.


101-119: LGTM! Improved text extraction for streaming chunks.

The enhanced _extract_output_text function now properly handles various dictionary shapes that can occur during streaming, including content/message fields and metadata-only chunks. This aligns well with the PR's objective to fix partial message streaming.


144-147: Good fix for preventing duplicate final messages during streaming.

The conditional sending of the final message based on had_streaming correctly prevents the issue where cumulative messages were being sent. When streaming occurred, the frontend has already accumulated chunks, so sending the complete message again would be redundant.


276-283: Correct implementation of partial message streaming.

The change from appending to replacing agent_message.text with chunk content correctly implements incremental streaming. The frontend accumulates these partial chunks, fixing the issue where cumulative messages were being sent. The conditional update of start_time for non-empty chunks is also a good optimization.


341-359: LGTM! Proper streaming event tracking and handler invocation.

The implementation correctly tracks streaming events and passes the had_streaming flag to the appropriate handlers. The logic distinguishes between streaming events (on_chain_stream, on_chat_model_stream) and properly propagates this information to handle_on_chain_end.

src/backend/base/langflow/services/database/models/user/crud.py (1)

65-69: LGTM! Clean implementation of superuser retrieval.

The function correctly queries for all superusers and returns them as a list. This supports the new CLI superuser creation flow which needs to check for existing superusers.

src/backend/base/langflow/services/utils.py (1)

82-88: LGTM! Clearer credential flow with explicit variable assignment.

The explicit assignment of username and password from defaults or settings makes the credential flow more transparent and maintainable. This aligns well with the enhanced superuser creation logic in the CLI.

src/backend/tests/unit/test_cli.py (5)

63-64: LGTM! Well-structured test class for CLI superuser commands.

The test class provides good organization and uses the xdist_group marker appropriately to prevent parallel execution conflicts when testing superuser operations.


66-83: Good test coverage for production mode authentication requirement.

The test correctly verifies that additional superuser creation in production mode (AUTO_LOGIN=False) requires authentication. The patching strategy properly isolates the settings service.


85-102: LGTM! Proper validation of AUTO_LOGIN mode restrictions.

The test correctly verifies that AUTO_LOGIN mode prevents creation of additional superusers, enforcing the single default superuser constraint for development environments.


104-119: Good security test for CLI feature flag.

The test properly validates that the ENABLE_SUPERUSER_CLI setting can disable superuser creation via CLI, which is an important security control.


129-147: LGTM! Comprehensive auth token validation test.

The test properly covers the authentication failure path, including both JWT and API key validation failures. Good use of mocking to simulate authentication errors.

src/backend/base/langflow/__main__.py (3)

653-763: Well-structured superuser creation with comprehensive security controls.

The _create_superuser function implements a robust authentication flow with:

  • Proper CLI feature flag checking (ENABLE_SUPERUSER_CLI)
  • Different behavior for AUTO_LOGIN vs production modes
  • Strong authentication requirements for creating additional superusers
  • Security audit logging for both successful and failed attempts
  • Default folder creation for new superusers

The implementation correctly addresses the security requirements outlined in the PR objectives.


632-636: Good CLI interface improvements for superuser command.

The updated command signature with clearer help text and support for both AUTO_LOGIN defaults and production mode credentials improves usability while maintaining security.


707-731: Robust token validation with proper error handling.

The authentication validation correctly:

  • Attempts JWT authentication first
  • Falls back to API key validation
  • Properly handles and re-raises typer.Exit without wrapping
  • Provides clear error messages for different failure scenarios
src/backend/base/langflow/base/agents/agent.py (2)

152-160: Fix: Handle empty text content properly when images are present.

The logic correctly addresses the issue by filtering text content from image content and handling the case where only images are present. This prevents sending empty messages when all content is image-based.


156-160: Verify downstream handling of empty-string input Confirm that consumers of input_dict["input"] (e.g., event builders in events.py and agent execution pipelines) accept "" without errors or skipping critical logic.

Comment on lines 51 to 56
messages = []
for value in data:
# Skip messages with empty or None text to avoid ValidationException
if hasattr(value, 'text') and value.text and str(value.text).strip():
messages.append(value.to_lc_message())
return messages
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Avoid dropping non-text messages in streaming path

Filtering on hasattr(value, "text") and value.text skips any Data instances whose text is empty/None even though they may still carry valid content in additional_kwargs (e.g., tool call deltas or other streaming payloads). Those messages used to reach the LLM; now they silently disappear, breaking tool-call acknowledgement and similar flows.

A safer way is to guard only the .strip() call while still emitting the message whenever to_lc_message() succeeds.

-    for value in data:
-        # Skip messages with empty or None text to avoid ValidationException
-        if hasattr(value, 'text') and value.text and str(value.text).strip():
-            messages.append(value.to_lc_message())
+    for value in data:
+        text = getattr(value, "text", None)
+        if isinstance(text, str) and not text.strip():
+            continue
+        try:
+            messages.append(value.to_lc_message())
+        except ValidationError:
+            continue

(Replace the ValidationError import with the concrete exception you are seeing.) This keeps the fix for blank strings without regressing non-text payloads.

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents
In src/backend/base/langflow/base/agents/utils.py around lines 51–56, the
current filter drops Data instances with empty/None text even when they carry
valid non-text payloads; instead, call value.to_lc_message() and append the
resulting message whenever conversion succeeds, but skip only when the instance
has a text attribute that is a blank string after strip. Concretely: iterate
each value, try to produce msg = value.to_lc_message(), then if hasattr(value,
"text") and value.text is not None and str(value.text).strip() == "" skip
appending, otherwise append msg; catch and handle the concrete validation
exception raised by to_lc_message (replace the generic ValidationError import
with the actual exception you see) so non-convertible items are still safely
skipped without losing non-text payloads.

@github-actions github-actions bot added bug Something isn't working and removed bug Something isn't working labels Sep 24, 2025
@github-actions github-actions bot added bug Something isn't working and removed bug Something isn't working labels Sep 24, 2025
@github-actions github-actions bot added bug Something isn't working and removed bug Something isn't working labels Sep 24, 2025
@github-actions github-actions bot added bug Something isn't working and removed bug Something isn't working labels Sep 24, 2025
if isinstance(text, str) and not text.strip():
# Skip only messages with empty/whitespace-only text strings
continue

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If I don't do this, I get errors like:

 Details: An error occurred (ValidationException) when calling the ConverseStream operation: The content field in the Message object at messages.6 is empty. Add a ContentBlock object to the content 
  field and try again.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is very weird. Maybe there's a langchain version problem causing this.

@github-actions github-actions bot added bug Something isn't working and removed bug Something isn't working labels Sep 24, 2025
@jordanrfrazier jordanrfrazier changed the base branch from release-1.5.1 to release-1.5.2 September 24, 2025 20:19
@github-actions github-actions bot added bug Something isn't working and removed bug Something isn't working labels Sep 24, 2025
agent_message.text = output_text
agent_message.properties.state = "partial"
agent_message = await send_message_method(message=agent_message)
if not agent_message.text:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why remove this?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if not agent_message.text: was here to only start the time counter if the message just started being generated.

@github-actions github-actions bot added bug Something isn't working and removed bug Something isn't working labels Sep 24, 2025
@sonarqubecloud
Copy link

@CPP-Flipper
Copy link

Will this be merged into 1.6.0? Or a separate one like 1.5.2 for a future release?

@Empreiteiro
Copy link
Collaborator

@CPP-Flipper Since 1.6 has already been released, this and the next PRS should be merged into main.

@CPP-Flipper
Copy link

@jordanrfrazier why was this closed?

@jordanrfrazier
Copy link
Collaborator Author

@jordanrfrazier why was this closed?

Reopened in another PR - #10216

That PR will be merged and released in v1.6.5 (coming in the next few days)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants