Merge release-1.11.0 into main

Author: erichare

.agents/skills/e2e-testing/SKILL.md

@@ -167,17 +167,19 @@ withEventDeliveryModes(
 
 ## Tags System
 
-Every test MUST have at least one tag. Tags enable filtering and CI pipeline configuration.
+Every test MUST be tagged with `@release` — the release run greps for it, so an
+untagged or wrongly-tagged spec silently drops out of release coverage. Add the
+domain tag(s) below on top of `@release` (a test can have more than one). These
+six are the only allowed tags; do not invent new ones.
 
 | Tag | Purpose | When to Use |
 |-----|---------|-------------|
-| `@release` | Tests that must pass before release | Critical user flows |
+| `@release` | Part of the release run (required on every spec) | All tests |
 | `@workspace` | Workspace/flow management | Creating, editing, deleting flows |
 | `@api` | API-dependent features | Tests that call backend endpoints |
 | `@database` | Database operations | Tests involving persistence |
 | `@components` | Component-level tests | Individual component behavior |
 | `@starter-projects` | Template/starter project tests | Pre-built flow templates |
-| `@regression` | Bug regression tests | Tests for specific fixed bugs |
 
 ```typescript
 // Right: tag your test
@@ -322,7 +324,7 @@ test.skip(true, "Feature not yet implemented with new designs");
 ## Writing Good E2E Tests
 
 ### Do:
-- **Tag every test** with at least one tag
+- **Tag every test** with `@release` (plus any domain tags that apply)
 - **Import from `../../fixtures`**, not `@playwright/test`
 - **Start with `awaitBootstrapTest(page)`** — always
 - **Use `getByTestId`** for stable selectors

.agents/skills/frontend-a11y-check/SKILL.md

@@ -37,6 +37,7 @@ Notes when using this skill:
 - **Code quality**: For any reviewed file, follow [references/code-quality.md](references/code-quality.md) to check styling conventions, TypeScript usage, Biome compliance, and component patterns.
 - **Performance**: If the review scope involves React components, hooks, Zustand stores, React Query usage, or @xyflow/react node rendering, follow [references/performance.md](references/performance.md) to check for re-render issues, memoization, and data flow patterns.
 - **Business logic**: If the review scope involves custom nodes (GenericNode), flow state, API calls, the component system, global variables, or the inspection panel, follow [references/business-logic.md](references/business-logic.md) to check for Langflow-specific correctness.
+- **i18n**: If the diff adds or changes user-facing text (labels, buttons, tooltips, modals, toasts, errors, placeholders, aria-labels), follow the [frontend-i18n skill](../frontend-i18n/SKILL.md): no hardcoded UI strings — everything through `t(...)` — and every new key present in **all** locale files (`src/frontend/src/locales/*.json`).
 
 ## General Review Rules
 

.agents/skills/frontend-code-review/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: frontend-i18n
+description: Add, change, or review user-facing text in the Langflow frontend using the i18n system (i18next / react-i18next). Use whenever a change adds or edits UI strings — labels, buttons, tooltips, modals, toasts, error messages, empty states — or when reviewing a diff that contains user-facing text. Every user-facing string must go through the translation system and every new key must exist in ALL locale files. Do NOT use for backend strings, log messages, or code identifiers.
+---
+
+# Frontend i18n
+
+The Langflow frontend is internationalized with **i18next + react-i18next**. Locales live in `src/frontend/src/locales/` — currently `en`, `de`, `es`, `fr`, `ja`, `pt`, `zh-Hans`. A hardcoded user-facing string, or a key missing from one locale, ships broken UI for part of the user base.
+
+## The two rules
+
+1. **Every user-facing string goes through `t(...)`** — never hardcoded JSX text for labels, buttons, tooltips, modals, toasts, errors, placeholders, `aria-label`s, or empty states.
+2. **Every new key is added to ALL locale files in the same PR** (`en.json`, `de.json`, `es.json`, `fr.json`, `ja.json`, `pt.json`, `zh-Hans.json`). `fallbackLng: "en"` means a missing key silently shows English — it won't crash, which is exactly why reviews must catch it.
+
+## How it works here
+
+- Config: `src/frontend/src/i18n.ts` — a custom i18next instance. `en` is bundled statically; other languages are **lazy-loaded** by `loadLanguage()` via dynamic import. Language preference comes from `localStorage.getItem("languagePreference")`, normalized (e.g. `zh-CN` → `zh-Hans`, unknown → `en`).
+- Keys are **flat, dot-namespaced by feature**: `deleteModal.title`, `errors.fileTooLarge`, `crash.restartButton`. Follow the existing namespace of the area you're touching; create a new prefix only for a genuinely new surface.
+- Interpolation uses `{{variable}}` in the string and an options object in the call.
+
+## Adding a string (the pattern)
+
+```tsx
+import { useTranslation } from "react-i18next";
+
+const { t } = useTranslation();
+
+<span>{t("deleteModal.title")}</span>
+<p>{t("errors.fileTooLarge", { maxSizeMB: "10MB" })}</p>
+```
+
+In `locales/en.json` (and **every** other locale file):
+
+```json
+"errors.fileTooLarge": "The file size is too large. Please select a file smaller than {{maxSizeMB}}."
+```
+
+For the non-English locales, write a real translation when confident; if not, add the key with the English value and flag it in the PR — a present-but-untranslated key is visible and searchable, a missing key is invisible.
+
+## Rules that prevent real bugs
+
+- **Don't concatenate translated fragments** (`t("a") + name + t("b")`) — word order differs across languages. Use one key with interpolation: `t("greeting", { name })`.
+- **Don't put JSX/HTML inside translation strings**; compose in JSX around `t()` calls (see how `crash.descriptionBefore` / `crash.githubIssues` / `crash.descriptionAfter` split around a link).
+- **Plurals**: use i18next plural forms (`_one` / `_other` suffixes), not `count === 1 ? ... : ...`.
+- **Keys are code**: renaming or deleting a key means updating **all seven** locale files — an orphan key in one file is dead weight; a rename missed in one file is a regression.
+- Dates/numbers/currency: format with `Intl.*` using the active locale, never hardcoded formats.
+
+## Review checklist (apply to any diff with UI text)
+
+- [ ] No hardcoded user-facing string in JSX (including `placeholder`, `title`, `aria-label`, toast/error text).
+- [ ] Every new key exists in **all** locale files (grep the key across `src/frontend/src/locales/*.json`).
+- [ ] No concatenation of translated fragments; interpolation used instead.
+- [ ] Removed/renamed keys cleaned up in all locales (no orphans).
+- [ ] Key follows the existing dot-namespace of the feature area.
+
+Quick check for a key across locales:
+
+```bash
+for f in src/frontend/src/locales/*.json; do grep -L '"my.new.key"' "$f"; done
+```
+
+(prints the locale files where the key is **missing** — should print nothing)

.agents/skills/frontend-i18n/SKILL.md

@@ -33,7 +33,7 @@ Activate this skill when:
 - **Path alias**: `@/` maps to `<rootDir>/src/`
 - **Test match patterns**: `src/**/__tests__/**/*.{test,spec}.{ts,tsx}` and `src/**/*.{test,spec}.{ts,tsx}`
 - **Transform**: Custom `transform-import-meta.js` handles `import.meta` for Jest compatibility
-- **Global mocks** (in `jest.setup.js`): `@radix-ui/react-form`, `react-markdown`, `lucide-react/dynamicIconImports`, `@/components/common/genericIconComponent`, `@/icons/BotMessageSquare`, `@/stores/darkStore`, `localStorage`, `sessionStorage`, `crypto`
+- **Global mocks** (in `jest.setup.js`): `@radix-ui/react-form`, `react-markdown`, `remark-gfm`, `remark-math`, `rehype-mathjax/browser`, `lucide-react/dynamicIconImports`, `@/components/common/genericIconComponent`, `@/icons/BotMessageSquare`, `@/stores/darkStore`, `localStorage`, `sessionStorage`, `crypto`
 
 ## Key Commands
 

.agents/skills/frontend-testing/SKILL.md

@@ -21,6 +21,7 @@ These modules are already mocked in `jest.setup.js`. Do NOT re-mock them unless
 
 - `@radix-ui/react-form` (all exports render children)
 - `react-markdown` (renders null)
+- `remark-gfm`, `remark-math`, `rehype-mathjax/browser` (no-op plugins; pure ESM that fails to parse under jest)
 - `lucide-react/dynamicIconImports` (empty object)
 - `@/components/common/genericIconComponent` (renders null)
 - `@/icons/BotMessageSquare` (renders null)

.agents/skills/frontend-testing/references/mocking.md

@@ -0,0 +1,184 @@
+---
+name: ibm-a11y-automation
+description: Run Langflow's local accessibility scanner script against frontend routes from src/frontend/src/routes.tsx and summarize the JSON report.
+---
+
+# Langflow Accessibility Scanner
+
+Use this skill when asked to scan Langflow frontend pages for accessibility issues.
+
+## Scanner
+
+Use the Python script:
+
+```bash
+uv run python scripts/a11y/a11y_scan.py \
+  --url http://localhost:3000 \
+  --routes-file scripts/a11y/a11y_routes.json \
+  --route-group static \
+  --out /tmp/langflow-a11y-report.json \
+  --markdown /tmp/langflow-a11y-report.md \
+  --html /tmp/langflow-a11y-report.html \
+  --timeout-ms 45000
+```
+
+Script options:
+
+- `--url`: base app URL, usually `http://localhost:3000`.
+- `--routes-file`: route manifest JSON file. Prefer `scripts/a11y/a11y_routes.json`.
+- `--route-group`: manifest group to scan. Default: `static`.
+- `--routes`: comma-separated route paths to scan.
+- `--route`: one route path; can be repeated instead of `--routes`.
+- `--levels`: comma-separated issue levels. Default: `violation`.
+- `--out`: JSON report path.
+- `--markdown`: optional Markdown report path.
+- `--html`: optional self-contained HTML report path.
+- `--timeout-ms`: per-route timeout.
+- `--quiet-ms`: network quiet window before scanning. Default: `1000`.
+- `--states-file`: JSON file with explicit modal/state actions.
+- `--headed`: show browser while scanning.
+
+## Route Selection
+
+Use `scripts/a11y/a11y_routes.json` as the source of truth for route selection.
+
+The normal CI/local batch is the manifest `static` group. Prefer that unless the user asks for custom, dynamic, or gated routes.
+
+Common manifest-backed command:
+
+```bash
+uv run python scripts/a11y/a11y_scan.py \
+  --url http://localhost:3000 \
+  --routes-file scripts/a11y/a11y_routes.json \
+  --route-group static \
+  --out /tmp/langflow-a11y-static.json \
+  --markdown /tmp/langflow-a11y-static.md \
+  --html /tmp/langflow-a11y-static.html
+```
+
+Dynamic routes need real IDs before scanning:
+
+- `/flow/:id/`
+- `/flow/:id/view`
+- `/playground/:id/`
+- `/assets/knowledge-bases/:sourceId/chunks`
+
+For dynamic routes, get IDs from the loaded app, API responses, or existing test data before replacing placeholders.
+
+## Examples
+
+Scan one route:
+
+```bash
+uv run python scripts/a11y/a11y_scan.py \
+  --url http://localhost:3000 \
+  --route /flows \
+  --out /tmp/langflow-a11y-flows.json
+```
+
+Scan multiple routes:
+
+```bash
+uv run python scripts/a11y/a11y_scan.py \
+  --url http://localhost:3000 \
+  --routes-file scripts/a11y/a11y_routes.json \
+  --route-group static \
+  --out /tmp/langflow-a11y-report.json \
+  --markdown /tmp/langflow-a11y-report.md \
+  --html /tmp/langflow-a11y-report.html
+```
+
+Scan more than violations:
+
+```bash
+uv run python scripts/a11y/a11y_scan.py \
+  --url http://localhost:3000 \
+  --routes-file scripts/a11y/a11y_routes.json \
+  --route-group static \
+  --levels violation,potentialviolation,recommendation \
+  --out /tmp/langflow-a11y-expanded.json
+```
+
+Scan route plus modal states:
+
+```bash
+uv run python scripts/a11y/a11y_scan.py \
+  --url http://localhost:3000 \
+  --states-file /tmp/langflow-a11y-states.json \
+  --out /tmp/langflow-a11y-modal-report.json \
+  --markdown /tmp/langflow-a11y-modal-report.md \
+  --html /tmp/langflow-a11y-modal-report.html \
+  --timeout-ms 45000
+```
+
+State file shape:
+
+```json
+[
+  {
+    "route": "/settings/global-variables",
+    "states": [
+      {
+        "name": "new-global-variable-modal",
+        "open": [
+          { "click": "[data-testid='api-key-button-store']" },
+          { "waitFor": "[role='dialog']" }
+        ],
+        "close": [
+          { "press": "Escape" },
+          { "waitForHidden": "[role='dialog']" }
+        ]
+      }
+    ]
+  }
+]
+```
+
+Supported state actions:
+
+- `{ "click": "<css selector>" }`
+- `{ "clickText": "<visible text>" }`
+- `{ "clickRole": { "role": "button", "name": "Create" } }`
+- `{ "fill": { "selector": "<css selector>", "value": "text" } }`
+- `{ "press": "Escape" }`
+- `{ "press": { "selector": "<css selector>", "key": "Enter" } }`
+- `{ "waitFor": "<css selector>" }`
+- `{ "waitForHidden": "<css selector>" }`
+- `{ "waitForText": "<visible text>" }`
+- `{ "wait": 500 }`
+
+## Report
+
+The scanner always writes JSON. It can also write Markdown and HTML for presentation.
+
+Use JSON for exact data. Use Markdown for PR comments or issues. Use HTML when the user wants a browsable report.
+
+Summarize:
+
+- report path
+- Markdown/HTML report paths, when generated
+- total issue count
+- per-route issue count
+- per-route API request count
+- per-route request failure count
+- top rule IDs
+
+Use report fields directly:
+
+- `totalIssues`
+- `results[].route`
+- `results[].state`
+- `results[].phase`
+- `results[].apiRequests`
+- `results[].requestFailures`
+- `results[].diagnostics`
+- `results[].issues[].ruleId`
+
+## Rules
+
+- Use only scanner output for findings.
+- Do not invent route names. Read `routes.tsx`.
+- Do not auto-click arbitrary buttons to find modals. Use explicit state actions.
+- Avoid destructive modal actions unless the user explicitly asks and data is safe.
+- If a route has zero API requests, mention that scan quality may be limited.
+- Ask before fixing files unless the user explicitly asks for fixes.