Merge branch 'release-1.12.0' into workflow-api-prod

Author: Jkavia

.secrets.baseline

@@ -1263,7 +1263,7 @@
         "filename": "src/backend/tests/unit/agentic/services/test_assistant_service_run_intent.py",
         "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
         "is_verified": false,
-        "line_number": 369,
+        "line_number": 386,
         "is_secret": false
       }
     ],
@@ -1337,7 +1337,7 @@
         "filename": "src/backend/tests/unit/agentic/services/test_provider_service.py",
         "hashed_secret": "c92b9809dacd9240dc85e86da6388e9b1bfc8a7d",
         "is_verified": false,
-        "line_number": 118,
+        "line_number": 126,
         "is_secret": false
       }
     ],
@@ -6589,7 +6589,7 @@
         "filename": "src/lfx/src/lfx/base/models/unified_models/model_catalog.py",
         "hashed_secret": "665b1e3851eefefa3fb878654292f16597d25155",
         "is_verified": false,
-        "line_number": 498,
+        "line_number": 502,
         "is_secret": false
       }
     ],

BUNDLE_API.md

@@ -511,6 +511,16 @@ the deserialize half is covered by
   exposes an immutable generation-tagged snapshot plus an eager catalog
   validation hook for deployment readiness.  Existing provider manifests are
   unaffected and `BUNDLE_API_VERSION` remains `1`.
+- **Provider identity resolution and policy snapshots (additive).**
+  `resolve_provider_id()` is the canonical resolver for registered names,
+  display names, aliases, stable IDs, and deterministic legacy fallbacks.
+  Model-provider policy services now expose cached synchronous `resolve()`,
+  async `aresolve()`, single-provider `is_allowed()`, and `invalidate()`
+  hooks while preserving the existing immutable snapshot and allow-all OSS
+  behavior. The process-local snapshot cache has a bounded TTL, and async
+  implementations can override `aget_allowed_provider_ids()` without
+  bypassing it. Existing synchronous policy subclasses, including subclasses
+  that did not call `super().__init__()`, remain source-compatible.
 - **New typed error codes (additive): `provider-invalid`, `provider-skipped`.**
   A malformed provider spec surfaces `provider-invalid`; a provider whose name
   collides with a built-in or already-loaded provider surfaces

Makefile

@@ -1,4 +1,4 @@
-.PHONY: all init format_backend format lint build run_backend dev help tests coverage clean_python_cache clean_npm_cache clean_frontend_build clean_all run_clic load_test_setup load_test_setup_basic load_test_list_flows load_test_run load_test_langflow_quick load_test_stress load_test_example load_test_clean load_test_remote_setup load_test_remote_run load_test_help docs docs_build docs_install api_examples_local api_examples_local_syntax
+.PHONY: all init format_backend format lint build backend backend_base install_backend setup_env run_backend dev help tests coverage clean_python_cache clean_npm_cache clean_frontend_build clean_all run_clic load_test_setup load_test_setup_basic load_test_list_flows load_test_run load_test_langflow_quick load_test_stress load_test_example load_test_clean load_test_remote_setup load_test_remote_run load_test_help docs docs_build docs_install api_examples_local api_examples_local_syntax
 
 # Configurations
 VERSION=$(shell grep "^version" pyproject.toml | sed 's/.*\"\(.*\)\"$$/\1/')
@@ -23,6 +23,7 @@ workers ?= 1
 async ?= true
 lf ?= false
 ff ?= true
+UV_RUN_ARGS ?=
 all: help
 
 ######################
@@ -285,12 +286,18 @@ setup_env: ## set up the environment
 
 
 
+backend_base: ## run the backend with only langflow-base installed
+	@UV_PROJECT_ENVIRONMENT="$(CURDIR)/src/backend/base/.venv" \
+		$(MAKE) backend \
+			EXTRA_ARGS="$(strip --package langflow-base $(EXTRA_ARGS))" \
+			UV_RUN_ARGS="$(strip --package langflow-base $(UV_RUN_ARGS))"
+
 
 backend: setup_env install_backend ## run the backend in development mode
 	@-kill -9 $$(lsof -t -i:7860) || true
 ifdef login
 	@echo "Running backend autologin is $(login)";
-	LANGFLOW_AUTO_LOGIN=$(login) uv run uvicorn \
+	LANGFLOW_AUTO_LOGIN=$(login) uv run$(if $(strip $(UV_RUN_ARGS)), $(strip $(UV_RUN_ARGS))) uvicorn \
 		--factory langflow.main:create_app \
 		--host 0.0.0.0 \
 		--port $(port) \
@@ -300,7 +307,7 @@ ifdef login
 		$(if $(workers),--workers $(workers),)
 else
 	@echo "Running backend respecting the $(env) file";
-	uv run uvicorn \
+	uv run$(if $(strip $(UV_RUN_ARGS)), $(strip $(UV_RUN_ARGS))) uvicorn \
 		--factory langflow.main:create_app \
 		--host 0.0.0.0 \
 		--port $(port) \
@@ -900,6 +907,7 @@ help_backend: ## show backend-specific commands
 	@echo ''
 	@echo "$(GREEN)Development:$(NC)"
 	@echo "  $(GREEN)make backend$(NC)             - Run backend in development mode"
+	@echo "  $(GREEN)make backend_base$(NC)        - Run backend with only langflow-base installed"
 	@echo "  $(GREEN)make run_cli$(NC)             - Run Langflow CLI"
 	@echo "  $(GREEN)make run_clic$(NC)            - Run CLI with fresh frontend build"
 	@echo "  $(GREEN)make run_cli_debug$(NC)       - Run CLI in debug mode"

docs/docs/Deployment/deployment-block-custom-components.mdx

@@ -31,6 +31,23 @@ LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true
 
 When set to `true`, non-superusers can still view and use custom components in flows, but they cannot create new custom components or edit custom component code.
 
+## Interaction with catalog governance
+
+Catalog governance takes precedence over the custom-code settings on the custom-component create, update, and code-validation endpoints. A catalog block has no superuser bypass.
+
+| Submitted source | Catalog policy | Custom components | Admin-only mode | Result |
+|---|---|---|---|---|
+| Known server template | Blocked | Either | Either | Denied for every user |
+| Known server template | Allowed | Disabled | Either | Allowed using the trusted server source |
+| Known server template | Allowed | Enabled | Non-superuser | Allowed using the trusted server source |
+| Unknown custom source | Not blocked | Disabled | Either | Denied |
+| Unknown custom source | Not blocked | Enabled | Non-superuser | Denied |
+| Unknown custom source | Not blocked | Enabled | Superuser or admin-only disabled | Allowed |
+
+For `POST /api/v1/validate/code`, this policy runs before the source is parsed or imports are inspected. In a restricted custom-code mode, known templates are validated from the trusted server copy, while unknown source follows the same disabled or admin-only rule as the component editor. On custom-component create and update, known blocked template source is rejected before the component is built, and the resolved component type is checked again before request-supplied frontend updates are applied.
+
+An active catalog policy fails closed with a temporary `503` response while server template identities are still initializing. An empty catalog policy preserves the default behavior and does not require template identity lookups.
+
 ## Configure a custom component allow-list
 
 `LANGFLOW_ALLOW_CUSTOM_COMPONENTS` works together with optional paths that define which component templates the server loads, and which code hashes are trusted.
@@ -62,4 +79,4 @@ Default is `true`, which preserves existing behavior. The setting has no effect
 For more information, see:
 
 * [Environment variables](/environment-variables#visual-editor-and-playground-behavior)
-* [Security](/security)
+* [Security](/security)

src/backend/base/langflow/agentic/flows/flow_builder_assistant.py

@@ -323,13 +323,16 @@
 running — otherwise the run fails with "No model selected".
 
 Pick the model in this STRICT priority order:
-1. **The model the user EXPLICITLY named WINS — always.** If the user asked
+1. **The model the user EXPLICITLY named WINS unless a runtime
+   `[Model provider policy ...]` notice says its provider is unavailable.**
+   If the user asked
    for a specific model ("use GPT-5.4", "use the OpenAI 5.4 model", "switch to
    claude-sonnet-4-5", "troque para gemini-2.5-pro"), use THAT model — never
    substitute a different version or the `preferred` model for it, even if the
-   requested model is not in the `[Available language models ...]` block and
-   even if a "preferred" model is offered. (e.g. user said "5.4" / "gpt-5.4"
-   and preferred is "gpt-5.5" → you MUST set the 5.4 model, NOT gpt-5.5.)
+   exact requested model is not listed and even if a "preferred" model is
+   offered. (e.g. user said "5.4" / "gpt-5.4" and preferred is "gpt-5.5"
+   → you MUST set the 5.4 model, NOT gpt-5.5.) If a policy notice omits or
+   rejects the provider, do not discover, configure, or run it.
    BUT set the **canonical model id** — the EXACT id as it appears in the
    provider catalog / `describe_component` / the `[Available language models]`
    block, NOT the user's loose wording. Provider model ids are CASE-SENSITIVE
@@ -343,19 +346,18 @@
    `preferred`; if there is none, pick ANY provider from "providers with
    credentials configured" (provider-agnostic — do NOT assume OpenAI; use
    whatever the user actually has keys for, e.g. Anthropic, Google, Groq).
-3. Only if no such block is present at all may you fall back to
-   `provider="OpenAI", name="gpt-4o-mini"`.
+3. Only if neither an Available-language-model block nor a restrictive
+   Model-provider-policy notice is present may you preserve the historical
+   fallback `provider="OpenAI", name="gpt-4o-mini"`.
 
 `configure_component(component_id="Agent-...", params='{"model": [{"provider": "<provider>", "name": "<name>"}]}')`.
 Never run a flow whose Agent has no model. NEVER claim in your reply that you
 used a model different from the one you actually set on the canvas — report the
 EXACT model you configured.
 
-Common providers and example model names:
-- `OpenAI` — `gpt-4o`, `gpt-4o-mini`, `gpt-5`, `o1-mini`
-- `Anthropic` — `claude-sonnet-4-5-20250929`, `claude-haiku-4-5`
-- `Google Generative AI` — `gemini-2.5-flash`, `gemini-2.5-pro`
-- `Groq`, `Azure OpenAI`, `Ollama`, `IBM WatsonX`
+Provider and model names are deployment-specific. Treat the runtime
+`[Available language models ...]` block as the authority; never infer that a
+provider is available from these instructions or from an example below.
 
 Add a SEPARATE model component (OpenAIModel etc.) only when the user
 EXPLICITLY says "add an OpenAIModel component" / "create a model node" — never

src/backend/base/langflow/agentic/mcp/server.py

@@ -5,6 +5,8 @@
 
 import asyncio
 import os
+from collections.abc import AsyncIterator
+from contextlib import asynccontextmanager
 from typing import Any
 from uuid import UUID
 
@@ -44,6 +46,7 @@
 from langflow.services.deps import get_db_service, get_settings_service, session_scope
 
 _services_initialized = False
+_policy_refresh_started = False
 _services_init_lock = asyncio.Lock()
 
 
@@ -54,21 +57,58 @@ async def _ensure_services() -> None:
     ``initialize_services()`` (its startup/migration side effects are not
     safe to run twice).
     """
-    global _services_initialized  # noqa: PLW0603
-    if _services_initialized:
+    global _policy_refresh_started, _services_initialized  # noqa: PLW0603
+    if _services_initialized and _policy_refresh_started:
         return
     async with _services_init_lock:
-        if _services_initialized:
-            return
-        get_db_service()
-        from langflow.services.utils import initialize_services
+        if not _services_initialized:
+            get_db_service()
+            from langflow.services.utils import initialize_services
+
+            await initialize_services()
+            # Mark service initialization immediately after it succeeds. If
+            # refresh startup fails, a later MCP call retries only that worker
+            # instead of repeating database migrations and registry setup.
+            _services_initialized = True
+
+        if not _policy_refresh_started:
+            from langflow.services.task.model_provider_policy_refresh import (
+                model_provider_policy_refresh_worker,
+            )
+
+            # Standalone stdio servers do not enter the FastAPI lifespan, but
+            # they are long-lived model consumers and must converge after an
+            # admin changes the install-wide provider ceiling.
+            await model_provider_policy_refresh_worker.start()
+            _policy_refresh_started = True
+
+
+async def _stop_policy_refresh() -> None:
+    """Stop the standalone refresh worker during MCP server shutdown."""
+    global _policy_refresh_started  # noqa: PLW0603
+    if not _policy_refresh_started:
+        return
+    from langflow.services.task.model_provider_policy_refresh import (
+        model_provider_policy_refresh_worker,
+    )
+
+    try:
+        await model_provider_policy_refresh_worker.stop()
+    finally:
+        _policy_refresh_started = False
+
 
-        await initialize_services()
-        _services_initialized = True
+@asynccontextmanager
+async def _service_lifespan(_server: FastMCP) -> AsyncIterator[dict]:
+    """Pair lazy standalone service startup with refresh-worker teardown."""
+    try:
+        yield {}
+    finally:
+        await _stop_policy_refresh()
 
 
 # Initialize FastMCP server
-mcp = FastMCP("langflow-agentic")
+mcp = FastMCP("langflow-agentic", lifespan=_service_lifespan)
 
 DEFAULT_TEMPLATE_FIELDS = ["id", "name", "description", "tags", "endpoint_name", "icon"]
 DEFAULT_COMPONENT_FIELDS = ["name", "type", "display_name", "description"]

src/backend/base/langflow/agentic/services/agent_run_context.py

@@ -18,20 +18,40 @@ class AgentRunModel(TypedDict):
     provider: str | None
     model_name: str | None
     api_key_var: str | None
+    allow_configuration: bool
+
+
+class RequestedAgentModel(TypedDict):
+    provider: str
+    model_name: str
+    api_key_var: str | None
 
 
 _model_var: contextvars.ContextVar[AgentRunModel | None] = contextvars.ContextVar("agentic_run_model", default=None)
 
-_requested_model_var: contextvars.ContextVar[AgentRunModel | None] = contextvars.ContextVar(
+_requested_model_var: contextvars.ContextVar[RequestedAgentModel | None] = contextvars.ContextVar(
     "agentic_requested_model", default=None
 )
 
 _iterations_var: contextvars.ContextVar[int | None] = contextvars.ContextVar("agentic_run_iterations", default=None)
 
 
-def set_agent_run_model(provider: str | None, model_name: str | None, api_key_var: str | None) -> None:
-    """Bind the request's provider/model/api-key to the current context."""
-    _model_var.set({"provider": provider, "model_name": model_name, "api_key_var": api_key_var})
+def set_agent_run_model(
+    provider: str | None,
+    model_name: str | None,
+    api_key_var: str | None,
+    *,
+    allow_configuration: bool = True,
+) -> None:
+    """Bind the request model and whether it may be injected into the canvas."""
+    _model_var.set(
+        {
+            "provider": provider,
+            "model_name": model_name,
+            "api_key_var": api_key_var,
+            "allow_configuration": allow_configuration,
+        }
+    )
 
 
 def current_agent_run_model() -> AgentRunModel | None:
@@ -83,7 +103,7 @@ def set_requested_agent_model(provider: str | None, model_name: str | None, api_
         _requested_model_var.set(None)
 
 
-def current_requested_agent_model() -> AgentRunModel | None:
+def current_requested_agent_model() -> RequestedAgentModel | None:
     """Return the user's explicitly-requested model (or ``None`` when unset)."""
     return _requested_model_var.get()