fix(mcp): fix validation, session isolation, and update_flow_from_spec parity

[ogabrielluiz]

Summary

• create_flow_from_spec(validate=True) now actually waits for validation to complete instead of fire-and-forget
• validate_flow filters poll results by job_id so stale builds from prior runs are not picked up
• update_flow_from_spec now uses server-side tools (configure_component, connect_components) for feature parity with create_flow_from_spec, including dynamic template refresh, prompt variable creation, and component_as_tool auto-enable. Includes rollback on failure to restore original flow data
• login() only closes the current session's client, no longer disrupts other concurrent SSE sessions
• _set_client invalidates the shared registry when the client changes to prevent stale registries after server switch
• validate_flow returns consistent errors list format so callers get proper error messages

Summary by CodeRabbit

• Bug Fixes

  • Improved session isolation ensuring per-session client operations don't affect other sessions.
  • Enhanced flow validation with detailed error messaging for invalid flows.
  • Fixed flow update operations with automatic rollback on failures.

• Improvements

  • Strengthened flow update workflow with more robust error handling.

• Dependencies

  • Updated multiple package versions including OpenAI, Langchain, and Google API client libraries.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c8f7caaa-ddf5-4725-9fe6-5ea52a02fb2b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

This PR contains dependency version updates across multiple packages in component_index.json, alongside a significant refactoring of MCP server session management, flow validation, creation, and update operations, supported by comprehensive new test coverage.

Changes

Dependency Updates

Layer / File(s)	Summary
Package Versions src/lfx/src/lfx/_assets/component_index.json	Multiple dependencies updated: openai (2.32.0 → 2.33.0), couchbase (4.6.0 → 4.6.1), googleapiclient (2.194.0 → 2.195.0), langchain (1.2.15 → 1.2.17), langchain_google_vertexai (3.2.2 → 3.2.3), git (3.1.43 → 3.1.47), toolguard (0.2.16 → 0.2.17). SHA256 hash updated.

MCP Server Flow Management

Layer / File(s)	Summary
Session & Client Management src/lfx/src/lfx/mcp/server.py	Added copy import. _set_client now atomically updates both shared client and registry. login closes only per-session client, instantiates new session-scoped client, and clears only session-scoped registry, preserving shared state.
Flow Validation & Creation src/lfx/src/lfx/mcp/server.py	create_flow_from_spec now validates flows via server-side validate_flow and raises detailed errors on failure, rather than proceeding unconditionally.
Flow Update with Rollback src/lfx/src/lfx/mcp/server.py	update_flow_from_spec rewritten to deep-copy original flow data, clear existing nodes/edges, rebuild via server-side tools (add_component, configure_component, connect_components), and restore original data on failure with error-handling and event emission.
Public Tool Mapping src/lfx/src/lfx/mcp/server.py	Public tool layout_flow now resolves to layout_flow_tool function instead of layout_flow directly, preserving external API name while updating implementation.
Test Infrastructure & Helpers src/lfx/tests/unit/mcp/test_server_bugs.py	New comprehensive test module with helpers (_make_mock_client, _mock_flow, MOCK_REGISTRY) covering registry invalidation on client change, login session isolation, validation behavior, and rollback semantics.
Bug Fix Test Coverage src/lfx/tests/unit/mcp/test_server_bugs.py	Tests verify: shared registry invalidation, per-session client closure, validation failure handling with skip option, original data restoration on rollback, and flow_settled event emission.
Event Test Updates src/lfx/tests/unit/mcp/test_server_events.py	Added test helpers for layout_flow_tool and revised update_flow_from_spec. Updated TOOL_CASES to expect flow_settled instead of flow_updated. Patched validate_flow in TestCreateFlowFromSpecEmitsSettled.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

🚥 Pre-merge checks | ✅ 6 | ❌ 3

❌ Failed checks (3 warnings)

Check name	Status	Explanation	Resolution
Test Quality And Coverage	⚠️ Warning	Tests lack state isolation. test_server_bugs.py mutates module-level state without restoration, causing potential test order dependency and flakiness as noted in review comments.	Add @pytest.fixture(autouse=True) to restore module state (_shared_client, _shared_registry, _client_var, _registry_var) before/after each test to prevent test pollution.
Test File Naming And Structure	⚠️ Warning	test_server_bugs.py lacks state isolation. Tests mutate module-level state without restoring it, violating test isolation best practices and causing order-dependent execution.	Add @pytest.fixture(autouse=True) to restore module-level state (srv._shared_client, srv._shared_registry, srv._client_var, srv._registry_var) after each test using try/finally pattern, as shown in review comment lines 63-90.
Excessive Mock Usage Warning	⚠️ Warning	Test uses 4.7 mocks per test on average, mocking core logic. Tests assert mock calls instead of actual behavior. Order-dependent due to unrestored module globals.	Add autouse fixture to restore module state. Test actual behavior vs mocks. Use integration tests for rollback/validation. Reduce mock count.

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title accurately reflects the main changes: it specifies three key fixes (validation, session isolation, and update_flow_from_spec parity) that align with the primary objectives described in the PR summary and file changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Test Coverage For New Implementations	✅ Passed	Tests added cover all code changes: validation, rollback, session isolation. Proper test_*.py naming conventions. 16 test methods with mocking and assertions. Not placeholder tests.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/mcp-server-bugs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

❌ Patch coverage is 43.61702% with 53 lines in your changes missing coverage. Please review.
✅ Project coverage is 55.90%. Comparing base (e080805) to head (da3e0a3).
⚠️ Report is 59 commits behind head on release-1.10.0.

Files with missing lines	Patch %	Lines
src/lfx/src/lfx/mcp/server.py	43.61%	46 Missing and 7 partials ⚠️

Additional details and impacted files

@@                Coverage Diff                 @@
##           release-1.10.0   #12528      +/-   ##
==================================================
+ Coverage           55.24%   55.90%   +0.65%     
==================================================
  Files                2173     2186      +13     
  Lines              203469   207824    +4355     
  Branches            30709    32600    +1891     
==================================================
+ Hits               112404   116181    +3777     
- Misses              89781    90289     +508     
- Partials             1284     1354      +70     

Flag	Coverage Δ
backend	60.57% <ø> (+0.30%)	⬆️
frontend	55.75% <ø> (+0.67%)	⬆️
lfx	52.06% <43.61%> (+0.98%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/lfx/src/lfx/mcp/server.py	47.74% <43.61%> (+0.34%)	⬆️

... and 530 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Frontend Unit Test Coverage Report

Coverage Summary

Lines	Statements	Branches	Functions
	40.47% (51619/127527)	68.52% (7024/10251)	39.18% (1156/2950)

Unit Test Results

Tests	Skipped	Failures	Errors	Time
4473	0 💤	0 ❌	0 🔥	11m 45s ⏱️

[erichare]

LGTM!

[erichare]

@ogabrielluiz Seeing this in the backend tests:

  FAILED src/backend/tests/unit/api/v1/test_mcp_client_server.py::TestCreateFlowFromSpec::test_create_flow_from_spec_with_tool_mode - RuntimeError: Flow validation failed: Build timed out: 0/4 components completed
  FAILED src/backend/tests/unit/api/v1/test_mcp_client_server.py::TestCreateFlowFromSpec::test_create_flow_from_spec_prompt_multiple_variables - RuntimeError: Flow validation failed: Build timed out: 0/1 components completed

[github-actions]

✅ Test Coverage Advisor

No source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉

Advisory check only — never blocks merge.