file-watcher: no monitored area covers src/lfx/ (1233 files), and a missing path is indistinguishable from "nothing changed"

[Victor-w-Madeira]

Surfaced while triaging #1091. The change that broke all 6 stdio registrations in
mcp-server.spec.ts landed in src/lfx/src/lfx/base/mcp/security.py on
2026-07-15 (f4d6ac4, upstream #14073). file-watcher.yml exists precisely to
open an issue for that class of upstream change. It did not fire, and it was
never going to.

1. src/lfx/ is watched by zero of the 13 areas

$ grep -c "src/lfx" .github/workflows/file-watcher.yml
0
$ find src/lfx -name "*.py" | wc -l          # in the upstream checkout
1233

Every monitored path lives under src/backend/base/langflow/ or
src/frontend/src/. Langflow has been moving backend behavior into the lfx
package, so a growing share of what our specs exercise is outside the watcher's
field of view entirely. This is omission, not drift — the paths listed are fine,
the list is incomplete.

2. Two areas watch a path whose implementation already left

Measured on the upstream checkout (3551acb, 2026-07-27):

Monitored path	Size	Where the code actually is	Size
src/backend/base/langflow/base/agents/	1 file, 3 lines	src/lfx/src/lfx/base/agents/	15 files, 3069 lines
src/backend/base/langflow/inputs/	6 files, 238 lines	src/lfx/src/lfx/inputs/	5 files, 1645 lines
(MCP) api/v1/mcp.py + mcp_projects.py	378 + 1718 lines — alive	src/lfx/src/lfx/base/mcp/ (unwatched)	5 files, 3826 lines, incl. security.py

Agents & Agentic Flows watches a 3-line shim for its agents leg (its other two
paths are alive), and MCP Server watches the live API layer while the security
and protocol base it depends on is invisible — which is exactly how #1091 got
through.

3. A missing path is silent by construction

COMMITS=$(git log --since="$SINCE" --oneline -- $PATH_LIST 2>/dev/null | head -5)
if [ -n "$COMMITS" ]; then ... fi

git log -- <nonexistent-path> returns nothing, and 2>/dev/null discards any
complaint. So "this path is gone" and "nothing changed here in 24h" produce the
identical empty string, and the empty string is treated as good news. The audit
above found one already stale: src/frontend/src/constants/flow_constants.tsx
(Flow CRUD & Canvas) no longer exists upstream. That area still fires on its
other five paths, so the loss is partial — and nothing anywhere says so.

This is the same fail-closed principle the repo already applies elsewhere: the
daily's runguard treats a verdict it cannot produce as a failure rather than a
pass (#1012), and the dedicated-issue guard fails loudly rather than reading as
a pass (#1035). The watcher currently does the opposite.

Done when

• Every monitored path is asserted to exist in the checkout, and a missing one fails the job naming the path — an area that cannot be evaluated must not read as "clean"
• src/frontend/src/constants/flow_constants.tsx is repointed or dropped
• The lfx counterparts are added to the areas that lost their implementation — at minimum src/lfx/src/lfx/base/mcp/ (MCP Server), src/lfx/src/lfx/inputs/ (Component Input Types), src/lfx/src/lfx/base/agents/ (Agents & Agentic Flows)
• A decision is recorded on the rest of src/lfx/ (1233 files): which subtrees map to which area, and which are deliberately out of scope

Notes

• Related but distinct: Watch: components are migrating from lfx.components.* to per-vendor distributions (lfx-bundles) — shims are removed at M4 #1040 tracks components migrating out of lfx.components.* into per-vendor distributions. That is about what ships in the image; this is about what the watcher looks at.
• Path sizes were measured against a local clone at 3551acb (release-1.11.1 merged into main, 2026-07-27). Re-measure before editing the list — the migration is ongoing, which is the whole point.