fix(processing): escape literal keys in JSON path selection

[LimbC-C]

Path Selection concatenates object keys into jq programs. A literal key such as document.id becomes .document.id, which can silently select a different nested field; spaces, quotes, backslashes and leading digits can instead produce invalid jq.

Keep ordinary ASCII jq identifiers unchanged and JSON-encode other keys before constructing paths. Apply the same rule to Operations and legacy JSON Operations, preserve array indexing, and update only their two cached source/hash entries.

Fixes #15831.

Validation on current release-1.13.0 (ddaf568f866af3f594efc0c64709c262f0e18f08): 224 passed, 8 skipped across the two complete component test files, including real libjq selection for special keys and ordinary-key controls. Skips are inherited historical-version fixture checks. Official two-component cache generation/integrity validation and all applicable pre-commit checks pass. All other catalog entries and current upstream component changes are preserved. Frozen lfx/backend dev dependencies and imports from the synchronized checkout were verified. No full backend, frontend, provider or connected-graph suite was run locally.

This head merges the current release baseline and preserves existing history. Its upstream CI is tracked separately; the old head's unrelated frontend Jest failure is historical and is not a claim about this new run.

AI assistance: Codex was used for investigation, implementation, regression tests and upstream synchronization.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: langflow-ai/langflow/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 707d6387-f84a-451b-8bf6-d35e9b967360

📥 Commits

Reviewing files that changed from the base of the PR and between 0e859cf and caa8b60.

📒 Files selected for processing: 4

• src/backend/tests/unit/components/processing/test_operations_component.py
• src/lfx/src/lfx/_assets/component_index.json
• src/lfx/src/lfx/components/processing/data_operations.py
• src/lfx/src/lfx/components/processing/operations.py

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

Both JSON operations components now generate paths that preserve literal keys containing punctuation or other non-identifier characters. A parametrized test checks path generation and selection for varied key formats.

Changes

JSON Path Selection

Layer / File(s)	Summary
Generate and validate literal-key paths src/lfx/src/lfx/components/processing/operations.py, src/lfx/src/lfx/components/processing/data_operations.py, src/backend/tests/unit/components/processing/test_operations_component.py	Both components use dot notation for identifier-safe keys and JSON-quoted bracket notation for other keys. The parametrized test checks picker visibility and verifies that generated paths select the expected value for varied key formats.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: erichare

Merge Risk: ⚪ Minimal · up to caa8b

The path pickers preserve non-identifier JSON keys while retaining ordinary paths. No material merge-blocking behavior issue is evident.

Pre-merge checks: 8 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 8 passed

Check name	Status	Explanation
Linked Issues check		Issue #15831 requires literal JSON key selection in Operations and legacy JSON Operations. Both extract_all_paths implementations now keep [A-Za-z_][A-Za-z0-9_]* keys in dot notation and JSON-quot…
Out of Scope Changes check		The reported changes are limited to path generation in the two requested components and focused regression coverage in the Operations component test file. The tests directly verify the issue behavior.…
Test Coverage For New Implementations		Regression coverage is included in the backend file test_operations_component.py, which follows the test_*.py convention. The parametrized test covers both OperationsComponent and `DataOperation…
Test Quality And Coverage		The added pytest covers both changed components with 18 cases. It exercises path generation through update_build_config, verifies the picker is shown, checks the unchanged .ordinary[0].value path,…
Test File Naming And Structure		The changed backend test is correctly named test_operations_component.py and uses pytest parameterization with a descriptive test_generated_json_paths_select_literal_keys function. It is placed un…
Excessive Mock Usage Warning		The added regression test uses real OperationsComponent and DataOperationsComponent instances, real Data input, update_build_config, and as_data; it adds no Mock, MagicMock, patch, or …
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: escaping literal keys in JSON path selection.

Full details: Linked Issues check

Explanation

Issue #15831 requires literal JSON key selection in Operations and legacy JSON Operations. Both extract_all_paths implementations now keep [A-Za-z_][A-Za-z0-9_]* keys in dot notation and JSON-quote other keys. This covers dots, spaces, quotes, backslashes, leading digits, empty keys, and Unicode. The added parametrized test exercises both components through update_build_config and as_data, preserves .ordinary[0].value, and reports all 18 jq cases passing.

Full details: Out of Scope Changes check

Explanation

The reported changes are limited to path generation in the two requested components and focused regression coverage in the Operations component test file. The tests directly verify the issue behavior. No unrelated change is established by the supplied change summary.

Full details: Test Coverage For New Implementations

Explanation

Regression coverage is included in the backend file test_operations_component.py, which follows the test_*.py convention. The parametrized test covers both OperationsComponent and DataOperationsComponent, exercises update_build_config, selects a generated path, and verifies the real as_data() result for dotted, spaced, quoted, escaped, digit-leading, empty, and Unicode keys. It also preserves the expected .ordinary[0].value path.

Full details: Test Quality And Coverage

Explanation

The added pytest covers both changed components with 18 cases. It exercises path generation through update_build_config, verifies the picker is shown, checks the unchanged .ordinary[0].value path, and executes each generated path through as_data() to require {"result": 42}. Cases include dots, spaces, quotes, backslashes, leading digits, empty keys, Unicode, and jq-like text. No new async function or API endpoint requires additional test patterns.

Full details: Test File Naming And Structure

Explanation

The changed backend test is correctly named test_operations_component.py and uses pytest parameterization with a descriptive test_generated_json_paths_select_literal_keys function. It is placed under src/backend/tests/unit/components/processing, matching the unit-test scope. The test covers both OperationsComponent and DataOperationsComponent, ordinary keys, punctuation, spaces, quotes, backslashes, leading digits, empty keys, and Unicode. No integration or frontend test requirements apply.

Full details: Excessive Mock Usage Warning

Explanation

The added regression test uses real OperationsComponent and DataOperationsComponent instances, real Data input, update_build_config, and as_data; it adds no Mock, MagicMock, patch, or similar test doubles. The only monkeypatch uses in the file are pre-existing environment setup for jq security tests, which is appropriate for an external environment dependency. No excessive mock usage is introduced by this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[LimbC-C]

CI follow-up for caa8b60: the main run failed in the frontend Jest job, in FormKeyRender's active expiry-preset toggle test (setExpiresAt expected "", received "2026-10-23"). Its other 7,676 tests passed; the backend unit/integration, LFX and CLI jobs succeeded.

The failing job is https://github.com/langflow-ai/langflow/actions/runs/38992625938/job/117278191819 . This PR changes the Python path generators, their regression tests and cached templates. I have not reproduced the frontend failure locally, so I am recording it separately rather than claiming the overall CI passed.