Merge branch 'main' into open-swe/jkb-55-safe-git-urls

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>

.github/workflows/_integration_test.yml

@@ -17,9 +17,6 @@ jobs:
         python-version:
           - "3.10"
           - "3.14"
-        build_mode:
-          - layered
-          - flat
         example:
           - name: A
             workdir: libs/cli/examples
@@ -33,11 +30,9 @@ jobs:
           - name: D
             workdir: libs/cli/examples/graphs_reqs_b
             tag: langgraph-test-d
-    name: "CLI integration test (${{ matrix.python-version }}, ${{ matrix.example.name }}, ${{ matrix.build_mode }})"
+    name: "CLI integration test"
     env:
-      BUILD_ARGS: ${{ matrix.build_mode == 'flat' && '--flat' || '' }}
       HAS_LANGSMITH_API_KEY: ${{ secrets.LANGSMITH_API_KEY != '' }}
-      TAG_SUFFIX: ${{ matrix.build_mode == 'flat' && '-flat' || '' }}
     defaults:
       run:
         working-directory: libs/cli
@@ -63,7 +58,7 @@ jobs:
         if: (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch')
         working-directory: ${{ matrix.example.workdir }}
         run: |
-          langgraph build $BUILD_ARGS -t ${{ matrix.example.tag }}$TAG_SUFFIX
+          langgraph build -t ${{ matrix.example.tag }}
       - name: Test service ${{ matrix.example.name }}
         if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&env.HAS_LANGSMITH_API_KEY == 'true' }}
         working-directory: ${{ matrix.example.workdir }}
@@ -76,98 +71,98 @@ jobs:
           if [ -f ../.env ]; then echo "LANGSMITH_API_KEY=${{ secrets.LANGSMITH_API_KEY }}" >> ../.env; fi
           # Run the integration test using the built tag
           REPO_ROOT=$(git rev-parse --show-toplevel)
-          timeout 60 python "$REPO_ROOT/.github/scripts/run_langgraph_cli_test.py" -t ${{ matrix.example.tag }}$TAG_SUFFIX
+          timeout 60 python "$REPO_ROOT/.github/scripts/run_langgraph_cli_test.py" -t ${{ matrix.example.tag }}
 
       - name: Build JS service
-        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') && matrix.example.name == 'A' }}
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' }}
         working-directory: libs/cli/js-examples
         run: |
-          langgraph build $BUILD_ARGS -t langgraph-test-e$TAG_SUFFIX
+          langgraph build -t langgraph-test-e
 
       - name: Build JS monorepo service
-        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') && matrix.example.name == 'A' }}
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' }}
         working-directory: libs/cli/js-monorepo-example
         run: |
-          langgraph build $BUILD_ARGS -t langgraph-test-f$TAG_SUFFIX -c apps/agent/langgraph.json --build-command "yarn run turbo build" --install-command "yarn install"
+          langgraph build -t langgraph-test-f -c apps/agent/langgraph.json --build-command "yarn run turbo build" --install-command "yarn install"
 
       - name: Build Python monorepo service
-        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') && matrix.example.name == 'A' }}
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' }}
         working-directory: libs/cli/python-monorepo-example
         run: |
-          langgraph build $BUILD_ARGS -t langgraph-test-g$TAG_SUFFIX -c apps/agent/langgraph.json
+          langgraph build -t langgraph-test-g -c apps/agent/langgraph.json
       - name: Test Python monorepo service
-        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') && matrix.example.name == 'A' && env.HAS_LANGSMITH_API_KEY == 'true' }}
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' && env.HAS_LANGSMITH_API_KEY == 'true' }}
         working-directory: libs/cli/python-monorepo-example
         env:
           LANGSMITH_API_KEY: ${{ secrets.LANGSMITH_API_KEY }}
         run: |
           cp apps/agent/.env.example apps/agent/.env
           echo "LANGSMITH_API_KEY=${{ secrets.LANGSMITH_API_KEY }}" >> apps/agent/.env
-          timeout 60 python ../../../.github/scripts/run_langgraph_cli_test.py -t langgraph-test-g$TAG_SUFFIX -c apps/agent/langgraph.json
+          timeout 60 python ../../../.github/scripts/run_langgraph_cli_test.py -t langgraph-test-g -c apps/agent/langgraph.json
 
       - name: Build prerelease reqs service
-        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') && matrix.example.name == 'A' }}
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' }}
         working-directory: libs/cli/examples/graph_prerelease_reqs
         run: |
-          langgraph build $BUILD_ARGS -t langgraph-test-h$TAG_SUFFIX
+          langgraph build -t langgraph-test-h
       - name: Test prerelease reqs service
-        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') && matrix.example.name == 'A' && env.HAS_LANGSMITH_API_KEY == 'true' }}
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' && env.HAS_LANGSMITH_API_KEY == 'true' }}
         working-directory: libs/cli/examples/graph_prerelease_reqs
         env:
           LANGSMITH_API_KEY: ${{ secrets.LANGSMITH_API_KEY }}
         run: |
           cp ../.env.example .env
           echo "LANGSMITH_API_KEY=${{ secrets.LANGSMITH_API_KEY }}" >> .env
-          timeout 60 python ../../../../.github/scripts/run_langgraph_cli_test.py -t langgraph-test-h$TAG_SUFFIX
+          timeout 60 python ../../../../.github/scripts/run_langgraph_cli_test.py -t langgraph-test-h
           echo "Finished starting up langgraph-test-h"
-          LANGGRAPH_VERSION=$(docker run --rm --entrypoint "" langgraph-test-h$TAG_SUFFIX python -c "import sys; from importlib.metadata import version; v = version('langgraph'); print(v);")
+          LANGGRAPH_VERSION=$(docker run --rm --entrypoint "" langgraph-test-h python -c "import sys; from importlib.metadata import version; v = version('langgraph'); print(v);")
           if [ "$LANGGRAPH_VERSION" != "1.1.5" ]; then
             echo "LANGGRAPH_VERSION != 1.1.5; $LANGGRAPH_VERSION"
             exit 1
           fi
-          LANGCHAIN_OPENAI_VERSION=$(docker run --rm --entrypoint "" langgraph-test-h$TAG_SUFFIX python -c "import sys; from importlib.metadata import version; v = version('langchain-openai'); print(v);")
+          LANGCHAIN_OPENAI_VERSION=$(docker run --rm --entrypoint "" langgraph-test-h python -c "import sys; from importlib.metadata import version; v = version('langchain-openai'); print(v);")
           if [ "$LANGCHAIN_OPENAI_VERSION" != "1.1.14" ]; then
             echo "LANGCHAIN_OPENAI_VERSION != 1.1.14; $LANGCHAIN_OPENAI_VERSION"
             exit 1
           fi
-          LANGCHAIN_ANTHROPIC_VERSION=$(docker run --rm --entrypoint "" langgraph-test-h$TAG_SUFFIX python -c "import sys; from importlib.metadata import version; v = version('langchain-anthropic'); print(v);")
+          LANGCHAIN_ANTHROPIC_VERSION=$(docker run --rm --entrypoint "" langgraph-test-h python -c "import sys; from importlib.metadata import version; v = version('langchain-anthropic'); print(v);")
           if [ "$LANGCHAIN_ANTHROPIC_VERSION" != "1.4.6" ]; then
             echo "LANGCHAIN_ANTHROPIC_VERSION != 1.4.6; $LANGCHAIN_ANTHROPIC_VERSION"
             exit 1
           fi
 
       - name: Build and test prerelease reqs fail service
-        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') && matrix.example.name == 'A' }}
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' }}
         working-directory: libs/cli/examples/graph_prerelease_reqs_fail
         run: |
-          langgraph build $BUILD_ARGS -t langgraph-test-i$TAG_SUFFIX || [ $? -eq 1 ]
+          langgraph build -t langgraph-test-i || [ $? -eq 1 ]
 
       - name: Build uv simple service
-        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') && matrix.example.name == 'A' }}
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' }}
         working-directory: libs/cli/uv-examples/simple
         run: |
-          langgraph build $BUILD_ARGS -t langgraph-test-uv-simple$TAG_SUFFIX
+          langgraph build -t langgraph-test-uv-simple
       - name: Test uv simple service
-        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') && matrix.example.name == 'A' && env.HAS_LANGSMITH_API_KEY == 'true' }}
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' && env.HAS_LANGSMITH_API_KEY == 'true' }}
         working-directory: libs/cli/uv-examples/simple
         env:
           LANGSMITH_API_KEY: ${{ secrets.LANGSMITH_API_KEY }}
         run: |
           cp .env.example .env
           echo "LANGSMITH_API_KEY=${{ secrets.LANGSMITH_API_KEY }}" >> .env
-          timeout 60 python ../../../../.github/scripts/run_langgraph_cli_test.py -t langgraph-test-uv-simple$TAG_SUFFIX
+          timeout 60 python ../../../../.github/scripts/run_langgraph_cli_test.py -t langgraph-test-uv-simple
 
       - name: Build uv monorepo service
-        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') && matrix.example.name == 'A' }}
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' }}
         working-directory: libs/cli/uv-examples/monorepo/apps/agent
         run: |
-          langgraph build $BUILD_ARGS -t langgraph-test-uv-monorepo$TAG_SUFFIX
+          langgraph build -t langgraph-test-uv-monorepo
       - name: Test uv monorepo service
-        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') && matrix.example.name == 'A' && env.HAS_LANGSMITH_API_KEY == 'true' }}
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' && env.HAS_LANGSMITH_API_KEY == 'true' }}
         working-directory: libs/cli/uv-examples/monorepo/apps/agent
         env:
           LANGSMITH_API_KEY: ${{ secrets.LANGSMITH_API_KEY }}
         run: |
           cp .env.example .env
           echo "LANGSMITH_API_KEY=${{ secrets.LANGSMITH_API_KEY }}" >> .env
-          timeout 60 python ../../../../../../.github/scripts/run_langgraph_cli_test.py -t langgraph-test-uv-monorepo$TAG_SUFFIX
+          timeout 60 python ../../../../../../.github/scripts/run_langgraph_cli_test.py -t langgraph-test-uv-monorepo

.gitignore

@@ -76,7 +76,6 @@ __pypackages__/
 
 # Environments
 .env
-.env.*
 .envrc
 *.crt
 *.key

libs/cli/README.md

@@ -103,6 +103,8 @@ The CLI uses a `langgraph.json` configuration file with these key settings:
 }
 ```
 
+Git dependencies should use credential-free URLs. The CLI conservatively scans direct `langgraph.json` dependencies, common Python package files, uv project and lock files, and common Node.js package and lock files for HTTP Git URLs with userinfo. This check is not exhaustive: generated Docker builds can copy other files, including nested requirement or constraint files, into image layers without scanning them. For private dependencies, provide short-lived credentials through your build environment's secret-backed Git credential helper. Do not store credentials in copied files such as `langgraph.json` or `pip_config_file`.
+
 See the [full documentation](https://reference.langchain.com/python/langgraph-cli) for detailed configuration options.
 
 ## Development

libs/cli/langgraph_cli/cli.py

@@ -408,12 +408,6 @@ For production use, requires a license key in env var LANGGRAPH_CLOUD_LICENSE_KE
     "--build-command",
     help="Custom build command to run from the langgraph.json directory. If not provided, uses default build process.",
 )
-@click.option(
-    "--flat",
-    is_flag=True,
-    envvar="LANGGRAPH_CLI_FLAT_IMAGES",
-    help="Flatten generated build steps into one image layer when supported.",
-)
 @click.argument("docker_build_args", nargs=-1, type=click.UNPROCESSED)
 @cli.command(
     help="📦 Build LangGraph API server Docker image.",
@@ -432,7 +426,6 @@ def build(
     tag: str,
     install_command: str | None,
     build_command: str | None,
-    flat: bool,
 ):
     if install_command and langgraph_cli.config.has_disallowed_build_command_content(
         install_command
@@ -468,7 +461,6 @@ def build(
             docker_build_args,
             install_command,
             build_command,
-            flat=flat,
         )
 
 

libs/cli/langgraph_cli/config.py

@@ -6,6 +6,7 @@ import re
 import shlex
 import textwrap
 from collections import Counter
+from collections.abc import Iterable
 from typing import Literal, NamedTuple
 
 import click
@@ -36,6 +37,10 @@ DISALLOWED_BUILD_COMMAND_CHARS = [
 # This blocks background execution (cmd &) while allowing command
 # chaining (cmd1 && cmd2) which is common in build commands.
 _SINGLE_AMPERSAND_RE = re.compile(r"(?<!&)&(?:&&)*(?!&)")
+_GIT_HTTP_AUTHORITY_RES = (
+    re.compile(r"git\+https?://(?P<authority>[^/\s\"']+)", re.I),
+    re.compile(r"\bgit\s*=\s*[\"']https?://(?P<authority>[^/\s\"']+)", re.I),
+)
 _API_VERSION_PATTERN = re.compile(
     r"^(?P<major>\d+)"
     r"(?:\.(?P<minor>\d+))?"
@@ -78,6 +83,62 @@ def has_disallowed_build_command_content(command: str) -> bool:
     return False
 
 
+def _has_git_http_url_userinfo(dependency: str) -> bool:
+    """Check whether a Git HTTP URL contains userinfo."""
+    return any(
+        "@" in match.group("authority")
+        for pattern in _GIT_HTTP_AUTHORITY_RES
+        for match in pattern.finditer(dependency)
+    )
+
+
+def _validate_git_http_url_userinfo(
+    values: Iterable[str], *, source: pathlib.Path | None = None
+) -> None:
+    """Reject credential-bearing Git HTTP URLs without echoing their values."""
+    if not any(_has_git_http_url_userinfo(value) for value in values):
+        return
+    message = (
+        "Git dependency URLs must not contain credentials or other URL "
+        "userinfo because generated Dockerfiles and image layers can retain "
+        "them. Use a credential-free Git URL and provide short-lived "
+        "credentials through your build environment's secret-backed Git "
+        "credential helper."
+    )
+    if source is not None:
+        message += f" Found in: {source}"
+    raise click.UsageError(message)
+
+
+def _validate_git_http_url_userinfo_files(paths: Iterable[pathlib.Path]) -> None:
+    """Reject credential-bearing Git HTTP URLs in dependency files."""
+    for path in paths:
+        path = path.resolve()
+        if not path.is_file():
+            continue
+        try:
+            contents = path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            raise click.UsageError(
+                f"Could not inspect dependency file for embedded credentials: {path}"
+            ) from None
+        _validate_git_http_url_userinfo([contents], source=path)
+
+
+def _validate_local_dependency_files(config_path: pathlib.Path, config: Config) -> None:
+    """Validate dependency files copied into a non-uv Python image."""
+    paths: list[pathlib.Path] = []
+    for dependency in config["dependencies"]:
+        if not isinstance(dependency, str) or not dependency.startswith("."):
+            continue
+        root = (config_path.parent / dependency).resolve()
+        paths.extend(
+            root / name
+            for name in ("requirements.txt", "pyproject.toml", "setup.py", "setup.cfg")
+        )
+    _validate_git_http_url_userinfo_files(paths)
+
+
 MIN_PYTHON_VERSION = "3.11"
 DEFAULT_PYTHON_VERSION = "3.11"
 
@@ -320,7 +381,9 @@ def _get_source_kind(config: Config) -> str | None:
     return kind if isinstance(kind, str) else None
 
 
-def validate_config(config: Config) -> Config:
+def validate_config(
+    config: Config, *, source_path: pathlib.Path | None = None
+) -> Config:
     """Validate a configuration dictionary."""
 
     graphs = config.get("graphs", {})
@@ -415,6 +478,15 @@ def validate_config(config: Config) -> Config:
                 '  "source": {"kind": "uv", "root": ".."}'
             )
 
+    _validate_git_http_url_userinfo(
+        (
+            dependency
+            for dependency in config["dependencies"]
+            if isinstance(dependency, str)
+        ),
+        source=source_path,
+    )
+
     source = config.get("source")
     source_kind = _get_source_kind(config)
     if source is not None and not isinstance(source, dict):
@@ -609,7 +681,7 @@ def validate_config_file(config_path: pathlib.Path) -> Config:
     """Load and validate a configuration file."""
     with open(config_path) as f:
         config = json.load(f)
-    validated = validate_config(config)
+    validated = validate_config(config, source_path=config_path.resolve())
     # Enforce the package.json doesn't enforce an
     # incompatible Node.js version
     if validated.get("node_version"):
@@ -1162,208 +1234,6 @@ def _build_runtime_env_vars(config: Config) -> list[str]:
     return env_vars
 
 
-def _faux_package_pyproject_command(package_name: str) -> str:
-    pyproject_path = shlex.quote(f"/deps/outer-{package_name}/pyproject.toml")
-    return f"""cat > {pyproject_path} <<'PYPROJECT'
-[project]
-name = {json.dumps(package_name)}
-version = "0.1"
-[tool.setuptools.package-data]
-"*" = ["**/*"]
-[build-system]
-requires = ["setuptools>=61"]
-build-backend = "setuptools.build_meta"
-PYPROJECT"""
-
-
-_FLAT_BUILD_CONTEXT = pathlib.PurePosixPath("/__build_context")
-_FLAT_ADDITIONAL_CONTEXTS = pathlib.PurePosixPath("/__additional_contexts")
-_DEFAULT_NODE_BUILD_COMMAND = (
-    '(test ! -f /api/langgraph_api/js/build.mts && echo "Prebuild script not found, '
-    'skipping") || tsx /api/langgraph_api/js/build.mts'
-)
-
-
-def _render_flat_dockerfile(
-    *,
-    image: str,
-    dockerfile_lines: list[str],
-    env_vars: list[str],
-    commands: list[str],
-    workdir: str | None,
-    additional_context_names: dict[pathlib.Path, str] | None = None,
-) -> str:
-    mounts = [f"--mount=type=bind,target={_FLAT_BUILD_CONTEXT},readonly"]
-    mounts.extend(
-        f"--mount=type=bind,from={name},"
-        f"target={_FLAT_ADDITIONAL_CONTEXTS / name},readonly"
-        for name in (additional_context_names or {}).values()
-    )
-
-    return os.linesep.join(
-        [
-            "# syntax=docker/dockerfile:1.7",
-            f"FROM {image}",
-            *dockerfile_lines,
-            *env_vars,
-            f"RUN {' '.join(mounts)} <<'USER_LAYER'",
-            *commands,
-            "USER_LAYER",
-            f"WORKDIR {workdir}" if workdir else "",
-        ]
-    )
-
-
-def _flat_context_source(
-    path: pathlib.Path,
-    relative_path: str,
-    additional_context_names: dict[pathlib.Path, str],
-    *,
-    additional_relative_path: str = ".",
-) -> str:
-    if name := additional_context_names.get(path):
-        return str(_FLAT_ADDITIONAL_CONTEXTS / name / additional_relative_path)
-    return str(_FLAT_BUILD_CONTEXT / relative_path)
-
-
-def _copy_directory_command(source: str, destination: str) -> str:
-    return f"""mkdir -p {shlex.quote(destination)}
-cp -a {shlex.quote(f"{source}/.")} {shlex.quote(destination)}/"""
-
-
-def _flat_local_dependency_commands(
-    *,
-    config_path: pathlib.Path,
-    local_deps: LocalDeps,
-    local_reqs_pip_install: str,
-    additional_context_names: dict[pathlib.Path, str],
-) -> list[str]:
-    commands = []
-
-    for reqpath, destination in local_deps.pip_reqs:
-        source = _flat_context_source(
-            reqpath.parent,
-            str(reqpath.relative_to(config_path.parent)),
-            additional_context_names,
-            additional_relative_path=reqpath.name,
-        )
-        destination_parent = pathlib.PurePosixPath(destination).parent
-        commands.append(f"""mkdir -p {shlex.quote(str(destination_parent))}
-cp {shlex.quote(source)} {shlex.quote(destination)}""")
-    if local_deps.pip_reqs:
-        requirements = " ".join(
-            f"-r {destination}" for _, destination in local_deps.pip_reqs
-        )
-        commands.append(f"{local_reqs_pip_install} {requirements}")
-
-    for full_path, (relative_path, name) in local_deps.real_pkgs.items():
-        source = _flat_context_source(
-            full_path, relative_path, additional_context_names
-        )
-        commands.append(_copy_directory_command(source, f"/deps/{name}"))
-
-    for full_path, (relative_path, destination) in local_deps.faux_pkgs.items():
-        source = _flat_context_source(
-            full_path, relative_path, additional_context_names
-        )
-        pyproject = _faux_package_pyproject_command(full_path.name)
-        commands.append(f"{_copy_directory_command(source, destination)}\n{pyproject}")
-
-    return commands
-
-
-def _build_flat_python_commands(
-    *,
-    config_path: pathlib.Path,
-    config: Config,
-    local_deps: LocalDeps,
-    pypi_deps: list[str],
-    local_reqs_pip_install: str,
-    local_deps_install_command: str,
-    pip_cleanup: str,
-    additional_context_names: dict[pathlib.Path, str],
-    js_working_dir: str | None,
-) -> list[str]:
-    commands = ["set -eu"]
-
-    if js_working_dir:
-        commands.append("/storage/install-node.sh")
-
-    if pip_config_file := config.get("pip_config_file"):
-        source = shlex.quote(str(_FLAT_BUILD_CONTEXT / pip_config_file))
-        commands.append(f"cp {source} /pipconfig.txt")
-    if pypi_deps:
-        commands.append(f"{local_reqs_pip_install} {' '.join(pypi_deps)}")
-
-    commands.extend(
-        _flat_local_dependency_commands(
-            config_path=config_path,
-            local_deps=local_deps,
-            local_reqs_pip_install=local_reqs_pip_install,
-            additional_context_names=additional_context_names,
-        )
-    )
-
-    commands.append(local_deps_install_command)
-    if js_working_dir:
-        working_dir = shlex.quote(js_working_dir)
-        commands.append(
-            f"cd {working_dir}\n"
-            f"{_get_node_pm_install_cmd(config_path.parent)} "
-            "&& tsx /api/langgraph_api/js/build.mts"
-        )
-    commands.extend(
-        line.removeprefix("RUN ")
-        for line in pip_cleanup.splitlines()
-        if line and not line.startswith("#")
-    )
-    return commands
-
-
-def _build_flat_python_dockerfile(
-    config_path: pathlib.Path,
-    config: Config,
-    local_deps: LocalDeps,
-    pypi_deps: list[str],
-    local_reqs_pip_install: str,
-    local_deps_install_command: str,
-    pip_cleanup: str,
-    image: str,
-    env_vars: list[str],
-    additional_context_names: dict[pathlib.Path, str],
-) -> str:
-    js_working_dir = (
-        local_deps.working_dir
-        if config.get("ui") or config.get("node_version")
-        else None
-    )
-    commands = _build_flat_python_commands(
-        config_path=config_path,
-        config=config,
-        local_deps=local_deps,
-        pypi_deps=pypi_deps,
-        local_reqs_pip_install=local_reqs_pip_install,
-        local_deps_install_command=local_deps_install_command,
-        pip_cleanup=pip_cleanup,
-        additional_context_names=additional_context_names,
-        js_working_dir=js_working_dir,
-    )
-    if js_working_dir:
-        env_vars = [
-            f"ENV NODE_VERSION={config.get('node_version') or DEFAULT_NODE_VERSION}",
-            *env_vars,
-        ]
-
-    return _render_flat_dockerfile(
-        image=image,
-        dockerfile_lines=config["dockerfile_lines"],
-        env_vars=env_vars,
-        commands=commands,
-        workdir=local_deps.working_dir,
-        additional_context_names=additional_context_names,
-    )
-
-
 def _get_node_pm_install_cmd(project_dir: pathlib.Path) -> str:
     def test_file(file_name):
         full_path = project_dir / file_name
@@ -1469,7 +1339,6 @@ def python_config_to_docker(
     api_version: str | None = None,
     *,
     escape_variables: bool = False,
-    flat: bool = False,
 ) -> tuple[str, dict[str, str]]:
     """Generate a Dockerfile from the configuration."""
     source_kind = _get_source_kind(config)
@@ -1483,6 +1352,7 @@ def python_config_to_docker(
             api_version=api_version,
             build_tools_to_uninstall=build_tools_to_uninstall,
         )
+    _validate_local_dependency_files(config_path, config)
     if pip_installer == "auto":
         if _image_supports_uv(base_image):
             pip_installer = "uv"
@@ -1631,36 +1501,6 @@ ADD {relpath} /deps/{name}
             ]
         )
     image_str = docker_tag(config, base_image, api_version)
-    dep_vname = "$$dep" if escape_variables else "$dep"
-    local_deps_install_command = f"""for dep in /deps/*; do \
-            echo "Installing {dep_vname}"; \
-            if [ -d "{dep_vname}" ]; then \
-                echo "Installing {dep_vname}"; \
-                (cd "{dep_vname}" && {global_reqs_pip_install} -e .); \
-            fi; \
-        done"""
-    pip_cleanup = _get_pip_cleanup_lines(
-        install_cmd=install_cmd,
-        to_uninstall=build_tools_to_uninstall,
-        pip_installer=pip_installer,
-    )
-
-    if flat:
-        return (
-            _build_flat_python_dockerfile(
-                config_path=config_path,
-                config=config,
-                local_deps=local_deps,
-                pypi_deps=pypi_deps,
-                local_reqs_pip_install=local_reqs_pip_install,
-                local_deps_install_command=local_deps_install_command,
-                pip_cleanup=pip_cleanup,
-                image=image_str,
-                env_vars=env_vars,
-                additional_context_names=additional_context_names,
-            ),
-            additional_contexts,
-        )
 
     # Prepare docker file contents
     docker_file_contents = []
@@ -1675,6 +1515,14 @@ ADD {relpath} /deps/{name}
         )
 
     # Add main dockerfile content
+    dep_vname = "$$dep" if escape_variables else "$dep"
+    local_deps_install_str = f"""RUN for dep in /deps/*; do \
+            echo "Installing {dep_vname}"; \
+            if [ -d "{dep_vname}" ]; then \
+                echo "Installing {dep_vname}"; \
+                (cd "{dep_vname}" && {global_reqs_pip_install} -e .); \
+            fi; \
+        done"""
     docker_file_contents.extend(
         [
             f"FROM {image_str}",
@@ -1684,14 +1532,18 @@ ADD {relpath} /deps/{name}
             installs,
             "",
             "# -- Installing all local dependencies --",
-            f"RUN {local_deps_install_command}",
+            local_deps_install_str,
             "# -- End of local dependencies install --",
             os.linesep.join(env_vars),
             "",
             js_inst_str,
             "",
             # Add pip cleanup after all installations are complete
-            pip_cleanup,
+            _get_pip_cleanup_lines(
+                install_cmd=install_cmd,
+                to_uninstall=build_tools_to_uninstall,
+                pip_installer=pip_installer,
+            ),
             "",
             f"WORKDIR {local_deps.working_dir}" if local_deps.working_dir else "",
         ]
@@ -1700,31 +1552,6 @@ ADD {relpath} /deps/{name}
     return os.linesep.join(docker_file_contents), additional_contexts
 
 
-def _build_flat_node_dockerfile(
-    *,
-    config: Config,
-    image: str,
-    env_vars: list[str],
-    install_workdir: str,
-    build_workdir: str,
-    install_command: str,
-    build_command: str,
-) -> str:
-    commands = [
-        "set -eu",
-        _copy_directory_command(str(_FLAT_BUILD_CONTEXT), install_workdir),
-        f"cd {shlex.quote(install_workdir)}\n{install_command}",
-        f"cd {shlex.quote(build_workdir)}\n{build_command}",
-    ]
-    return _render_flat_dockerfile(
-        image=image,
-        dockerfile_lines=config["dockerfile_lines"],
-        env_vars=env_vars,
-        commands=commands,
-        workdir=build_workdir,
-    )
-
-
 def node_config_to_docker(
     config_path: pathlib.Path,
     config: Config,
@@ -1733,66 +1560,76 @@ def node_config_to_docker(
     install_command: str | None = None,
     build_command: str | None = None,
     build_context: str | None = None,
-    flat: bool = False,
 ) -> tuple[str, dict[str, str]]:
     # Calculate paths for monorepo support
     install_root = (
-        pathlib.Path(build_context).resolve() if build_context else config_path.parent
+        pathlib.Path(build_context).resolve()
+        if build_context
+        else config_path.parent.resolve()
+    )
+    config_root = config_path.parent.resolve()
+    dependency_roots = (
+        (install_root, config_root) if install_root != config_root else (install_root,)
+    )
+    _validate_git_http_url_userinfo_files(
+        root / name
+        for root in dependency_roots
+        for name in ("package.json", "package-lock.json", "yarn.lock", "pnpm-lock.yaml")
     )
     install_cmd = install_command or _get_node_pm_install_cmd(install_root)
     if build_context:
         relative_workdir = _calculate_relative_workdir(config_path, build_context)
         container_name = pathlib.Path(build_context).name
-        install_workdir = f"/deps/{container_name}"
-        build_workdir = (
-            f"{install_workdir}/{relative_workdir}"
-            if relative_workdir
-            else install_workdir
-        )
+        if relative_workdir:
+            faux_path = f"/deps/{container_name}/{relative_workdir}"
+        else:
+            faux_path = f"/deps/{container_name}"
     else:
         # Backward compatibility: use the original behavior
-        install_workdir = build_workdir = f"/deps/{config_path.parent.name}"
+        faux_path = f"/deps/{config_path.parent.name}"
 
     image_str = docker_tag(config, base_image, api_version)
 
     env_vars = _build_runtime_env_vars(config)
 
-    build_cmd = (
-        build_command
-        if build_context and build_command
-        else _DEFAULT_NODE_BUILD_COMMAND
-    )
+    # For monorepo support, we need to handle install and build commands differently
+    if build_context:
+        # Monorepo case: install from root, build from config directory
+        container_root = f"/deps/{pathlib.Path(build_context).name}"
+        install_workdir = container_root
+        install_step = f"RUN {install_cmd}"
 
-    if flat:
-        return (
-            _build_flat_node_dockerfile(
-                config=config,
-                image=image_str,
-                env_vars=env_vars,
-                install_workdir=install_workdir,
-                build_workdir=build_workdir,
-                install_command=install_cmd,
-                build_command=build_cmd,
-            ),
-            {},
-        )
+        if build_command:
+            build_step = f"RUN {build_command}"
+        else:
+            build_step = 'RUN (test ! -f /api/langgraph_api/js/build.mts && echo "Prebuild script not found, skipping") || tsx /api/langgraph_api/js/build.mts'
+    else:
+        # Original behavior: everything happens in the same directory
+        install_workdir = faux_path
+        install_step = f"RUN {install_cmd}"
+        build_step = 'RUN (test ! -f /api/langgraph_api/js/build.mts && echo "Prebuild script not found, skipping") || tsx /api/langgraph_api/js/build.mts'
+
+    if build_context:
+        build_workdir = faux_path
+    else:
+        build_workdir = faux_path
 
     docker_file_contents = [
         f"FROM {image_str}",
         "",
         os.linesep.join(config["dockerfile_lines"]),
         "",
-        f"ADD . {install_workdir}",
+        f"ADD . {faux_path if not build_context else container_root}",
         "",
         f"WORKDIR {install_workdir}",
         "",
-        f"RUN {install_cmd}",
+        install_step,
         "",
         os.linesep.join(env_vars),
         "",
         f"WORKDIR {build_workdir}",
         "",
-        f"RUN {build_cmd}",
+        build_step,
     ]
 
     return os.linesep.join(docker_file_contents), {}
@@ -1872,7 +1709,6 @@ def config_to_docker(
     build_command: str | None = None,
     build_context: str | None = None,
     escape_variables: bool = False,
-    flat: bool = False,
 ) -> tuple[str, dict[str, str]]:
     base_image = base_image or default_base_image(config)
 
@@ -1885,7 +1721,6 @@ def config_to_docker(
             install_command=install_command,
             build_command=build_command,
             build_context=build_context,
-            flat=flat,
         )
 
     return python_config_to_docker(
@@ -1894,7 +1729,6 @@ def config_to_docker(
         base_image=base_image,
         api_version=api_version,
         escape_variables=escape_variables,
-        flat=flat,
     )
 
 

libs/cli/langgraph_cli/docker.py

@@ -345,7 +345,6 @@ def build_docker_image(
     docker_command: Sequence[str] | None = None,
     extra_flags: Sequence[str] = (),
     verbose: bool = True,
-    flat: bool = False,
 ):
     """Build a Docker image from a LangGraph config."""
     # pull latest images
@@ -388,7 +387,6 @@ def build_docker_image(
         install_command=install_command,
         build_command=build_command,
         build_context=build_context,
-        flat=flat,
     )
     # add additional_contexts
     if additional_contexts:

libs/cli/langgraph_cli/schemas.py

@@ -650,7 +650,8 @@ class Config(TypedDict, total=False):
 
     pip_config_file: str | None
     """Optional. Path to a pip config file (e.g., "/etc/pip.conf" or "pip.ini") for controlling
-    package installation (custom indices, credentials, etc.).
+    package installation (custom indices, timeouts, etc.). The file is copied into the
+    generated image, so it must not contain credentials or other secrets.
 
     Only relevant if Python dependencies are installed via pip. If omitted, default pip settings are used.
     """
@@ -689,6 +690,9 @@ class Config(TypedDict, total=False):
       - "." or "./src" if you have a local Python package
       - str (aka "anthropic") for a PyPI package
       - "git+https://github.com/org/repo.git@main" for a Git-based package
+    Git HTTP URLs must not contain userinfo such as a username or token. For private
+    dependencies, provide short-lived credentials through the build environment's
+    secret-backed Git credential helper.
     Defaults to an empty list, meaning no additional packages installed beyond your base environment.
 
     This field is not supported when `source.kind` is `uv`.

libs/cli/langgraph_cli/uv_lock.py

@@ -880,6 +880,7 @@ def python_config_to_docker_uv_lock(
         _get_node_pm_install_cmd,
         _get_pip_cleanup_lines,
         _image_supports_uv,
+        _validate_git_http_url_userinfo_files,
         docker_tag,
     )
 
@@ -890,11 +891,20 @@ def python_config_to_docker_uv_lock(
         )
 
     config_root = config_path.parent.resolve()
+    source_root = config["source"].get("root", ".")
+    project_root = (config_root / source_root).resolve()
+    _validate_git_http_url_userinfo_files(
+        [project_root / "pyproject.toml", project_root / "uv.lock"]
+    )
+
     install_cmd = "uv pip install --system"
     _, global_reqs_pip_install, pip_config_file_str = _build_python_install_commands(
         config, install_cmd
     )
     plan = _plan_uv_lock_workspace(config_path, config)
+    _validate_git_http_url_userinfo_files(
+        package.pyproject_path for package in plan.install_order
+    )
 
     _update_uv_lock_graph_paths(config_path, config, plan)
     for section, key in [

libs/cli/schemas/schema.json

@@ -28,7 +28,7 @@
                   "type": "null"
                 }
               ],
-              "description": "Optional. Path to a pip config file (e.g., \"/etc/pip.conf\" or \"pip.ini\") for controlling\npackage installation (custom indices, credentials, etc.).\n\nOnly relevant if Python dependencies are installed via pip. If omitted, default pip settings are used.\n"
+              "description": "Optional. Path to a pip config file (e.g., \"/etc/pip.conf\" or \"pip.ini\") for controlling\npackage installation (custom indices, timeouts, etc.). The file is copied into the\ngenerated image, so it must not contain credentials or other secrets.\n\nOnly relevant if Python dependencies are installed via pip. If omitted, default pip settings are used.\n"
             },
             "_INTERNAL_docker_tag": {
               "anyOf": [
@@ -270,7 +270,7 @@
                   "type": "null"
                 }
               ],
-              "description": "Optional. Path to a pip config file (e.g., \"/etc/pip.conf\" or \"pip.ini\") for controlling\npackage installation (custom indices, credentials, etc.).\n\nOnly relevant if Python dependencies are installed via pip. If omitted, default pip settings are used.\n"
+              "description": "Optional. Path to a pip config file (e.g., \"/etc/pip.conf\" or \"pip.ini\") for controlling\npackage installation (custom indices, timeouts, etc.). The file is copied into the\ngenerated image, so it must not contain credentials or other secrets.\n\nOnly relevant if Python dependencies are installed via pip. If omitted, default pip settings are used.\n"
             },
             "_INTERNAL_docker_tag": {
               "anyOf": [

libs/cli/schemas/schema.v0.json

@@ -28,7 +28,7 @@
                   "type": "null"
                 }
               ],
-              "description": "Optional. Path to a pip config file (e.g., \"/etc/pip.conf\" or \"pip.ini\") for controlling\npackage installation (custom indices, credentials, etc.).\n\nOnly relevant if Python dependencies are installed via pip. If omitted, default pip settings are used.\n"
+              "description": "Optional. Path to a pip config file (e.g., \"/etc/pip.conf\" or \"pip.ini\") for controlling\npackage installation (custom indices, timeouts, etc.). The file is copied into the\ngenerated image, so it must not contain credentials or other secrets.\n\nOnly relevant if Python dependencies are installed via pip. If omitted, default pip settings are used.\n"
             },
             "_INTERNAL_docker_tag": {
               "anyOf": [
@@ -270,7 +270,7 @@
                   "type": "null"
                 }
               ],
-              "description": "Optional. Path to a pip config file (e.g., \"/etc/pip.conf\" or \"pip.ini\") for controlling\npackage installation (custom indices, credentials, etc.).\n\nOnly relevant if Python dependencies are installed via pip. If omitted, default pip settings are used.\n"
+              "description": "Optional. Path to a pip config file (e.g., \"/etc/pip.conf\" or \"pip.ini\") for controlling\npackage installation (custom indices, timeouts, etc.). The file is copied into the\ngenerated image, so it must not contain credentials or other secrets.\n\nOnly relevant if Python dependencies are installed via pip. If omitted, default pip settings are used.\n"
             },
             "_INTERNAL_docker_tag": {
               "anyOf": [

libs/cli/tests/unit_tests/test_config.py

@@ -255,6 +255,243 @@ def test_validate_config():
         )
 
 
+@pytest.mark.parametrize(
+    "dependency",
+    [
+        "git+https://user:secret-token@github.com/org/private.git@main",
+        "private-package @ git+http://token@github.com/org/private.git",
+        "git+HTTPS://user%40example.com:secret%2Ftoken@github.com/org/private.git",
+        "git+https://${GIT_TOKEN}@github.com/org/private.git",
+    ],
+)
+def test_validate_config_rejects_git_http_url_userinfo(dependency: str):
+    with pytest.raises(click.UsageError) as exc_info:
+        validate_config(
+            {
+                "python_version": "3.11",
+                "dependencies": [dependency],
+                "graphs": {"agent": "./agent.py:graph"},
+            }
+        )
+
+    message = str(exc_info.value)
+    assert "must not contain credentials or other URL userinfo" in message
+    assert "secret-token" not in message
+    assert "secret%2Ftoken" not in message
+
+
+def test_validate_config_file_reports_source_for_git_http_url_userinfo(
+    tmp_path: pathlib.Path,
+):
+    config_path = tmp_path / "langgraph.json"
+    config_path.write_text(
+        json.dumps(
+            {
+                "python_version": "3.11",
+                "dependencies": ["git+https://secret-token@github.com/org/private.git"],
+                "graphs": {"agent": "./agent.py:graph"},
+            }
+        )
+    )
+
+    with pytest.raises(click.UsageError) as exc_info:
+        validate_config_file(config_path)
+
+    message = str(exc_info.value)
+    assert "secret-token" not in message
+    assert f"Found in: {config_path.resolve()}" in message
+
+
+@pytest.mark.parametrize(
+    "manifest", ["package.json", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"]
+)
+def test_config_to_docker_rejects_git_http_url_userinfo_in_node_files(
+    tmp_path: pathlib.Path, manifest: str
+):
+    config_path = tmp_path / "langgraph.json"
+    config_path.write_text("{}\n")
+    (tmp_path / "agent.js").write_text("export const graph = {};\n")
+    (tmp_path / "package.json").write_text('{"name":"agent"}\n')
+    (tmp_path / manifest).write_text(
+        '"priv": "git+https://user:secret-token@github.com/org/private.git"\n'
+    )
+    config = validate_config(
+        {
+            "node_version": "20",
+            "graphs": {"agent": "./agent.js:graph"},
+        }
+    )
+
+    with pytest.raises(click.UsageError) as exc_info:
+        config_to_docker(
+            config_path,
+            config,
+            base_image="langchain/langgraphjs-api",
+        )
+
+    message = str(exc_info.value)
+    assert "must not contain credentials or other URL userinfo" in message
+    assert "secret-token" not in message
+    assert f"Found in: {(tmp_path / manifest).resolve()}" in message
+
+
+def test_config_to_docker_allows_node_git_urls_without_http_userinfo(
+    tmp_path: pathlib.Path,
+):
+    config_path = tmp_path / "langgraph.json"
+    config_path.write_text("{}\n")
+    (tmp_path / "agent.js").write_text("export const graph = {};\n")
+    (tmp_path / "package.json").write_text(
+        '{"dependencies":{"public":"git+https://github.com/org/public.git"}}\n'
+    )
+    config = validate_config(
+        {
+            "node_version": "20",
+            "graphs": {"agent": "./agent.js:graph"},
+        }
+    )
+
+    docker, _ = config_to_docker(
+        config_path,
+        config,
+        base_image="langchain/langgraphjs-api",
+    )
+
+    assert f"ADD . /deps/{tmp_path.name}" in docker
+
+
+def test_config_to_docker_rejects_git_http_url_userinfo_in_node_workspace(
+    tmp_path: pathlib.Path,
+):
+    config_root = tmp_path / "apps" / "agent"
+    config_root.mkdir(parents=True)
+    config_path = config_root / "langgraph.json"
+    config_path.write_text("{}\n")
+    (config_root / "agent.js").write_text("export const graph = {};\n")
+    (config_root / "package.json").write_text(
+        '{"dependencies":{"priv":"git+https://secret-token@github.com/org/private.git"}}\n'
+    )
+    (tmp_path / "package.json").write_text('{"name":"workspace"}\n')
+    config = validate_config(
+        {
+            "node_version": "20",
+            "graphs": {"agent": "./agent.js:graph"},
+        }
+    )
+
+    with pytest.raises(click.UsageError) as exc_info:
+        config_to_docker(
+            config_path,
+            config,
+            base_image="langchain/langgraphjs-api",
+            build_context=str(tmp_path),
+        )
+
+    message = str(exc_info.value)
+    assert "secret-token" not in message
+    assert f"Found in: {(config_root / 'package.json').resolve()}" in message
+
+
+@pytest.mark.parametrize(
+    "dependency",
+    [
+        "git+https://github.com/org/public.git@main",
+        "private-package @ git+https://github.com/org/private.git@main",
+        "git+ssh://git@github.com/org/private.git@main",
+    ],
+)
+def test_validate_config_allows_git_urls_without_http_userinfo(dependency: str):
+    config = validate_config(
+        {
+            "python_version": "3.11",
+            "dependencies": [dependency],
+            "graphs": {"agent": "./agent.py:graph"},
+        }
+    )
+
+    assert config["dependencies"] == [dependency]
+
+
+def test_config_to_docker_rejects_git_http_url_userinfo_in_requirements(
+    tmp_path: pathlib.Path,
+):
+    config_path = tmp_path / "langgraph.json"
+    config_path.write_text("{}\n")
+    (tmp_path / "agent.py").write_text("graph = object()\n")
+    (tmp_path / "requirements.txt").write_text(
+        "private @ git+https://secret-token@github.com/org/private.git\n"
+    )
+    config = validate_config(
+        {
+            "python_version": "3.11",
+            "dependencies": ["."],
+            "graphs": {"agent": "./agent.py:graph"},
+        }
+    )
+
+    with pytest.raises(click.UsageError) as exc_info:
+        config_to_docker(
+            config_path,
+            config,
+            base_image="langchain/langgraph-api:0.2.47",
+        )
+
+    message = str(exc_info.value)
+    assert "must not contain credentials or other URL userinfo" in message
+    assert "secret-token" not in message
+    assert f"Found in: {(tmp_path / 'requirements.txt').resolve()}" in message
+
+
+@pytest.mark.parametrize("manifest", ["pyproject.toml", "uv.lock"])
+def test_config_to_docker_rejects_git_http_url_userinfo_in_uv_files(
+    tmp_path: pathlib.Path, manifest: str
+):
+    config_path = tmp_path / "langgraph.json"
+    config_path.write_text("{}\n")
+    (tmp_path / "src").mkdir()
+    (tmp_path / "src" / "agent.py").write_text("graph = object()\n")
+    pyproject = textwrap.dedent(
+        """
+        [project]
+        name = "agent"
+        version = "0.1.0"
+        dependencies = ["private"]
+
+        [tool.uv.sources]
+        private = { git = "https://github.com/org/private.git" }
+        """
+    ).strip()
+    uv_lock = "# uv lock file\n"
+    if manifest == "pyproject.toml":
+        pyproject = pyproject.replace(
+            "https://github.com", "https://secret-token@github.com"
+        )
+    else:
+        uv_lock += (
+            'source = { git = "https://secret-token@github.com/org/private.git" }\n'
+        )
+    (tmp_path / "pyproject.toml").write_text(pyproject + "\n")
+    (tmp_path / "uv.lock").write_text(uv_lock)
+    config = validate_config(
+        {
+            "python_version": "3.11",
+            "graphs": {"agent": "./src/agent.py:graph"},
+            "source": {"kind": "uv"},
+        }
+    )
+
+    with pytest.raises(click.UsageError) as exc_info:
+        config_to_docker(
+            config_path,
+            config,
+            base_image="langchain/langgraph-api:0.2.47",
+        )
+
+    message = str(exc_info.value)
+    assert "must not contain credentials or other URL userinfo" in message
+    assert "secret-token" not in message
+
+
 def test_validate_config_image_distro():
     """Test validation of image_distro field."""
     # Valid image_distro values should work
@@ -723,67 +960,6 @@ WORKDIR /deps/outer-unit_tests/unit_tests\
     }
 
 
-def test_config_to_docker_flat():
-    dockerfile, additional_contexts = config_to_docker(
-        PATH_TO_CONFIG,
-        validate_config(
-            {"dependencies": ["."], "graphs": {"agent": "./agent.py:graph"}}
-        ),
-        base_image="langchain/langgraph-api",
-        flat=True,
-    )
-
-    assert additional_contexts == {}
-    assert dockerfile.count("\nRUN ") == 1
-    assert "--mount=type=bind" in dockerfile
-    assert "cp -a /__build_context/. /deps/outer-unit_tests/unit_tests/" in dockerfile
-    assert "cat > /deps/outer-unit_tests/pyproject.toml <<'PYPROJECT'" in dockerfile
-    assert '[tool.setuptools.package-data]\n"*" = ["**/*"]' in dockerfile
-    assert dockerfile.endswith("WORKDIR /deps/outer-unit_tests/unit_tests")
-
-
-def test_config_to_docker_flat_with_custom_lines_and_escaped_variables():
-    dockerfile, _ = config_to_docker(
-        PATH_TO_CONFIG,
-        validate_config(
-            {
-                "dependencies": ["."],
-                "graphs": {"agent": "./agent.py:graph"},
-                "dockerfile_lines": ["RUN echo custom"],
-            }
-        ),
-        base_image="langchain/langgraph-api",
-        escape_variables=True,
-        flat=True,
-    )
-
-    assert dockerfile.index("RUN echo custom") < dockerfile.index("USER_LAYER")
-    assert 'echo "Installing $$dep"' in dockerfile
-
-
-def test_config_to_docker_flat_with_additional_context():
-    dockerfile, additional_contexts = config_to_docker(
-        PATH_TO_CONFIG,
-        validate_config(
-            {"dependencies": [".", ".."], "graphs": {"agent": "./agent.py:graph"}}
-        ),
-        base_image="langchain/langgraph-api",
-        flat=True,
-    )
-
-    assert additional_contexts == {
-        "outer-tests": str(pathlib.Path(__file__).parent.parent.absolute()),
-    }
-    assert (
-        "--mount=type=bind,from=outer-tests,"
-        "target=/__additional_contexts/outer-tests,readonly" in dockerfile
-    )
-    assert (
-        "cp -a /__additional_contexts/outer-tests/. /deps/outer-tests/tests/"
-        in dockerfile
-    )
-
-
 def test_config_to_docker_outside_path():
     graphs = {"agent": "./agent.py:graph"}
     actual_docker_stdin, additional_contexts = config_to_docker(
@@ -1059,28 +1235,6 @@ RUN (test ! -f /api/langgraph_api/js/build.mts && echo "Prebuild script not foun
     assert additional_contexts == {}
 
 
-def test_config_to_docker_nodejs_flat():
-    dockerfile, additional_contexts = config_to_docker(
-        PATH_TO_CONFIG,
-        validate_config(
-            {
-                "node_version": "20",
-                "graphs": {"agent": "./graphs/agent.js:graph"},
-                "dockerfile_lines": ["RUN echo custom"],
-            }
-        ),
-        base_image="langchain/langgraphjs-api",
-        flat=True,
-    )
-
-    assert additional_contexts == {}
-    assert dockerfile.index("RUN echo custom") < dockerfile.index("USER_LAYER")
-    assert "cp -a /__build_context/. /deps/unit_tests/" in dockerfile
-    assert "cd /deps/unit_tests\nnpm i" in dockerfile
-    assert "tsx /api/langgraph_api/js/build.mts" in dockerfile
-    assert dockerfile.endswith("WORKDIR /deps/unit_tests")
-
-
 def test_config_to_docker_python_encryption():
     # Test that encryption config is included in validation
     graphs = {"agent": "./agent.py:graph"}
@@ -1297,29 +1451,6 @@ WORKDIR /deps/outer-unit_tests/unit_tests"""
     assert additional_contexts == {}
 
 
-def test_config_to_docker_gen_ui_python_flat():
-    dockerfile, additional_contexts = config_to_docker(
-        PATH_TO_CONFIG,
-        validate_config(
-            {
-                "dependencies": ["."],
-                "graphs": {"agent": "./agent.py:graph"},
-                "ui": {"agent": "./graphs/agent.ui.jsx"},
-            }
-        ),
-        base_image="langchain/langgraph-api",
-        flat=True,
-    )
-
-    assert additional_contexts == {}
-    assert dockerfile.count("\nRUN ") == 1
-    assert dockerfile.index("ENV NODE_VERSION=20") < dockerfile.index("\nRUN ")
-    assert dockerfile.index("ENV LANGGRAPH_UI=") < dockerfile.index("\nRUN ")
-    assert "/storage/install-node.sh" in dockerfile
-    assert "cd /deps/outer-unit_tests/unit_tests\nnpm i" in dockerfile
-    assert "tsx /api/langgraph_api/js/build.mts" in dockerfile
-
-
 def test_config_to_docker_multiplatform():
     graphs = {
         "python": "./multiplatform/python.py:graph",