# Behavior traces — langflow-ai/langflow

> Canonical page: https://codevetter.com/unpack/langflow/behavior-traces

# Behavior traces — langflow-ai/langflow

Scanned commit 5621dcfd84e11108e4cc1ecb0c51f41053c4211c (2026-09-15). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Traced end-to-end: (1) `langflow run` startup from console script through lifespan service init; (2) a synchronous POST /api/v1/run/{flow} execution; (3) the editor's build+events flow; (4) flow deletion cascade; (5) v2 workflow dispatch; (6) shutdown ordering. Each hop below names the actual functions in call order.
- Startup trace: `langflow` script -> langflow_launcher.main (Darwin re-exec for OBJC fork safety) -> typer `run` command -> env-file load -> production preflight + Postgres version check -> ProcessManager spawns gunicorn (Linux) or uvicorn (win/mac, workers clamped to 1) -> create_app() -> get_lifespan(). — [src/backend/base/langflow/langflow_launcher.py](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/langflow_launcher.py) [src/backend/base/langflow/__main__.py#L13-20](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/__main__.py#L13-L20) [src/backend/base/langflow/__main__.py#L162-198](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/__main__.py#L162-L198) [src/backend/base/langflow/main.py#L854-869](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/main.py#L854-L869)
- Lifespan init order: configure() logging -> optional sentry_sdk.init -> ensure_production_preflight -> initialize_services (register_all_service_factories -> initialize_database + alembic -> hydrate_policy_bundle -> hydrate_catalog_policy -> setup_superuser -> clean_transactions/vertex_builds/authz_audit_log) -> initialize_environment_variables -> telemetry writer + audit_cleanup + model_provider_policy_refresh workers -> setup_llm_caching -> profile pictures -> KB/memory-base backfills -> Prometheus -> load_bundles_from_urls -> get_and_cache_all_types_dict -> create_or_update_starter_projects (FileLock) -> agentic globals -> telemetry_service.start -> MCPComposerService.start -> MCP server backfill -> load_flows_from_directory -> warm registry task -> sync_flows_from_fs + queue_service.start -> orphan sweep -> delayed init_mcp_servers -> streamable-HTTP managers -> lag monitor + DB pool instrumentation -> enterprise hooks. — [src/backend/base/langflow/main.py#L192-661](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/main.py#L192-L661) [src/backend/base/langflow/services/utils.py#L699-757](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/utils.py#L699-L757)
- Superuser bootstrap: setup_superuser branches on AUTO_LOGIN — when on, it ignores a legacy default password, generates token_urlsafe(32), takes a FileLock (langflow_auto_login_superuser.lock), creates the user via auth.create_super_user, initializes variables and the default folder; when off, it requires configured credentials and deletes an unused default superuser on teardown. — [src/backend/base/langflow/services/utils.py#L141-263](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/utils.py#L141-L263) [src/backend/base/langflow/services/utils.py#L402-425](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/utils.py#L402-L425)
- Sync run trace: POST /api/v1/run/{flow_id_or_name} -> api_key_security / get_current_user -> get_flow_by_id_or_endpoint_name (widen_for_shares) -> ensure_flow_permission(EXECUTE) -> _run_flow_internal -> _enforce_owner_only_tweaks -> resolve_serving_scope -> simple_run_flow -> set_current_model_provider_policy_context -> prepare_flow_build_for_user -> try_warm_run_graph or (process_tweaks -> raise_if_hitl_unsupported -> apply_global_variable_defaults -> Graph.from_payload) -> graph.set_run_id -> JobService.create_job + execute_with_status -> run_graph_internal -> graph.arun -> RunResponse -> _v1_run_response (content_blocks projection). — [src/backend/base/langflow/api/v1/endpoints.py#L807-1050](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v1/endpoints.py#L807-L1050) [src/backend/base/langflow/api/v1/endpoints.py#L382-577](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v1/endpoints.py#L382-L577) [src/lfx/src/lfx/processing/process.py#L62-108](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/processing/process.py#L62-L108)
- Streaming run trace: _run_flow_internal(stream=True) creates an asyncio.Queue + client_consumed_queue, wraps them in a tokens EventManager, spawns run_flow_generator as a task (simple_run_flow(stream=True) -> event_manager.on_end/on_error -> sentinel None), and returns StreamingResponse(consume_and_yield(...)) with an on_disconnect cancel. — [src/backend/base/langflow/api/v1/endpoints.py#L747-805](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v1/endpoints.py#L747-L805) [src/backend/base/langflow/api/v1/endpoints.py#L961-986](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v1/endpoints.py#L961-L986)
- Editor build trace: POST /api/v1/build/{flow_id}/flow -> session_scope _read_flow (owner-scoped, PUBLIC fallback) -> ensure_flow_permission(EXECUTE) with deny->404 reframe unless READ passes -> resolve_flow_data_override drops caller data unless flow:write -> prepare_flow_build_for_user sanitizes stored/inline data -> start_flow_build -> validate_targeted_inputs -> queue_service.create_queue(job_id) -> generate_flow_events task (build_graph_from_db/build_graph_from_data -> graph.prepare -> per-vertex build emits VertexBuildResponse events) -> returns {job_id} -> client polls GET /build/{job_id}/events -> _register_job_owner_or_cancel records ownership for cancel. — [src/backend/base/langflow/api/v1/chat.py#L304-477](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v1/chat.py#L304-L477) [src/backend/base/langflow/api/build.py#L185-250](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/build.py#L185-L250) [src/backend/base/langflow/api/utils/flow_utils.py#L47-100](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/utils/flow_utils.py#L47-L100)
- Flow deletion trace: DELETE /api/v1/flows/{flow_id} -> owner/authz check -> cascade_delete_flow -> check_flow_has_deployed_versions guard -> delete messages -> transactions -> vertex_builds -> flow_versions -> spans then traces (FK order) -> authz_share rows -> flow row; rowcount==1 verifies removal. — [src/backend/base/langflow/api/v1/flows.py#L921-979](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v1/flows.py#L921-L979) [src/backend/base/langflow/api/utils/flow_utils.py#L103-141](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/utils/flow_utils.py#L103-L141)
- v2 workflow trace: POST /api/v2/workflows -> lfx create_workflow_router -> LangflowWorkflowHost.resolve_caller (oauth2_login cookie -> api_key query -> header -> get_current_user_for_workflow, in its own session_scope to avoid SQLite contention) -> get_flow (resolve_flow_for_execution) -> authorize (authorize_flow_action, deny->404) -> branch: run_sync_with_mapping (job-tracked), build_stream_response (v1 build-vertex loop + AG-UI), or submit_background_with_mapping (durable). — [src/backend/base/langflow/api/router.py#L141-164](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/router.py#L141-L164) [src/backend/base/langflow/api/v2/workflow_host.py](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v2/workflow_host.py) [src/lfx/src/lfx/workflow/router.py](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/workflow/router.py)
- Service resolution trace: get_service(ServiceType.X) -> ServiceManager.get (keyed lock) -> first-call discover_plugins (entry points `lfx.services` override=False, then lfx.toml/pyproject `[tool.lfx.services]` override=True) -> service_classes direct registration wins -> _create_service_from_class inspects __init__ params and recursively resolves ServiceType dependencies -> otherwise _create_service_from_factory resolves factory.dependencies then factory.create() + set_ready(). — [src/backend/base/langflow/services/deps.py#L38-60](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/deps.py#L38-L60) [src/lfx/src/lfx/services/manager.py#L121-269](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/services/manager.py#L121-L269) [src/lfx/src/lfx/services/manager.py#L366-558](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/services/manager.py#L366-L558)
- Shutdown trace: lifespan finally -> cleanup_mcp_sessions FIRST (kill MCP subprocesses) -> enterprise shutdown hooks -> stop_event_loop_lag_monitor -> staged progress (stop server -> cancel sync_flows_from_fs/mcp_init/models_dev/warm_registry tasks + stop streamable-HTTP/project/agentic MCP managers + A2A push client + audit/policy workers) -> drain_pending_audit_writes -> teardown_services (30s cap; teardown_superuser deletes unused default superuser when AUTO_LOGIN off) -> shutdown_sandbox (QEMU guests) -> temp_dir cleanup -> summary. — [src/backend/base/langflow/main.py#L694-849](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/main.py#L694-L849) [src/backend/base/langflow/services/utils.py#L428-436](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/utils.py#L428-L436)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)