Skip to content
Open
Show file tree
Hide file tree
Changes from 4 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions .github/workflows/langchain-ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
name: LangChain CI

on:
pull_request:
branches: [main]
paths:
- ".github/workflows/langchain-ci.yml"
- "langchain/**"
push:
branches: [main]
paths:
- ".github/workflows/langchain-ci.yml"
- "langchain/**"

permissions:
contents: read

jobs:
test:
runs-on: ubuntu-latest

defaults:
run:
working-directory: langchain

steps:
- uses: actions/checkout@v6

- uses: actions/setup-python@v6
with:
python-version: "3.12"

- run: python -m pip install --upgrade pip

- run: python -m pip install -e . -r requirements-dev.txt

- run: make lint

- run: make test

- run: python -m build
106 changes: 106 additions & 0 deletions .github/workflows/langchain-publish.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,106 @@
name: LangChain CD - Publish to PyPI

on:
push:
branches: [main]
paths:
- ".github/workflows/langchain-publish.yml"
- "langchain/**"

jobs:
build:
name: Build distribution
runs-on: ubuntu-latest
permissions:
contents: read
outputs:
version-exists: ${{ steps.version.outputs.exists }}
package-version: ${{ steps.version.outputs.version }}
steps:
- name: Checkout repository
uses: actions/checkout@v6

- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: "3.12"

- name: Install uv
uses: astral-sh/setup-uv@v8.1.0

- name: Check PyPI version availability
id: version
working-directory: ./langchain
run: |
PACKAGE=$(python -c "import tomllib; f=open('pyproject.toml','rb'); d=tomllib.load(f); print(d['project']['name'])")
VERSION=$(python -c "import tomllib; f=open('pyproject.toml','rb'); d=tomllib.load(f); print(d['project']['version'])")
echo "package=${PACKAGE}" >> "$GITHUB_OUTPUT"
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
RESULT=$(python - "$PACKAGE" "$VERSION" <<'PY'
import sys
import urllib.error
import urllib.parse
import urllib.request

package = sys.argv[1]
version = sys.argv[2]
url = f"https://pypi.org/pypi/{urllib.parse.quote(package)}/{version}/json"
try:
with urllib.request.urlopen(url, timeout=10):
pass
except urllib.error.HTTPError as exc:
if exc.code == 404:
print("missing")
sys.exit(0)
print(f"PyPI returned HTTP {exc.code} while checking {url}", file=sys.stderr)
sys.exit(2)
except Exception as exc:
print(f"Failed to check PyPI for {url}: {exc}", file=sys.stderr)
sys.exit(2)
print("exists")
PY
)
case "$RESULT" in
exists)
echo "exists=true" >> "$GITHUB_OUTPUT"
echo "${PACKAGE} ${VERSION} already exists on PyPI; skipping publish."
;;
missing)
echo "exists=false" >> "$GITHUB_OUTPUT"
echo "${PACKAGE} ${VERSION} is available on PyPI; building distribution."
;;
*)
echo "Unexpected PyPI availability result: $RESULT"
exit 1
;;
esac
Comment on lines +31 to +76
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

find . -name "langchain-publish.yml" -type f

Repository: tinyfish-io/tinyfish-web-agent-integrations

Length of output: 129


🏁 Script executed:

cat -n .github/workflows/langchain-publish.yml 2>/dev/null || echo "File not found in root"

Repository: tinyfish-io/tinyfish-web-agent-integrations

Length of output: 4227


🌐 Web query:

pypa gh-action-pypi-publish skip-existing parameter documentation

💡 Result:

The pypa/gh-action-pypi-publish action documents the input parameter as skip-existing, disabled by default, and it can be enabled in the workflow as: with: skip-existing: true [1][2] The official action repository explains that skip-existing is intended to tolerate release package file duplicates (e.g., race conditions when publishing the same release from multiple places), and includes a note advising to avoid enabling it when possible. [1] In the action.yml, the input is wired through to the underlying implementation via skip-existing: ${{ inputs.skip-existing || inputs.skip_existing }}. [3]

Citations:


Make the publish step idempotent.

The preflight PyPI check creates a TOCTOU window: two concurrent workflow runs can both observe the version as missing before either publishes, causing the second upload to fail. pypa/gh-action-pypi-publish supports skip-existing: true to tolerate duplicate releases, so add it to the publish step.

🛠️ Proposed fix
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist/
+         skip-existing: true
          password: ${{ secrets.PYPI_API_TOKEN }}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/langchain-publish.yml around lines 31 - 76, The publish
step currently uses the pypa/gh-action-pypi-publish action and is vulnerable to
a TOCTOU race; update the "Publish to PyPI" step that invokes
pypa/gh-action-pypi-publish to include the input skip-existing: true so the
action tolerates duplicate uploads if another run already pushed the same
version. Locate the step that uses pypa/gh-action-pypi-publish and add the
skip-existing: true parameter to the action inputs (you can keep the preflight
PyPI check but ensure skip-existing is set).


- name: Build package
if: steps.version.outputs.exists == 'false'
working-directory: ./langchain
run: uv build

- name: Upload distribution artifact
if: steps.version.outputs.exists == 'false'
uses: actions/upload-artifact@v7
with:
name: python-package-distributions
path: langchain/dist/

publish-pypi:
name: Publish to PyPI
needs: build
if: needs.build.outputs.version-exists == 'false'
runs-on: ubuntu-latest
steps:
- name: Download distributions
uses: actions/download-artifact@v8
with:
name: python-package-distributions
path: dist/

- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
with:
packages-dir: dist/
password: ${{ secrets.PYPI_API_TOKEN }}
Comment on lines +90 to +106
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

# First, let's find and examine the workflow file
find . -name "langchain-publish.yml" -type f

Repository: tinyfish-io/tinyfish-web-agent-integrations

Length of output: 129


🏁 Script executed:

# Get the specific lines from the workflow file
if [ -f ".github/workflows/langchain-publish.yml" ]; then
  cat -n ".github/workflows/langchain-publish.yml" | sed -n '90,110p'
fi

Repository: tinyfish-io/tinyfish-web-agent-integrations

Length of output: 696


🌐 Web query:

gh-action-pypi-publish OIDC trusted publishing configuration

💡 Result:

Trusted Publishing (using OpenID Connect) allows you to publish Python packages to PyPI from GitHub Actions without storing long-lived API tokens or passwords as GitHub Secrets [1][2]. To configure Trusted Publishing with the pypa/gh-action-pypi-publish action, follow these steps: 1. Configure the Trusted Publisher on PyPI Navigate to your project's settings on PyPI (e.g., https://pypi.org/manage/project//settings/publishing/) [3][4]. Add a new trusted publisher by specifying the GitHub repository owner, repository name, and the workflow filename (e.g., release.yml) that will perform the publishing [3][4]. You can optionally restrict this to a specific GitHub Actions environment [3][4]. 2. Update your GitHub Actions Workflow In your GitHub Actions workflow file, you must grant the publishing job the necessary OIDC permissions and omit any username or password inputs for the action [3][2]. Required configuration in your workflow YAML: - Set the id-token permission to write at the job level [3][5]. - Use the pypa/gh-action-pypi-publish action without providing a username or password [2][6]. Example Workflow Snippet: jobs: pypi-publish: runs-on: ubuntu-latest environment: release permissions: id-token: write # Mandatory for Trusted Publishing steps: - uses: actions/download-artifact@v5 with: name: release-dists path: dist/ - uses: pypa/gh-action-pypi-publish@release/v1 Important Considerations: - Security: Trusted Publishing is highly recommended over long-lived API tokens because it uses short-lived, automatically expiring tokens, significantly reducing the risk of credential theft [1][7]. - Reusable Workflows: Trusted Publishing is currently not supported when called from within a reusable workflow [6]. It is recommended to keep the job that calls pypa/gh-action-pypi-publish in a top-level workflow [6]. - Isolation: It is best practice to keep your build and publish steps in separate jobs, with the publish job having the minimum necessary privileges [2].

Citations:


Switch this job to OIDC Trusted Publishing.

The job currently uses password: ${{ secrets.PYPI_API_TOKEN }} without declaring permissions.id-token: write, keeping a long-lived secret in the release path. OIDC Trusted Publishing provides superior security by using short-lived, automatically expiring tokens instead of long-lived API tokens. To enable it, add permissions: id-token: write at the job level and remove the explicit password field.

Proposed fix
   publish-pypi:
     name: Publish to PyPI
     needs: build
     if: needs.build.outputs.version-exists == 'false'
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - name: Download distributions
         uses: actions/download-artifact@v8
         with:
           name: python-package-distributions
           path: dist/
 
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           packages-dir: dist/
-          password: ${{ secrets.PYPI_API_TOKEN }}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
publish-pypi:
name: Publish to PyPI
needs: build
if: needs.build.outputs.version-exists == 'false'
runs-on: ubuntu-latest
steps:
- name: Download distributions
uses: actions/download-artifact@v8
with:
name: python-package-distributions
path: dist/
- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
with:
packages-dir: dist/
password: ${{ secrets.PYPI_API_TOKEN }}
publish-pypi:
name: Publish to PyPI
needs: build
if: needs.build.outputs.version-exists == 'false'
runs-on: ubuntu-latest
permissions:
id-token: write
steps:
- name: Download distributions
uses: actions/download-artifact@v8
with:
name: python-package-distributions
path: dist/
- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
with:
packages-dir: dist/
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/langchain-publish.yml around lines 90 - 106, The
publish-pypi job is using a long-lived secret via the password field; switch it
to OIDC Trusted Publishing by adding a job-level permissions block that sets
id-token: write and removing the explicit password input for the
pypa/gh-action-pypi-publish step. Update the job named publish-pypi to include
permissions: id-token: write and delete the line referencing password: ${{
secrets.PYPI_API_TOKEN }} so the pypa/gh-action-pypi-publish action will use
OIDC instead of the stored secret.

12 changes: 12 additions & 0 deletions langchain/.gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
*.egg-info/
*.egg
dist/
build/
__pycache__/
*.pyc
*.pyo
.env
.claude/
.mypy_cache/
.ruff_cache/
.pytest_cache/
21 changes: 21 additions & 0 deletions langchain/LICENSE
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
MIT License

Copyright (c) 2026 TinyFish

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
24 changes: 24 additions & 0 deletions langchain/Makefile
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
.PHONY: all format lint test integration_test check_imports clean

all: format lint test

TEST_FILE ?= tests/unit_tests/
integration_test: TEST_FILE = tests/integration_tests/

format:
ruff format langchain_tinyfish tests
ruff check --fix langchain_tinyfish tests

lint:
ruff check langchain_tinyfish tests
mypy langchain_tinyfish

test integration_test:
pytest $(TEST_FILE) -v

check_imports: $(shell find langchain_tinyfish -name '*.py')
python scripts/check_imports.py $^

clean:
rm -rf build dist *.egg-info .pytest_cache .mypy_cache .ruff_cache
find . -type d -name __pycache__ -exec rm -rf {} +
166 changes: 166 additions & 0 deletions langchain/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,166 @@
# TinyFish Web Agent for LangChain

![Powered by TinyFish](https://img.shields.io/badge/Powered%20by-TinyFish-blue)

This package provides a LangChain Tool to run the TinyFish Web Agent directly within your LangChain Agents and Workflows.

TinyFish is a platform for executing complex, goal-oriented tasks on the live web. Unlike traditional scrapers or local browser automation, TinyFish uses a fleet of remote, AI-powered web agents that can navigate complex sites, handle anti-bot protection, and return clean, structured JSON data.

## Installation

```bash
pip install langchain-tinyfish
```

## Configuration

1. Get your TinyFish API key from [agent.tinyfish.ai/api-keys](https://agent.tinyfish.ai/api-keys).
2. Set it as an environment variable:

```bash
export TINYFISH_API_KEY="YOUR_API_KEY"
```

## Quick Start

Here is a simple example of how to use the TinyFish Web Agent to extract the current stock price of NVIDIA from Yahoo Finance.

```python
from langchain_tinyfish import TinyFishWebAutomation

tool = TinyFishWebAutomation()

result = tool.invoke({
"url": "https://finance.yahoo.com/quote/NVDA/",
"goal": "Extract the current stock price of NVIDIA",
})

print(result)
# Output: {"stock_price": 950.02}
```

### Search, Fetch, and Browser Sessions

The package also exposes SDK-backed tools for TinyFish Search, Fetch, and Browser sessions:

```python
from langchain_tinyfish import (
TinyFishBrowserSession,
TinyFishFetch,
TinyFishSearch,
)

search = TinyFishSearch()
fetch = TinyFishFetch()
browser = TinyFishBrowserSession()

search_results = search.invoke({"query": "TinyFish Web Agent docs"})
page_content = fetch.invoke({"urls": ["https://docs.tinyfish.ai"], "format": "markdown"})
session = browser.invoke({"url": "https://example.com"})
```

### With a LangChain Agent

```python
from langchain_openai import ChatOpenAI
from langgraph.prebuilt import create_react_agent
from langchain_tinyfish import TinyFishFetch, TinyFishSearch, TinyFishWebAutomation

llm = ChatOpenAI(model="gpt-4o")
tools = [
TinyFishWebAutomation(),
TinyFishSearch(),
TinyFishFetch(),
]
agent = create_react_agent(llm, tools)

result = agent.invoke({
"messages": [("user", "Go to scrapeme.live/shop and extract the first 5 product names and prices")]
})

for message in result["messages"]:
print(message.content)
```

### Stealth Mode + Proxy

For sites with bot protection (Cloudflare, CAPTCHAs, etc.):

```python
from langchain_tinyfish import TinyFishAPIWrapper, TinyFishWebAutomation

tool = TinyFishWebAutomation(
api_wrapper=TinyFishAPIWrapper(
browser_profile="stealth",
proxy_enabled=True,
proxy_country_code="US", # Also: GB, CA, DE, FR, JP, AU
)
)
```

### Async Usage

```python
import asyncio
from langchain_tinyfish import TinyFishWebAutomation

async def main():
tool = TinyFishWebAutomation()
result = await tool.ainvoke({
"url": "https://example.com",
"goal": "Extract the page title",
})
print(result)

asyncio.run(main())
```

## Use Cases

- **AI Agent Enablement:** Give your AI agent the ability to perform deep research on the web.
- **Workflow Automation:** Monitor a competitor's pricing page and get a Slack notification when it changes.
- **Data Extraction:** Extract job postings, product details, or contact information into a structured format.

## Configuration Options

All parameters are set on the `TinyFishAPIWrapper`:

| Parameter | Default | Description |
|-----------|---------|-------------|
| `api_key` | `$TINYFISH_API_KEY` | Your TinyFish API key |
| `browser_profile` | `"lite"` | `"lite"` (fast) or `"stealth"` (anti-detection) |
| `proxy_enabled` | `False` | Enable proxy routing |
| `proxy_country_code` | `"US"` | Proxy country: US, GB, CA, DE, FR, JP, AU |
| `timeout` | `300` | Request timeout in seconds |

```python
from langchain_tinyfish import TinyFishAPIWrapper, TinyFishWebAutomation

wrapper = TinyFishAPIWrapper(
api_key="sk-mino-...",
browser_profile="stealth",
timeout=600,
)
tool = TinyFishWebAutomation(api_wrapper=wrapper)
```

## Development

```bash
# Install package + dev dependencies
pip install -e .
pip install -r requirements-dev.txt

# Run unit tests
make test

# Run linter
make lint

# Run integration tests (requires TINYFISH_API_KEY)
make integration_test
```

## Support

If you have any questions or need help, please reach out to [support@tinyfish.ai](mailto:support@tinyfish.ai) or join our [Discord community](https://discord.gg/agentql).
Loading