feat: add FunASR transcription component

[LauraGPT]

Summary

• add a dedicated FunASR speech-to-text component for self-hosted OpenAI-compatible endpoints
• default to the local FunASR /v1 endpoint and sensevoice, with optional gateway auth and language selection
• enforce Langflow file-access scopes and SSRF-safe HTTP requests without adding a runtime dependency

Closes #13426

Validation

• 10 focused FunASR component tests (included in 24 passing and 1 skipped lfx-bundles tests)
• 587 passing isolated lfx extension, loader, schema, and migration tests
• migration append-only and globally unique bare-name guards
• Ruff check and format, uv lock --check, and git diff --check
• built the lfx-bundles sdist/wheel, verified both archives contain the FunASR component, and imported the installed wheel in an isolated Python 3.14 environment
• refreshed onto upstream main at 48aac68e99e436520e901a4e3e05e4d6d183bb9c with no source conflicts
• real CPU smoke test against FunASR 1.3.26: sample.wav transcribed as 我想问我在滨海新区有房

Deployment note

When Langflow SSRF protection is enabled, operators should add their self-hosted FunASR host to LANGFLOW_SSRF_ALLOWED_HOSTS; this is surfaced in the component input help.

Summary by CodeRabbit

• New Features

  • Added a FunASR audio transcription component for converting local audio files to text through compatible self-hosted endpoints.
  • Supports optional API keys, language selection, configurable models, and request timeouts.
  • Added the FunASR bundle option to aggregate installation bundles.
  • Added migration support for the new component.

• Bug Fixes

  • Added validation for endpoint URLs and local audio files.
  • Improved handling and reporting of provider and response errors.

[coderabbitai]

Walkthrough

Adds a self-hosted FunASR speech-to-text component with secure local audio handling, validated endpoints, multipart requests, lazy exports, package extras, migration metadata, and tests.

Changes

FunASR transcription

Layer / File(s)	Summary
Package extra and lazy export src/bundles/lfx-bundles/pyproject.toml, src/bundles/lfx-bundles/src/lfx_bundles/funasr/__init__.py	Adds the funasr optional extra to aggregate installations and lazily exports FunASRTranscriptionComponent.
Component contract and input validation src/bundles/lfx-bundles/src/lfx_bundles/funasr/funasr_transcription.py	Defines component metadata and inputs, validates the endpoint, securely opens local audio, and handles secret values.
Multipart transcription flow src/bundles/lfx-bundles/src/lfx_bundles/funasr/funasr_transcription.py	Sends audio to the FunASR-compatible endpoint, validates the response, and returns transcript data or errors.
Migration registration and behavioral validation src/bundles/lfx-bundles/tests/test_funasr_transcription.py, src/lfx/src/lfx/extension/migration/migration_table.json	Registers the component for migration and tests its contract, request handling, security checks, URL validation, and provider errors.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant FunASRTranscriptionComponent
  participant LocalAudioFile
  participant FunASREndpoint
  FunASRTranscriptionComponent->>LocalAudioFile: securely open and read audio
  FunASRTranscriptionComponent->>FunASREndpoint: multipart POST to /audio/transcriptions
  FunASREndpoint-->>FunASRTranscriptionComponent: JSON response with text

Loading

Possibly related PRs

• langflow-ai/langflow#13886: Updates lfx-bundles optional-dependency aggregate handling.

Suggested labels: lgtm

Suggested reviewers: erichare

🚥 Pre-merge checks | ✅ 9

✅ Passed checks (9 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The new component, tests, migration entry, and extras align with the FunASR speech-to-text feature request.
Out of Scope Changes check	✅ Passed	Changes stay focused on the FunASR component, its tests, packaging, and migration entry with no obvious unrelated additions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Test Coverage For New Implementations	✅ Passed	PASS: Added test_funasr_transcription.py covers the new component’s contract, success path, auth/language handling, and error cases.
Test Quality And Coverage	✅ Passed	PASS: The new pytest module covers success, optional auth/language, untrusted-path rejection, invalid URLs, and upstream HTTP/shape errors with behavioral assertions.
Test File Naming And Structure	✅ Passed	PASS: test_funasr_transcription.py follows pytest naming under tests/, has descriptive test_* functions, helpers, grouped scenarios, and both success/failure coverage.
Excessive Mock Usage Warning	✅ Passed	The new tests use only targeted monkeypatches for external file-access and HTTP helpers, while exercising real files and httpx.Response objects, so mocking isn’t excessive.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding a new FunASR transcription component.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/bundles/lfx-bundles/src/lfx_bundles/funasr/funasr_transcription.py`:
- Around line 104-136: The _open_audio_file method must open the
already-validated resolved_path rather than requested_path, and avoid
re-resolving the raw input for the post-open comparison. Use resolved_path for
the open/stat flow so the opened file remains within the validated scope, while
preserving the existing access checks and same-file validation.

In `@src/lfx/src/lfx/extension/migration/migration_table.json`:
- Around line 4913-4918: Extend the migration table entries for
FunASRTranscriptionComponent to include import-path mappings for both
lfx_bundles.funasr.funasr_transcription.FunASRTranscriptionComponent and
lfx_bundles.funasr.FunASRTranscriptionComponent, preserving the same target and
added_in values as the existing bare_class_name mapping.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a3584d42-dd42-4c02-9e1e-c0ad0622f256

📥 Commits

Reviewing files that changed from the base of the PR and between 0a8ef93 and e9c45b2.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• src/bundles/lfx-bundles/pyproject.toml
• src/bundles/lfx-bundles/src/lfx_bundles/funasr/__init__.py
• src/bundles/lfx-bundles/src/lfx_bundles/funasr/funasr_transcription.py
• src/bundles/lfx-bundles/tests/test_funasr_transcription.py
• src/lfx/src/lfx/extension/migration/migration_table.json

[LauraGPT]

Refreshed this PR onto current langflow-ai/main@ce17f022be; the exact signed head is now 036ecbddb686728af02f61aa544a5695877e8a35.

Fresh exact-head verification:

• lfx-bundles: 24 passed, 1 environment-conditional skip
• isolated src/lfx extension suite: 587/587 passed
• Ruff check/format, uv lock --check, and git diff --check: passed
• wheel and sdist built; the wheel installed with local lfx and imported FunASRTranscriptionComponent in a clean virtual environment
• both commits verify with the configured ED25519 key
• both prior CodeRabbit threads remain resolved and the PR is mergeable

GitHub's refreshed full matrix currently reports 160 passed, 0 failed, with only Python 3.10 group 3 still running. @erichare, could you review this bundle integration when convenient? Your recent bundle and connector SSRF work is the closest ownership match.

Python 3.10 Group 5 timeout diagnosis (2026-07-30)

The only code-level red check is an unrelated runner/fixture timeout, not a FunASR assertion failure. Both retry attempts reached 90%, then started src/backend/tests/unit/test_session_metadata.py::test_message_with_session_metadata without ever reporting its result before the 50-minute job limit. The voice_utils test shown at the end was running on the other xdist worker and reported PASSED when the runner terminated; it is not the hanging test.

This PR changes only the FunASR bundle component/tests, the migration table/completeness test, and uv.lock; the new funasr extra is empty and adds no package dependency. A same-window Python 3.10 Group 5 job on #14316 ran the same session-metadata test in about 5 seconds and completed with 2100 passed, 123 skipped, and 2 xfailed: https://github.com/langflow-ai/langflow/actions/runs/30501675389/job/90742555441

Maintainer action needed: please rerun the failed jobs for https://github.com/langflow-ai/langflow/actions/runs/30499744096. The author token cannot rerun this repository workflow (GitHub requires admin rights).