@datalayer/agent-runtimes 1.3.39 → 1.3.40

package/lib/loop/plugins/chat/ChatView.js

@@ -1100,6 +1100,12 @@ export default function ChatView({ workspace }) {
         // a new identity would resend the last suggestion.
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [suggestion]);
+    /*
+     * An application's session checks who is calling (LOOP R-32, R-04): its
+     * chat says so with the person's token. The embed hands its own.
+     */
+    const runsApp = Boolean(blueprintTurn?.createPayload?.app_spec);
+    const iamToken = useIAMStore(state => state.token);
     const protocol = useMemo(() => inPage
         ? browserProtocolConfig({
             agentId: member?.specId ?? agentId,
@@ -1132,9 +1138,10 @@ export default function ChatView({ workspace }) {
             // (LOOP R-04): each thread a session, recorded under its uid,
             // run in the name the application runs in, and taking what the
             // page did besides the message — the same AG-UI events back.
-            endpoint: blueprintTurn?.createPayload?.app_spec
+            endpoint: runsApp
                 ? `${agentServerUrl}/api/v1/apps/agents/${encodeURIComponent(agentId)}/ag-ui/`
                 : `${agentServerUrl}/api/v1/ag-ui/${agentId}/`,
+            ...(runsApp && iamToken ? { authToken: iamToken } : {}),
             agentId,
             // `/api/v1/configure`, not `/api/v1/configure/config`: the hooks
             // strip one trailing `config`/`configure` segment to find the API
@@ -1152,6 +1159,8 @@ export default function ChatView({ workspace }) {
         blueprintTurn,
         activeModel,
         agentServerUrl,
+        runsApp,
+        iamToken,
     ]);
     /*
      * The model catalogue, and the builtin tools and skills the agent reports.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@datalayer/agent-runtimes",
-    "version": "1.3.39",
+    "version": "1.3.40",
     "type": "module",
     "workspaces": [
         ".",