@macaw-ai/client 0.0.0-stage → 0.9.10

package/payload/secureAI/examples/openai/openai_1b_multiuser_bind_streaming.py

@@ -0,0 +1,199 @@
+#!/usr/bin/env python3
+"""
+openai_1b_multiuser_bind_streaming.py - Multi-user OpenAI with streaming
+
+Same as 1b but demonstrates streaming responses with bind_to_user pattern.
+
+Prerequisites:
+    - MACAW SDK installed (pip install macaw-client macaw-adapters)
+    - OPENAI_API_KEY environment variable
+    - Identity Provider configured (Console -> Settings -> Identity Bridge)
+    - Test users: alice/Alice123!, bob/Bob@123!
+
+Run:
+    export OPENAI_API_KEY=sk-...
+    python openai_1b_multiuser_bind_streaming.py
+
+No IdP configured? Run simpler example first:
+    python openai_1a_dropin_simple.py
+"""
+
+import os
+import sys
+
+from macaw_adapters.openai import SecureOpenAI
+from macaw_client import MACAWClient, RemoteIdentityProvider
+
+
+# Test configurations based on user policies
+# Alice: GPT-3.5 only, max 500 tokens
+# Bob: GPT-3.5/4, max 2000 tokens
+USER_TESTS = {
+    "alice": {
+        "password": "Alice123!",
+        "policy_desc": "GPT-3.5 only, max 500 tokens",
+        "tests": [
+            # (model, max_tokens, should_succeed)
+            ("gpt-3.5-turbo", 400, True),   # ALLOWED - correct model, within limit
+            ("gpt-4", 400, False),           # BLOCKED - alice can't use GPT-4
+            ("gpt-3.5-turbo", 600, False),   # BLOCKED - exceeds max_tokens
+        ]
+    },
+    "bob": {
+        "password": "Bob@123!",
+        "policy_desc": "GPT-3.5/4, max 2000 tokens",
+        "tests": [
+            ("gpt-3.5-turbo", 400, True),   # ALLOWED
+            ("gpt-4", 400, True),            # ALLOWED - bob CAN use GPT-4
+            ("gpt-3.5-turbo", 600, True),   # ALLOWED - within bob's 2000 limit
+            ("gpt-4", 2500, False),          # BLOCKED - exceeds max_tokens
+        ]
+    }
+}
+
+
+def create_user_client(username: str, password: str) -> MACAWClient:
+    """Create authenticated user client."""
+    print(f"  Authenticating {username}...")
+    jwt_token, _ = RemoteIdentityProvider().login(username, password)
+
+    user = MACAWClient(
+        user_name=username,
+        iam_token=jwt_token,
+        agent_type="user",
+        app_name="financial-app"
+    )
+
+    if not user.register():
+        raise RuntimeError(f"Failed to register user {username}")
+
+    print(f"  User agent: {user.agent_id}")
+    return user
+
+
+def test_user(username: str, openai_service: SecureOpenAI):
+    """Test a user with bind_to_user pattern."""
+    config = USER_TESTS[username]
+
+    print(f"\n{'=' * 60}")
+    print(f"Testing {username.upper()} via bind_to_user")
+    print(f"Policy: {config['policy_desc']}")
+    print("=" * 60)
+
+    # 1. Create user client with JWT
+    user_client = create_user_client(username, config["password"])
+
+    # 2. Bind user to service
+    print(f"\n  Binding to service: {openai_service.server_id}")
+    user_openai = openai_service.bind_to_user(user_client)
+
+    # 3. Test with different parameters
+    print(f"\n  Running tests:")
+    for model, max_tokens, should_succeed in config["tests"]:
+        expected = "SHOULD SUCCEED" if should_succeed else "SHOULD BE BLOCKED"
+        print(f"\n  -> {model}, {max_tokens} tokens ({expected})")
+
+        try:
+            response = user_openai.chat.completions.create(
+                model=model,
+                max_tokens=max_tokens,
+                messages=[
+                    {"role": "system", "content": "You are a financial analyst."},
+                    {"role": "user", "content": "What is revenue growth? Brief answer."}
+                ],
+                stream=True
+            )
+
+            if should_succeed:
+                print(f"     SUCCESS (as expected)")
+                # Collect streaming chunks
+                collected_content = []
+                chunk_count = 0
+                for chunk in response:
+                    chunk_count += 1
+                    if chunk.choices and chunk.choices[0].delta.content:
+                        collected_content.append(chunk.choices[0].delta.content)
+                full_content = "".join(collected_content)
+                print(f"     Chunks received: {chunk_count}")
+                print(f"     Response: {full_content[:60]}...")
+            else:
+                print(f"     UNEXPECTED SUCCESS - should have been blocked!")
+
+        except Exception as e:
+            error = str(e)
+            is_policy_block = any(word in error.lower() for word in
+                                  ["not in allowed", "not permitted", "policy",
+                                   "max_tokens", "model", "blocked", "denied"])
+            if is_policy_block:
+                if should_succeed:
+                    print(f"     UNEXPECTED BLOCK: {error[:60]}...")
+                else:
+                    print(f"     CORRECTLY BLOCKED by policy")
+            else:
+                print(f"     ERROR: {error[:60]}...")
+
+    # 4. Cleanup
+    print(f"\n  Unbinding user...")
+    user_openai.unbind()
+    print(f"  is_bound: {user_openai.is_bound}")
+
+
+def main():
+    # Check for API key
+    if not os.environ.get("OPENAI_API_KEY"):
+        print("Set OPENAI_API_KEY environment variable")
+        print("  export OPENAI_API_KEY=sk-...")
+        return
+
+    print("=" * 60)
+    print("Example 1b: Multi-user with bind_to_user (OpenAI)")
+    print("=" * 60)
+    print("\nPath: bind_to_user (per-user identity)")
+    print("Use when: SaaS app, different users need different permissions")
+    print("\nArchitecture:")
+    print("  - Single SecureOpenAI service (shared)")
+    print("  - Per-user MACAWClient with JWT identity")
+    print("  - bind_to_user() connects user to service")
+    print("  - User's identity flows through for policy evaluation")
+
+    # Create SINGLE service (shared across all users)
+    print("\n--- Creating SecureOpenAI service ---")
+    openai_service = SecureOpenAI(app_name="openai-service")
+    print(f"Service registered: {openai_service.server_id}")
+    print(f"Mode: {openai_service._mode}")
+
+    # Test alice (restricted)
+    try:
+        test_user("alice", openai_service)
+    except Exception as e:
+        print(f"\nFailed to test alice: {e}")
+
+    # Test bob (enhanced)
+    try:
+        test_user("bob", openai_service)
+    except Exception as e:
+        print(f"\nFailed to test bob: {e}")
+
+    print("\n" + "=" * 60)
+    print("Example complete!")
+    print("=" * 60)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except Exception as e:
+        err = str(e)
+        print("\n" + "=" * 60)
+        if "OPENAI_API_KEY" in err or "api_key" in err.lower():
+            print("ERROR: OpenAI API key not configured")
+            print("Fix: export OPENAI_API_KEY=sk-...")
+        elif "Local provider does not support" in err:
+            print("ERROR: Identity Provider not configured")
+            print("Fix: Console -> Settings -> Identity Bridge")
+            print("\nOr run simpler example first:")
+            print("  python openai_1a_dropin_simple.py")
+        else:
+            print(f"ERROR: {e}")
+        print("=" * 60)
+        sys.exit(1)

package/payload/secureAI/examples/openai/openai_1c_a2a_invoke.py

@@ -0,0 +1,156 @@
+#!/usr/bin/env python3
+"""
+openai_1c_a2a_invoke.py - Agent-to-Agent invocation with invoke_tool
+
+Demonstrates explicit tool invocation for agent systems and cross-service calls.
+Use when you need fine-grained control over routing and tool invocation.
+
+Prerequisites:
+    - MACAW SDK installed (pip install macaw-client macaw-adapters)
+    - OPENAI_API_KEY environment variable
+    - Identity Provider configured (Console -> Settings -> Identity Bridge)
+    - Test users: alice/Alice123!
+
+Run:
+    export OPENAI_API_KEY=sk-...
+    python openai_1c_a2a_invoke.py
+
+No IdP configured? Run simpler example first:
+    python openai_1a_dropin_simple.py
+"""
+
+import os
+import sys
+
+from macaw_adapters.openai import SecureOpenAI
+from macaw_client import MACAWClient, RemoteIdentityProvider
+
+
+def main():
+    # Check for API key
+    if not os.environ.get("OPENAI_API_KEY"):
+        print("Set OPENAI_API_KEY environment variable")
+        print("  export OPENAI_API_KEY=sk-...")
+        return
+
+    print("=" * 60)
+    print("Example 1c: A2A with invoke_tool (OpenAI)")
+    print("=" * 60)
+    print("\nPath: invoke_tool (explicit A2A control)")
+    print("Use when: Agent systems, explicit control, cross-service calls")
+    print("\nArchitecture:")
+    print("  - SecureOpenAI service registers tools")
+    print("  - User agent calls invoke_tool() directly")
+    print("  - Must know MAPL tool name: tool:<app>/generate")
+    print("  - Returns raw dict (not SDK types)")
+
+    # 1. Create OpenAI service
+    print("\n--- Creating SecureOpenAI service ---")
+    openai_service = SecureOpenAI(app_name="openai-service")
+    print(f"Service registered: {openai_service.server_id}")
+    print(f"Tools registered:")
+    for tool_name in openai_service.tools.keys():
+        print(f"  - {tool_name}")
+
+    # 2. Create user agent with JWT
+    print("\n--- Creating user agent ---")
+    print("  Authenticating alice...")
+    jwt_token, _ = RemoteIdentityProvider().login("alice", "Alice123!")
+
+    user = MACAWClient(
+        user_name="alice",
+        iam_token=jwt_token,
+        agent_type="user",
+        app_name="my-agent"
+    )
+
+    if not user.register():
+        print("  Failed to register user agent")
+        return
+
+    print(f"  User agent: {user.agent_id}")
+
+    # 3. Explicit invoke_tool
+    print("\n--- Test 1: Direct invoke_tool ---")
+    print(f"  Tool name: tool:{openai_service.app_name}/generate")
+    print(f"  Target: {openai_service.server_id}")
+
+    result = user.invoke_tool(
+        tool_name=f"tool:{openai_service.app_name}/generate",
+        parameters={
+            "model": "gpt-3.5-turbo",
+            "max_tokens": 100,
+            "messages": [
+                {"role": "system", "content": "You are a financial analyst."},
+                {"role": "user", "content": "What is compound interest? Brief answer."}
+            ]
+        },
+        target_agent=openai_service.server_id
+    )
+
+    # Result is raw dict - you handle parsing
+    if isinstance(result, dict):
+        if "error" in result:
+            print(f"  Error: {result['error']}")
+        elif "choices" in result:
+            content = result["choices"][0]["message"]["content"]
+            print(f"  Success!")
+            print(f"  Model: {result.get('model')}")
+            print(f"  Response: {content[:80]}...")
+        else:
+            print(f"  Unexpected result: {result}")
+
+    # 4. Test policy enforcement
+    print("\n--- Test 2: Policy enforcement (GPT-4 blocked for alice) ---")
+    try:
+        result = user.invoke_tool(
+            tool_name=f"tool:{openai_service.app_name}/generate",
+            parameters={
+                "model": "gpt-4",  # Alice can't use GPT-4!
+                "max_tokens": 100,
+                "messages": [{"role": "user", "content": "Hello"}]
+            },
+            target_agent=openai_service.server_id
+        )
+
+        if isinstance(result, dict) and "error" in result:
+            print(f"  Correctly blocked: {result['error'][:60]}...")
+        else:
+            print(f"  Unexpected - should have been blocked!")
+    except Exception as e:
+        print(f"  Correctly blocked: {str(e)[:60]}...")
+
+    # 5. Service discovery (optional advanced feature)
+    print("\n--- Service Discovery ---")
+    print("  (Agents can discover services dynamically via registry)")
+    print(f"  Known service: {openai_service.server_id}")
+    print(f"  Tool pattern: tool:<app_name>/generate")
+
+    print("\n" + "=" * 60)
+    print("Example complete!")
+    print("=" * 60)
+    print("\nKey differences from bind_to_user:")
+    print("  - Must know MAPL tool names (tool:xxx/generate)")
+    print("  - Must know target agent server_id")
+    print("  - Returns raw dict (not ChatCompletion)")
+    print("  - More control, but more responsibility")
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except Exception as e:
+        err = str(e)
+        print("\n" + "=" * 60)
+        if "OPENAI_API_KEY" in err or "api_key" in err.lower():
+            print("ERROR: OpenAI API key not configured")
+            print("Fix: export OPENAI_API_KEY=sk-...")
+        elif "Local provider does not support" in err:
+            print("ERROR: Identity Provider not configured")
+            print("Fix: Console -> Settings -> Identity Bridge")
+            print("\nOr run simpler example first:")
+            print("  python openai_1a_dropin_simple.py")
+        else:
+            print(f"ERROR: {e}")
+        print("=" * 60)
+        sys.exit(1)

package/payload/secureAI/examples/openai/openai_1d_invocation_patterns.py

@@ -0,0 +1,337 @@
+#!/usr/bin/env python3
+"""
+openai_1d_invocation_patterns.py - Compare invoke_tool vs bind_to_user
+
+Compares two ways to invoke SecureOpenAI with the same security guarantees:
+
+PATH 1: Direct invoke_tool
+  - Explicit A2A (agent-to-agent) control
+  - Must know MAPL tool name: tool:<app>/generate
+  - Returns raw dict
+  - Use when: Agent systems, cross-service calls, custom routing
+
+PATH 2: bind_to_user wrapper
+  - OpenAI-compatible API (chat.completions.create)
+  - Familiar SDK experience
+  - Internally calls invoke_tool
+  - Use when: Drop-in replacement, developer ergonomics
+
+Both paths enforce per-user policies and propagate JWT identity.
+
+Prerequisites:
+    - MACAW SDK installed (pip install macaw-client macaw-adapters)
+    - OPENAI_API_KEY environment variable
+    - Identity Provider configured (Console -> Settings -> Identity Bridge)
+    - Test users: alice/Alice123!, bob/Bob@123!
+
+Run:
+    export OPENAI_API_KEY=sk-...
+    python openai_1d_invocation_patterns.py
+
+No IdP configured? Run simpler example first:
+    python openai_1a_dropin_simple.py
+"""
+
+import os
+import sys
+
+from macaw_adapters.openai import SecureOpenAI
+from macaw_client import MACAWClient, RemoteIdentityProvider
+
+
+# User-specific test configurations based on their policies
+# Alice: GPT-3.5 only, max 500 tokens
+# Bob: GPT-3.5/4, max 2000 tokens
+USER_TESTS = {
+    "alice": {
+        "password": "Alice123!",
+        "policy_desc": "gpt-3.5-turbo only, max_tokens <= 500",
+        "tests": [
+            # (model, max_tokens, query, should_succeed)
+            ("gpt-3.5-turbo", 400, "What is revenue growth?", True),          # ALLOWED
+            ("gpt-4", 400, "What is revenue growth?", False),                  # BLOCKED - wrong model
+            ("gpt-3.5-turbo", 600, "What is compound interest?", False),       # BLOCKED - exceeds max_tokens
+        ]
+    },
+    "bob": {
+        "password": "Bob@123!",
+        "policy_desc": "gpt-3.5-turbo/gpt-4, max_tokens <= 2000",
+        "tests": [
+            # (model, max_tokens, query, should_succeed)
+            ("gpt-3.5-turbo", 400, "What is revenue growth?", True),          # ALLOWED
+            ("gpt-4", 400, "What is market cap?", True),                       # ALLOWED - Bob CAN use gpt-4
+            ("gpt-3.5-turbo", 600, "What is compound interest?", True),        # ALLOWED - Bob's limit is 2000
+            ("gpt-4", 2500, "Deep financial analysis", False),                 # BLOCKED - exceeds max_tokens
+        ]
+    }
+}
+
+
+def test_user_path1(username: str, openai_service: SecureOpenAI):
+    """
+    PATH 1: Direct invoke_tool (explicit A2A control).
+
+    invoke_tool auto-creates authenticated prompts based on registry lookup.
+    """
+    print(f"\n{'='*60}")
+    print(f"PATH 1: {username.upper()} via invoke_tool")
+    print("="*60)
+
+    user_config = USER_TESTS[username]
+
+    # 1. Get JWT
+    print(f"1. Authenticating...")
+    jwt_token, _ = RemoteIdentityProvider().login(username, user_config["password"])
+    print("   OK Got JWT token")
+
+    # 2. Create user agent with JWT
+    print("2. Creating user agent...")
+    user = MACAWClient(
+        user_name=username,
+        iam_token=jwt_token,  # Converted to embedded_context automatically!
+        agent_type="user",
+        app_name="financial-analyzer"
+    )
+
+    if not user.register():
+        print("   FAIL Failed to create user agent")
+        return None
+    print(f"   OK User agent: {user.agent_id}")
+
+    # 3. Test with invoke_tool (auto-creates authenticated prompts!)
+    tests = user_config["tests"]
+
+    print(f"\n3. Testing via invoke_tool to service {openai_service.server_id}:")
+    print("   (invoke_tool will auto-create authenticated prompts for 'messages')")
+    print(f"   Policy: {username} -> {user_config['policy_desc']}")
+
+    for model, max_tokens, query, should_succeed in tests:
+        expected = "SHOULD SUCCEED" if should_succeed else "SHOULD BE BLOCKED"
+        print(f"\n   -> {model} with {max_tokens} tokens ({expected})")
+
+        try:
+            # A2A call to single service agent
+            # invoke_tool auto-creates authenticated prompts!
+            result = user.invoke_tool(
+                tool_name=f"tool:{openai_service.app_name}/generate",
+                parameters={
+                    "model": model,
+                    "max_tokens": max_tokens,
+                    "messages": [
+                        {"role": "system", "content": "You are a financial analyst."},
+                        {"role": "user", "content": query}
+                    ]
+                },
+                target_agent=openai_service.server_id
+            )
+
+            # Check if we got a valid response
+            if isinstance(result, dict):
+                if "error" in result:
+                    if should_succeed:
+                        print(f"     FAIL UNEXPECTED FAILURE: {result['error']}")
+                    else:
+                        print(f"     PASS CORRECTLY BLOCKED: {result['error'][:60]}...")
+                elif "choices" in result:
+                    if should_succeed:
+                        print(f"     PASS SUCCESS (as expected)")
+                        print(f"       Model: {result.get('model')}")
+                        content = result.get('choices', [{}])[0].get('message', {}).get('content', '')
+                        print(f"       Response: {content[:80]}...")
+                    else:
+                        print(f"     FAIL UNEXPECTED SUCCESS - should have been blocked!")
+                else:
+                    print(f"     FAIL Unexpected response: {result}")
+            else:
+                print(f"     FAIL Invalid response type: {type(result)}")
+
+        except Exception as e:
+            error = str(e)
+            is_policy_block = ("not in allowed" in error or "not permitted" in error or
+                               "policy" in error.lower() or "max_tokens" in error or
+                               "model" in error or "blocked" in error.lower())
+            if is_policy_block:
+                if should_succeed:
+                    print(f"     FAIL UNEXPECTED BLOCK: {error}")
+                else:
+                    print(f"     PASS CORRECTLY BLOCKED by policy")
+            else:
+                print(f"     FAIL Error: {error}")
+
+    return user
+
+
+def test_user_path2(username: str, openai_service: SecureOpenAI):
+    """
+    PATH 2: bind_to_user wrapper (OpenAI-compatible API).
+
+    Same underlying invoke_tool, but wrapped in OpenAI-compatible API.
+    """
+    print(f"\n{'='*60}")
+    print(f"PATH 2: {username.upper()} via bind_to_user")
+    print("="*60)
+
+    user_config = USER_TESTS[username]
+
+    # 1. Get JWT
+    print(f"1. Authenticating...")
+    jwt_token, _ = RemoteIdentityProvider().login(username, user_config["password"])
+    print("   OK Got JWT token")
+
+    # 2. Create user agent with JWT
+    print("2. Creating user agent...")
+    user = MACAWClient(
+        user_name=username,
+        iam_token=jwt_token,
+        agent_type="user",
+        app_name="financial-analyzer"
+    )
+
+    if not user.register():
+        print("   FAIL Failed to create user agent")
+        return
+    print(f"   OK User agent: {user.agent_id}")
+
+    # 3. Bind user to service
+    print("3. Binding user to SecureOpenAI service...")
+    user_openai = openai_service.bind_to_user(user)
+    print(f"   OK Bound to: {openai_service.server_id}")
+
+    # 4. Test with OpenAI-style API
+    tests = user_config["tests"]
+
+    print(f"\n4. Testing via bind_to_user wrapper:")
+    print("   (internally calls invoke_tool which auto-creates auth prompts)")
+    print(f"   Policy: {username} -> {user_config['policy_desc']}")
+
+    for model, max_tokens, query, should_succeed in tests:
+        expected = "SHOULD SUCCEED" if should_succeed else "SHOULD BE BLOCKED"
+        print(f"\n   -> {model} with {max_tokens} tokens ({expected})")
+
+        try:
+            response = user_openai.chat.completions.create(
+                model=model,
+                max_tokens=max_tokens,
+                messages=[
+                    {"role": "system", "content": "You are a financial analyst."},
+                    {"role": "user", "content": query}
+                ]
+            )
+
+            if should_succeed:
+                print(f"     PASS SUCCESS (as expected)")
+                print(f"       Model: {response.model}")
+                print(f"       Response: {response.choices[0].message.content[:80]}...")
+            else:
+                print(f"     FAIL UNEXPECTED SUCCESS - should have been blocked!")
+
+        except Exception as e:
+            error = str(e)
+            is_policy_block = ("not in allowed" in error or "not permitted" in error or
+                               "policy" in error.lower() or "max_tokens" in error or
+                               "model" in error or "blocked" in error.lower())
+            if is_policy_block:
+                if should_succeed:
+                    print(f"     FAIL UNEXPECTED BLOCK: {error}")
+                else:
+                    print(f"     PASS CORRECTLY BLOCKED by policy")
+            else:
+                print(f"     FAIL Error: {error}")
+
+    # 5. Demonstrate unbind
+    print(f"\n5. Testing unbind()...")
+    print(f"   is_bound before: {user_openai.is_bound}")
+    user_openai.unbind()
+    print(f"   is_bound after: {user_openai.is_bound}")
+    try:
+        user_openai.chat.completions.create(model="gpt-3.5-turbo", messages=[{"role": "user", "content": "test"}])
+        print(f"     FAIL Call should have failed after unbind!")
+    except RuntimeError as e:
+        print(f"     PASS Correctly rejected: {str(e)[:50]}...")
+
+
+def main():
+    """Compare both invocation patterns with multi-user policy enforcement."""
+    print("\n" + "="*70)
+    print("Invocation Patterns Demo + MACAW Policy Enforcement")
+    print("="*70)
+    print("\nArchitecture:")
+    print("  - Single SecureOpenAI service agent (created once)")
+    print("  - User agents with JWT -> embedded_context (automatic)")
+    print("  - A2A calls: User -> SecureOpenAI service")
+    print("  - Policy enforcement at ToolAgent PEP level")
+    print("  - Authenticated prompts auto-created by invoke_tool")
+
+    print("\nTwo invocation patterns tested:")
+    print("  PATH 1: Direct invoke_tool (explicit A2A control)")
+    print("  PATH 2: bind_to_user wrapper (OpenAI-compatible API)")
+
+    print("\nExpected policies (enforced by ToolAgent PEP):")
+    print("  - Alice: GPT-3.5 only, max 500 tokens")
+    print("  - Bob: GPT-3.5/4, max 2000 tokens")
+
+    if not os.environ.get("OPENAI_API_KEY"):
+        print("\nWARNING: No OPENAI_API_KEY - demo will fail")
+        print("   Set with: export OPENAI_API_KEY=sk-...")
+        return
+
+    # Create SINGLE SecureOpenAI service (ONCE!)
+    print("\n" + "="*70)
+    print("Creating single SecureOpenAI service agent...")
+    print("="*70)
+
+    openai_service = SecureOpenAI(
+        api_key=os.environ.get("OPENAI_API_KEY"),
+        app_name="openai-service"
+    )
+
+    print(f"OK SecureOpenAI service: {openai_service.server_id}")
+
+    # Test Alice with PATH 1 (invoke_tool)
+    try:
+        test_user_path1("alice", openai_service)
+    except Exception as e:
+        print(f"\nFAIL Failed PATH 1 for alice: {e}")
+
+    # Test Alice with PATH 2 (bind_to_user)
+    try:
+        test_user_path2("alice", openai_service)
+    except Exception as e:
+        print(f"\nFAIL Failed PATH 2 for alice: {e}")
+
+    # Test Bob with PATH 1 (invoke_tool)
+    try:
+        test_user_path1("bob", openai_service)
+    except Exception as e:
+        print(f"\nFAIL Failed PATH 1 for bob: {e}")
+
+    # Test Bob with PATH 2 (bind_to_user)
+    try:
+        test_user_path2("bob", openai_service)
+    except Exception as e:
+        print(f"\nFAIL Failed PATH 2 for bob: {e}")
+
+    # Summary
+    print("\n" + "="*70)
+    print("Demo complete!")
+    print("="*70)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except Exception as e:
+        err = str(e)
+        print("\n" + "=" * 60)
+        if "OPENAI_API_KEY" in err or "api_key" in err.lower():
+            print("ERROR: OpenAI API key not configured")
+            print("Fix: export OPENAI_API_KEY=sk-...")
+        elif "Local provider does not support" in err:
+            print("ERROR: Identity Provider not configured")
+            print("Fix: Console -> Settings -> Identity Bridge")
+            print("\nOr run simpler example first:")
+            print("  python openai_1a_dropin_simple.py")
+        else:
+            print(f"ERROR: {e}")
+        print("=" * 60)
+        sys.exit(1)