@salesforce/sfdx-agent-sdk 0.34.0 → 0.36.0

package/CHANGELOG.md

@@ -3,6 +3,29 @@
 All notable changes to `@salesforce/sfdx-agent-sdk` are documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.36.0] - 2026-07-27
+
+### Features
+- **harness-openai**: skills bridge (AgentConfig.skills + multi-file skills) @W-23546666 ([#694](https://github.com/forcedotcom/agentic-dx/pull/694))
+- **agent-sdk**: add GPT-4.1 model (sfdc_ai__DefaultGPT41) @W-23564468@ ([#690](https://github.com/forcedotcom/agentic-dx/pull/690))
+- **harness-openai**: rules loader (AgentConfig.rules support) @W-23546667@ ([#689](https://github.com/forcedotcom/agentic-dx/pull/689))
+- **harness-openai**: MCP-tool approval gating @W-23546664@ ([#688](https://github.com/forcedotcom/agentic-dx/pull/688))
+
+## [0.35.0] - 2026-07-22
+
+### Features
+- **harness-openai**: full conformance gate + e2e closeout @W-23447579@ ([#684](https://github.com/forcedotcom/agentic-dx/pull/684))
+- **harness-openai**: scaffold OpenAI Agents SDK harness with connectivity + streamed turn @W-23447570@ ([#675](https://github.com/forcedotcom/agentic-dx/pull/675))
+
+### Fixes
+- **ci**: bump openai harness off seed version so it can publish @W-23447579@ ([#686](https://github.com/forcedotcom/agentic-dx/pull/686))
+
+### Tests
+- **agent-sdk**: add raw-gateway fetch probe to isolate SDK/harness bugs from gateway failures @W-23477193@ ([#674](https://github.com/forcedotcom/agentic-dx/pull/674))
+
+### Chores
+- **deps-dev**: bump eslint from 10.6.0 to 10.7.0 in the eslint group ([#680](https://github.com/forcedotcom/agentic-dx/pull/680))
+
 ## [0.34.0] - 2026-07-15
 
 ### Features

package/dist/agent-connectivity-resolver.d.ts

@@ -1,5 +1,5 @@
 import { Model } from './models/index.js';
-import { type JSONWebToken, type OrgConnection, type OrgConnectionFactory } from '@salesforce/agentic-common';
+import { type JSONWebToken, type OrgConnection, type OrgConnectionFactory, SfApiEnv } from '@salesforce/agentic-common';
 import type { AgentConfig } from './harness/harness-config.js';
 import type { ModelConnectivityInfo, ProviderHint } from './types/model-connectivity-info.js';
 /**
@@ -109,6 +109,34 @@ export declare class DefaultAgentConnectivityResolver implements AgentConnectivi
  * `sfdc_ai__Default*` geo ids to `bedrock-anthropic` (W-23292476).
  */
 export declare function pickProviderHintForGatewayModel(model: Model): ProviderHint;
+/**
+ * Returns the Salesforce LLM Gateway base URL for the given environment.
+ *
+ * Includes the `/ai/gpt/v1` API root: the pass-through endpoints
+ * (`/responses` for OpenAI Responses, `/model/<id>/invoke-with-response-stream`
+ * for Bedrock-Anthropic) live under this prefix, and provider SDKs
+ * (`@anthropic-ai/bedrock-sdk`, `openai`) construct their per-model paths by
+ * concatenation onto the base URL the consumer supplies.
+ *
+ * Exported (module-path only, not on the public `index.ts` surface) so the
+ * `test/smoke/raw-gateway-probe.ts` diagnostic targets the exact same gateway
+ * URL production does, rather than re-stating the env→URL switch (which drifted
+ * before — W-23292476). Same rationale as {@link pickProviderHintForGatewayModel}.
+ */
+export declare function salesforceGatewayBaseUrl(env: SfApiEnv): string;
+/**
+ * Builds the full header set for a Salesforce LLM Gateway request, including the
+ * Authorization Bearer JWT, tenant-key, feature-id, and any model-specific custom
+ * headers. Re-evaluated on every harness call so JWT rotations land on the next
+ * request without rebuilding the bag.
+ *
+ * Exported (module-path only, not on the public `index.ts` surface) so the
+ * `test/smoke/raw-gateway-probe.ts` diagnostic sends the exact same header bag
+ * production does — the minted `Bearer <jwt>` + tenant-key + feature-id is the
+ * one part a hand-rolled request gets wrong, and duplicating it would let the
+ * probe silently drift from the real auth shape.
+ */
+export declare function buildSalesforceGatewayHeaders(orgJwt: JSONWebToken, model: Model): Promise<Record<string, string>>;
 /**
  * Resolves an `AgentConfig.modelId` value (which may be a {@link ModelName} enum value, a
  * pre-built {@link Model} instance, or `undefined`) to a concrete {@link Model}.

package/dist/agent-connectivity-resolver.js

@@ -106,8 +106,13 @@ export function pickProviderHintForGatewayModel(model) {
  * for Bedrock-Anthropic) live under this prefix, and provider SDKs
  * (`@anthropic-ai/bedrock-sdk`, `openai`) construct their per-model paths by
  * concatenation onto the base URL the consumer supplies.
+ *
+ * Exported (module-path only, not on the public `index.ts` surface) so the
+ * `test/smoke/raw-gateway-probe.ts` diagnostic targets the exact same gateway
+ * URL production does, rather than re-stating the env→URL switch (which drifted
+ * before — W-23292476). Same rationale as {@link pickProviderHintForGatewayModel}.
  */
-function salesforceGatewayBaseUrl(env) {
+export function salesforceGatewayBaseUrl(env) {
     switch (env) {
         case SfApiEnv.Dev:
             return 'https://dev.api.salesforce.com/ai/gpt/v1';
@@ -127,8 +132,14 @@ function salesforceGatewayBaseUrl(env) {
  * Authorization Bearer JWT, tenant-key, feature-id, and any model-specific custom
  * headers. Re-evaluated on every harness call so JWT rotations land on the next
  * request without rebuilding the bag.
+ *
+ * Exported (module-path only, not on the public `index.ts` surface) so the
+ * `test/smoke/raw-gateway-probe.ts` diagnostic sends the exact same header bag
+ * production does — the minted `Bearer <jwt>` + tenant-key + feature-id is the
+ * one part a hand-rolled request gets wrong, and duplicating it would let the
+ * probe silently drift from the real auth shape.
  */
-async function buildSalesforceGatewayHeaders(orgJwt, model) {
+export async function buildSalesforceGatewayHeaders(orgJwt, model) {
     const [jwtValue, tenantKey] = await Promise.all([orgJwt.getValue(), orgJwt.getTenantKey()]);
     // Order matters: spread `customHeaders` FIRST so the resolver-set auth /
     // tenant / feature-id headers win on conflict. `customHeaders` is for

package/dist/models/gpt-4-1.d.ts

@@ -0,0 +1,17 @@
+import { Model, ModelName } from './model.js';
+import { type SupportedFileFormat } from './types.js';
+/**
+ * GPT-4.1 on the geo-aware `sfdc_ai__DefaultGPT41` gateway route — the gateway
+ * resolves the regional deployment (parent `llmgateway__GPT41`) while the wire
+ * shape stays OpenAI Responses (Mastra harness). See W-23256760 for the
+ * geo-aware `sfdc_ai__Default*` rename.
+ */
+export declare class GPT41 extends Model {
+    readonly name: ModelName;
+    readonly displayId: string;
+    readonly maxInputTokens: number;
+    readonly maxOutputTokens: number;
+    readonly contextWindow: number;
+    readonly supportsPromptCache: boolean;
+    readonly supportedFormats: readonly SupportedFileFormat[];
+}

package/dist/models/gpt-4-1.js

@@ -0,0 +1,31 @@
+/*
+ * Copyright 2026, Salesforce, Inc. All rights reserved.
+ * See LICENSE.txt for license terms.
+ */
+import { Model, ModelName } from './model.js';
+import { MimeType } from './types.js';
+/**
+ * GPT-4.1 on the geo-aware `sfdc_ai__DefaultGPT41` gateway route — the gateway
+ * resolves the regional deployment (parent `llmgateway__GPT41`) while the wire
+ * shape stays OpenAI Responses (Mastra harness). See W-23256760 for the
+ * geo-aware `sfdc_ai__Default*` rename.
+ */
+export class GPT41 extends Model {
+    name = ModelName.GPT_4_1;
+    displayId = 'GPT-4.1';
+    // Source of truth: hawking-public/shared-public-inference-models `llmgateway/GPT41.yml`
+    // (text inputType.maxInputToken = 128000, max_tokens.maxRangeValue = 32768). GPT-4.1's
+    // context is markedly smaller than the GPT-5.x long-context variants.
+    maxInputTokens = 128000;
+    maxOutputTokens = 32768;
+    contextWindow = 128000;
+    supportsPromptCache = false;
+    // png/jpeg only — `GPT41.yml` declares no pdf input type (unlike the GPT-5.x models). The
+    // registry allows 20 MB / 50 images per format, but the SDK's global 15 MiB total / 10-file
+    // caps bind first, so no per-format caps.
+    supportedFormats = [
+        { name: 'png', mimeType: MimeType.Png },
+        { name: 'jpeg', mimeType: MimeType.Jpeg },
+    ];
+}
+//# sourceMappingURL=gpt-4-1.js.map

package/dist/models/index.d.ts

@@ -2,6 +2,7 @@ import { Model, ModelName } from './model.js';
 export { Model, ModelName, type ThinkingMode } from './model.js';
 export { MimeType, type SupportedFileFormat, type MultimodalFile } from './types.js';
 export { validateMultimodalFiles, MAX_FILES_PER_REQUEST, MAX_TOTAL_FILE_BYTES } from './multimodal.js';
+export { GPT41 } from './gpt-4-1.js';
 export { GPT5 } from './gpt-5.js';
 export { GPT51 } from './gpt-5-1.js';
 export { GPT52 } from './gpt-5-2.js';

package/dist/models/index.js

@@ -3,6 +3,7 @@
  * See LICENSE.txt for license terms.
  */
 import { Model, ModelName } from './model.js';
+import { GPT41 } from './gpt-4-1.js';
 import { GPT5 } from './gpt-5.js';
 import { GPT51 } from './gpt-5-1.js';
 import { GPT52 } from './gpt-5-2.js';
@@ -17,6 +18,7 @@ import { ClaudeOpus48 } from './claude-opus-4-8.js';
 export { Model, ModelName } from './model.js';
 export { MimeType } from './types.js';
 export { validateMultimodalFiles, MAX_FILES_PER_REQUEST, MAX_TOTAL_FILE_BYTES } from './multimodal.js';
+export { GPT41 } from './gpt-4-1.js';
 export { GPT5 } from './gpt-5.js';
 export { GPT51 } from './gpt-5-1.js';
 export { GPT52 } from './gpt-5-2.js';
@@ -55,6 +57,8 @@ export function getDefault() {
 export function getByName(modelName) {
     // Map a legacy pinned id to its canonical member; leave canonical ids untouched.
     const canonical = LEGACY_MODEL_ID_ALIASES[modelName] ?? modelName;
+    if (canonical === ModelName.GPT_4_1)
+        return new GPT41();
     if (canonical === ModelName.GPT_5)
         return new GPT5();
     if (canonical === ModelName.GPT_5_1)

package/dist/models/model.d.ts

@@ -36,6 +36,7 @@ export type ThinkingMode = 'enabled' | 'adaptive' | 'disabled';
  * silently miss escape-hatch ids.
  */
 export declare enum ModelName {
+    GPT_4_1 = "sfdc_ai__DefaultGPT41",
     GPT_5 = "sfdc_ai__DefaultGPT5",
     GPT_5_1 = "sfdc_ai__DefaultGPT51",
     GPT_5_2 = "sfdc_ai__DefaultGPT52",

package/dist/models/model.js

@@ -24,6 +24,7 @@
  */
 export var ModelName;
 (function (ModelName) {
+    ModelName["GPT_4_1"] = "sfdc_ai__DefaultGPT41";
     ModelName["GPT_5"] = "sfdc_ai__DefaultGPT5";
     ModelName["GPT_5_1"] = "sfdc_ai__DefaultGPT51";
     ModelName["GPT_5_2"] = "sfdc_ai__DefaultGPT52";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/sfdx-agent-sdk",
-  "version": "0.34.0",
+  "version": "0.36.0",
   "description": "Harness-agnostic agentic infrastructure for Salesforce developer experience tooling",
   "type": "module",
   "main": "dist/index.js",
@@ -31,6 +31,7 @@
     "test:e2e:local:cleanup": "node scripts/local-e2e-cleanup.mjs",
     "test:smoke": "tsc --build ./test/tsconfig.json && vitest run -c ./test/smoke/vitest.config.ts",
     "test:smoke:local": "node scripts/local-smoke.mjs",
+    "test:raw-probe:local": "node scripts/local-raw-probe.mjs",
     "verify": "tsx scripts/verify.ts"
   },
   "license": "SEE LICENSE IN LICENSE.txt",
@@ -46,16 +47,17 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@salesforce/sfdx-agent-harness-claude": "0.30.0",
-    "@salesforce/sfdx-agent-harness-mastra": "0.33.0",
+    "@salesforce/sfdx-agent-harness-claude": "0.32.0",
+    "@salesforce/sfdx-agent-harness-mastra": "0.35.0",
+    "@salesforce/sfdx-agent-harness-openai": "0.1.0",
     "@types/node": "^22.20.0",
     "@vitest/coverage-istanbul": "^4.1.10",
-    "@vitest/eslint-plugin": "^1.6.23",
+    "@vitest/eslint-plugin": "^1.6.22",
     "eslint": "^10.7.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-n": "^18.2.2",
+    "eslint-plugin-n": "^18.2.1",
     "globals": "^17.6.0",
     "lint-staged": "^17.0.7",
     "prettier": "^3.9.4",