langsmith 0.7.9 → 0.7.11

package/dist/_openapi_client/resources/index.d.ts

@@ -1,15 +1,4 @@
-export { AnnotationQueues, type AnnotationQueueRubricItemSchema, type AnnotationQueueSchema, type AnnotationQueueSizeSchema, type RunSchemaWithAnnotationQueueInfo, type AnnotationQueueRetrieveResponse, type AnnotationQueueUpdateResponse, type AnnotationQueueDeleteResponse, type AnnotationQueueCreateRunStatusResponse, type AnnotationQueueExportResponse, type AnnotationQueuePopulateResponse, type AnnotationQueueRetrieveAnnotationQueuesResponse, type AnnotationQueueRetrieveQueuesResponse, type AnnotationQueueUpdateParams, type AnnotationQueueAnnotationQueuesParams, type AnnotationQueueCreateRunStatusParams, type AnnotationQueueExportParams, type AnnotationQueuePopulateParams, type AnnotationQueueRetrieveAnnotationQueuesParams, type AnnotationQueueRetrieveRunParams, type AnnotationQueueRetrieveSizeParams, type AnnotationQueueRetrieveTotalArchivedParams, type AnnotationQueueRetrieveAnnotationQueuesResponsesOffsetPaginationTopLevelArray, } from './annotation-queues/annotation-queues.js';
-export { Commits, type CommitManifestResponse, type CommitWithLookups, type CommitCreateResponse, type CommitRetrieveResponse, type CommitCreateParams, type CommitRetrieveParams, type CommitListParams, type CommitWithLookupsOffsetPaginationCommits, } from './commits.js';
 export { Datasets, type DataType, type Dataset, type DatasetTransformation, type DatasetVersion, type FeedbackCreateCoreSchema, type Missing, type SortByDatasetColumn, type DatasetUpdateResponse, type DatasetDeleteResponse, type DatasetCloneResponse, type DatasetRetrieveCsvResponse, type DatasetRetrieveJSONLResponse, type DatasetRetrieveOpenAIResponse, type DatasetRetrieveOpenAIFtResponse, type DatasetCreateParams, type DatasetUpdateParams, type DatasetListParams, type DatasetCloneParams, type DatasetRetrieveCsvParams, type DatasetRetrieveJSONLParams, type DatasetRetrieveOpenAIParams, type DatasetRetrieveOpenAIFtParams, type DatasetRetrieveVersionParams, type DatasetUpdateTagsParams, type DatasetUploadParams, type DatasetVersionsOffsetPaginationTopLevelArray, type DatasetsOffsetPaginationTopLevelArray, } from './datasets/datasets.js';
-export { Evaluators, type CodeEvaluatorTopLevel, type Evaluator, type EvaluatorPagerdutyAlert, type EvaluatorTopLevel, type EvaluatorWebhook, type EvaluatorListResponse, type EvaluatorListParams, } from './evaluators.js';
-export { Examples, type AttachmentsOperations, type Example, type ExampleSelect, type ExampleUpdateResponse, type ExampleDeleteResponse, type ExampleDeleteAllResponse, type ExampleRetrieveCountResponse, type ExampleUploadFromCsvResponse, type ExampleCreateParams, type ExampleRetrieveParams, type ExampleUpdateParams, type ExampleListParams, type ExampleDeleteAllParams, type ExampleRetrieveCountParams, type ExampleUploadFromCsvParams, type ExamplesOffsetPaginationTopLevelArray, } from './examples/examples.js';
-export { Feedback, type APIFeedbackSource, type AppFeedbackSource, type AutoEvalFeedbackSource, type FeedbackCreateSchema, type FeedbackLevel, type FeedbackSchema, type ModelFeedbackSource, type SourceType, type FeedbackDeleteResponse, type FeedbackCreateParams, type FeedbackRetrieveParams, type FeedbackUpdateParams, type FeedbackListParams, type FeedbackSchemasOffsetPaginationTopLevelArray, } from './feedback/feedback.js';
 export { Info, type InfoListResponse } from './info.js';
 export { OnlineEvaluators, type BulkDeleteEvaluatorFailedItem, type BulkDeleteEvaluatorsResponse, type CreateOnlineCodeEvaluatorRequest, type CreateOnlineEvaluatorRequest, type CreateOnlineEvaluatorResponse, type CreateOnlineLlmEvaluatorRequest, type GetOnlineEvaluatorSpendResponse, type OnlineCodeEvaluator, type OnlineEvaluator, type OnlineEvaluatorRunRule, type OnlineEvaluatorSpendDay, type OnlineEvaluatorSpendGroup, type OnlineEvaluatorType, type OnlineLlmEvaluator, type OnlineSpendLimit, type UpdateOnlineCodeEvaluatorRequest, type UpdateOnlineEvaluatorRequest, type UpdateOnlineEvaluatorResponse, type UpdateOnlineLlmEvaluatorRequest, type OnlineEvaluatorCreateParams, type OnlineEvaluatorUpdateParams, type OnlineEvaluatorListParams, type OnlineEvaluatorDeleteParams, type OnlineEvaluatorBulkDeleteParams, type OnlineEvaluatorSpendParams, type OnlineEvaluatorsOffsetPaginationOnlineEvaluators, } from './online-evaluators.js';
-export { Public, type PublicRetrieveFeedbacksParams } from './public/public.js';
-export { Repos, type CreateRepoResponse, type DemoConfig, type EPromptOptimizationAlgorithm, type GetRepoResponse, type PromptimConfig, type RepoWithLookups, type RepoDeleteResponse, type RepoCreateParams, type RepoRetrieveParams, type RepoUpdateParams, type RepoListParams, type RepoDeleteParams, type RepoWithLookupsOffsetPaginationRepos, } from './repos/repos.js';
-export { Runs, type BodyParamsForRunSchema, type RequestBodyForRunsGenerateQuery, type ResponseBodyForRunsGenerateQuery, type Run, type RunSchema, type RunStatsQueryParams, type RunTypeEnum, type RunsFilterDataSourceTypeEnum, type RunCreateResponse, type RunUpdateResponse, type RunIngestBatchResponse, type RunQueryResponse, type RunStatsResponse, type RunUpdate2Response, type RunCreateParams, type RunRetrieveParams, type RunUpdateParams, type RunIngestBatchParams, type RunQueryParams, type RunStatsParams, } from './runs/runs.js';
-export { Sandboxes } from './sandboxes/sandboxes.js';
 export { Sessions, type CustomChartsSection, type CustomChartsSectionRequest, type RunStatsGroupBy, type SessionSortableColumns, type TimedeltaInput, type TracerSession, type TracerSessionWithoutVirtualFields, type SessionDeleteResponse, type SessionCreateParams, type SessionRetrieveParams, type SessionUpdateParams, type SessionListParams, type SessionDashboardParams, type TracerSessionsOffsetPaginationTopLevelArray, } from './sessions/sessions.js';
-export { Settings, type AppHubCrudTenantsTenant } from './settings.js';
-export { Workspaces, type WorkspaceCreateResponse, type WorkspaceUpdateResponse, type WorkspaceListResponse, type WorkspaceDeleteResponse, type WorkspaceCreateParams, type WorkspaceUpdateParams, type WorkspaceListParams, } from './workspaces.js';

package/dist/_openapi_client/resources/index.js

@@ -1,17 +1,6 @@
 // @ts-nocheck
 // File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
-export { AnnotationQueues, } from './annotation-queues/annotation-queues.js';
-export { Commits, } from './commits.js';
 export { Datasets, } from './datasets/datasets.js';
-export { Evaluators, } from './evaluators.js';
-export { Examples, } from './examples/examples.js';
-export { Feedback, } from './feedback/feedback.js';
 export { Info } from './info.js';
 export { OnlineEvaluators, } from './online-evaluators.js';
-export { Public } from './public/public.js';
-export { Repos, } from './repos/repos.js';
-export { Runs, } from './runs/runs.js';
-export { Sandboxes } from './sandboxes/sandboxes.js';
 export { Sessions, } from './sessions/sessions.js';
-export { Settings } from './settings.js';
-export { Workspaces, } from './workspaces.js';

package/dist/anonymizer/index.cjs

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SECRET_RULES = exports.SECRET_PLACEHOLDER = void 0;
 exports.createAnonymizer = createAnonymizer;
+exports.createSecretAnonymizer = createSecretAnonymizer;
 function extractStringNodes(data, options) {
     const parsedOptions = { ...options, maxDepth: options.maxDepth ?? 10 };
     const queue = [[data, 0, "", null, ""]];
@@ -125,3 +127,143 @@ function createAnonymizer(replacer, options) {
         return mutateValue;
     };
 }
+/**
+ * Replacement token written in place of detected secrets by
+ * {@link DEFAULT_SECRET_RULES} / {@link createSecretAnonymizer}.
+ */
+exports.SECRET_PLACEHOLDER = "[SECRET_DETECTED]";
+/**
+ * A curated, high-precision rule set for detecting common credentials in
+ * traced data (prompts, tool inputs/outputs, file contents, shell commands).
+ *
+ * Designed to favor *low false positives* over exhaustive coverage:
+ *  - Provider rules are anchored to well-known key prefixes.
+ *  - Structural rules only fire when a sensitive *name* (api_key, token,
+ *    password, …) is paired with an assignment/separator, so ordinary code,
+ *    UUIDs, and hashes are left intact.
+ *
+ * This is NOT a port of gitleaks/secretlint; pattern shapes are drawn from
+ * those projects (and provider docs) as a reference only. Every rule sets an
+ * explicit `replace` because {@link createAnonymizer}'s default is
+ * `[redacted]`, whereas the shared token here is {@link SECRET_PLACEHOLDER}.
+ *
+ * Patterns are written to port 1:1 to the Python SDK preset (no lookbehind).
+ */
+exports.DEFAULT_SECRET_RULES = [
+    // ── Provider API keys (prefix-anchored) ─────────────────────────────────
+    // Anthropic
+    { pattern: /sk-ant-[A-Za-z0-9_-]{20,}/g, replace: exports.SECRET_PLACEHOLDER },
+    // OpenAI: project / service-account / admin keys, then legacy `sk-...`
+    {
+        pattern: /sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    { pattern: /sk-[A-Za-z0-9]{32,}/g, replace: exports.SECRET_PLACEHOLDER },
+    // LangSmith (keys are multi-segment: lsv2_pt_<key>_<tail> — match the
+    // full underscore-delimited tail so none of it leaks past the placeholder)
+    {
+        pattern: /lsv2_(?:pt|sk)_[A-Za-z0-9]{32,}(?:_[A-Za-z0-9]+)*/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    { pattern: /ls__[A-Za-z0-9]{16,}/g, replace: exports.SECRET_PLACEHOLDER },
+    // GitHub personal access / app tokens
+    { pattern: /gh[pousr]_[A-Za-z0-9]{36,}/g, replace: exports.SECRET_PLACEHOLDER },
+    { pattern: /github_pat_[A-Za-z0-9_]{82}/g, replace: exports.SECRET_PLACEHOLDER },
+    // GitLab personal access token
+    { pattern: /glpat-[A-Za-z0-9_-]{20,}/g, replace: exports.SECRET_PLACEHOLDER },
+    // AWS access key id (covers AKIA/ASIA/ABIA/ACCA/A3T* prefixes)
+    {
+        pattern: /\b(?:AKIA|ASIA|ABIA|ACCA|A3T[A-Z0-9])[0-9A-Z]{16}\b/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    // Google API key + OAuth access token
+    { pattern: /AIza[0-9A-Za-z_-]{35}/g, replace: exports.SECRET_PLACEHOLDER },
+    { pattern: /ya29\.[0-9A-Za-z_-]+/g, replace: exports.SECRET_PLACEHOLDER },
+    // Slack tokens (bot/user + app-level) + incoming webhooks
+    { pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/g, replace: exports.SECRET_PLACEHOLDER },
+    { pattern: /xapp-\d-[A-Za-z0-9-]{10,}/g, replace: exports.SECRET_PLACEHOLDER },
+    {
+        pattern: /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]+/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    // Stripe
+    {
+        pattern: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{20,}\b/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    // npm
+    { pattern: /npm_[A-Za-z0-9]{36}/g, replace: exports.SECRET_PLACEHOLDER },
+    // PyPI upload token
+    {
+        pattern: /pypi-AgEIcHlwaS[A-Za-z0-9_-]{50,}/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    // SendGrid
+    {
+        pattern: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    // ── Structured tokens ────────────────────────────────────────────────────
+    // JWT (header.payload.signature)
+    {
+        pattern: /eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    // PEM private key blocks (RSA/EC/OPENSSH/DSA/plain + PGP "...KEY BLOCK")
+    {
+        pattern: /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY(?: BLOCK)?-----[\s\S]+?-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY(?: BLOCK)?-----/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    // ── Structural / contextual (sensitive NAME + assignment) ─────────────────
+    // KEY=value or "key": "value" where the name looks sensitive. Keep the name
+    // and separator ($1), redact the value. Notes:
+    //  - (?![A-Za-z0-9]) after the keyword requires a component boundary, so
+    //    `token` matches `api_token`/`mytoken` but NOT `tokenizer`/`tokens`.
+    //  - the value may start with an auth scheme word (Bearer/Token/Basic) so a
+    //    `X-Api-Key: Bearer <tok>` shape redacts the credential, not just "Bearer".
+    //  - value excludes & and ; so query-string params past the secret survive.
+    //  - requires a 6+ char value so short non-secret values are not touched.
+    {
+        pattern: /\b([A-Za-z0-9_.-]*(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|ACCESS[_-]?KEY|AUTH[_-]?TOKEN|CLIENT[_-]?SECRET)(?![A-Za-z0-9])(?:[_.-][A-Za-z0-9]+)*["']?\s*[:=]\s*["']?)(?:(?:bearer|token|basic)\s+)?[^\s"'&;]{6,}/gi,
+        replace: `$1${exports.SECRET_PLACEHOLDER}`,
+    },
+    // Authorization / API-key headers. Keep the header name + separator ($1$2)
+    // and an optional scheme ($3); redact the credential.
+    {
+        pattern: /\b(authorization|x-api-key|x-auth-token)(["']?\s*[:=]\s*["']?)(bearer\s+|token\s+|basic\s+)?[A-Za-z0-9._~+/-]{8,}=*/gi,
+        replace: `$1$2$3${exports.SECRET_PLACEHOLDER}`,
+    },
+    // Bare "Bearer <token>" (any case; the scheme word is preserved via $1).
+    {
+        pattern: /\b(Bearer\s+)[A-Za-z0-9._~+/-]{10,}=*/gi,
+        replace: `$1${exports.SECRET_PLACEHOLDER}`,
+    },
+    // Credentials embedded in URLs: proto://user:PASS@host -> redact PASS only.
+    // Username is optional so proto://:PASS@host (empty user) is still covered.
+    {
+        pattern: /\b([a-z][a-z0-9+.-]*:\/\/[^:@/\s]*:)[^@/\s]+(@)/gi,
+        replace: `$1${exports.SECRET_PLACEHOLDER}$2`,
+    },
+];
+/**
+ * Build an anonymizer pre-loaded with {@link DEFAULT_SECRET_RULES} suitable for
+ * passing to `new Client({ anonymizer })`. It redacts detected secrets from run
+ * inputs, outputs, and metadata client-side, before they are uploaded.
+ *
+ * @param options.extraRules - Additional rules appended after the defaults.
+ * @param options.maxDepth - Max recursion depth (default 24; higher than
+ *   `createAnonymizer`'s default of 10 because traced payloads nest deeply,
+ *   e.g. `messages[].content[].args`).
+ *
+ * @example
+ * ```ts
+ * import { Client } from "langsmith";
+ * import { createSecretAnonymizer } from "langsmith/anonymizer";
+ *
+ * const client = new Client({ anonymizer: createSecretAnonymizer() });
+ * ```
+ */
+function createSecretAnonymizer(options) {
+    const rules = [...exports.DEFAULT_SECRET_RULES, ...(options?.extraRules ?? [])];
+    return createAnonymizer(rules, { maxDepth: options?.maxDepth ?? 24 });
+}

package/dist/anonymizer/index.d.ts

@@ -14,3 +14,48 @@ export type ReplacerType = ((value: string, path?: string) => string) | StringNo
 export declare function createAnonymizer(replacer: ReplacerType, options?: {
     maxDepth?: number;
 }): <T>(data: T) => T;
+/**
+ * Replacement token written in place of detected secrets by
+ * {@link DEFAULT_SECRET_RULES} / {@link createSecretAnonymizer}.
+ */
+export declare const SECRET_PLACEHOLDER = "[SECRET_DETECTED]";
+/**
+ * A curated, high-precision rule set for detecting common credentials in
+ * traced data (prompts, tool inputs/outputs, file contents, shell commands).
+ *
+ * Designed to favor *low false positives* over exhaustive coverage:
+ *  - Provider rules are anchored to well-known key prefixes.
+ *  - Structural rules only fire when a sensitive *name* (api_key, token,
+ *    password, …) is paired with an assignment/separator, so ordinary code,
+ *    UUIDs, and hashes are left intact.
+ *
+ * This is NOT a port of gitleaks/secretlint; pattern shapes are drawn from
+ * those projects (and provider docs) as a reference only. Every rule sets an
+ * explicit `replace` because {@link createAnonymizer}'s default is
+ * `[redacted]`, whereas the shared token here is {@link SECRET_PLACEHOLDER}.
+ *
+ * Patterns are written to port 1:1 to the Python SDK preset (no lookbehind).
+ */
+export declare const DEFAULT_SECRET_RULES: StringNodeRule[];
+/**
+ * Build an anonymizer pre-loaded with {@link DEFAULT_SECRET_RULES} suitable for
+ * passing to `new Client({ anonymizer })`. It redacts detected secrets from run
+ * inputs, outputs, and metadata client-side, before they are uploaded.
+ *
+ * @param options.extraRules - Additional rules appended after the defaults.
+ * @param options.maxDepth - Max recursion depth (default 24; higher than
+ *   `createAnonymizer`'s default of 10 because traced payloads nest deeply,
+ *   e.g. `messages[].content[].args`).
+ *
+ * @example
+ * ```ts
+ * import { Client } from "langsmith";
+ * import { createSecretAnonymizer } from "langsmith/anonymizer";
+ *
+ * const client = new Client({ anonymizer: createSecretAnonymizer() });
+ * ```
+ */
+export declare function createSecretAnonymizer(options?: {
+    extraRules?: StringNodeRule[];
+    maxDepth?: number;
+}): <T>(data: T) => T;

package/dist/anonymizer/index.js

@@ -122,3 +122,143 @@ export function createAnonymizer(replacer, options) {
         return mutateValue;
     };
 }
+/**
+ * Replacement token written in place of detected secrets by
+ * {@link DEFAULT_SECRET_RULES} / {@link createSecretAnonymizer}.
+ */
+export const SECRET_PLACEHOLDER = "[SECRET_DETECTED]";
+/**
+ * A curated, high-precision rule set for detecting common credentials in
+ * traced data (prompts, tool inputs/outputs, file contents, shell commands).
+ *
+ * Designed to favor *low false positives* over exhaustive coverage:
+ *  - Provider rules are anchored to well-known key prefixes.
+ *  - Structural rules only fire when a sensitive *name* (api_key, token,
+ *    password, …) is paired with an assignment/separator, so ordinary code,
+ *    UUIDs, and hashes are left intact.
+ *
+ * This is NOT a port of gitleaks/secretlint; pattern shapes are drawn from
+ * those projects (and provider docs) as a reference only. Every rule sets an
+ * explicit `replace` because {@link createAnonymizer}'s default is
+ * `[redacted]`, whereas the shared token here is {@link SECRET_PLACEHOLDER}.
+ *
+ * Patterns are written to port 1:1 to the Python SDK preset (no lookbehind).
+ */
+export const DEFAULT_SECRET_RULES = [
+    // ── Provider API keys (prefix-anchored) ─────────────────────────────────
+    // Anthropic
+    { pattern: /sk-ant-[A-Za-z0-9_-]{20,}/g, replace: SECRET_PLACEHOLDER },
+    // OpenAI: project / service-account / admin keys, then legacy `sk-...`
+    {
+        pattern: /sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    { pattern: /sk-[A-Za-z0-9]{32,}/g, replace: SECRET_PLACEHOLDER },
+    // LangSmith (keys are multi-segment: lsv2_pt_<key>_<tail> — match the
+    // full underscore-delimited tail so none of it leaks past the placeholder)
+    {
+        pattern: /lsv2_(?:pt|sk)_[A-Za-z0-9]{32,}(?:_[A-Za-z0-9]+)*/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    { pattern: /ls__[A-Za-z0-9]{16,}/g, replace: SECRET_PLACEHOLDER },
+    // GitHub personal access / app tokens
+    { pattern: /gh[pousr]_[A-Za-z0-9]{36,}/g, replace: SECRET_PLACEHOLDER },
+    { pattern: /github_pat_[A-Za-z0-9_]{82}/g, replace: SECRET_PLACEHOLDER },
+    // GitLab personal access token
+    { pattern: /glpat-[A-Za-z0-9_-]{20,}/g, replace: SECRET_PLACEHOLDER },
+    // AWS access key id (covers AKIA/ASIA/ABIA/ACCA/A3T* prefixes)
+    {
+        pattern: /\b(?:AKIA|ASIA|ABIA|ACCA|A3T[A-Z0-9])[0-9A-Z]{16}\b/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    // Google API key + OAuth access token
+    { pattern: /AIza[0-9A-Za-z_-]{35}/g, replace: SECRET_PLACEHOLDER },
+    { pattern: /ya29\.[0-9A-Za-z_-]+/g, replace: SECRET_PLACEHOLDER },
+    // Slack tokens (bot/user + app-level) + incoming webhooks
+    { pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/g, replace: SECRET_PLACEHOLDER },
+    { pattern: /xapp-\d-[A-Za-z0-9-]{10,}/g, replace: SECRET_PLACEHOLDER },
+    {
+        pattern: /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]+/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    // Stripe
+    {
+        pattern: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{20,}\b/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    // npm
+    { pattern: /npm_[A-Za-z0-9]{36}/g, replace: SECRET_PLACEHOLDER },
+    // PyPI upload token
+    {
+        pattern: /pypi-AgEIcHlwaS[A-Za-z0-9_-]{50,}/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    // SendGrid
+    {
+        pattern: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    // ── Structured tokens ────────────────────────────────────────────────────
+    // JWT (header.payload.signature)
+    {
+        pattern: /eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    // PEM private key blocks (RSA/EC/OPENSSH/DSA/plain + PGP "...KEY BLOCK")
+    {
+        pattern: /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY(?: BLOCK)?-----[\s\S]+?-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY(?: BLOCK)?-----/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    // ── Structural / contextual (sensitive NAME + assignment) ─────────────────
+    // KEY=value or "key": "value" where the name looks sensitive. Keep the name
+    // and separator ($1), redact the value. Notes:
+    //  - (?![A-Za-z0-9]) after the keyword requires a component boundary, so
+    //    `token` matches `api_token`/`mytoken` but NOT `tokenizer`/`tokens`.
+    //  - the value may start with an auth scheme word (Bearer/Token/Basic) so a
+    //    `X-Api-Key: Bearer <tok>` shape redacts the credential, not just "Bearer".
+    //  - value excludes & and ; so query-string params past the secret survive.
+    //  - requires a 6+ char value so short non-secret values are not touched.
+    {
+        pattern: /\b([A-Za-z0-9_.-]*(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|ACCESS[_-]?KEY|AUTH[_-]?TOKEN|CLIENT[_-]?SECRET)(?![A-Za-z0-9])(?:[_.-][A-Za-z0-9]+)*["']?\s*[:=]\s*["']?)(?:(?:bearer|token|basic)\s+)?[^\s"'&;]{6,}/gi,
+        replace: `$1${SECRET_PLACEHOLDER}`,
+    },
+    // Authorization / API-key headers. Keep the header name + separator ($1$2)
+    // and an optional scheme ($3); redact the credential.
+    {
+        pattern: /\b(authorization|x-api-key|x-auth-token)(["']?\s*[:=]\s*["']?)(bearer\s+|token\s+|basic\s+)?[A-Za-z0-9._~+/-]{8,}=*/gi,
+        replace: `$1$2$3${SECRET_PLACEHOLDER}`,
+    },
+    // Bare "Bearer <token>" (any case; the scheme word is preserved via $1).
+    {
+        pattern: /\b(Bearer\s+)[A-Za-z0-9._~+/-]{10,}=*/gi,
+        replace: `$1${SECRET_PLACEHOLDER}`,
+    },
+    // Credentials embedded in URLs: proto://user:PASS@host -> redact PASS only.
+    // Username is optional so proto://:PASS@host (empty user) is still covered.
+    {
+        pattern: /\b([a-z][a-z0-9+.-]*:\/\/[^:@/\s]*:)[^@/\s]+(@)/gi,
+        replace: `$1${SECRET_PLACEHOLDER}$2`,
+    },
+];
+/**
+ * Build an anonymizer pre-loaded with {@link DEFAULT_SECRET_RULES} suitable for
+ * passing to `new Client({ anonymizer })`. It redacts detected secrets from run
+ * inputs, outputs, and metadata client-side, before they are uploaded.
+ *
+ * @param options.extraRules - Additional rules appended after the defaults.
+ * @param options.maxDepth - Max recursion depth (default 24; higher than
+ *   `createAnonymizer`'s default of 10 because traced payloads nest deeply,
+ *   e.g. `messages[].content[].args`).
+ *
+ * @example
+ * ```ts
+ * import { Client } from "langsmith";
+ * import { createSecretAnonymizer } from "langsmith/anonymizer";
+ *
+ * const client = new Client({ anonymizer: createSecretAnonymizer() });
+ * ```
+ */
+export function createSecretAnonymizer(options) {
+    const rules = [...DEFAULT_SECRET_RULES, ...(options?.extraRules ?? [])];
+    return createAnonymizer(rules, { maxDepth: options?.maxDepth ?? 24 });
+}

package/dist/client.cjs

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Client = exports.AutoBatchQueue = exports.DEFAULT_MAX_SIZE_BYTES = exports.DEFAULT_UNCOMPRESSED_BATCH_SIZE_LIMIT_BYTES = void 0;
 exports.mergeRuntimeEnvIntoRun = mergeRuntimeEnvIntoRun;
+exports._checkBackendVersion = _checkBackendVersion;
 const uuid = __importStar(require("./utils/uuid/src/index.cjs"));
 const translator_js_1 = require("./experimental/otel/translator.cjs");
 const otel_js_1 = require("./singletons/otel.cjs");
@@ -45,6 +46,7 @@ const index_js_1 = require("./index.cjs");
 const index_js_2 = require("./_openapi_client/index.cjs");
 const _uuid_js_1 = require("./utils/_uuid.cjs");
 const warn_js_1 = require("./utils/warn.cjs");
+const constants_js_1 = require("./utils/constants.cjs");
 const prompts_js_1 = require("./utils/prompts.cjs");
 const error_js_1 = require("./utils/error.cjs");
 const index_js_3 = require("./utils/prompt_cache/index.cjs");
@@ -159,6 +161,25 @@ function _formatFeedbackScore(score) {
     }
     return score;
 }
+function _checkBackendVersion(version, minVersion = constants_js_1._MIN_BACKEND_VERSION) {
+    const parse = (v) => v.split(".").map((s) => parseInt(s, 10));
+    const [maj, min, pat] = parse(version);
+    const [rMaj, rMin, rPat] = parse(minVersion);
+    if (isNaN(maj) ||
+        isNaN(min) ||
+        isNaN(pat) ||
+        isNaN(rMaj) ||
+        isNaN(rMin) ||
+        isNaN(rPat)) {
+        console.warn(`[LANGSMITH]: Could not parse backend version ${JSON.stringify(version)} for compatibility check.`);
+        return;
+    }
+    if (maj < rMaj ||
+        (maj === rMaj && min < rMin) ||
+        (maj === rMaj && min === rMin && pat < rPat)) {
+        console.warn(`[LANGSMITH]: Backend version ${JSON.stringify(version)} is older than the minimum version required by this SDK (${JSON.stringify(minVersion)}). Some features may not work as expected.`);
+    }
+}
 exports.DEFAULT_UNCOMPRESSED_BATCH_SIZE_LIMIT_BYTES = 24 * 1024 * 1024;
 /** Default maximum memory (1GB) for queue size limits. */
 exports.DEFAULT_MAX_SIZE_BYTES = 1024 * 1024 * 1024; // 1GB
@@ -1408,6 +1429,9 @@ class Client {
                 if (this._serverInfo === undefined) {
                     try {
                         this._serverInfo = await this._getServerInfo();
+                        if (this._serverInfo?.version) {
+                            _checkBackendVersion(this._serverInfo.version);
+                        }
                     }
                     catch (e) {
                         console.warn(`[LANGSMITH]: Failed to fetch info on supported operations. Falling back to batch operations and default limits. Info: ${e.status ?? "Unspecified status code"} ${e.message}`);
@@ -3502,7 +3526,7 @@ class Client {
             return res;
         });
     }
-    async createFeedback(runId, key, { score, value, correction, comment, sourceInfo, feedbackSourceType = "api", sourceRunId, feedbackId, feedbackConfig, projectId, comparativeExperimentId, sessionId, startTime, }) {
+    async createFeedback(runId, key, { score, value, correction, comment, sourceInfo, feedbackSourceType = "api", sourceRunId, feedbackId, feedbackConfig, projectId, comparativeExperimentId, sessionId, startTime, extendTraceRetention, }) {
         if (!runId && !projectId) {
             throw new Error("One of runId or projectId must be provided");
         }
@@ -3535,6 +3559,7 @@ class Client {
             feedbackConfig,
             session_id: sessionId ?? projectId,
             start_time: startTime,
+            extend_trace_retention: extendTraceRetention,
         };
         const body = JSON.stringify(feedback);
         const url = `${this.apiUrl}/feedback`;

package/dist/client.d.ts

@@ -382,6 +382,7 @@ export interface ListThreadsItem extends Thread {
     runs: Run[];
 }
 export declare function mergeRuntimeEnvIntoRun<T extends RunCreate | RunUpdate>(run: T, cachedEnvVars?: Record<string, string>, omitTracedRuntimeInfo?: boolean): T;
+export declare function _checkBackendVersion(version: string, minVersion?: string): void;
 export declare const DEFAULT_UNCOMPRESSED_BATCH_SIZE_LIMIT_BYTES: number;
 /** Default maximum memory (1GB) for queue size limits. */
 export declare const DEFAULT_MAX_SIZE_BYTES: number;
@@ -915,7 +916,7 @@ export declare class Client implements LangSmithTracingClientInterface {
         exampleIds: string[];
         remove?: boolean;
     }): Promise<void>;
-    createFeedback(runId: string | null, key: string, { score, value, correction, comment, sourceInfo, feedbackSourceType, sourceRunId, feedbackId, feedbackConfig, projectId, comparativeExperimentId, sessionId, startTime, }: {
+    createFeedback(runId: string | null, key: string, { score, value, correction, comment, sourceInfo, feedbackSourceType, sourceRunId, feedbackId, feedbackConfig, projectId, comparativeExperimentId, sessionId, startTime, extendTraceRetention, }: {
         score?: ScoreType;
         value?: ValueType;
         correction?: object;
@@ -932,6 +933,8 @@ export declare class Client implements LangSmithTracingClientInterface {
         sessionId?: string;
         /** The start time of the run this feedback is for. Accepts ISO string or epoch ms. */
         startTime?: number | string;
+        /** If false, create feedback without extending the trace's retention tier. */
+        extendTraceRetention?: boolean;
     }): Promise<Feedback>;
     updateFeedback(feedbackId: string, { score, value, correction, comment, }: {
         score?: number | boolean | null;

package/dist/client.js

@@ -8,6 +8,7 @@ import { __version__ } from "./index.js";
 import { Langsmith as OpenAPILangsmith } from "./_openapi_client/index.js";
 import { assertUuid } from "./utils/_uuid.js";
 import { warnOnce } from "./utils/warn.js";
+import { _MIN_BACKEND_VERSION } from "./utils/constants.js";
 import { parseHubIdentifier } from "./utils/prompts.js";
 import { raiseForStatus, isLangSmithNotFoundError, isLangSmithConflictError, } from "./utils/error.js";
 import { promptCacheSingleton, } from "./utils/prompt_cache/index.js";
@@ -122,6 +123,25 @@ function _formatFeedbackScore(score) {
     }
     return score;
 }
+export function _checkBackendVersion(version, minVersion = _MIN_BACKEND_VERSION) {
+    const parse = (v) => v.split(".").map((s) => parseInt(s, 10));
+    const [maj, min, pat] = parse(version);
+    const [rMaj, rMin, rPat] = parse(minVersion);
+    if (isNaN(maj) ||
+        isNaN(min) ||
+        isNaN(pat) ||
+        isNaN(rMaj) ||
+        isNaN(rMin) ||
+        isNaN(rPat)) {
+        console.warn(`[LANGSMITH]: Could not parse backend version ${JSON.stringify(version)} for compatibility check.`);
+        return;
+    }
+    if (maj < rMaj ||
+        (maj === rMaj && min < rMin) ||
+        (maj === rMaj && min === rMin && pat < rPat)) {
+        console.warn(`[LANGSMITH]: Backend version ${JSON.stringify(version)} is older than the minimum version required by this SDK (${JSON.stringify(minVersion)}). Some features may not work as expected.`);
+    }
+}
 export const DEFAULT_UNCOMPRESSED_BATCH_SIZE_LIMIT_BYTES = 24 * 1024 * 1024;
 /** Default maximum memory (1GB) for queue size limits. */
 export const DEFAULT_MAX_SIZE_BYTES = 1024 * 1024 * 1024; // 1GB
@@ -1370,6 +1390,9 @@ export class Client {
                 if (this._serverInfo === undefined) {
                     try {
                         this._serverInfo = await this._getServerInfo();
+                        if (this._serverInfo?.version) {
+                            _checkBackendVersion(this._serverInfo.version);
+                        }
                     }
                     catch (e) {
                         console.warn(`[LANGSMITH]: Failed to fetch info on supported operations. Falling back to batch operations and default limits. Info: ${e.status ?? "Unspecified status code"} ${e.message}`);
@@ -3464,7 +3487,7 @@ export class Client {
             return res;
         });
     }
-    async createFeedback(runId, key, { score, value, correction, comment, sourceInfo, feedbackSourceType = "api", sourceRunId, feedbackId, feedbackConfig, projectId, comparativeExperimentId, sessionId, startTime, }) {
+    async createFeedback(runId, key, { score, value, correction, comment, sourceInfo, feedbackSourceType = "api", sourceRunId, feedbackId, feedbackConfig, projectId, comparativeExperimentId, sessionId, startTime, extendTraceRetention, }) {
         if (!runId && !projectId) {
             throw new Error("One of runId or projectId must be provided");
         }
@@ -3497,6 +3520,7 @@ export class Client {
             feedbackConfig,
             session_id: sessionId ?? projectId,
             start_time: startTime,
+            extend_trace_retention: extendTraceRetention,
         };
         const body = JSON.stringify(feedback);
         const url = `${this.apiUrl}/feedback`;

package/dist/index.cjs

@@ -20,6 +20,6 @@ Object.defineProperty(exports, "PromptCache", { enumerable: true, get: function
 Object.defineProperty(exports, "configureGlobalPromptCache", { enumerable: true, get: function () { return index_js_1.configureGlobalPromptCache; } });
 Object.defineProperty(exports, "promptCacheSingleton", { enumerable: true, get: function () { return index_js_1.promptCacheSingleton; } });
 // Update using pnpm bump-version
-exports.__version__ = "0.7.9";
+exports.__version__ = "0.7.11";
 // Metadata key to hide a traced run from LangSmith's Messages View.
 exports.LS_MESSAGE_VIEW_EXCLUDE = "ls_message_view_exclude";

package/dist/index.d.ts

@@ -6,5 +6,5 @@ export { getDefaultProjectName } from "./utils/project.js";
 export { uuid7, uuid7FromTime } from "./uuid.js";
 export { isTracingEnabled } from "./utils/guard.js";
 export { Cache, PromptCache, type CacheConfig, type CacheMetrics, configureGlobalPromptCache, promptCacheSingleton, } from "./utils/prompt_cache/index.js";
-export declare const __version__ = "0.7.9";
+export declare const __version__ = "0.7.11";
 export declare const LS_MESSAGE_VIEW_EXCLUDE: "ls_message_view_exclude";

package/dist/index.js

@@ -6,6 +6,6 @@ export { uuid7, uuid7FromTime } from "./uuid.js";
 export { isTracingEnabled } from "./utils/guard.js";
 export { Cache, PromptCache, configureGlobalPromptCache, promptCacheSingleton, } from "./utils/prompt_cache/index.js";
 // Update using pnpm bump-version
-export const __version__ = "0.7.9";
+export const __version__ = "0.7.11";
 // Metadata key to hide a traced run from LangSmith's Messages View.
 export const LS_MESSAGE_VIEW_EXCLUDE = "ls_message_view_exclude";

package/dist/sandbox/client.cjs

@@ -10,7 +10,7 @@ const async_caller_js_1 = require("../utils/async_caller.cjs");
 const sandbox_js_1 = require("./sandbox.cjs");
 const errors_js_1 = require("./errors.cjs");
 const helpers_js_1 = require("./helpers.cjs");
-const proxy_config_js_1 = require("./proxy_config.cjs");
+const mounts_js_1 = require("./mounts.cjs");
 const index_js_1 = require("../utils/uuid/src/index.cjs");
 /**
  * Sleep that can be interrupted by an AbortSignal.
@@ -372,9 +372,6 @@ class SandboxClient {
         if (snapshotId && snapshotName) {
             throw new errors_js_1.LangSmithValidationError("At most one of snapshotId or options.snapshotName may be set", "snapshotId");
         }
-        if ("mounts" in resolvedOptions) {
-            throw new errors_js_1.LangSmithValidationError("mounts is not a public createSandbox option; use mountConfig", "mounts");
-        }
         (0, helpers_js_1.validateTtl)(idleTtlSeconds, "idleTtlSeconds");
         (0, helpers_js_1.validateTtl)(deleteAfterStopSeconds, "deleteAfterStopSeconds");
         const url = `${this._baseUrl}/boxes`;
@@ -408,12 +405,12 @@ class SandboxClient {
         if (fsCapacityBytes !== undefined) {
             payload.fs_capacity_bytes = fsCapacityBytes;
         }
-        const effectiveProxyConfig = (0, proxy_config_js_1.mergeProxyConfigs)(mountConfig?.proxyConfig, proxyConfig);
         if (mountConfig !== undefined) {
-            payload.mounts = mountConfig.mounts;
+            (0, mounts_js_1.validateMountConfigProxyConfig)(mountConfig, proxyConfig);
+            payload.mount_config = mountConfig;
         }
-        if (effectiveProxyConfig !== undefined) {
-            payload.proxy_config = effectiveProxyConfig;
+        if (proxyConfig !== undefined) {
+            payload.proxy_config = proxyConfig;
         }
         const httpTimeout = waitForReady ? (timeout + 30) * 1000 : 30 * 1000;
         const response = await this._fetch(url, {

package/dist/sandbox/client.js

@@ -7,7 +7,7 @@ import { AsyncCaller } from "../utils/async_caller.js";
 import { Sandbox } from "./sandbox.js";
 import { LangSmithResourceCreationError, LangSmithResourceNameConflictError, LangSmithResourceNotFoundError, LangSmithResourceTimeoutError, LangSmithSandboxAPIError, LangSmithValidationError, } from "./errors.js";
 import { handleClientHttpError, handleSandboxCreationError, validateTtl, } from "./helpers.js";
-import { mergeProxyConfigs } from "./proxy_config.js";
+import { validateMountConfigProxyConfig } from "./mounts.js";
 import { v4 as uuidv4 } from "../utils/uuid/src/index.js";
 /**
  * Sleep that can be interrupted by an AbortSignal.
@@ -369,9 +369,6 @@ export class SandboxClient {
         if (snapshotId && snapshotName) {
             throw new LangSmithValidationError("At most one of snapshotId or options.snapshotName may be set", "snapshotId");
         }
-        if ("mounts" in resolvedOptions) {
-            throw new LangSmithValidationError("mounts is not a public createSandbox option; use mountConfig", "mounts");
-        }
         validateTtl(idleTtlSeconds, "idleTtlSeconds");
         validateTtl(deleteAfterStopSeconds, "deleteAfterStopSeconds");
         const url = `${this._baseUrl}/boxes`;
@@ -405,12 +402,12 @@ export class SandboxClient {
         if (fsCapacityBytes !== undefined) {
             payload.fs_capacity_bytes = fsCapacityBytes;
         }
-        const effectiveProxyConfig = mergeProxyConfigs(mountConfig?.proxyConfig, proxyConfig);
         if (mountConfig !== undefined) {
-            payload.mounts = mountConfig.mounts;
+            validateMountConfigProxyConfig(mountConfig, proxyConfig);
+            payload.mount_config = mountConfig;
         }
-        if (effectiveProxyConfig !== undefined) {
-            payload.proxy_config = effectiveProxyConfig;
+        if (proxyConfig !== undefined) {
+            payload.proxy_config = proxyConfig;
         }
         const httpTimeout = waitForReady ? (timeout + 30) * 1000 : 30 * 1000;
         const response = await this._fetch(url, {