langsmith 0.8.10 → 0.8.11

package/dist/index.cjs

@@ -35,6 +35,6 @@ Object.defineProperty(exports, "UnprocessableEntityError", { enumerable: true, g
 Object.defineProperty(exports, "RateLimitError", { enumerable: true, get: function () { return error_js_1.RateLimitError; } });
 Object.defineProperty(exports, "InternalServerError", { enumerable: true, get: function () { return error_js_1.InternalServerError; } });
 // Update using pnpm bump-version
-exports.__version__ = "0.8.10";
+exports.__version__ = "0.8.11";
 // Metadata key to hide a traced run from LangSmith's Messages View.
 exports.LS_MESSAGE_VIEW_EXCLUDE = "ls_message_view_exclude";

package/dist/index.d.ts

@@ -7,5 +7,5 @@ export { computeRunIdForSecondaryReplica, uuid7, uuid7FromTime, } from "./uuid.j
 export { isTracingEnabled } from "./utils/guard.js";
 export { Cache, PromptCache, type CacheConfig, type CacheMetrics, configureGlobalPromptCache, promptCacheSingleton, } from "./utils/prompt_cache/index.js";
 export { LangsmithError, APIError, APIUserAbortError, APIConnectionError, APIConnectionTimeoutError, BadRequestError, AuthenticationError, PermissionDeniedError, NotFoundError, ConflictError, UnprocessableEntityError, RateLimitError, InternalServerError, } from "./_openapi_client/core/error.js";
-export declare const __version__ = "0.8.10";
+export declare const __version__ = "0.8.11";
 export declare const LS_MESSAGE_VIEW_EXCLUDE: "ls_message_view_exclude";

package/dist/index.js

@@ -7,6 +7,6 @@ export { isTracingEnabled } from "./utils/guard.js";
 export { Cache, PromptCache, configureGlobalPromptCache, promptCacheSingleton, } from "./utils/prompt_cache/index.js";
 export { LangsmithError, APIError, APIUserAbortError, APIConnectionError, APIConnectionTimeoutError, BadRequestError, AuthenticationError, PermissionDeniedError, NotFoundError, ConflictError, UnprocessableEntityError, RateLimitError, InternalServerError, } from "./_openapi_client/core/error.js";
 // Update using pnpm bump-version
-export const __version__ = "0.8.10";
+export const __version__ = "0.8.11";
 // Metadata key to hide a traced run from LangSmith's Messages View.
 export const LS_MESSAGE_VIEW_EXCLUDE = "ls_message_view_exclude";

package/dist/sandbox/client.cjs

@@ -698,13 +698,19 @@ class SandboxClient {
      *
      * @param name - Snapshot name.
      * @param dockerfile - Local Dockerfile path, relative to context by default.
-     * @param fsCapacityBytes - Filesystem capacity in bytes.
-     * @param options - Build context, args, target, build log callback, builder
-     *   vCPUs/memory, timeout.
+     * @param fsCapacityBytesOrOptions - Optional filesystem capacity in bytes, or
+     *   build options. When omitted, the server applies its default capacity.
+     * @param options - Build options when capacity is passed separately.
      * @returns Snapshot in "ready" status.
      */
-    async createSnapshotFromDockerfile(name, dockerfile, fsCapacityBytes, options = {}) {
-        const { context = ".", buildArgs, target, onBuildLog, vCpus, memBytes, timeout = 60, } = options;
+    async createSnapshotFromDockerfile(name, dockerfile, fsCapacityBytesOrOptions, options = {}) {
+        const fsCapacityBytes = typeof fsCapacityBytesOrOptions === "number"
+            ? fsCapacityBytesOrOptions
+            : undefined;
+        const resolvedOptions = typeof fsCapacityBytesOrOptions === "number"
+            ? options
+            : (fsCapacityBytesOrOptions ?? options);
+        const { context = ".", buildArgs, target, onBuildLog, vCpus, memBytes, timeout = 60, } = resolvedOptions;
         const { contextPath, dockerfileRel } = await resolveDockerfileContext(dockerfile, context);
         const builderName = `snapshot-builder-${(0, index_js_2.v4)().replace(/-/g, "").slice(0, 12)}`;
         // Stage the build on the capacity-backed root filesystem, not /tmp.

package/dist/sandbox/client.d.ts

@@ -208,12 +208,12 @@ export declare class SandboxClient {
      *
      * @param name - Snapshot name.
      * @param dockerfile - Local Dockerfile path, relative to context by default.
-     * @param fsCapacityBytes - Filesystem capacity in bytes.
-     * @param options - Build context, args, target, build log callback, builder
-     *   vCPUs/memory, timeout.
+     * @param fsCapacityBytesOrOptions - Optional filesystem capacity in bytes, or
+     *   build options. When omitted, the server applies its default capacity.
+     * @param options - Build options when capacity is passed separately.
      * @returns Snapshot in "ready" status.
      */
-    createSnapshotFromDockerfile(name: string, dockerfile: string, fsCapacityBytes: number, options?: CreateDockerfileSnapshotOptions): Promise<Snapshot>;
+    createSnapshotFromDockerfile(name: string, dockerfile: string, fsCapacityBytesOrOptions?: number | CreateDockerfileSnapshotOptions, options?: CreateDockerfileSnapshotOptions): Promise<Snapshot>;
     /**
      * Capture a snapshot from a running sandbox.
      *

package/dist/sandbox/client.js

@@ -695,13 +695,19 @@ export class SandboxClient {
      *
      * @param name - Snapshot name.
      * @param dockerfile - Local Dockerfile path, relative to context by default.
-     * @param fsCapacityBytes - Filesystem capacity in bytes.
-     * @param options - Build context, args, target, build log callback, builder
-     *   vCPUs/memory, timeout.
+     * @param fsCapacityBytesOrOptions - Optional filesystem capacity in bytes, or
+     *   build options. When omitted, the server applies its default capacity.
+     * @param options - Build options when capacity is passed separately.
      * @returns Snapshot in "ready" status.
      */
-    async createSnapshotFromDockerfile(name, dockerfile, fsCapacityBytes, options = {}) {
-        const { context = ".", buildArgs, target, onBuildLog, vCpus, memBytes, timeout = 60, } = options;
+    async createSnapshotFromDockerfile(name, dockerfile, fsCapacityBytesOrOptions, options = {}) {
+        const fsCapacityBytes = typeof fsCapacityBytesOrOptions === "number"
+            ? fsCapacityBytesOrOptions
+            : undefined;
+        const resolvedOptions = typeof fsCapacityBytesOrOptions === "number"
+            ? options
+            : (fsCapacityBytesOrOptions ?? options);
+        const { context = ".", buildArgs, target, onBuildLog, vCpus, memBytes, timeout = 60, } = resolvedOptions;
         const { contextPath, dockerfileRel } = await resolveDockerfileContext(dockerfile, context);
         const builderName = `snapshot-builder-${uuidv4().replace(/-/g, "").slice(0, 12)}`;
         // Stage the build on the capacity-backed root filesystem, not /tmp.

package/dist/sandbox/index.cjs

@@ -29,7 +29,7 @@
  * @packageDocumentation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LangSmithDataplaneNotConfiguredError = exports.LangSmithCommandTimeoutError = exports.LangSmithSandboxOperationError = exports.LangSmithSandboxNotReadyError = exports.LangSmithSandboxCreationError = exports.LangSmithResourceCreationError = exports.LangSmithQuotaExceededError = exports.LangSmithValidationError = exports.LangSmithResourceNameConflictError = exports.LangSmithResourceAlreadyExistsError = exports.LangSmithResourceInUseError = exports.LangSmithResourceTimeoutError = exports.LangSmithResourceNotFoundError = exports.LangSmithSandboxServerReloadError = exports.LangSmithSandboxConnectTimeoutError = exports.LangSmithSandboxConnectionError = exports.LangSmithSandboxAuthenticationError = exports.LangSmithSandboxAPIError = exports.LangSmithSandboxError = exports.s3Mount = exports.mountConfig = exports.gitMount = exports.gcsMount = exports.workspaceSecret = exports.proxyConfig = exports.opaqueSecret = exports.gcpAuth = exports.awsAuth = exports.CommandHandle = exports.Sandbox = exports.SandboxClient = void 0;
+exports.LangSmithDataplaneNotConfiguredError = exports.LangSmithCommandTimeoutError = exports.LangSmithSandboxOperationError = exports.LangSmithSandboxNotReadyError = exports.LangSmithSandboxCreationError = exports.LangSmithResourceCreationError = exports.LangSmithQuotaExceededError = exports.LangSmithValidationError = exports.LangSmithResourceNameConflictError = exports.LangSmithResourceAlreadyExistsError = exports.LangSmithResourceInUseError = exports.LangSmithResourceTimeoutError = exports.LangSmithResourceNotFoundError = exports.LangSmithSandboxServerReloadError = exports.LangSmithSandboxConnectTimeoutError = exports.LangSmithSandboxConnectionError = exports.LangSmithSandboxAuthenticationError = exports.LangSmithSandboxAPIError = exports.LangSmithSandboxError = exports.s3Mount = exports.mountConfig = exports.gitMount = exports.gcsMount = exports.contextHubMount = exports.workspaceSecret = exports.proxyConfig = exports.opaqueSecret = exports.gcpAuth = exports.awsAuth = exports.CommandHandle = exports.Sandbox = exports.SandboxClient = void 0;
 // Main classes
 var client_js_1 = require("./client.cjs");
 Object.defineProperty(exports, "SandboxClient", { enumerable: true, get: function () { return client_js_1.SandboxClient; } });
@@ -44,6 +44,7 @@ Object.defineProperty(exports, "opaqueSecret", { enumerable: true, get: function
 Object.defineProperty(exports, "proxyConfig", { enumerable: true, get: function () { return proxy_config_js_1.proxyConfig; } });
 Object.defineProperty(exports, "workspaceSecret", { enumerable: true, get: function () { return proxy_config_js_1.workspaceSecret; } });
 var mounts_js_1 = require("./mounts.cjs");
+Object.defineProperty(exports, "contextHubMount", { enumerable: true, get: function () { return mounts_js_1.contextHubMount; } });
 Object.defineProperty(exports, "gcsMount", { enumerable: true, get: function () { return mounts_js_1.gcsMount; } });
 Object.defineProperty(exports, "gitMount", { enumerable: true, get: function () { return mounts_js_1.gitMount; } });
 Object.defineProperty(exports, "mountConfig", { enumerable: true, get: function () { return mounts_js_1.mountConfig; } });

package/dist/sandbox/index.d.ts

@@ -31,6 +31,6 @@ export { SandboxClient } from "./client.js";
 export { Sandbox } from "./sandbox.js";
 export { CommandHandle } from "./command_handle.js";
 export { awsAuth, gcpAuth, opaqueSecret, proxyConfig, workspaceSecret, } from "./proxy_config.js";
-export { gcsMount, gitMount, mountConfig, s3Mount } from "./mounts.js";
-export type { ExecutionResult, OutputChunk, WsMessage, WsRunOptions, ResourceStatus, Snapshot, SandboxData, SandboxClientConfig, RunOptions, CreateSandboxOptions, SandboxAccessControl, SandboxAwsAuthRule, SandboxAwsMountAuthConfig, SandboxGcpAuthRule, SandboxGcpMountAuthConfig, SandboxMountAuth, SandboxMountAuthConfig, SandboxMountConfig, SandboxProxyConfig, SandboxProxyRule, SandboxProxySecret, SandboxMount, MountCacheConfig, GCSMountConfig, GCSMountSpec, GitMountConfig, GitMountRefSpec, GitMountSpec, S3MountConfig, S3MountSpec, CreateSnapshotOptions, CreateDockerfileSnapshotOptions, CaptureSnapshotOptions, ListSnapshotsOptions, WaitForSnapshotOptions, StartSandboxOptions, UpdateSandboxOptions, WaitForSandboxOptions, } from "./types.js";
+export { contextHubMount, gcsMount, gitMount, mountConfig, s3Mount, } from "./mounts.js";
+export type { ExecutionResult, OutputChunk, WsMessage, WsRunOptions, ResourceStatus, Snapshot, SandboxData, SandboxClientConfig, RunOptions, CreateSandboxOptions, SandboxAccessControl, SandboxAwsAuthRule, SandboxAwsMountAuthConfig, SandboxGcpAuthRule, SandboxGcpMountAuthConfig, SandboxMountAuth, SandboxMountAuthConfig, SandboxMountConfig, SandboxProxyConfig, SandboxProxyRule, SandboxProxySecret, SandboxMount, MountCacheConfig, ContextHubMountConfig, ContextHubMountSpec, GCSMountConfig, GCSMountSpec, GitMountConfig, GitMountRefSpec, GitMountSpec, S3MountConfig, S3MountSpec, CreateSnapshotOptions, CreateDockerfileSnapshotOptions, CaptureSnapshotOptions, ListSnapshotsOptions, WaitForSnapshotOptions, StartSandboxOptions, UpdateSandboxOptions, WaitForSandboxOptions, } from "./types.js";
 export { LangSmithSandboxError, LangSmithSandboxAPIError, LangSmithSandboxAuthenticationError, LangSmithSandboxConnectionError, LangSmithSandboxConnectTimeoutError, LangSmithSandboxServerReloadError, LangSmithResourceNotFoundError, LangSmithResourceTimeoutError, LangSmithResourceInUseError, LangSmithResourceAlreadyExistsError, LangSmithResourceNameConflictError, LangSmithValidationError, LangSmithQuotaExceededError, LangSmithResourceCreationError, LangSmithSandboxCreationError, LangSmithSandboxNotReadyError, LangSmithSandboxOperationError, LangSmithCommandTimeoutError, LangSmithDataplaneNotConfiguredError, } from "./errors.js";

package/dist/sandbox/index.js

@@ -32,7 +32,7 @@ export { SandboxClient } from "./client.js";
 export { Sandbox } from "./sandbox.js";
 export { CommandHandle } from "./command_handle.js";
 export { awsAuth, gcpAuth, opaqueSecret, proxyConfig, workspaceSecret, } from "./proxy_config.js";
-export { gcsMount, gitMount, mountConfig, s3Mount } from "./mounts.js";
+export { contextHubMount, gcsMount, gitMount, mountConfig, s3Mount, } from "./mounts.js";
 // Errors
 export { 
 // Base and connection errors

package/dist/sandbox/mounts.cjs

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.s3Mount = s3Mount;
 exports.gitMount = gitMount;
 exports.gcsMount = gcsMount;
+exports.contextHubMount = contextHubMount;
 exports.mountConfig = mountConfig;
 exports.validateMountConfigProxyConfig = validateMountConfigProxyConfig;
 function requireNonEmptyString(value, field) {
@@ -132,6 +133,25 @@ function gcsMount({ id, mountPath, bucket, prefix, readOnly, cache, }) {
     }
     return mount;
 }
+/**
+ * Build a read-only Context Hub mount. The sync is one-way: files written
+ * under the mount path inside the sandbox are never pushed back to the repo,
+ * and the next sync overwrites them.
+ */
+function contextHubMount({ id, mountPath, repo, initialPullOnly, }) {
+    const mount = {
+        id: requireNonEmptyString(id, "id"),
+        type: "contexthub",
+        mount_path: requireNonEmptyString(mountPath, "mountPath"),
+        contexthub: {
+            repo: requireNonEmptyString(repo, "repo"),
+        },
+    };
+    if (initialPullOnly !== undefined) {
+        mount.contexthub.initial_pull_only = initialPullOnly;
+    }
+    return mount;
+}
 function normalizeMounts(mounts) {
     if (!Array.isArray(mounts) || mounts.length === 0) {
         throw new Error("mounts must be a non-empty array of mount objects");
@@ -140,8 +160,11 @@ function normalizeMounts(mounts) {
         if (mount === null || typeof mount !== "object" || Array.isArray(mount)) {
             throw new Error("mounts must be a non-empty array of mount objects");
         }
-        if (mount.type !== "s3" && mount.type !== "gcs" && mount.type !== "git") {
-            throw new Error("mountConfig only supports s3, gcs, and git mounts");
+        if (mount.type !== "s3" &&
+            mount.type !== "gcs" &&
+            mount.type !== "git" &&
+            mount.type !== "contexthub") {
+            throw new Error("mountConfig only supports s3, gcs, git, and contexthub mounts");
         }
         rejectProviderCredentialsInMount(mount);
         return mount;

package/dist/sandbox/mounts.d.ts

@@ -1,4 +1,4 @@
-import type { GCSMountSpec, GitMountRefSpec, GitMountSpec, MountCacheConfig, S3MountSpec, SandboxMount, SandboxMountAuth, SandboxMountConfig, SandboxProxyConfig } from "./types.js";
+import type { ContextHubMountSpec, GCSMountSpec, GitMountRefSpec, GitMountSpec, MountCacheConfig, S3MountSpec, SandboxMount, SandboxMountAuth, SandboxMountConfig, SandboxProxyConfig } from "./types.js";
 export declare function s3Mount({ id, mountPath, bucket, region, prefix, endpointUrl, pathStyle, readOnly, cache, }: {
     id: string;
     mountPath: string;
@@ -25,6 +25,17 @@ export declare function gcsMount({ id, mountPath, bucket, prefix, readOnly, cach
     readOnly?: boolean;
     cache?: MountCacheConfig;
 }): GCSMountSpec;
+/**
+ * Build a read-only Context Hub mount. The sync is one-way: files written
+ * under the mount path inside the sandbox are never pushed back to the repo,
+ * and the next sync overwrites them.
+ */
+export declare function contextHubMount({ id, mountPath, repo, initialPullOnly, }: {
+    id: string;
+    mountPath: string;
+    repo: string;
+    initialPullOnly?: boolean;
+}): ContextHubMountSpec;
 export declare function mountConfig({ auth, mounts, }: {
     auth?: SandboxMountAuth[];
     mounts: SandboxMount[];

package/dist/sandbox/mounts.js

@@ -125,6 +125,25 @@ export function gcsMount({ id, mountPath, bucket, prefix, readOnly, cache, }) {
     }
     return mount;
 }
+/**
+ * Build a read-only Context Hub mount. The sync is one-way: files written
+ * under the mount path inside the sandbox are never pushed back to the repo,
+ * and the next sync overwrites them.
+ */
+export function contextHubMount({ id, mountPath, repo, initialPullOnly, }) {
+    const mount = {
+        id: requireNonEmptyString(id, "id"),
+        type: "contexthub",
+        mount_path: requireNonEmptyString(mountPath, "mountPath"),
+        contexthub: {
+            repo: requireNonEmptyString(repo, "repo"),
+        },
+    };
+    if (initialPullOnly !== undefined) {
+        mount.contexthub.initial_pull_only = initialPullOnly;
+    }
+    return mount;
+}
 function normalizeMounts(mounts) {
     if (!Array.isArray(mounts) || mounts.length === 0) {
         throw new Error("mounts must be a non-empty array of mount objects");
@@ -133,8 +152,11 @@ function normalizeMounts(mounts) {
         if (mount === null || typeof mount !== "object" || Array.isArray(mount)) {
             throw new Error("mounts must be a non-empty array of mount objects");
         }
-        if (mount.type !== "s3" && mount.type !== "gcs" && mount.type !== "git") {
-            throw new Error("mountConfig only supports s3, gcs, and git mounts");
+        if (mount.type !== "s3" &&
+            mount.type !== "gcs" &&
+            mount.type !== "git" &&
+            mount.type !== "contexthub") {
+            throw new Error("mountConfig only supports s3, gcs, git, and contexthub mounts");
         }
         rejectProviderCredentialsInMount(mount);
         return mount;

package/dist/sandbox/proxy_config.cjs

@@ -17,6 +17,22 @@ function requireNonEmptyStringArray(values, field) {
     }
     return values.map((value) => requireNonEmptyString(value, field));
 }
+function requireEnvVars(envVars) {
+    if (envVars === null ||
+        typeof envVars !== "object" ||
+        Array.isArray(envVars)) {
+        throw new Error("envVars must be a non-empty object of names to values");
+    }
+    const entries = Object.entries(envVars);
+    if (entries.length === 0) {
+        throw new Error("envVars must be a non-empty object of names to values");
+    }
+    return Object.fromEntries(entries.map(([name, value]) => {
+        // Validated on the trimmed form, stored verbatim: whitespace can be significant.
+        requireNonEmptyString(value, `envVars[${name}]`);
+        return [requireNonEmptyString(name, "envVars name"), value];
+    }));
+}
 function requireProxyRules(rules) {
     if (rules === undefined) {
         return [];
@@ -79,8 +95,8 @@ function proxyConfig({ rules, noProxy, accessControl, } = {}) {
     return config;
 }
 /** Build a sandbox proxy rule that signs AWS HTTPS requests with SigV4. */
-function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled = true, }) {
-    return {
+function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled = true, envVars, }) {
+    const rule = {
         name: requireNonEmptyString(name, "name"),
         type: "aws",
         enabled,
@@ -89,19 +105,27 @@ function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled = true, }
             secret_access_key: secretAccessKey,
         },
     };
+    if (envVars !== undefined) {
+        rule.env_vars = requireEnvVars(envVars);
+    }
+    return rule;
 }
 /** Build a sandbox proxy rule that injects GCP OAuth bearer auth. */
-function gcpAuth({ serviceAccountJson, scopes, name = "gcp", enabled = true, }) {
+function gcpAuth({ serviceAccountJson, scopes, name = "gcp", enabled = true, envVars, }) {
     const gcp = {
         service_account_json: serviceAccountJson,
     };
     if (scopes !== undefined) {
         gcp.scopes = requireNonEmptyStringArray(scopes, "scopes");
     }
-    return {
+    const rule = {
         name: requireNonEmptyString(name, "name"),
         type: "gcp",
         enabled,
         gcp,
     };
+    if (envVars !== undefined) {
+        rule.env_vars = requireEnvVars(envVars);
+    }
+    return rule;
 }

package/dist/sandbox/proxy_config.d.ts

@@ -10,16 +10,18 @@ export declare function proxyConfig({ rules, noProxy, accessControl, }?: {
     accessControl?: SandboxAccessControl;
 }): SandboxProxyConfig;
 /** Build a sandbox proxy rule that signs AWS HTTPS requests with SigV4. */
-export declare function awsAuth({ accessKeyId, secretAccessKey, name, enabled, }: {
+export declare function awsAuth({ accessKeyId, secretAccessKey, name, enabled, envVars, }: {
     accessKeyId: SandboxProxySecret;
     secretAccessKey: SandboxProxySecret;
     name?: string;
     enabled?: boolean;
+    envVars?: Record<string, string>;
 }): SandboxAwsAuthRule;
 /** Build a sandbox proxy rule that injects GCP OAuth bearer auth. */
-export declare function gcpAuth({ serviceAccountJson, scopes, name, enabled, }: {
+export declare function gcpAuth({ serviceAccountJson, scopes, name, enabled, envVars, }: {
     serviceAccountJson: SandboxProxySecret;
     scopes?: string[];
     name?: string;
     enabled?: boolean;
+    envVars?: Record<string, string>;
 }): SandboxGcpAuthRule;

package/dist/sandbox/proxy_config.js

@@ -10,6 +10,22 @@ function requireNonEmptyStringArray(values, field) {
     }
     return values.map((value) => requireNonEmptyString(value, field));
 }
+function requireEnvVars(envVars) {
+    if (envVars === null ||
+        typeof envVars !== "object" ||
+        Array.isArray(envVars)) {
+        throw new Error("envVars must be a non-empty object of names to values");
+    }
+    const entries = Object.entries(envVars);
+    if (entries.length === 0) {
+        throw new Error("envVars must be a non-empty object of names to values");
+    }
+    return Object.fromEntries(entries.map(([name, value]) => {
+        // Validated on the trimmed form, stored verbatim: whitespace can be significant.
+        requireNonEmptyString(value, `envVars[${name}]`);
+        return [requireNonEmptyString(name, "envVars name"), value];
+    }));
+}
 function requireProxyRules(rules) {
     if (rules === undefined) {
         return [];
@@ -72,8 +88,8 @@ export function proxyConfig({ rules, noProxy, accessControl, } = {}) {
     return config;
 }
 /** Build a sandbox proxy rule that signs AWS HTTPS requests with SigV4. */
-export function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled = true, }) {
-    return {
+export function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled = true, envVars, }) {
+    const rule = {
         name: requireNonEmptyString(name, "name"),
         type: "aws",
         enabled,
@@ -82,19 +98,27 @@ export function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled =
             secret_access_key: secretAccessKey,
         },
     };
+    if (envVars !== undefined) {
+        rule.env_vars = requireEnvVars(envVars);
+    }
+    return rule;
 }
 /** Build a sandbox proxy rule that injects GCP OAuth bearer auth. */
-export function gcpAuth({ serviceAccountJson, scopes, name = "gcp", enabled = true, }) {
+export function gcpAuth({ serviceAccountJson, scopes, name = "gcp", enabled = true, envVars, }) {
     const gcp = {
         service_account_json: serviceAccountJson,
     };
     if (scopes !== undefined) {
         gcp.scopes = requireNonEmptyStringArray(scopes, "scopes");
     }
-    return {
+    const rule = {
         name: requireNonEmptyString(name, "name"),
         type: "gcp",
         enabled,
         gcp,
     };
+    if (envVars !== undefined) {
+        rule.env_vars = requireEnvVars(envVars);
+    }
+    return rule;
 }

package/dist/sandbox/types.d.ts

@@ -270,6 +270,13 @@ export interface SandboxAwsAuthRule {
     type: "aws";
     /** Whether the rule is enabled. */
     enabled?: boolean;
+    /**
+     * Plaintext environment variables set for every command in the sandbox while
+     * the rule is enabled, for tools that refuse to run unless a credential
+     * variable is present even though the proxy injects the real credential on
+     * the wire.
+     */
+    env_vars?: Record<string, string>;
     /** AWS credentials used by the proxy signer. */
     aws: {
         access_key_id: SandboxProxySecret;
@@ -284,6 +291,13 @@ export interface SandboxGcpAuthRule {
     type: "gcp";
     /** Whether the rule is enabled. */
     enabled?: boolean;
+    /**
+     * Plaintext environment variables set for every command in the sandbox while
+     * the rule is enabled, for tools that refuse to run unless a credential
+     * variable is present even though the proxy injects the real credential on
+     * the wire.
+     */
+    env_vars?: Record<string, string>;
     /** GCP service-account credential and OAuth scopes. */
     gcp: {
         service_account_json: SandboxProxySecret;
@@ -386,8 +400,29 @@ export interface GitMountSpec {
     /** Git mount configuration. */
     git: GitMountConfig;
 }
+/** Context Hub configuration for a sandbox mount. */
+export interface ContextHubMountConfig {
+    /**
+     * Context Hub repository to sync, as `owner/repo` (e.g. `-/my-agent`, where
+     * `-` is the current workspace).
+     */
+    repo: string;
+    /** Sync once at startup instead of polling for updates. */
+    initial_pull_only?: boolean;
+}
+/** Read-only Context Hub-backed sandbox mount specification. */
+export interface ContextHubMountSpec {
+    /** Stable mount identifier. */
+    id: string;
+    /** Mount type. */
+    type: "contexthub";
+    /** Absolute path inside the sandbox where the repo tree appears. */
+    mount_path: string;
+    /** Context Hub mount configuration. */
+    contexthub: ContextHubMountConfig;
+}
 /** Sandbox mount specification. */
-export type SandboxMount = S3MountSpec | GCSMountSpec | GitMountSpec;
+export type SandboxMount = S3MountSpec | GCSMountSpec | GitMountSpec | ContextHubMountSpec;
 /** AWS credentials used by the backend to authenticate S3 mounts. */
 export interface SandboxAwsMountAuthConfig {
     access_key_id: SandboxProxySecret;

package/dist/wrappers/anthropic.cjs

@@ -5,7 +5,36 @@ exports.createUsageMetadata = createUsageMetadata;
 const anthropic_managed_js_1 = require("./utils/anthropic_managed.cjs");
 const traceable_js_1 = require("../traceable.cjs");
 const usage_js_1 = require("../utils/usage.cjs");
+const index_js_1 = require("../anonymizer/index.cjs");
 const TRACED_INVOCATION_KEYS = ["top_k", "top_p", "stream", "thinking"];
+/** Keys of an MCP server definition that are safe to trace. */
+const MCP_SERVER_SAFE_KEYS = new Set([
+    "name",
+    "type",
+    "url",
+    "tool_configuration",
+]);
+/**
+ * Mask credentials in `mcp_servers` before tracing. Anything outside
+ * {@link MCP_SERVER_SAFE_KEYS} keeps its name but gets
+ * {@link SECRET_PLACEHOLDER} as its value, so the trace shows the field was set
+ * without exposing it, and fields the API adds later are masked by default.
+ *
+ * Returns new objects; the caller's are also sent to Anthropic.
+ */
+function redactMcpServers(servers) {
+    if (!Array.isArray(servers))
+        return servers;
+    return servers.map((server) => {
+        if (typeof server !== "object" || server == null || Array.isArray(server)) {
+            return server;
+        }
+        return Object.fromEntries(Object.entries(server).map(([key, value]) => [
+            key,
+            MCP_SERVER_SAFE_KEYS.has(key) ? value : index_js_1.SECRET_PLACEHOLDER,
+        ]));
+    });
+}
 /**
  * Create usage metadata from Anthropic's token usage format.
  */
@@ -222,11 +251,15 @@ const wrapAnthropic = (anthropic, options) => {
      * This provides parity with the Python SDK behavior and enables system prompts
      * to be viewed and edited in the LangSmith playground.
      */
-    function processSystemMessage(params) {
+    function processTracedInputs(params) {
+        // Copy first: `params` also goes to the API and must keep its real values.
+        const processed = { ...params };
+        if (processed.mcp_servers != null) {
+            processed.mcp_servers = redactMcpServers(processed.mcp_servers);
+        }
         if (!params.system) {
-            return params;
+            return processed;
         }
-        const processed = { ...params };
         // Handle both string and ContentBlock[] formats
         const systemContent = Array.isArray(params.system)
             ? params.system
@@ -248,7 +281,7 @@ const wrapAnthropic = (anthropic, options) => {
         run_type: "llm",
         aggregator: messageAggregator,
         argsConfigPath: [1, "langsmithExtra"],
-        processInputs: processSystemMessage,
+        processInputs: processTracedInputs,
         getInvocationParams: (payload) => {
             if (typeof payload !== "object" || payload == null)
                 return undefined;
@@ -315,7 +348,7 @@ const wrapAnthropic = (anthropic, options) => {
         run_type: "llm",
         aggregator: messageAggregator,
         argsConfigPath: [1, "langsmithExtra"],
-        processInputs: processSystemMessage,
+        processInputs: processTracedInputs,
         getInvocationParams: messagesCreateConfig.getInvocationParams,
         processOutputs: processMessageOutput,
         ...cleanedOptions,
@@ -341,7 +374,7 @@ const wrapAnthropic = (anthropic, options) => {
                     run_type: "llm",
                     aggregator: messageAggregator,
                     argsConfigPath: [1, "langsmithExtra"],
-                    processInputs: processSystemMessage,
+                    processInputs: processTracedInputs,
                     getInvocationParams: messagesCreateConfig.getInvocationParams,
                     processOutputs: processMessageOutput,
                     ...cleanedOptions,

package/dist/wrappers/anthropic.js

@@ -1,7 +1,36 @@
 import { wrapManagedAgentSessionEvents } from "./utils/anthropic_managed.js";
 import { isTraceableFunction, traceable, } from "../traceable.js";
 import { convertAnthropicUsageToInputTokenDetails } from "../utils/usage.js";
+import { SECRET_PLACEHOLDER } from "../anonymizer/index.js";
 const TRACED_INVOCATION_KEYS = ["top_k", "top_p", "stream", "thinking"];
+/** Keys of an MCP server definition that are safe to trace. */
+const MCP_SERVER_SAFE_KEYS = new Set([
+    "name",
+    "type",
+    "url",
+    "tool_configuration",
+]);
+/**
+ * Mask credentials in `mcp_servers` before tracing. Anything outside
+ * {@link MCP_SERVER_SAFE_KEYS} keeps its name but gets
+ * {@link SECRET_PLACEHOLDER} as its value, so the trace shows the field was set
+ * without exposing it, and fields the API adds later are masked by default.
+ *
+ * Returns new objects; the caller's are also sent to Anthropic.
+ */
+function redactMcpServers(servers) {
+    if (!Array.isArray(servers))
+        return servers;
+    return servers.map((server) => {
+        if (typeof server !== "object" || server == null || Array.isArray(server)) {
+            return server;
+        }
+        return Object.fromEntries(Object.entries(server).map(([key, value]) => [
+            key,
+            MCP_SERVER_SAFE_KEYS.has(key) ? value : SECRET_PLACEHOLDER,
+        ]));
+    });
+}
 /**
  * Create usage metadata from Anthropic's token usage format.
  */
@@ -218,11 +247,15 @@ export const wrapAnthropic = (anthropic, options) => {
      * This provides parity with the Python SDK behavior and enables system prompts
      * to be viewed and edited in the LangSmith playground.
      */
-    function processSystemMessage(params) {
+    function processTracedInputs(params) {
+        // Copy first: `params` also goes to the API and must keep its real values.
+        const processed = { ...params };
+        if (processed.mcp_servers != null) {
+            processed.mcp_servers = redactMcpServers(processed.mcp_servers);
+        }
         if (!params.system) {
-            return params;
+            return processed;
         }
-        const processed = { ...params };
         // Handle both string and ContentBlock[] formats
         const systemContent = Array.isArray(params.system)
             ? params.system
@@ -244,7 +277,7 @@ export const wrapAnthropic = (anthropic, options) => {
         run_type: "llm",
         aggregator: messageAggregator,
         argsConfigPath: [1, "langsmithExtra"],
-        processInputs: processSystemMessage,
+        processInputs: processTracedInputs,
         getInvocationParams: (payload) => {
             if (typeof payload !== "object" || payload == null)
                 return undefined;
@@ -311,7 +344,7 @@ export const wrapAnthropic = (anthropic, options) => {
         run_type: "llm",
         aggregator: messageAggregator,
         argsConfigPath: [1, "langsmithExtra"],
-        processInputs: processSystemMessage,
+        processInputs: processTracedInputs,
         getInvocationParams: messagesCreateConfig.getInvocationParams,
         processOutputs: processMessageOutput,
         ...cleanedOptions,
@@ -337,7 +370,7 @@ export const wrapAnthropic = (anthropic, options) => {
                     run_type: "llm",
                     aggregator: messageAggregator,
                     argsConfigPath: [1, "langsmithExtra"],
-                    processInputs: processSystemMessage,
+                    processInputs: processTracedInputs,
                     getInvocationParams: messagesCreateConfig.getInvocationParams,
                     processOutputs: processMessageOutput,
                     ...cleanedOptions,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "langsmith",
-  "version": "0.8.10",
+  "version": "0.8.11",
   "description": "Client library to connect to the LangSmith Observability and Evaluation Platform.",
   "packageManager": "pnpm@10.33.0",
   "files": [
@@ -481,7 +481,17 @@
   },
   "pnpm": {
     "overrides": {
-      "js-yaml": "^4.1.1",
+      "@hono/node-server": "2.0.10",
+      "brace-expansion@<1.1.16": "1.1.16",
+      "brace-expansion@>=2.0.0 <2.1.2": "2.1.2",
+      "brace-expansion@>=3.0.0 <5.0.7": "5.0.7",
+      "fast-uri": "3.1.5",
+      "postcss": "8.5.23",
+      "js-yaml": "4.3.1",
+      "hono": "4.12.34",
+      "ip-address": "10.3.1",
+      "undici@>=7.0.0 <8.0.0": "7.29.0",
+      "undici@>=8.0.0 <9.0.0": "8.9.0",
       "vite": "^7.3.2",
       "form-data": "4.0.6",
       "langsmith": "0.6.0",