langsmith 0.8.9 → 0.8.11

package/dist/utils/profiles.js

@@ -5,6 +5,8 @@ export const DEFAULT_API_URL = "https://api.smith.langchain.com";
 const OAUTH_CLIENT_ID = "langsmith-cli";
 const TOKEN_REFRESH_LEEWAY_MS = 60_000;
 const TOKEN_REFRESH_TIMEOUT_MS = 10_000;
+const OAUTH_DISCOVERY_TIMEOUT_MS = 5_000;
+const WELL_KNOWN_OAUTH_PATH = "/.well-known/oauth-authorization-server";
 function isBrowserLikeRuntime() {
     const env = getEnv();
     return env === "browser" || env === "webworker";
@@ -87,6 +89,126 @@ function normalizeConfigUrl(apiUrl) {
         ? normalized.slice(0, -apiV1Suffix.length)
         : normalized;
 }
+/**
+ * Metadata base URLs to probe, most specific first: the configured mount point,
+ * then the self-hosted and SaaS locations, so both a bare origin and an
+ * explicit `/api` resolve.
+ */
+function oauthDiscoveryCandidates(apiUrl) {
+    const given = normalizeConfigUrl(apiUrl);
+    const origin = given.endsWith("/api")
+        ? given.slice(0, -"/api".length)
+        : given;
+    const candidates = [];
+    for (const candidate of [given, `${origin}/api`, origin]) {
+        if (candidate && candidate !== "/api" && !candidates.includes(candidate)) {
+            candidates.push(candidate);
+        }
+    }
+    return candidates;
+}
+/**
+ * Check the document describes the deployment we probed. RFC 8414 requires the
+ * issuer to match the URL the well-known path was built from, and every
+ * endpoint must share the issuer's origin. Refresh tokens are posted to these
+ * endpoints, so an unvalidated document could redirect credentials elsewhere.
+ */
+function isTrustedOAuthMetadata(doc, base) {
+    const { issuer } = doc;
+    if (typeof issuer !== "string" ||
+        issuer.replace(/\/+$/, "") !== base.replace(/\/+$/, "")) {
+        return false;
+    }
+    let issuerUrl;
+    try {
+        issuerUrl = new URL(issuer);
+    }
+    catch {
+        return false;
+    }
+    for (const endpoint of [
+        doc.device_authorization_endpoint,
+        doc.token_endpoint,
+    ]) {
+        if (typeof endpoint !== "string" || !endpoint) {
+            return false;
+        }
+        try {
+            const url = new URL(endpoint);
+            if (url.protocol !== issuerUrl.protocol || url.host !== issuerUrl.host) {
+                return false;
+            }
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Metadata URLs for an issuer, RFC 8414 form first. RFC 8414 inserts the
+ * well-known segment between the origin and the issuer path, so
+ * `https://host/api` is described at
+ * `https://host/.well-known/oauth-authorization-server/api`. Deployments
+ * commonly also serve the appended form, and for a path-less issuer the two are
+ * identical.
+ */
+function oauthMetadataUrls(base) {
+    const appended = `${base}${WELL_KNOWN_OAUTH_PATH}`;
+    let inserted;
+    try {
+        const url = new URL(base);
+        inserted = `${url.origin}${WELL_KNOWN_OAUTH_PATH}${url.pathname === "/" ? "" : url.pathname}`;
+    }
+    catch {
+        return [appended];
+    }
+    return inserted === appended ? [inserted] : [inserted, appended];
+}
+async function fetchOAuthMetadata(url, base, fetchImplementation) {
+    let response;
+    try {
+        response = await fetchImplementation(url, {
+            method: "GET",
+            headers: { Accept: "application/json" },
+            signal: AbortSignal.timeout(OAUTH_DISCOVERY_TIMEOUT_MS),
+        });
+    }
+    catch {
+        return undefined;
+    }
+    if (!response.ok) {
+        return undefined;
+    }
+    let doc;
+    try {
+        // Self-hosted answers unknown paths with an HTML 200 from the SPA.
+        doc = (await response.json());
+    }
+    catch {
+        return undefined;
+    }
+    if (!doc || typeof doc !== "object" || !isTrustedOAuthMetadata(doc, base)) {
+        return undefined;
+    }
+    return doc;
+}
+/**
+ * Resolve the token endpoint, preferring the deployment's metadata document.
+ * Falls back to `<mount>/oauth/token`, keeping a trailing `/api` because
+ * self-hosted mounts the authorization server under it.
+ */
+export async function resolveTokenEndpoint(apiUrl, fetchImplementation) {
+    for (const base of oauthDiscoveryCandidates(apiUrl)) {
+        for (const url of oauthMetadataUrls(base)) {
+            const doc = await fetchOAuthMetadata(url, base, fetchImplementation);
+            if (doc) {
+                return doc.token_endpoint;
+            }
+        }
+    }
+    return `${normalizeConfigUrl(apiUrl)}/oauth/token`;
+}
 function applyTokenResponse(profile, token) {
     profile.oauth ??= {};
     if (token.access_token) {
@@ -224,7 +346,8 @@ export class ProfileAuth {
                 client_id: OAUTH_CLIENT_ID,
                 refresh_token: this.state.profile.oauth?.refresh_token ?? refreshToken,
             });
-            const response = await fetchImplementation(`${normalizeConfigUrl(refreshApiUrl)}/oauth/token`, {
+            const tokenEndpoint = await resolveTokenEndpoint(refreshApiUrl, fetchImplementation);
+            const response = await fetchImplementation(tokenEndpoint, {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/x-www-form-urlencoded",

package/dist/wrappers/anthropic.cjs

@@ -5,7 +5,36 @@ exports.createUsageMetadata = createUsageMetadata;
 const anthropic_managed_js_1 = require("./utils/anthropic_managed.cjs");
 const traceable_js_1 = require("../traceable.cjs");
 const usage_js_1 = require("../utils/usage.cjs");
+const index_js_1 = require("../anonymizer/index.cjs");
 const TRACED_INVOCATION_KEYS = ["top_k", "top_p", "stream", "thinking"];
+/** Keys of an MCP server definition that are safe to trace. */
+const MCP_SERVER_SAFE_KEYS = new Set([
+    "name",
+    "type",
+    "url",
+    "tool_configuration",
+]);
+/**
+ * Mask credentials in `mcp_servers` before tracing. Anything outside
+ * {@link MCP_SERVER_SAFE_KEYS} keeps its name but gets
+ * {@link SECRET_PLACEHOLDER} as its value, so the trace shows the field was set
+ * without exposing it, and fields the API adds later are masked by default.
+ *
+ * Returns new objects; the caller's are also sent to Anthropic.
+ */
+function redactMcpServers(servers) {
+    if (!Array.isArray(servers))
+        return servers;
+    return servers.map((server) => {
+        if (typeof server !== "object" || server == null || Array.isArray(server)) {
+            return server;
+        }
+        return Object.fromEntries(Object.entries(server).map(([key, value]) => [
+            key,
+            MCP_SERVER_SAFE_KEYS.has(key) ? value : index_js_1.SECRET_PLACEHOLDER,
+        ]));
+    });
+}
 /**
  * Create usage metadata from Anthropic's token usage format.
  */
@@ -222,11 +251,15 @@ const wrapAnthropic = (anthropic, options) => {
      * This provides parity with the Python SDK behavior and enables system prompts
      * to be viewed and edited in the LangSmith playground.
      */
-    function processSystemMessage(params) {
+    function processTracedInputs(params) {
+        // Copy first: `params` also goes to the API and must keep its real values.
+        const processed = { ...params };
+        if (processed.mcp_servers != null) {
+            processed.mcp_servers = redactMcpServers(processed.mcp_servers);
+        }
         if (!params.system) {
-            return params;
+            return processed;
         }
-        const processed = { ...params };
         // Handle both string and ContentBlock[] formats
         const systemContent = Array.isArray(params.system)
             ? params.system
@@ -248,7 +281,7 @@ const wrapAnthropic = (anthropic, options) => {
         run_type: "llm",
         aggregator: messageAggregator,
         argsConfigPath: [1, "langsmithExtra"],
-        processInputs: processSystemMessage,
+        processInputs: processTracedInputs,
         getInvocationParams: (payload) => {
             if (typeof payload !== "object" || payload == null)
                 return undefined;
@@ -315,7 +348,7 @@ const wrapAnthropic = (anthropic, options) => {
         run_type: "llm",
         aggregator: messageAggregator,
         argsConfigPath: [1, "langsmithExtra"],
-        processInputs: processSystemMessage,
+        processInputs: processTracedInputs,
         getInvocationParams: messagesCreateConfig.getInvocationParams,
         processOutputs: processMessageOutput,
         ...cleanedOptions,
@@ -341,7 +374,7 @@ const wrapAnthropic = (anthropic, options) => {
                     run_type: "llm",
                     aggregator: messageAggregator,
                     argsConfigPath: [1, "langsmithExtra"],
-                    processInputs: processSystemMessage,
+                    processInputs: processTracedInputs,
                     getInvocationParams: messagesCreateConfig.getInvocationParams,
                     processOutputs: processMessageOutput,
                     ...cleanedOptions,

package/dist/wrappers/anthropic.js

@@ -1,7 +1,36 @@
 import { wrapManagedAgentSessionEvents } from "./utils/anthropic_managed.js";
 import { isTraceableFunction, traceable, } from "../traceable.js";
 import { convertAnthropicUsageToInputTokenDetails } from "../utils/usage.js";
+import { SECRET_PLACEHOLDER } from "../anonymizer/index.js";
 const TRACED_INVOCATION_KEYS = ["top_k", "top_p", "stream", "thinking"];
+/** Keys of an MCP server definition that are safe to trace. */
+const MCP_SERVER_SAFE_KEYS = new Set([
+    "name",
+    "type",
+    "url",
+    "tool_configuration",
+]);
+/**
+ * Mask credentials in `mcp_servers` before tracing. Anything outside
+ * {@link MCP_SERVER_SAFE_KEYS} keeps its name but gets
+ * {@link SECRET_PLACEHOLDER} as its value, so the trace shows the field was set
+ * without exposing it, and fields the API adds later are masked by default.
+ *
+ * Returns new objects; the caller's are also sent to Anthropic.
+ */
+function redactMcpServers(servers) {
+    if (!Array.isArray(servers))
+        return servers;
+    return servers.map((server) => {
+        if (typeof server !== "object" || server == null || Array.isArray(server)) {
+            return server;
+        }
+        return Object.fromEntries(Object.entries(server).map(([key, value]) => [
+            key,
+            MCP_SERVER_SAFE_KEYS.has(key) ? value : SECRET_PLACEHOLDER,
+        ]));
+    });
+}
 /**
  * Create usage metadata from Anthropic's token usage format.
  */
@@ -218,11 +247,15 @@ export const wrapAnthropic = (anthropic, options) => {
      * This provides parity with the Python SDK behavior and enables system prompts
      * to be viewed and edited in the LangSmith playground.
      */
-    function processSystemMessage(params) {
+    function processTracedInputs(params) {
+        // Copy first: `params` also goes to the API and must keep its real values.
+        const processed = { ...params };
+        if (processed.mcp_servers != null) {
+            processed.mcp_servers = redactMcpServers(processed.mcp_servers);
+        }
         if (!params.system) {
-            return params;
+            return processed;
         }
-        const processed = { ...params };
         // Handle both string and ContentBlock[] formats
         const systemContent = Array.isArray(params.system)
             ? params.system
@@ -244,7 +277,7 @@ export const wrapAnthropic = (anthropic, options) => {
         run_type: "llm",
         aggregator: messageAggregator,
         argsConfigPath: [1, "langsmithExtra"],
-        processInputs: processSystemMessage,
+        processInputs: processTracedInputs,
         getInvocationParams: (payload) => {
             if (typeof payload !== "object" || payload == null)
                 return undefined;
@@ -311,7 +344,7 @@ export const wrapAnthropic = (anthropic, options) => {
         run_type: "llm",
         aggregator: messageAggregator,
         argsConfigPath: [1, "langsmithExtra"],
-        processInputs: processSystemMessage,
+        processInputs: processTracedInputs,
         getInvocationParams: messagesCreateConfig.getInvocationParams,
         processOutputs: processMessageOutput,
         ...cleanedOptions,
@@ -337,7 +370,7 @@ export const wrapAnthropic = (anthropic, options) => {
                     run_type: "llm",
                     aggregator: messageAggregator,
                     argsConfigPath: [1, "langsmithExtra"],
-                    processInputs: processSystemMessage,
+                    processInputs: processTracedInputs,
                     getInvocationParams: messagesCreateConfig.getInvocationParams,
                     processOutputs: processMessageOutput,
                     ...cleanedOptions,

package/dist/wrappers/openai.cjs

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.wrapOpenAI = void 0;
 const traceable_js_1 = require("../traceable.cjs");
+const traceable_js_2 = require("../singletons/traceable.cjs");
+const ls_agent_type_js_1 = require("../utils/ls_agent_type.cjs");
 const TRACED_INVOCATION_KEYS = [
     "frequency_penalty",
     "n",
@@ -261,6 +263,7 @@ const getChatModelInvocationParamsFn = (provider, prepopulatedInvocationParams,
                 ...prepopulatedInvocationParams,
                 ...ls_invocation_params,
             },
+            ...(0, ls_agent_type_js_1.defaultLsAgentTypeMetadata)(requestMetadata, (0, traceable_js_2.getCurrentRunTree)(true)),
         };
     };
 };
@@ -416,6 +419,7 @@ const wrapOpenAI = (openai, options) => {
                         ...prepopulatedInvocationParams,
                         ...ls_invocation_params,
                     },
+                    ...(0, ls_agent_type_js_1.defaultLsAgentTypeMetadata)({}, (0, traceable_js_2.getCurrentRunTree)(true)),
                 };
             },
             ...cleanedOptions,

package/dist/wrappers/openai.js

@@ -1,4 +1,6 @@
 import { isTraceableFunction, traceable, } from "../traceable.js";
+import { getCurrentRunTree } from "../singletons/traceable.js";
+import { defaultLsAgentTypeMetadata } from "../utils/ls_agent_type.js";
 const TRACED_INVOCATION_KEYS = [
     "frequency_penalty",
     "n",
@@ -258,6 +260,7 @@ const getChatModelInvocationParamsFn = (provider, prepopulatedInvocationParams,
                 ...prepopulatedInvocationParams,
                 ...ls_invocation_params,
             },
+            ...defaultLsAgentTypeMetadata(requestMetadata, getCurrentRunTree(true)),
         };
     };
 };
@@ -413,6 +416,7 @@ export const wrapOpenAI = (openai, options) => {
                         ...prepopulatedInvocationParams,
                         ...ls_invocation_params,
                     },
+                    ...defaultLsAgentTypeMetadata({}, getCurrentRunTree(true)),
                 };
             },
             ...cleanedOptions,

package/dist/wrappers/openai_agents.cjs

@@ -10,6 +10,7 @@ const node_async_hooks_1 = require("node:async_hooks");
 const run_trees_js_1 = require("../run_trees.cjs");
 const client_js_1 = require("../client.cjs");
 const traceable_js_1 = require("../singletons/traceable.cjs");
+const ls_agent_type_js_1 = require("../utils/ls_agent_type.cjs");
 traceable_js_1.AsyncLocalStorageProviderSingleton.initializeGlobalInstance(new node_async_hooks_1.AsyncLocalStorage());
 /**
  * Set the current AsyncLocalStorage store to the given RunTree without a
@@ -521,14 +522,15 @@ class OpenAIAgentsTracingProcessor {
         else {
             runName = "Agent workflow";
         }
-        // Build metadata
-        const runExtra = {
-            metadata: {
-                ...this._metadata,
-                ls_integration: "openai-agents-sdk",
-                ls_agent_type: "root",
-            },
+        // Merge three sources: processor defaults, trace.metadata (user's per-run
+        // ls_agent_type), and force-set ls_integration.
+        const mergedMetadata = {
+            ...this._metadata,
+            ...(trace.metadata ?? {}),
+            ls_integration: "openai-agents-sdk",
         };
+        Object.assign(mergedMetadata, (0, ls_agent_type_js_1.defaultLsAgentTypeMetadata)(mergedMetadata, currentRunTree));
+        const runExtra = { metadata: mergedMetadata };
         const traceDict = trace.toJSON() ?? {};
         const groupId = trace.groupId ??
             traceDict.groupId ??
@@ -589,9 +591,10 @@ class OpenAIAgentsTracingProcessor {
         }
         this._runs.delete(trace.traceId);
         const traceDict = trace.toJSON() ?? {};
+        // trace.metadata may have new keys since onTraceStart; pull them in.
         const metadata = {
-            ...traceDict.metadata,
             ...this._metadata,
+            ...traceDict.metadata,
         };
         try {
             // Update run with final inputs/outputs
@@ -695,10 +698,10 @@ class OpenAIAgentsTracingProcessor {
                 if (!childRun.extra.metadata) {
                     childRun.extra.metadata = {};
                 }
-                childRun.extra.metadata = {
-                    ...childRun.extra.metadata,
-                    ls_agent_type: "subagent",
-                };
+                const meta = childRun.extra.metadata;
+                if (!ls_agent_type_js_1.NON_ROOT_LS_AGENT_TYPES.has(meta.ls_agent_type)) {
+                    meta.ls_agent_type = "subagent";
+                }
             }
         }
         // Track span data type for parent lookups

package/dist/wrappers/openai_agents.js

@@ -7,6 +7,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { RunTree } from "../run_trees.js";
 import { Client } from "../client.js";
 import { AsyncLocalStorageProviderSingleton, getCurrentRunTree, } from "../singletons/traceable.js";
+import { NON_ROOT_LS_AGENT_TYPES, defaultLsAgentTypeMetadata, } from "../utils/ls_agent_type.js";
 AsyncLocalStorageProviderSingleton.initializeGlobalInstance(new AsyncLocalStorage());
 /**
  * Set the current AsyncLocalStorage store to the given RunTree without a
@@ -518,14 +519,15 @@ export class OpenAIAgentsTracingProcessor {
         else {
             runName = "Agent workflow";
         }
-        // Build metadata
-        const runExtra = {
-            metadata: {
-                ...this._metadata,
-                ls_integration: "openai-agents-sdk",
-                ls_agent_type: "root",
-            },
+        // Merge three sources: processor defaults, trace.metadata (user's per-run
+        // ls_agent_type), and force-set ls_integration.
+        const mergedMetadata = {
+            ...this._metadata,
+            ...(trace.metadata ?? {}),
+            ls_integration: "openai-agents-sdk",
         };
+        Object.assign(mergedMetadata, defaultLsAgentTypeMetadata(mergedMetadata, currentRunTree));
+        const runExtra = { metadata: mergedMetadata };
         const traceDict = trace.toJSON() ?? {};
         const groupId = trace.groupId ??
             traceDict.groupId ??
@@ -586,9 +588,10 @@ export class OpenAIAgentsTracingProcessor {
         }
         this._runs.delete(trace.traceId);
         const traceDict = trace.toJSON() ?? {};
+        // trace.metadata may have new keys since onTraceStart; pull them in.
         const metadata = {
-            ...traceDict.metadata,
             ...this._metadata,
+            ...traceDict.metadata,
         };
         try {
             // Update run with final inputs/outputs
@@ -692,10 +695,10 @@ export class OpenAIAgentsTracingProcessor {
                 if (!childRun.extra.metadata) {
                     childRun.extra.metadata = {};
                 }
-                childRun.extra.metadata = {
-                    ...childRun.extra.metadata,
-                    ls_agent_type: "subagent",
-                };
+                const meta = childRun.extra.metadata;
+                if (!NON_ROOT_LS_AGENT_TYPES.has(meta.ls_agent_type)) {
+                    meta.ls_agent_type = "subagent";
+                }
             }
         }
         // Track span data type for parent lookups

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "langsmith",
-  "version": "0.8.9",
+  "version": "0.8.11",
   "description": "Client library to connect to the LangSmith Observability and Evaluation Platform.",
   "packageManager": "pnpm@10.33.0",
   "files": [
@@ -481,7 +481,17 @@
   },
   "pnpm": {
     "overrides": {
-      "js-yaml": "^4.1.1",
+      "@hono/node-server": "2.0.10",
+      "brace-expansion@<1.1.16": "1.1.16",
+      "brace-expansion@>=2.0.0 <2.1.2": "2.1.2",
+      "brace-expansion@>=3.0.0 <5.0.7": "5.0.7",
+      "fast-uri": "3.1.5",
+      "postcss": "8.5.23",
+      "js-yaml": "4.3.1",
+      "hono": "4.12.34",
+      "ip-address": "10.3.1",
+      "undici@>=7.0.0 <8.0.0": "7.29.0",
+      "undici@>=8.0.0 <9.0.0": "8.9.0",
       "vite": "^7.3.2",
       "form-data": "4.0.6",
       "langsmith": "0.6.0",