agent-engine-runner-shared 0.11.8__tar.gz → 0.11.10__tar.gz

{agent_engine_runner_shared-0.11.8 → agent_engine_runner_shared-0.11.10}/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- Reuse a process-wide keep-alive mTLS client for OE callbacks (tool
+  execute/result, node events, progress and custom events) and drain callback
+  response bodies so connections return to the pool; removes a full TLS
+  handshake per callback.
+
 ### Fixed
 - Uncaught exceptions in agent code now emit one filterable `level=ERROR`
   record instead of only `WARNING`. Ordinary stderr writes with no

{agent_engine_runner_shared-0.11.8 → agent_engine_runner_shared-0.11.10}/Dockerfile

@@ -5,7 +5,7 @@
 # Usage: docker buildx build -t runner:latest -f packages/python/packages/agent-engine-runner-shared/Dockerfile .
 
 ARG BASE_TARGETPLATFORM=linux/amd64
-ARG RUNNER_BASE_IMAGE=664315256653.dkr.ecr.us-east-1.amazonaws.com/base/amazonlinux2023-python:v3.11-202512082043-f9f77a3
+ARG RUNNER_BASE_IMAGE=664315256653.dkr.ecr.us-east-1.amazonaws.com/base/amazonlinux2023-python:v3.11-202610191636-2ff39c3@sha256:30ecac067fceafe43a5f0f5e80d1725b60708204dcd2fe3f176363417e2a2402
 
 FROM --platform=${BASE_TARGETPLATFORM} ghcr.io/astral-sh/uv@sha256:ff07b86af50d4d9391d9daf4ff89ce427bc544f9aae87057e69a1cc0aa369946 AS uv
 

{agent_engine_runner_shared-0.11.8 → agent_engine_runner_shared-0.11.10}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.5
 Name: agent-engine-runner-shared
-Version: 0.11.8
+Version: 0.11.10
 Summary: Runner SDK - Framework-agnostic agent runtime
 License: Apache-2.0
 License-File: LICENSE
 Requires-Python: >=3.11
-Requires-Dist: agent-engine-sdk-memory==0.11.8
-Requires-Dist: agent-engine-sdk==0.11.8
+Requires-Dist: agent-engine-sdk-memory==0.11.10
+Requires-Dist: agent-engine-sdk==0.11.10
 Requires-Dist: fastapi>=0.141.1
 Requires-Dist: filelock>=3.0.0
 Requires-Dist: httpx-sse>=0.4.0
@@ -20,8 +20,8 @@ Requires-Dist: python-dotenv>=1.0.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: regex>=2026.4.4
 Requires-Dist: sentry-sdk>=2.27.0
-Requires-Dist: starlette>=1.4.1
-Requires-Dist: uvicorn>=0.32.0
+Requires-Dist: starlette>=1.7.0
+Requires-Dist: uvicorn>=0.50.0
 Provides-Extra: debug
 Requires-Dist: debugpy>=1.8.0; extra == 'debug'
 Provides-Extra: dev

{agent_engine_runner_shared-0.11.8 → agent_engine_runner_shared-0.11.10}/docs/api.md

@@ -166,6 +166,7 @@
   * [register\_guardrail\_policy\_engine](#agent_engine_runner_shared.guardrails_evaluator.core.register_guardrail_policy_engine)
   * [evaluate\_guardrail\_check](#agent_engine_runner_shared.guardrails_evaluator.core.evaluate_guardrail_check)
 * [agent\_engine\_runner\_shared.secure\_llm\_proxy](#agent_engine_runner_shared.secure_llm_proxy)
+  * [GuardrailReviewPending](#agent_engine_runner_shared.secure_llm_proxy.GuardrailReviewPending)
   * [guardrail\_review\_wait\_id](#agent_engine_runner_shared.secure_llm_proxy.guardrail_review_wait_id)
   * [SecureLLMProxy](#agent_engine_runner_shared.secure_llm_proxy.SecureLLMProxy)
     * [step\_counter](#agent_engine_runner_shared.secure_llm_proxy.SecureLLMProxy.step_counter)
@@ -173,14 +174,19 @@
     * [response\_from\_stream\_chunks](#agent_engine_runner_shared.secure_llm_proxy.SecureLLMProxy.response_from_stream_chunks)
     * [stream](#agent_engine_runner_shared.secure_llm_proxy.SecureLLMProxy.stream)
 * [agent\_engine\_runner\_shared.secure\_wrapper](#agent_engine_runner_shared.secure_wrapper)
+  * [\_OAuthAuthorizationRequired](#agent_engine_runner_shared.secure_wrapper._OAuthAuthorizationRequired)
+    * [\_\_init\_\_](#agent_engine_runner_shared.secure_wrapper._OAuthAuthorizationRequired.__init__)
+  * [oauth\_authorization\_wait\_id](#agent_engine_runner_shared.secure_wrapper.oauth_authorization_wait_id)
   * [extract\_usage](#agent_engine_runner_shared.secure_wrapper.extract_usage)
   * [PolicyDeniedException](#agent_engine_runner_shared.secure_wrapper.PolicyDeniedException)
   * [OERetryAfterError](#agent_engine_runner_shared.secure_wrapper.OERetryAfterError)
   * [ToolExecutionError](#agent_engine_runner_shared.secure_wrapper.ToolExecutionError)
+  * [ToolPlatformError](#agent_engine_runner_shared.secure_wrapper.ToolPlatformError)
   * [TerminalExecutionError](#agent_engine_runner_shared.secure_wrapper.TerminalExecutionError)
   * [raise\_for\_oe\_rejection](#agent_engine_runner_shared.secure_wrapper.raise_for_oe_rejection)
   * [ToolCallTimeoutError](#agent_engine_runner_shared.secure_wrapper.ToolCallTimeoutError)
   * [OperationalStepAllocator](#agent_engine_runner_shared.secure_wrapper.OperationalStepAllocator)
+    * [allocation\_count](#agent_engine_runner_shared.secure_wrapper.OperationalStepAllocator.allocation_count)
   * [ExternalAPICallError](#agent_engine_runner_shared.secure_wrapper.ExternalAPICallError)
   * [LLMInvocationError](#agent_engine_runner_shared.secure_wrapper.LLMInvocationError)
   * [request\_oe\_approval](#agent_engine_runner_shared.secure_wrapper.request_oe_approval)
@@ -2623,6 +2629,16 @@ The proxy packages intercepted invoke_llm requests for the Orchestration Engine
 and unwraps the streamed OE relay back into sdk-core models. The OE owns
 approval, routing, live SSE relay, and final audit/result recording.
 
+<a id="agent_engine_runner_shared.secure_llm_proxy.GuardrailReviewPending"></a>
+
+## GuardrailReviewPending
+
+```python
+class GuardrailReviewPending(Exception)
+```
+
+A recorded halt whose adapter emits its native wait after the LLM call.
+
 <a id="agent_engine_runner_shared.secure_llm_proxy.guardrail_review_wait_id"></a>
 
 #### guardrail\_review\_wait\_id
@@ -2691,11 +2707,14 @@ Collect streamed sdk-core chunks into a final sdk-core LLMResponse.
 #### stream
 
 ```python
-def stream(messages: list[Message],
-           step: int | None = None,
-           stop: list[str] | None = None,
-           options: LLMInvocationOptions | None = None,
-           activity_key: str | None = None) -> Iterator[LLMStreamChunk]
+def stream(
+    messages: list[Message],
+    step: int | None = None,
+    stop: list[str] | None = None,
+    options: LLMInvocationOptions | None = None,
+    activity_key: str | None = None,
+    pending_review: GuardrailReviewPending | None = None
+) -> Iterator[LLMStreamChunk]
 ```
 
 Stream invoke_llm chunks through OE approval and OE-owned SSE relay.
@@ -2718,6 +2737,36 @@ This module provides:
 
 HITL is handled via LangGraph's native interrupt() / Command(resume=...) API.
 
+<a id="agent_engine_runner_shared.secure_wrapper._OAuthAuthorizationRequired"></a>
+
+## \_OAuthAuthorizationRequired
+
+```python
+class _OAuthAuthorizationRequired(Exception)
+```
+
+Leave durable dispatch with typed consent control instead of interrupting its activity.
+
+<a id="agent_engine_runner_shared.secure_wrapper._OAuthAuthorizationRequired.__init__"></a>
+
+#### \_\_init\_\_
+
+```python
+def __init__(elicitation: ElicitationInfo, step: int) -> None
+```
+
+Carry the OE response to its activity boundary without exposing it in errors.
+
+<a id="agent_engine_runner_shared.secure_wrapper.oauth_authorization_wait_id"></a>
+
+#### oauth\_authorization\_wait\_id
+
+```python
+def oauth_authorization_wait_id(value: Any) -> str | None
+```
+
+Identify a consent wait only when this attempt recorded the platform's challenge.
+
 <a id="agent_engine_runner_shared.secure_wrapper.extract_usage"></a>
 
 #### extract\_usage
@@ -2768,12 +2817,26 @@ class ToolExecutionError(Exception)
 
 Raised when tool execution fails.
 
+<a id="agent_engine_runner_shared.secure_wrapper.ToolPlatformError"></a>
+
+## ToolPlatformError
+
+```python
+class ToolPlatformError(ToolExecutionError)
+```
+
+Raised when the platform, not the tool, failed a tool call.
+
+The tool may already have run, for example when OE rejects or never
+acknowledges its result, so an adapter must not report this to the model as
+a failed tool it could call again.
+
 <a id="agent_engine_runner_shared.secure_wrapper.TerminalExecutionError"></a>
 
 ## TerminalExecutionError
 
 ```python
-class TerminalExecutionError(ToolExecutionError)
+class TerminalExecutionError(ToolPlatformError)
 ```
 
 Raised when OE rejects a tool call because the execution already ended.
@@ -2818,6 +2881,16 @@ Process-local operational step_number mint for one AER execution.
 Shared by SecureToolWrapper and SecureLLMProxy so parallel tools and LLM
 calls cannot collide under a single AER. Not a multi-OE authority.
 
+<a id="agent_engine_runner_shared.secure_wrapper.OperationalStepAllocator.allocation_count"></a>
+
+#### allocation\_count
+
+```python
+def allocation_count() -> int
+```
+
+Count minted request slots independently of replayed step watermarks.
+
 <a id="agent_engine_runner_shared.secure_wrapper.ExternalAPICallError"></a>
 
 ## ExternalAPICallError
@@ -3052,24 +3125,30 @@ Clean up resources owned by this execution's wrapper.
 #### execute\_tool
 
 ```python
-def execute_tool(tool_name: str,
-                 arguments: Dict[str, Any],
-                 *,
-                 metadata: Optional[Dict[str, Any]] = None,
-                 provider_type: Optional[str] = None,
-                 scopes: Optional[list[str]] = None,
-                 tool_call_id: Optional[str] = None,
-                 raw_on_interrupt: bool = False,
-                 redact_fields: Optional[list[str]] = None,
-                 is_local: bool = True,
-                 local_executor: Optional[Callable[[], Any]] = None,
-                 is_framework_control_flow: Optional[Callable[[BaseException],
-                                                              bool]] = None,
-                 call_channel_expected: bool = False) -> Any
+def execute_tool(
+        tool_name: str,
+        arguments: Dict[str, Any],
+        *,
+        metadata: Optional[Dict[str, Any]] = None,
+        provider_type: Optional[str] = None,
+        scopes: Optional[list[str]] = None,
+        tool_call_id: Optional[str] = None,
+        raw_on_interrupt: bool = False,
+        redact_fields: Optional[list[str]] = None,
+        is_local: bool = True,
+        local_executor: Optional[Callable[[], Any]] = None,
+        is_framework_control_flow: Optional[Callable[[BaseException],
+                                                     bool]] = None,
+        call_channel_expected: bool = False,
+        on_unknown_outcome: Optional[UnknownOutcomePolicy] = None) -> Any
 ```
 
 Execute a tool call through OE.
 
+Durable OAuth records a typed challenge before a separate framework
+wait, then records the actual resource call after reauthorization.
+Its consent answer never becomes a tool result or Memory content.
+
 **Arguments**:
 
 - `tool_name` - Name of the tool
@@ -3086,6 +3165,9 @@ Execute a tool call through OE.
 - `is_local` - Whether OE should return the approved call to this AER.
 - `local_executor` - Callback that invokes the registered tool on the
   current framework stack. Required for local tools.
+- `on_unknown_outcome` - What a retry does when the runner was lost while
+  this tool was in flight in a durable workflow: ``"rerun"`` runs it
+  again, ``"fail"`` refuses the retry.
 
 
 **Returns**:
@@ -3107,20 +3189,22 @@ Execute a tool call through OE.
 
 ```python
 def create_secure_tool_function(
-    original_tool: Any,
-    tool_name: str,
-    *,
-    allow_direct: bool = False,
-    metadata: Optional[Dict[str, Any]] = None,
-    is_local: bool = True,
-    provider_type: Optional[str] = None,
-    scopes: Optional[list[str]] = None,
-    response_format: Literal["content", "content_and_artifact"] = "content",
-    tool_declared_format: Optional[Literal["content",
-                                           "content_and_artifact"]] = None,
-    redact_fields: Optional[list[str]] = None,
-    is_framework_control_flow: Optional[Callable[[BaseException], bool]] = None
-) -> Callable
+        original_tool: Any,
+        tool_name: str,
+        *,
+        allow_direct: bool = False,
+        metadata: Optional[Dict[str, Any]] = None,
+        is_local: bool = True,
+        provider_type: Optional[str] = None,
+        scopes: Optional[list[str]] = None,
+        response_format: Literal["content",
+                                 "content_and_artifact"] = "content",
+        tool_declared_format: Optional[Literal["content",
+                                               "content_and_artifact"]] = None,
+        redact_fields: Optional[list[str]] = None,
+        is_framework_control_flow: Optional[Callable[[BaseException],
+                                                     bool]] = None,
+        on_unknown_outcome: Optional[UnknownOutcomePolicy] = None) -> Callable
 ```
 
 Create a wrapped tool function that routes through SecureToolWrapper.
@@ -3140,6 +3224,9 @@ to be built before execution context exists.
 - `tool_declared_format` - The tool author's own original format, used only
   to decide whether a normal result gets shape-matched into a tuple.
   Defaults to ``response_format``.
+- `on_unknown_outcome` - What a retry does when the runner was lost while
+  this tool was in flight in a durable workflow: ``"rerun"`` runs it
+  again, ``"fail"`` refuses the retry.
 
 
 **Returns**:

{agent_engine_runner_shared-0.11.8 → agent_engine_runner_shared-0.11.10}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agent-engine-runner-shared"
-version = "0.11.8"
+version = "0.11.10"
 description = "Runner SDK - Framework-agnostic agent runtime"
 readme = "README.md"
 license = {text = "Apache-2.0"}
@@ -11,8 +11,10 @@ dependencies = [
     # floor: older starlette rebuilds url.path from the Host header with no
     # validation, which can disagree with scope["path"]. The
     # Host-validating _HOST_RE landed in starlette 1.4.1.
-    "starlette>=1.4.1",
-    "uvicorn>=0.32.0",
+    "starlette>=1.7.0",
+    # The launcher relies on uvicorn's STARTUP_FAILURE (exit 3) contract for
+    # lifespan startup and bind failures, added in 0.50.0.
+    "uvicorn>=0.50.0",
     "pydantic>=2.0.0",
     "protobuf>=6.33.6,<7",
     "httpx>=0.27.0",
@@ -23,9 +25,9 @@ dependencies = [
     "jsonschema>=4.26.0",
     "sentry-sdk>=2.27.0",
     # BaseAgent protocol and AgentInput/AgentEvent models
-    "agent-engine-sdk==0.11.8",
+    "agent-engine-sdk==0.11.10",
     # Memory models and the MemoryClient HTTP client
-    "agent-engine-sdk-memory==0.11.8",
+    "agent-engine-sdk-memory==0.11.10",
     # Required for checkpoint message decoding (query/sessions endpoints)
     "msgpack>=1.0.0",
     # Required by guardrails_evaluator/regex.py for advanced regex matching

{agent_engine_runner_shared-0.11.8 → agent_engine_runner_shared-0.11.10}/src/agent_engine_runner_shared/__init__.py

@@ -96,6 +96,7 @@ from agent_engine_runner_shared.secure_wrapper import (
     TerminalExecutionError,
     ToolCallTimeoutError,
     ToolExecutionError,
+    ToolPlatformError,
     extract_usage,
 )
 from agent_engine_runner_shared.structured_logging import (
@@ -190,6 +191,7 @@ __all__ = [
     "TerminalExecutionError",
     "ToolCallTimeoutError",
     "ToolExecutionError",
+    "ToolPlatformError",
     "ExternalAPICallError",
     # Utilities
     "extract_usage",

agent_engine_runner_shared-0.11.10/src/agent_engine_runner_shared/caller_trace.py

@@ -0,0 +1,138 @@
+"""Distinguish an inbound caller trace from a root this runner created.
+
+AER always starts ``aer.execute``. With no inbound traceparent that span is a
+root, and ``tls_client`` injects it on the call to the OE. The OE forwards
+that header, so the tool process sees a remote parent even though no caller
+trace was bound. W3C traceparent cannot say who created the root, so the
+outgoing tracestate carries ``agentengine=root`` for a runner-created trace.
+Guardrail content is recorded only when that marker is absent.
+"""
+
+from __future__ import annotations
+
+from contextlib import contextmanager
+from typing import Any, Iterator
+
+# Simple W3C tracestate member. A value of "root" means a runner process
+# created this trace; an inbound caller does not set it.
+RUNNER_ROOT_TRACESTATE_KEY = "agentengine"
+RUNNER_ROOT_TRACESTATE_VALUE = "root"
+
+_RUNNER_ROOTED_KEY: Any = None
+
+
+def _runner_rooted_key() -> Any:
+    global _RUNNER_ROOTED_KEY
+    if _RUNNER_ROOTED_KEY is None:
+        from opentelemetry import context
+
+        _RUNNER_ROOTED_KEY = context.create_key("agentengine.runner_rooted_trace")
+    return _RUNNER_ROOTED_KEY
+
+
+def trace_state_marks_runner_root(trace_state: Any) -> bool:
+    """True when tracestate says a runner created this trace's root."""
+    if trace_state is None:
+        return False
+    try:
+        marked = RUNNER_ROOT_TRACESTATE_KEY in trace_state
+    except TypeError:
+        return False
+    if not marked:
+        return False
+    return trace_state[RUNNER_ROOT_TRACESTATE_KEY] == RUNNER_ROOT_TRACESTATE_VALUE
+
+
+def merge_runner_root_trace_state(existing: str | None) -> str:
+    """Return tracestate with the runner-root member first, without duplicates."""
+    kept: list[str] = []
+    prefix = f"{RUNNER_ROOT_TRACESTATE_KEY}="
+    for part in (existing or "").split(","):
+        item = part.strip()
+        if not item or item.startswith(prefix):
+            continue
+        kept.append(item)
+    member = f"{RUNNER_ROOT_TRACESTATE_KEY}={RUNNER_ROOT_TRACESTATE_VALUE}"
+    return ",".join([member, *kept])
+
+
+def parent_context_is_runner_rooted(parent_context: Any) -> bool:
+    """True when ``parent_context`` is not an inbound caller trace.
+
+    An invalid extract means this process is about to create the root. A
+    remote parent without the runner-root marker was already bound by a caller.
+    """
+    from opentelemetry import trace
+
+    span_context = trace.get_current_span(parent_context).get_span_context()
+    if span_context is None or not span_context.is_valid:
+        return True
+    if trace_state_marks_runner_root(getattr(span_context, "trace_state", None)):
+        return True
+    if getattr(span_context, "is_remote", False):
+        return False
+    return True
+
+
+def bind_runner_rooted_trace(ctx: Any, rooted: bool) -> Any:
+    """Return ``ctx`` with the runner-rooted flag set for descendant spans."""
+    from opentelemetry import context
+
+    return context.set_value(_runner_rooted_key(), rooted, ctx)
+
+
+def runner_rooted_trace_active() -> bool:
+    """True when the active span's trace was created by a runner, not a caller.
+
+    The flag set at span entry wins. Without it, a remote parent that carries
+    the marker — or any local root — is treated as runner-created so guardrail
+    content stays off unless a caller trace was already bound.
+    """
+    try:
+        from opentelemetry import context, trace
+    except ImportError:
+        return False
+
+    explicit = context.get_value(_runner_rooted_key())
+    if explicit is True:
+        return True
+    if explicit is False:
+        return False
+
+    span = trace.get_current_span()
+    span_context = span.get_span_context()
+    if trace_state_marks_runner_root(getattr(span_context, "trace_state", None)):
+        return True
+    parent = getattr(span, "parent", None)
+    if parent is not None and getattr(parent, "is_valid", False):
+        if trace_state_marks_runner_root(getattr(parent, "trace_state", None)):
+            return True
+        if getattr(parent, "is_remote", False):
+            return False
+        # Parent was created in this process and nobody bound a caller trace.
+        return True
+    if span_context is not None and span_context.is_valid:
+        if getattr(span_context, "is_remote", False):
+            return trace_state_marks_runner_root(getattr(span_context, "trace_state", None))
+        return True
+    return False
+
+
+@contextmanager
+def runner_trace_scope(parent_context: Any) -> Iterator[None]:
+    """Attach the runner-rooted flag for the span about to be started.
+
+    ``start_as_current_span`` copies the ambient context, so the flag has to
+    be attached before the span or nested ``tls_client`` calls will not see it.
+    """
+    try:
+        from opentelemetry import context as otel_context
+    except ImportError:
+        yield
+        return
+    rooted = parent_context_is_runner_rooted(parent_context)
+    token = otel_context.attach(bind_runner_rooted_trace(otel_context.get_current(), rooted))
+    try:
+        yield
+    finally:
+        otel_context.detach(token)

{agent_engine_runner_shared-0.11.8 → agent_engine_runner_shared-0.11.10}/src/agent_engine_runner_shared/connectors/README.md

@@ -42,6 +42,25 @@ auth:
   env: JIRA_TOKEN
 ```
 
+For delegated OAuth, replace that auth block with an explicit provider binding:
+
+```yaml
+auth:
+  type: oauth
+  provider_type: github
+  scopes: [repo]
+```
+
+`provider_type` is the key of a provider configured for the project, independent
+of the resource API's base URL. The scopes apply to every exposed operation in
+this connector. Registration carries this policy outside the model's argument
+schema. The Orchestration Engine resolves a credential for the saved application
+user and passes it to the Tool Pod for that invocation. A missing or invalid token
+stops the HTTP call; OAuth never falls back to a tenant environment secret.
+Existing static auth modes continue to use their configured environment bindings.
+Catalog regeneration preserves the authored OAuth binding and records only
+secret-free Bearer presentation in the catalog.
+
 The pre-materialized index paths are relative to the index and must remain inside its
 directory. AER loads the schemas as ordinary remote tools. Tool Pod startup loads the
 same materialized view and owns one `ConnectorExecutor` per connector.
@@ -52,7 +71,9 @@ same materialized view and owns one `ConnectorExecutor` per connector.
 
 Own one `ConnectorExecutor(definitions)` per connector in a Tool Pod process. Call
 `execute(tool_name, arguments, env=tenant_secrets)` after authorization; the environment
-mapping is request-local and defaults to the tenant-owned process environment. Close
+mapping is request-local and defaults to the tenant-owned process environment for
+static auth. OAuth additionally requires `authorization=ToolAuthorization(...)`;
+the Tool Pod supplies it from request context and the executor never retains it. Close
 the executor at shutdown after in-flight calls finish, or use it as a context manager.
 
 The compiled format is the stable `source`, `auth`, `tools`, `params` and
@@ -86,14 +107,17 @@ Only GET, HEAD and OPTIONS retry 429/503, at most three times; `Retry-After` is
 at 30 seconds. Each invocation carries a 30-second budget between requests, redirects,
 response chunks and retry waits. Every request
 uses its remaining budget for HTTPX's standard connect, read, write and pool timeouts;
-the read timeout bounds each blocking read, as defined by HTTPX.
+the read timeout bounds each blocking read, as defined by HTTPX. Requests carry
+`User-Agent: agent-engine-connector` unless the connector sets its own in
+`auth.headers`, matched case-insensitively.
 
 HTTP failures, including rejected provider redirects, use `httpx.HTTPStatusError`,
 and transport failures use the existing
 timeout/connection exception types recognized by `classify_tool_api_error`. An HTTP
 error may retain a bounded provider error body (at most 4 KB) so the shared classifier
-can surface the provider's own explanation. The retained body is never logged; the
-classifier applies rudimentary hygiene to the extracted explanation — control
-characters dropped, URL-shaped text rejected, exact credential values redacted, result
-bounded. This is best-effort, not a guarantee. Oversized bodies, redirect locations,
+can surface the provider's own explanation: a recognized JSON error field, or a
+plain-text body that is not HTML markup, up to its first link. The retained body is
+never logged; the classifier applies rudimentary hygiene to the extracted explanation
+— control characters dropped, URL-shaped text rejected, exact credential values
+redacted, result bounded. This is best-effort, not a guarantee. Oversized bodies, redirect locations,
 and credential-bearing request objects are never retained.

{agent_engine_runner_shared-0.11.8 → agent_engine_runner_shared-0.11.10}/src/agent_engine_runner_shared/connectors/bundle.py

@@ -95,14 +95,16 @@ class BundledTool:
 
     @property
     def registration_metadata(self) -> dict[str, Any]:
-        """Return the shared AER and Tool Pod registration policy."""
+        """Return detached AER/Tool Pod policy, with delegated binding outside the schema."""
         operation = self.operation
+        auth = self.connector.definitions.auth
+        delegated = auth if auth is not None and auth.type == "oauth" else None
         return {
             "name": operation.name,
             "description": operation.description.strip() or f"REST connector tool {operation.name}",
             "is_local": False,
-            "provider_type": None,
-            "scopes": [],
+            "provider_type": delegated.provider_type if delegated else None,
+            "scopes": list(delegated.scopes) if delegated else [],
             "network": self.network,
             "timeout_seconds": DEFAULT_EXECUTION_TIMEOUT_SECONDS,
             "redact_fields": [],

{agent_engine_runner_shared-0.11.8 → agent_engine_runner_shared-0.11.10}/src/agent_engine_runner_shared/connectors/definitions.py

@@ -162,8 +162,14 @@ class Credential(_Model):
 
 
 class Auth(_Model):
-    type: Literal["none", "bearer", "api_key", "basic", "api_keys"] = Field(
-        default="none", description="Static auth presentation"
+    type: Literal["none", "bearer", "api_key", "basic", "api_keys", "oauth"] = Field(
+        default="none", description="Static auth presentation or request-local delegated OAuth"
+    )
+    provider_type: str | None = Field(
+        default=None, description="Project-scoped Broker provider key"
+    )
+    scopes: list[str] = Field(
+        default_factory=list, description="Connector-wide delegated permissions"
     )
     env: str | None = Field(default=None, description="Tenant secret environment reference")
     header: str | None = Field(default=None, description="API key header name")
@@ -189,12 +195,23 @@ class Auth(_Model):
             "api_key": {"type", "env", "header", "location", "name", "prefix", "headers"},
             "basic": {"type", "username_env", "password_env", "headers"},
             "api_keys": {"type", "credentials", "headers"},
+            "oauth": {"type", "provider_type", "scopes", "headers"},
         }[self.type]
         if configured - allowed:
             raise ValueError(f"{self.type} auth contains fields for another auth type")
 
         credential_headers: set[str] = set()
-        if self.type == "bearer":
+        if self.type == "oauth":
+            if not self.provider_type or any(
+                ord(character) <= 32 or ord(character) >= 127 for character in self.provider_type
+            ):
+                raise ValueError("OAuth auth requires an explicit provider key without whitespace")
+            if len(set(self.scopes)) != len(self.scopes) or any(
+                re.fullmatch(r"[!\x23-\x5B\x5D-\x7E]+", scope) is None for scope in self.scopes
+            ):
+                raise ValueError("OAuth scopes must be unique OAuth scope tokens")
+            credential_headers.add("authorization")
+        elif self.type == "bearer":
             if not _validate_secret_env(self.env):
                 raise ValueError("bearer auth requires one tenant secret env")
             credential_headers.add("authorization")
@@ -235,7 +252,7 @@ class Auth(_Model):
 
     def header_name(self) -> str | None:
         """Return the single generated auth header, when this auth shape has one."""
-        if self.type == "bearer":
+        if self.type in ("bearer", "oauth"):
             return "Authorization"
         if self.type == "api_key":
             if (self.location or "header") == "header":
@@ -244,7 +261,7 @@ class Auth(_Model):
 
     def header_names(self) -> set[str]:
         """List auth-controlled headers so model parameters cannot collide with them."""
-        if self.type in ("bearer", "basic"):
+        if self.type in ("bearer", "basic", "oauth"):
             names = {"authorization"}
         elif self.type == "api_key" and (header_name := self.header_name()):
             names = {header_name.lower()}