deepintshield 2.7.0__tar.gz → 2.7.2__tar.gz

{deepintshield-2.7.0/src/deepintshield.egg-info → deepintshield-2.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepintshield
-Version: 2.7.0
+Version: 2.7.2
 Summary: Unified Python SDK for routing chat, RAG, agentic tool-gating, identity, and MCP traffic through DeepintShield - drop-in across the top agentic frameworks.
 Author: DeepintShield
 License-Expression: Apache-2.0
@@ -98,6 +98,8 @@ Dynamic: license-file
 
 Unified Python SDK for DeepIntShield - one import, any provider, any agent framework.
 
+Current release: **2.7.2**, aligned with DeepIntShield Server **2.7.2**.
+
 `deepintshield` lets you keep writing idiomatic OpenAI / Anthropic / Bedrock /
 Google GenAI code **and** native agent-framework code (LangGraph, CrewAI,
 OpenAI Agents SDK, LlamaIndex, AutoGen, PydanticAI, Temporal, AWS Strands,
@@ -134,6 +136,9 @@ and you're done.
 
 ## Install
 
+For a reproducible installation of this release, use `pip install "deepintshield==2.7.2"`.
+Add the provider and framework extras your application needs:
+
 ```bash
 pip install deepintshield                       # core (chat, RAG, agentic)
 pip install 'deepintshield[openai]'             # + OpenAI SDK
@@ -268,17 +273,40 @@ response = openai.chat.completions.create(
 )
 ```
 
+The same client exposes the native Responses API:
+
+```python
+response = openai.responses.create(
+    model="gpt-4o-mini",
+    input="Explain this design in one sentence.",
+    store=False,
+)
+print(response.output_text)
+```
+
+Responses uses `max_output_tokens` and a `reasoning` object where supported;
+Chat Completions uses its model's supported token-limit field and
+`reasoning_effort`. For manual Responses continuations, retain the full output
+items, including tool calls and opaque reasoning state, and replay them only
+with the same provider and model. The Playground performs this mapping and
+preserves compatible response state in saved sessions.
+
 ### Anthropic
 
 ```python
 anthropic = shield.anthropic()
 response = anthropic.messages.create(
-    model="claude-3-sonnet-20240229",
+    model="claude-sonnet-5",
     max_tokens=256,
     messages=[{"role": "user", "content": "hello"}],
 )
 ```
 
+`shield.anthropic()` uses the installed Anthropic SDK's default transport class,
+including SDK releases backed by `httpx2`, and retains automatic prompt-cache
+hooks. A caller-supplied `http_client` must be compatible with that installed SDK
+and remains responsible for its own prompt-cache hooks.
+
 ### Bedrock
 
 ```python
@@ -294,11 +322,30 @@ response = bedrock.converse(
 ```python
 genai = shield.genai()
 response = genai.models.generate_content(
-    model="gemini-1.5-flash",
+    model="gemini-3.5-flash",
     contents="hello",
+    config={"automatic_function_calling": {"disable": True}},
 )
+print(response.text)
 ```
 
+Disabling automatic function calling (AFC) is optional for this text-only call.
+Recent Google SDK versions warn about direct AFC use even when no callable tools
+are supplied; that warning alone does not mean the request failed. When using
+Python callable tools, Google recommends the chat interface. Multi-turn tool
+workflows also depend on the gateway preserving tool roles and thought signatures;
+a successful text-only request does not verify those conversions.
+
+The gateway's native Gemini conversion preserves model/user tool roles, per-call
+thought signatures, and distinct IDs for parallel calls to the same function.
+SDK regression tests cover direct and chat calls, sync/async streaming, and
+callable-tool continuations. A timeout-only `http_options` override retains the
+gateway destination in SDK 2.7.2 (fixed in 2.7.1); SDK 2.7.0 does not merge that override correctly.
+
+For streaming, use `genai.models.generate_content_stream(...)` or
+`chat.send_message_stream(...)` and read each chunk's `text`. The native async
+interfaces remain available under `genai.aio`.
+
 ### LangChain
 
 ```python
@@ -370,6 +417,12 @@ retriever = shield.rag.guard_retriever(my_retriever)   # mutates in place
 docs = retriever.invoke("what is the Q2 ledger?")        # only allowed chunks
 ```
 
+Async retrievers are supported too: use `await retriever.ainvoke(query)` or
+the retriever's native async retrieval method. Filtering finishes before
+documents are returned; delegated retrieval methods filter once per call.
+Allowed documents keep their order and original framework objects. Redacted
+content is returned in copies, leaving the retriever's source documents intact.
+
 ### Guard an embedder (pre-embedding, Portkey-parity "before request")
 
 Screen input text for PII / injection / toxicity **before** it is vectorised:
@@ -808,15 +861,21 @@ OpenAI/Anthropic/LangChain conversion-loop helpers remain deprecated 2.x
 compatibility shims. Their removal is planned for SDK 3.0; new code should use
 the official session or a maintained third-party adapter.
 
+For an existing Anthropic conversion loop, use the same `shield.mcp` instance
+for `to_anthropic(tools)` and `run_anthropic_tool_uses(response.content)`.
+Provider-safe aliases distinguish qualified names that contain unsupported
+characters or exceed Anthropic's length limit; that client retains the mapping
+back to the original tool names for execution.
+
 ---
 
 ## Cost Optimization
 
-The SDK automatically participates in the gateway's two cost-reduction layers
+The SDK participates in the gateway's caching mechanisms
 (both controlled by workspace switches under **Cost Optimization**):
 
-- **Provider prompt caching** - every chat client returned by `shield.openai()`,
-  `shield.anthropic()`, etc. ships an `httpx` request hook that injects
+- **Provider prompt caching** - SDK-created OpenAI and Anthropic transports
+  include request hooks that inject
   Anthropic `cache_control` markers and an OpenAI `prompt_cache_key` so the
   provider reuses KV state for the static prompt prefix. Eligible cached tokens
   use the provider's current cached-input rate; verify model-specific pricing
@@ -830,6 +889,11 @@ The SDK automatically participates in the gateway's two cost-reduction layers
   threshold. The SDK doesn't need any code change to benefit; results flow
   back through the normal API.
 
+Cost dashboards show recorded numeric totals, using `$0.00` when no display
+value is available. Missing prices remain nullable in API log records and can
+still be found through the missing-cost filter. Estimated savings remain signed
+and are separate from the actual recorded cost.
+
 ### Per-request cache overrides
 
 Workspace settings are the default, but any individual call can override

{deepintshield-2.7.0 → deepintshield-2.7.2}/README.md

@@ -5,6 +5,8 @@
 
 Unified Python SDK for DeepIntShield - one import, any provider, any agent framework.
 
+Current release: **2.7.2**, aligned with DeepIntShield Server **2.7.2**.
+
 `deepintshield` lets you keep writing idiomatic OpenAI / Anthropic / Bedrock /
 Google GenAI code **and** native agent-framework code (LangGraph, CrewAI,
 OpenAI Agents SDK, LlamaIndex, AutoGen, PydanticAI, Temporal, AWS Strands,
@@ -41,6 +43,9 @@ and you're done.
 
 ## Install
 
+For a reproducible installation of this release, use `pip install "deepintshield==2.7.2"`.
+Add the provider and framework extras your application needs:
+
 ```bash
 pip install deepintshield                       # core (chat, RAG, agentic)
 pip install 'deepintshield[openai]'             # + OpenAI SDK
@@ -175,17 +180,40 @@ response = openai.chat.completions.create(
 )
 ```
 
+The same client exposes the native Responses API:
+
+```python
+response = openai.responses.create(
+    model="gpt-4o-mini",
+    input="Explain this design in one sentence.",
+    store=False,
+)
+print(response.output_text)
+```
+
+Responses uses `max_output_tokens` and a `reasoning` object where supported;
+Chat Completions uses its model's supported token-limit field and
+`reasoning_effort`. For manual Responses continuations, retain the full output
+items, including tool calls and opaque reasoning state, and replay them only
+with the same provider and model. The Playground performs this mapping and
+preserves compatible response state in saved sessions.
+
 ### Anthropic
 
 ```python
 anthropic = shield.anthropic()
 response = anthropic.messages.create(
-    model="claude-3-sonnet-20240229",
+    model="claude-sonnet-5",
     max_tokens=256,
     messages=[{"role": "user", "content": "hello"}],
 )
 ```
 
+`shield.anthropic()` uses the installed Anthropic SDK's default transport class,
+including SDK releases backed by `httpx2`, and retains automatic prompt-cache
+hooks. A caller-supplied `http_client` must be compatible with that installed SDK
+and remains responsible for its own prompt-cache hooks.
+
 ### Bedrock
 
 ```python
@@ -201,11 +229,30 @@ response = bedrock.converse(
 ```python
 genai = shield.genai()
 response = genai.models.generate_content(
-    model="gemini-1.5-flash",
+    model="gemini-3.5-flash",
     contents="hello",
+    config={"automatic_function_calling": {"disable": True}},
 )
+print(response.text)
 ```
 
+Disabling automatic function calling (AFC) is optional for this text-only call.
+Recent Google SDK versions warn about direct AFC use even when no callable tools
+are supplied; that warning alone does not mean the request failed. When using
+Python callable tools, Google recommends the chat interface. Multi-turn tool
+workflows also depend on the gateway preserving tool roles and thought signatures;
+a successful text-only request does not verify those conversions.
+
+The gateway's native Gemini conversion preserves model/user tool roles, per-call
+thought signatures, and distinct IDs for parallel calls to the same function.
+SDK regression tests cover direct and chat calls, sync/async streaming, and
+callable-tool continuations. A timeout-only `http_options` override retains the
+gateway destination in SDK 2.7.2 (fixed in 2.7.1); SDK 2.7.0 does not merge that override correctly.
+
+For streaming, use `genai.models.generate_content_stream(...)` or
+`chat.send_message_stream(...)` and read each chunk's `text`. The native async
+interfaces remain available under `genai.aio`.
+
 ### LangChain
 
 ```python
@@ -277,6 +324,12 @@ retriever = shield.rag.guard_retriever(my_retriever)   # mutates in place
 docs = retriever.invoke("what is the Q2 ledger?")        # only allowed chunks
 ```
 
+Async retrievers are supported too: use `await retriever.ainvoke(query)` or
+the retriever's native async retrieval method. Filtering finishes before
+documents are returned; delegated retrieval methods filter once per call.
+Allowed documents keep their order and original framework objects. Redacted
+content is returned in copies, leaving the retriever's source documents intact.
+
 ### Guard an embedder (pre-embedding, Portkey-parity "before request")
 
 Screen input text for PII / injection / toxicity **before** it is vectorised:
@@ -715,15 +768,21 @@ OpenAI/Anthropic/LangChain conversion-loop helpers remain deprecated 2.x
 compatibility shims. Their removal is planned for SDK 3.0; new code should use
 the official session or a maintained third-party adapter.
 
+For an existing Anthropic conversion loop, use the same `shield.mcp` instance
+for `to_anthropic(tools)` and `run_anthropic_tool_uses(response.content)`.
+Provider-safe aliases distinguish qualified names that contain unsupported
+characters or exceed Anthropic's length limit; that client retains the mapping
+back to the original tool names for execution.
+
 ---
 
 ## Cost Optimization
 
-The SDK automatically participates in the gateway's two cost-reduction layers
+The SDK participates in the gateway's caching mechanisms
 (both controlled by workspace switches under **Cost Optimization**):
 
-- **Provider prompt caching** - every chat client returned by `shield.openai()`,
-  `shield.anthropic()`, etc. ships an `httpx` request hook that injects
+- **Provider prompt caching** - SDK-created OpenAI and Anthropic transports
+  include request hooks that inject
   Anthropic `cache_control` markers and an OpenAI `prompt_cache_key` so the
   provider reuses KV state for the static prompt prefix. Eligible cached tokens
   use the provider's current cached-input rate; verify model-specific pricing
@@ -737,6 +796,11 @@ The SDK automatically participates in the gateway's two cost-reduction layers
   threshold. The SDK doesn't need any code change to benefit; results flow
   back through the normal API.
 
+Cost dashboards show recorded numeric totals, using `$0.00` when no display
+value is available. Missing prices remain nullable in API log records and can
+still be found through the missing-cost filter. Estimated savings remain signed
+and are separate from the actual recorded cost.
+
 ### Per-request cache overrides
 
 Workspace settings are the default, but any individual call can override

{deepintshield-2.7.0 → deepintshield-2.7.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "deepintshield"
-version = "2.7.0"
+version = "2.7.2"
 description = "Unified Python SDK for routing chat, RAG, agentic tool-gating, identity, and MCP traffic through DeepintShield - drop-in across the top agentic frameworks."
 readme = "README.md"
 requires-python = ">=3.10"

{deepintshield-2.7.0 → deepintshield-2.7.2}/src/deepintshield/_prompt_cache.py

@@ -25,6 +25,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+from functools import lru_cache
 from typing import Any, Callable, Iterable
 
 import httpx
@@ -33,6 +34,20 @@ import httpx
 PROVIDER_ANTHROPIC = "anthropic"
 PROVIDER_OPENAI = "openai"
 
+
+@lru_cache(maxsize=8)
+def _request_byte_stream_type(request_type: type) -> type:
+    """Keep rewritten request streams in the HTTP library that owns the request."""
+    for cls in request_type.__mro__:
+        package = cls.__module__.partition(".")[0]
+        if package == "httpx2":
+            # Optional: only imported for a request from an installed httpx2 SDK.
+            from httpx2 import ByteStream
+            return ByteStream
+        if package == "httpx":
+            return httpx.ByteStream
+    return httpx.ByteStream
+
 # Anthropic accepts up to 4 cache_control markers per request. We place them in
 # priority order: system → tools → last static user/assistant block.
 _DEFAULT_BREAKPOINTS: tuple[str, ...] = ("system", "tools")
@@ -209,13 +224,7 @@ def build_request_hook(
         # the announced byte count). Reattach the stream so the new body
         # is what actually gets sent.
         request._content = encoded  # type: ignore[attr-defined]
-        try:
-            from httpx._content import ByteStream  # type: ignore
-        except ImportError:  # httpx <0.24 fallback - module path drifted.
-            from httpx import _content  # type: ignore
-            ByteStream = getattr(_content, "ByteStream", None)
-        if ByteStream is not None:
-            request.stream = ByteStream(encoded)  # type: ignore[attr-defined]
+        request.stream = _request_byte_stream_type(type(request))(encoded)
 
     return hook
 

{deepintshield-2.7.0 → deepintshield-2.7.2}/src/deepintshield/agentic/enforcement.py

@@ -267,6 +267,17 @@ def install_all(*, client: Any = None) -> list[str]:
             with _install_lock:
                 if mod_name in _installed:
                     continue
+                # Nested imports return before the enclosing framework has
+                # defined its execution classes. Inspecting it at that point
+                # causes circular imports and falsely reports an unsupported
+                # version. The enclosing import's post-hook retries once all
+                # framework modules have finished initializing.
+                if any(
+                    (name == mod_name or name.startswith(mod_name + "."))
+                    and getattr(getattr(module, "__spec__", None), "_initializing", False)
+                    for name, module in tuple(sys.modules.items())
+                ):
+                    continue
                 # Keep check → patch → mark atomic. Two clients initialized in
                 # parallel must not wrap the same framework method twice and
                 # therefore run two PDP decisions for one tool invocation.

{deepintshield-2.7.0 → deepintshield-2.7.2}/src/deepintshield/agentic/registry.py

@@ -3358,6 +3358,23 @@ def ensure_registration_capture(
         if time.monotonic() < _capture_retry_at(engine, tool_key):
             return False
         selector = str(getattr(engine, "_agent_subject_selector", "") or "")
+        if not selector:
+            # No explicit agent_name was given. The gateway's own
+            # credential-info carries the subject this virtual key is bound to,
+            # and ``AgenticEngine.agent_subject`` documents that value as
+            # authoritative - it is already what /decide is told the principal
+            # is. Registering under it keeps one identity across the decision
+            # and the registry instead of refusing a VK that the server can
+            # name perfectly well.
+            #
+            # This is NOT the invented shared name warned about below: it is
+            # server-issued and VK-bound, so it cannot collide across keys.
+            try:
+                selector = str(getattr(engine, "agent_subject", "") or "").strip()
+            except Exception:
+                # Credential discovery is allowed to fail here; the selector
+                # check below then reports the missing name as before.
+                selector = ""
         agent_key = _key(selector.removeprefix("agent:"))
         if not selector.startswith("agent:") or not agent_key:
             # Proof-less registration is deliberately limited to an explicit

{deepintshield-2.7.0 → deepintshield-2.7.2}/src/deepintshield/mcp/adapters/anthropic.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import re
+import hashlib
 from typing import TYPE_CHECKING, Any, Iterable, Mapping
 
 from ..tool import Tool
@@ -15,11 +16,23 @@ if TYPE_CHECKING:
 _ANTHROPIC_NAME_RE = re.compile(r"[^a-zA-Z0-9_-]")
 
 
-def to_anthropic(tools: Iterable[Tool]) -> list[dict[str, Any]]:
+def to_anthropic(
+    tools: Iterable[Tool], *, name_map: dict[str, str] | None = None,
+) -> list[dict[str, Any]]:
     """Convert ``Tool`` objects to Anthropic's Messages API tools array."""
     out: list[dict[str, Any]] = []
+    aliases = dict(name_map or {})
     for tool in tools:
-        sanitized = _ANTHROPIC_NAME_RE.sub("_", tool.qualified_name)[:64]
+        qualified = tool.qualified_name
+        sanitized = _ANTHROPIC_NAME_RE.sub("_", qualified)
+        if sanitized != qualified or len(sanitized) > 64:
+            # Truncation/replacement alone can send two different tools to
+            # the same server name. Keep a stable, provider-valid alias.
+            digest = hashlib.sha256(qualified.encode("utf-8")).hexdigest()[:16]
+            sanitized = f"{sanitized[:47]}_{digest}"
+        if sanitized in aliases and aliases[sanitized] != qualified:
+            raise ValueError("Anthropic MCP tool aliases collide")
+        aliases[sanitized] = qualified
         out.append(
             {
                 "name": sanitized,
@@ -27,6 +40,8 @@ def to_anthropic(tools: Iterable[Tool]) -> list[dict[str, Any]]:
                 "input_schema": tool.schema or {"type": "object", "properties": {}},
             }
         )
+    if name_map is not None:
+        name_map.update(aliases)
     return out
 
 
@@ -35,6 +50,7 @@ def run_tool_uses(
     content: Iterable[Any],
     *,
     extra_headers: Mapping[str, str] | None = None,
+    name_map: Mapping[str, str] | None = None,
 ) -> list[dict[str, Any]]:
     """Execute every ``tool_use`` block in an assistant content array.
 
@@ -50,7 +66,7 @@ def run_tool_uses(
             continue
         try:
             result = client.call_qualified(
-                name,
+                (name_map or {}).get(name, name),
                 args or {},
                 call_id=tool_use_id,
                 extra_headers=extra_headers,

{deepintshield-2.7.0 → deepintshield-2.7.2}/src/deepintshield/mcp/client.py

@@ -41,6 +41,7 @@ class MCPClient:
 
     def __init__(self, shield: "DeepintShield") -> None:
         self._shield = shield
+        self._anthropic_tool_names: dict[str, str] = {}
 
     # ───────────────────── preferred native MCP boundary ───────────────────
 
@@ -193,7 +194,7 @@ class MCPClient:
             "POST",
             "/v1/mcp/tool/execute",
             json_body=payload,
-            extra_headers=extra_headers,
+            extra_headers=self._agent_identity_headers(extra_headers),
             error_code=ErrorCode.MCP_EXECUTION_FAILED,
             require_object=True,
         )
@@ -258,6 +259,36 @@ class MCPClient:
             )
         return self.call(server=server, tool=tool, arguments=args_dict, **kwargs)
 
+    # ───────────────────────── agent identity headers ────────────────────────
+
+    def _agent_identity_headers(
+        self, extra_headers: Mapping[str, str] | None
+    ) -> dict[str, str]:
+        """Attach the client's agent selector to a gateway MCP call.
+
+        A DeepintShield client represents one agent identity. The PDP decide
+        path already sends ``X-Agent-Subject``; the brokered MCP path used to
+        send nothing, so a virtual key bound to more than one active agent was
+        refused with ``mcp_tool_authorization_unavailable`` on execute while
+        its decide calls succeeded. The selector is derived locally (no
+        discovery round-trip). Workload tokens stay request-scoped: pass
+        ``X-Agent-Token`` through ``extra_headers`` as before. Explicit caller
+        headers always win; nothing is added for a client without an
+        ``agent_name``.
+        """
+        headers = dict(extra_headers or {})
+        agent_name = str(getattr(self._shield, "agent_name", "") or "").strip()
+        if not agent_name:
+            return headers
+        if any(str(key).lower() == "x-agent-subject" for key in headers):
+            return headers
+        from ..agentic.registry import _registry_key
+
+        agent_key = _registry_key(agent_name)
+        if agent_key:
+            headers["X-Agent-Subject"] = f"agent:{agent_key}"
+        return headers
+
     # ─────────────────────────── discovery (optional) ────────────────────────
 
     def list_tools(
@@ -274,7 +305,7 @@ class MCPClient:
         unavailable in your environment, supply tool definitions manually.
         """
         self._warn_legacy("list_tools")
-        headers: dict[str, str] = {}
+        headers: dict[str, str] = self._agent_identity_headers(None)
         if admin_token:
             headers["Authorization"] = f"Bearer {admin_token}"
         payload = self._shield.request(
@@ -338,7 +369,7 @@ class MCPClient:
         """Convert tools to Anthropic Messages API ``tools=`` array shape."""
         self._warn_legacy("to_anthropic")
         from .adapters import anthropic as _anthropic
-        return _anthropic.to_anthropic(tools)
+        return _anthropic.to_anthropic(tools, name_map=self._anthropic_tool_names)
 
     def run_anthropic_tool_uses(
         self,
@@ -356,6 +387,7 @@ class MCPClient:
             self,
             content,
             extra_headers=extra_headers,
+            name_map=self._anthropic_tool_names,
         )
 
     def to_langchain(self, tools: Iterable[Tool]) -> list[Any]:

{deepintshield-2.7.0 → deepintshield-2.7.2}/src/deepintshield/providers/anthropic.py

@@ -2,8 +2,9 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING, Any
 
-from .._prompt_cache import PROVIDER_ANTHROPIC, build_http_client
+from .._prompt_cache import PROVIDER_ANTHROPIC, build_request_hook
 from ..errors import ErrorCode, _dependency_error
+from ..transport import connection_headers, _install_agent_selector_header_hook
 
 if TYPE_CHECKING:
     from ..client import DeepintShield
@@ -19,8 +20,8 @@ def build_client(shield: "DeepintShield", *, passthrough: bool = False, **kwargs
     Provider Prompt Caching switch - disabled workspaces have the markers
     stripped at the gateway before they reach Anthropic.
 
-    Pass a custom ``http_client`` to bypass injection entirely; the SDK trusts
-    the caller's transport in that case.
+    Pass a custom ``http_client`` to manage caching yourself; only
+    case-insensitive agent selector override handling is added to that client.
     """
     try:
         import anthropic
@@ -33,13 +34,28 @@ def build_client(shield: "DeepintShield", *, passthrough: bool = False, **kwargs
 
     base_url = shield.anthropic_passthrough_base_url() if passthrough else shield.anthropic_base_url()
     http_client = kwargs.pop("http_client", None)
+    owns_http_client = http_client is None
     if http_client is None:
-        http_client = build_http_client(PROVIDER_ANTHROPIC, timeout=shield.timeout)
-
-    return anthropic.Anthropic(
-        base_url=kwargs.pop("base_url", base_url),
-        api_key=kwargs.pop("api_key", shield.api_key()),
-        default_headers={**shield.headers(), **(kwargs.pop("default_headers", None) or {})},
-        http_client=http_client,
-        **kwargs,
-    )
+        # Use the installed SDK's public transport class: older releases use
+        # httpx, while current releases require httpx2 and reject httpx.Client.
+        http_client = anthropic.DefaultHttpxClient(
+            timeout=shield.timeout,
+            follow_redirects=False,
+            event_hooks={"request": [build_request_hook(PROVIDER_ANTHROPIC)]},
+        )
+
+    try:
+        client = anthropic.Anthropic(
+            base_url=kwargs.pop("base_url", base_url),
+            api_key=kwargs.pop("api_key", shield.api_key()),
+            default_headers=connection_headers(shield, extra=kwargs.pop("default_headers", None)),
+            http_client=http_client,
+            **kwargs,
+        )
+    except Exception:
+        if owns_http_client:
+            http_client.close()
+        raise
+    # Let the SDK validate caller-supplied transports before mutating hooks.
+    _install_agent_selector_header_hook(http_client)
+    return client

{deepintshield-2.7.0 → deepintshield-2.7.2}/src/deepintshield/providers/genai.py

@@ -4,6 +4,12 @@ from typing import TYPE_CHECKING, Any
 
 from .._gemini_cache import GenaiCachedClient, GeminiCacheManager, env_ttl_seconds
 from ..errors import ErrorCode, _dependency_error
+from ..transport import (
+    connection_headers,
+    _install_agent_selector_header_hook,
+    _normalize_agent_selector_headers,
+    _normalize_agent_selector_headers_async,
+)
 
 if TYPE_CHECKING:
     from ..client import DeepintShield
@@ -22,9 +28,34 @@ def build_client(shield: "DeepintShield", *, passthrough: bool = False, **kwargs
         ) from exc
 
     base_url = shield.genai_passthrough_base_url() if passthrough else shield.genai_base_url()
+    supplied_options = kwargs.pop("http_options", None)
+    if isinstance(supplied_options, HttpOptions):
+        options = supplied_options.model_copy()
+    else:
+        options = HttpOptions(**(supplied_options or {}))
+    options.base_url = options.base_url or base_url
+    options.headers = connection_headers(shield, extra=options.headers)
+    # Preserve caller options, transports, and hooks. Native sync/async clients
+    # use the same stateless selector normalization, including stream requests.
+    for client_attr, args_attr, hook in (
+        ("httpx_client", "client_args", _normalize_agent_selector_headers),
+        ("httpx_async_client", "async_client_args", _normalize_agent_selector_headers_async),
+    ):
+        native_http_client = getattr(options, client_attr, None)
+        if native_http_client is not None:
+            _install_agent_selector_header_hook(native_http_client)
+        else:
+            client_args = dict(getattr(options, args_attr, None) or {})
+            event_hooks = dict(client_args.get("event_hooks") or {})
+            request_hooks = list(event_hooks.get("request") or [])
+            if hook not in request_hooks:
+                request_hooks.append(hook)
+            event_hooks["request"] = request_hooks
+            client_args["event_hooks"] = event_hooks
+            setattr(options, args_attr, client_args)
     return genai.Client(
         api_key=kwargs.pop("api_key", shield.api_key()),
-        http_options=kwargs.pop("http_options", HttpOptions(base_url=base_url, headers=shield.headers())),
+        http_options=options,
         **kwargs,
     )
 

{deepintshield-2.7.0 → deepintshield-2.7.2}/src/deepintshield/providers/openai.py

@@ -4,6 +4,7 @@ from typing import TYPE_CHECKING, Any
 
 from .._prompt_cache import PROVIDER_OPENAI, build_http_client
 from ..errors import ErrorCode, _dependency_error
+from ..transport import connection_headers, _install_agent_selector_header_hook
 
 if TYPE_CHECKING:
     from ..client import DeepintShield
@@ -19,8 +20,8 @@ def build_client(shield: "DeepintShield", *, passthrough: bool = False, **kwargs
     on the gateway - if the workspace has it disabled the gateway strips the
     key before forwarding.
 
-    Callers passing their own ``http_client`` are respected (no hook is
-    attached); they're assumed to manage caching themselves.
+    Callers passing their own ``http_client`` manage caching themselves; only
+    case-insensitive agent selector override handling is added to that client.
     """
     try:
         from openai import OpenAI
@@ -35,11 +36,12 @@ def build_client(shield: "DeepintShield", *, passthrough: bool = False, **kwargs
     http_client = kwargs.pop("http_client", None)
     if http_client is None:
         http_client = build_http_client(PROVIDER_OPENAI, timeout=shield.timeout)
+    _install_agent_selector_header_hook(http_client)
 
     return OpenAI(
         base_url=kwargs.pop("base_url", base_url),
         api_key=kwargs.pop("api_key", shield.api_key()),
-        default_headers={**shield.headers(), **(kwargs.pop("default_headers", None) or {})},
+        default_headers=connection_headers(shield, extra=kwargs.pop("default_headers", None)),
         http_client=http_client,
         **kwargs,
     )