dispatch_agents 0.11.0__tar.gz → 0.12.2__tar.gz

{dispatch_agents-0.11.0 → dispatch_agents-0.12.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dispatch_agents
-Version: 0.11.0
+Version: 0.12.2
 Summary: Dispatch Agents SDK
 License-File: LICENSE
 License-File: LICENSE-3rdparty.csv

dispatch_agents-0.12.2/RELEASE_NOTES.md

@@ -0,0 +1 @@
+BREAKING CHANGE: Compatibility changes to remove LiteLLM from backend.

{dispatch_agents-0.11.0 → dispatch_agents-0.12.2}/dispatch_agents/config.py

@@ -5,6 +5,7 @@ shared between CLI and backend.
 """
 
 import os
+import re
 from enum import StrEnum
 from typing import Any
 
@@ -25,6 +26,13 @@ RESERVED_ENV_VARS: frozenset[str] = frozenset(
     }
 )
 
+# Domain validation pattern for egress allow list.
+# Accepts exact FQDNs (api.openai.com) and wildcard prefixes (*.github.com).
+# Rejects URLs with schemes/ports/paths, IP addresses, and bare wildcards.
+_DOMAIN_PATTERN = re.compile(
+    r"^(\*\.)?([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$"
+)
+
 
 class VolumeMode(StrEnum):
     """Volume access mode for persistent storage.
@@ -322,6 +330,98 @@ class ResourceConfig(BaseModel):
     )
 
 
+class DomainSelector(BaseModel):
+    """A single domain selector -- exactly one of match_name or match_pattern.
+
+    match_name is an exact FQDN (e.g. api.openai.com).
+    match_pattern is a wildcard prefix (e.g. *.github.com).
+
+    Serialises with camelCase aliases (matchName / matchPattern) to match the
+    downstream Cilium FQDN selector API.
+    """
+
+    match_name: str | None = Field(
+        default=None,
+        description="Exact FQDN to allow. Must match the entire domain name exactly "
+        "(e.g. 'api.openai.com' matches only 'api.openai.com').",
+    )
+    match_pattern: str | None = Field(
+        default=None,
+        description="Wildcard pattern to allow. Uses '*.domain.com' syntax to match "
+        "any subdomain of the specified domain (e.g. '*.github.com' matches "
+        "'api.github.com' and 'raw.github.com' but not 'github.com' itself).",
+    )
+
+    @model_validator(mode="after")
+    def _validate_exactly_one_field(self) -> "DomainSelector":
+        if self.match_name and self.match_pattern:
+            raise ValueError(
+                "Exactly one of match_name or match_pattern must be set, not both"
+            )
+        if not self.match_name and not self.match_pattern:
+            raise ValueError("Exactly one of match_name or match_pattern must be set")
+        domain = self.match_name or self.match_pattern or ""
+        if not _DOMAIN_PATTERN.match(domain):
+            raise ValueError(
+                f"Invalid domain '{domain}'. "
+                "Must be an exact FQDN (e.g., api.openai.com) "
+                "or wildcard prefix (e.g., *.github.com). "
+                "URL schemes, ports, paths, IP addresses, "
+                "and bare wildcards are not allowed."
+            )
+        return self
+
+    model_config = {"extra": "forbid"}
+
+
+class EgressConfig(BaseModel):
+    """Configuration for network egress allow list.
+
+    Domains are specified as objects with either matchName (exact FQDN)
+    or matchPattern (wildcard prefix). This is a subset of the
+    downstream Cilium FQDN selector API.
+
+    Example:
+        network:
+          egress:
+            allow_domains:
+              - match_name: api.openai.com
+              - match_pattern: "*.github.com"
+    """
+
+    allow_domains: list[DomainSelector] = Field(
+        default_factory=list,
+        description="Domains allowed for egress as Cilium FQDN selectors.",
+    )
+
+    @field_validator("allow_domains")
+    @classmethod
+    def _validate_allow_domains(cls, v: list[DomainSelector]) -> list[DomainSelector]:
+        if len(v) > 50:
+            raise ValueError(
+                f"allow_domains cannot have more than 50 entries, got {len(v)}"
+            )
+        return v
+
+
+class NetworkConfig(BaseModel):
+    """Network configuration for an agent.
+
+    When present in dispatch.yaml, CiliumNetworkPolicies are created to
+    restrict the agent's outbound traffic to platform services and any
+    listed allow_domains.  When absent, all egress is unrestricted.
+
+    Example:
+        network:
+          egress:
+            allow_domains:
+              - match_name: api.openai.com
+              - match_pattern: "*.github.com"
+    """
+
+    egress: EgressConfig = Field(default_factory=EgressConfig)
+
+
 class DispatchConfig(BaseModel):
     """Configuration model for dispatch.yaml files.
 
@@ -416,6 +516,10 @@ class DispatchConfig(BaseModel):
         default_factory=ResourceConfig,
         description="Container resource limits (CPU and memory)",
     )
+    network: NetworkConfig | None = Field(
+        default=None,
+        description="Network egress restrictions. When set, CiliumNetworkPolicies restrict outbound traffic.",
+    )
 
     @field_validator("env")
     @classmethod
@@ -485,6 +589,16 @@ class DispatchConfig(BaseModel):
         }
         result["resources"] = {"limits": limits_dict}
 
+        if self.network is not None:
+            result["network"] = {
+                "egress": {
+                    "allow_domains": [
+                        d.model_dump(exclude_none=True)
+                        for d in self.network.egress.allow_domains
+                    ],
+                }
+            }
+
         return result
 
     model_config = {"populate_by_name": True}

{dispatch_agents-0.11.0 → dispatch_agents-0.12.2}/dispatch_agents/integrations/github/client.py

@@ -38,6 +38,7 @@ async def get_github_app_token() -> GitHubAppToken:
         RuntimeError: If DISPATCH_API_KEY environment variable is not set.
         RuntimeError: If no GitHub installation is configured for this org (404).
         RuntimeError: If authentication fails — check DISPATCH_API_KEY (401).
+        RuntimeError: If access is forbidden (403).
         RuntimeError: If the backend returns an unexpected HTTP status code.
 
     Note:
@@ -76,7 +77,7 @@ async def get_github_app_token() -> GitHubAppToken:
     if not os.getenv("DISPATCH_API_KEY"):
         raise RuntimeError(
             "DISPATCH_API_KEY environment variable is not set. "
-            "GitHub installation token requires authentication with the Dispatch backend."
+            "GitHub installation token requires an authenticated Dispatch agent."
         )
 
     if _cached_token is not None:
@@ -96,6 +97,8 @@ async def get_github_app_token() -> GitHubAppToken:
             "GitHub installation token request failed: unauthorized. "
             "Check that DISPATCH_API_KEY is valid."
         )
+    if response.status_code == 403:
+        raise RuntimeError("GitHub installation token request failed: forbidden.")
     if response.status_code == 404:
         raise RuntimeError(
             "No GitHub installation found for this organization. "

{dispatch_agents-0.11.0 → dispatch_agents-0.12.2}/dispatch_agents/llm.py

@@ -470,7 +470,17 @@ class LLMClient:
                 headers=auth_headers,
                 timeout=600.0,  # 10min — matches ALB idle timeout for long-context LLM calls
             )
-            response.raise_for_status()
+            if response.status_code >= 400:
+                try:
+                    error_body = response.json()
+                    detail = error_body.get("detail", response.text)
+                except Exception:
+                    detail = response.text
+                raise httpx.HTTPStatusError(
+                    f"LLM inference failed ({response.status_code}): {detail}",
+                    request=response.request,
+                    response=response,
+                )
             data = response.json()
 
         # Parse tool calls if present

{dispatch_agents-0.11.0 → dispatch_agents-0.12.2}/dispatch_agents/proxy/server.py

@@ -764,7 +764,7 @@ async def _call_provider_directly_streaming(
 ) -> Response:
     """Call the LLM provider directly with streaming (fallback when backend has no config).
 
-    Uses raw httpx streaming (not litellm) since litellm is not available in the SDK.
+    Uses raw httpx streaming.
     Buffers SSE events for usage extraction and logs to /llm/log after stream completes.
     """
 
@@ -947,10 +947,10 @@ async def _proxy_passthrough(request: Request, provider_format: str) -> Response
         )
 
     # Build passthrough request for backend.
-    # provider_format is no longer sent; the backend derives it from path.
     backend_payload: dict[str, Any] = {
         "path": path,
         "method": method,
+        "provider_format": provider_format,
     }
     if body_dict is not None:
         backend_payload["body"] = body_dict

{dispatch_agents-0.11.0 → dispatch_agents-0.12.2}/examples/hello_world/agent.py

@@ -2,6 +2,7 @@
 
 import asyncio
 
+import aiohttp
 import dispatch_agents
 from dispatch_agents import BasePayload, fn, on
 from dispatch_agents.integrations.github import PullRequestReviewCommentCreated
@@ -11,7 +12,7 @@ from pydantic import Field, PositiveInt
 class GreetingPayload(BasePayload):
     """Input payload for greeting requests."""
 
-    subject: str = Field(description="The name or subject to greet")
+    subject: str = Field(default="World", description="The name or subject to greet")
 
 
 class GreetingResponse(BasePayload):
@@ -110,3 +111,51 @@ async def reverse(payload: ReverseRequest) -> ReverseResponse:
     """Reverse the provided text string."""
     print(f"Reversing: {payload.text!r}")
     return ReverseResponse(reversed_text=payload.text[::-1])
+
+
+class EgressTestRequest(BasePayload):
+    """Input for the egress test function."""
+
+    url: str = Field(
+        default="https://jsonplaceholder.typicode.com/todos/1",
+        description="URL to attempt to fetch",
+    )
+
+
+class EgressTestResponse(BasePayload):
+    """Output of the egress test function."""
+
+    success: bool = Field(description="Whether the request succeeded")
+    status_code: int | None = Field(
+        default=None, description="HTTP status code if successful"
+    )
+    body: str = Field(default="", description="Response body or error message")
+
+
+@fn()
+async def test_egress(payload: EgressTestRequest) -> EgressTestResponse:
+    """Test outbound HTTP connectivity by fetching a URL.
+
+    Useful for verifying network egress controls. When network.egress is
+    configured, this request will be blocked unless the target domain is
+    in allow_domains.
+    """
+    print(f"Testing egress to: {payload.url}")
+    try:
+        async with aiohttp.ClientSession(
+            timeout=aiohttp.ClientTimeout(total=10)
+        ) as session:
+            async with session.get(payload.url) as resp:
+                body = await resp.text()
+                print(f"Response: {resp.status} ({len(body)} bytes)")
+                return EgressTestResponse(
+                    success=True,
+                    status_code=resp.status,
+                    body=body[:1000],
+                )
+    except Exception as e:
+        print(f"Request failed: {type(e).__name__}: {e}")
+        return EgressTestResponse(
+            success=False,
+            body=f"{type(e).__name__}: {e}",
+        )

{dispatch_agents-0.11.0 → dispatch_agents-0.12.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "dispatch_agents"
-version = "0.11.0"
+version = "0.12.2"
 description = "Dispatch Agents SDK"
 requires-python = ">=3.11"
 dependencies = [

{dispatch_agents-0.11.0 → dispatch_agents-0.12.2}/tests/test_config.py

@@ -4,7 +4,10 @@ import pytest
 
 from dispatch_agents.config import (
     DispatchConfig,
+    DomainSelector,
+    EgressConfig,
     MCPServerConfig,
+    NetworkConfig,
     ResourceConfig,
     ResourceLimits,
     SecretConfig,
@@ -510,3 +513,207 @@ class TestVolumeMode:
     def test_string_comparison(self):
         """Should compare as string."""
         assert VolumeMode.READ_WRITE_MANY == "read_write_many"
+
+
+class TestDomainSelector:
+    """Tests for DomainSelector model."""
+
+    def test_valid_match_name(self):
+        """Should accept exact FQDN via matchName."""
+        ds = DomainSelector(match_name="api.openai.com")
+        assert ds.match_name == "api.openai.com"
+        assert ds.match_pattern is None
+
+    def test_valid_match_pattern(self):
+        """Should accept wildcard via matchPattern."""
+        ds = DomainSelector(match_pattern="*.github.com")
+        assert ds.match_pattern == "*.github.com"
+        assert ds.match_name is None
+
+    def test_rejects_both_fields(self):
+        """Should reject when both matchName and matchPattern are set."""
+        with pytest.raises(ValueError, match="not both"):
+            DomainSelector(match_name="api.openai.com", match_pattern="*.github.com")
+
+    def test_rejects_neither_field(self):
+        """Should reject when neither field is set."""
+        with pytest.raises(ValueError, match="must be set"):
+            DomainSelector()
+
+    def test_rejects_invalid_match_name(self):
+        """Should reject invalid domain in matchName."""
+        with pytest.raises(ValueError, match="Invalid domain"):
+            DomainSelector(match_name="https://api.openai.com")
+
+    def test_rejects_invalid_match_pattern(self):
+        """Should reject invalid pattern in matchPattern."""
+        with pytest.raises(ValueError, match="Invalid domain"):
+            DomainSelector(match_pattern="*")
+
+    def test_model_dump_excludes_none(self):
+        """Should produce clean dict when dumped with exclude_none."""
+        ds = DomainSelector(match_name="api.openai.com")
+        assert ds.model_dump(exclude_none=True) == {"match_name": "api.openai.com"}
+
+
+class TestEgressConfig:
+    """Tests for EgressConfig model and validators."""
+
+    def test_empty_allow_domains(self):
+        """Should accept empty allow_domains list."""
+        config = EgressConfig()
+        assert config.allow_domains == []
+
+    def test_valid_exact_domain(self):
+        """Should accept exact FQDNs via matchName."""
+        config = EgressConfig(
+            allow_domains=[DomainSelector(match_name="api.openai.com")]
+        )
+        assert config.allow_domains[0].match_name == "api.openai.com"
+
+    def test_valid_wildcard_domain(self):
+        """Should accept wildcard prefixes via matchPattern."""
+        config = EgressConfig(
+            allow_domains=[DomainSelector(match_pattern="*.github.com")]
+        )
+        assert config.allow_domains[0].match_pattern == "*.github.com"
+
+    def test_valid_multiple_domains(self):
+        """Should accept multiple valid domains."""
+        domains = [
+            DomainSelector(match_name="api.openai.com"),
+            DomainSelector(match_pattern="*.github.com"),
+            DomainSelector(match_name="httpbin.org"),
+        ]
+        config = EgressConfig(allow_domains=domains)
+        assert len(config.allow_domains) == 3
+
+    def test_rejects_url_with_scheme(self):
+        """Should reject domains with URL schemes."""
+        with pytest.raises(ValueError, match="Invalid domain"):
+            EgressConfig(
+                allow_domains=[DomainSelector(match_name="https://api.openai.com")]
+            )
+
+    def test_rejects_domain_with_port(self):
+        """Should reject domains with ports."""
+        with pytest.raises(ValueError, match="Invalid domain"):
+            EgressConfig(
+                allow_domains=[DomainSelector(match_name="api.openai.com:443")]
+            )
+
+    def test_rejects_domain_with_path(self):
+        """Should reject domains with paths."""
+        with pytest.raises(ValueError, match="Invalid domain"):
+            EgressConfig(allow_domains=[DomainSelector(match_name="api.openai.com/v1")])
+
+    def test_rejects_ip_address(self):
+        """Should reject IP addresses."""
+        with pytest.raises(ValueError, match="Invalid domain"):
+            EgressConfig(allow_domains=[DomainSelector(match_name="192.168.1.1")])
+
+    def test_rejects_bare_wildcard(self):
+        """Should reject bare wildcard."""
+        with pytest.raises(ValueError, match="Invalid domain"):
+            EgressConfig(allow_domains=[DomainSelector(match_pattern="*")])
+
+    def test_rejects_wildcard_tld(self):
+        """Should reject wildcard on TLD only."""
+        with pytest.raises(ValueError, match="Invalid domain"):
+            EgressConfig(allow_domains=[DomainSelector(match_pattern="*.com")])
+
+    def test_rejects_too_many_domains(self):
+        """Should reject more than 50 entries."""
+        domains = [
+            DomainSelector(match_name=f"domain{i}.example.com") for i in range(51)
+        ]
+        with pytest.raises(ValueError, match="cannot have more than 50"):
+            EgressConfig(allow_domains=domains)
+
+    def test_accepts_50_domains(self):
+        """Should accept exactly 50 entries."""
+        domains = [
+            DomainSelector(match_name=f"domain{i}.example.com") for i in range(50)
+        ]
+        config = EgressConfig(allow_domains=domains)
+        assert len(config.allow_domains) == 50
+
+    def test_rejects_bare_tld(self):
+        """Should reject bare TLD."""
+        with pytest.raises(ValueError, match="Invalid domain"):
+            EgressConfig(allow_domains=[DomainSelector(match_name="com")])
+
+
+class TestNetworkConfig:
+    """Tests for NetworkConfig model."""
+
+    def test_default_egress(self):
+        """Should default to empty allow_domains."""
+        config = NetworkConfig()
+        assert config.egress.allow_domains == []
+
+    def test_custom_egress(self):
+        """Should accept custom egress config."""
+        config = NetworkConfig(
+            egress=EgressConfig(
+                allow_domains=[DomainSelector(match_name="api.openai.com")]
+            )
+        )
+        assert config.egress.allow_domains[0].match_name == "api.openai.com"
+
+
+class TestDispatchConfigNetwork:
+    """Tests for network field on DispatchConfig."""
+
+    def test_network_none_by_default(self):
+        """Should default to None (no restrictions)."""
+        config = DispatchConfig()
+        assert config.network is None
+
+    def test_network_with_egress(self):
+        """Should accept network config with egress."""
+        config = DispatchConfig(
+            network=NetworkConfig(
+                egress=EgressConfig(
+                    allow_domains=[DomainSelector(match_name="api.openai.com")]
+                )
+            )
+        )
+        assert config.network is not None
+        assert config.network.egress.allow_domains[0].match_name == "api.openai.com"
+
+    def test_to_yaml_dict_includes_network(self):
+        """Should include network in YAML serialization when set."""
+        config = DispatchConfig(
+            network=NetworkConfig(
+                egress=EgressConfig(
+                    allow_domains=[
+                        DomainSelector(match_name="api.openai.com"),
+                        DomainSelector(match_pattern="*.github.com"),
+                    ]
+                )
+            )
+        )
+        result = config.to_yaml_dict()
+        assert "network" in result
+        assert result["network"] == {
+            "egress": {
+                "allow_domains": [
+                    {"match_name": "api.openai.com"},
+                    {"match_pattern": "*.github.com"},
+                ],
+            }
+        }
+
+    def test_to_yaml_dict_includes_network_empty_domains(self):
+        """Should include network even with empty allow_domains (triggers policy creation)."""
+        config = DispatchConfig(network=NetworkConfig())
+        result = config.to_yaml_dict()
+        assert "network" in result
+        assert result["network"] == {"egress": {"allow_domains": []}}
+
+    def test_to_yaml_dict_excludes_network_when_none(self):
+        """Should not include network when None."""
+        config = DispatchConfig()
+        result = config.to_yaml_dict()
+        assert "network" not in result

{dispatch_agents-0.11.0 → dispatch_agents-0.12.2}/tests/test_github_client.py

@@ -213,6 +213,7 @@ async def test_normalizes_naive_expiry_timestamp(monkeypatch):
     ("status_code", "expected_message"),
     [
         (401, "DISPATCH_API_KEY"),
+        (403, "request failed: forbidden"),
         (404, "No GitHub installation found"),
         (500, "backend returned HTTP 500"),
     ],

{dispatch_agents-0.11.0 → dispatch_agents-0.12.2}/tests/test_proxy_server.py

@@ -1054,6 +1054,10 @@ class TestPassthroughRoute:
         resp = client.get("/openai/v1/models")
         assert resp.status_code == 200
 
+        # Verify provider_format is sent in the payload
+        payload = mock_client.post.call_args.kwargs["json"]
+        assert payload["provider_format"] == "openai"
+
     @patch("dispatch_agents.proxy.server.httpx.AsyncClient")
     def test_anthropic_passthrough_get(self, mock_client_cls, client):
         """GET /anthropic/v1/models goes through passthrough."""
@@ -1071,6 +1075,10 @@ class TestPassthroughRoute:
         resp = client.get("/anthropic/v1/models")
         assert resp.status_code == 200
 
+        # Verify provider_format is sent in the payload
+        payload = mock_client.post.call_args.kwargs["json"]
+        assert payload["provider_format"] == "anthropic"
+
 
 # ── Auth Error Detection ─────────────────────────────────────────────
 

{dispatch_agents-0.11.0 → dispatch_agents-0.12.2}/uv.lock

@@ -3,15 +3,15 @@ revision = 3
 requires-python = ">=3.11"
 
 [options]
-exclude-newer = "2026-02-28T15:12:16.136865Z"
+exclude-newer = "2026-03-03T20:09:23.684706Z"
 exclude-newer-span = "P30D"
 
 [options.exclude-newer-package]
-dispatch-agents = { timestamp = "2026-03-30T15:12:16.136874Z", span = "PT0S" }
-claude-agent-sdk = { timestamp = "2026-03-16T15:12:16.136882Z", span = "P14D" }
-openai = { timestamp = "2026-03-16T15:12:16.136883Z", span = "P14D" }
-langchain-openai = { timestamp = "2026-03-16T15:12:16.136885Z", span = "P14D" }
-openai-agents = { timestamp = "2026-03-16T15:12:16.136884Z", span = "P14D" }
+dispatch-agents = { timestamp = "2026-04-02T20:09:23.684712Z", span = "PT0S" }
+claude-agent-sdk = { timestamp = "2026-03-19T20:09:23.684719Z", span = "P14D" }
+openai = { timestamp = "2026-03-19T20:09:23.684719Z", span = "P14D" }
+langchain-openai = { timestamp = "2026-03-19T20:09:23.68472Z", span = "P14D" }
+openai-agents = { timestamp = "2026-03-19T20:09:23.684719Z", span = "P14D" }
 
 [[package]]
 name = "aiohappyeyeballs"
@@ -551,7 +551,7 @@ wheels = [
 
 [[package]]
 name = "dispatch-agents"
-version = "0.11.0"
+version = "0.12.2"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },

dispatch_agents-0.11.0/RELEASE_NOTES.md

@@ -1,2 +0,0 @@
-## Features
-- Added `get_github_app_token()` to the SDK's GitHub integration module, enabling GitHub App-based authentication for agents that interact with GitHub APIs.