gumloop 0.4.0__tar.gz → 0.4.2__tar.gz

{gumloop-0.4.0 → gumloop-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gumloop
-Version: 0.4.0
+Version: 0.4.2
 Summary: Python client for the Gumloop API
 Project-URL: Homepage, https://github.com/gumloop/gumloop-py
 Project-URL: Bug Tracker, https://github.com/gumloop/gumloop-py/issues
@@ -57,6 +57,26 @@ output = client.run_flow(
 print(output)
 ```
 
+## Authenticate with a team API key
+
+Team (workspace) API keys are scoped to a single team. Pass the team's ID and
+the acting member's user ID — every request is validated against that team and
+only reaches resources the team owns.
+
+```python
+from gumloop import Gumloop
+
+client = Gumloop(
+    api_key="your_team_api_key",
+    user_id="your_user_id",  # must be a member of the team
+    team_id="your_team_id",
+)
+
+agents = client.agents.list()  # scoped to the team
+```
+
+`team_id` can also be provided via the `GUMLOOP_TEAM_ID` environment variable.
+
 ## Chat with an agent (streaming)
 
 ```python

{gumloop-0.4.0 → gumloop-0.4.2}/README.md

@@ -32,6 +32,26 @@ output = client.run_flow(
 print(output)
 ```
 
+## Authenticate with a team API key
+
+Team (workspace) API keys are scoped to a single team. Pass the team's ID and
+the acting member's user ID — every request is validated against that team and
+only reaches resources the team owns.
+
+```python
+from gumloop import Gumloop
+
+client = Gumloop(
+    api_key="your_team_api_key",
+    user_id="your_user_id",  # must be a member of the team
+    team_id="your_team_id",
+)
+
+agents = client.agents.list()  # scoped to the team
+```
+
+`team_id` can also be provided via the `GUMLOOP_TEAM_ID` environment variable.
+
 ## Chat with an agent (streaming)
 
 ```python

{gumloop-0.4.0 → gumloop-0.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "gumloop"
-version = "0.4.0"
+version = "0.4.2"
 description = "Python client for the Gumloop API"
 readme = "README.md"
 requires-python = ">=3.10"

{gumloop-0.4.0 → gumloop-0.4.2}/src/gumloop/_client.py

@@ -32,7 +32,7 @@ from gumloop.resources import Sync
 from gumloop.resources import Teams
 
 DEFAULT_BASE_URL = "https://api.gumloop.com/api/v1"
-DEFAULT_TIMEOUT = 30.0
+DEFAULT_TIMEOUT = 90.0
 DEFAULT_STREAM_TIMEOUT = 3600.0
 
 
@@ -55,6 +55,7 @@ class Gumloop:
         *,
         access_token: str | None = None,
         user_id: str | None = None,
+        team_id: str | None = None,
         base_url: str | None = None,
         stream_base_url: str | None = None,
         timeout: float = DEFAULT_TIMEOUT,
@@ -66,6 +67,8 @@ class Gumloop:
         # x-auth-key header to look up the owner's stored secret. OAuth
         # callers omit it because the bearer token already identifies them.
         self.user_id = user_id or os.environ.get("GUMLOOP_USER_ID")
+        # Team API keys are validated against ``team_id``; ``user_id`` stays the acting member.
+        self.team_id = team_id or os.environ.get("GUMLOOP_TEAM_ID")
         # Defaults to production; GUMLOOP_BASE_URL is an optional override.
         self.base_url = (base_url or os.environ.get("GUMLOOP_BASE_URL") or DEFAULT_BASE_URL).rstrip("/")
         self.stream_base_url = (stream_base_url or _derive_stream_base_url(self.base_url)).rstrip("/")
@@ -77,6 +80,7 @@ class Gumloop:
             stream_base_url=self.stream_base_url,
             access_token=self.access_token,
             user_id=self.user_id,
+            team_id=self.team_id,
             timeout=self.timeout,
             stream_timeout=self.stream_timeout,
         )
@@ -112,6 +116,7 @@ class AsyncGumloop:
         *,
         access_token: str | None = None,
         user_id: str | None = None,
+        team_id: str | None = None,
         base_url: str | None = None,
         stream_base_url: str | None = None,
         timeout: float = DEFAULT_TIMEOUT,
@@ -120,6 +125,8 @@ class AsyncGumloop:
         self.api_key = api_key
         self.access_token = access_token or api_key or EnvToken.from_env()
         self.user_id = user_id or os.environ.get("GUMLOOP_USER_ID")
+        # Team API keys are validated against ``team_id``; ``user_id`` stays the acting member.
+        self.team_id = team_id or os.environ.get("GUMLOOP_TEAM_ID")
         # Defaults to production; GUMLOOP_BASE_URL is an optional override.
         self.base_url = (base_url or os.environ.get("GUMLOOP_BASE_URL") or DEFAULT_BASE_URL).rstrip("/")
         self.stream_base_url = (stream_base_url or _derive_stream_base_url(self.base_url)).rstrip("/")
@@ -131,6 +138,7 @@ class AsyncGumloop:
             stream_base_url=self.stream_base_url,
             access_token=self.access_token,
             user_id=self.user_id,
+            team_id=self.team_id,
             timeout=self.timeout,
             stream_timeout=self.stream_timeout,
         )

{gumloop-0.4.0 → gumloop-0.4.2}/src/gumloop/_http.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import logging
+import os
 from collections.abc import AsyncIterator
 from collections.abc import Iterator
 from collections.abc import Mapping
@@ -19,6 +20,29 @@ from gumloop.types import StreamEvent
 
 logger = logging.getLogger(__name__)
 
+
+def _inject_trace_context(request: httpx.Request) -> None:
+    """Request event hook: attach W3C trace context when the host sets TRACEPARENT.
+
+    Read per request: sandbox runtimes rotate env between calls. setdefault so
+    an explicitly provided header wins.
+    """
+    traceparent = os.environ.get("TRACEPARENT")
+    if not traceparent:
+        return
+    request.headers.setdefault("traceparent", traceparent)
+    tracestate = os.environ.get("TRACESTATE")
+    if tracestate:
+        request.headers.setdefault("tracestate", tracestate)
+
+
+async def _inject_trace_context_async(request: httpx.Request) -> None:
+    _inject_trace_context(request)
+
+
+_TRACE_EVENT_HOOKS = {"request": [_inject_trace_context]}
+_ASYNC_TRACE_EVENT_HOOKS = {"request": [_inject_trace_context_async]}
+
 _DONE_SENTINEL = "[DONE]"
 _T = TypeVar("_T", bound=BaseModel)
 
@@ -64,14 +88,24 @@ class HttpClient:
         stream_base_url: str,
         access_token: str | None,
         user_id: str | None,
+        team_id: str | None = None,
         timeout: float,
         stream_timeout: float | None,
     ) -> None:
         self.access_token = access_token
         self.user_id = user_id
+        self.team_id = team_id
         self._stream_base_url = stream_base_url.rstrip("/")
         self._stream_timeout = stream_timeout
-        self._client = httpx.Client(base_url=base_url.rstrip("/"), timeout=timeout)
+        self._client = httpx.Client(base_url=base_url.rstrip("/"), timeout=timeout, event_hooks=_TRACE_EVENT_HOOKS)
+
+    def _scoped_params(self, params: dict[str, Any] | None) -> dict[str, Any] | None:
+        # Team keys are validated against ``team_id``, so it rides on every request.
+        if not self.team_id:
+            return params
+        merged = dict(params or {})
+        merged.setdefault("team_id", self.team_id)
+        return merged
 
     def close(self) -> None:
         self._client.close()
@@ -234,6 +268,7 @@ class HttpClient:
             headers["Content-Type"] = "application/json"
         if extra_headers:
             headers.update(extra_headers)
+        kwargs["params"] = self._scoped_params(kwargs.get("params"))
         response = self._client.request(method, path, headers=headers, **kwargs)
         if response.status_code >= 400:
             raise to_api_error(response)
@@ -250,14 +285,26 @@ class AsyncHttpClient:
         stream_base_url: str,
         access_token: str | None,
         user_id: str | None,
+        team_id: str | None = None,
         timeout: float,
         stream_timeout: float | None,
     ) -> None:
         self.access_token = access_token
         self.user_id = user_id
+        self.team_id = team_id
         self._stream_base_url = stream_base_url.rstrip("/")
         self._stream_timeout = stream_timeout
-        self._client = httpx.AsyncClient(base_url=base_url.rstrip("/"), timeout=timeout)
+        self._client = httpx.AsyncClient(
+            base_url=base_url.rstrip("/"), timeout=timeout, event_hooks=_ASYNC_TRACE_EVENT_HOOKS
+        )
+
+    def _scoped_params(self, params: dict[str, Any] | None) -> dict[str, Any] | None:
+        # Team keys are validated against ``team_id``, so it rides on every request.
+        if not self.team_id:
+            return params
+        merged = dict(params or {})
+        merged.setdefault("team_id", self.team_id)
+        return merged
 
     async def aclose(self) -> None:
         await self._client.aclose()
@@ -371,6 +418,7 @@ class AsyncHttpClient:
         headers = auth_headers(self.access_token, self.user_id)
         if not kwargs.get("files"):
             headers["Content-Type"] = "application/json"
+        kwargs["params"] = self._scoped_params(kwargs.get("params"))
         response = await self._client.request(method, path, headers=headers, **kwargs)
         if response.status_code >= 400:
             raise to_api_error(response)

{gumloop-0.4.0 → gumloop-0.4.2}/src/gumloop/_version.py

@@ -1,3 +1,3 @@
 from __future__ import annotations
 
-__version__ = "0.4.0"
+__version__ = "0.4.2"

{gumloop-0.4.0 → gumloop-0.4.2}/src/gumloop/resources/agents.py

@@ -46,9 +46,11 @@ class Agents:
         request: AgentCreateRequest | Mapping[str, Any] | None = None,
         **kwargs: Any,
     ) -> AgentResponse:
-        return AgentResponse.model_validate(
-            self._client.post("agents", json=AgentCreateRequest.build(request, **kwargs))
-        )
+        body = AgentCreateRequest.build(request, **kwargs)
+        # The create workspace is read from the body, not the query.
+        if self._client.team_id is not None:
+            body.setdefault("team_id", self._client.team_id)
+        return AgentResponse.model_validate(self._client.post("agents", json=body))
 
     def retrieve(self, agent_id: str) -> AgentResponse:
         return AgentResponse.model_validate(self._client.get(f"agents/{agent_id}"))
@@ -169,7 +171,11 @@ class AsyncAgents:
         request: AgentCreateRequest | Mapping[str, Any] | None = None,
         **kwargs: Any,
     ) -> AgentResponse:
-        data = await self._client.post("agents", json=AgentCreateRequest.build(request, **kwargs))
+        body = AgentCreateRequest.build(request, **kwargs)
+        # The create workspace is read from the body, not the query.
+        if self._client.team_id is not None:
+            body.setdefault("team_id", self._client.team_id)
+        data = await self._client.post("agents", json=body)
         return AgentResponse.model_validate(data)
 
     async def retrieve(self, agent_id: str) -> AgentResponse:

{gumloop-0.4.0 → gumloop-0.4.2}/src/gumloop/resources/mcp.py

@@ -79,6 +79,8 @@ class MCP:
         *,
         team_id: str | None = None,
     ) -> McpPromptResponse:
+        # team_id is read from the body here; the query-level default doesn't reach it.
+        team_id = team_id if team_id is not None else self._client.team_id
         body: dict[str, Any] = {"name": name, "arguments": arguments or {}}
         if team_id is not None:
             body["team_id"] = team_id
@@ -93,6 +95,7 @@ class MCP:
         ref: str | None = None,
         team_id: str | None = None,
     ) -> McpExecuteResponse:
+        team_id = team_id if team_id is not None else self._client.team_id
         call = McpToolCallRequest(
             server_id=server_id,
             tool_name=tool_name,
@@ -107,6 +110,7 @@ class MCP:
         *,
         team_id: str | None = None,
     ) -> McpExecuteResponse:
+        team_id = team_id if team_id is not None else self._client.team_id
         return McpExecuteResponse.model_validate(self._client.post("mcp/tools/call", json=_call_body(calls, team_id)))
 
 
@@ -156,6 +160,8 @@ class AsyncMCP:
         *,
         team_id: str | None = None,
     ) -> McpPromptResponse:
+        # team_id is read from the body here; the query-level default doesn't reach it.
+        team_id = team_id if team_id is not None else self._client.team_id
         body: dict[str, Any] = {"name": name, "arguments": arguments or {}}
         if team_id is not None:
             body["team_id"] = team_id
@@ -171,6 +177,7 @@ class AsyncMCP:
         ref: str | None = None,
         team_id: str | None = None,
     ) -> McpExecuteResponse:
+        team_id = team_id if team_id is not None else self._client.team_id
         call = McpToolCallRequest(
             server_id=server_id,
             tool_name=tool_name,
@@ -186,5 +193,6 @@ class AsyncMCP:
         *,
         team_id: str | None = None,
     ) -> McpExecuteResponse:
+        team_id = team_id if team_id is not None else self._client.team_id
         data = await self._client.post("mcp/tools/call", json=_call_body(calls, team_id))
         return McpExecuteResponse.model_validate(data)

{gumloop-0.4.0 → gumloop-0.4.2}/src/gumloop/resources/skills.py

@@ -70,6 +70,8 @@ class Skills:
         team_id: str | None = None,
         **kwargs: Any,
     ) -> SkillResponse:
+        # The create workspace is read from the form body, not the query.
+        team_id = team_id if team_id is not None else self._client.team_id
         return SkillResponse.model_validate(
             self._client.post(
                 "skills",
@@ -134,6 +136,8 @@ class AsyncSkills:
         team_id: str | None = None,
         **kwargs: Any,
     ) -> SkillResponse:
+        # The create workspace is read from the form body, not the query.
+        team_id = team_id if team_id is not None else self._client.team_id
         data = await self._client.post(
             "skills",
             data={"team_id": team_id, **kwargs},

{gumloop-0.4.0 → gumloop-0.4.2}/tests/sdk/test_client.py

@@ -13,6 +13,7 @@ from gumloop.errors import APIStatusError
 from gumloop.errors import AuthenticationError
 from tests.sdk.helpers import API_BASE
 from tests.sdk.helpers import auth_header
+from tests.sdk.helpers import request_json
 
 
 @respx.mock
@@ -202,3 +203,123 @@ def test_async_user_id_sets_x_auth_key_header() -> None:
     asyncio.run(run())
 
     assert route.calls[0].request.headers["x-auth-key"] == "user_123"
+
+
+_AGENT_JSON = {"agent": {"id": "agent_1", "name": "Agent"}}
+
+
+@respx.mock
+def test_team_id_is_sent_as_query_param_on_every_request() -> None:
+    # Team keys are validated against ``team_id`` — it must be on every request.
+    route = respx.get(f"{API_BASE}/agents/agent_1").mock(return_value=httpx.Response(200, json=_AGENT_JSON))
+
+    Gumloop(api_key="team_key", user_id="user_123", team_id="team_1").agents.retrieve("agent_1")
+
+    assert route.calls[0].request.url.params["team_id"] == "team_1"
+
+
+@respx.mock
+def test_explicit_team_id_wins_over_client_team_id() -> None:
+    route = respx.get(f"{API_BASE}/agents").mock(return_value=httpx.Response(200, json={"agents": []}))
+
+    Gumloop(api_key="team_key", user_id="user_123", team_id="team_1").agents.list(team_id="team_2")
+
+    assert route.calls[0].request.url.params["team_id"] == "team_2"
+
+
+@respx.mock
+def test_no_team_id_omits_query_param() -> None:
+    route = respx.get(f"{API_BASE}/models").mock(return_value=httpx.Response(200, json={"model_groups": []}))
+
+    Gumloop(api_key="gum_xxx", user_id="user_123").models.list()
+
+    assert "team_id" not in route.calls[0].request.url.params
+
+
+@respx.mock
+def test_env_team_id_is_used_when_not_passed_explicitly(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("GUMLOOP_TEAM_ID", "env_team")
+    route = respx.get(f"{API_BASE}/models").mock(return_value=httpx.Response(200, json={"model_groups": []}))
+
+    Gumloop(api_key="team_key", user_id="user_123").models.list()
+
+    assert route.calls[0].request.url.params["team_id"] == "env_team"
+
+
+@respx.mock
+def test_team_id_defaults_into_mcp_execute_body() -> None:
+    # /mcp/tools/call reads team_id from the body — a query-only default would
+    # authenticate as the team but silently execute with personal credentials.
+    route = respx.post(f"{API_BASE}/mcp/tools/call").mock(return_value=httpx.Response(200, json={"results": []}))
+
+    Gumloop(api_key="team_key", user_id="user_123", team_id="team_1").mcp.execute("server_1", "tool_1")
+
+    assert request_json(route.calls[0].request)["team_id"] == "team_1"
+
+
+@respx.mock
+def test_team_id_defaults_into_agent_create_body() -> None:
+    route = respx.post(f"{API_BASE}/agents").mock(return_value=httpx.Response(201, json=_AGENT_JSON))
+
+    client = Gumloop(api_key="team_key", user_id="user_123", team_id="team_1")
+    client.agents.create(name="Agent", model_name="model")
+    client.agents.create(name="Agent", model_name="model", team_id="team_2")
+
+    assert request_json(route.calls[0].request)["team_id"] == "team_1"
+    assert request_json(route.calls[1].request)["team_id"] == "team_2"
+
+
+@respx.mock
+def test_async_team_id_is_sent_as_query_param() -> None:
+    route = respx.get(f"{API_BASE}/agents/agent_1").mock(return_value=httpx.Response(200, json=_AGENT_JSON))
+
+    async def run() -> None:
+        async with AsyncGumloop(api_key="team_key", user_id="user_123", team_id="team_1") as client:
+            await client.agents.retrieve("agent_1")
+
+    asyncio.run(run())
+
+    assert route.calls[0].request.url.params["team_id"] == "team_1"
+
+
+@respx.mock
+def test_traceparent_env_is_forwarded_as_header(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("GUMLOOP_ACCESS_TOKEN", "env-token")
+    monkeypatch.setenv("TRACEPARENT", "00-11111111111111111111111111111111-2222222222222222-01")
+    monkeypatch.setenv("TRACESTATE", "gumloop=1")
+    route = respx.get(f"{API_BASE}/models").mock(return_value=httpx.Response(200, json={"model_groups": []}))
+
+    Gumloop().models.list()
+
+    request = route.calls[0].request
+    assert request.headers["traceparent"] == "00-11111111111111111111111111111111-2222222222222222-01"
+    assert request.headers["tracestate"] == "gumloop=1"
+
+
+@respx.mock
+def test_no_trace_headers_without_traceparent_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("GUMLOOP_ACCESS_TOKEN", "env-token")
+    monkeypatch.delenv("TRACEPARENT", raising=False)
+    route = respx.get(f"{API_BASE}/models").mock(return_value=httpx.Response(200, json={"model_groups": []}))
+
+    Gumloop().models.list()
+
+    request = route.calls[0].request
+    assert "traceparent" not in request.headers
+    assert "tracestate" not in request.headers
+
+
+@respx.mock
+def test_traceparent_env_is_forwarded_on_async_client(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("GUMLOOP_ACCESS_TOKEN", "env-token")
+    monkeypatch.setenv("TRACEPARENT", "00-11111111111111111111111111111111-2222222222222222-01")
+    route = respx.get(f"{API_BASE}/models").mock(return_value=httpx.Response(200, json={"model_groups": []}))
+
+    async def run() -> None:
+        async with AsyncGumloop() as client:
+            await client.models.list()
+
+    asyncio.run(run())
+
+    request = route.calls[0].request
+    assert request.headers["traceparent"] == "00-11111111111111111111111111111111-2222222222222222-01"

{gumloop-0.4.0 → gumloop-0.4.2}/uv.lock

@@ -355,7 +355,7 @@ wheels = [
 
 [[package]]
 name = "gumloop"
-version = "0.4.0"
+version = "0.4.2"
 source = { editable = "." }
 dependencies = [
     { name = "click" },