managed-deepagents 0.6.2.dev20__py3-none-win_amd64.whl → 0.6.2.dev22__py3-none-win_amd64.whl

managed_deepagents/__init__.py

@@ -9,18 +9,17 @@ This package provides two things:
 
 Resources use ``define_*`` factories while provider collections use namespaces:
 ``define_sandbox()``, ``channels.slack(...)``, ``connectors.mcp(...)``,
-``credentials.get(...)``, and ``auth.supabase(...)``. Contributing a *new*
+``connections.get(...)``, and ``auth.supabase(...)``. Contributing a *new*
 primitive is not part of the public surface.
 """
 
 from __future__ import annotations
 
-from managed_deepagents._credentials import (
+from managed_deepagents._connections import (
+    ConnectionNotFoundError,
     CredentialAuthorizationRequiredError,
-    CredentialNotFoundError,
-    CredentialOwner,
     CredentialStoreError,
-    credentials,
+    connections,
 )
 from managed_deepagents._managed_tools import (
     ManagedDeepAgentRuntime,
@@ -38,9 +37,8 @@ from managed_deepagents.sandbox import SandboxDefinition
 from managed_deepagents.schedules import define_schedule
 
 __all__ = [
+    "ConnectionNotFoundError",
     "CredentialAuthorizationRequiredError",
-    "CredentialNotFoundError",
-    "CredentialOwner",
     "CredentialStoreError",
     "DeepAgentDefinition",
     "ManagedDeepAgentRuntime",
@@ -49,8 +47,8 @@ __all__ = [
     "SandboxDefinition",
     "auth",
     "channels",
+    "connections",
     "connectors",
-    "credentials",
     "define_deep_agent",
     "define_identity",
     "define_memory",

managed_deepagents/_agent_auth.py

@@ -1,4 +1,4 @@
-"""Agent Auth client used by ``credentials.get`` and the pre-run credential gate.
+"""Agent Auth client used by ``connections.get`` and the pre-run credential gate.
 
 Talks to the shipped Agent Auth APIs (credentials + oauth-authorization-sessions),
 not the aspirational ``credentials/mint`` endpoint.
@@ -33,6 +33,7 @@ __all__ = [
     "AgentAuthUnknownProviderError",
     "CredentialAuthorizationRequiredError",
     "PendingAuthorization",
+    "WorkspaceConnection",
 ]
 
 
@@ -48,17 +49,24 @@ class AgentAuthContext:
 
 
 class PendingAuthorization(TypedDict):
-    """One credential slug the caller has not granted, with its connect URL."""
+    """One connection slug the caller has not granted, with its connect URL."""
 
     slug: str
     connect_url: str
     auth_id: str
 
 
+@dataclass(frozen=True)
+class WorkspaceConnection:
+    connection_id: str
+    kind: str
+    owner_policy: str
+
+
 class CredentialAuthorizationRequiredError(RuntimeError):
     def __init__(self, slugs: list[str]) -> None:
         super().__init__(
-            f"the caller has not connected: {', '.join(slugs)}. Declare the credential "
+            f"the caller has not connected: {', '.join(slugs)}. Declare the connection "
             "on a connector so the pre-run gate can request it."
         )
         self.slugs = slugs
@@ -106,6 +114,80 @@ class AgentAuth:
         self._timeout = timeout
         self._request: AgentAuthRequest = request if request is not None else self._urlopen_json
 
+    def find_workspace_connection(self, slug: str) -> WorkspaceConnection | None:
+        """List workspace connections and return the row for ``slug``, if any."""
+        if not (self.context.workspace_id or "").strip():
+            raise CredentialStoreError(
+                "connections are not configured: LANGSMITH_WORKSPACE_ID is not set"
+            )
+        cursor: str | None = None
+        for _ in range(AGENT_AUTH_MAX_PROVIDER_PAGES):
+            query: dict[str, str] = {
+                "page_size": str(AGENT_AUTH_PROVIDER_PAGE_SIZE),
+            }
+            if cursor:
+                query["cursor"] = cursor
+            status, body = self._request(
+                "GET",
+                f"/v1/agent-auth/connections?{urllib.parse.urlencode(query)}",
+            )
+            if status >= _HTTP_BAD_REQUEST:
+                raise CredentialStoreError("Agent Auth list connections failed", status)
+            raw_items = body.get("items")
+            items = raw_items if isinstance(raw_items, list) else []
+            for item in items:
+                if not isinstance(item, Mapping) or item.get("slug") != slug:
+                    continue
+                connection_id = (
+                    item.get("id") or item.get("connection_id") or item.get("credential_id")
+                )
+                kind = item.get("kind")
+                owner_policy = item.get("owner_policy")
+                if not isinstance(connection_id, str) or not connection_id:
+                    raise CredentialStoreError("Agent Auth connection row missing id or kind")
+                if not isinstance(kind, str) or not kind:
+                    raise CredentialStoreError("Agent Auth connection row missing id or kind")
+                return WorkspaceConnection(
+                    connection_id=connection_id,
+                    kind=kind,
+                    owner_policy=str(owner_policy) if isinstance(owner_policy, str) else "",
+                )
+            next_cursor = body.get("next_cursor")
+            if not isinstance(next_cursor, str) or not next_cursor or next_cursor == cursor:
+                return None
+            cursor = next_cursor
+        raise CredentialStoreError("Agent Auth connection list returned too many pages")
+
+    def find_workspace_credential_id(self, slug: str) -> str | None:
+        """Workspace credential id for an agent-owned opaque secret grant."""
+        workspace_id = (self.context.workspace_id or "").strip()
+        if not workspace_id:
+            raise CredentialStoreError(
+                "connections are not configured: LANGSMITH_WORKSPACE_ID is not set"
+            )
+        return self.find_credential_id(
+            owner_type="workspace",
+            owner_id=workspace_id,
+            kind="secret",
+            slug=slug,
+        )
+
+    def read_user_secret(self, slug: str) -> str | None:
+        """Read a caller-owned opaque secret grant for a workspace connection slug."""
+        credential_id = self.find_credential_id(
+            owner_type="user",
+            owner_id=self.context.principal_id,
+            kind="secret",
+            slug=slug,
+        )
+        if credential_id is None:
+            return None
+        return self.read_secret(credential_id)
+
+    def read_connection_access_token(self, connection_id: str) -> str | None:
+        """Read an OAuth access token stored on a workspace connection row."""
+        return self._fetch_access_token(connection_id)
+
     def read_user_access_token(self, slug: str) -> str | None:
         """Read the caller's OAuth access token without starting a session.
 
@@ -128,12 +210,16 @@ class AgentAuth:
 
     def start_authorization_session(self, slug: str) -> PendingAuthorization:
         """Start an OAuth session for a slug the caller has not granted."""
-        provider_id = self.resolve_oauth_provider_id(slug)
+        connection = self.find_workspace_connection(slug)
+        if connection is None:
+            raise CredentialStoreError(f"workspace connection {slug!r} is not configured")
+        if connection.kind != "oauth2":
+            raise CredentialStoreError(f"connection {slug!r} is not an OAuth connection")
         status, body = self._request(
             "POST",
             "/v1/agent-auth/oauth-authorization-sessions",
             body={
-                "provider_id": provider_id,
+                "connection_id": connection.connection_id,
                 "principal_id": self.context.principal_id,
                 "agent_id": self.context.agent_id,
             },
@@ -182,18 +268,35 @@ class AgentAuth:
     ) -> str | None:
         """Find a credential id by slug.
 
-        The credential key is ``credential_id``, never ``id``.
+        The shipped credentials list filters by owner and kind only, so the
+        slug match is made client-side across pages. The credential key is
+        ``credential_id``, never ``id``.
         """
-        query = agent_auth_credential_query(
-            owner_type=owner_type, owner_id=owner_id, kind=kind, slug=slug
-        )
-        status, body = self._request("GET", f"/v1/agent-auth/credentials?{query}")
-        if status >= _HTTP_BAD_REQUEST:
-            raise CredentialStoreError("Agent Auth list credentials failed", status)
-        items = body.get("items")
-        row = items[0] if isinstance(items, list) and items else None
-        credential_id = row.get("credential_id") if isinstance(row, Mapping) else None
-        return credential_id if isinstance(credential_id, str) else None
+        cursor: str | None = None
+        for _ in range(AGENT_AUTH_MAX_PROVIDER_PAGES):
+            query = agent_auth_credential_query(
+                owner_type=owner_type,
+                owner_id=owner_id,
+                kind=kind,
+                page_size=AGENT_AUTH_PROVIDER_PAGE_SIZE,
+                cursor=cursor,
+            )
+            status, body = self._request("GET", f"/v1/agent-auth/credentials?{query}")
+            if status >= _HTTP_BAD_REQUEST:
+                raise CredentialStoreError("Agent Auth list credentials failed", status)
+            raw_items = body.get("items")
+            items = raw_items if isinstance(raw_items, list) else []
+            for item in items:
+                if not isinstance(item, Mapping) or item.get("slug") != slug:
+                    continue
+                credential_id = item.get("credential_id")
+                if isinstance(credential_id, str) and credential_id:
+                    return credential_id
+            next_cursor = body.get("next_cursor")
+            if not isinstance(next_cursor, str) or not next_cursor or next_cursor == cursor:
+                return None
+            cursor = next_cursor
+        raise CredentialStoreError("Agent Auth credential list returned too many pages")
 
     def read_secret(self, credential_id: str) -> str | None:
         status, body = self._request(

managed_deepagents/_agent_auth_http.py

@@ -46,12 +46,24 @@ def agent_auth_credential_query(
     owner_type: str,
     owner_id: str,
     kind: str,
-    slug: str,
+    page_size: int | None = None,
+    cursor: str | None = None,
 ) -> str:
-    """Query string that addresses one credential by its natural key."""
-    return urllib.parse.urlencode(
-        {"owner_type": owner_type, "owner_id": owner_id, "kind": kind, "slug": slug}
-    )
+    """Query string for listing credentials filtered by owner and kind.
+
+    The shipped list endpoint does not filter by slug; callers match ``slug``
+    client-side across pages.
+    """
+    params: dict[str, str] = {
+        "owner_type": owner_type,
+        "owner_id": owner_id,
+        "kind": kind,
+    }
+    if page_size is not None:
+        params["page_size"] = str(page_size)
+    if cursor:
+        params["cursor"] = cursor
+    return urllib.parse.urlencode(params)
 
 
 def agent_auth_headers(

managed_deepagents/_channels/manifest.py

@@ -17,6 +17,8 @@ JsonObject = dict[str, JsonValue]
 class _OptionalChannelManifest(TypedDict, total=False):
     transport: Literal["trigger_server"]
     userCredentials: list[str]
+    userConnections: list[str]
+    agentConnections: list[str]
 
 
 class ChannelManifest(_OptionalChannelManifest):