managed-deepagents 0.6.2.dev25__py3-none-win_amd64.whl → 0.6.2.dev29__py3-none-win_amd64.whl

managed_deepagents/__init__.py

@@ -19,6 +19,7 @@ from managed_deepagents._connections import (
     ConnectionNotFoundError,
     CredentialAuthorizationRequiredError,
     CredentialStoreError,
+    InvalidAgentAuthEndpointError,
     connections,
 )
 from managed_deepagents._managed_tools import (
@@ -41,6 +42,7 @@ __all__ = [
     "CredentialAuthorizationRequiredError",
     "CredentialStoreError",
     "DeepAgentDefinition",
+    "InvalidAgentAuthEndpointError",
     "ManagedDeepAgentRuntime",
     "ManagedServerInfo",
     "MemoryDefinition",

managed_deepagents/_agent_auth.py

@@ -46,6 +46,8 @@ class AgentAuthContext:
     principal_id: str
     api_key: str | None = None
     workspace_id: str | None = None
+    #: Agent Builder service JWT for workspace-owned credential material.
+    service_key: str | None = None
 
 
 class PendingAuthorization(TypedDict):
@@ -141,7 +143,7 @@ class AgentAuth:
                 connection_id = (
                     item.get("id") or item.get("connection_id") or item.get("credential_id")
                 )
-                kind = item.get("kind")
+                kind = _connection_credential_kind(item)
                 owner_policy = item.get("owner_policy")
                 if not isinstance(connection_id, str) or not connection_id:
                     raise CredentialStoreError("Agent Auth connection row missing id or kind")
@@ -160,18 +162,62 @@ class AgentAuth:
 
     def find_workspace_credential_id(self, slug: str) -> str | None:
         """Workspace credential id for an agent-owned opaque secret grant."""
+        connection = self.find_workspace_connection(slug)
+        if connection is None:
+            return None
+        return self.find_secret_credential_id(connection, slug)
+
+    def find_secret_credential_id(self, connection: WorkspaceConnection, slug: str) -> str | None:
+        """Resolve the credential id for a secret connection row.
+
+        With an Agent Builder service key, prefer GET-for-owner / workspace list.
+        Personal API keys may only list agent-owned credentials.
+        """
+        if connection.kind != "secret":
+            return None
         workspace_id = (self.context.workspace_id or "").strip()
         if not workspace_id:
             raise CredentialStoreError(
                 "connections are not configured: LANGSMITH_WORKSPACE_ID is not set"
             )
+        if (self.context.service_key or "").strip():
+            from_owner = self._credential_id_for_owner(
+                connection.connection_id, "workspace", workspace_id
+            )
+            if from_owner is not None:
+                return from_owner
+            return self.find_credential_id(
+                owner_type="workspace",
+                owner_id=workspace_id,
+                kind="secret",
+                slug=slug,
+            )
         return self.find_credential_id(
-            owner_type="workspace",
-            owner_id=workspace_id,
+            owner_type="agent",
+            owner_id=self.context.agent_id,
             kind="secret",
             slug=slug,
         )
 
+    def _credential_id_for_owner(
+        self, connection_id: str, owner_type: str, owner_id: str
+    ) -> str | None:
+        query = urllib.parse.urlencode(
+            {
+                "credential_owner_type": owner_type,
+                "credential_owner_id": owner_id,
+            }
+        )
+        status, body = self._request(
+            "GET",
+            f"/v1/agent-auth/connections/{_path_segment(connection_id)}?{query}",
+        )
+        if status == _HTTP_NOT_FOUND:
+            return None
+        if status >= _HTTP_BAD_REQUEST:
+            raise CredentialStoreError("Agent Auth get connection for owner failed", status)
+        return _connection_credential_id(body)
+
     def read_user_secret(self, slug: str) -> str | None:
         """Read a caller-owned opaque secret grant for a workspace connection slug."""
         credential_id = self.find_credential_id(
@@ -344,6 +390,7 @@ class AgentAuth:
         return agent_auth_headers(
             api_key=self.context.api_key,
             workspace_id=self.context.workspace_id,
+            service_key=self.context.service_key,
         )
 
 
@@ -351,6 +398,24 @@ def _path_segment(value: str) -> str:
     return urllib.parse.quote(value, safe="")
 
 
+def _connection_credential_kind(item: Mapping[str, object]) -> str:
+    credential = item.get("credential")
+    if isinstance(credential, Mapping):
+        kind = credential.get("kind")
+        if isinstance(kind, str) and kind:
+            return kind
+    kind = item.get("kind")
+    return kind if isinstance(kind, str) else ""
+
+
+def _connection_credential_id(body: Mapping[str, object]) -> str | None:
+    credential = body.get("credential")
+    if not isinstance(credential, Mapping):
+        return None
+    credential_id = credential.get("credential_id")
+    return credential_id if isinstance(credential_id, str) and credential_id else None
+
+
 def _is_authorization_required(status: int, body: dict[str, object]) -> bool:
     """Agent Auth answers 409 when a stored grant has lapsed and needs re-auth."""
     if status != _HTTP_CONFLICT:

managed_deepagents/_agent_auth_http.py

@@ -70,12 +70,16 @@ def agent_auth_headers(
     *,
     api_key: str | None = None,
     workspace_id: str | None = None,
+    service_key: str | None = None,
 ) -> dict[str, str]:
     headers = {
         "accept": "application/json",
         "content-type": "application/json",
         "x-langsmith-product": "mda",
     }
+    resolved_service_key = (service_key or "").strip()
+    if resolved_service_key:
+        headers["x-service-key"] = resolved_service_key
     resolved_api_key = (api_key or "").strip()
     if resolved_api_key:
         headers["x-api-key"] = resolved_api_key

managed_deepagents/_connections.py

@@ -47,6 +47,7 @@ __all__ = [
     "ConnectionRequest",
     "CredentialAuthorizationRequiredError",
     "CredentialStoreError",
+    "InvalidAgentAuthEndpointError",
     "agent_connection_env_key",
     "connections",
     "is_connection_reference",
@@ -132,6 +133,15 @@ _API_KEY_ENV = "LANGSMITH_API_KEY"
 _WORKSPACE_ID_ENV = "LANGSMITH_WORKSPACE_ID"
 
 
+class InvalidAgentAuthEndpointError(CredentialStoreError):
+    """``LANGSMITH_ENDPOINT`` is not a usable Agent Auth origin."""
+
+    def __init__(self) -> None:
+        super().__init__(
+            f"LangSmith Agent Auth endpoint is not a valid URL (set {PLATFORM_API_URL_ENV})"
+        )
+
+
 class ConnectionHttpResponse(TypedDict):
     status: int
     body: bytes
@@ -147,6 +157,7 @@ class _AgentAuthConfig:
     api_key: str
     deployment_id: str | None
     workspace_id: str
+    service_key: str | None = None
 
 
 class AgentAuthConnectionStore:
@@ -177,6 +188,7 @@ class AgentAuthConnectionStore:
                 principal_id=owner_id,
                 api_key=config.api_key,
                 workspace_id=config.workspace_id,
+                service_key=config.service_key,
             ),
             request=self._bind_request(config),
             timeout=self._timeout,
@@ -200,7 +212,11 @@ class AgentAuthConnectionStore:
         ) -> tuple[int, dict[str, object]]:
             del method, body
             url = f"{config.base_url}{path}"
-            headers = agent_auth_headers(api_key=config.api_key, workspace_id=config.workspace_id)
+            headers = agent_auth_headers(
+                api_key=config.api_key,
+                workspace_id=config.workspace_id,
+                service_key=config.service_key,
+            )
             response = http_get(url, headers, timeout)
             status = response.get("status")
             raw_body = response.get("body", b"")
@@ -260,7 +276,7 @@ def _lookup_agent_connection_material(
     row: WorkspaceConnection,
 ) -> str | None:
     if row.kind == "secret":
-        credential_id = client.find_workspace_credential_id(slug)
+        credential_id = client.find_secret_credential_id(row, slug)
         if credential_id is None:
             return None
         return client.read_secret(credential_id)
@@ -413,6 +429,7 @@ def resolve_agent_auth_context(
         principal_id=resolve_owner_id({"type": "user"}, identity, config.deployment_id),
         api_key=config.api_key,
         workspace_id=config.workspace_id,
+        service_key=config.service_key,
     )
 
 
@@ -426,22 +443,34 @@ def _resolve_agent_auth_config(env: Mapping[str, str] | None) -> _AgentAuthConfi
         raise CredentialStoreError(
             f"connections are not configured: {_WORKSPACE_ID_ENV} is not set"
         )
+    service_key = (resolved.get("MDA_AGENT_AUTH_SERVICE_KEY") or "").strip() or None
     return _AgentAuthConfig(
         base_url=resolve_agent_auth_base_url(resolved),
         api_key=api_key,
         deployment_id=(resolved.get(DEPLOYMENT_ID_ENV) or "").strip() or None,
         workspace_id=workspace_id,
+        service_key=service_key,
     )
 
 
 def resolve_agent_auth_base_url(env: Mapping[str, str] | None = None) -> str:
+    """Origin for Agent Auth HTTP calls from ``LANGSMITH_ENDPOINT``.
+
+    Cloud SaaS revisions omit that reserved name and inject
+    ``LANGCHAIN_ENDPOINT`` instead; read it as the same setting so we do not
+    default to production.
+    """
     resolved = os.environ if env is None else env
-    raw = (resolved.get(PLATFORM_API_URL_ENV) or "").strip() or _DEFAULT_LANGSMITH_ENDPOINT
+    raw = (
+        (resolved.get(PLATFORM_API_URL_ENV) or "").strip()
+        or (resolved.get("LANGCHAIN_ENDPOINT") or "").strip()
+        or _DEFAULT_LANGSMITH_ENDPOINT
+    )
     try:
         parsed = urllib.parse.urlsplit(raw.rstrip("/"))
         _ = parsed.port
     except ValueError:
-        raise CredentialStoreError(f"{PLATFORM_API_URL_ENV} is not a valid URL") from None
+        raise InvalidAgentAuthEndpointError from None
     if (
         parsed.scheme not in {"http", "https"}
         or not parsed.hostname
@@ -451,7 +480,7 @@ def resolve_agent_auth_base_url(env: Mapping[str, str] | None = None) -> str:
         or parsed.query
         or parsed.fragment
     ):
-        raise CredentialStoreError(f"{PLATFORM_API_URL_ENV} is not a valid URL")
+        raise InvalidAgentAuthEndpointError
     return f"{parsed.scheme}://{parsed.netloc}"
 
 

{managed_deepagents-0.6.2.dev25.dist-info → managed_deepagents-0.6.2.dev29.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: managed-deepagents
-Version: 0.6.2.dev25
+Version: 0.6.2.dev29
 Summary: Managed Deep Agents — the define_deep_agent authoring interface plus the CLI that compiles and deploys a code-first Deep Agent repository to a managed LangGraph runtime.
 Author: LangChain
 License: MIT
@@ -282,8 +282,8 @@ when a grant is missing. `mda dev` has no deployment to hold user grants, so
 a user-owned connection fails there with an actionable error; deploy the agent
 to exercise one.
 
-Provision workspace connections with `mda connection create` before deploy.
-`mda connection check` verifies manifest slugs exist in the workspace.
+Provision workspace connections with `mda connections create` before deploy.
+`mda connections check` verifies manifest slugs exist in the workspace.
 
 Use `include_tools` or `exclude_tools` inside a server config to select a
 subset. Tool names are raw MCP tool names before the managed `{server}__` prefix

{managed_deepagents-0.6.2.dev25.dist-info → managed_deepagents-0.6.2.dev29.dist-info}/RECORD

@@ -1,10 +1,10 @@
-managed_deepagents/__init__.py,sha256=KSwxB3Sdu3az-TKh1r6aYWp3nus0DMJJdvPtN68Fl1w,1790
+managed_deepagents/__init__.py,sha256=RezkpgYxCcywj6_W7Nk3PN9TMBfYyFgIatxGrIeY8V4,1862
 managed_deepagents/__main__.py,sha256=GcjmqN0Ea5v8OHKMxYToasm3eCX_doSLOlpEzAi1tAw,67
-managed_deepagents/_agent_auth.py,sha256=Pj4UJzIOoNz3cuO35jp17xvE0yBbFVeAW6FZA25APAE,14101
-managed_deepagents/_agent_auth_http.py,sha256=xMp6bVNrgEoR1xnUKAFSjPfvMO1o9m1CO-_vmaI5sOs,3748
+managed_deepagents/_agent_auth.py,sha256=3rA39j_3PFROrtsIr5OHkAO_FgAHfASM-ee0vGhPGu8,16650
+managed_deepagents/_agent_auth_http.py,sha256=DtspEFmWHTtpp3uqELw1-wuHiLbAx_ers9JW18J3Coc,3924
 managed_deepagents/_channel.py,sha256=-Og7QOM1yvV-yeTDOfv2CxXpR2HLY4xdX1bLrIsPi5k,5272
 managed_deepagents/_cli.py,sha256=jVaw2i1ysdRoWziMdPFmRXtKry_baYGRspyzyIeGWoU,1688
-managed_deepagents/_connections.py,sha256=sy_ZDO6ZlgEm3NioF1i776GNcPATgb8Zn4gMBHMt158,15598
+managed_deepagents/_connections.py,sha256=N6luj1YMpBPjpH-WnGc6AIGNTE9DnZoBWAlWcFRSo2I,16518
 managed_deepagents/_connector.py,sha256=Syp0SRs1oFCUUltIUmZbSNi1Ys_PxObVdiAi-I9GBzs,8040
 managed_deepagents/_cors.py,sha256=V96RPrqewdRWG5RpEMEBnPuRq9_zF8nf4vf99k5dkuI,7597
 managed_deepagents/_credential_gate.py,sha256=WlryhbWHtg1FN5IdadiOvgT3JX3G78DtWVGW0wLWvz4,12252
@@ -28,7 +28,7 @@ managed_deepagents/py.typed,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
 managed_deepagents/runtime.py,sha256=B4iKTJZD0zXx_MZ09pqQFOkVo07tqJDT3qvOBr-0iOk,65782
 managed_deepagents/sandbox.py,sha256=xlpcWa6CoVX6GKip2nK-0Lw-HBCoFGFYm0r4x9eYwcY,2530
 managed_deepagents/schedules.py,sha256=MtTQN4tlm1NizFDCjZZv_huGfbQx-dj9WP1dIBybCug,5237
-managed_deepagents/_binaries/mda.exe,sha256=XZjv2YMdWq9BDc7DgFLJ4-kt3NUskewROt7ypb0yCj8,3855360
+managed_deepagents/_binaries/mda.exe,sha256=2tNegm-g-AkSnDb_mHCMIVwJNX47E6AXbRfpM74WQag,3858432
 managed_deepagents/_channels/__init__.py,sha256=Z6eXmzaLxG09DSyJoY_CX34axcsBo9gSJ0G7pRm2D6M,1216
 managed_deepagents/_channels/assistant_text.py,sha256=f-Z3J3PlQFXZHztgBxlRoqB2LigU1Hj1YpwoXBMTR18,2171
 managed_deepagents/_channels/binding.py,sha256=6vAKbWpg-eyLErJ0SsozH4mZc50hA1NhquM63mVmWDQ,3423
@@ -68,9 +68,9 @@ managed_deepagents/identity/__init__.py,sha256=Slm-oEqKxbaZEQsMqHfD3LbG5M4vH2lKU
 managed_deepagents/identity/claims.py,sha256=prby7r_8Lww3MmoBm8PX6PsSGE3GwSHkr8mVIz_08nU,1180
 managed_deepagents/identity/options.py,sha256=x_yMbXEFR7zXyehEjDHG2qjAlukXjrRBcQLcM6IndLM,2550
 managed_deepagents/identity/supabase.py,sha256=8uobl3WCrQL_ieSXG8KTLf1th7Qjim9liZT50HeaJE0,6026
-managed_deepagents-0.6.2.dev25.dist-info/licenses/LICENSE,sha256=WnPZQQ608ojZUkXl7BW6VbKloIAibZiGm1K6cjeZOL8,1066
-managed_deepagents-0.6.2.dev25.dist-info/METADATA,sha256=yqZkx8zOkbSgz9Ydkeqjgzkx0IGBr3O_wfYezDqCNtg,13580
-managed_deepagents-0.6.2.dev25.dist-info/WHEEL,sha256=3I5VVWZdsFlU417aCS2bMRuerS8wsfvBq99MyatBV3A,97
-managed_deepagents-0.6.2.dev25.dist-info/entry_points.txt,sha256=ziZqkKuaDO3qHCjKmBhrx9cm3ok8bZ9xcEDpUTj4unM,53
-managed_deepagents-0.6.2.dev25.dist-info/top_level.txt,sha256=fdBo4O0Hlol_w022tTLB5ftZpamb4yJoQ3MUvjgTGfA,19
-managed_deepagents-0.6.2.dev25.dist-info/RECORD,,
+managed_deepagents-0.6.2.dev29.dist-info/licenses/LICENSE,sha256=WnPZQQ608ojZUkXl7BW6VbKloIAibZiGm1K6cjeZOL8,1066
+managed_deepagents-0.6.2.dev29.dist-info/METADATA,sha256=XkIgC0l4YyYRSgaLIuI97rr2Li4jElapfveTwg_EiZ4,13582
+managed_deepagents-0.6.2.dev29.dist-info/WHEEL,sha256=3I5VVWZdsFlU417aCS2bMRuerS8wsfvBq99MyatBV3A,97
+managed_deepagents-0.6.2.dev29.dist-info/entry_points.txt,sha256=ziZqkKuaDO3qHCjKmBhrx9cm3ok8bZ9xcEDpUTj4unM,53
+managed_deepagents-0.6.2.dev29.dist-info/top_level.txt,sha256=fdBo4O0Hlol_w022tTLB5ftZpamb4yJoQ3MUvjgTGfA,19
+managed_deepagents-0.6.2.dev29.dist-info/RECORD,,