managed-deepagents 0.6.2.dev30__py3-none-win_amd64.whl → 0.6.2.dev32__py3-none-win_amd64.whl

managed_deepagents/__init__.py

@@ -9,18 +9,18 @@ This package provides two things:
 
 Resources use ``define_*`` factories while provider collections use namespaces:
 ``define_sandbox()``, ``channels.slack(...)``, ``connectors.mcp(...)``,
-``credentials.get(...)``, and ``auth.supabase(...)``. Contributing a *new*
+``connections.get(...)``, and ``auth.supabase(...)``. Contributing a *new*
 primitive is not part of the public surface.
 """
 
 from __future__ import annotations
 
-from managed_deepagents._credentials import (
+from managed_deepagents._connections import (
+    ConnectionNotFoundError,
     CredentialAuthorizationRequiredError,
-    CredentialNotFoundError,
-    CredentialOwner,
     CredentialStoreError,
-    credentials,
+    InvalidAgentAuthEndpointError,
+    connections,
 )
 from managed_deepagents._managed_tools import (
     ManagedDeepAgentRuntime,
@@ -38,19 +38,19 @@ from managed_deepagents.sandbox import SandboxDefinition
 from managed_deepagents.schedules import define_schedule
 
 __all__ = [
+    "ConnectionNotFoundError",
     "CredentialAuthorizationRequiredError",
-    "CredentialNotFoundError",
-    "CredentialOwner",
     "CredentialStoreError",
     "DeepAgentDefinition",
+    "InvalidAgentAuthEndpointError",
     "ManagedDeepAgentRuntime",
     "ManagedServerInfo",
     "MemoryDefinition",
     "SandboxDefinition",
     "auth",
     "channels",
+    "connections",
     "connectors",
-    "credentials",
     "define_deep_agent",
     "define_identity",
     "define_memory",

managed_deepagents/_agent_auth.py

@@ -1,4 +1,4 @@
-"""Agent Auth client used by ``credentials.get`` and the pre-run credential gate.
+"""Agent Auth client used by ``connections.get`` and the pre-run credential gate.
 
 Talks to the shipped Agent Auth APIs (credentials + oauth-authorization-sessions),
 not the aspirational ``credentials/mint`` endpoint.
@@ -33,6 +33,7 @@ __all__ = [
     "AgentAuthUnknownProviderError",
     "CredentialAuthorizationRequiredError",
     "PendingAuthorization",
+    "WorkspaceConnection",
 ]
 
 
@@ -45,20 +46,29 @@ class AgentAuthContext:
     principal_id: str
     api_key: str | None = None
     workspace_id: str | None = None
+    #: Agent Builder service JWT for workspace-owned credential material.
+    service_key: str | None = None
 
 
 class PendingAuthorization(TypedDict):
-    """One credential slug the caller has not granted, with its connect URL."""
+    """One connection slug the caller has not granted, with its connect URL."""
 
     slug: str
     connect_url: str
     auth_id: str
 
 
+@dataclass(frozen=True)
+class WorkspaceConnection:
+    connection_id: str
+    kind: str
+    owner_policy: str
+
+
 class CredentialAuthorizationRequiredError(RuntimeError):
     def __init__(self, slugs: list[str]) -> None:
         super().__init__(
-            f"the caller has not connected: {', '.join(slugs)}. Declare the credential "
+            f"the caller has not connected: {', '.join(slugs)}. Declare the connection "
             "on a connector so the pre-run gate can request it."
         )
         self.slugs = slugs
@@ -106,6 +116,124 @@ class AgentAuth:
         self._timeout = timeout
         self._request: AgentAuthRequest = request if request is not None else self._urlopen_json
 
+    def find_workspace_connection(self, slug: str) -> WorkspaceConnection | None:
+        """List workspace connections and return the row for ``slug``, if any."""
+        if not (self.context.workspace_id or "").strip():
+            raise CredentialStoreError(
+                "connections are not configured: LANGSMITH_WORKSPACE_ID is not set"
+            )
+        cursor: str | None = None
+        for _ in range(AGENT_AUTH_MAX_PROVIDER_PAGES):
+            query: dict[str, str] = {
+                "page_size": str(AGENT_AUTH_PROVIDER_PAGE_SIZE),
+            }
+            if cursor:
+                query["cursor"] = cursor
+            status, body = self._request(
+                "GET",
+                f"/v1/agent-auth/connections?{urllib.parse.urlencode(query)}",
+            )
+            if status >= _HTTP_BAD_REQUEST:
+                raise CredentialStoreError("Agent Auth list connections failed", status)
+            raw_items = body.get("items")
+            items = raw_items if isinstance(raw_items, list) else []
+            for item in items:
+                if not isinstance(item, Mapping) or item.get("slug") != slug:
+                    continue
+                connection_id = (
+                    item.get("id") or item.get("connection_id") or item.get("credential_id")
+                )
+                kind = _connection_credential_kind(item)
+                owner_policy = item.get("owner_policy")
+                if not isinstance(connection_id, str) or not connection_id:
+                    raise CredentialStoreError("Agent Auth connection row missing id or kind")
+                if not isinstance(kind, str) or not kind:
+                    raise CredentialStoreError("Agent Auth connection row missing id or kind")
+                return WorkspaceConnection(
+                    connection_id=connection_id,
+                    kind=kind,
+                    owner_policy=str(owner_policy) if isinstance(owner_policy, str) else "",
+                )
+            next_cursor = body.get("next_cursor")
+            if not isinstance(next_cursor, str) or not next_cursor or next_cursor == cursor:
+                return None
+            cursor = next_cursor
+        raise CredentialStoreError("Agent Auth connection list returned too many pages")
+
+    def find_workspace_credential_id(self, slug: str) -> str | None:
+        """Workspace credential id for an agent-owned opaque secret grant."""
+        connection = self.find_workspace_connection(slug)
+        if connection is None:
+            return None
+        return self.find_secret_credential_id(connection, slug)
+
+    def find_secret_credential_id(self, connection: WorkspaceConnection, slug: str) -> str | None:
+        """Resolve the credential id for a secret connection row.
+
+        With an Agent Builder service key, prefer GET-for-owner / workspace list.
+        Personal API keys may only list agent-owned credentials.
+        """
+        if connection.kind != "secret":
+            return None
+        workspace_id = (self.context.workspace_id or "").strip()
+        if not workspace_id:
+            raise CredentialStoreError(
+                "connections are not configured: LANGSMITH_WORKSPACE_ID is not set"
+            )
+        if (self.context.service_key or "").strip():
+            from_owner = self._credential_id_for_owner(
+                connection.connection_id, "workspace", workspace_id
+            )
+            if from_owner is not None:
+                return from_owner
+            return self.find_credential_id(
+                owner_type="workspace",
+                owner_id=workspace_id,
+                kind="secret",
+                slug=slug,
+            )
+        return self.find_credential_id(
+            owner_type="agent",
+            owner_id=self.context.agent_id,
+            kind="secret",
+            slug=slug,
+        )
+
+    def _credential_id_for_owner(
+        self, connection_id: str, owner_type: str, owner_id: str
+    ) -> str | None:
+        query = urllib.parse.urlencode(
+            {
+                "credential_owner_type": owner_type,
+                "credential_owner_id": owner_id,
+            }
+        )
+        status, body = self._request(
+            "GET",
+            f"/v1/agent-auth/connections/{_path_segment(connection_id)}?{query}",
+        )
+        if status == _HTTP_NOT_FOUND:
+            return None
+        if status >= _HTTP_BAD_REQUEST:
+            raise CredentialStoreError("Agent Auth get connection for owner failed", status)
+        return _connection_credential_id(body)
+
+    def read_user_secret(self, slug: str) -> str | None:
+        """Read a caller-owned opaque secret grant for a workspace connection slug."""
+        credential_id = self.find_credential_id(
+            owner_type="user",
+            owner_id=self.context.principal_id,
+            kind="secret",
+            slug=slug,
+        )
+        if credential_id is None:
+            return None
+        return self.read_secret(credential_id)
+
+    def read_connection_access_token(self, connection_id: str) -> str | None:
+        """Read an OAuth access token stored on a workspace connection row."""
+        return self._fetch_access_token(connection_id)
+
     def read_user_access_token(self, slug: str) -> str | None:
         """Read the caller's OAuth access token without starting a session.
 
@@ -128,12 +256,16 @@ class AgentAuth:
 
     def start_authorization_session(self, slug: str) -> PendingAuthorization:
         """Start an OAuth session for a slug the caller has not granted."""
-        provider_id = self.resolve_oauth_provider_id(slug)
+        connection = self.find_workspace_connection(slug)
+        if connection is None:
+            raise CredentialStoreError(f"workspace connection {slug!r} is not configured")
+        if connection.kind != "oauth2":
+            raise CredentialStoreError(f"connection {slug!r} is not an OAuth connection")
         status, body = self._request(
             "POST",
             "/v1/agent-auth/oauth-authorization-sessions",
             body={
-                "provider_id": provider_id,
+                "connection_id": connection.connection_id,
                 "principal_id": self.context.principal_id,
                 "agent_id": self.context.agent_id,
             },
@@ -182,18 +314,35 @@ class AgentAuth:
     ) -> str | None:
         """Find a credential id by slug.
 
-        The credential key is ``credential_id``, never ``id``.
+        The shipped credentials list filters by owner and kind only, so the
+        slug match is made client-side across pages. The credential key is
+        ``credential_id``, never ``id``.
         """
-        query = agent_auth_credential_query(
-            owner_type=owner_type, owner_id=owner_id, kind=kind, slug=slug
-        )
-        status, body = self._request("GET", f"/v1/agent-auth/credentials?{query}")
-        if status >= _HTTP_BAD_REQUEST:
-            raise CredentialStoreError("Agent Auth list credentials failed", status)
-        items = body.get("items")
-        row = items[0] if isinstance(items, list) and items else None
-        credential_id = row.get("credential_id") if isinstance(row, Mapping) else None
-        return credential_id if isinstance(credential_id, str) else None
+        cursor: str | None = None
+        for _ in range(AGENT_AUTH_MAX_PROVIDER_PAGES):
+            query = agent_auth_credential_query(
+                owner_type=owner_type,
+                owner_id=owner_id,
+                kind=kind,
+                page_size=AGENT_AUTH_PROVIDER_PAGE_SIZE,
+                cursor=cursor,
+            )
+            status, body = self._request("GET", f"/v1/agent-auth/credentials?{query}")
+            if status >= _HTTP_BAD_REQUEST:
+                raise CredentialStoreError("Agent Auth list credentials failed", status)
+            raw_items = body.get("items")
+            items = raw_items if isinstance(raw_items, list) else []
+            for item in items:
+                if not isinstance(item, Mapping) or item.get("slug") != slug:
+                    continue
+                credential_id = item.get("credential_id")
+                if isinstance(credential_id, str) and credential_id:
+                    return credential_id
+            next_cursor = body.get("next_cursor")
+            if not isinstance(next_cursor, str) or not next_cursor or next_cursor == cursor:
+                return None
+            cursor = next_cursor
+        raise CredentialStoreError("Agent Auth credential list returned too many pages")
 
     def read_secret(self, credential_id: str) -> str | None:
         status, body = self._request(
@@ -241,6 +390,7 @@ class AgentAuth:
         return agent_auth_headers(
             api_key=self.context.api_key,
             workspace_id=self.context.workspace_id,
+            service_key=self.context.service_key,
         )
 
 
@@ -248,6 +398,24 @@ def _path_segment(value: str) -> str:
     return urllib.parse.quote(value, safe="")
 
 
+def _connection_credential_kind(item: Mapping[str, object]) -> str:
+    credential = item.get("credential")
+    if isinstance(credential, Mapping):
+        kind = credential.get("kind")
+        if isinstance(kind, str) and kind:
+            return kind
+    kind = item.get("kind")
+    return kind if isinstance(kind, str) else ""
+
+
+def _connection_credential_id(body: Mapping[str, object]) -> str | None:
+    credential = body.get("credential")
+    if not isinstance(credential, Mapping):
+        return None
+    credential_id = credential.get("credential_id")
+    return credential_id if isinstance(credential_id, str) and credential_id else None
+
+
 def _is_authorization_required(status: int, body: dict[str, object]) -> bool:
     """Agent Auth answers 409 when a stored grant has lapsed and needs re-auth."""
     if status != _HTTP_CONFLICT:

managed_deepagents/_agent_auth_http.py

@@ -46,24 +46,40 @@ def agent_auth_credential_query(
     owner_type: str,
     owner_id: str,
     kind: str,
-    slug: str,
+    page_size: int | None = None,
+    cursor: str | None = None,
 ) -> str:
-    """Query string that addresses one credential by its natural key."""
-    return urllib.parse.urlencode(
-        {"owner_type": owner_type, "owner_id": owner_id, "kind": kind, "slug": slug}
-    )
+    """Query string for listing credentials filtered by owner and kind.
+
+    The shipped list endpoint does not filter by slug; callers match ``slug``
+    client-side across pages.
+    """
+    params: dict[str, str] = {
+        "owner_type": owner_type,
+        "owner_id": owner_id,
+        "kind": kind,
+    }
+    if page_size is not None:
+        params["page_size"] = str(page_size)
+    if cursor:
+        params["cursor"] = cursor
+    return urllib.parse.urlencode(params)
 
 
 def agent_auth_headers(
     *,
     api_key: str | None = None,
     workspace_id: str | None = None,
+    service_key: str | None = None,
 ) -> dict[str, str]:
     headers = {
         "accept": "application/json",
         "content-type": "application/json",
         "x-langsmith-product": "mda",
     }
+    resolved_service_key = (service_key or "").strip()
+    if resolved_service_key:
+        headers["x-service-key"] = resolved_service_key
     resolved_api_key = (api_key or "").strip()
     if resolved_api_key:
         headers["x-api-key"] = resolved_api_key

managed_deepagents/_channels/manifest.py

@@ -17,6 +17,8 @@ JsonObject = dict[str, JsonValue]
 class _OptionalChannelManifest(TypedDict, total=False):
     transport: Literal["trigger_server"]
     userCredentials: list[str]
+    userConnections: list[str]
+    agentConnections: list[str]
 
 
 class ChannelManifest(_OptionalChannelManifest):

managed_deepagents/_channels/trigger/http.py

@@ -250,7 +250,7 @@ async def _observe_accepted_run(
                 event["channel_id"],
                 {
                     "type": "post",
-                    "action_id": str(uuid.uuid4()),
+                    "action_id": event["event_id"],
                     "address": event["address"],
                     "source_thread_key": event["source_thread_key"],
                     "message": {"text": text},