managed-deepagents 0.6.2.dev34__py3-none-win_amd64.whl → 0.6.2.dev36__py3-none-win_amd64.whl

managed_deepagents/_agent_auth.py

@@ -23,6 +23,7 @@ AGENT_AUTH_PROVIDER_PAGE_SIZE = 100
 AGENT_AUTH_MAX_PROVIDER_PAGES = 20
 
 _HTTP_BAD_REQUEST = 400
+_HTTP_FORBIDDEN = 403
 _HTTP_NOT_FOUND = 404
 _HTTP_CONFLICT = 409
 
@@ -46,8 +47,6 @@ class AgentAuthContext:
     principal_id: str
     api_key: str | None = None
     workspace_id: str | None = None
-    #: Agent Builder service JWT for workspace-owned credential material.
-    service_key: str | None = None
 
 
 class PendingAuthorization(TypedDict):
@@ -134,7 +133,7 @@ class AgentAuth:
                 f"/v1/agent-auth/connections?{urllib.parse.urlencode(query)}",
             )
             if status >= _HTTP_BAD_REQUEST:
-                raise CredentialStoreError("Agent Auth list connections failed", status)
+                raise CredentialStoreError("Agent Auth list connections failed", status, body)
             raw_items = body.get("items")
             items = raw_items if isinstance(raw_items, list) else []
             for item in items:
@@ -170,28 +169,17 @@ class AgentAuth:
     def find_secret_credential_id(self, connection: WorkspaceConnection, slug: str) -> str | None:
         """Resolve the credential id for a secret connection row.
 
-        With an Agent Builder service key, prefer GET-for-owner / workspace list.
-        Personal API keys may only list agent-owned credentials.
+        Agent-owned connection declarations scope the credential to this
+        deployment. Workspace-owned credentials are deliberately not visible
+        to deployments.
         """
         if connection.kind != "secret":
             return None
-        workspace_id = (self.context.workspace_id or "").strip()
-        if not workspace_id:
-            raise CredentialStoreError(
-                "connections are not configured: LANGSMITH_WORKSPACE_ID is not set"
-            )
-        if (self.context.service_key or "").strip():
-            from_owner = self._credential_id_for_owner(
-                connection.connection_id, "workspace", workspace_id
-            )
-            if from_owner is not None:
-                return from_owner
-            return self.find_credential_id(
-                owner_type="workspace",
-                owner_id=workspace_id,
-                kind="secret",
-                slug=slug,
-            )
+        from_agent = self._credential_id_for_owner(
+            connection.connection_id, "agent", self.context.agent_id
+        )
+        if from_agent is not None:
+            return from_agent
         return self.find_credential_id(
             owner_type="agent",
             owner_id=self.context.agent_id,
@@ -202,6 +190,12 @@ class AgentAuth:
     def _credential_id_for_owner(
         self, connection_id: str, owner_type: str, owner_id: str
     ) -> str | None:
+        """Read credential_id from GET /connections/{id}?credential_owner_*.
+
+        Deployments authenticate with ``LANGSMITH_API_KEY`` (the minted
+        service-account key). User and workspace owners additionally require
+        workspace management permission.
+        """
         query = urllib.parse.urlencode(
             {
                 "credential_owner_type": owner_type,
@@ -215,16 +209,27 @@ class AgentAuth:
         if status == _HTTP_NOT_FOUND:
             return None
         if status >= _HTTP_BAD_REQUEST:
-            raise CredentialStoreError("Agent Auth get connection for owner failed", status)
+            raise CredentialStoreError(
+                "Agent Auth get connection for owner failed"
+                + (" (forbidden)" if status == _HTTP_FORBIDDEN else ""),
+                status,
+                body,
+            )
         return _connection_credential_id(body)
 
     def read_user_secret(self, slug: str) -> str | None:
         """Read a caller-owned opaque secret grant for a workspace connection slug."""
-        credential_id = self.find_credential_id(
-            owner_type="user",
-            owner_id=self.context.principal_id,
-            kind="secret",
-            slug=slug,
+        connection = self.find_workspace_connection(slug)
+        if connection is None:
+            return None
+        return self.read_user_secret_for_connection(connection)
+
+    def read_user_secret_for_connection(self, connection: WorkspaceConnection) -> str | None:
+        """Read a caller-owned opaque secret when the connection row is already loaded."""
+        if connection.kind != "secret":
+            return None
+        credential_id = self._credential_id_for_owner(
+            connection.connection_id, "user", self.context.principal_id
         )
         if credential_id is None:
             return None
@@ -244,11 +249,17 @@ class AgentAuth:
         Returns:
             The access token, or ``None`` when the caller must connect.
         """
-        credential_id = self.find_credential_id(
-            owner_type="user",
-            owner_id=self.context.principal_id,
-            kind="oauth2",
-            slug=slug,
+        connection = self.find_workspace_connection(slug)
+        if connection is None:
+            return None
+        return self.read_user_access_token_for_connection(connection)
+
+    def read_user_access_token_for_connection(self, connection: WorkspaceConnection) -> str | None:
+        """Read a caller OAuth token when the connection row is already loaded."""
+        if connection.kind != "oauth2":
+            return None
+        credential_id = self._credential_id_for_owner(
+            connection.connection_id, "user", self.context.principal_id
         )
         if credential_id is None:
             return None
@@ -272,7 +283,7 @@ class AgentAuth:
         )
         if status >= _HTTP_BAD_REQUEST:
             raise CredentialStoreError(
-                "Agent Auth create oauth-authorization-session failed", status
+                "Agent Auth create oauth-authorization-session failed", status, body
             )
         auth_id = str(body.get("id") or "")
         connect_url = str(body.get("verification_url") or "")
@@ -293,7 +304,7 @@ class AgentAuth:
                 "GET", f"/v1/agent-auth/oauth-providers?{urllib.parse.urlencode(query)}"
             )
             if status >= _HTTP_BAD_REQUEST:
-                raise CredentialStoreError("Agent Auth list oauth-providers failed", status)
+                raise CredentialStoreError("Agent Auth list oauth-providers failed", status, body)
             raw_items = body.get("items")
             for item in raw_items if isinstance(raw_items, list) else []:
                 if isinstance(item, Mapping) and item.get("slug") == slug and item.get("id"):
@@ -329,7 +340,7 @@ class AgentAuth:
             )
             status, body = self._request("GET", f"/v1/agent-auth/credentials?{query}")
             if status >= _HTTP_BAD_REQUEST:
-                raise CredentialStoreError("Agent Auth list credentials failed", status)
+                raise CredentialStoreError("Agent Auth list credentials failed", status, body)
             raw_items = body.get("items")
             items = raw_items if isinstance(raw_items, list) else []
             for item in items:
@@ -352,7 +363,7 @@ class AgentAuth:
         if status == _HTTP_NOT_FOUND:
             return None
         if status >= _HTTP_BAD_REQUEST:
-            raise CredentialStoreError("Agent Auth get secret failed", status)
+            raise CredentialStoreError("Agent Auth get secret failed", status, body)
         secret = body.get("secret")
         return secret if isinstance(secret, str) and secret else None
 
@@ -364,7 +375,7 @@ class AgentAuth:
         if _is_authorization_required(status, body):
             return None
         if status >= _HTTP_BAD_REQUEST:
-            raise CredentialStoreError("Agent Auth get oauth2 failed", status)
+            raise CredentialStoreError("Agent Auth get oauth2 failed", status, body)
         oauth2 = body.get("oauth2") if isinstance(body.get("oauth2"), dict) else body
         token = oauth2.get("access_token") if isinstance(oauth2, dict) else None
         return token if isinstance(token, str) and token else None
@@ -390,7 +401,6 @@ class AgentAuth:
         return agent_auth_headers(
             api_key=self.context.api_key,
             workspace_id=self.context.workspace_id,
-            service_key=self.context.service_key,
         )
 
 

managed_deepagents/_agent_auth_http.py

@@ -11,32 +11,68 @@ import urllib.error
 import urllib.parse
 import urllib.request
 from collections.abc import Mapping
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Final
 
 if TYPE_CHECKING:
     from http.client import HTTPMessage
     from typing import IO
 
 AGENT_AUTH_TIMEOUT_SECONDS = 10.0
+AGENT_AUTH_PROBLEM_HINT_MAX_CHARS = 200
+_PROBLEM_HINT_FIELDS: Final = ("detail", "remedy")
+
+
+def agent_auth_problem_hint(body: Mapping[str, object] | None) -> str | None:
+    """Return the caller-facing part of an Agent Auth problem+json body.
+
+    ``detail`` names the failure and ``remedy`` names the fix. Nothing else
+    from a response body is read, because the rest can quote secret material.
+    Both are collapsed to one line and truncated so a long or multi-line body
+    cannot reshape an error message.
+    """
+    seen: dict[str, None] = {}
+    for field in _PROBLEM_HINT_FIELDS:
+        value = None if body is None else body.get(field)
+        if not isinstance(value, str):
+            continue
+        text = " ".join(value.split())
+        if text:
+            seen[text] = None
+    if not seen:
+        return None
+    hint = " ".join(seen)
+    if len(hint) > AGENT_AUTH_PROBLEM_HINT_MAX_CHARS:
+        return hint[:AGENT_AUTH_PROBLEM_HINT_MAX_CHARS] + "..."
+    return hint
 
 
 class CredentialStoreError(RuntimeError):
     """Agent Auth could not answer.
 
-    Callers pass a fixed message: a response body can quote secret material, so
-    it never reaches this error, the logs, or the traceback chain.
+    Callers pass a fixed message; the only part of a response body that reaches
+    this error, the logs, or the traceback chain is the allow-listed
+    problem+json hint, since an arbitrary body can quote secret material.
     """
 
-    def __init__(self, message: str, status: int | None = None) -> None:
+    def __init__(
+        self,
+        message: str,
+        status: int | None = None,
+        problem: Mapping[str, object] | None = None,
+    ) -> None:
         self.status = status
-        super().__init__(message if status is None else f"{message} (status {status})")
+        with_status = message if status is None else f"{message} (status {status})"
+        hint = agent_auth_problem_hint(problem)
+        super().__init__(with_status if hint is None else f"{with_status}: {hint}")
 
 
 __all__ = [
+    "AGENT_AUTH_PROBLEM_HINT_MAX_CHARS",
     "AGENT_AUTH_TIMEOUT_SECONDS",
     "CredentialStoreError",
     "agent_auth_credential_query",
     "agent_auth_headers",
+    "agent_auth_problem_hint",
     "request_agent_auth_json",
 ]
 
@@ -70,16 +106,12 @@ def agent_auth_headers(
     *,
     api_key: str | None = None,
     workspace_id: str | None = None,
-    service_key: str | None = None,
 ) -> dict[str, str]:
     headers = {
         "accept": "application/json",
         "content-type": "application/json",
         "x-langsmith-product": "mda",
     }
-    resolved_service_key = (service_key or "").strip()
-    if resolved_service_key:
-        headers["x-service-key"] = resolved_service_key
     resolved_api_key = (api_key or "").strip()
     if resolved_api_key:
         headers["x-api-key"] = resolved_api_key

managed_deepagents/_channels/trigger/http.py

@@ -16,6 +16,12 @@ from managed_deepagents._channels.trigger.client import (
     TriggerClientLike,
     create_trigger_client,
 )
+from managed_deepagents._channels.trigger.identity_context import (
+    IdentityContextKey,
+    IdentityContextUnavailableError,
+    InvalidIdentityContextError,
+    principal_id_from_identity_context,
+)
 from managed_deepagents._channels.trigger.types import (
     TRIGGER_SERVICE_KEY_HEADER,
     TriggerChannelEvent,
@@ -52,6 +58,7 @@ class StartAgentFn(Protocol):
         messages: list[dict[str, object]],
         source_provider: str,
         source_thread_key: str,
+        user_id: str,
     ) -> StartedIngressRun: ...
 
 
@@ -64,6 +71,7 @@ class ResumeAgentFn(Protocol):
         resume: TriggerChannelResume,
         source_provider: str,
         source_thread_key: str,
+        user_id: str,
     ) -> StartedIngressRun: ...
 
 
@@ -74,6 +82,7 @@ async def _start_event_run(
     source_provider: str,
     start_agent: StartAgentFn | None,
     resume_agent: ResumeAgentFn | None,
+    user_id: str,
 ) -> StartedIngressRun:
     thread_id = _thread_id(event["source_thread_key"])
     if event["type"] == "message":
@@ -84,6 +93,7 @@ async def _start_event_run(
             messages=event["input"]["messages"],
             source_provider=source_provider,
             source_thread_key=event["source_thread_key"],
+            user_id=user_id,
         )
     resume = resume_agent or resume_ingress_agent
     return await resume(
@@ -92,10 +102,11 @@ async def _start_event_run(
         resume=event["interaction"]["resume"],
         source_provider=source_provider,
         source_thread_key=event["source_thread_key"],
+        user_id=user_id,
     )
 
 
-async def handle_trigger_channel_event_request(
+async def handle_trigger_channel_event_request(  # noqa: C901, PLR0911
     request: object,
     *,
     source_provider: str,
@@ -106,9 +117,11 @@ async def handle_trigger_channel_event_request(
     resume_agent: ResumeAgentFn | None = None,
     observe_agent: ObserveAgentFn | None = None,
     trigger_client: TriggerClientLike | None = None,
+    identity_context_key: IdentityContextKey | None = None,
+    identity_context_issuer: str | None = None,
 ) -> object:
     """Validate a Trigger message and enqueue its Agent Server run."""
-    # TODO: Validate a per-deployment Trigger↔MDA shared secret.
+    # TODO: Validate Trigger's platform-signed x-service-key JWT (not presence).
     if not _nonblank_header(request, TRIGGER_SERVICE_KEY_HEADER):
         return _json_response({"error": "unauthorized"}, status_code=401)
 
@@ -117,6 +130,32 @@ async def handle_trigger_channel_event_request(
     except (TypeError, ValueError, UnicodeDecodeError):
         logger.warning("invalid channel event")
         return _json_response({"error": "invalid channel event"}, status_code=400)
+
+    try:
+        user_id = _principal_for_event(
+            event,
+            identity_context_key=identity_context_key,
+            identity_context_issuer=identity_context_issuer,
+        )
+    except _MissingIdentityContextError:
+        logger.warning("missing channel identity_context")
+        return _json_response({"error": "missing channel identity_context"}, status_code=400)
+    except IdentityContextUnavailableError as error:
+        logger.error(
+            "channel identity_context unavailable (%s)",
+            logger.safe_error_label(error),
+        )
+        return _json_response(
+            {"error": "identity_context verification unavailable"},
+            status_code=503,
+        )
+    except InvalidIdentityContextError as error:
+        logger.warning(
+            "invalid channel identity_context (%s)",
+            logger.safe_error_label(error),
+        )
+        return _json_response({"error": "invalid channel identity_context"}, status_code=400)
+
     logger.info(
         "Channel incoming event (type=%s, event_id=%s, delivery_id=%s, channel_id=%s)",
         event["type"],
@@ -159,6 +198,7 @@ async def handle_trigger_channel_event_request(
             source_provider=source_provider,
             start_agent=start_agent,
             resume_agent=resume_agent,
+            user_id=user_id,
         )
     except Exception as error:  # noqa: BLE001 - never expose Agent Server details in the response
         logger.error(
@@ -173,6 +213,9 @@ async def handle_trigger_channel_event_request(
             started=started,
             client=client,
             observe_agent=observe_agent,
+            source_provider=source_provider,
+            source_thread_key=event["source_thread_key"],
+            user_id=user_id,
         )
 
     schedule_ingress_work(
@@ -192,6 +235,9 @@ async def _observe_accepted_run(
     started: StartedIngressRun,
     client: TriggerClientLike,
     observe_agent: ObserveAgentFn | None,
+    source_provider: str | None = None,
+    source_thread_key: str | None = None,
+    user_id: str,
 ) -> None:
     async def lifecycle(
         event_type: TriggerChannelRuntimeEventType,
@@ -212,11 +258,13 @@ async def _observe_accepted_run(
         )
 
     await lifecycle("run.started")
-    observe = observe_agent or observe_ingress_agent
     try:
-        observed = await observe(
-            thread_id=started["thread_id"],
-            run_id=started["run_id"],
+        observed = await _observe_run(
+            started=started,
+            observe_agent=observe_agent,
+            source_provider=source_provider,
+            source_thread_key=source_thread_key,
+            user_id=user_id,
         )
     except Exception:  # noqa: BLE001 - observation details stay internal
         await lifecycle("run.failed")
@@ -263,6 +311,53 @@ async def _observe_accepted_run(
     await lifecycle("run.completed")
 
 
+async def _observe_run(
+    *,
+    started: StartedIngressRun,
+    observe_agent: ObserveAgentFn | None,
+    source_provider: str | None,
+    source_thread_key: str | None,
+    user_id: str,
+) -> ObservedIngressRun:
+    if observe_agent is not None:
+        return await observe_agent(
+            **_observation_kwargs(
+                started=started,
+                source_provider=source_provider,
+                source_thread_key=source_thread_key,
+                user_id=user_id,
+            )
+        )
+    if source_provider is None or source_thread_key is None:
+        raise RuntimeError("channel observation context is not configured")
+    return await observe_ingress_agent(
+        thread_id=started["thread_id"],
+        run_id=started["run_id"],
+        source_provider=source_provider,
+        source_thread_key=source_thread_key,
+        user_id=user_id,
+    )
+
+
+def _observation_kwargs(
+    *,
+    started: StartedIngressRun,
+    source_provider: str | None,
+    source_thread_key: str | None,
+    user_id: str,
+) -> dict[str, object]:
+    kwargs: dict[str, object] = {
+        "thread_id": started["thread_id"],
+        "run_id": started["run_id"],
+        "user_id": user_id,
+    }
+    if source_provider is None or source_thread_key is None:
+        return kwargs
+    kwargs["source_provider"] = source_provider
+    kwargs["source_thread_key"] = source_thread_key
+    return kwargs
+
+
 def _is_interrupted_run(observed: ObservedIngressRun) -> bool:
     # Agent Server can report status "success" after join while values still
     # carry `__interrupt__`. Trust either signal.
@@ -315,6 +410,27 @@ def _thread_id(source_thread_key: str) -> str:
     return str(uuid.uuid5(uuid.NAMESPACE_URL, source_thread_key))
 
 
+class _MissingIdentityContextError(ValueError):
+    """A message event arrived without a Trigger identity_context token."""
+
+
+def _principal_for_event(
+    event: TriggerChannelEvent,
+    *,
+    identity_context_key: IdentityContextKey | None,
+    identity_context_issuer: str | None,
+) -> str:
+    """Resolve the verified principal required on every Trigger delivery."""
+    raw_identity_context = event.get("identity_context")
+    if not isinstance(raw_identity_context, str) or not raw_identity_context.strip():
+        raise _MissingIdentityContextError
+    return principal_id_from_identity_context(
+        raw_identity_context,
+        key=identity_context_key,
+        issuer=identity_context_issuer,
+    )
+
+
 def _resolve_assistant_id(override: str | None) -> str:
     if override is not None and (explicit := override.strip()):
         return explicit

managed_deepagents/_channels/trigger/identity_context.py

@@ -0,0 +1,214 @@
+"""Verify Trigger Server ``identity_context`` JWTs into Agent Auth principal ids.
+
+Agent Auth signs these with the LangSmith EdDSA JWKS published at
+``{LANGSMITH_ENDPOINT}/.well-known/jwks.json``. MDA verifies the signature
+(and typ/version/aud/iss/exp/principal UUID) before stamping ``x-mda-user-id``.
+Delivery still requires Trigger's ``x-service-key`` header; signature verify is
+what stops a forged principal when that gate is weak.
+"""
+
+from __future__ import annotations
+
+import os
+from collections.abc import Mapping
+from uuid import UUID
+
+import jwt
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+from jwt import PyJWK, PyJWKClient
+
+IdentityContextKey = Ed25519PublicKey | PyJWK
+
+IDENTITY_CONTEXT_TOKEN_TYP = "identity-context+jwt"  # noqa: S105
+IDENTITY_CONTEXT_AUDIENCE = "mda"
+IDENTITY_CONTEXT_VERSION = "1"
+IDENTITY_CONTEXT_ALGORITHMS = ("EdDSA",)
+_DEFAULT_LANGSMITH_ENDPOINT = "https://api.smith.langchain.com"
+_JWKS_HTTP_TIMEOUT_S = 5
+
+_jwks_clients: dict[str, PyJWKClient] = {}
+
+
+class InvalidIdentityContextError(ValueError):
+    """Raised when a Trigger ``identity_context`` token is unusable."""
+
+
+class IdentityContextUnavailableError(RuntimeError):
+    """JWKS / network failure while verifying identity_context. Callers should 5xx."""
+
+
+def resolve_identity_context_issuer(
+    env: Mapping[str, str] | None = None,
+) -> str:
+    """LangSmith API origin used as identity-context ``iss`` and JWKS host."""
+    source = env if env is not None else os.environ
+    raw = (
+        (source.get("LANGSMITH_ENDPOINT") or "").strip()
+        or (source.get("LANGCHAIN_ENDPOINT") or "").strip()
+        or _DEFAULT_LANGSMITH_ENDPOINT
+    )
+    return raw.rstrip("/")
+
+
+def resolve_identity_context_jwks_url(
+    env: Mapping[str, str] | None = None,
+) -> str:
+    """Public JWKS URL for Agent Auth identity-context signatures."""
+    return f"{resolve_identity_context_issuer(env)}/.well-known/jwks.json"
+
+
+def principal_id_from_identity_context(
+    token: str,
+    *,
+    key: IdentityContextKey | None = None,
+    issuer: str | None = None,
+    env: Mapping[str, str] | None = None,
+) -> str:
+    """Extract the Agent Auth principal UUID from a Trigger identity-context JWT.
+
+    Raises:
+        InvalidIdentityContextError: when the token is missing, malformed, or
+            fails signature / claim checks.
+    """
+    value = token.strip()
+    if not value:
+        raise InvalidIdentityContextError("identity_context is blank")
+
+    _require_identity_context_header(value)
+    claims = _verify_identity_context_claims(
+        value,
+        key=key,
+        issuer=issuer or resolve_identity_context_issuer(env),
+        env=env,
+    )
+    if claims.get("version") != IDENTITY_CONTEXT_VERSION:
+        raise InvalidIdentityContextError(
+            f"identity_context version must be {IDENTITY_CONTEXT_VERSION}"
+        )
+    return _principal_id_from_claims(claims)
+
+
+def optional_principal_id_from_identity_context(
+    token: object | None,
+    *,
+    key: IdentityContextKey | None = None,
+    issuer: str | None = None,
+    env: Mapping[str, str] | None = None,
+) -> str | None:
+    """Resolve a principal id from an optional event field; ``None`` when absent."""
+    if token is None:
+        return None
+    if not isinstance(token, str):
+        raise InvalidIdentityContextError("identity_context must be a string")
+    if not token.strip():
+        return None
+    return principal_id_from_identity_context(token, key=key, issuer=issuer, env=env)
+
+
+def _require_identity_context_header(token: str) -> None:
+    try:
+        header = jwt.get_unverified_header(token)
+    except jwt.exceptions.DecodeError as error:
+        raise InvalidIdentityContextError("identity_context is not a JWT") from error
+    if header.get("typ") != IDENTITY_CONTEXT_TOKEN_TYP:
+        raise InvalidIdentityContextError(
+            f"identity_context typ must be {IDENTITY_CONTEXT_TOKEN_TYP}"
+        )
+    if header.get("alg") != "EdDSA":
+        raise InvalidIdentityContextError("identity_context alg must be EdDSA")
+
+
+def _verify_identity_context_claims(
+    token: str,
+    *,
+    key: IdentityContextKey | None,
+    issuer: str,
+    env: Mapping[str, str] | None,
+) -> dict[str, object]:
+    algorithms = list(IDENTITY_CONTEXT_ALGORITHMS)
+    try:
+        verify_key = _jwks_client(env).get_signing_key_from_jwt(token) if key is None else key
+        decoded = jwt.decode(
+            token,
+            key=verify_key,
+            algorithms=algorithms,
+            audience=IDENTITY_CONTEXT_AUDIENCE,
+            issuer=issuer,
+            options={"require": ["exp"], "verify_exp": True},
+        )
+    except jwt.exceptions.ExpiredSignatureError as error:
+        raise InvalidIdentityContextError("identity_context is expired") from error
+    except jwt.exceptions.MissingRequiredClaimError as error:
+        raise InvalidIdentityContextError("identity_context is missing exp") from error
+    except jwt.exceptions.PyJWKClientConnectionError as error:
+        raise IdentityContextUnavailableError(
+            "identity_context JWKS verification is unavailable"
+        ) from error
+    except TimeoutError as error:
+        raise IdentityContextUnavailableError(
+            "identity_context JWKS verification is unavailable"
+        ) from error
+    except OSError as error:
+        raise IdentityContextUnavailableError(
+            "identity_context JWKS verification is unavailable"
+        ) from error
+    except jwt.exceptions.PyJWTError as error:
+        raise InvalidIdentityContextError(
+            "identity_context signature verification failed"
+        ) from error
+    if not isinstance(decoded, dict):
+        raise InvalidIdentityContextError("identity_context claims must be an object")
+    claims = {str(name): value for name, value in decoded.items()}
+    if not isinstance(claims.get("exp"), (int, float)) or isinstance(claims.get("exp"), bool):
+        raise InvalidIdentityContextError("identity_context is missing exp")
+    return claims
+
+
+def _jwks_client(env: Mapping[str, str] | None) -> PyJWKClient:
+    uri = resolve_identity_context_jwks_url(env)
+    client = _jwks_clients.get(uri)
+    if client is None:
+        client = PyJWKClient(uri, timeout=_JWKS_HTTP_TIMEOUT_S)
+        _jwks_clients[uri] = client
+    return client
+
+
+def _principal_id_from_claims(claims: Mapping[str, object]) -> str:
+    from_principal = _principal_id_claim(claims.get("principal"))
+    raw_subject = claims.get("sub")
+    from_subject = _normalize_uuid(raw_subject) if isinstance(raw_subject, str) else None
+    if from_principal and from_subject and from_principal != from_subject:
+        raise InvalidIdentityContextError("identity_context principal.id and sub disagree")
+    principal_id = from_principal or from_subject
+    if not principal_id:
+        raise InvalidIdentityContextError("identity_context is missing a principal UUID")
+    return principal_id
+
+
+def _principal_id_claim(value: object) -> str | None:
+    if not isinstance(value, Mapping):
+        return None
+    raw_id = value.get("id")
+    return _normalize_uuid(raw_id) if isinstance(raw_id, str) else None
+
+
+def _normalize_uuid(value: str) -> str | None:
+    try:
+        return str(UUID(value))
+    except ValueError:
+        return None
+
+
+__all__ = [
+    "IDENTITY_CONTEXT_ALGORITHMS",
+    "IDENTITY_CONTEXT_AUDIENCE",
+    "IDENTITY_CONTEXT_TOKEN_TYP",
+    "IDENTITY_CONTEXT_VERSION",
+    "IdentityContextKey",
+    "IdentityContextUnavailableError",
+    "InvalidIdentityContextError",
+    "optional_principal_id_from_identity_context",
+    "principal_id_from_identity_context",
+    "resolve_identity_context_issuer",
+    "resolve_identity_context_jwks_url",
+]

managed_deepagents/_channels/trigger/types.py

@@ -25,7 +25,7 @@ class TriggerChannelMessageInput(TypedDict):
     messages: list[dict[str, object]]
 
 
-class TriggerChannelMessageEvent(TypedDict):
+class TriggerChannelMessageEventRequired(TypedDict):
     version: Literal["1"]
     type: Literal["message"]
     event_id: str
@@ -37,6 +37,10 @@ class TriggerChannelMessageEvent(TypedDict):
     input: TriggerChannelMessageInput
 
 
+class TriggerChannelMessageEvent(TriggerChannelMessageEventRequired, total=False):
+    identity_context: str | None
+
+
 # Keyed LangGraph resume: `{interrupt_id: value}`. Values are opaque
 # (`interrupt()` results or HITL `{decisions}`).
 TriggerChannelResume: TypeAlias = dict[str, object]
@@ -47,7 +51,7 @@ class TriggerChannelInterruptResumeInteraction(TypedDict):
     resume: TriggerChannelResume
 
 
-class TriggerChannelInterruptResumeEvent(TypedDict):
+class TriggerChannelInterruptResumeEventRequired(TypedDict):
     version: Literal["1"]
     type: Literal["interrupt_resume"]
     event_id: str
@@ -59,6 +63,10 @@ class TriggerChannelInterruptResumeEvent(TypedDict):
     interaction: TriggerChannelInterruptResumeInteraction
 
 
+class TriggerChannelInterruptResumeEvent(TriggerChannelInterruptResumeEventRequired, total=False):
+    identity_context: str | None
+
+
 TriggerChannelEvent = TriggerChannelMessageEvent | TriggerChannelInterruptResumeEvent
 
 
@@ -170,6 +178,7 @@ class _MessageEventModel(_WireModel):
     source_thread_key: _NonBlankString
     address: SkipValidation[dict[str, object]]
     input: _InputModel
+    identity_context: str | None = None
 
     @field_validator("address", mode="before")
     @classmethod
@@ -197,6 +206,7 @@ class _InterruptResumeEventModel(_WireModel):
     source_thread_key: _NonBlankString
     address: SkipValidation[dict[str, object]]
     interaction: _InterruptResumeInteractionModel
+    identity_context: str | None = None
 
     @field_validator("address", mode="before")
     @classmethod

managed_deepagents/_connections.py

@@ -1,6 +1,6 @@
 """``connections.get(...)`` — read a managed connection from a tool.
 
-``{ type: "agent" }`` resolves shared workspace material on the connection row.
+``{ type: "agent" }`` resolves material owned by the current deployment.
 ``{ type: "user" }`` resolves per-caller grants (OAuth or opaque). Resolution
 reads Agent Auth on every await and never caches.
 
@@ -157,11 +157,10 @@ class _AgentAuthConfig:
     api_key: str
     deployment_id: str | None
     workspace_id: str
-    service_key: str | None = None
 
 
 class AgentAuthConnectionStore:
-    """Store backed by workspace connection rows in Agent Auth."""
+    """Store backed by connection rows and deployment/user grants in Agent Auth."""
 
     def __init__(
         self,
@@ -188,7 +187,6 @@ class AgentAuthConnectionStore:
                 principal_id=owner_id,
                 api_key=config.api_key,
                 workspace_id=config.workspace_id,
-                service_key=config.service_key,
             ),
             request=self._bind_request(config),
             timeout=self._timeout,
@@ -215,7 +213,6 @@ class AgentAuthConnectionStore:
             headers = agent_auth_headers(
                 api_key=config.api_key,
                 workspace_id=config.workspace_id,
-                service_key=config.service_key,
             )
             response = http_get(url, headers, timeout)
             status = response.get("status")
@@ -254,19 +251,18 @@ def _lookup_workspace_connection(
     if row is None:
         return None
     if owner["type"] == "user":
-        return _lookup_user_connection_material(client, slug, row)
+        return _lookup_user_connection_material(client, row)
     return _lookup_agent_connection_material(client, slug, row)
 
 
 def _lookup_user_connection_material(
     client: AgentAuth,
-    slug: str,
     row: WorkspaceConnection,
 ) -> str | None:
     if row.kind == "secret":
-        return client.read_user_secret(slug)
+        return client.read_user_secret_for_connection(row)
     if row.kind == "oauth2":
-        return client.read_user_access_token(slug)
+        return client.read_user_access_token_for_connection(row)
     return None
 
 
@@ -429,7 +425,6 @@ def resolve_agent_auth_context(
         principal_id=resolve_owner_id({"type": "user"}, identity, config.deployment_id),
         api_key=config.api_key,
         workspace_id=config.workspace_id,
-        service_key=config.service_key,
     )
 
 
@@ -443,13 +438,11 @@ def _resolve_agent_auth_config(env: Mapping[str, str] | None) -> _AgentAuthConfi
         raise CredentialStoreError(
             f"connections are not configured: {_WORKSPACE_ID_ENV} is not set"
         )
-    service_key = (resolved.get("MDA_AGENT_AUTH_SERVICE_KEY") or "").strip() or None
     return _AgentAuthConfig(
         base_url=resolve_agent_auth_base_url(resolved),
         api_key=api_key,
         deployment_id=(resolved.get(DEPLOYMENT_ID_ENV) or "").strip() or None,
         workspace_id=workspace_id,
-        service_key=service_key,
     )
 
 

managed_deepagents/_credential_gate.py

@@ -190,9 +190,9 @@ def _read_user_connection_grants(
             raise CredentialStoreError(f"workspace connection {slug!r} is not configured")
         kind: Literal["oauth2", "secret"] = "secret" if row.kind == "secret" else "oauth2"
         token = (
-            agent_auth.read_user_secret(slug)
+            agent_auth.read_user_secret_for_connection(row)
             if kind == "secret"
-            else agent_auth.read_user_access_token(slug)
+            else agent_auth.read_user_access_token_for_connection(row)
         )
         grants.append(_UserConnectionGrant(slug=slug, kind=kind, token=token))
     return grants

managed_deepagents/_identity_auth.py

@@ -124,6 +124,9 @@ CONNECTOR_EVENTS_PATH_SUFFIX = "/events"
 CHANNEL_EVENTS_USER = "mda:channel-events"
 CHANNEL_SERVICE_USER = "mda:channel"
 
+#: Owner-key namespace for threads owned by a channel source conversation.
+CHANNEL_THREAD_OWNER_PREFIX = "mda:source-thread:"
+
 _BUILTIN_CHANNEL_SOURCE_PROVIDERS = frozenset({"slack", "github"})
 
 
@@ -203,16 +206,20 @@ def build_managed_auth(identity: IdentityDefinitionLike) -> AuthInstance:
         return await _authenticate(cfg, http, auth_cls, headers, authorization, path, method)
 
     async def scope_threads(ctx: object, value: object) -> Mapping[str, str] | None:
-        # Studio is deliberately not exempt from thread ownership. Studio
-        # identity is reachable by any holder of a workspace LangSmith API key
-        # (the Agent Server honours ``x-auth-scheme: langsmith``), so unscoping
-        # it would let that key read and write every caller's threads. Under
-        # ``mda dev`` the generated ``langgraph.json`` disables the Studio
-        # scheme, so local Studio arrives as the local-dev service principal and
-        # stays unscoped through the check below.
+        # Let Studio inspect every deployment thread so channel-triggered runs
+        # and their interrupts are visible there. Keep mutations owner-scoped:
+        # Studio identity is reachable by any holder of a workspace LangSmith
+        # API key, so exempting all actions would let that key alter caller
+        # threads too.
         user = getattr(ctx, "user", ctx)
         if is_local_dev_unscoped_user(user):
             return None
+        if (
+            is_studio_user is not None
+            and is_studio_user(user)
+            and getattr(ctx, "action", "") in {"read", "search"}
+        ):
+            return None
         key = _thread_owner_key(user)
         if isinstance(value, dict):
             payload = cast("JsonObject", value)
@@ -660,15 +667,50 @@ def _has_valid_ingress_secret(headers: Mapping[str, object]) -> bool:
 def _thread_owner_key(user: object) -> str:
     """Derive the owner value ``@auth.on.threads`` filters on.
 
+    A managed channel thread is owned by its source conversation; every other
+    caller owns its threads by user id. Channel threads are addressed by
+    ``source_thread_key`` and the deliveries that reach one can legitimately
+    carry different principals: the Trigger Server does not attach
+    ``identity_context`` to every envelope, and any participant may reply in a
+    shared thread or answer an interrupt someone else raised. Keying such a
+    thread on the delivering principal denies every later delivery that does
+    not match.
+
+    Only managed ingress sets both source stamps, and only over a trusted
+    loopback credential — a client presenting them is rejected in
+    :func:`_reject_untrusted_handoff_headers`. ``mda_user_id`` still carries the
+    principal, so credential resolution and store scoping stay per caller.
+
     Principals resolved by ``authenticate`` always carry ``mda_user_id``. A
     Studio user does not: the Agent Server builds it for
     ``x-auth-scheme: langsmith`` without consulting managed auth, so it exposes
     only ``identity``. Fall back to that rather than bucketing every such caller
     under an empty owner.
     """
+    conversation = _channel_conversation_owner_key(user)
+    if conversation is not None:
+        return conversation
     return str(_field(user, "mda_user_id") or _field(user, "identity") or "")
 
 
+def _channel_conversation_owner_key(user: object) -> str | None:
+    """Owner key for a channel ingress caller, or ``None`` for anyone else.
+
+    The prefix keeps conversation owners in a namespace no ``mda_user_id`` can
+    reach (those are UUIDs, emails, or ``mda:*`` service ids), so a source
+    thread key can never collide with a caller.
+    """
+    provider = _trimmed_stamp(_field(user, "mda_source_provider"))
+    thread_key = _trimmed_stamp(_field(user, "mda_source_thread_id"))
+    if not provider or not thread_key:
+        return None
+    return f"{CHANNEL_THREAD_OWNER_PREFIX}{provider}:{thread_key}"
+
+
+def _trimmed_stamp(value: object) -> str:
+    return value.strip() if isinstance(value, str) else ""
+
+
 #: LangGraph Store namespace prefix for Slack ↔ actor account links.
 IDENTITY_LINKS_STORE_PREFIX = "mda_identity_links"
 

managed_deepagents/_ingress.py

@@ -19,7 +19,6 @@ from managed_deepagents._channels.assistant_text import extract_assistant_text
 from managed_deepagents._channels.binding import CHANNEL_BINDING_KEY, ChannelBinding
 from managed_deepagents._channels.types import ChannelError
 from managed_deepagents._identity_auth import (
-    CHANNEL_SERVICE_USER,
     HANDOFF_SECRET_ENV,
     HANDOFF_SECRET_HEADER,
     INGRESS_SECRET_ENV,
@@ -73,6 +72,7 @@ class ObservedIngressRun(TypedDict):
 class _IngressSource(TypedDict):
     provider: str
     thread_key: str
+    user_id: str
 
 
 class _ThreadsClient(Protocol):
@@ -165,8 +165,8 @@ async def ingress_source_thread_exists(
 ) -> bool:
     """True when an MDA thread already exists for this source-thread key.
 
-    Call with the **resolved** actor (post identity remap) so ownership matches
-    the thread created on the first run.
+    The thread is owned by the source conversation rather than by the caller, so
+    this answers "is the agent already in this thread" for any participant.
     """
     if not _has_loopback_credential():
         return False
@@ -236,10 +236,18 @@ async def start_ingress_agent(
     messages: list[dict[str, object]],
     source_provider: str,
     source_thread_key: str,
+    user_id: str,
 ) -> StartedIngressRun:
-    """Create a Trigger-addressed thread and enqueue its run."""
+    """Create a Trigger-addressed thread and enqueue its run.
+
+    ``user_id`` is the Agent Auth principal UUID from Trigger ``identity_context``.
+    """
     client = _create_trigger_ingress_loopback_client(
-        {"provider": source_provider, "thread_key": source_thread_key}
+        {
+            "provider": source_provider,
+            "thread_key": source_thread_key,
+            "user_id": user_id,
+        }
     )
     await client.threads.create(
         thread_id=thread_id,
@@ -268,10 +276,18 @@ async def resume_ingress_agent(
     resume: dict[str, object],
     source_provider: str,
     source_thread_key: str,
+    user_id: str,
 ) -> StartedIngressRun:
-    """Resume a Trigger-addressed thread with a keyed interrupt response."""
+    """Resume a Trigger-addressed thread with a keyed interrupt response.
+
+    ``user_id`` is the Agent Auth principal UUID from Trigger ``identity_context``.
+    """
     client = _create_trigger_ingress_loopback_client(
-        {"provider": source_provider, "thread_key": source_thread_key}
+        {
+            "provider": source_provider,
+            "thread_key": source_thread_key,
+            "user_id": user_id,
+        }
     )
     run = await client.runs.create(
         thread_id,
@@ -292,9 +308,18 @@ async def observe_ingress_agent(
     *,
     thread_id: str,
     run_id: str,
+    source_provider: str,
+    source_thread_key: str,
+    user_id: str,
 ) -> ObservedIngressRun:
-    """Join an accepted run and read its terminal status."""
-    client = _create_trigger_ingress_loopback_client()
+    """Join an accepted run as the principal that owns its thread."""
+    client = _create_trigger_ingress_loopback_client(
+        {
+            "provider": source_provider,
+            "thread_key": source_thread_key,
+            "user_id": user_id,
+        }
+    )
     values = await client.runs.join(thread_id, run_id)
     run = await client.runs.get(thread_id, run_id)
     status = run.get("status") if isinstance(run, Mapping) else None
@@ -312,7 +337,7 @@ async def observe_ingress_agent(
 
 
 def _create_trigger_ingress_loopback_client(
-    source: _IngressSource | None = None,
+    source: _IngressSource,
 ) -> _IngressLoopbackClient:
     api_key = os.environ.get(LANGCHAIN_API_KEY_ENV, "").strip()
     if not api_key:
@@ -322,10 +347,17 @@ def _create_trigger_ingress_loopback_client(
         )
     module = import_module("langgraph_sdk")
     get_client = cast("_GetClient", module.get_client)
-    headers = {USER_HEADER: CHANNEL_SERVICE_USER}
-    if source is not None:
-        headers[SOURCE_PROVIDER_HEADER] = source["provider"]
-        headers[SOURCE_THREAD_HEADER] = source["thread_key"]
+    user_id = source["user_id"].strip()
+    if not user_id:
+        raise ChannelError(
+            "channel_run_failed",
+            "channel run requires an identity_context principal",
+        )
+    headers = {
+        USER_HEADER: user_id,
+        SOURCE_PROVIDER_HEADER: source["provider"],
+        SOURCE_THREAD_HEADER: source["thread_key"],
+    }
     return get_client(
         url=resolve_loopback_api_url(),
         api_key=api_key,

{managed_deepagents-0.6.2.dev34.dist-info → managed_deepagents-0.6.2.dev36.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: managed-deepagents
-Version: 0.6.2.dev34
+Version: 0.6.2.dev36
 Summary: Managed Deep Agents — the define_deep_agent authoring interface plus the CLI that compiles and deploys a code-first Deep Agent repository to a managed LangGraph runtime.
 Author: LangChain
 License: MIT
@@ -282,7 +282,9 @@ when a grant is missing. `mda dev` has no deployment to hold user grants, so
 a user-owned connection fails there with an actionable error; deploy the agent
 to exercise one.
 
-Provision workspace connections with `mda connections create` before deploy.
+Deploy the project first, then provision its connections with
+`mda connections create`. Agent-owned opaque secrets are scoped to that
+deployment, so the command refuses to create one before `mda deploy`.
 `mda connections check` verifies manifest slugs exist in the workspace.
 
 Use `include_tools` or `exclude_tools` inside a server config to select a

{managed_deepagents-0.6.2.dev34.dist-info → managed_deepagents-0.6.2.dev36.dist-info}/RECORD

@@ -1,20 +1,20 @@
 managed_deepagents/__init__.py,sha256=RezkpgYxCcywj6_W7Nk3PN9TMBfYyFgIatxGrIeY8V4,1862
 managed_deepagents/__main__.py,sha256=GcjmqN0Ea5v8OHKMxYToasm3eCX_doSLOlpEzAi1tAw,67
-managed_deepagents/_agent_auth.py,sha256=3rA39j_3PFROrtsIr5OHkAO_FgAHfASM-ee0vGhPGu8,16650
-managed_deepagents/_agent_auth_http.py,sha256=DtspEFmWHTtpp3uqELw1-wuHiLbAx_ers9JW18J3Coc,3924
+managed_deepagents/_agent_auth.py,sha256=bOxTT1ZX9BZZyvgIaxd9SZycbEaQl-HuCrPieCAv6G0,17258
+managed_deepagents/_agent_auth_http.py,sha256=aCYn7Rrtw3cnK3r4ir4JWxwzFkb7cF7nBgPpNdydxDw,5108
 managed_deepagents/_channel.py,sha256=-Og7QOM1yvV-yeTDOfv2CxXpR2HLY4xdX1bLrIsPi5k,5272
 managed_deepagents/_cli.py,sha256=jVaw2i1ysdRoWziMdPFmRXtKry_baYGRspyzyIeGWoU,1688
-managed_deepagents/_connections.py,sha256=N6luj1YMpBPjpH-WnGc6AIGNTE9DnZoBWAlWcFRSo2I,16518
+managed_deepagents/_connections.py,sha256=VwVBwM4T0rp1MgYu9D8QjGj1ireYeEuP3VIAFN5urFY,16246
 managed_deepagents/_connector.py,sha256=Syp0SRs1oFCUUltIUmZbSNi1Ys_PxObVdiAi-I9GBzs,8040
 managed_deepagents/_cors.py,sha256=V96RPrqewdRWG5RpEMEBnPuRq9_zF8nf4vf99k5dkuI,7597
-managed_deepagents/_credential_gate.py,sha256=WlryhbWHtg1FN5IdadiOvgT3JX3G78DtWVGW0wLWvz4,12252
+managed_deepagents/_credential_gate.py,sha256=SNxXunqmHgjBsZpiZu8yp49YkRIO0amkl0-7GHLGnIg,12280
 managed_deepagents/_eval_filesystem.py,sha256=1nuD0yn3gh19JrWNocWyPFyeJW42E7Gse3XRWCUSTAA,1399
 managed_deepagents/_extension.py,sha256=x2H1S8inkvTZQ_dr7kq0M8o8rre1FjzCDvMzItw4iyk,5318
-managed_deepagents/_identity_auth.py,sha256=BydhEhqxkb9mUg04hBZlGeyxzlKAogrMfu-r4X_bzdU,30983
+managed_deepagents/_identity_auth.py,sha256=l0t0Xx-J1-z_Zw4K5D-B2yV6lNdeJgOw7UvxODxUxZQ,32798
 managed_deepagents/_identity_http.py,sha256=aVQfZr7UKQoXF1Dry3p9fzXIj1882sEa668rvhn37i0,16029
 managed_deepagents/_identity_links.py,sha256=Z1H2Seo2KaI-vcdU3_PGM-F06wOz0IQqUP-28wqiQsA,9172
 managed_deepagents/_identity_runtime.py,sha256=vsshj0TNWd-rXUhVsPAqXIkANunQT7jI94CWgzq-1cY,24409
-managed_deepagents/_ingress.py,sha256=mPIb1o60G_pCg4Qotwt-SUloCxY1xXfUTSyN_BPZNts,11581
+managed_deepagents/_ingress.py,sha256=iqsGm2jZKKn0FqjNn2nJAlR7d-IqCpVKWo6NbMEhjxw,12323
 managed_deepagents/_log.py,sha256=oYwOO0ZL4-INkge9YJvtLuCxL9zAtgjSPIggVbkcyc8,2932
 managed_deepagents/_loopback.py,sha256=hQ1oNi77XpdUjzZURSBRoMvJ1mGCs-STobfBftGmXuE,2409
 managed_deepagents/_managed_middleware.py,sha256=cfInVHTVjWoy_DBoFlnslfrDf2_n6llGnTGasta4AIo,10295
@@ -28,7 +28,7 @@ managed_deepagents/py.typed,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
 managed_deepagents/runtime.py,sha256=B4iKTJZD0zXx_MZ09pqQFOkVo07tqJDT3qvOBr-0iOk,65782
 managed_deepagents/sandbox.py,sha256=xlpcWa6CoVX6GKip2nK-0Lw-HBCoFGFYm0r4x9eYwcY,2530
 managed_deepagents/schedules.py,sha256=MtTQN4tlm1NizFDCjZZv_huGfbQx-dj9WP1dIBybCug,5237
-managed_deepagents/_binaries/mda.exe,sha256=XsmY2FZEeZ4zFKjZ2uAL0VWIbYEJYKu66n6rKEihWuE,3855872
+managed_deepagents/_binaries/mda.exe,sha256=beXeCdpeh0KOXNrpeg-iudNWEv54xwLyOp0XVkL6MyA,3855360
 managed_deepagents/_channels/__init__.py,sha256=Z6eXmzaLxG09DSyJoY_CX34axcsBo9gSJ0G7pRm2D6M,1216
 managed_deepagents/_channels/assistant_text.py,sha256=f-Z3J3PlQFXZHztgBxlRoqB2LigU1Hj1YpwoXBMTR18,2171
 managed_deepagents/_channels/binding.py,sha256=6vAKbWpg-eyLErJ0SsozH4mZc50hA1NhquM63mVmWDQ,3423
@@ -50,8 +50,9 @@ managed_deepagents/_channels/slack/transport.py,sha256=_xQmzK2hBpPOoY3zKFhzc3vvl
 managed_deepagents/_channels/trigger/__init__.py,sha256=bWj66XoPbDdrztPUCKBuSJBBS2pBocn4EA8FDE3WeBA,48
 managed_deepagents/_channels/trigger/channel.py,sha256=rKSvOABOZX58ZIvZ3hKcYxvTx9npQ0YXPQWk9JEy6XE,5108
 managed_deepagents/_channels/trigger/client.py,sha256=cM97gzYWUTFC9o3uoveFe9-HxZc6_VqiqC8u4fKqjXc,8572
-managed_deepagents/_channels/trigger/http.py,sha256=L5ILylDH0BXO5MAfHpXGF742vfCxnRhGLNbLn5kQUCY,12303
-managed_deepagents/_channels/trigger/types.py,sha256=G4kW1zKV2JlNyV7evGra-lSrZ_ZpVsRQm2iSx0iLEGE,6277
+managed_deepagents/_channels/trigger/http.py,sha256=O8yMleioXj3s5QXj7jK-HpUpiSFppjfRjHJ2tdfX0Is,16205
+managed_deepagents/_channels/trigger/identity_context.py,sha256=oo6sgtNDLGGkZCzrkrifMHkkAqxj7ui2HgUUdjNA1iU,7701
+managed_deepagents/_channels/trigger/types.py,sha256=42JMOFXP9MfqwQ66SFlAiwC7q_AnNIJXBts3sAujxac,6625
 managed_deepagents/_connectors/__init__.py,sha256=c_SdH3T7T6bgX7-I5jxAqDzHojmqVUCX0AXRI7g5Ovs,575
 managed_deepagents/_connectors/tool_selection.py,sha256=xMvohEvg_rguQvziUXzxKn4V140mmearZHel97F8tVs,2978
 managed_deepagents/_connectors/mcp/__init__.py,sha256=3AL429g5djYEYuiuSqsxj2VESpTkyU2NeBIJsHlWVk4,11162
@@ -68,9 +69,9 @@ managed_deepagents/identity/__init__.py,sha256=Slm-oEqKxbaZEQsMqHfD3LbG5M4vH2lKU
 managed_deepagents/identity/claims.py,sha256=prby7r_8Lww3MmoBm8PX6PsSGE3GwSHkr8mVIz_08nU,1180
 managed_deepagents/identity/options.py,sha256=x_yMbXEFR7zXyehEjDHG2qjAlukXjrRBcQLcM6IndLM,2550
 managed_deepagents/identity/supabase.py,sha256=8uobl3WCrQL_ieSXG8KTLf1th7Qjim9liZT50HeaJE0,6026
-managed_deepagents-0.6.2.dev34.dist-info/licenses/LICENSE,sha256=WnPZQQ608ojZUkXl7BW6VbKloIAibZiGm1K6cjeZOL8,1066
-managed_deepagents-0.6.2.dev34.dist-info/METADATA,sha256=WTv8_E_fBXtTODOPUqUrNf0qcaK01ym-dPnhOonzF3E,13582
-managed_deepagents-0.6.2.dev34.dist-info/WHEEL,sha256=3I5VVWZdsFlU417aCS2bMRuerS8wsfvBq99MyatBV3A,97
-managed_deepagents-0.6.2.dev34.dist-info/entry_points.txt,sha256=ziZqkKuaDO3qHCjKmBhrx9cm3ok8bZ9xcEDpUTj4unM,53
-managed_deepagents-0.6.2.dev34.dist-info/top_level.txt,sha256=fdBo4O0Hlol_w022tTLB5ftZpamb4yJoQ3MUvjgTGfA,19
-managed_deepagents-0.6.2.dev34.dist-info/RECORD,,
+managed_deepagents-0.6.2.dev36.dist-info/licenses/LICENSE,sha256=WnPZQQ608ojZUkXl7BW6VbKloIAibZiGm1K6cjeZOL8,1066
+managed_deepagents-0.6.2.dev36.dist-info/METADATA,sha256=TcDnuQedflv-AcffJe1UoQkL5yvtwtfI4V6gfMrnqag,13709
+managed_deepagents-0.6.2.dev36.dist-info/WHEEL,sha256=3I5VVWZdsFlU417aCS2bMRuerS8wsfvBq99MyatBV3A,97
+managed_deepagents-0.6.2.dev36.dist-info/entry_points.txt,sha256=ziZqkKuaDO3qHCjKmBhrx9cm3ok8bZ9xcEDpUTj4unM,53
+managed_deepagents-0.6.2.dev36.dist-info/top_level.txt,sha256=fdBo4O0Hlol_w022tTLB5ftZpamb4yJoQ3MUvjgTGfA,19
+managed_deepagents-0.6.2.dev36.dist-info/RECORD,,