managed-deepagents 0.6.2.dev3__py3-none-win_amd64.whl → 0.6.2.dev5__py3-none-win_amd64.whl

managed_deepagents/_cors.py

@@ -9,11 +9,12 @@ and other built-ins are not double-headed.
 :data:`MDA_PUBLIC_APP_URL_ENV` plus optional :data:`MDA_CORS_ORIGINS_ENV`.
 
 Subdomain policy: an allowlisted origin also permits **one** DNS label beneath
-it (e.g. Cloudflare Pages previews under a project apex). Deeper nesting is
-rejected. With ``allow_credentials=True``, do not put hosts that issue
-attacker-reachable subdomains into :data:`MDA_CORS_ORIGINS_ENV` / the public
-app URL — a malicious page on such a subdomain could read credentialed
-``/connectors`` and ``/channels`` responses.
+it (e.g. Cloudflare Pages previews under a project apex) **on the same scheme**.
+Deeper nesting is rejected, and ``http://`` is never reflected for an
+``https://`` allowlist entry (or the reverse). With ``allow_credentials=True``,
+do not put hosts that issue attacker-reachable subdomains into
+:data:`MDA_CORS_ORIGINS_ENV` / the public app URL — a malicious page on such a
+subdomain could read credentialed ``/connectors`` and ``/channels`` responses.
 """
 
 from __future__ import annotations
@@ -96,9 +97,10 @@ def _is_single_subdomain(request_host: str, allowed_host: str) -> bool:
 def match_cors_origin(request_origin: str, allowlist: list[str]) -> str | None:
     """Return ``request_origin`` when allowed, otherwise ``None``.
 
-    Mirrors TypeScript ``matchCorsOrigin`` (exact host or one subdomain label).
-    Starlette has no origin callback, so production uses
-    :func:`_cors_origin_regex` instead; keep this helper for tests / policy parity.
+    Mirrors TypeScript ``matchCorsOrigin`` (exact origin, or one subdomain
+    label on the same scheme). Starlette has no origin callback, so production
+    uses :func:`_cors_origin_regex` instead; keep this helper for tests / policy
+    parity.
     """
     parsed = urlparse(request_origin)
     if not parsed.scheme or not parsed.netloc:
@@ -108,8 +110,9 @@ def match_cors_origin(request_origin: str, allowlist: list[str]) -> str | None:
         return origin
     request_host = parsed.netloc
     for allowed in allowlist:
-        allowed_host = urlparse(allowed).netloc
-        if not allowed_host:
+        allowed_parsed = urlparse(allowed)
+        allowed_host = allowed_parsed.netloc
+        if not allowed_host or parsed.scheme != allowed_parsed.scheme:
             continue
         if request_host == allowed_host or _is_single_subdomain(request_host, allowed_host):
             return origin

managed_deepagents/_identity_http.py

@@ -42,7 +42,7 @@ from managed_deepagents.identity import (
     RuntimeIdentity,
 )
 
-CHANNEL_EVENTS_MAX_BODY_BYTES = 1024 * 1024
+EVENTS_MAX_BODY_BYTES = 1024 * 1024
 
 RouteResult = object | Awaitable[object]
 PublicRouteHandler = Callable[[HttpRequestLike], RouteResult]
@@ -204,9 +204,9 @@ def _channel_events_route(
         if not callable(events):
             raise TypeError(f'channel "{name}" is missing events')
         try:
-            raw_body = await _read_limited_channel_body(request)
+            raw_body = await _read_limited_events_body(request)
             if raw_body is None:
-                return responses.PlainTextResponse("Payload Too Large", status_code=413)
+                return responses.JSONResponse({"error": "payload too large"}, status_code=413)
             result = events(
                 {
                     "name": name,
@@ -225,12 +225,12 @@ def _channel_events_route(
     return cast("StarletteRoute", routing.Route(path, events_handler, methods=["POST"]))
 
 
-async def _read_limited_channel_body(request: HttpRequestLike) -> bytes | None:
+async def _read_limited_events_body(request: HttpRequestLike) -> bytes | None:
     stream = getattr(request, "stream", None)
     if not callable(stream):
         body_method = getattr(request, "body", None)
         body = await body_method() if callable(body_method) else b""
-        if isinstance(body, bytes) and len(body) <= CHANNEL_EVENTS_MAX_BODY_BYTES:
+        if isinstance(body, bytes) and len(body) <= EVENTS_MAX_BODY_BYTES:
             return body
         return None
 
@@ -238,7 +238,7 @@ async def _read_limited_channel_body(request: HttpRequestLike) -> bytes | None:
     size = 0
     async for chunk in stream():
         size += len(chunk)
-        if size > CHANNEL_EVENTS_MAX_BODY_BYTES:
+        if size > EVENTS_MAX_BODY_BYTES:
             return None
         chunks.append(chunk)
     return b"".join(chunks)
@@ -261,22 +261,28 @@ def _connector_events_route(
     )
 
     async def events_handler(request: HttpRequestLike) -> object:
-        body_method = getattr(request, "body", None)
-        raw_body = await body_method() if callable(body_method) else b""
+        responses = import_module("starlette.responses")
         events = getattr(connector, "events", None)
         if not callable(events):
             raise TypeError(f'connector "{name}" is missing events')
-        result = events(
-            {
-                "name": name,
-                "request": request,
-                "raw_body": raw_body,
-                "connector": connector,
-            }
-        )
-        if inspect.isawaitable(result):
-            result = await result
-        return result
+        try:
+            raw_body = await _read_limited_events_body(request)
+            if raw_body is None:
+                return responses.JSONResponse({"error": "payload too large"}, status_code=413)
+            result = events(
+                {
+                    "name": name,
+                    "request": request,
+                    "raw_body": raw_body,
+                    "connector": connector,
+                }
+            )
+            if inspect.isawaitable(result):
+                result = await result
+            return result
+        except Exception as error:  # noqa: BLE001 - log a safe label, keep the HTTP body opaque
+            logger.error("POST %s failed (%s)", path, logger.safe_error_label(error))
+            return responses.JSONResponse({"error": "internal error"}, status_code=500)
 
     return cast("StarletteRoute", routing.Route(path, events_handler, methods=["POST"]))
 

{managed_deepagents-0.6.2.dev3.dist-info → managed_deepagents-0.6.2.dev5.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: managed-deepagents
-Version: 0.6.2.dev3
+Version: 0.6.2.dev5
 Summary: Managed Deep Agents — the define_deep_agent authoring interface plus the CLI that compiles and deploys a code-first Deep Agent repository to a managed LangGraph runtime.
 Author: LangChain
 License: MIT

{managed_deepagents-0.6.2.dev3.dist-info → managed_deepagents-0.6.2.dev5.dist-info}/RECORD

@@ -3,11 +3,11 @@ managed_deepagents/__main__.py,sha256=GcjmqN0Ea5v8OHKMxYToasm3eCX_doSLOlpEzAi1tA
 managed_deepagents/_channel.py,sha256=-Og7QOM1yvV-yeTDOfv2CxXpR2HLY4xdX1bLrIsPi5k,5272
 managed_deepagents/_cli.py,sha256=jVaw2i1ysdRoWziMdPFmRXtKry_baYGRspyzyIeGWoU,1688
 managed_deepagents/_connector.py,sha256=Syp0SRs1oFCUUltIUmZbSNi1Ys_PxObVdiAi-I9GBzs,8040
-managed_deepagents/_cors.py,sha256=MKT5DQwIhCpHDOcb6RwR1XIJBsrWRbUwh0t0Q9Ur5oc,7377
+managed_deepagents/_cors.py,sha256=V96RPrqewdRWG5RpEMEBnPuRq9_zF8nf4vf99k5dkuI,7597
 managed_deepagents/_eval_filesystem.py,sha256=1nuD0yn3gh19JrWNocWyPFyeJW42E7Gse3XRWCUSTAA,1399
 managed_deepagents/_extension.py,sha256=x2H1S8inkvTZQ_dr7kq0M8o8rre1FjzCDvMzItw4iyk,5318
 managed_deepagents/_identity_auth.py,sha256=M8SHwh18aQhf8QEgVfLiX0vaH6kBqW3Ic0nmuEffjrE,26866
-managed_deepagents/_identity_http.py,sha256=MuqhmBxkW5tnXN_Nv3NJHzIqlOHpFG7JIpMGNbnK76c,15598
+managed_deepagents/_identity_http.py,sha256=aVQfZr7UKQoXF1Dry3p9fzXIj1882sEa668rvhn37i0,16029
 managed_deepagents/_identity_links.py,sha256=Z1H2Seo2KaI-vcdU3_PGM-F06wOz0IQqUP-28wqiQsA,9172
 managed_deepagents/_identity_runtime.py,sha256=9-8y7OYn2dbiYiWUjLpv-v9cA_Q3bxoPlJtogdnBdCQ,10500
 managed_deepagents/_ingress.py,sha256=mPIb1o60G_pCg4Qotwt-SUloCxY1xXfUTSyN_BPZNts,11581
@@ -24,7 +24,7 @@ managed_deepagents/py.typed,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
 managed_deepagents/runtime.py,sha256=vRAFLVxoYKW-MA8C8aei-23NpS-0MRgjSn4WhezFAR8,64712
 managed_deepagents/sandbox.py,sha256=xlpcWa6CoVX6GKip2nK-0Lw-HBCoFGFYm0r4x9eYwcY,2530
 managed_deepagents/schedules.py,sha256=MtTQN4tlm1NizFDCjZZv_huGfbQx-dj9WP1dIBybCug,5237
-managed_deepagents/_binaries/mda.exe,sha256=_NOUU5mwn_jvsSjZsTeaOPjUsnWxnpUi6MuXmDGVydQ,3744768
+managed_deepagents/_binaries/mda.exe,sha256=-wv6PdXRem67zG6ZDNvX9rqwlbVp9qJm_e3kwkY9YLk,3746816
 managed_deepagents/_channels/__init__.py,sha256=Z6eXmzaLxG09DSyJoY_CX34axcsBo9gSJ0G7pRm2D6M,1216
 managed_deepagents/_channels/assistant_text.py,sha256=f-Z3J3PlQFXZHztgBxlRoqB2LigU1Hj1YpwoXBMTR18,2171
 managed_deepagents/_channels/binding.py,sha256=6vAKbWpg-eyLErJ0SsozH4mZc50hA1NhquM63mVmWDQ,3423
@@ -64,9 +64,9 @@ managed_deepagents/identity/__init__.py,sha256=7qfGbOfQf4-5EQT6Ssrf8_CRhkihr-ENf
 managed_deepagents/identity/claims.py,sha256=prby7r_8Lww3MmoBm8PX6PsSGE3GwSHkr8mVIz_08nU,1180
 managed_deepagents/identity/options.py,sha256=x_yMbXEFR7zXyehEjDHG2qjAlukXjrRBcQLcM6IndLM,2550
 managed_deepagents/identity/supabase.py,sha256=8uobl3WCrQL_ieSXG8KTLf1th7Qjim9liZT50HeaJE0,6026
-managed_deepagents-0.6.2.dev3.dist-info/licenses/LICENSE,sha256=WnPZQQ608ojZUkXl7BW6VbKloIAibZiGm1K6cjeZOL8,1066
-managed_deepagents-0.6.2.dev3.dist-info/METADATA,sha256=XCAP38CV8pG50t8CcpfW_PvDlf48BYDLPYHcByrpCEk,12848
-managed_deepagents-0.6.2.dev3.dist-info/WHEEL,sha256=3I5VVWZdsFlU417aCS2bMRuerS8wsfvBq99MyatBV3A,97
-managed_deepagents-0.6.2.dev3.dist-info/entry_points.txt,sha256=ziZqkKuaDO3qHCjKmBhrx9cm3ok8bZ9xcEDpUTj4unM,53
-managed_deepagents-0.6.2.dev3.dist-info/top_level.txt,sha256=fdBo4O0Hlol_w022tTLB5ftZpamb4yJoQ3MUvjgTGfA,19
-managed_deepagents-0.6.2.dev3.dist-info/RECORD,,
+managed_deepagents-0.6.2.dev5.dist-info/licenses/LICENSE,sha256=WnPZQQ608ojZUkXl7BW6VbKloIAibZiGm1K6cjeZOL8,1066
+managed_deepagents-0.6.2.dev5.dist-info/METADATA,sha256=jJk-jx_i4yXR7vlikPQM68V2V-BeU2Ps19FSwlNcsKs,12848
+managed_deepagents-0.6.2.dev5.dist-info/WHEEL,sha256=3I5VVWZdsFlU417aCS2bMRuerS8wsfvBq99MyatBV3A,97
+managed_deepagents-0.6.2.dev5.dist-info/entry_points.txt,sha256=ziZqkKuaDO3qHCjKmBhrx9cm3ok8bZ9xcEDpUTj4unM,53
+managed_deepagents-0.6.2.dev5.dist-info/top_level.txt,sha256=fdBo4O0Hlol_w022tTLB5ftZpamb4yJoQ3MUvjgTGfA,19
+managed_deepagents-0.6.2.dev5.dist-info/RECORD,,