managed-deepagents 0.6.2.dev5__py3-none-win_amd64.whl → 0.6.2.dev7__py3-none-win_amd64.whl

managed_deepagents/__init__.py

@@ -9,12 +9,19 @@ This package provides two things:
 
 Resources use ``define_*`` factories while provider collections use namespaces:
 ``define_sandbox()``, ``channels.slack(...)``, ``connectors.mcp(...)``,
-and ``auth.supabase(...)``. Contributing a *new*
+``credentials.get(...)``, and ``auth.supabase(...)``. Contributing a *new*
 primitive is not part of the public surface.
 """
 
 from __future__ import annotations
 
+from managed_deepagents._credentials import (
+    CredentialAuthorizationRequiredError,
+    CredentialNotFoundError,
+    CredentialOwner,
+    CredentialStoreError,
+    credentials,
+)
 from managed_deepagents._managed_tools import (
     ManagedDeepAgentRuntime,
 )
@@ -31,6 +38,10 @@ from managed_deepagents.sandbox import SandboxDefinition
 from managed_deepagents.schedules import define_schedule
 
 __all__ = [
+    "CredentialAuthorizationRequiredError",
+    "CredentialNotFoundError",
+    "CredentialOwner",
+    "CredentialStoreError",
     "DeepAgentDefinition",
     "ManagedDeepAgentRuntime",
     "MemoryDefinition",
@@ -38,6 +49,7 @@ __all__ = [
     "auth",
     "channels",
     "connectors",
+    "credentials",
     "define_deep_agent",
     "define_identity",
     "define_memory",

managed_deepagents/_agent_auth.py

@@ -0,0 +1,260 @@
+"""Agent Auth client used by ``credentials.get`` and the pre-run credential gate.
+
+Talks to the shipped Agent Auth APIs (credentials + oauth-authorization-sessions),
+not the aspirational ``credentials/mint`` endpoint.
+"""
+
+from __future__ import annotations
+
+import urllib.parse
+from collections.abc import Mapping
+from dataclasses import dataclass
+from typing import Protocol, TypedDict
+
+from managed_deepagents._agent_auth_http import (
+    AGENT_AUTH_TIMEOUT_SECONDS,
+    CredentialStoreError,
+    agent_auth_credential_query,
+    agent_auth_headers,
+    request_agent_auth_json,
+)
+
+AGENT_AUTH_PROVIDER_PAGE_SIZE = 100
+AGENT_AUTH_MAX_PROVIDER_PAGES = 20
+
+_HTTP_BAD_REQUEST = 400
+_HTTP_NOT_FOUND = 404
+_HTTP_CONFLICT = 409
+
+__all__ = [
+    "AGENT_AUTH_TIMEOUT_SECONDS",
+    "AgentAuth",
+    "AgentAuthContext",
+    "AgentAuthUnknownProviderError",
+    "CredentialAuthorizationRequiredError",
+    "PendingAuthorization",
+]
+
+
+@dataclass(frozen=True)
+class AgentAuthContext:
+    base_url: str
+    #: Deployment id, passed to oauth-authorization-sessions as ``agent_id``.
+    agent_id: str
+    #: Authenticated caller, used as ``owner_id`` for user credentials.
+    principal_id: str
+    api_key: str | None = None
+    workspace_id: str | None = None
+
+
+class PendingAuthorization(TypedDict):
+    """One credential slug the caller has not granted, with its connect URL."""
+
+    slug: str
+    connect_url: str
+    auth_id: str
+
+
+class CredentialAuthorizationRequiredError(RuntimeError):
+    def __init__(self, slugs: list[str]) -> None:
+        super().__init__(
+            f"the caller has not connected: {', '.join(slugs)}. Declare the credential "
+            "on a connector so the pre-run gate can request it."
+        )
+        self.slugs = slugs
+
+
+class AgentAuthUnknownProviderError(RuntimeError):
+    def __init__(self, slug: str) -> None:
+        super().__init__(
+            f'Agent Auth has no OAuth provider registered for slug "{slug}". '
+            "Register the provider or fix the credential slug."
+        )
+        self.slug = slug
+
+
+class AgentAuthRequest(Protocol):
+    """HTTP surface bound onto :class:`AgentAuth` (method, path, optional JSON body)."""
+
+    def __call__(
+        self,
+        method: str,
+        path: str,
+        *,
+        body: dict[str, object] | None = None,
+    ) -> tuple[int, dict[str, object]]: ...
+
+
+class AgentAuth:
+    """Bound Agent Auth HTTP client. Headers, origin, and timeout live on the instance."""
+
+    def __init__(
+        self,
+        context: AgentAuthContext,
+        *,
+        request: AgentAuthRequest | None = None,
+        timeout: float = AGENT_AUTH_TIMEOUT_SECONDS,
+    ) -> None:
+        """Bind this client to a caller.
+
+        Args:
+            context: Caller/run identity and Agent Auth origin.
+            request: Testing only. Substitute for the default HTTP transport.
+            timeout: Testing only. Override the request budget in seconds.
+        """
+        self.context = context
+        self._timeout = timeout
+        self._request: AgentAuthRequest = request if request is not None else self._urlopen_json
+
+    def read_user_access_token(self, slug: str) -> str | None:
+        """Read the caller's OAuth access token without starting a session.
+
+        Reads never mint, so a caller can be probed repeatedly — on every replay
+        of an interrupted node, for instance — without leaving authorization
+        sessions behind.
+
+        Returns:
+            The access token, or ``None`` when the caller must connect.
+        """
+        credential_id = self.find_credential_id(
+            owner_type="user",
+            owner_id=self.context.principal_id,
+            kind="oauth2",
+            slug=slug,
+        )
+        if credential_id is None:
+            return None
+        return self._fetch_access_token(credential_id)
+
+    def start_authorization_session(self, slug: str) -> PendingAuthorization:
+        """Start an OAuth session for a slug the caller has not granted."""
+        provider_id = self.resolve_oauth_provider_id(slug)
+        status, body = self._request(
+            "POST",
+            "/v1/agent-auth/oauth-authorization-sessions",
+            body={
+                "provider_id": provider_id,
+                "principal_id": self.context.principal_id,
+                "agent_id": self.context.agent_id,
+            },
+        )
+        if status >= _HTTP_BAD_REQUEST:
+            raise CredentialStoreError(
+                "Agent Auth create oauth-authorization-session failed", status
+            )
+        auth_id = str(body.get("id") or "")
+        connect_url = str(body.get("verification_url") or "")
+        if not auth_id or not connect_url:
+            raise CredentialStoreError(
+                "Agent Auth oauth-authorization-session missing id or verification_url"
+            )
+        return {"slug": slug, "connect_url": connect_url, "auth_id": auth_id}
+
+    def resolve_oauth_provider_id(self, slug: str) -> str:
+        """oauth-providers has no slug filter, so the match is made across pages."""
+        cursor: str | None = None
+        for _ in range(AGENT_AUTH_MAX_PROVIDER_PAGES):
+            query = {"page_size": str(AGENT_AUTH_PROVIDER_PAGE_SIZE)}
+            if cursor:
+                query["cursor"] = cursor
+            status, body = self._request(
+                "GET", f"/v1/agent-auth/oauth-providers?{urllib.parse.urlencode(query)}"
+            )
+            if status >= _HTTP_BAD_REQUEST:
+                raise CredentialStoreError("Agent Auth list oauth-providers failed", status)
+            raw_items = body.get("items")
+            for item in raw_items if isinstance(raw_items, list) else []:
+                if isinstance(item, Mapping) and item.get("slug") == slug and item.get("id"):
+                    return str(item["id"])
+            next_cursor = body.get("next_cursor")
+            if not isinstance(next_cursor, str) or not next_cursor or next_cursor == cursor:
+                raise AgentAuthUnknownProviderError(slug)
+            cursor = next_cursor
+        raise CredentialStoreError("Agent Auth oauth-provider list returned too many pages")
+
+    def find_credential_id(
+        self,
+        *,
+        owner_type: str,
+        owner_id: str,
+        kind: str,
+        slug: str,
+    ) -> str | None:
+        """Find a credential id by slug.
+
+        The credential key is ``credential_id``, never ``id``.
+        """
+        query = agent_auth_credential_query(
+            owner_type=owner_type, owner_id=owner_id, kind=kind, slug=slug
+        )
+        status, body = self._request("GET", f"/v1/agent-auth/credentials?{query}")
+        if status >= _HTTP_BAD_REQUEST:
+            raise CredentialStoreError("Agent Auth list credentials failed", status)
+        items = body.get("items")
+        row = items[0] if isinstance(items, list) and items else None
+        credential_id = row.get("credential_id") if isinstance(row, Mapping) else None
+        return credential_id if isinstance(credential_id, str) else None
+
+    def read_secret(self, credential_id: str) -> str | None:
+        status, body = self._request(
+            "GET",
+            f"/v1/agent-auth/credentials/{_path_segment(credential_id)}/secret",
+        )
+        if status == _HTTP_NOT_FOUND:
+            return None
+        if status >= _HTTP_BAD_REQUEST:
+            raise CredentialStoreError("Agent Auth get secret failed", status)
+        secret = body.get("secret")
+        return secret if isinstance(secret, str) and secret else None
+
+    def _fetch_access_token(self, credential_id: str) -> str | None:
+        status, body = self._request(
+            "GET",
+            f"/v1/agent-auth/credentials/{_path_segment(credential_id)}/oauth2",
+        )
+        if _is_authorization_required(status, body):
+            return None
+        if status >= _HTTP_BAD_REQUEST:
+            raise CredentialStoreError("Agent Auth get oauth2 failed", status)
+        oauth2 = body.get("oauth2") if isinstance(body.get("oauth2"), dict) else body
+        token = oauth2.get("access_token") if isinstance(oauth2, dict) else None
+        return token if isinstance(token, str) and token else None
+
+    def _urlopen_json(
+        self,
+        method: str,
+        path: str,
+        *,
+        body: dict[str, object] | None = None,
+    ) -> tuple[int, dict[str, object]]:
+        if not self.context.base_url.startswith(("http://", "https://")):
+            raise ValueError("Agent Auth URL must be an http(s) URL")
+        return request_agent_auth_json(
+            method,
+            f"{self.context.base_url}{path}",
+            body=body,
+            headers=self._headers(),
+            timeout=self._timeout,
+        )
+
+    def _headers(self) -> dict[str, str]:
+        return agent_auth_headers(
+            api_key=self.context.api_key,
+            workspace_id=self.context.workspace_id,
+        )
+
+
+def _path_segment(value: str) -> str:
+    return urllib.parse.quote(value, safe="")
+
+
+def _is_authorization_required(status: int, body: dict[str, object]) -> bool:
+    """Agent Auth answers 409 when a stored grant has lapsed and needs re-auth."""
+    if status != _HTTP_CONFLICT:
+        return False
+    detail = str(body.get("detail") or body.get("title") or body.get("error") or "").lower()
+    return (
+        body.get("error") == "authorization_required"
+        or "authorization is required" in detail
+        or "oauth authorization" in detail
+    )

managed_deepagents/_agent_auth_http.py

@@ -0,0 +1,119 @@
+"""Shared Agent Auth HTTP transport and credential-list paging.
+
+Used by ``credentials.get`` and the credential gate so both talk to the same
+API with the same headers, redirect policy, and page walker.
+"""
+
+from __future__ import annotations
+
+import json
+import urllib.error
+import urllib.parse
+import urllib.request
+from collections.abc import Mapping
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from http.client import HTTPMessage
+    from typing import IO
+
+AGENT_AUTH_TIMEOUT_SECONDS = 10.0
+
+
+class CredentialStoreError(RuntimeError):
+    """Agent Auth could not answer.
+
+    Callers pass a fixed message: a response body can quote secret material, so
+    it never reaches this error, the logs, or the traceback chain.
+    """
+
+    def __init__(self, message: str, status: int | None = None) -> None:
+        self.status = status
+        super().__init__(message if status is None else f"{message} (status {status})")
+
+
+__all__ = [
+    "AGENT_AUTH_TIMEOUT_SECONDS",
+    "CredentialStoreError",
+    "agent_auth_credential_query",
+    "agent_auth_headers",
+    "request_agent_auth_json",
+]
+
+
+def agent_auth_credential_query(
+    *,
+    owner_type: str,
+    owner_id: str,
+    kind: str,
+    slug: str,
+) -> str:
+    """Query string that addresses one credential by its natural key."""
+    return urllib.parse.urlencode(
+        {"owner_type": owner_type, "owner_id": owner_id, "kind": kind, "slug": slug}
+    )
+
+
+def agent_auth_headers(
+    *,
+    api_key: str | None = None,
+    workspace_id: str | None = None,
+) -> dict[str, str]:
+    headers = {
+        "accept": "application/json",
+        "content-type": "application/json",
+        "x-langsmith-product": "mda",
+    }
+    resolved_api_key = (api_key or "").strip()
+    if resolved_api_key:
+        headers["x-api-key"] = resolved_api_key
+    resolved_workspace = (workspace_id or "").strip()
+    if resolved_workspace:
+        headers["x-tenant-id"] = resolved_workspace
+    return headers
+
+
+def _decode_json_object(raw: bytes) -> dict[str, object]:
+    try:
+        payload = json.loads(raw.decode("utf-8") or "{}")
+    except (UnicodeDecodeError, json.JSONDecodeError, ValueError):
+        return {}
+    return payload if isinstance(payload, dict) else {}
+
+
+class _NoRedirectHandler(urllib.request.HTTPRedirectHandler):
+    def redirect_request(
+        self,
+        req: urllib.request.Request,
+        fp: IO[bytes],
+        code: int,
+        msg: str,
+        headers: HTTPMessage,
+        newurl: str,
+    ) -> urllib.request.Request | None:
+        del req, fp, code, msg, headers, newurl
+        return None
+
+
+def request_agent_auth_json(
+    method: str,
+    url: str,
+    *,
+    body: Mapping[str, object] | None = None,
+    headers: Mapping[str, str],
+    timeout: float,
+) -> tuple[int, dict[str, object]]:
+    """Issue one Agent Auth HTTP call: no redirects, bounded timeout, JSON body."""
+    data = None if body is None else json.dumps(dict(body)).encode("utf-8")
+    request = urllib.request.Request(  # noqa: S310
+        url,
+        data=data,
+        headers=dict(headers),
+        method=method,
+    )
+    try:
+        opener = urllib.request.build_opener(_NoRedirectHandler())
+        with opener.open(request, timeout=timeout) as response:
+            return int(response.status), _decode_json_object(response.read())
+    except urllib.error.HTTPError as exc:
+        return int(exc.code), _decode_json_object(exc.read())

managed_deepagents/_connectors/mcp/__init__.py

@@ -9,7 +9,7 @@ name, before any managed ``{server}__`` prefix is applied.
 Example::
 
     # connectors/mcp.py
-    from managed_deepagents import connectors
+    from managed_deepagents import connectors, credentials
 
     connector = connectors.mcp(
         use_standard_content_blocks=True,
@@ -21,6 +21,11 @@ Example::
                 "url": "https://docs.example.com/mcp",
                 "include_tools": ["search", "fetch"],
             },
+            "notion": {
+                "transport": "http",
+                "url": "https://mcp.notion.com/mcp",
+                "credential": credentials.get("notion", {"type": "user"}),
+            },
         },
     )
 """
@@ -42,6 +47,7 @@ from pydantic import (
 
 from managed_deepagents._connector import Connector
 from managed_deepagents._connectors.mcp.load import load_managed_mcp_tools
+from managed_deepagents._credentials import CredentialReference  # noqa: TC001
 from managed_deepagents._extension import define_extension
 
 
@@ -53,6 +59,9 @@ class McpToolSelectionConfig(TypedDict, total=False):
 class RemoteMcpServerBaseConfig(McpToolSelectionConfig, total=False):
     url: str
     headers: dict[str, str]
+    #: Bearer credential: an agent owner is a deployment-wide secret read once
+    #: at load, a user owner is the caller's OAuth grant loaded after the gate.
+    credential: CredentialReference
     #: Default timeout in seconds for tools loaded from this server.
     default_tool_timeout: float
 
@@ -142,7 +151,7 @@ class _RemoteMcpServer(BaseModel):
     ``default_tool_timeout``) are stripped before the client is constructed.
     """
 
-    model_config = ConfigDict(extra="allow", validate_default=True)
+    model_config = ConfigDict(extra="allow", validate_default=True, arbitrary_types_allowed=True)
 
     # Both default to a value the validators below reject, so a missing field
     # reports the same message a malformed one does — as it does in Zod.
@@ -154,6 +163,7 @@ class _RemoteMcpServer(BaseModel):
     default_tool_timeout: float | None = None
     include_tools: list[_ToolName] | None = None
     exclude_tools: list[_ToolName] | None = None
+    credential: CredentialReference | None = None
 
     @field_validator("default_tool_timeout")
     @classmethod