mobileops-managed-agent 0.2.0__tar.gz → 0.2.2__tar.gz

{mobileops_managed_agent-0.2.0/src/mobileops_managed_agent.egg-info → mobileops_managed_agent-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mobileops-managed-agent
-Version: 0.2.0
+Version: 0.2.2
 Summary: Server-side SDK for the MobileOPS Managed Agent API.
 Project-URL: Homepage, https://github.com/InnoMindX/deepagent/tree/main/managed-agent-sdk/python
 Project-URL: Repository, https://github.com/InnoMindX/deepagent

{mobileops_managed_agent-0.2.0 → mobileops_managed_agent-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mobileops-managed-agent"
-version = "0.2.0"
+version = "0.2.2"
 description = "Server-side SDK for the MobileOPS Managed Agent API."
 readme = "README.md"
 requires-python = ">=3.10"

{mobileops_managed_agent-0.2.0 → mobileops_managed_agent-0.2.2}/src/mobileops_managed_agent/__init__.py

@@ -14,6 +14,12 @@ from .capabilities import (
     validate_capability_bundle,
 )
 from .client import MobileOpsAgentClient, MobileOpsManagedAgentClient
+from .credential_vault import (
+    CREDENTIAL_VAULT_CONFIG_KEY,
+    CREDENTIAL_VAULT_ID_PREFIX,
+    CredentialVaultReference,
+    validate_credential_vault,
+)
 from .files import (
     MobileOpsFilesClient,
     MobileOpsFilesError,
@@ -30,6 +36,12 @@ from .response_schema import (
     JsonSchema,
     validate_response_schema,
 )
+from .sandbox_profile import (
+    SANDBOX_PROFILE_CONFIG_KEY,
+    SANDBOX_PROFILE_ID_PREFIX,
+    SandboxProfileReference,
+    validate_sandbox_profile,
+)
 
 __all__ = [
     "MobileOpsManagedAgentClient",
@@ -55,4 +67,12 @@ __all__ = [
     "JsonSchema",
     "RESPONSE_SCHEMA_CONFIG_KEY",
     "validate_response_schema",
+    "SANDBOX_PROFILE_CONFIG_KEY",
+    "SANDBOX_PROFILE_ID_PREFIX",
+    "SandboxProfileReference",
+    "validate_sandbox_profile",
+    "CREDENTIAL_VAULT_CONFIG_KEY",
+    "CREDENTIAL_VAULT_ID_PREFIX",
+    "CredentialVaultReference",
+    "validate_credential_vault",
 ]

{mobileops_managed_agent-0.2.0 → mobileops_managed_agent-0.2.2}/src/mobileops_managed_agent/assistant_model.py

@@ -9,11 +9,19 @@ from .capabilities import (
     MobileOpsAssistantConfig,
     validate_capability_bundle,
 )
+from .credential_vault import (
+    CREDENTIAL_VAULT_CONFIG_KEY,
+    validate_credential_vault,
+)
 from .response_schema import (
     RESPONSE_SCHEMA_CONFIG_KEY,
     JsonSchema,
     validate_response_schema,
 )
+from .sandbox_profile import (
+    SANDBOX_PROFILE_CONFIG_KEY,
+    validate_sandbox_profile,
+)
 
 
 class ContextHubAttachment(TypedDict):
@@ -43,6 +51,8 @@ class MobileOpsAssistant(TypedDict, total=False):
     file_resources: list[FileResourceAttachment]
     mcp_servers: dict[str, CapabilityMcpServer]
     response_schema: JsonSchema
+    sandbox_profile: str
+    credential_vault: str
     raw: Any
     created_at: str
     updated_at: str
@@ -116,7 +126,14 @@ def to_capability_bundle(**kwargs: Any) -> CapabilityBundle | None:
 def to_wire_config(**kwargs: Any) -> MobileOpsAssistantConfig | None:
     bundle = to_capability_bundle(**kwargs)
     has_response_schema = "response_schema" in kwargs
-    if bundle is None and not has_response_schema:
+    has_sandbox_profile = "sandbox_profile" in kwargs
+    has_credential_vault = "credential_vault" in kwargs
+    if (
+        bundle is None
+        and not has_response_schema
+        and not has_sandbox_profile
+        and not has_credential_vault
+    ):
         return None
     configurable: dict[str, Any] = {}
     if bundle is not None:
@@ -126,6 +143,16 @@ def to_wire_config(**kwargs: Any) -> MobileOpsAssistantConfig | None:
         configurable[RESPONSE_SCHEMA_CONFIG_KEY] = validate_response_schema(
             response_schema
         )
+    sandbox_profile = kwargs.get("sandbox_profile")
+    if has_sandbox_profile and sandbox_profile is not None:
+        configurable[SANDBOX_PROFILE_CONFIG_KEY] = validate_sandbox_profile(
+            {"ref": sandbox_profile}
+        )
+    credential_vault = kwargs.get("credential_vault")
+    if has_credential_vault and credential_vault is not None:
+        configurable[CREDENTIAL_VAULT_CONFIG_KEY] = validate_credential_vault(
+            {"ref": credential_vault}
+        )
     return {"configurable": configurable}  # type: ignore[return-value]
 
 
@@ -241,6 +268,22 @@ def from_wire_assistant(raw: object) -> MobileOpsAssistant:
         if response_schema_raw is not None
         else None
     )
+    sandbox_profile_raw = (
+        configurable.get(SANDBOX_PROFILE_CONFIG_KEY) if configurable else None
+    )
+    sandbox_profile = (
+        validate_sandbox_profile(sandbox_profile_raw)["ref"]
+        if sandbox_profile_raw is not None
+        else None
+    )
+    credential_vault_raw = (
+        configurable.get(CREDENTIAL_VAULT_CONFIG_KEY) if configurable else None
+    )
+    credential_vault = (
+        validate_credential_vault(credential_vault_raw)["ref"]
+        if credential_vault_raw is not None
+        else None
+    )
 
     if bundle:
         hub = bundle.get("context_hub_resources") or []
@@ -282,6 +325,10 @@ def from_wire_assistant(raw: object) -> MobileOpsAssistant:
     }
     if response_schema is not None:
         product["response_schema"] = response_schema
+    if sandbox_profile is not None:
+        product["sandbox_profile"] = sandbox_profile
+    if credential_vault is not None:
+        product["credential_vault"] = credential_vault
     if isinstance(doc.get("name"), str):
         product["name"] = doc["name"]
     if isinstance(doc.get("description"), str):

{mobileops_managed_agent-0.2.0 → mobileops_managed_agent-0.2.2}/src/mobileops_managed_agent/assistants.py

@@ -50,6 +50,8 @@ class MobileOpsAssistantsClient:
         file_resources: list[FileResourceAttachment] | None = None,
         mcp_servers: dict[str, CapabilityMcpServer] | None = None,
         response_schema: JsonSchema | None = None,
+        sandbox_profile: str | None = None,
+        credential_vault: str | None = None,
         assistant_id: str | None = None,
         if_exists: OnConflictBehavior | None = None,
         context: Context | None = None,
@@ -87,6 +89,10 @@ class MobileOpsAssistantsClient:
             product_kwargs["mcp_servers"] = mcp_servers
         if response_schema is not None:
             product_kwargs["response_schema"] = response_schema
+        if sandbox_profile is not None:
+            product_kwargs["sandbox_profile"] = sandbox_profile
+        if credential_vault is not None:
+            product_kwargs["credential_vault"] = credential_vault
 
         wire = to_wire_create_kwargs(**product_kwargs)
         native_kwargs = {
@@ -164,6 +170,8 @@ class MobileOpsAssistantsClient:
         file_resources: list[FileResourceAttachment] | None = None,
         mcp_servers: dict[str, CapabilityMcpServer] | None = None,
         response_schema: JsonSchema | None | _NotGiven = _NOT_GIVEN,
+        sandbox_profile: str | None | _NotGiven = _NOT_GIVEN,
+        credential_vault: str | None | _NotGiven = _NOT_GIVEN,
         context: Context | None = None,
         headers: Mapping[str, str] | None = None,
         params: QueryParamTypes | None = None,
@@ -202,7 +210,9 @@ class MobileOpsAssistantsClient:
                 file_resources,
                 mcp_servers,
             )
-        ) or not isinstance(response_schema, _NotGiven)
+        ) or not isinstance(response_schema, _NotGiven) or not isinstance(
+            sandbox_profile, _NotGiven
+        ) or not isinstance(credential_vault, _NotGiven)
         if changes_config:
             current = await self.get(
                 assistant_id,
@@ -233,6 +243,16 @@ class MobileOpsAssistantsClient:
                 if not isinstance(response_schema, _NotGiven)
                 else current.get("response_schema")
             )
+            product_kwargs["sandbox_profile"] = (
+                sandbox_profile
+                if not isinstance(sandbox_profile, _NotGiven)
+                else current.get("sandbox_profile")
+            )
+            product_kwargs["credential_vault"] = (
+                credential_vault
+                if not isinstance(credential_vault, _NotGiven)
+                else current.get("credential_vault")
+            )
 
         wire = to_wire_update_kwargs(**product_kwargs)
         updated = await self._native.update(assistant_id, **wire)

{mobileops_managed_agent-0.2.0 → mobileops_managed_agent-0.2.2}/src/mobileops_managed_agent/capabilities.py

@@ -4,7 +4,17 @@ import re
 from typing import Literal, NotRequired, Required, TypedDict
 from urllib.parse import urlparse
 
+from .credential_vault import (
+    CREDENTIAL_VAULT_CONFIG_KEY,
+    CredentialVaultReference,
+    validate_credential_vault,
+)
 from .response_schema import JsonSchema, validate_response_schema
+from .sandbox_profile import (
+    SANDBOX_PROFILE_CONFIG_KEY,
+    SandboxProfileReference,
+    validate_sandbox_profile,
+)
 
 
 # Capability Bundle validation is a cross-project protocol contract. Any rule
@@ -47,6 +57,9 @@ class StdioMcpServer(TypedDict, total=False):
 class RemoteMcpServer(TypedDict, total=False):
     type: Literal["http", "sse"]
     url: Required[str]
+    # Headers sent to the remote MCP server. Values may reference jail env vars
+    # (e.g. "$GRAFANA_TOKEN") so credential-vault placeholders can be substituted.
+    headers: dict[str, str]
 
 
 CapabilityMcpServer = StdioMcpServer | RemoteMcpServer
@@ -65,6 +78,8 @@ class CapabilityBundle(TypedDict, total=False):
 class MobileOpsAssistantConfigurable(TypedDict, total=False):
     haiops_capability_bundle: CapabilityBundle
     haiops_response_schema: JsonSchema | None
+    haiops_sandbox_profile: SandboxProfileReference
+    haiops_credential_vault: CredentialVaultReference
 
 
 class MobileOpsAssistantConfig(TypedDict, total=False):
@@ -231,12 +246,142 @@ def validate_capability_bundle(value: object) -> None:
             if "clear_env" in server and not isinstance(server["clear_env"], bool):
                 raise TypeError(f"mcp.mcpServers.{name}.clear_env must be boolean")
         elif server_type in {"http", "sse"}:
-            _allowed_keys(server, {"type", "url"}, f"mcp.mcpServers.{name}")
+            _allowed_keys(server, {"type", "url", "headers"}, f"mcp.mcpServers.{name}")
             _http_url(server.get("url"), f"mcp.mcpServers.{name}.url")
             if "command" in server:
                 raise TypeError(f"mcp.mcpServers.{name} must not define command")
+            if "headers" in server:
+                headers = _object(server["headers"], f"mcp.mcpServers.{name}.headers")
+                if len(headers) > 32:
+                    raise TypeError(
+                        f"mcp.mcpServers.{name}.headers must have at most 32 entries"
+                    )
+                total_value_bytes = 0
+                for key, value in headers.items():
+                    if not isinstance(key, str) or not re.fullmatch(
+                        r"[!#$%&'*+\-.^_`|~0-9A-Za-z]+", key
+                    ):
+                        raise TypeError(
+                            f"mcp.mcpServers.{name}.headers contains invalid "
+                            f"header name: {key!r}"
+                        )
+                    if not isinstance(value, str):
+                        raise TypeError(
+                            f"mcp.mcpServers.{name}.headers.{key} must be a string"
+                        )
+                    if any(ord(ch) < 0x20 or ord(ch) == 0x7F for ch in value):
+                        raise TypeError(
+                            f"mcp.mcpServers.{name}.headers.{key} must not contain "
+                            "control characters"
+                        )
+                    value_bytes = len(value.encode("utf-8"))
+                    if value_bytes > 8 * 1024:
+                        raise TypeError(
+                            f"mcp.mcpServers.{name}.headers.{key} must be at most "
+                            "8192 bytes"
+                        )
+                    total_value_bytes += value_bytes
+                    if total_value_bytes > 48 * 1024:
+                        raise TypeError(
+                            f"mcp.mcpServers.{name}.headers total value size must "
+                            "be at most 49152 bytes"
+                        )
         else:
             raise TypeError(f"mcp.mcpServers.{name}.type must be stdio, http, or sse")
+    _assert_mcp_gateway_config_launchable(servers)
+
+
+_MAX_AGENTGATEWAY_CONFIG_BYTES = 100_000
+# Matches backend size budget for processd backendTunnel injection
+# (DNS-max hostname + port; not just 127.0.0.1).
+_SIZE_BUDGET_PROXY_HOST = f"{'x' * 253}:65535"
+
+
+def _size_budget_upstream_host(url: object) -> str | None:
+    """Mirror backend auto-Host injection for tunnel absolute-form authority."""
+    if not isinstance(url, str) or not url.strip():
+        return None
+    from urllib.parse import urlparse
+
+    text = url.strip()
+    parsed = urlparse(text if "://" in text else f"http://{text}")
+    host = parsed.hostname
+    if not host:
+        return None
+    port = parsed.port
+    if port is None:
+        port = 443 if (parsed.scheme or "http").lower() == "https" else 80
+    if not (1 <= port <= 65535):
+        return None
+    if ":" in host:
+        return f"[{host}]:{port}"
+    return f"{host}:{port}"
+
+
+def _assert_mcp_gateway_config_launchable(servers: dict) -> None:
+    """Mirror backend agentgateway config size guard (argv limit for `-c`)."""
+    targets: list[dict] = []
+    for name, item in sorted(servers.items()):
+        server = item if isinstance(item, dict) else {}
+        inferred = (
+            "stdio" if "command" in server else "http" if "url" in server else None
+        )
+        server_type = server.get("type", inferred)
+        if server_type == "stdio":
+            stdio: dict = {"cmd": server.get("command"), "clear_env": server.get("clear_env", False)}
+            if "args" in server:
+                stdio["args"] = server["args"]
+            if "env" in server:
+                stdio["env"] = server["env"]
+            targets.append({"name": name, "stdio": stdio})
+            continue
+        # Budget processd backendTunnel + auto Host injected at sandbox setup.
+        policies: dict = {
+            "backendTunnel": {"proxy": {"host": _SIZE_BUDGET_PROXY_HOST}},
+        }
+        headers = server.get("headers")
+        header_set: dict = dict(headers) if isinstance(headers, dict) else {}
+        if not any(str(k).lower() == "host" for k in header_set):
+            upstream_host = _size_budget_upstream_host(server.get("url"))
+            if upstream_host:
+                header_set["Host"] = upstream_host
+        if header_set:
+            policies["requestHeaderModifier"] = {"set": header_set}
+        targets.append(
+            {
+                "name": name,
+                ("sse" if server_type == "sse" else "mcp"): {
+                    "host": server.get("url")
+                },
+                "policies": policies,
+            }
+        )
+    config = {
+        "mcp": {
+            "port": 3009,
+            "statefulMode": "stateful",
+            "prefixMode": "always",
+            "failureMode": "failOpen",
+            "policies": {
+                "cors": {
+                    "allowOrigins": ["*"],
+                    "allowHeaders": ["*"],
+                    "exposeHeaders": ["Mcp-Session-Id"],
+                }
+            },
+            "targets": targets,
+        }
+    }
+    import json
+
+    size = len(
+        json.dumps(config, ensure_ascii=False, separators=(",", ":")).encode("utf-8")
+    )
+    if size > _MAX_AGENTGATEWAY_CONFIG_BYTES:
+        raise TypeError(
+            f"MCP gateway config is too large to start ({size} bytes; "
+            f"max {_MAX_AGENTGATEWAY_CONFIG_BYTES}). Reduce remote MCP headers."
+        )
 
 
 def validate_assistant_config(config: MobileOpsAssistantConfig | None) -> None:
@@ -253,12 +398,19 @@ def validate_assistant_config(config: MobileOpsAssistantConfig | None) -> None:
     if set(configurable) - {
         "haiops_capability_bundle",
         "haiops_response_schema",
+        SANDBOX_PROFILE_CONFIG_KEY,
+        CREDENTIAL_VAULT_CONFIG_KEY,
     }:
         raise TypeError(
             "Assistant config.configurable only supports "
-            "haiops_capability_bundle and haiops_response_schema"
+            "haiops_capability_bundle, haiops_response_schema, "
+            f"{SANDBOX_PROFILE_CONFIG_KEY} and {CREDENTIAL_VAULT_CONFIG_KEY}"
         )
     if "haiops_capability_bundle" in configurable:
         validate_capability_bundle(configurable["haiops_capability_bundle"])
     if configurable.get("haiops_response_schema") is not None:
         validate_response_schema(configurable["haiops_response_schema"])
+    if SANDBOX_PROFILE_CONFIG_KEY in configurable:
+        validate_sandbox_profile(configurable[SANDBOX_PROFILE_CONFIG_KEY])
+    if CREDENTIAL_VAULT_CONFIG_KEY in configurable:
+        validate_credential_vault(configurable[CREDENTIAL_VAULT_CONFIG_KEY])

mobileops_managed_agent-0.2.2/src/mobileops_managed_agent/credential_vault.py

@@ -0,0 +1,38 @@
+"""Credential Vault reference validation (MobileOPS assistant config contract).
+
+``haiops_credential_vault`` is an independent configurable key holding a
+reference to a Context Hub credential vault. It is NOT a capability bundle
+field, so the bundle validators and test-fixtures/capability-bundle are
+unaffected.
+"""
+
+from __future__ import annotations
+
+from typing import Any, TypeAlias
+
+CREDENTIAL_VAULT_CONFIG_KEY = "haiops_credential_vault"
+CREDENTIAL_VAULT_ID_PREFIX = "vlt_"
+
+CredentialVaultReference: TypeAlias = dict[str, str]
+
+
+def validate_credential_vault(raw: Any) -> CredentialVaultReference:
+    """Validate the ``haiops_credential_vault`` assistant-config value.
+
+    Shape: ``{"ref": "vlt_..."}``. Only the reference is persisted on the
+    assistant; the credentials live in Context Hub and are resolved
+    server-side at run time. Inline credential fields are rejected.
+    """
+    if not isinstance(raw, dict):
+        raise TypeError("Credential vault must be a JSON object")
+    unknown = sorted(set(raw) - {"ref"})
+    if unknown:
+        raise TypeError(f"Credential vault contains unsupported field: {unknown[0]}")
+    ref = raw.get("ref")
+    if not isinstance(ref, str) or not ref.strip():
+        raise TypeError("Credential vault ref must be a non-empty string")
+    if not ref.startswith(CREDENTIAL_VAULT_ID_PREFIX):
+        raise TypeError(
+            f"Credential vault ref must start with {CREDENTIAL_VAULT_ID_PREFIX!r}"
+        )
+    return {"ref": ref}

mobileops_managed_agent-0.2.2/src/mobileops_managed_agent/sandbox_profile.py

@@ -0,0 +1,38 @@
+"""Sandbox Profile reference validation (MobileOPS assistant config contract).
+
+``haiops_sandbox_profile`` is an independent configurable key holding a
+reference to a Context Hub sandbox profile. It is NOT a capability bundle
+field, so the bundle validators and test-fixtures/capability-bundle are
+unaffected.
+"""
+
+from __future__ import annotations
+
+from typing import Any, TypeAlias
+
+SANDBOX_PROFILE_CONFIG_KEY = "haiops_sandbox_profile"
+SANDBOX_PROFILE_ID_PREFIX = "sbp_"
+
+SandboxProfileReference: TypeAlias = dict[str, str]
+
+
+def validate_sandbox_profile(raw: Any) -> SandboxProfileReference:
+    """Validate the ``haiops_sandbox_profile`` assistant-config value.
+
+    Shape: ``{"ref": "sbp_..."}``. Only the reference is persisted on the
+    assistant; the network policy body lives in Context Hub and is resolved
+    server-side at run time. Inline policy fields are rejected.
+    """
+    if not isinstance(raw, dict):
+        raise TypeError("Sandbox profile must be a JSON object")
+    unknown = sorted(set(raw) - {"ref"})
+    if unknown:
+        raise TypeError(f"Sandbox profile contains unsupported field: {unknown[0]}")
+    ref = raw.get("ref")
+    if not isinstance(ref, str) or not ref.strip():
+        raise TypeError("Sandbox profile ref must be a non-empty string")
+    if not ref.startswith(SANDBOX_PROFILE_ID_PREFIX):
+        raise TypeError(
+            f"Sandbox profile ref must start with {SANDBOX_PROFILE_ID_PREFIX!r}"
+        )
+    return {"ref": ref}

{mobileops_managed_agent-0.2.0 → mobileops_managed_agent-0.2.2/src/mobileops_managed_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mobileops-managed-agent
-Version: 0.2.0
+Version: 0.2.2
 Summary: Server-side SDK for the MobileOPS Managed Agent API.
 Project-URL: Homepage, https://github.com/InnoMindX/deepagent/tree/main/managed-agent-sdk/python
 Project-URL: Repository, https://github.com/InnoMindX/deepagent

{mobileops_managed_agent-0.2.0 → mobileops_managed_agent-0.2.2}/src/mobileops_managed_agent.egg-info/SOURCES.txt

@@ -7,9 +7,11 @@ src/mobileops_managed_agent/assistants.py
 src/mobileops_managed_agent/auth.py
 src/mobileops_managed_agent/capabilities.py
 src/mobileops_managed_agent/client.py
+src/mobileops_managed_agent/credential_vault.py
 src/mobileops_managed_agent/files.py
 src/mobileops_managed_agent/resources.py
 src/mobileops_managed_agent/response_schema.py
+src/mobileops_managed_agent/sandbox_profile.py
 src/mobileops_managed_agent.egg-info/PKG-INFO
 src/mobileops_managed_agent.egg-info/SOURCES.txt
 src/mobileops_managed_agent.egg-info/dependency_links.txt