mobileops-managed-agent 0.2.2__tar.gz → 0.3.1__tar.gz

{mobileops_managed_agent-0.2.2/src/mobileops_managed_agent.egg-info → mobileops_managed_agent-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mobileops-managed-agent
-Version: 0.2.2
+Version: 0.3.1
 Summary: Server-side SDK for the MobileOPS Managed Agent API.
 Project-URL: Homepage, https://github.com/InnoMindX/deepagent/tree/main/managed-agent-sdk/python
 Project-URL: Repository, https://github.com/InnoMindX/deepagent
@@ -18,11 +18,13 @@ Requires-Dist: pytest-asyncio>=0.23.0; extra == "dev"
 
 Server-side Python SDK for the MobileOPS Managed Agent API.
 
-The SDK exposes three surfaces:
+The SDK exposes five surfaces:
 
 - `client.agent` wraps the LangGraph runtime client and exposes the supported Assistant CRUD methods at `client.agent.assistants`.
 - `client.files` exposes MobileOPS Sandbox Workspace file routes.
 - `client.resources` manages Context Hub resources, versions, and latest-version files.
+- `client.vaults` manages credential vaults and their write-only credentials.
+- `client.sandbox_profiles` manages sandbox profiles (运行环境).
 
 Assistant create and update retain LangGraph's ordinary arguments, while
 persisted configuration is exposed through product fields. Pass
@@ -37,6 +39,8 @@ therefore only affects Runs started on **new** Threads; existing Threads keep
 the schema captured at their creation.
 
 ```py
+import os
+
 from mobileops_managed_agent import MobileOpsManagedAgentClient
 
 client = MobileOpsManagedAgentClient(api_url=api_url, api_key=api_key)
@@ -45,12 +49,25 @@ thread = await client.agent.threads.create()
 await client.agent.runs.create(thread["thread_id"], assistant_id, input=input)
 
 skill = await client.resources.create("skills", zip_bytes)  # slug inferred
+profile = await client.sandbox_profiles.create(
+    name="prod",
+    spec={"network": {"allow": ["*.example.com"]}},
+)
+vault = await client.vaults.create(name="prod")
+await client.vaults.credentials.create(
+    vault["id"],
+    name="GRAFANA_TOKEN",
+    value=os.environ["GRAFANA_TOKEN"],
+    allowed_hosts=["grafana.example.com"],
+)
 assistant = await client.agent.assistants.create(
     name="Operations agent",
     skills=[{
         "ref": skill["ref"],  # e.g. incident-response@sha256-…
         "target_path": "/workspace/skills",  # zip already contains {slug}/
     }],
+    sandbox_profile=profile["id"],
+    credential_vault=vault["id"],
 )
 
 await client.resources.versions.create("skills", skill["slug"], next_zip_bytes)

{mobileops_managed_agent-0.2.2 → mobileops_managed_agent-0.3.1}/README.md

@@ -2,11 +2,13 @@
 
 Server-side Python SDK for the MobileOPS Managed Agent API.
 
-The SDK exposes three surfaces:
+The SDK exposes five surfaces:
 
 - `client.agent` wraps the LangGraph runtime client and exposes the supported Assistant CRUD methods at `client.agent.assistants`.
 - `client.files` exposes MobileOPS Sandbox Workspace file routes.
 - `client.resources` manages Context Hub resources, versions, and latest-version files.
+- `client.vaults` manages credential vaults and their write-only credentials.
+- `client.sandbox_profiles` manages sandbox profiles (运行环境).
 
 Assistant create and update retain LangGraph's ordinary arguments, while
 persisted configuration is exposed through product fields. Pass
@@ -21,6 +23,8 @@ therefore only affects Runs started on **new** Threads; existing Threads keep
 the schema captured at their creation.
 
 ```py
+import os
+
 from mobileops_managed_agent import MobileOpsManagedAgentClient
 
 client = MobileOpsManagedAgentClient(api_url=api_url, api_key=api_key)
@@ -29,12 +33,25 @@ thread = await client.agent.threads.create()
 await client.agent.runs.create(thread["thread_id"], assistant_id, input=input)
 
 skill = await client.resources.create("skills", zip_bytes)  # slug inferred
+profile = await client.sandbox_profiles.create(
+    name="prod",
+    spec={"network": {"allow": ["*.example.com"]}},
+)
+vault = await client.vaults.create(name="prod")
+await client.vaults.credentials.create(
+    vault["id"],
+    name="GRAFANA_TOKEN",
+    value=os.environ["GRAFANA_TOKEN"],
+    allowed_hosts=["grafana.example.com"],
+)
 assistant = await client.agent.assistants.create(
     name="Operations agent",
     skills=[{
         "ref": skill["ref"],  # e.g. incident-response@sha256-…
         "target_path": "/workspace/skills",  # zip already contains {slug}/
     }],
+    sandbox_profile=profile["id"],
+    credential_vault=vault["id"],
 )
 
 await client.resources.versions.create("skills", skill["slug"], next_zip_bytes)

{mobileops_managed_agent-0.2.2 → mobileops_managed_agent-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mobileops-managed-agent"
-version = "0.2.2"
+version = "0.3.1"
 description = "Server-side SDK for the MobileOPS Managed Agent API."
 readme = "README.md"
 requires-python = ">=3.10"

{mobileops_managed_agent-0.2.2 → mobileops_managed_agent-0.3.1}/src/mobileops_managed_agent/__init__.py

@@ -17,6 +17,7 @@ from .client import MobileOpsAgentClient, MobileOpsManagedAgentClient
 from .credential_vault import (
     CREDENTIAL_VAULT_CONFIG_KEY,
     CREDENTIAL_VAULT_ID_PREFIX,
+    SECRET_REDACTED_VALUE,
     CredentialVaultReference,
     validate_credential_vault,
 )
@@ -39,9 +40,29 @@ from .response_schema import (
 from .sandbox_profile import (
     SANDBOX_PROFILE_CONFIG_KEY,
     SANDBOX_PROFILE_ID_PREFIX,
+    SYSTEM_DEFAULT_PROFILE_ID,
     SandboxProfileReference,
     validate_sandbox_profile,
 )
+from .sandbox_profiles import (
+    MobileOpsSandboxProfilesClient,
+    MobileOpsSandboxProfilesError,
+    SandboxProfile,
+    SandboxProfileCreateInput,
+    SandboxProfileNetwork,
+    SandboxProfileSpec,
+    SandboxProfileUpdateInput,
+)
+from .vaults import (
+    MobileOpsVaultsClient,
+    MobileOpsVaultsError,
+    Vault,
+    VaultCreateInput,
+    VaultCredential,
+    VaultCredentialInput,
+    VaultCredentialUpdateInput,
+    VaultUpdateInput,
+)
 
 __all__ = [
     "MobileOpsManagedAgentClient",
@@ -51,9 +72,24 @@ __all__ = [
     "MobileOpsAssistantsClient",
     "MobileOpsResourcesClient",
     "MobileOpsResourcesError",
+    "MobileOpsVaultsClient",
+    "MobileOpsVaultsError",
+    "MobileOpsSandboxProfilesClient",
+    "MobileOpsSandboxProfilesError",
     "ResourceFile",
     "ResourceSummary",
     "ResourceVersion",
+    "Vault",
+    "VaultCreateInput",
+    "VaultCredential",
+    "VaultCredentialInput",
+    "VaultCredentialUpdateInput",
+    "VaultUpdateInput",
+    "SandboxProfile",
+    "SandboxProfileCreateInput",
+    "SandboxProfileNetwork",
+    "SandboxProfileSpec",
+    "SandboxProfileUpdateInput",
     "CapabilityBundle",
     "MobileOpsAssistantConfig",
     "MobileOpsAssistant",
@@ -69,10 +105,14 @@ __all__ = [
     "validate_response_schema",
     "SANDBOX_PROFILE_CONFIG_KEY",
     "SANDBOX_PROFILE_ID_PREFIX",
+    "SYSTEM_DEFAULT_PROFILE_ID",
     "SandboxProfileReference",
     "validate_sandbox_profile",
     "CREDENTIAL_VAULT_CONFIG_KEY",
     "CREDENTIAL_VAULT_ID_PREFIX",
+    "SECRET_REDACTED_VALUE",
     "CredentialVaultReference",
     "validate_credential_vault",
 ]
+
+from .tool_permissions import validate_tool_permissions, TOOL_PERMISSIONS_CONFIG_KEY

{mobileops_managed_agent-0.2.2 → mobileops_managed_agent-0.3.1}/src/mobileops_managed_agent/assistant_model.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from .tool_permissions import TOOL_PERMISSIONS_CONFIG_KEY, validate_tool_permissions
+
 from typing import Any, NotRequired, TypedDict
 
 from .capabilities import (
@@ -52,6 +54,7 @@ class MobileOpsAssistant(TypedDict, total=False):
     mcp_servers: dict[str, CapabilityMcpServer]
     response_schema: JsonSchema
     sandbox_profile: str
+    tool_permissions: dict[str, Any]
     credential_vault: str
     raw: Any
     created_at: str
@@ -133,6 +136,7 @@ def to_wire_config(**kwargs: Any) -> MobileOpsAssistantConfig | None:
         and not has_response_schema
         and not has_sandbox_profile
         and not has_credential_vault
+        and "tool_permissions" not in kwargs
     ):
         return None
     configurable: dict[str, Any] = {}
@@ -153,6 +157,10 @@ def to_wire_config(**kwargs: Any) -> MobileOpsAssistantConfig | None:
         configurable[CREDENTIAL_VAULT_CONFIG_KEY] = validate_credential_vault(
             {"ref": credential_vault}
         )
+    if "tool_permissions" in kwargs:
+        configurable[TOOL_PERMISSIONS_CONFIG_KEY] = validate_tool_permissions(
+            kwargs["tool_permissions"], list((kwargs.get("mcp_servers") or {}).keys())
+        )
     return {"configurable": configurable}  # type: ignore[return-value]
 
 
@@ -327,6 +335,10 @@ def from_wire_assistant(raw: object) -> MobileOpsAssistant:
         product["response_schema"] = response_schema
     if sandbox_profile is not None:
         product["sandbox_profile"] = sandbox_profile
+    if configurable and TOOL_PERMISSIONS_CONFIG_KEY in configurable:
+        product["tool_permissions"] = validate_tool_permissions(
+            configurable[TOOL_PERMISSIONS_CONFIG_KEY]
+        )
     if credential_vault is not None:
         product["credential_vault"] = credential_vault
     if isinstance(doc.get("name"), str):

{mobileops_managed_agent-0.2.2 → mobileops_managed_agent-0.3.1}/src/mobileops_managed_agent/assistants.py

@@ -52,6 +52,7 @@ class MobileOpsAssistantsClient:
         response_schema: JsonSchema | None = None,
         sandbox_profile: str | None = None,
         credential_vault: str | None = None,
+        tool_permissions: dict[str, Any] | _NotGiven = _NOT_GIVEN,
         assistant_id: str | None = None,
         if_exists: OnConflictBehavior | None = None,
         context: Context | None = None,
@@ -94,6 +95,8 @@ class MobileOpsAssistantsClient:
         if credential_vault is not None:
             product_kwargs["credential_vault"] = credential_vault
 
+        if not isinstance(tool_permissions, _NotGiven):
+            product_kwargs["tool_permissions"] = tool_permissions
         wire = to_wire_create_kwargs(**product_kwargs)
         native_kwargs = {
             key: wire[key]
@@ -172,6 +175,7 @@ class MobileOpsAssistantsClient:
         response_schema: JsonSchema | None | _NotGiven = _NOT_GIVEN,
         sandbox_profile: str | None | _NotGiven = _NOT_GIVEN,
         credential_vault: str | None | _NotGiven = _NOT_GIVEN,
+        tool_permissions: dict[str, Any] | _NotGiven = _NOT_GIVEN,
         context: Context | None = None,
         headers: Mapping[str, str] | None = None,
         params: QueryParamTypes | None = None,
@@ -212,7 +216,9 @@ class MobileOpsAssistantsClient:
             )
         ) or not isinstance(response_schema, _NotGiven) or not isinstance(
             sandbox_profile, _NotGiven
-        ) or not isinstance(credential_vault, _NotGiven)
+        ) or not isinstance(credential_vault, _NotGiven) or not isinstance(
+            tool_permissions, _NotGiven
+        )
         if changes_config:
             current = await self.get(
                 assistant_id,
@@ -248,6 +254,10 @@ class MobileOpsAssistantsClient:
                 if not isinstance(sandbox_profile, _NotGiven)
                 else current.get("sandbox_profile")
             )
+            if not isinstance(tool_permissions, _NotGiven):
+                product_kwargs["tool_permissions"] = tool_permissions
+            elif "tool_permissions" in current:
+                product_kwargs["tool_permissions"] = current["tool_permissions"]
             product_kwargs["credential_vault"] = (
                 credential_vault
                 if not isinstance(credential_vault, _NotGiven)

{mobileops_managed_agent-0.2.2 → mobileops_managed_agent-0.3.1}/src/mobileops_managed_agent/capabilities.py

@@ -298,7 +298,7 @@ _SIZE_BUDGET_PROXY_HOST = f"{'x' * 253}:65535"
 
 
 def _size_budget_upstream_host(url: object) -> str | None:
-    """Mirror backend auto-Host injection for tunnel absolute-form authority."""
+    """Mirror backend upstream Host configuration for tunneled targets."""
     if not isinstance(url, str) or not url.strip():
         return None
     from urllib.parse import urlparse
@@ -337,7 +337,7 @@ def _assert_mcp_gateway_config_launchable(servers: dict) -> None:
             continue
         # Budget processd backendTunnel + auto Host injected at sandbox setup.
         policies: dict = {
-            "backendTunnel": {"proxy": {"host": _SIZE_BUDGET_PROXY_HOST}},
+            "backendTunnel": {"mode": "connect", "proxy": {"host": _SIZE_BUDGET_PROXY_HOST}},
         }
         headers = server.get("headers")
         header_set: dict = dict(headers) if isinstance(headers, dict) else {}

{mobileops_managed_agent-0.2.2 → mobileops_managed_agent-0.3.1}/src/mobileops_managed_agent/client.py

@@ -9,6 +9,8 @@ from .auth import build_headers
 from .files import MobileOpsFilesClient
 from .assistants import MobileOpsAssistantsClient
 from .resources import MobileOpsResourcesClient
+from .sandbox_profiles import MobileOpsSandboxProfilesClient
+from .vaults import MobileOpsVaultsClient
 
 
 class MobileOpsAgentClient:
@@ -62,6 +64,18 @@ class MobileOpsManagedAgentClient:
             headers=headers,
             http_client=http_client,
         )
+        self.vaults = MobileOpsVaultsClient(
+            api_url=api_url,
+            api_key=api_key,
+            headers=headers,
+            http_client=http_client,
+        )
+        self.sandbox_profiles = MobileOpsSandboxProfilesClient(
+            api_url=api_url,
+            api_key=api_key,
+            headers=headers,
+            http_client=http_client,
+        )
 
     async def aclose(self) -> None:
         try:
@@ -72,7 +86,13 @@ class MobileOpsManagedAgentClient:
             try:
                 await self.files.aclose()
             finally:
-                await self.resources.aclose()
+                try:
+                    await self.resources.aclose()
+                finally:
+                    try:
+                        await self.vaults.aclose()
+                    finally:
+                        await self.sandbox_profiles.aclose()
 
     async def __aenter__(self) -> "MobileOpsManagedAgentClient":
         return self

{mobileops_managed_agent-0.2.2 → mobileops_managed_agent-0.3.1}/src/mobileops_managed_agent/credential_vault.py

@@ -12,6 +12,7 @@ from typing import Any, TypeAlias
 
 CREDENTIAL_VAULT_CONFIG_KEY = "haiops_credential_vault"
 CREDENTIAL_VAULT_ID_PREFIX = "vlt_"
+SECRET_REDACTED_VALUE = "***"
 
 CredentialVaultReference: TypeAlias = dict[str, str]
 

{mobileops_managed_agent-0.2.2 → mobileops_managed_agent-0.3.1}/src/mobileops_managed_agent/resources.py

@@ -36,7 +36,6 @@ class ResourceSummary(TypedDict):
 
 class ResourceFile(TypedDict):
     path: str
-    content_b64: NotRequired[str]
     size: NotRequired[int]
 
 

{mobileops_managed_agent-0.2.2 → mobileops_managed_agent-0.3.1}/src/mobileops_managed_agent/sandbox_profile.py

@@ -12,6 +12,7 @@ from typing import Any, TypeAlias
 
 SANDBOX_PROFILE_CONFIG_KEY = "haiops_sandbox_profile"
 SANDBOX_PROFILE_ID_PREFIX = "sbp_"
+SYSTEM_DEFAULT_PROFILE_ID = f"{SANDBOX_PROFILE_ID_PREFIX}system_default"
 
 SandboxProfileReference: TypeAlias = dict[str, str]
 

mobileops_managed_agent-0.3.1/src/mobileops_managed_agent/sandbox_profiles.py

@@ -0,0 +1,148 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any, NotRequired, TypedDict
+from urllib.parse import quote
+
+import httpx
+
+from .auth import build_headers
+from .sandbox_profile import SYSTEM_DEFAULT_PROFILE_ID
+
+__all__ = [
+    "SYSTEM_DEFAULT_PROFILE_ID",
+    "SandboxProfile",
+    "SandboxProfileCreateInput",
+    "SandboxProfileNetwork",
+    "SandboxProfileSpec",
+    "SandboxProfileUpdateInput",
+    "MobileOpsSandboxProfilesError",
+    "MobileOpsSandboxProfilesClient",
+]
+
+
+class SandboxProfileNetwork(TypedDict):
+    allow: list[str]
+    allow_ports: NotRequired[list[int]]
+
+
+class SandboxProfileSpec(TypedDict):
+    network: SandboxProfileNetwork
+
+
+class SandboxProfile(TypedDict):
+    id: str
+    name: str
+    spec: SandboxProfileSpec
+    created_at: NotRequired[str]
+    updated_at: NotRequired[str]
+
+
+class SandboxProfileCreateInput(TypedDict):
+    name: str
+    spec: SandboxProfileSpec
+
+
+class SandboxProfileUpdateInput(TypedDict, total=False):
+    name: str
+    spec: SandboxProfileSpec
+
+
+class MobileOpsSandboxProfilesError(Exception):
+    def __init__(self, response: httpx.Response, body: Any) -> None:
+        self.status_code = response.status_code
+        self.response = response
+        self.body = body
+        message = (
+            body.get("error")
+            if isinstance(body, dict) and isinstance(body.get("error"), str)
+            else (
+                "MobileOPS Sandbox Profiles request failed with status "
+                f"{response.status_code}"
+            )
+        )
+        super().__init__(message)
+
+
+class MobileOpsSandboxProfilesClient:
+    def __init__(
+        self,
+        *,
+        api_url: str,
+        api_key: str,
+        headers: Mapping[str, str] | None = None,
+        http_client: httpx.AsyncClient | None = None,
+    ) -> None:
+        if not api_url:
+            raise ValueError("api_url is required")
+        if not api_key:
+            raise ValueError("api_key is required")
+        self._api_url = api_url.rstrip("/")
+        self._headers = build_headers(api_key, headers)
+        self._client = http_client or httpx.AsyncClient()
+        self._owns_client = http_client is None
+
+    async def aclose(self) -> None:
+        if self._owns_client:
+            await self._client.aclose()
+
+    async def list(self) -> list[SandboxProfile]:
+        payload = await self._request_json("GET", self._profiles_url())
+        return payload["profiles"]
+
+    async def create(
+        self, *, name: str, spec: SandboxProfileSpec
+    ) -> SandboxProfile:
+        payload = await self._request_json(
+            "POST", self._profiles_url(), json={"name": name, "spec": spec}
+        )
+        return payload["profile"]
+
+    async def retrieve(self, id: str) -> SandboxProfile:
+        payload = await self._request_json("GET", self._profile_url(id))
+        return payload["profile"]
+
+    async def update(
+        self,
+        id: str,
+        *,
+        name: str | None = None,
+        spec: SandboxProfileSpec | None = None,
+    ) -> SandboxProfile:
+        payload_body: dict[str, Any] = {}
+        if name is not None:
+            payload_body["name"] = name
+        if spec is not None:
+            payload_body["spec"] = spec
+        payload = await self._request_json(
+            "PATCH", self._profile_url(id), json=payload_body
+        )
+        return payload["profile"]
+
+    async def delete(self, id: str) -> None:
+        await self._request("DELETE", self._profile_url(id))
+
+    def _profiles_url(self) -> str:
+        return f"{self._api_url}/context-hub/v1/sandbox-profiles"
+
+    def _profile_url(self, id: str) -> str:
+        return f"{self._profiles_url()}/{quote(id, safe='')}"
+
+    async def _request_json(
+        self, method: str, url: str, **kwargs: Any
+    ) -> dict[str, Any]:
+        return (await self._request(method, url, **kwargs)).json()
+
+    async def _request(self, method: str, url: str, **kwargs: Any) -> httpx.Response:
+        headers = {**self._headers, **kwargs.pop("headers", {})}
+        response = await self._client.request(method, url, headers=headers, **kwargs)
+        if response.is_error:
+            content_type = response.headers.get("content-type", "")
+            body: Any = response.text
+            if "application/json" in content_type:
+                try:
+                    body = response.json()
+                except ValueError:
+                    pass
+            raise MobileOpsSandboxProfilesError(response, body)
+        return response

mobileops_managed_agent-0.3.1/src/mobileops_managed_agent/tool_permissions.py

@@ -0,0 +1,97 @@
+"""Tool permission policies. Approval decisions never modify configured rules.
+Keep validators aligned with the shared conformance fixtures.
+"""
+
+from __future__ import annotations
+
+import copy
+import re
+from typing import Any
+
+TOOL_PERMISSIONS_CONFIG_KEY = "haiops_tool_permissions"
+BUILTIN_TOOL_NAMES = frozenset(
+    {
+        "ls",
+        "read_file",
+        "write_file",
+        "edit_file",
+        "delete",
+        "glob",
+        "grep",
+        "execute",
+        "eval",
+        "task",
+        "write_todos",
+        "request_user_input",
+    }
+)
+
+
+def _object(value: Any, keys: set[str]) -> dict:
+    if not isinstance(value, dict) or set(value) - keys:
+        raise ValueError("Invalid tool permissions object or unsupported field")
+    return value
+
+
+def _rule(value: Any, named: bool = False) -> dict:
+    r = _object(
+        value, {"enabled", "permission_policy"} | ({"name"} if named else set())
+    )
+    if "enabled" in r and type(r["enabled"]) is not bool:
+        raise ValueError("enabled must be boolean")
+    if "permission_policy" in r:
+        p = _object(r["permission_policy"], {"type"})
+        if p.get("type") not in ("always_allow", "always_ask"):
+            raise ValueError("Unsupported permission policy")
+    return r
+
+
+def validate_tool_permissions(value: Any, servers: list[str] | None = None) -> dict:
+    p = _object(value, {"version", "toolsets"})
+    if (
+        type(p.get("version")) is not int
+        or p["version"] != 1
+        or not isinstance(p.get("toolsets"), list)
+        or len(p["toolsets"]) > 128
+    ):
+        raise ValueError(
+            "Tool permissions require version 1 and a toolsets array (max 128)"
+        )
+    seen = set()
+    for raw in p["toolsets"]:
+        s = _object(raw, {"type", "mcp_server_name", "default_config", "configs"})
+        if s.get("type") not in ("builtin", "mcp"):
+            raise ValueError("Unknown toolset type")
+        if s["type"] == "mcp":
+            server = s.get("mcp_server_name")
+            if (
+                not isinstance(server, str)
+                or not re.fullmatch(r"[A-Za-z0-9.-]+", server)
+                or (servers is not None and server not in servers)
+            ):
+                raise ValueError("Unknown or invalid MCP server")
+        elif "mcp_server_name" in s:
+            raise ValueError("Only MCP toolsets accept mcp_server_name")
+        key = (s["type"], s.get("mcp_server_name"))
+        if key in seen:
+            raise ValueError("Duplicate toolset")
+        seen.add(key)
+        if "default_config" in s:
+            _rule(s["default_config"])
+        if "configs" in s:
+            if not isinstance(s["configs"], list) or len(s["configs"]) > 1024:
+                raise ValueError("configs must be an array (max 1024)")
+            names = set()
+            for raw_config in s["configs"]:
+                c = _rule(raw_config, True)
+                name = c.get("name")
+                if (
+                    not isinstance(name, str)
+                    or not re.fullmatch(r"[A-Za-z0-9_.-]{1,128}", name)
+                    or name in names
+                ):
+                    raise ValueError("Invalid or duplicate tool name")
+                if s["type"] == "builtin" and name not in BUILTIN_TOOL_NAMES:
+                    raise ValueError("Unknown built-in tool")
+                names.add(name)
+    return copy.deepcopy(p)

mobileops_managed_agent-0.3.1/src/mobileops_managed_agent/vaults.py

@@ -0,0 +1,231 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any, NotRequired, TypedDict
+from urllib.parse import quote
+
+import httpx
+
+from .auth import build_headers
+from .credential_vault import SECRET_REDACTED_VALUE
+
+__all__ = [
+    "SECRET_REDACTED_VALUE",
+    "Vault",
+    "VaultCreateInput",
+    "VaultCredential",
+    "VaultCredentialInput",
+    "VaultCredentialUpdateInput",
+    "VaultUpdateInput",
+    "MobileOpsVaultsError",
+    "MobileOpsVaultsClient",
+]
+
+
+class Vault(TypedDict):
+    id: str
+    name: str
+    credential_count: int
+    created_at: NotRequired[str]
+    updated_at: NotRequired[str]
+
+
+class VaultCredential(TypedDict):
+    id: str
+    vault_id: str
+    name: str
+    value: str
+    allowed_hosts: list[str]
+    header: bool
+    body: bool
+    created_at: NotRequired[str]
+    updated_at: NotRequired[str]
+
+
+class VaultCreateInput(TypedDict):
+    name: str
+
+
+class VaultUpdateInput(TypedDict, total=False):
+    name: str
+
+
+class VaultCredentialInput(TypedDict):
+    name: str
+    value: str
+    allowed_hosts: list[str]
+    header: NotRequired[bool]
+    body: NotRequired[bool]
+
+
+class VaultCredentialUpdateInput(TypedDict, total=False):
+    name: str
+    value: str
+    allowed_hosts: list[str]
+    header: bool
+    body: bool
+
+
+class MobileOpsVaultsError(Exception):
+    def __init__(self, response: httpx.Response, body: Any) -> None:
+        self.status_code = response.status_code
+        self.response = response
+        self.body = body
+        message = (
+            body.get("error")
+            if isinstance(body, dict) and isinstance(body.get("error"), str)
+            else f"MobileOPS Vaults request failed with status {response.status_code}"
+        )
+        super().__init__(message)
+
+
+class MobileOpsVaultCredentialsClient:
+    def __init__(self, vaults: "MobileOpsVaultsClient") -> None:
+        self._vaults = vaults
+
+    async def list(self, vault_id: str) -> list[VaultCredential]:
+        payload = await self._vaults._request_json(
+            "GET", self._vaults._credentials_url(vault_id)
+        )
+        return payload["credentials"]
+
+    async def create(
+        self,
+        vault_id: str,
+        *,
+        name: str,
+        value: str,
+        allowed_hosts: list[str],
+        header: bool | None = None,
+        body: bool | None = None,
+    ) -> VaultCredential:
+        payload_body: dict[str, Any] = {
+            "name": name,
+            "value": value,
+            "allowed_hosts": allowed_hosts,
+        }
+        if header is not None:
+            payload_body["header"] = header
+        if body is not None:
+            payload_body["body"] = body
+        payload = await self._vaults._request_json(
+            "POST",
+            self._vaults._credentials_url(vault_id),
+            json=payload_body,
+        )
+        return payload["credential"]
+
+    async def update(
+        self,
+        vault_id: str,
+        credential_id: str,
+        *,
+        name: str | None = None,
+        value: str | None = None,
+        allowed_hosts: list[str] | None = None,
+        header: bool | None = None,
+        body: bool | None = None,
+    ) -> VaultCredential:
+        payload_body: dict[str, Any] = {}
+        if name is not None:
+            payload_body["name"] = name
+        if value is not None:
+            payload_body["value"] = value
+        if allowed_hosts is not None:
+            payload_body["allowed_hosts"] = allowed_hosts
+        if header is not None:
+            payload_body["header"] = header
+        if body is not None:
+            payload_body["body"] = body
+        payload = await self._vaults._request_json(
+            "PATCH",
+            self._vaults._credential_url(vault_id, credential_id),
+            json=payload_body,
+        )
+        return payload["credential"]
+
+    async def delete(self, vault_id: str, credential_id: str) -> None:
+        await self._vaults._request(
+            "DELETE", self._vaults._credential_url(vault_id, credential_id)
+        )
+
+
+class MobileOpsVaultsClient:
+    def __init__(
+        self,
+        *,
+        api_url: str,
+        api_key: str,
+        headers: Mapping[str, str] | None = None,
+        http_client: httpx.AsyncClient | None = None,
+    ) -> None:
+        if not api_url:
+            raise ValueError("api_url is required")
+        if not api_key:
+            raise ValueError("api_key is required")
+        self._api_url = api_url.rstrip("/")
+        self._headers = build_headers(api_key, headers)
+        self._client = http_client or httpx.AsyncClient()
+        self._owns_client = http_client is None
+        self.credentials = MobileOpsVaultCredentialsClient(self)
+
+    async def aclose(self) -> None:
+        if self._owns_client:
+            await self._client.aclose()
+
+    async def list(self) -> list[Vault]:
+        payload = await self._request_json("GET", self._vaults_url())
+        return payload["vaults"]
+
+    async def create(self, *, name: str) -> Vault:
+        payload = await self._request_json(
+            "POST", self._vaults_url(), json={"name": name}
+        )
+        return payload["vault"]
+
+    async def retrieve(self, id: str) -> Vault:
+        payload = await self._request_json("GET", self._vault_url(id))
+        return payload["vault"]
+
+    async def update(self, id: str, *, name: str | None = None) -> Vault:
+        payload_body: dict[str, Any] = {}
+        if name is not None:
+            payload_body["name"] = name
+        payload = await self._request_json(
+            "PATCH", self._vault_url(id), json=payload_body
+        )
+        return payload["vault"]
+
+    async def delete(self, id: str) -> None:
+        await self._request("DELETE", self._vault_url(id))
+
+    def _vaults_url(self) -> str:
+        return f"{self._api_url}/context-hub/v1/vaults"
+
+    def _vault_url(self, id: str) -> str:
+        return f"{self._vaults_url()}/{quote(id, safe='')}"
+
+    def _credentials_url(self, vault_id: str) -> str:
+        return f"{self._vault_url(vault_id)}/credentials"
+
+    def _credential_url(self, vault_id: str, credential_id: str) -> str:
+        return f"{self._credentials_url(vault_id)}/{quote(credential_id, safe='')}"
+
+    async def _request_json(
+        self, method: str, url: str, **kwargs: Any
+    ) -> dict[str, Any]:
+        return (await self._request(method, url, **kwargs)).json()
+
+    async def _request(self, method: str, url: str, **kwargs: Any) -> httpx.Response:
+        headers = {**self._headers, **kwargs.pop("headers", {})}
+        response = await self._client.request(method, url, headers=headers, **kwargs)
+        if response.is_error:
+            content_type = response.headers.get("content-type", "")
+            body: Any = response.text
+            if "application/json" in content_type:
+                try:
+                    body = response.json()
+                except ValueError:
+                    pass
+            raise MobileOpsVaultsError(response, body)
+        return response

{mobileops_managed_agent-0.2.2 → mobileops_managed_agent-0.3.1/src/mobileops_managed_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mobileops-managed-agent
-Version: 0.2.2
+Version: 0.3.1
 Summary: Server-side SDK for the MobileOPS Managed Agent API.
 Project-URL: Homepage, https://github.com/InnoMindX/deepagent/tree/main/managed-agent-sdk/python
 Project-URL: Repository, https://github.com/InnoMindX/deepagent
@@ -18,11 +18,13 @@ Requires-Dist: pytest-asyncio>=0.23.0; extra == "dev"
 
 Server-side Python SDK for the MobileOPS Managed Agent API.
 
-The SDK exposes three surfaces:
+The SDK exposes five surfaces:
 
 - `client.agent` wraps the LangGraph runtime client and exposes the supported Assistant CRUD methods at `client.agent.assistants`.
 - `client.files` exposes MobileOPS Sandbox Workspace file routes.
 - `client.resources` manages Context Hub resources, versions, and latest-version files.
+- `client.vaults` manages credential vaults and their write-only credentials.
+- `client.sandbox_profiles` manages sandbox profiles (运行环境).
 
 Assistant create and update retain LangGraph's ordinary arguments, while
 persisted configuration is exposed through product fields. Pass
@@ -37,6 +39,8 @@ therefore only affects Runs started on **new** Threads; existing Threads keep
 the schema captured at their creation.
 
 ```py
+import os
+
 from mobileops_managed_agent import MobileOpsManagedAgentClient
 
 client = MobileOpsManagedAgentClient(api_url=api_url, api_key=api_key)
@@ -45,12 +49,25 @@ thread = await client.agent.threads.create()
 await client.agent.runs.create(thread["thread_id"], assistant_id, input=input)
 
 skill = await client.resources.create("skills", zip_bytes)  # slug inferred
+profile = await client.sandbox_profiles.create(
+    name="prod",
+    spec={"network": {"allow": ["*.example.com"]}},
+)
+vault = await client.vaults.create(name="prod")
+await client.vaults.credentials.create(
+    vault["id"],
+    name="GRAFANA_TOKEN",
+    value=os.environ["GRAFANA_TOKEN"],
+    allowed_hosts=["grafana.example.com"],
+)
 assistant = await client.agent.assistants.create(
     name="Operations agent",
     skills=[{
         "ref": skill["ref"],  # e.g. incident-response@sha256-…
         "target_path": "/workspace/skills",  # zip already contains {slug}/
     }],
+    sandbox_profile=profile["id"],
+    credential_vault=vault["id"],
 )
 
 await client.resources.versions.create("skills", skill["slug"], next_zip_bytes)

{mobileops_managed_agent-0.2.2 → mobileops_managed_agent-0.3.1}/src/mobileops_managed_agent.egg-info/SOURCES.txt

@@ -12,6 +12,9 @@ src/mobileops_managed_agent/files.py
 src/mobileops_managed_agent/resources.py
 src/mobileops_managed_agent/response_schema.py
 src/mobileops_managed_agent/sandbox_profile.py
+src/mobileops_managed_agent/sandbox_profiles.py
+src/mobileops_managed_agent/tool_permissions.py
+src/mobileops_managed_agent/vaults.py
 src/mobileops_managed_agent.egg-info/PKG-INFO
 src/mobileops_managed_agent.egg-info/SOURCES.txt
 src/mobileops_managed_agent.egg-info/dependency_links.txt