AI-231: keep tool and manifest credentials out of Workflow history - #2317
Draft
xumaple wants to merge 1 commit into
Draft
AI-231: keep tool and manifest credentials out of Workflow history#2317xumaple wants to merge 1 commit into
xumaple wants to merge 1 commit into
Conversation
…w history (AI-231) Hosted tool configuration and sandbox manifest environment values cross the Workflow/Activity boundary, so any credential in them is written to durable, replayable Workflow history. secretRef() and envSecretRef() write a reference that the Worker resolves from its own environment instead, and the provider's echoed tool definitions are stripped from both the Activity result and the published stream events. Bumps @openai/agents-core and @openai/agents-openai to ~0.14.3 for the EnvValueReference mechanism manifest references are built on. Manifest environment values backed by an EnvValue.resolve closure are now rejected: the SDK persists whatever such a closure returns into session state.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hosted tool configuration and sandbox manifest environment values cross the Workflow/Activity boundary, so a credential in either is written into Workflow history — durable, replayed, and visible in the Web UI.
secretRef('VAR')goes where a literal credential would in a hosted MCP tool'sauthorizationorheaders, or a shell or code interpreter tool's domain secrets;envSecretRef('VAR')does the same for sandbox Manifest environment values. Both name a Worker environment variable that the Worker resolves from its own process environment, so only the name crosses the boundary. An unset or empty variable fails the Activity non-retryably, naming the variable but never its value.The provider's raw response echoes the tool definitions back, so the same credentials returned through the Activity result and the streamed events; those echoes are now stripped from both before either reaches history. A Manifest environment value backed by an
EnvValue.resolveclosure is rejected outright, because the SDK persists whatever such a closure returns into session state.Manifest references are built on the
EnvValueReferencemechanism added in@openai/agents-core0.14.2, which is why this bumps to 0.14.3. That bump also introducestaskandturnspan types, so the tracing expectations gain those levels.Note: the guarantee covers those four hosted-tool fields and Manifest environment references, in both directions. Ephemeral Manifest file contents still reach history, and a marker placed in a field the plugin does not resolve is passed through verbatim to whatever consumes it — both stated in the README section this adds.
Based on #2186 and targets that branch.