release(sdk-py): 0.4.4 (#8738)

Bumps the Python SDK version from 0.4.3 to 0.4.4.

.github/dependabot.yml

@@ -21,16 +21,6 @@ updates:
     directory: "/libs/checkpoint"
     schedule:
       interval: "monthly"
-    versioning-strategy: increase
-    ignore:
-      - dependency-name: "langgraph"
-      - dependency-name: "langgraph-cli"
-      - dependency-name: "langgraph-sdk"
-      - dependency-name: "langgraph-prebuilt"
-      - dependency-name: "langgraph-checkpoint"
-      - dependency-name: "langgraph-checkpoint-postgres"
-      - dependency-name: "langgraph-checkpoint-sqlite"
-      - dependency-name: "langgraph-checkpoint-conformance"
     groups:
       minor-and-patch:
         patterns:
@@ -48,16 +38,6 @@ updates:
     directory: "/libs/checkpoint-conformance"
     schedule:
       interval: "monthly"
-    versioning-strategy: increase
-    ignore:
-      - dependency-name: "langgraph"
-      - dependency-name: "langgraph-cli"
-      - dependency-name: "langgraph-sdk"
-      - dependency-name: "langgraph-prebuilt"
-      - dependency-name: "langgraph-checkpoint"
-      - dependency-name: "langgraph-checkpoint-postgres"
-      - dependency-name: "langgraph-checkpoint-sqlite"
-      - dependency-name: "langgraph-checkpoint-conformance"
     groups:
       minor-and-patch:
         patterns:
@@ -75,16 +55,6 @@ updates:
     directory: "/libs/checkpoint-postgres"
     schedule:
       interval: "monthly"
-    versioning-strategy: increase
-    ignore:
-      - dependency-name: "langgraph"
-      - dependency-name: "langgraph-cli"
-      - dependency-name: "langgraph-sdk"
-      - dependency-name: "langgraph-prebuilt"
-      - dependency-name: "langgraph-checkpoint"
-      - dependency-name: "langgraph-checkpoint-postgres"
-      - dependency-name: "langgraph-checkpoint-sqlite"
-      - dependency-name: "langgraph-checkpoint-conformance"
     groups:
       minor-and-patch:
         patterns:
@@ -102,16 +72,6 @@ updates:
     directory: "/libs/checkpoint-sqlite"
     schedule:
       interval: "monthly"
-    versioning-strategy: increase
-    ignore:
-      - dependency-name: "langgraph"
-      - dependency-name: "langgraph-cli"
-      - dependency-name: "langgraph-sdk"
-      - dependency-name: "langgraph-prebuilt"
-      - dependency-name: "langgraph-checkpoint"
-      - dependency-name: "langgraph-checkpoint-postgres"
-      - dependency-name: "langgraph-checkpoint-sqlite"
-      - dependency-name: "langgraph-checkpoint-conformance"
     groups:
       minor-and-patch:
         patterns:
@@ -129,16 +89,6 @@ updates:
     directory: "/libs/cli"
     schedule:
       interval: "monthly"
-    versioning-strategy: increase
-    ignore:
-      - dependency-name: "langgraph"
-      - dependency-name: "langgraph-cli"
-      - dependency-name: "langgraph-sdk"
-      - dependency-name: "langgraph-prebuilt"
-      - dependency-name: "langgraph-checkpoint"
-      - dependency-name: "langgraph-checkpoint-postgres"
-      - dependency-name: "langgraph-checkpoint-sqlite"
-      - dependency-name: "langgraph-checkpoint-conformance"
     groups:
       minor-and-patch:
         patterns:
@@ -156,16 +106,6 @@ updates:
     directory: "/libs/langgraph"
     schedule:
       interval: "monthly"
-    versioning-strategy: increase
-    ignore:
-      - dependency-name: "langgraph"
-      - dependency-name: "langgraph-cli"
-      - dependency-name: "langgraph-sdk"
-      - dependency-name: "langgraph-prebuilt"
-      - dependency-name: "langgraph-checkpoint"
-      - dependency-name: "langgraph-checkpoint-postgres"
-      - dependency-name: "langgraph-checkpoint-sqlite"
-      - dependency-name: "langgraph-checkpoint-conformance"
     groups:
       minor-and-patch:
         patterns:
@@ -183,16 +123,6 @@ updates:
     directory: "/libs/prebuilt"
     schedule:
       interval: "monthly"
-    versioning-strategy: increase
-    ignore:
-      - dependency-name: "langgraph"
-      - dependency-name: "langgraph-cli"
-      - dependency-name: "langgraph-sdk"
-      - dependency-name: "langgraph-prebuilt"
-      - dependency-name: "langgraph-checkpoint"
-      - dependency-name: "langgraph-checkpoint-postgres"
-      - dependency-name: "langgraph-checkpoint-sqlite"
-      - dependency-name: "langgraph-checkpoint-conformance"
     groups:
       minor-and-patch:
         patterns:
@@ -210,16 +140,6 @@ updates:
     directory: "/libs/sdk-py"
     schedule:
       interval: "monthly"
-    versioning-strategy: increase
-    ignore:
-      - dependency-name: "langgraph"
-      - dependency-name: "langgraph-cli"
-      - dependency-name: "langgraph-sdk"
-      - dependency-name: "langgraph-prebuilt"
-      - dependency-name: "langgraph-checkpoint"
-      - dependency-name: "langgraph-checkpoint-postgres"
-      - dependency-name: "langgraph-checkpoint-sqlite"
-      - dependency-name: "langgraph-checkpoint-conformance"
     groups:
       minor-and-patch:
         patterns:
@@ -266,38 +186,3 @@ updates:
           - "*"
         update-types:
           - "major"
-
-  # CI builds this maintained integration image and Compose stack.
-  - package-ecosystem: "docker"
-    directory: "/libs/sdk-py/integration"
-    schedule:
-      interval: "monthly"
-    groups:
-      minor-and-patch:
-        patterns:
-          - "*"
-        update-types:
-          - "minor"
-          - "patch"
-      major:
-        patterns:
-          - "*"
-        update-types:
-          - "major"
-
-  - package-ecosystem: "docker-compose"
-    directory: "/libs/sdk-py/integration"
-    schedule:
-      interval: "monthly"
-    groups:
-      minor-and-patch:
-        patterns:
-          - "*"
-        update-types:
-          - "minor"
-          - "patch"
-      major:
-        patterns:
-          - "*"
-        update-types:
-          - "major"

AGENTS.md

@@ -2,6 +2,14 @@
 
 This repository is a monorepo. Each library lives in a subdirectory under `libs/`.
 
+<corridor>
+
+## Corridor security analysis
+
+When Corridor's `analyzePlan` tool is available, create a plan and use the tool to analyze it before generating or modifying code. Apply the resulting security guidance before writing code.
+
+</corridor>
+
 When you modify code in any library, run the following commands in that library's directory before creating a pull request:
 
 - `make format` – run code formatters

CLAUDE.md

@@ -2,6 +2,14 @@
 
 This repository is a monorepo. Each library lives in a subdirectory under `libs/`.
 
+<corridor>
+
+## Corridor security analysis
+
+Before generating or modifying code, create a plan and use Corridor's `analyzePlan` tool to analyze it. Apply the resulting security guidance before writing code.
+
+</corridor>
+
 When you modify code in any library, run the following commands in that library's directory before creating a pull request:
 
 - `make format` – run code formatters

libs/sdk-py/CHANGELOG.md

@@ -39,6 +39,15 @@
 - `client.threads.stream()` now accepts `transport="sse"` (default) or
   `transport="websocket"` in place of the previous transport-agnostic default.
 
+### Fixed
+
+- Resource-scoped auth decorators now honor `actions=` and reject empty or
+  invalid action lists. Because unmatched custom-auth paths remain allowed,
+  deployments using action-scoped handlers should configure a global
+  default-deny handler; `langgraph-api` 0.10+ warns about uncovered paths at
+  startup. Resource-specific decorators retain matching `resources=` selectors
+  for backward compatibility; use `@auth.on(resources=...)` for other resources.
+
 ### Notes
 
 - The v3 streaming surface (`AsyncThreadStream`, `SyncThreadStream`, and all

libs/sdk-py/langgraph_sdk/__init__.py

@@ -3,7 +3,7 @@ from langgraph_sdk.client import get_client, get_sync_client
 from langgraph_sdk.encryption import Encryption
 from langgraph_sdk.encryption.types import DecryptResult, EncryptionContext
 
-__version__ = "0.4.3"
+__version__ = "0.4.4"
 
 __all__ = [
     "Auth",

libs/sdk-py/langgraph_sdk/_async/stream.py

@@ -24,7 +24,7 @@ from langchain_core.language_models.chat_model_stream import AsyncChatModelStrea
 from langchain_protocol import Event, SubscribeParams
 
 from langgraph_sdk._async.http import HttpClient
-from langgraph_sdk.schema import QueryParamTypes
+from langgraph_sdk.schema import LangSmithTracing, QueryParamTypes
 from langgraph_sdk.stream.controller import _SeenEventIds
 from langgraph_sdk.stream.decoders import (
     DataDecoder,
@@ -172,6 +172,7 @@ class RunModule:
         input: Any = None,
         config: dict[str, Any] | None = None,
         metadata: dict[str, Any] | None = None,
+        langsmith_tracing: LangSmithTracing | None = None,
     ) -> dict[str, Any]:
         """Send `run.start` to the server. Returns the result (`{"run_id": ...}`)."""
         params: dict[str, Any] = {"assistant_id": self._owner.assistant_id}
@@ -181,6 +182,8 @@ class RunModule:
             params["config"] = config
         if metadata is not None:
             params["metadata"] = metadata
+        if langsmith_tracing is not None:
+            params["langsmith_tracer"] = langsmith_tracing
         loop = asyncio.get_running_loop()
         gate: asyncio.Future[None] = loop.create_future()
         self._owner._run_start_ready = gate

libs/sdk-py/langgraph_sdk/_sync/stream.py

@@ -23,7 +23,7 @@ from langchain_core.language_models.chat_model_stream import ChatModelStream
 from langchain_protocol import Event, SubscribeParams
 
 from langgraph_sdk._sync.http import SyncHttpClient
-from langgraph_sdk.schema import QueryParamTypes
+from langgraph_sdk.schema import LangSmithTracing, QueryParamTypes
 from langgraph_sdk.stream.decoders import (
     DataDecoder,
     Decoder,
@@ -215,6 +215,7 @@ class SyncRunModule:
         input: Any = None,
         config: dict[str, Any] | None = None,
         metadata: dict[str, Any] | None = None,
+        langsmith_tracing: LangSmithTracing | None = None,
     ) -> dict[str, Any]:
         """Send `run.start` to the server. Returns the result (`{"run_id": ...}`)."""
         params: dict[str, Any] = {"assistant_id": self._owner.assistant_id}
@@ -224,6 +225,8 @@ class SyncRunModule:
             params["config"] = config
         if metadata is not None:
             params["metadata"] = metadata
+        if langsmith_tracing is not None:
+            params["langsmith_tracer"] = langsmith_tracing
         result = self._owner._send_command("run.start", params)
         self._owner._run_seen = True
         controller = self._owner._controller

libs/sdk-py/langgraph_sdk/auth/__init__.py

@@ -341,9 +341,15 @@ VUpdate = typing.TypeVar("VUpdate", covariant=True)
 VRead = typing.TypeVar("VRead", covariant=True)
 VDelete = typing.TypeVar("VDelete", covariant=True)
 VSearch = typing.TypeVar("VSearch", covariant=True)
+ResourceActionT = typing.TypeVar("ResourceActionT", bound=str)
+
+_ResourceAction = typing.Literal["create", "read", "update", "delete", "search"]
+_ThreadAction = _ResourceAction | typing.Literal["create_run"]
 
 
-class _ResourceOn(typing.Generic[VCreate, VRead, VUpdate, VDelete, VSearch]):
+class _ResourceOn(
+    typing.Generic[VCreate, VRead, VUpdate, VDelete, VSearch, ResourceActionT]
+):
     """
     Generic base class for resource-specific handlers.
     """
@@ -392,8 +398,8 @@ class _ResourceOn(typing.Generic[VCreate, VRead, VUpdate, VDelete, VSearch]):
     def __call__(
         self,
         *,
-        resources: str | Sequence[str],
-        actions: str | Sequence[str] | None = None,
+        resources: str | Sequence[str] | None = None,
+        actions: ResourceActionT | Sequence[ResourceActionT] | None = None,
     ) -> Callable[
         [_ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch]],
         _ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch],
@@ -408,7 +414,7 @@ class _ResourceOn(typing.Generic[VCreate, VRead, VUpdate, VDelete, VSearch]):
         ) = None,
         *,
         resources: str | Sequence[str] | None = None,
-        actions: str | Sequence[str] | None = None,
+        actions: ResourceActionT | Sequence[ResourceActionT] | None = None,
     ) -> (
         _ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch]
         | Callable[
@@ -416,24 +422,66 @@ class _ResourceOn(typing.Generic[VCreate, VRead, VUpdate, VDelete, VSearch]):
             _ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch],
         ]
     ):
-        if fn is not None:
-            _validate_handler(fn)
-            return typing.cast(
-                "_ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch]",
-                _register_handler(self.auth, self.resource, "*", fn),
-            )
-
         def decorator(
             handler: _ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch],
         ) -> _ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch]:
             _validate_handler(handler)
-            return typing.cast(
-                "_ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch]",
-                _register_handler(self.auth, self.resource, "*", handler),
+            if resources is None:
+                resource_list = [self.resource]
+            elif isinstance(resources, str):
+                resource_list = [resources]
+            elif isinstance(resources, Sequence):
+                resource_list = list(resources)
+            else:
+                raise TypeError("resources must be a string or sequence of strings")
+            if resource_list != [self.resource]:
+                raise ValueError(
+                    f"Resource-specific decorator for {self.resource!r} cannot "
+                    f"register handlers for {resource_list!r}. Use @auth.on(...) "
+                    "for other or multiple resources."
+                )
+            if actions is None:
+                action_list = ["*"]
+            elif isinstance(actions, str):
+                action_list = [actions]
+            elif isinstance(actions, Sequence):
+                action_list = list(actions)
+            else:
+                raise TypeError("actions must be a string or sequence of strings")
+            if not action_list:
+                raise ValueError("actions must not be empty")
+            if not all(isinstance(action, str) for action in action_list):
+                raise TypeError("actions must be a string or sequence of strings")
+            valid_actions = {
+                value.action
+                for value in vars(self).values()
+                if isinstance(value, _ResourceActionOn)
+            }
+            invalid_actions = (
+                sorted(set(action_list) - valid_actions) if actions is not None else []
             )
+            if invalid_actions:
+                raise ValueError(
+                    f"Invalid action(s) for {self.resource}: {', '.join(invalid_actions)}"
+                )
+            if len(action_list) != len(set(action_list)):
+                raise ValueError("actions must not contain duplicates")
+            for action in action_list:
+                if (self.resource, action) in self.auth._handlers:
+                    raise ValueError(
+                        f"types.Handler already set for {self.resource}, {action}."
+                    )
+            for action in action_list:
+                _register_handler(self.auth, self.resource, action, handler)
+            return handler
 
-        # Accept keyword-only parameters for future filtering behavior; referenced to satisfy linters.
-        _ = resources, actions
+        if fn is not None:
+            return decorator(
+                typing.cast(
+                    "_ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch]",
+                    fn,
+                )
+            )
         return decorator
 
 
@@ -444,6 +492,7 @@ class _AssistantsOn(
         types.AssistantsUpdate,
         types.AssistantsDelete,
         types.AssistantsSearch,
+        _ResourceAction,
     ]
 ):
     value = (
@@ -467,6 +516,7 @@ class _ThreadsOn(
         types.ThreadsUpdate,
         types.ThreadsDelete,
         types.ThreadsSearch,
+        _ThreadAction,
     ]
 ):
     value = (
@@ -502,6 +552,7 @@ class _CronsOn(
         types.CronsUpdate,
         types.CronsDelete,
         types.CronsSearch,
+        _ResourceAction,
     ]
 ):
     value = type[

libs/sdk-py/tests/streaming/test_sync_thread_stream.py

@@ -426,11 +426,17 @@ def test_sync_run_start_sends_command():
     with httpx.Client(transport=fake.transport, base_url="http://test") as raw:
         threads = SyncThreadsClient(SyncHttpClient(raw))
         with threads.stream(thread_id="t-1", assistant_id="agent") as thread:
-            result = thread.run.start(input={"x": 1})
+            result = thread.run.start(
+                input={"x": 1},
+                langsmith_tracing={"project_name": "replica-project"},
+            )
 
     assert result == {"run_id": "run-1"}
     assert fake.received_commands[0]["method"] == "run.start"
     assert fake.received_commands[0]["params"]["assistant_id"] == "agent"
+    assert fake.received_commands[0]["params"]["langsmith_tracer"] == {
+        "project_name": "replica-project"
+    }
 
 
 def test_sync_events_iterates_raw_events():

libs/sdk-py/tests/streaming/test_thread_stream.py

@@ -287,7 +287,7 @@ async def test_command_ids_are_monotonic():
     assert [c["id"] for c in fake.received_commands] == [1, 2]
 
 
-async def test_run_start_forwards_config_and_metadata():
+async def test_run_start_forwards_config_metadata_and_langsmith_tracing():
     fake = FakeServer()
     transport = httpx.ASGITransport(app=fake.app)
     async with httpx.AsyncClient(transport=transport, base_url="http://test") as raw:
@@ -297,10 +297,18 @@ async def test_run_start_forwards_config_and_metadata():
                 input={"x": 1},
                 config={"recursion_limit": 5},
                 metadata={"trace": "abc"},
+                langsmith_tracing={
+                    "project_name": "replica-project",
+                    "example_id": "example-1",
+                },
             )
     params = fake.received_commands[0]["params"]
     assert params["config"] == {"recursion_limit": 5}
     assert params["metadata"] == {"trace": "abc"}
+    assert params["langsmith_tracer"] == {
+        "project_name": "replica-project",
+        "example_id": "example-1",
+    }
 
 
 async def test_run_start_raises_outside_context_manager():

libs/sdk-py/tests/test_auth.py

@@ -0,0 +1,132 @@
+import pytest
+
+from langgraph_sdk import Auth
+
+
+def test_handler_multiple_resources_and_actions() -> None:
+    auth = Auth()
+
+    @auth.on(resources=["threads", "assistants"], actions=["read", "search"])
+    async def allow_reads(ctx, value):
+        del value
+        return {"owner": ctx.user.identity}
+
+    assert auth._handlers == {
+        ("threads", "read"): [allow_reads],
+        ("threads", "search"): [allow_reads],
+        ("assistants", "read"): [allow_reads],
+        ("assistants", "search"): [allow_reads],
+    }
+
+
+def test_resource_handler_actions_are_scoped() -> None:
+    auth = Auth()
+
+    @auth.on
+    async def deny_all(ctx, value):
+        del ctx, value
+        return False
+
+    @auth.on.threads(actions=["create", "search"])
+    async def handler(ctx, value):
+        del ctx, value
+        return None
+
+    @auth.on.threads(actions="create_run")
+    async def run_handler(ctx, value):
+        del ctx, value
+        return None
+
+    assert auth._handlers == {
+        ("threads", "create"): [handler],
+        ("threads", "search"): [handler],
+        ("threads", "create_run"): [run_handler],
+    }
+    assert auth._global_handlers == [deny_all]
+
+
+def test_resource_handler_preserves_wildcard() -> None:
+    auth = Auth()
+
+    @auth.on.threads
+    async def handler(ctx, value):
+        del ctx, value
+        return None
+
+    assert auth._handlers == {("threads", "*"): [handler]}
+
+
+def test_resource_handler_preserves_wildcard_with_parentheses() -> None:
+    auth = Auth()
+
+    @auth.on.threads()
+    async def handler(ctx, value):
+        del ctx, value
+        return None
+
+    assert auth._handlers == {("threads", "*"): [handler]}
+
+
+def test_resource_handler_accepts_matching_resource() -> None:
+    auth = Auth()
+
+    @auth.on.threads(resources=["threads"], actions="read")
+    async def handler(ctx, value):
+        del ctx, value
+        return None
+
+    assert auth._handlers == {("threads", "read"): [handler]}
+
+
+@pytest.mark.parametrize(
+    "resources", [["assistants"], ["threads", "assistants"], [], [1]]
+)
+def test_resource_handler_rejects_nonmatching_resources(resources) -> None:
+    auth = Auth()
+
+    async def handler(ctx, value):
+        del ctx, value
+        return None
+
+    with pytest.raises(ValueError, match=r"Use @auth\.on"):
+        auth.on.threads(resources=resources)(handler)
+    assert auth._handlers == {}
+
+
+@pytest.mark.parametrize(
+    ("resource", "actions", "error"),
+    [
+        ("threads", [], ValueError),
+        ("threads", ["reed"], ValueError),
+        ("threads", ["create", "create"], ValueError),
+        ("threads", {"create": True}, TypeError),
+        ("crons", ["create_run"], ValueError),
+    ],
+)
+def test_resource_handler_rejects_invalid_actions(resource, actions, error) -> None:
+    auth = Auth()
+
+    async def handler(ctx, value):
+        del ctx, value
+        return None
+
+    with pytest.raises(error):
+        getattr(auth.on, resource)(actions=actions)(handler)
+    assert auth._handlers == {}
+
+
+def test_resource_handler_registration_is_atomic() -> None:
+    auth = Auth()
+
+    @auth.on.threads.read
+    async def read_handler(ctx, value):
+        del ctx, value
+        return None
+
+    async def handler(ctx, value):
+        del ctx, value
+        return None
+
+    with pytest.raises(ValueError, match="already set"):
+        auth.on.threads(actions=["create", "read"])(handler)
+    assert auth._handlers == {("threads", "read"): [read_handler]}