Uh oh!
There was an error while loading. Please reload this page.
Add 7 agent-framework integrations (OpenAI Agents, LangChain, ADK, smolagents, DSPy, Strands, Letta) - #53
Conversation
SDK Coverage •
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Greptile SummaryThis PR adds several agent framework integrations to the SDK. The main changes are:
Confidence Score: 5/5This looks safe to merge.
Important Files Changed
Reviews (2): Last reviewed commit: "Add DSPy, Strands, Letta integrations" | Re-trigger Greptile |
Uh oh!
There was an error while loading. Please reload this page.
| name = (serialized or {}).get("name", "tool") | ||
| decision = self._hooks.before_tool_call(name, {"input": input_str}) |
There was a problem hiding this comment.
LangChain passes this callback the tool input, but the adapter wraps it as {"input": input_str} before policy evaluation. For structured tool calls, the guard no longer sees fields like command, query, path, or url, so argument-sensitive blocking can miss a dangerous payload that would have been blocked with the original args.
There was a problem hiding this comment.
Fixed in #59. on_tool_start now prefers the structured inputs dict that newer LangChain forwards (resolved in _tool_call_args), so field-sensitive policy sees command / query / path / url; it falls back to {"input": input_str} only when structured args aren't provided. Unit test covers both paths.
| def _coerce_output_text(value: Any) -> str: | ||
| """Flatten an agent output (``str``, message object, or model) to text.""" | ||
| if isinstance(value, str): | ||
| return value | ||
| for attr in ("response", "content", "text", "output", "final_output"): | ||
| inner = getattr(value, attr, None) | ||
| if isinstance(inner, str): | ||
| return inner | ||
| return str(value) |
There was a problem hiding this comment.
When an OpenAI agent returns structured output, this path only checks a few attributes and then scans str(value). If the secret or unsafe content is stored in another field and the object's string form redacts or omits it, the output guardrail can allow content that is still returned to the caller.
There was a problem hiding this comment.
Fixed in #59. _coerce_output_text now flattens the whole object via flatten_text instead of returning the first .content/.text attribute, so a secret stashed in another field is scanned rather than omitted by the object's primary string form.
| def _coerce_text(value: Any) -> str: | ||
| if isinstance(value, str): | ||
| return value | ||
| text = getattr(value, "text", None) | ||
| if isinstance(text, str): | ||
| return text | ||
| return str(value) |
There was a problem hiding this comment.
The smolagents final-answer path only scans .text or str(value). If a final answer is a dict, model, or tool result whose string form hides a secret field, Unplug scans the harmless representation while the real final answer can still contain the unsafe value.
There was a problem hiding this comment.
Fixed in #59. _coerce_text now flattens structured answers (dict / model / tool result) via flatten_text rather than trusting .text or str(value), so a secret hidden in a sibling field is included in what gets scanned. Regression test added.
| decision = h.scan_agent_output(_coerce_text(final_answer)) | ||
| require_allowed(decision) | ||
| return True |
There was a problem hiding this comment.
This check raises on a blocked final answer, and smolagents treats check exceptions as failed checks that can leave the final answer as None. A user can receive an unexplained empty result instead of a clear blocked response, making guardrail blocks look like agent failures.
There was a problem hiding this comment.
Intentional. Raising in a final_answer_checks validator is smolagents' documented way to fail a check, and require_allowed raises with a descriptive message (Output blocked: …) so the block is explainable rather than a silent None. Keeping the fail-closed behavior — surfacing the message is a framework-side concern, not a reason to allow the answer through.
Uh oh!
There was an error while loading. Please reload this page.
Summary
Adds seven widely-used agent frameworks to the integration hub, each following the existing Haystack-style split: a framework-free core (matrix-tested, no SDK needed) plus lazy native wiring (live-tested against the real SDK). Tool policy is always enforced locally (fail-closed).
openai-agentsopenai_agents.pytripwire_triggered) + local tool guardlangchainlangchain.pyRunnableLambdainput/output guards +on_tool_startcallback handlergoogle-adkgoogle_adk.pybefore_model_callback(→LlmResponse) +before_tool_callback(→block dict)smolagentssmolagents.pyfinal_answer_checks+ tool guarddspydspy.pyunplug_guard_module(wraps anydspy.Module) +dspy_guard_toolfordspy.ReActstrandsstrands.pyUnplugHookProvidercancels destructive tool calls viaevent.cancel_toollettaletta.pyscan_letta_responseoverresponse.messagesPer framework: optional extra (folded into the
integrationsmeta-extra), a guide underintegrations/<name>/, a runnableexamples/<name>_hooks_demo.py, a live test, and security-matrix cases.Docs & linking
integrations/README.md+docs/INTEGRATIONS.mdframework tables and demo lists updatedintegrations/TESTING.md)pyproject.tomlextras +uv.lockre-locked (added:openai-agents 0.17.7,google-adk 2.3.0,smolagents 1.26.0,dspy 3.2.1,strands-agents 1.45.0,letta-client 1.12.1).github/workflows/integrations-live.yml: 7 new live-CI legsCHANGELOG.md[Unreleased]entryTest plan
ruff check+ruff format --checkclean across adapters, examples, and testsdspy 3.2.1,strands-agents 1.45.0,letta-client 1.12.1)Integrations (live)legs for all 7 extras