ag-ui-protocol / ag-ui-protocol/ag-ui

[Feature]: dojo agno integration — support Authorization header via env var

Aperta
#2,130 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
enhancement Integration
Lingua principale
Python
Stelle
15.9k
Fork
1.4k
Merge medio
1g 17h
PR unite (30g)
163

Descrizione

### Pre-flight Checklist

- [x] I have searched existing issues and this hasn't been requested yet.

### Problem or Motivation

Agno v2.7 ([agno-agi/agno#8747](https://github.com/agno-agi/agno/pull/8747)) put agno's AG-UI endpoint (`POST {prefix}/agui`) behind AgentOS's central auth middleware. Any deployment using `OS_SECURITY_KEY`, JWT auth, or platform access tokens now answers anonymous requests with:

```
HTTP 401 {"detail":"Authorization header required"}
```

The dojo builds its `AgnoAgent` instances from `AGNO_URL` alone:

```ts
(path) => new AgnoAgent({ url: `${envVars.agnoUrl}/${path}/agui` }),
```

There is no way to attach a credential, so the stock dojo cannot connect to **any** secured agno backend — every agno feature page fails with a 401.

### Proposed Solution

An opt-in `AGNO_AUTH_TOKEN` env var, mirroring the watsonx credential pattern ([#1665](https://github.com/ag-ui-protocol/ag-ui/pull/1665)):

- `env.ts` — read `AGNO_AUTH_TOKEN` with an empty-string default
- `agents.ts` — when the token is set, pass `headers: { Authorization: "Bearer " }` in the `AgnoAgent` config

No SDK changes needed: `HttpAgent` (which `AgnoAgent` extends) already accepts `headers` and sends them on every request. `agents.ts` is `server-only`, so the token never reaches the browser. When the var is unset, behavior is byte-identical to today.

```bash
AGNO_URL=http://localhost:9001 AGNO_AUTH_TOKEN= pnpm dev
```

The change is ~6 lines plus a README note — implemented in [#2132](https://github.com/ag-ui-protocol/ag-ui/pull/2132).

### Alternatives Considered

- Extending the per-request `x-*` header forwarding ([#1763](https://github.com/ag-ui-protocol/ag-ui/pull/1763)) — solves a different problem (forwarding browser request headers), not server-side static credentials.
- Reading env vars inside `@ag-ui/agno` — the SDK should stay env-agnostic; the dojo is the right layer, as with watsonx.

### Additional Context

The agno maintainers requested this dojo plumbing on the v2.7 review thread ([agno#8747](https://github.com/agno-agi/agno/pull/8747#discussion_r3535035220)).

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.