From c14cf7c314adca465770d4c5b3827dba13b182f5 Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Tue, 10 Nov 2026 17:05:46 -0800 Subject: [PATCH 1/2] fix(agent-vault): drop accessBundleId from access bundle services Services belong to the Agent Vault project and can be in any number of access bundles, so the API no longer returns accessBundleId on the services in an access bundle read. Co-Authored-By: Claude Opus 5.5 --- infisical_sdk/api_types.py | 1 - tests/test_agent_vault.py | 6 +++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/infisical_sdk/api_types.py b/infisical_sdk/api_types.py index 85b9eb0..4512016 100644 --- a/infisical_sdk/api_types.py +++ b/infisical_sdk/api_types.py @@ -689,7 +689,6 @@ class AgentVaultAccessBundleRef(BaseModel): class AgentVaultService(BaseModel): """A service in an Agent Vault access bundle. type is http, mcp, postgres, mysql or ssh, and the API returns only that type's fields: hostPattern, allowedMethods, allowedPathPrefixes, customHeaders and substitutions for http; serverUrl, transport, hostPattern, allowedTools and customHeaders for mcp; host, port, database and tls for postgres and mysql; host and port for ssh. Its nested settings, such as credential and tls ({"enabled", "verify", "ca"}), are left as the API returns them.""" id: str - accessBundleId: str name: str type: str hostPattern: Optional[str] = None diff --git a/tests/test_agent_vault.py b/tests/test_agent_vault.py index d7711fb..d4d19c0 100644 --- a/tests/test_agent_vault.py +++ b/tests/test_agent_vault.py @@ -248,7 +248,7 @@ def test_access_bundles_list_reads_the_services_requiring_setup(api, agent_vault def test_access_bundles_get_reads_services_and_keeps_their_nested_settings(api, agent_vault, json_response): service = { - "id": SERVICE_ID, "accessBundleId": BUNDLE["id"], "name": "github", "type": "http", + "id": SERVICE_ID, "name": "github", "type": "http", "hostPattern": "api.github.com", "credential": {"type": "bearer", "memberProvidedFields": []}, "customHeaders": [], "substitutions": [], "personalValues": None, "createdAt": BUNDLE["createdAt"], "updatedAt": BUNDLE["updatedAt"], @@ -440,7 +440,7 @@ def test_sessions_create_keeps_the_servers_explanation_when_it_refuses_services( def test_access_bundles_get_reads_the_tools_an_mcp_service_allows(api, agent_vault, json_response): service = { - "id": SERVICE_ID, "accessBundleId": BUNDLE["id"], "name": "linear", "type": "mcp", + "id": SERVICE_ID, "name": "linear", "type": "mcp", "serverUrl": "https://mcp.linear.app/mcp", "transport": "streamable-http", "hostPattern": "mcp.linear.app", "allowedTools": ["list_issues"], "credential": {"type": "bearer", "memberProvidedFields": []}, "customHeaders": [], @@ -452,7 +452,7 @@ def test_access_bundles_get_reads_the_tools_an_mcp_service_allows(api, agent_vau def test_access_bundles_get_reads_database_and_ssh_services_without_http_fields(api, agent_vault, json_response): shared = { - "accessBundleId": BUNDLE["id"], "description": None, "variableReferences": [], "createdAt": BUNDLE["createdAt"], "updatedAt": BUNDLE["updatedAt"], + "description": None, "variableReferences": [], "createdAt": BUNDLE["createdAt"], "updatedAt": BUNDLE["updatedAt"], } postgres = dict(shared, id=SERVICE_ID, name="orders-db", type="postgres", host="db.internal", port=5432, database="orders", tls={"enabled": True, "verify": True, "ca": None}, From 9047e11d69c14f4b91d65fcd1b1631935e69f037 Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Tue, 10 Nov 2026 18:41:26 -0800 Subject: [PATCH 2/2] test(agent-vault): read bundle services with and without accessBundleId Co-Authored-By: Claude Opus 5.5 --- tests/test_agent_vault.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/tests/test_agent_vault.py b/tests/test_agent_vault.py index d4d19c0..30dfd64 100644 --- a/tests/test_agent_vault.py +++ b/tests/test_agent_vault.py @@ -246,16 +246,19 @@ def test_access_bundles_list_reads_the_services_requiring_setup(api, agent_vault assert bundle.services is None -def test_access_bundles_get_reads_services_and_keeps_their_nested_settings(api, agent_vault, json_response): +# Servers still send accessBundleId on each service for older SDK releases; this one reads both shapes. +@pytest.mark.parametrize("legacy", [{}, {"accessBundleId": BUNDLE["id"]}], ids=["current", "with accessBundleId"]) +def test_access_bundles_get_reads_services_and_keeps_their_nested_settings(api, agent_vault, json_response, legacy): service = { "id": SERVICE_ID, "name": "github", "type": "http", "hostPattern": "api.github.com", "credential": {"type": "bearer", "memberProvidedFields": []}, "customHeaders": [], "substitutions": [], "personalValues": None, - "createdAt": BUNDLE["createdAt"], "updatedAt": BUNDLE["updatedAt"], + "createdAt": BUNDLE["createdAt"], "updatedAt": BUNDLE["updatedAt"], **legacy, } api.session.get.return_value = json_response({"accessBundle": dict(BUNDLE, services=[service])}) [read] = agent_vault.access_bundles.get(BUNDLE["id"]).services assert (read.name, read.credential["type"], read.variableReferences) == ("github", "bearer", None) + assert not hasattr(read, "accessBundleId") def test_access_bundles_update_sends_an_empty_description_to_remove_it(api, agent_vault, json_response):