fix(sdk): call real resource methods in agent-framework adapters - #411
fix(sdk): call real resource methods in agent-framework adapters#411EfeDurmaz16 wants to merge 2 commits into
Conversation
The langchain, ai-sdk, and mastra adapters used `as unknown as { ... }`
casts to invoke resource methods that had the wrong signature or did not
exist. The casts suppressed type-checking, so the calls compiled but would
fail at runtime:
- wallets.getBalance was called with an object as the 2nd arg; the real
signature is getBalance(walletId, chain, token).
- policies.check was passed {merchant, token}; the real input is
{agent_id, amount, merchant_id, merchant_category, ...}.
- policies.applyFromNaturalLanguage does not exist; the real method is
apply(natural_language, agent_id).
- holds.capture was passed an {amount} object; the real signature is
capture(holdId, amount?).
- transactions.list does not exist; recent activity lives in
ledger.listEntries({ wallet_id, limit }).
Remove the casts and call the real methods so tsc validates them. Add a
regression test pinning the argument shapes. tsc clean; 24 tests pass.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5f916009eb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| check: (body: Record<string, unknown>) => Promise<unknown>; | ||
| }).check({ | ||
| client.policies.check({ | ||
| agent_id: opts.agentId ?? '', |
There was a problem hiding this comment.
When callers use the documented AI SDK setup with only apiKey and walletId, opts.agentId is absent, but this now fabricates agent_id: '' for policies.check even though the SDK resource requires a real agent_id. That makes the default sardis_check_policy path send an invalid policy scope instead of failing closed or telling the user to configure an agent, so policy checks can fail or be evaluated against the wrong/nonexistent agent.
Useful? React with 👍 / 👎.
| client.policies.check({ | ||
| agent_id: opts.agentId ?? '', | ||
| amount: parsed.amount, | ||
| ...(parsed.token ? { token: parsed.token } : {}), | ||
| merchant: parsed.to, | ||
| ...(parsed.to ? { merchant_id: parsed.to } : {}), | ||
| }), |
There was a problem hiding this comment.
CheckPolicySchema still accepts a token, but the new typed payload drops it and only sends agent_id, amount, and merchant_id. For a non-default-token payment or a policy that restricts currencies, policies.check never receives the requested currency even though the resource supports currency, so the agent can get a policy decision for the wrong/default currency before paying with the requested token. Map parsed.token to currency or remove the input field.
Useful? React with 👍 / 👎.
1 participant
The langchain, ai-sdk, and mastra adapters used
as unknown as { ... }casts to invoke resource methods that had the wrong signature or did not exist. The casts suppressed type-checking, so the calls compiled but would fail at runtime:wallets.getBalancecalled with an object 2nd arg — real:getBalance(walletId, chain, token).policies.checkpassed{merchant, token}— real input:{agent_id, amount, merchant_id, merchant_category, ...}.policies.applyFromNaturalLanguagedoes not exist — real:apply(natural_language, agent_id).holds.capturepassed{amount}— real:capture(holdId, amount?).transactions.listdoes not exist — recent activity lives inledger.listEntries({ wallet_id, limit }).Removing the casts lets
tscvalidate the calls. Adds a regression test pinning the argument shapes. tsc clean; 24 tests pass (5 new).Surfaced by the ponytail×deslop minimization audit (deslop lens caught the casts; these were latent runtime bugs, not style).