feat(guardrails): send execution source and job key headers by valentinabojan · Pull Request #1739 · UiPath/uipath-python

valentinabojan · 2026-06-22T14:47:30Z

Guardrail validation calls now send the execution source (x-uipath-guardrails-source) and job key (x-uipath-jobkey) headers for licensing/metering correlation.

The source is derived from the executing CLI command (run→runtime, debug/dev→playground, eval→eval) on UiPathRuntimeContext.execution_source (added in uipath-runtime 0.11.4), and flows through the execution-context boundary rather than an env var: the CLI calls set_execution_source(ctx.execution_source), which sets a ContextVar that UiPathExecutionContext.execution_source reads, and GuardrailsService builds the header from self._execution_context.execution_source. This keeps the source correctly scoped for concurrent/eval runs and works for both coded and low-code agents, since both run through the uipath CLI. Job key continues to come from UiPathConfig.job_key; both headers are omitted when unset.

Requires uipath-runtime>=0.11.4 (companion PR: UiPath/uipath-runtime-python#132).

🤖 Generated with Claude Code

Guardrail validation calls now carry x-uipath-agenthub-config (execution source) and x-uipath-jobkey headers for licensing/metering correlation, mirroring the licensing flow. The source is derived from the executing CLI command (run -> runtime, debug/dev -> playground, eval -> eval) and exposed via the UIPATH_EXECUTION_SOURCE env var, so it works for both coded and low-code agents since both run through the uipath CLI. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Also drops the "(AgentHub config)" note from the execution_source docstring. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Copilot

Pull request overview

This PR adds correlation metadata to guardrail validation requests by propagating the CLI execution “source” and orchestrator job key into HTTP headers, aligning guardrails with existing licensing/metering flows.

Changes:

Set UIPATH_EXECUTION_SOURCE at the start of CLI agent-executing commands (run, debug, dev, eval) via a new execution-source resolver.
Send x-uipath-agenthub-config (execution source) and x-uipath-jobkey (job key) headers on guardrail validation requests, omitting each when unset.
Add unit tests to verify presence/absence of the new headers on outgoing guardrails requests.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
packages/uipath/src/uipath/_cli/cli_run.py	Sets execution source for `run` before runtime construction.
packages/uipath/src/uipath/_cli/cli_eval.py	Sets execution source for `eval` before evaluation execution starts.
packages/uipath/src/uipath/_cli/cli_dev.py	Sets execution source for `dev` before launching the developer console/runtime.
packages/uipath/src/uipath/_cli/cli_debug.py	Sets execution source for `debug` before runtime/debug setup.
packages/uipath/src/uipath/_cli/_utils/_execution_source.py	New mapping logic from CLI command → execution source env var.
packages/uipath-platform/src/uipath/platform/guardrails/_guardrails_service.py	Adds execution source + job key headers to guardrails validate requests.
packages/uipath-platform/src/uipath/platform/common/constants.py	Introduces `UIPATH_EXECUTION_SOURCE` env var constant.
packages/uipath-platform/src/uipath/platform/common/_job_context.py	Adds `header_execution_source()` helper alongside existing job key header helper.
packages/uipath-platform/src/uipath/platform/common/_config.py	Exposes `UiPathConfig.execution_source` via the new env var.
packages/uipath-platform/tests/services/test_guardrails_service.py	Adds tests ensuring headers are present when set and omitted when unset.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Use a dedicated x-uipath-execution-source header instead of reusing x-uipath-agenthub-config. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Mirror get_execution_type's plain command->type mapping; the playground reclassification was a licensing-only concern. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

- Raise uipath -> uipath-platform pin to >=0.1.72 (dependency-bump check) - Regenerate uv.lock files for the version bumps (--locked sync) - Add unit tests for set_execution_source and header_execution_source Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…ails-source-job-headers # Conflicts: # packages/uipath/pyproject.toml # packages/uipath/uv.lock

…ails-source-job-headers # Conflicts: # packages/uipath-platform/pyproject.toml # packages/uipath-platform/uv.lock # packages/uipath/pyproject.toml # packages/uipath/uv.lock

radu-mocanu

env vars are acceptable for process bootstrap/config coming from the outside world, but this PR uses an env var as an internal (same-process) message bus from the CLI layer to the platform client. this is not a clean design as it:

makes the state global
can t be scoped in async/concurrent eval runs
etc.

we should make this execution metadata part of runtimecontext and pass it through the existing context boundary, as currently done for for command/job/trace-related execution state.

A cleaner shape would be:


 - map `command -> execution_source` when building `UiPathRuntimeContext`
 - carry it as `runtime_context.execution_source`
 - propagate it into `UiPathExecutionContext` / the platform client context
 - have `GuardrailsService` read `self._execution_context.execution_source` when adding `x-uipath-guardrails-source`

Replace the UIPATH_EXECUTION_SOURCE env-var bridge with the runtime context boundary, addressing PR review feedback (env var as an internal same-process message bus is global and not scoped for concurrent runs). - platform: add ExecutionSourceContext (a scoped ContextVar manager) and UiPathExecutionContext.execution_source reading it - guardrails: build x-uipath-guardrails-source from self._execution_context.execution_source - cli: enter ExecutionSourceContext(ctx.execution_source) around run/ debug/dev/eval execution, sourcing the value from the runtime context - remove the env var: UIPATH_EXECUTION_SOURCE, UiPathConfig.execution_source, header_execution_source(), and the _execution_source CLI helper - bump uipath-runtime pin to >=0.11.4 for the new UiPathRuntimeContext.execution_source field Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Replace ExecutionSourceContext with a set_execution_source(value) helper backed by the same ContextVar. CLI handlers call it once with ctx.execution_source instead of wrapping the run in a context manager; the set/reset scoping was only meaningful for the dev server and a CLI invocation is one source per process. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…ails-source-job-headers # Conflicts: # packages/uipath-platform/pyproject.toml # packages/uipath-platform/uv.lock # packages/uipath/pyproject.toml # packages/uipath/uv.lock

Extract the dev context/factory setup into _create_dev_factory and unit test it, so the new execution-source logic in the (otherwise untested) dev command is covered. Addresses SonarCloud new-code coverage. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

- drop unused type:ignore on _create_dev_factory - patch UiPathRuntimeFactoryRegistry.get via string target to avoid no_implicit_reexport on the cli_dev re-import Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…ails-source-job-headers # Conflicts: # packages/uipath/pyproject.toml

radu-mocanu · 2026-06-24T15:55:12Z

                    command="debug",
-                ) as ctx:
+                )
+                set_execution_source(ctx.execution_source)


this should be a context manager (like ctx or the resource overwrites). the context var token should be released when we exit the context

Per review feedback, set the execution source with a context manager that releases the ContextVar token on exit (like ResourceOverwritesContext and the runtime ctx), instead of a bare setter. CLI handlers enter 'with ExecutionSourceContext(ctx.execution_source), ctx:'; dev wraps the console/server run. Adds a dev terminal test covering the scoped run. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sonarqubecloud · 2026-06-24T16:06:00Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
94.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2026-06-24T21:10:33Z

🚨 Heads up: `uipath-langchain` cross-tests are FAILING 🚨

Your changes may break the uipath-langchain-python integration.

⚠️ These checks are NOT enforced by branch protection rules. Please review the failures before merging.

🔍 Inspect the failed run →

Copilot AI review requested due to automatic review settings June 22, 2026 14:47

github-actions Bot added test:uipath-langchain Triggers tests in the uipath-langchain-python repository test:uipath-integrations labels Jun 22, 2026

Copilot started reviewing on behalf of valentinabojan June 22, 2026 14:48 View session

chore: bump uipath to 2.11.7 and uipath-platform to 0.1.72

dd0bf50

Also drops the "(AgentHub config)" note from the execution_source docstring. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Copilot AI reviewed Jun 22, 2026

View reviewed changes

Comment thread packages/uipath/src/uipath/_cli/_utils/_execution_source.py Outdated

Valentina Bojan and others added 6 commits June 22, 2026 17:50

docs: trim execution_source docstring

64b255e

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

feat(guardrails): send execution source on x-uipath-execution-source

b31a580

Use a dedicated x-uipath-execution-source header instead of reusing x-uipath-agenthub-config. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

feat(guardrails): rename source header to x-uipath-guardrails-source

c94cf5c

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

refactor: drop debug-rooted reclassification from execution source

987d2e4

Mirror get_execution_type's plain command->type mapping; the playground reclassification was a licensing-only concern. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/main' into valentinabojan/guardr…

c126ba4

…ails-source-job-headers # Conflicts: # packages/uipath/pyproject.toml # packages/uipath/uv.lock

valentinabojan requested a review from radu-mocanu June 23, 2026 09:11

ctiliescuuipath approved these changes Jun 23, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into valentinabojan/guardr…

43fc443

…ails-source-job-headers # Conflicts: # packages/uipath-platform/pyproject.toml # packages/uipath-platform/uv.lock # packages/uipath/pyproject.toml # packages/uipath/uv.lock

apetraru-uipath approved these changes Jun 23, 2026

View reviewed changes

radu-mocanu requested changes Jun 24, 2026

View reviewed changes

Valentina Bojan and others added 7 commits June 24, 2026 17:06

docs: shorten set_execution_source docstring

81f1549

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/main' into valentinabojan/guardr…

18ef4ed

…ails-source-job-headers # Conflicts: # packages/uipath-platform/pyproject.toml # packages/uipath-platform/uv.lock # packages/uipath/pyproject.toml # packages/uipath/uv.lock

fix(lint): resolve mypy errors in dev execution-source test

d7aaec7

- drop unused type:ignore on _create_dev_factory - patch UiPathRuntimeFactoryRegistry.get via string target to avoid no_implicit_reexport on the cli_dev re-import Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/main' into valentinabojan/guardr…

9be628e

…ails-source-job-headers # Conflicts: # packages/uipath/pyproject.toml

radu-mocanu reviewed Jun 24, 2026

View reviewed changes

valentinabojan requested a review from radu-mocanu June 24, 2026 16:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(guardrails): send execution source and job key headers#1739

feat(guardrails): send execution source and job key headers#1739
valentinabojan wants to merge 17 commits into
mainfrom
valentinabojan/guardrails-source-job-headers

valentinabojan commented Jun 22, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

radu-mocanu left a comment

Uh oh!

radu-mocanu Jun 24, 2026

Uh oh!

valentinabojan Jun 24, 2026

Uh oh!

sonarqubecloud Bot commented Jun 24, 2026

Uh oh!

github-actions Bot commented Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

valentinabojan commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

radu-mocanu left a comment

Choose a reason for hiding this comment

Uh oh!

radu-mocanu Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

valentinabojan Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Jun 24, 2026

Quality Gate passed

Uh oh!

github-actions Bot commented Jun 24, 2026

🚨 Heads up: uipath-langchain cross-tests are FAILING 🚨

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

valentinabojan commented Jun 22, 2026 •

edited

Loading

🚨 Heads up: `uipath-langchain` cross-tests are FAILING 🚨