feat(managed-agent): Claude Platform Managed Agents workflow blocks

apps/sim/.env.example

@@ -64,6 +64,8 @@ API_ENCRYPTION_KEY=your_api_encryption_key # Use `openssl rand -hex 32` to gener
 # LITELLM_API_KEY=                       # Optional bearer token if your LiteLLM proxy requires auth
 # FIREWORKS_API_KEY=                     # Optional Fireworks AI API key for model listing
 # NEXT_PUBLIC_BEDROCK_DEFAULT_CREDENTIALS=true  # Set when using AWS default credential chain (IAM roles, ECS task roles, IRSA). Hides credential fields in Agent block UI.
+# MANAGED_AGENT_SELF_HOSTED_DEFAULTS='{"SOURCE_TYPE":"git","SOURCE_REF":"main"}'  # Server-only JSON object of default session-metadata rows seeded into fresh Claude Managed Agents (self-hosted) blocks. Deployment-specific; keys map to whatever env vars your self-hosted agent sandbox reads. Absent = empty table. Values are served via GET /api/managed-agent-defaults and never inlined into the client bundle — safe to include values that should not leak to the browser.
+# NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_MEMORY_ENABLED=true  # Reveal Memory Store + Memory Access fields on the Claude Managed Agents (self-hosted) block. Off by default: Claude self-hosted environments do not currently support the memory-store resource attach on the session API. Enable only if your self-hosted agent sandbox implements memory attach on its side.
 # AZURE_OPENAI_ENDPOINT=                        # Azure OpenAI endpoint (hides field in UI when set alongside NEXT_PUBLIC_AZURE_CONFIGURED)
 # AZURE_OPENAI_API_KEY=                         # Azure OpenAI API key
 # AZURE_OPENAI_API_VERSION=                     # Azure OpenAI API version

apps/sim/app/api/managed-agent-connections/[id]/agents/route.ts

@@ -0,0 +1,89 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  type ManagedAgentAgent,
+  managedAgentProxyParamsSchema,
+  managedAgentProxyQuerySchema,
+} from '@/lib/api/contracts'
+import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getDecryptedApiKey } from '@/lib/managed-agents/connections'
+import {
+  type AnthropicListPage,
+  apiKeyFailureResponse,
+  ManagedAgentProxyError,
+  proxyManagedAgentsGet,
+} from '@/lib/managed-agents/proxy'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+
+const logger = createLogger('ManagedAgentAgentsAPI')
+
+interface AnthropicAgent {
+  id: string
+  name?: string
+  description?: string
+  latest_version?: number | string
+  version?: number | string
+}
+
+interface RouteContext {
+  params: Promise<{ id: string }>
+}
+
+export const GET = withRouteHandler(async (request: NextRequest, context: RouteContext) => {
+  const requestId = generateRequestId()
+  try {
+    const authResult = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
+    if (!authResult.success || !authResult.userId) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+    const userId = authResult.userId
+
+    const rawParams = await context.params
+    const paramsValidation = managedAgentProxyParamsSchema.safeParse(rawParams)
+    const queryValidation = managedAgentProxyQuerySchema.safeParse(
+      Object.fromEntries(request.nextUrl.searchParams.entries())
+    )
+    if (!paramsValidation.success || !queryValidation.success) {
+      return NextResponse.json({ error: 'Invalid request data' }, { status: 400 })
+    }
+    const { id } = paramsValidation.data
+    const { workspaceId } = queryValidation.data
+
+    const userPermission = await getUserEntityPermissions(userId, 'workspace', workspaceId)
+    if (!userPermission) {
+      return NextResponse.json({ error: 'Access denied' }, { status: 403 })
+    }
+
+    const keyResult = await getDecryptedApiKey({ id, workspaceId })
+    if (!keyResult.ok) return apiKeyFailureResponse(keyResult)
+    const apiKey = keyResult.apiKey
+
+    try {
+      const body = await proxyManagedAgentsGet<AnthropicListPage<AnthropicAgent>>(
+        apiKey,
+        '/v1/agents?limit=100'
+      )
+      const data: ManagedAgentAgent[] = (body.data ?? []).map((row) => ({
+        id: row.id,
+        name: row.name ?? null,
+        description: row.description ?? null,
+        version: row.latest_version ?? row.version ?? null,
+      }))
+      return NextResponse.json({ data })
+    } catch (error) {
+      if (error instanceof ManagedAgentProxyError) {
+        return NextResponse.json({ error: error.message }, { status: 502 })
+      }
+      throw error
+    }
+  } catch (error) {
+    logger.error(`[${requestId}] Failed to list agents`, error)
+    return NextResponse.json(
+      { error: getErrorMessage(error, 'Failed to list agents') },
+      { status: 500 }
+    )
+  }
+})

apps/sim/app/api/managed-agent-connections/[id]/environments/[envId]/route.ts

@@ -0,0 +1,102 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  type ManagedAgentEnvironment,
+  managedAgentEnvironmentDetailParamsSchema,
+  managedAgentProxyQuerySchema,
+} from '@/lib/api/contracts'
+import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getDecryptedApiKey } from '@/lib/managed-agents/connections'
+import {
+  apiKeyFailureResponse,
+  ManagedAgentProxyError,
+  proxyManagedAgentsGet,
+} from '@/lib/managed-agents/proxy'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+
+const logger = createLogger('ManagedAgentEnvironmentAPI')
+
+interface AnthropicEnvironment {
+  id: string
+  name?: string
+  description?: string
+  scope?: 'organization' | 'account' | null
+  config?: { type?: 'cloud' | 'self_hosted' }
+}
+
+interface RouteContext {
+  params: Promise<{ id: string; envId: string }>
+}
+
+/**
+ * GET /api/managed-agent-connections/[id]/environments/[envId] — used by
+ * the workflow-block tool at run time to resolve `envType` before
+ * building the session-create payload.
+ */
+export const GET = withRouteHandler(async (request: NextRequest, context: RouteContext) => {
+  const requestId = generateRequestId()
+  try {
+    const authResult = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
+    if (!authResult.success || !authResult.userId) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+    const userId = authResult.userId
+
+    const rawParams = await context.params
+    const paramsValidation = managedAgentEnvironmentDetailParamsSchema.safeParse(rawParams)
+    const queryValidation = managedAgentProxyQuerySchema.safeParse(
+      Object.fromEntries(request.nextUrl.searchParams.entries())
+    )
+    if (!paramsValidation.success || !queryValidation.success) {
+      return NextResponse.json({ error: 'Invalid request data' }, { status: 400 })
+    }
+    const { id, envId } = paramsValidation.data
+    const { workspaceId } = queryValidation.data
+
+    const userPermission = await getUserEntityPermissions(userId, 'workspace', workspaceId)
+    if (!userPermission) {
+      return NextResponse.json({ error: 'Access denied' }, { status: 403 })
+    }
+
+    const keyResult = await getDecryptedApiKey({ id, workspaceId })
+    if (!keyResult.ok) return apiKeyFailureResponse(keyResult)
+    const apiKey = keyResult.apiKey
+
+    try {
+      const body = await proxyManagedAgentsGet<AnthropicEnvironment>(
+        apiKey,
+        `/v1/environments/${encodeURIComponent(envId)}`
+      )
+      const envType = body.config?.type
+      if (envType !== 'cloud' && envType !== 'self_hosted') {
+        return NextResponse.json(
+          { error: 'Environment returned an unrecognised config.type' },
+          { status: 502 }
+        )
+      }
+      const data: ManagedAgentEnvironment = {
+        id: body.id,
+        name: body.name ?? null,
+        description: body.description ?? null,
+        envType,
+        scope: body.scope ?? null,
+      }
+      return NextResponse.json({ data })
+    } catch (error) {
+      if (error instanceof ManagedAgentProxyError) {
+        const status = error.status === 404 ? 404 : 502
+        return NextResponse.json({ error: error.message }, { status })
+      }
+      throw error
+    }
+  } catch (error) {
+    logger.error(`[${requestId}] Failed to fetch environment`, error)
+    return NextResponse.json(
+      { error: getErrorMessage(error, 'Failed to fetch environment') },
+      { status: 500 }
+    )
+  }
+})

apps/sim/app/api/managed-agent-connections/[id]/environments/route.ts

@@ -0,0 +1,96 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  type ManagedAgentEnvironment,
+  managedAgentProxyParamsSchema,
+  managedAgentProxyQuerySchema,
+} from '@/lib/api/contracts'
+import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getDecryptedApiKey } from '@/lib/managed-agents/connections'
+import {
+  type AnthropicListPage,
+  apiKeyFailureResponse,
+  ManagedAgentProxyError,
+  proxyManagedAgentsGet,
+} from '@/lib/managed-agents/proxy'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+
+const logger = createLogger('ManagedAgentEnvironmentsAPI')
+
+interface AnthropicEnvironment {
+  id: string
+  name?: string
+  description?: string
+  scope?: 'organization' | 'account' | null
+  config?: { type?: 'cloud' | 'self_hosted' }
+}
+
+interface RouteContext {
+  params: Promise<{ id: string }>
+}
+
+export const GET = withRouteHandler(async (request: NextRequest, context: RouteContext) => {
+  const requestId = generateRequestId()
+  try {
+    const authResult = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
+    if (!authResult.success || !authResult.userId) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+    const userId = authResult.userId
+
+    const rawParams = await context.params
+    const paramsValidation = managedAgentProxyParamsSchema.safeParse(rawParams)
+    const queryValidation = managedAgentProxyQuerySchema.safeParse(
+      Object.fromEntries(request.nextUrl.searchParams.entries())
+    )
+    if (!paramsValidation.success || !queryValidation.success) {
+      return NextResponse.json({ error: 'Invalid request data' }, { status: 400 })
+    }
+    const { id } = paramsValidation.data
+    const { workspaceId } = queryValidation.data
+
+    const userPermission = await getUserEntityPermissions(userId, 'workspace', workspaceId)
+    if (!userPermission) {
+      return NextResponse.json({ error: 'Access denied' }, { status: 403 })
+    }
+
+    const keyResult = await getDecryptedApiKey({ id, workspaceId })
+    if (!keyResult.ok) return apiKeyFailureResponse(keyResult)
+    const apiKey = keyResult.apiKey
+
+    try {
+      const body = await proxyManagedAgentsGet<AnthropicListPage<AnthropicEnvironment>>(
+        apiKey,
+        '/v1/environments?limit=100'
+      )
+      const data: ManagedAgentEnvironment[] = (body.data ?? [])
+        .map((row) => {
+          const envType = row.config?.type
+          if (envType !== 'cloud' && envType !== 'self_hosted') return null
+          return {
+            id: row.id,
+            name: row.name ?? null,
+            description: row.description ?? null,
+            envType,
+            scope: row.scope ?? null,
+          }
+        })
+        .filter((row): row is ManagedAgentEnvironment => row !== null)
+      return NextResponse.json({ data })
+    } catch (error) {
+      if (error instanceof ManagedAgentProxyError) {
+        return NextResponse.json({ error: error.message }, { status: 502 })
+      }
+      throw error
+    }
+  } catch (error) {
+    logger.error(`[${requestId}] Failed to list environments`, error)
+    return NextResponse.json(
+      { error: getErrorMessage(error, 'Failed to list environments') },
+      { status: 500 }
+    )
+  }
+})