Users can now access other users' PUBLIC agents and collections by providing
their own credentials in the request:
For agents:
- Provide `providerApiKey` for LLM access
- Provide `env` object with tool environment variables
- Owner's stored credentials are never shared
For collections (MCP):
- Provide `env` in params for tool environment variables
- Owner's stored credentials are never shared
Returns clear errors listing missing required env vars if not provided.
Files changed:
- packages/types/src/agent.ts: Add providerApiKey to SendMessageSchema
- apps/web/src/lib/agents/env-helpers.ts: New helper functions for env vars
- apps/web/src/lib/agents/build-tools.ts: Accept callerEnvVars parameter
- apps/web/src/app/api/agents/[id]/conversation/[conversationId]/route.ts:
Allow public agent access with caller credentials
- apps/web/src/lib/mcp/handlers.ts: Accept callerEnvVars, validate requirements
- apps/web/src/app/api/mcp/[username]/[slug]/[transport]/route.ts:
Allow public collection access, pass isOwner flag
- apps/web/src/app/docs/platform-guide/page.tsx: Update access model docs
7d9321d9c6