[FE POC] ETL implementation for evaluation runs.

api/entrypoints/routers.py

@@ -352,7 +352,6 @@ async def lifespan(*args, **kwargs):
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["Content-Type"] + get_all_supertokens_cors_headers(),
-    expose_headers=["front-token", "x-ag-support-id", "x-ag-support-ts"],
 )
 
 if ee and is_ee():

api/oss/src/apis/fastapi/shared/utils.py

@@ -10,6 +10,31 @@
 from oss.src.utils.context import support_ctx
 
 
+def _expose_support_headers(
+    headers: List[Tuple[bytes, bytes]],
+    exposed: List[bytes],
+) -> None:
+    """Add `exposed` to Access-Control-Expose-Headers so browser JS can read
+    the support headers. Done here, not in the CORS config, because listing
+    them there broke the `--web-local` cross-origin setup. CORS leaves this
+    header alone (its own `expose_headers` is unset), so we won't be clobbered.
+    """
+    name = b"access-control-expose-headers"
+
+    for index, (key, value) in enumerate(headers):
+        if key.lower() == name:
+            existing = {
+                part.strip().lower() for part in value.split(b",") if part.strip()
+            }
+            additions = [h for h in exposed if h.lower() not in existing]
+            if additions:
+                merged = value + b", " + b", ".join(additions)
+                headers[index] = (key, merged)
+            return
+
+    headers.append((name, b", ".join(exposed)))
+
+
 class SupportHeadersMiddleware:
     """Pure-ASGI middleware that emits x-ag-support-* headers when
     a downstream decorator stashes support metadata in `support_ctx`.
@@ -34,20 +59,26 @@ async def send_with_support(message):
                 support = support_ctx.get()
                 if support is not None:
                     headers = list(message.get("headers", []))
+                    exposed: List[bytes] = []
                     if support.support_id:
                         headers.append(
                             (
                                 b"x-ag-support-id",
                                 support.support_id.encode("latin-1"),
                             )
                         )
+                        exposed.append(b"x-ag-support-id")
                     if support.support_ts:
                         headers.append(
                             (
                                 b"x-ag-support-ts",
                                 support.support_ts.isoformat().encode("latin-1"),
                             )
                         )
+                        exposed.append(b"x-ag-support-ts")
+                    # Make the headers we just emitted readable by browser JS.
+                    if exposed:
+                        _expose_support_headers(headers, exposed)
                     message["headers"] = headers
             await send(message)
 

api/oss/tests/pytest/unit/utils/test_exceptions.py

@@ -159,3 +159,46 @@ def test_support_headers_survive_base_http_middleware():
     assert response.status_code == 200
     assert "x-ag-support-id" in response.headers
     assert "x-ag-support-ts" in response.headers
+
+
+def _build_test_app_with_cors() -> FastAPI:
+    # Mirrors the production wiring: CORSMiddleware (added last, so outermost)
+    # wraps SupportHeadersMiddleware (added first, innermost). The support
+    # middleware must declare its headers in Access-Control-Expose-Headers
+    # itself, because the CORS layer intentionally does NOT list them
+    # (doing so broke the `--web-local` cross-origin setup).
+    from starlette.middleware.cors import CORSMiddleware
+
+    app = FastAPI()
+    app.add_middleware(SupportHeadersMiddleware)
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=["http://localhost:3000"],
+        allow_credentials=True,
+        allow_methods=["*"],
+        allow_headers=["Content-Type"],
+    )
+
+    @app.get("/fail")
+    @suppress_exceptions(default={"count": 0}, verbose=False)
+    async def fail(request: Request):
+        raise RuntimeError("boom")
+
+    return app
+
+
+def test_support_headers_exposed_to_allowed_cross_origin():
+    client = TestClient(_build_test_app_with_cors())
+
+    response = client.get("/fail", headers={"Origin": "http://localhost:3000"})
+
+    assert response.status_code == 200
+    # CORS still mirrors the allowed origin — the regression that the commented
+    # `expose_headers` CORS config caused for `--web-local`.
+    assert response.headers["access-control-allow-origin"] == "http://localhost:3000"
+    # Support headers are both emitted and readable by browser JS.
+    assert "x-ag-support-id" in response.headers
+    assert "x-ag-support-ts" in response.headers
+    expose = response.headers["access-control-expose-headers"].lower()
+    assert "x-ag-support-id" in expose
+    assert "x-ag-support-ts" in expose

api/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "api"
-version = "0.100.0"
+version = "0.100.1"
 description = "Agenta API"
 requires-python = ">=3.11,<3.14"
 authors = [

clients/python/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agenta-client"
-version = "0.100.0"
+version = "0.100.1"
 description = "Fern-generated Python client for the Agenta API."
 requires-python = ">=3.11,<3.14"
 authors = [