sync: mileszim/seekrit@b2ab672910dd22924cbb3b5133ff62d05ac841f1

Author: seekrit-bot

README.md

@@ -195,6 +195,42 @@ with use_scope(Scope(overrides={"tenants": tenant})):
     result = await agent.run(prompt, deps=Deps(tenant=tenant))
 ```
 
+### CrewAI
+
+`pip install 'seekrit[crewai]'` adds CrewAI's own interception contract, plus
+hooks that scope credentials per **agent** as well as per tool — the bound that
+matters when several agents share one process:
+
+```python
+from crewai import LLM
+from seekrit.crewai import SeekritCredentials, SeekritInterceptor, ensure_intercepted
+
+llm = ensure_intercepted(
+    LLM(
+        model="openai/gpt-5.6-terra",
+        api_key="{{seekrit:OPENAI_API_KEY}}",
+        interceptor=SeekritInterceptor(
+            allow={
+                "api.openai.com": ["OPENAI_API_KEY"],
+                "api.stripe.com": ["STRIPE_SECRET_KEY"],
+            },
+            require_scope=True,
+        ),
+    )
+)
+
+with SeekritCredentials(
+    agents={"Researcher": ["OPENAI_API_KEY"]},
+    tools={"refund": ["OPENAI_API_KEY", "STRIPE_SECRET_KEY"]},
+):
+    crew.kickoff()
+```
+
+Both lists are exhaustive and are intersected, so the `Researcher` cannot reach
+Stripe even by calling `refund`, and an agent added later starts with nothing.
+`ensure_intercepted` is worth the line: a model string that routes to CrewAI's
+LiteLLM fallback accepts an interceptor and never calls it.
+
 Because it runs in your process, this is a weaker boundary than the
 [egress proxy](https://seekrit.dev/docs/guides/agent-proxy). What it does buy:
 the value exists only inside one HTTP call, so it never reaches model context, a

pyproject.toml

@@ -30,6 +30,10 @@ langchain = ["httpx>=0.24", "langchain>=1.0"]
 # `seekrit.pydantic_ai` — a WrapperToolset that scopes each tool call. Brings
 # httpx along for the same reason.
 pydantic-ai = ["httpx>=0.24", "pydantic-ai>=1.0"]
+# `seekrit.crewai` — a BaseInterceptor that substitutes into a CrewAI
+# provider's outbound request, plus hooks that scope credentials per agent and
+# per tool. httpx again: the interceptor rewrites an httpx.Request.
+crewai = ["httpx>=0.24", "crewai>=1.15"]
 
 # `seekrit.hermes` — Hermes Agent secret sources. No extra: the module imports
 # Hermes lazily (only inside `register()`), so there is no third-party dependency

src/seekrit/_scope.py

@@ -55,3 +55,19 @@ def use_scope(scope: Optional[Scope]) -> Iterator[None]:
         yield
     finally:
         _current.reset(token)
+
+
+def set_scope(scope: Optional[Scope]) -> None:
+    """Install ``scope`` with no matching reset, replacing whatever was there.
+
+    :func:`use_scope` is the right tool wherever the framework hands you the
+    call to wrap. Some do not: CrewAI dispatches ``before_llm_call`` and
+    ``after_llm_call`` as two independent hooks with no ``finally`` between
+    them, so there is nowhere to hold a ``contextvars.Token`` and nothing
+    guarantees the closing hook runs at all. Setting unconditionally is what
+    makes that safe — every ``before`` hook overwrites the previous value, so a
+    scope stranded by a raising call narrows nothing it should not; the next
+    call installs its own, and :mod:`seekrit.crewai` also clears at the end of a
+    run. See that module for the whole argument.
+    """
+    _current.set(scope)