feat(dojo): support Authorization header for the agno integration

[Himanshu040604]

What

Adds an opt-in AGNO_AUTH_TOKEN env var to the dojo's agno integration. When set, every dojo→agno request carries Authorization: Bearer <token>. When unset, behavior is byte-identical to today.

Fixes #2130

Why

Agno v2.7 (agno-agi/agno#8747) put agno's AG-UI endpoint behind AgentOS's central auth middleware, so deployments using OS_SECURITY_KEY, JWT auth, or platform access tokens now return 401 to anonymous requests. The dojo builds its AgnoAgent instances from AGNO_URL alone — there is no way to attach a credential — which means the stock dojo cannot connect to any secured agno backend. This PR closes that gap with a single opt-in env var, while unsecured setups keep working exactly as before.

We chose this approach because the SDK already supports it end-to-end — no new machinery needed (agno#8747 review):

Note the SDK already supports this: HttpAgent (which AgnoAgent extends) accepts headers in its config […] We need to update the dojo demo app to add the env plumbing, which is a one-line change there.

Design

• Follows the watsonx credential pattern (#1665): env var read in env.ts with an || "" default, consumed in the agents.ts factory.
• No SDK or integration-package changes — HttpAgent already sends configured headers on every request; @ag-ui/agno stays a thin subclass.
• agents.ts is server-only and the var is not NEXT_PUBLIC_-prefixed, so the token never reaches the browser.

Testing

No sidebar feature is added, so no new e2e suite per CONTRIBUTING. Verified instead (Node 22, pnpm 10.33.4):

Check	Result
pnpm run build (nx, 34 projects)	✅ pass
pnpm generate-content-json + git diff --exit-code src/files.json	✅ unchanged
Root pnpm run test	✅ 31/32 — sole failure is @ag-ui/cross-language-tests, which needs a local .NET SDK and fails identically on unmodified main
agno Playwright e2e (tests/agnoTests, 10 tests) with AGNO_AUTH_TOKEN unset	✅ 10/10 — no-op regression proof

Live against agno v2.7.0:

Backend	Dojo	Result
OS_SECURITY_KEY set	no token	❌ HTTP 401 {"detail":"Authorization header required"}
OS_SECURITY_KEY set	AGNO_AUTH_TOKEN set	✅ chat streams normally
open (no key)	no token	✅ identical to today

[Copilot]

Pull request overview

Adds optional auth-token plumbing to the Dojo’s Agno integration so the Dojo can connect to secured Agno/AgentOS deployments by sending a Bearer Authorization header on all Dojo→Agno requests when configured.

Changes:

• Introduces AGNO_AUTH_TOKEN in Dojo env parsing with an empty-string default (no-op when unset).
• Passes Authorization: Bearer <token> via AgnoAgent/HttpAgent headers config only when the token is set.
• Documents the Dojo auth env var in the @ag-ui/agno TypeScript README.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
integrations/agno/typescript/README.md	Documents AGNO_AUTH_TOKEN usage for running Dojo against secured Agno/AgentOS.
apps/dojo/src/env.ts	Adds agnoAuthToken to Dojo env var parsing with a safe default.
apps/dojo/src/agents.ts	Conditionally injects an Authorization header into AgnoAgent construction.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.