@google/adk 0.6.1 → 1.1.0

package/dist/esm/auth/oauth2/oauth2_discovery.js

@@ -0,0 +1,156 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { z } from "zod";
+import { logger } from "../../utils/logger.js";
+const AuthorizationServerMetadataSchema = z.object({
+  issuer: z.string(),
+  authorization_endpoint: z.string(),
+  token_endpoint: z.string(),
+  scopes_supported: z.array(z.string()).optional(),
+  registration_endpoint: z.string().optional()
+});
+const ProtectedResourceMetadataSchema = z.object({
+  resource: z.string(),
+  authorization_servers: z.array(z.string()).default([])
+});
+class OAuth2DiscoveryManager {
+  /**
+   * Discovers the OAuth2 authorization server metadata.
+   */
+  async discoverAuthServerMetadata(issuerUrl) {
+    if (!validateDiscoveryUrl(issuerUrl)) {
+      return void 0;
+    }
+    let baseUrl;
+    let path;
+    try {
+      const url = new URL(issuerUrl);
+      baseUrl = `${url.protocol}//${url.host}`;
+      path = url.pathname;
+    } catch (e) {
+      logger.warn(`Failed to parse issuerUrl ${issuerUrl}: ${e}`);
+      return void 0;
+    }
+    const endpointsToTry = [];
+    if (path && path !== "/") {
+      endpointsToTry.push(
+        `${baseUrl}/.well-known/oauth-authorization-server${path}`,
+        `${baseUrl}/.well-known/openid-configuration${path}`,
+        `${baseUrl}${path}/.well-known/openid-configuration`
+      );
+    } else {
+      endpointsToTry.push(
+        `${baseUrl}/.well-known/oauth-authorization-server`,
+        `${baseUrl}/.well-known/openid-configuration`
+      );
+    }
+    for (const endpoint of endpointsToTry) {
+      try {
+        const response = await fetch(endpoint, {
+          method: "GET",
+          headers: {
+            Accept: "application/json"
+          }
+        });
+        if (!response.ok) {
+          continue;
+        }
+        const data = await response.json();
+        const metadata = AuthorizationServerMetadataSchema.parse(data);
+        if (metadata.issuer.replace(/\/$/, "") === issuerUrl.replace(/\/$/, "")) {
+          return metadata;
+        } else {
+          logger.warn(
+            `Issuer in metadata ${metadata.issuer} does not match issuerUrl ${issuerUrl}`
+          );
+        }
+      } catch (e) {
+        logger.debug(`Failed to fetch metadata from ${endpoint}: ${e}`);
+      }
+    }
+    return void 0;
+  }
+  /**
+   * Discovers the OAuth2 protected resource metadata.
+   */
+  async discoverResourceMetadata(resourceUrl) {
+    if (!validateDiscoveryUrl(resourceUrl)) {
+      return void 0;
+    }
+    let baseUrl;
+    let path;
+    try {
+      const url = new URL(resourceUrl);
+      baseUrl = `${url.protocol}//${url.host}`;
+      path = url.pathname;
+    } catch (e) {
+      logger.warn(`Failed to parse resourceUrl ${resourceUrl}: ${e}`);
+      return void 0;
+    }
+    let wellKnownEndpoint;
+    if (path && path !== "/") {
+      wellKnownEndpoint = `${baseUrl}/.well-known/oauth-protected-resource${path}`;
+    } else {
+      wellKnownEndpoint = `${baseUrl}/.well-known/oauth-protected-resource`;
+    }
+    try {
+      const response = await fetch(wellKnownEndpoint, {
+        method: "GET",
+        headers: {
+          Accept: "application/json"
+        }
+      });
+      if (!response.ok) {
+        return void 0;
+      }
+      const data = await response.json();
+      const metadata = ProtectedResourceMetadataSchema.parse(data);
+      if (metadata.resource.replace(/\/$/, "") === resourceUrl.replace(/\/$/, "")) {
+        return metadata;
+      } else {
+        logger.warn(
+          `Resource in metadata ${metadata.resource} does not match resourceUrl ${resourceUrl}`
+        );
+      }
+    } catch (e) {
+      logger.debug(`Failed to fetch metadata from ${wellKnownEndpoint}: ${e}`);
+    }
+    return void 0;
+  }
+}
+function validateDiscoveryUrl(urlStr) {
+  try {
+    const url = new URL(urlStr);
+    if (url.protocol !== "https:") {
+      logger.warn(`Unsafe protocol for discovery URL: ${url.protocol}`);
+      return false;
+    }
+    const host = url.hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host.startsWith("10.") || host.startsWith("192.168.") || host.startsWith("169.254.")) {
+      logger.warn(`Unsafe host for discovery URL: ${host}`);
+      return false;
+    }
+    const match = host.match(/^172\.(\d+)\./);
+    if (match) {
+      const secondOctet = parseInt(match[1], 10);
+      if (secondOctet >= 16 && secondOctet <= 31) {
+        logger.warn(`Unsafe host for discovery URL: ${host}`);
+        return false;
+      }
+    }
+    return true;
+  } catch (e) {
+    logger.warn(`Failed to parse URL for validation ${urlStr}: ${e}`);
+    return false;
+  }
+}
+export {
+  AuthorizationServerMetadataSchema,
+  OAuth2DiscoveryManager,
+  ProtectedResourceMetadataSchema
+};

package/dist/esm/auth/oauth2/oauth2_utils.js

@@ -0,0 +1,87 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { logger } from "../../utils/logger.js";
+function getTokenEndpoint(authScheme) {
+  if (authScheme.type === "openIdConnect" && authScheme.tokenEndpoint) {
+    return authScheme.tokenEndpoint;
+  }
+  if (authScheme.type === "oauth2" && authScheme.flows) {
+    const flows = authScheme.flows;
+    const flow = flows.authorizationCode || flows.clientCredentials || flows.password || flows.implicit;
+    if (flow && "tokenUrl" in flow) {
+      return flow.tokenUrl;
+    }
+  }
+  return void 0;
+}
+async function fetchOAuth2Tokens(endpoint, body) {
+  try {
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: body.toString()
+    });
+    if (!response.ok) {
+      throw new Error(`Token request failed with status ${response.status}`);
+    }
+    const data = await response.json();
+    return {
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token,
+      idToken: data.id_token,
+      expiresIn: data.expires_in,
+      expiresAt: data.expires_in ? Date.now() + data.expires_in * 1e3 : void 0
+    };
+  } catch (e) {
+    logger.error(`Failed to fetch OAuth2 tokens: ${e}`);
+    throw e;
+  }
+}
+function parseAuthorizationCode(uri) {
+  try {
+    const url = new URL(uri);
+    return url.searchParams.get("code") || void 0;
+  } catch (e) {
+    logger.warn(`Failed to parse authorization URI ${uri}: ${e}`);
+    return void 0;
+  }
+}
+function createOAuth2TokenRequestBody(params) {
+  const body = new URLSearchParams();
+  body.set("grant_type", params.grantType);
+  body.set("client_id", params.clientId);
+  body.set("client_secret", params.clientSecret);
+  if (params.grantType === "authorization_code") {
+    body.set("code", params.code);
+    if (params.redirectUri) {
+      body.set("redirect_uri", params.redirectUri);
+    }
+    if (params.codeVerifier) {
+      body.set("code_verifier", params.codeVerifier);
+    }
+  } else if (params.grantType === "refresh_token") {
+    body.set("refresh_token", params.refreshToken);
+  }
+  return body;
+}
+function isTokenExpired(token, leeway = 60) {
+  if (typeof token.expiresAt !== "number") {
+    return false;
+  }
+  const expirationThreshold = token.expiresAt - leeway * 1e3;
+  return expirationThreshold < Date.now();
+}
+export {
+  createOAuth2TokenRequestBody,
+  fetchOAuth2Tokens,
+  getTokenEndpoint,
+  isTokenExpired,
+  parseAuthorizationCode
+};

package/dist/esm/auth/refresher/base_credential_refresher.js

@@ -0,0 +1,16 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+class CredentialRefresherError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CredentialRefresherError";
+  }
+}
+export {
+  CredentialRefresherError
+};

package/dist/esm/auth/refresher/credential_refresher_registry.js

@@ -0,0 +1,40 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { AuthCredentialTypes } from "../auth_credential.js";
+class CredentialRefresherRegistry {
+  constructor() {
+    this.refreshers = {
+      [AuthCredentialTypes.API_KEY]: void 0,
+      [AuthCredentialTypes.HTTP]: void 0,
+      [AuthCredentialTypes.OAUTH2]: void 0,
+      [AuthCredentialTypes.OPEN_ID_CONNECT]: void 0,
+      [AuthCredentialTypes.SERVICE_ACCOUNT]: void 0
+    };
+  }
+  /**
+   * Register a refresher instance for a credential type.
+   *
+   * @param credentialType The credential type to register for.
+   * @param refresherInstance The refresher instance to register.
+   */
+  register(credentialType, refresherInstance) {
+    this.refreshers[credentialType] = refresherInstance;
+  }
+  /**
+   * Get the refresher instance for a credential type.
+   *
+   * @param credentialType The credential type to get refresher for.
+   * @returns The refresher instance if registered, undefined otherwise.
+   */
+  getRefresher(credentialType) {
+    return this.refreshers[credentialType];
+  }
+}
+export {
+  CredentialRefresherRegistry
+};

package/dist/esm/code_executors/base_code_executor.js

@@ -1,3 +1,5 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
 /**
  * @license
  * Copyright 2025 Google LLC
@@ -34,16 +36,20 @@ class BaseCodeExecutor {
     this.errorRetryAttempts = 2;
     /**
      * The list of the enclosing delimiters to identify the code blocks.
-     * For example, the delimiter('```python\\n', '\\n```') can be  used to
-     * identify code blocks with the following format::
+     * For example, the delimiter('```javascript\\n', '\\n```') can be used to
+     * identify code blocks with the following format:
      *
-     * ```python
-     *  print("hello")
+     * ```javascript
+     *  console.log("hello")
      * ```
      */
     this.codeBlockDelimiters = [
       ["```tool_code\n", "\n```"],
-      ["```python\n", "\n```"]
+      ["```python\n", "\n```"],
+      ["```javascript\n", "\n```"],
+      ["```typescript\n", "\n```"],
+      ["```bash\n", "\n```"],
+      ["```sh\n", "\n```"]
     ];
     /**
      * The delimiters to format the code execution result.

package/dist/esm/code_executors/built_in_code_executor.js

@@ -1,3 +1,5 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
 /**
  * @license
  * Copyright 2025 Google LLC

package/dist/esm/code_executors/code_execution_utils.js

@@ -1,3 +1,5 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
 /**
  * @license
  * Copyright 2025 Google LLC
@@ -6,6 +8,21 @@
 import { Language, Outcome } from "@google/genai";
 import { cloneDeep } from "lodash-es";
 import { base64Encode, isBase64Encoded } from "../utils/env_aware_utils.js";
+var FileContentEncoding = /* @__PURE__ */ ((FileContentEncoding2) => {
+  FileContentEncoding2["UTF8"] = "utf-8";
+  FileContentEncoding2["BASE64"] = "base64";
+  return FileContentEncoding2;
+})(FileContentEncoding || {});
+var CodeExecutionLanguage = /* @__PURE__ */ ((CodeExecutionLanguage2) => {
+  CodeExecutionLanguage2["UNSPECIFIED"] = "unspecified";
+  CodeExecutionLanguage2["PYTHON"] = "python";
+  CodeExecutionLanguage2["JAVASCRIPT"] = "javascript";
+  CodeExecutionLanguage2["TYPESCRIPT"] = "typescript";
+  CodeExecutionLanguage2["SHELL"] = "shell";
+  CodeExecutionLanguage2["POWERSHELL"] = "powershell";
+  CodeExecutionLanguage2["WINDOWS_CMD"] = "cmd";
+  return CodeExecutionLanguage2;
+})(CodeExecutionLanguage || {});
 function getEncodedFileContent(data) {
   return isBase64Encoded(data) ? data : base64Encode(data);
 }
@@ -100,6 +117,8 @@ function convertCodeExecutionParts(content, codeBlockDelimiter, executionResultD
   }
 }
 export {
+  CodeExecutionLanguage,
+  FileContentEncoding,
   buildCodeExecutionResultPart,
   buildExecutableCodePart,
   convertCodeExecutionParts,

package/dist/esm/code_executors/code_executor_context.js

@@ -1,3 +1,5 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
 /**
  * @license
  * Copyright 2025 Google LLC

package/dist/esm/code_executors/unsafe_local_code_executor.js

@@ -0,0 +1,205 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { spawn } from "child_process";
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { getMimeTypeAndEncoding } from "../utils/file_extension_utils.js";
+import { materializeFiles } from "../utils/file_utils.js";
+import { logger } from "../utils/logger.js";
+import { BaseCodeExecutor } from "./base_code_executor.js";
+import {
+  CodeExecutionLanguage
+} from "./code_execution_utils.js";
+const IS_WINDOWS = os.platform() === "win32";
+async function createTempScriptFile(code, language, shellCommandPath) {
+  const tempDir = path.join(
+    os.tmpdir(),
+    "adk_js_unsafe_code_executor",
+    Date.now().toString() + "_" + Math.random().toString(36).slice(2)
+  );
+  await fs.mkdir(tempDir, { recursive: true });
+  const ext = getExtensionForLanguage(language, shellCommandPath) || ".js";
+  const filePath = path.join(tempDir, `script${ext}`);
+  await fs.writeFile(filePath, code);
+  return { filePath, tempDir };
+}
+function getExtensionForLanguage(language, shellCommandPath) {
+  if (language === CodeExecutionLanguage.JAVASCRIPT) {
+    return ".js";
+  }
+  if (language === CodeExecutionLanguage.PYTHON) {
+    return ".py";
+  }
+  if (language === CodeExecutionLanguage.POWERSHELL) {
+    return ".ps1";
+  }
+  if (language === CodeExecutionLanguage.WINDOWS_CMD) {
+    return ".bat";
+  }
+  if (language === CodeExecutionLanguage.SHELL) {
+    if (IS_WINDOWS) {
+      if (shellCommandPath && shellCommandPath.toLowerCase().includes("cmd")) {
+        return ".bat";
+      }
+      return ".ps1";
+    }
+    return ".sh";
+  }
+  return void 0;
+}
+class UnsafeLocalCodeExecutor extends BaseCodeExecutor {
+  constructor(options = {}) {
+    var _a, _b, _c, _d;
+    super();
+    this.timeoutSeconds = (_a = options.timeoutSeconds) != null ? _a : 30;
+    this.nodeCommandPath = (_b = options.commandPath) != null ? _b : process.execPath;
+    this.pythonCommandPath = (_c = options.pythonCommandPath) != null ? _c : IS_WINDOWS ? "python" : "python3";
+    this.shellCommandPath = (_d = options.shellCommandPath) != null ? _d : IS_WINDOWS ? "powershell" : "bash";
+    this.stateful = false;
+    this.optimizeDataFile = false;
+  }
+  async executeCode(params) {
+    var _a;
+    const { code, language } = params.codeExecutionInput;
+    if (![
+      CodeExecutionLanguage.JAVASCRIPT,
+      CodeExecutionLanguage.PYTHON,
+      CodeExecutionLanguage.SHELL,
+      CodeExecutionLanguage.WINDOWS_CMD,
+      CodeExecutionLanguage.POWERSHELL
+    ].includes(language)) {
+      return {
+        stdout: "",
+        stderr: `Unsupported language: ${language}`,
+        outputFiles: []
+      };
+    }
+    logger.warn(
+      "\n====================================================================================\n\u26A0\uFE0F DANGER: UnsafeLocalCodeExecutor is executing code locally on this host machine!\nThis component provides NO sandboxing or container isolation. Arbitrary shell/script\ncommands generated by AI or untrusted sources could lead to serious security risks.\n====================================================================================\n"
+    );
+    let tempDir;
+    try {
+      const res = await createTempScriptFile(
+        code,
+        language,
+        this.shellCommandPath
+      );
+      const filePath = res.filePath;
+      tempDir = res.tempDir;
+      if (params.codeExecutionInput.inputFiles) {
+        await materializeFiles(params.codeExecutionInput.inputFiles, tempDir);
+      }
+      let command = this.nodeCommandPath;
+      let args = [filePath];
+      if (language === CodeExecutionLanguage.PYTHON) {
+        command = this.pythonCommandPath;
+      } else if (language === CodeExecutionLanguage.SHELL) {
+        command = this.shellCommandPath;
+        if (this.shellCommandPath.toLowerCase().includes("powershell")) {
+          args = ["-NoLogo", "-ExecutionPolicy", "Bypass", "-File", filePath];
+        } else if (this.shellCommandPath.toLowerCase().includes("cmd")) {
+          args = ["/c", filePath];
+        }
+      } else if (language === CodeExecutionLanguage.POWERSHELL) {
+        command = IS_WINDOWS ? "powershell" : "pwsh";
+        args = ["-NoLogo", "-ExecutionPolicy", "Bypass", "-File", filePath];
+      } else if (language === CodeExecutionLanguage.WINDOWS_CMD) {
+        command = "cmd.exe";
+        args = ["/c", filePath];
+      }
+      if (params.codeExecutionInput.args) {
+        if (Array.isArray(params.codeExecutionInput.args)) {
+          args.push(...params.codeExecutionInput.args);
+        } else {
+          for (const [k, v] of Object.entries(params.codeExecutionInput.args)) {
+            args.push(`--${k}`, String(v));
+          }
+        }
+      }
+      const executionResult = await new Promise((resolve) => {
+        const child = spawn(command, args, {
+          timeout: this.timeoutSeconds * 1e3,
+          killSignal: "SIGKILL",
+          cwd: tempDir
+        });
+        let stdout = "";
+        let stderr = "";
+        if (child.stdout) {
+          child.stdout.on("data", (data) => {
+            stdout += data.toString();
+          });
+        }
+        if (child.stderr) {
+          child.stderr.on("data", (data) => {
+            stderr += data.toString();
+          });
+        }
+        child.on("error", (err) => {
+          stderr += `Process error: ${err.message}
+`;
+        });
+        child.on("close", (exitCode, signal) => {
+          if (signal === "SIGKILL" || signal === "SIGTERM") {
+            stderr += `
+Code execution timed out after ${this.timeoutSeconds} seconds.`;
+          } else if (exitCode !== 0 && exitCode !== null) {
+            if (!stderr) {
+              stderr = `Exit code ${exitCode}`;
+            }
+          }
+          resolve({ stdout, stderr, exitCode });
+        });
+      });
+      const outputFiles = [];
+      try {
+        const allFiles = await fs.readdir(tempDir, { recursive: true });
+        for (const relativeFilePath of allFiles) {
+          const fullPath = path.join(tempDir, relativeFilePath);
+          const stat = await fs.lstat(fullPath);
+          if (!stat.isFile()) {
+            continue;
+          }
+          if (relativeFilePath === path.basename(filePath)) {
+            continue;
+          }
+          const isInputFile = (_a = params.codeExecutionInput.inputFiles) == null ? void 0 : _a.some(
+            (f) => f.name === relativeFilePath
+          );
+          if (isInputFile) {
+            continue;
+          }
+          const fileContent = await fs.readFile(fullPath);
+          const { mimeType, encoding } = getMimeTypeAndEncoding(
+            path.extname(relativeFilePath)
+          );
+          outputFiles.push({
+            name: relativeFilePath,
+            content: fileContent.toString(encoding),
+            contentEncoding: encoding,
+            mimeType
+          });
+        }
+      } catch (e) {
+        logger.error(`Error scanning output files: ${e}`);
+      }
+      return {
+        stdout: executionResult.stdout,
+        stderr: executionResult.stderr,
+        outputFiles
+      };
+    } finally {
+      if (tempDir) {
+        await fs.rm(tempDir, { recursive: true, force: true });
+      }
+    }
+  }
+}
+export {
+  UnsafeLocalCodeExecutor
+};