@google/adk 1.3.0 → 1.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (165) hide show
  1. package/dist/cjs/agents/active_streaming_tool.js +6 -1
  2. package/dist/cjs/agents/context.js +1 -11
  3. package/dist/cjs/agents/functions.js +35 -16
  4. package/dist/cjs/agents/instructions.js +23 -5
  5. package/dist/cjs/agents/invocation_context.js +2 -5
  6. package/dist/cjs/agents/llm_agent.js +8 -6
  7. package/dist/cjs/agents/processors/code_execution_request_processor.js +0 -3
  8. package/dist/cjs/agents/processors/content_processor_utils.js +16 -3
  9. package/dist/cjs/agents/processors/context_compactor_request_processor.js +4 -2
  10. package/dist/cjs/agents/processors/interactions_request_processor.js +63 -0
  11. package/dist/cjs/apps/app.js +79 -0
  12. package/dist/cjs/apps/resumability_config.js +44 -0
  13. package/dist/cjs/artifacts/file_artifact_service.js +14 -1
  14. package/dist/cjs/artifacts/gcs_artifact_service.js +57 -15
  15. package/dist/cjs/artifacts/in_memory_artifact_service.js +5 -1
  16. package/dist/cjs/artifacts/scoped_artifact_service.js +101 -0
  17. package/dist/cjs/artifacts/session_artifact_service.js +27 -0
  18. package/dist/cjs/auth/oauth2/oauth2_discovery.js +17 -5
  19. package/dist/cjs/auth/oauth2/oauth2_utils.js +12 -1
  20. package/dist/cjs/common.js +47 -0
  21. package/dist/cjs/context/agent_controlled_context_compactor.js +109 -0
  22. package/dist/cjs/context/token_based_context_compactor.js +42 -10
  23. package/dist/cjs/context/trajectory_thought_pruning_compactor.js +71 -0
  24. package/dist/cjs/events/event.js +24 -0
  25. package/dist/cjs/models/google_llm.js +25 -10
  26. package/dist/cjs/models/interactions_utils.js +732 -0
  27. package/dist/cjs/plugins/base_plugin.js +1 -0
  28. package/dist/cjs/runner/in_memory_runner.js +13 -2
  29. package/dist/cjs/runner/runner.js +93 -72
  30. package/dist/cjs/sessions/base_session_service.js +6 -1
  31. package/dist/cjs/sessions/database_session_service.js +24 -7
  32. package/dist/cjs/sessions/vertex_ai_session_service.js +19 -4
  33. package/dist/cjs/skills/loader.js +2 -2
  34. package/dist/cjs/tools/base_toolset.js +1 -1
  35. package/dist/cjs/tools/consolidate_context_tool.js +79 -0
  36. package/dist/cjs/tools/forwarding_artifact_service.js +16 -28
  37. package/dist/cjs/tools/openapi_tool/openapi_spec_parser/tool_auth_handler.js +2 -12
  38. package/dist/cjs/utils/async_hooks_shim.js +52 -0
  39. package/dist/cjs/utils/client_labels.js +41 -3
  40. package/dist/cjs/utils/env_aware_utils.js +10 -1
  41. package/dist/cjs/utils/streaming_utils.js +10 -4
  42. package/dist/cjs/utils/task.js +62 -0
  43. package/dist/cjs/version.js +1 -1
  44. package/dist/esm/agents/active_streaming_tool.js +6 -1
  45. package/dist/esm/agents/context.js +1 -11
  46. package/dist/esm/agents/functions.js +36 -15
  47. package/dist/esm/agents/instructions.js +23 -5
  48. package/dist/esm/agents/invocation_context.js +2 -5
  49. package/dist/esm/agents/llm_agent.js +8 -6
  50. package/dist/esm/agents/processors/code_execution_request_processor.js +0 -3
  51. package/dist/esm/agents/processors/content_processor_utils.js +14 -2
  52. package/dist/esm/agents/processors/context_compactor_request_processor.js +4 -2
  53. package/dist/esm/agents/processors/interactions_request_processor.js +34 -0
  54. package/dist/esm/apps/app.js +49 -0
  55. package/dist/esm/apps/resumability_config.js +16 -0
  56. package/dist/esm/artifacts/file_artifact_service.js +14 -1
  57. package/dist/esm/artifacts/gcs_artifact_service.js +57 -15
  58. package/dist/esm/artifacts/in_memory_artifact_service.js +5 -1
  59. package/dist/esm/artifacts/scoped_artifact_service.js +73 -0
  60. package/dist/esm/artifacts/session_artifact_service.js +7 -0
  61. package/dist/esm/auth/oauth2/oauth2_discovery.js +14 -4
  62. package/dist/esm/auth/oauth2/oauth2_utils.js +12 -1
  63. package/dist/esm/common.js +42 -2
  64. package/dist/esm/context/agent_controlled_context_compactor.js +81 -0
  65. package/dist/esm/context/token_based_context_compactor.js +42 -10
  66. package/dist/esm/context/trajectory_thought_pruning_compactor.js +43 -0
  67. package/dist/esm/events/event.js +22 -0
  68. package/dist/esm/models/google_llm.js +23 -9
  69. package/dist/esm/models/interactions_utils.js +697 -0
  70. package/dist/esm/plugins/base_plugin.js +1 -0
  71. package/dist/esm/runner/in_memory_runner.js +13 -2
  72. package/dist/esm/runner/runner.js +91 -73
  73. package/dist/esm/sessions/base_session_service.js +6 -1
  74. package/dist/esm/sessions/database_session_service.js +24 -7
  75. package/dist/esm/sessions/vertex_ai_session_service.js +17 -3
  76. package/dist/esm/skills/loader.js +2 -2
  77. package/dist/esm/tools/base_toolset.js +1 -1
  78. package/dist/esm/tools/consolidate_context_tool.js +51 -0
  79. package/dist/esm/tools/forwarding_artifact_service.js +16 -28
  80. package/dist/esm/tools/openapi_tool/openapi_spec_parser/tool_auth_handler.js +2 -12
  81. package/dist/esm/utils/async_hooks_shim.js +24 -0
  82. package/dist/esm/utils/client_labels.js +38 -2
  83. package/dist/esm/utils/env_aware_utils.js +10 -1
  84. package/dist/esm/utils/streaming_utils.js +10 -4
  85. package/dist/esm/utils/task.js +34 -0
  86. package/dist/esm/version.js +1 -1
  87. package/dist/types/agents/active_streaming_tool.d.ts +3 -4
  88. package/dist/types/agents/functions.d.ts +12 -9
  89. package/dist/types/agents/invocation_context.d.ts +7 -3
  90. package/dist/types/agents/processors/content_processor_utils.d.ts +8 -0
  91. package/dist/types/agents/processors/interactions_request_processor.d.ts +17 -0
  92. package/dist/types/apps/app.d.ts +52 -0
  93. package/dist/types/apps/resumability_config.d.ts +27 -0
  94. package/dist/types/artifacts/base_artifact_service.d.ts +6 -36
  95. package/dist/types/artifacts/gcs_artifact_service.d.ts +2 -1
  96. package/dist/types/artifacts/scoped_artifact_service.d.ts +25 -0
  97. package/dist/types/artifacts/session_artifact_service.d.ts +25 -0
  98. package/dist/types/auth/oauth2/oauth2_discovery.d.ts +11 -0
  99. package/dist/types/common.d.ts +20 -3
  100. package/dist/types/context/agent_controlled_context_compactor.d.ts +24 -0
  101. package/dist/types/context/base_context_compactor.d.ts +3 -0
  102. package/dist/types/context/token_based_context_compactor.d.ts +6 -1
  103. package/dist/types/context/trajectory_thought_pruning_compactor.d.ts +27 -0
  104. package/dist/types/events/event.d.ts +8 -0
  105. package/dist/types/models/google_llm.d.ts +15 -1
  106. package/dist/types/models/interactions_utils.d.ts +92 -0
  107. package/dist/types/models/llm_request.d.ts +4 -0
  108. package/dist/types/models/llm_response.d.ts +4 -0
  109. package/dist/types/plugins/base_plugin.d.ts +2 -1
  110. package/dist/types/runner/in_memory_runner.d.ts +7 -1
  111. package/dist/types/runner/runner.d.ts +43 -9
  112. package/dist/types/sessions/base_session_service.d.ts +3 -16
  113. package/dist/types/sessions/session.d.ts +11 -0
  114. package/dist/types/sessions/vertex_ai_session_service.d.ts +9 -1
  115. package/dist/types/tools/consolidate_context_tool.d.ts +19 -0
  116. package/dist/types/tools/forwarding_artifact_service.d.ts +3 -2
  117. package/dist/types/utils/async_hooks_shim.d.ts +10 -0
  118. package/dist/types/utils/client_labels.d.ts +10 -0
  119. package/dist/types/utils/env_aware_utils.d.ts +3 -3
  120. package/dist/types/utils/task.d.ts +24 -0
  121. package/dist/types/version.d.ts +1 -1
  122. package/dist/web/agents/active_streaming_tool.js +6 -1
  123. package/dist/web/agents/context.js +1 -11
  124. package/dist/web/agents/functions.js +36 -15
  125. package/dist/web/agents/instructions.js +23 -5
  126. package/dist/web/agents/invocation_context.js +2 -5
  127. package/dist/web/agents/llm_agent.js +8 -6
  128. package/dist/web/agents/processors/code_execution_request_processor.js +0 -3
  129. package/dist/web/agents/processors/content_processor_utils.js +14 -2
  130. package/dist/web/agents/processors/context_compactor_request_processor.js +4 -2
  131. package/dist/web/agents/processors/interactions_request_processor.js +52 -0
  132. package/dist/web/apps/app.js +49 -0
  133. package/dist/web/apps/resumability_config.js +31 -0
  134. package/dist/web/artifacts/file_artifact_service.js +14 -1
  135. package/dist/web/artifacts/gcs_artifact_service.js +55 -15
  136. package/dist/web/artifacts/in_memory_artifact_service.js +5 -1
  137. package/dist/web/artifacts/scoped_artifact_service.js +86 -0
  138. package/dist/web/artifacts/session_artifact_service.js +7 -0
  139. package/dist/web/auth/oauth2/oauth2_discovery.js +14 -4
  140. package/dist/web/auth/oauth2/oauth2_utils.js +12 -1
  141. package/dist/web/common.js +42 -2
  142. package/dist/web/context/agent_controlled_context_compactor.js +81 -0
  143. package/dist/web/context/token_based_context_compactor.js +42 -10
  144. package/dist/web/context/trajectory_thought_pruning_compactor.js +43 -0
  145. package/dist/web/events/event.js +20 -0
  146. package/dist/web/models/google_llm.js +54 -9
  147. package/dist/web/models/interactions_utils.js +728 -0
  148. package/dist/web/plugins/base_plugin.js +1 -0
  149. package/dist/web/runner/in_memory_runner.js +13 -2
  150. package/dist/web/runner/runner.js +111 -75
  151. package/dist/web/sessions/base_session_service.js +6 -1
  152. package/dist/web/sessions/database_session_service.js +24 -7
  153. package/dist/web/sessions/vertex_ai_session_service.js +17 -3
  154. package/dist/web/skills/loader.js +2 -2
  155. package/dist/web/tools/base_toolset.js +1 -1
  156. package/dist/web/tools/consolidate_context_tool.js +51 -0
  157. package/dist/web/tools/forwarding_artifact_service.js +16 -28
  158. package/dist/web/tools/openapi_tool/openapi_spec_parser/tool_auth_handler.js +2 -12
  159. package/dist/web/utils/async_hooks_shim.js +24 -0
  160. package/dist/web/utils/client_labels.js +38 -2
  161. package/dist/web/utils/env_aware_utils.js +10 -1
  162. package/dist/web/utils/streaming_utils.js +10 -4
  163. package/dist/web/utils/task.js +34 -0
  164. package/dist/web/version.js +1 -1
  165. package/package.json +2 -2
@@ -35,12 +35,16 @@ var import_logger = require("../utils/logger.js");
35
35
  * Copyright 2025 Google LLC
36
36
  * SPDX-License-Identifier: Apache-2.0
37
37
  */
38
+ const GCS_FILE_URI_METADATA_KEY = "adkFileUri";
39
+ const GCS_FILE_MIME_TYPE_METADATA_KEY = "adkFileMimeType";
40
+ const GCS_DISPLAY_NAME_METADATA_KEY = "adkDisplayName";
41
+ const GCS_IS_TEXT_METADATA_KEY = "adkIsText";
38
42
  class GcsArtifactService {
39
- constructor(bucket) {
40
- this.bucket = new import_storage.Storage().bucket(bucket);
43
+ constructor(bucket, options) {
44
+ this.bucket = new import_storage.Storage(options).bucket(bucket);
41
45
  }
42
46
  async saveArtifact(request) {
43
- if (!request.artifact.inlineData && !request.artifact.text) {
47
+ if (!request.artifact.inlineData && !request.artifact.text && !request.artifact.fileData) {
44
48
  throw new Error("Artifact must have either inlineData or text content.");
45
49
  }
46
50
  const versions = await this.listVersions(request);
@@ -51,24 +55,48 @@ class GcsArtifactService {
51
55
  version
52
56
  })
53
57
  );
54
- const metadata = request.customMetadata || {};
58
+ const customMetadata = {
59
+ ...request.customMetadata
60
+ };
55
61
  if (request.artifact.inlineData) {
62
+ if (request.artifact.inlineData.displayName) {
63
+ customMetadata[GCS_DISPLAY_NAME_METADATA_KEY] = request.artifact.inlineData.displayName;
64
+ }
56
65
  await file.save(
57
66
  Buffer.from(request.artifact.inlineData.data || "", "base64"),
58
67
  {
59
68
  contentType: request.artifact.inlineData.mimeType,
60
- metadata
69
+ metadata: { metadata: customMetadata }
61
70
  }
62
71
  );
63
72
  return version;
73
+ } else if (request.artifact.text !== void 0) {
74
+ await file.save(request.artifact.text, {
75
+ contentType: "text/plain",
76
+ metadata: {
77
+ metadata: { ...customMetadata, [GCS_IS_TEXT_METADATA_KEY]: "true" }
78
+ }
79
+ });
80
+ return version;
81
+ } else {
82
+ const fileData = request.artifact.fileData;
83
+ const fileUri = fileData == null ? void 0 : fileData.fileUri;
84
+ if (!fileUri) {
85
+ throw new Error("Artifact fileData must have a fileUri.");
86
+ }
87
+ customMetadata[GCS_FILE_URI_METADATA_KEY] = fileUri;
88
+ if (fileData.mimeType) {
89
+ customMetadata[GCS_FILE_MIME_TYPE_METADATA_KEY] = fileData.mimeType;
90
+ }
91
+ await file.save("", {
92
+ contentType: fileData.mimeType || void 0,
93
+ metadata: { metadata: customMetadata }
94
+ });
95
+ return version;
64
96
  }
65
- await file.save(request.artifact.text, {
66
- contentType: "text/plain",
67
- metadata
68
- });
69
- return version;
70
97
  }
71
98
  async loadArtifact(request) {
99
+ var _a, _b, _c;
72
100
  try {
73
101
  let version = request.version;
74
102
  if (version === void 0) {
@@ -84,11 +112,25 @@ class GcsArtifactService {
84
112
  version
85
113
  })
86
114
  );
87
- const [[metadata], [rawDataBuffer]] = await Promise.all([
88
- file.getMetadata(),
89
- file.download()
90
- ]);
91
- if (metadata.contentType === "text/plain") {
115
+ const [metadata] = await file.getMetadata();
116
+ const customMeta = (_a = metadata.metadata) != null ? _a : {};
117
+ const fileUri = customMeta[GCS_FILE_URI_METADATA_KEY];
118
+ if (fileUri) {
119
+ const mimeType = (_c = (_b = customMeta[GCS_FILE_MIME_TYPE_METADATA_KEY]) != null ? _b : metadata.contentType) != null ? _c : void 0;
120
+ return { fileData: { fileUri, mimeType } };
121
+ }
122
+ const [rawDataBuffer] = await file.download();
123
+ const displayName = customMeta[GCS_DISPLAY_NAME_METADATA_KEY];
124
+ if (displayName) {
125
+ return {
126
+ inlineData: {
127
+ data: rawDataBuffer.toString("base64"),
128
+ mimeType: metadata.contentType,
129
+ displayName
130
+ }
131
+ };
132
+ }
133
+ if (customMeta[GCS_IS_TEXT_METADATA_KEY] === "true" || metadata.contentType === "text/plain") {
92
134
  return (0, import_genai.createPartFromText)(rawDataBuffer.toString("utf-8"));
93
135
  }
94
136
  return (0, import_genai.createPartFromBase64)(
@@ -48,7 +48,7 @@ class InMemoryArtifactService {
48
48
  artifact,
49
49
  customMetadata
50
50
  }) {
51
- if (!artifact.inlineData && !artifact.text) {
51
+ if (!artifact.inlineData && !artifact.text && !artifact.fileData) {
52
52
  return Promise.reject(
53
53
  new Error("Artifact must have either inlineData or text content.")
54
54
  );
@@ -62,6 +62,10 @@ class InMemoryArtifactService {
62
62
  version,
63
63
  customMetadata
64
64
  };
65
+ if (!artifact.inlineData && artifact.text === void 0) {
66
+ const fileData = artifact.fileData;
67
+ metadata.mimeType = fileData.mimeType;
68
+ }
65
69
  this.artifacts[path].push({ part: artifact, metadata });
66
70
  return Promise.resolve(version);
67
71
  }
@@ -0,0 +1,101 @@
1
+ /**
2
+ * @license
3
+ * Copyright 2026 Google LLC
4
+ * SPDX-License-Identifier: Apache-2.0
5
+ */
6
+
7
+ "use strict";
8
+ var __defProp = Object.defineProperty;
9
+ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
10
+ var __getOwnPropNames = Object.getOwnPropertyNames;
11
+ var __hasOwnProp = Object.prototype.hasOwnProperty;
12
+ var __export = (target, all) => {
13
+ for (var name in all)
14
+ __defProp(target, name, { get: all[name], enumerable: true });
15
+ };
16
+ var __copyProps = (to, from, except, desc) => {
17
+ if (from && typeof from === "object" || typeof from === "function") {
18
+ for (let key of __getOwnPropNames(from))
19
+ if (!__hasOwnProp.call(to, key) && key !== except)
20
+ __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
21
+ }
22
+ return to;
23
+ };
24
+ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
25
+ var scoped_artifact_service_exports = {};
26
+ __export(scoped_artifact_service_exports, {
27
+ ScopedArtifactService: () => ScopedArtifactService
28
+ });
29
+ module.exports = __toCommonJS(scoped_artifact_service_exports);
30
+ /**
31
+ * @license
32
+ * Copyright 2026 Google LLC
33
+ * SPDX-License-Identifier: Apache-2.0
34
+ */
35
+ class ScopedArtifactService {
36
+ constructor(delegate, appName, userId, sessionId) {
37
+ this.delegate = delegate;
38
+ this.appName = appName;
39
+ this.userId = userId;
40
+ this.sessionId = sessionId;
41
+ }
42
+ async saveArtifact(request) {
43
+ return this.delegate.saveArtifact({
44
+ appName: this.appName,
45
+ userId: this.userId,
46
+ sessionId: this.sessionId,
47
+ ...request
48
+ });
49
+ }
50
+ async loadArtifact(request) {
51
+ return this.delegate.loadArtifact({
52
+ appName: this.appName,
53
+ userId: this.userId,
54
+ sessionId: this.sessionId,
55
+ ...request
56
+ });
57
+ }
58
+ async listArtifactKeys() {
59
+ return this.delegate.listArtifactKeys({
60
+ appName: this.appName,
61
+ userId: this.userId,
62
+ sessionId: this.sessionId
63
+ });
64
+ }
65
+ async deleteArtifact(filename) {
66
+ return this.delegate.deleteArtifact({
67
+ appName: this.appName,
68
+ userId: this.userId,
69
+ sessionId: this.sessionId,
70
+ filename
71
+ });
72
+ }
73
+ async listVersions(filename) {
74
+ return this.delegate.listVersions({
75
+ appName: this.appName,
76
+ userId: this.userId,
77
+ sessionId: this.sessionId,
78
+ filename
79
+ });
80
+ }
81
+ async listArtifactVersions(filename) {
82
+ return this.delegate.listArtifactVersions({
83
+ appName: this.appName,
84
+ userId: this.userId,
85
+ sessionId: this.sessionId,
86
+ filename
87
+ });
88
+ }
89
+ async getArtifactVersion(request) {
90
+ return this.delegate.getArtifactVersion({
91
+ appName: this.appName,
92
+ userId: this.userId,
93
+ sessionId: this.sessionId,
94
+ ...request
95
+ });
96
+ }
97
+ }
98
+ // Annotate the CommonJS export names for ESM import in node:
99
+ 0 && (module.exports = {
100
+ ScopedArtifactService
101
+ });
@@ -0,0 +1,27 @@
1
+ /**
2
+ * @license
3
+ * Copyright 2026 Google LLC
4
+ * SPDX-License-Identifier: Apache-2.0
5
+ */
6
+
7
+ "use strict";
8
+ var __defProp = Object.defineProperty;
9
+ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
10
+ var __getOwnPropNames = Object.getOwnPropertyNames;
11
+ var __hasOwnProp = Object.prototype.hasOwnProperty;
12
+ var __copyProps = (to, from, except, desc) => {
13
+ if (from && typeof from === "object" || typeof from === "function") {
14
+ for (let key of __getOwnPropNames(from))
15
+ if (!__hasOwnProp.call(to, key) && key !== except)
16
+ __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
17
+ }
18
+ return to;
19
+ };
20
+ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
21
+ var session_artifact_service_exports = {};
22
+ module.exports = __toCommonJS(session_artifact_service_exports);
23
+ /**
24
+ * @license
25
+ * Copyright 2026 Google LLC
26
+ * SPDX-License-Identifier: Apache-2.0
27
+ */
@@ -26,7 +26,9 @@ var oauth2_discovery_exports = {};
26
26
  __export(oauth2_discovery_exports, {
27
27
  AuthorizationServerMetadataSchema: () => AuthorizationServerMetadataSchema,
28
28
  OAuth2DiscoveryManager: () => OAuth2DiscoveryManager,
29
- ProtectedResourceMetadataSchema: () => ProtectedResourceMetadataSchema
29
+ ProtectedResourceMetadataSchema: () => ProtectedResourceMetadataSchema,
30
+ normaliseHostname: () => normaliseHostname,
31
+ validateDiscoveryUrl: () => validateDiscoveryUrl
30
32
  });
31
33
  module.exports = __toCommonJS(oauth2_discovery_exports);
32
34
  var import_zod = require("zod");
@@ -84,7 +86,11 @@ class OAuth2DiscoveryManager {
84
86
  method: "GET",
85
87
  headers: {
86
88
  Accept: "application/json"
87
- }
89
+ },
90
+ // Never follow redirects: validateDiscoveryUrl only checks the
91
+ // initial URL, so following a 3xx would let a validated host
92
+ // redirect discovery to a private/cloud-metadata address (CWE-918).
93
+ redirect: "error"
88
94
  });
89
95
  if (!response.ok) {
90
96
  continue;
@@ -132,7 +138,11 @@ class OAuth2DiscoveryManager {
132
138
  method: "GET",
133
139
  headers: {
134
140
  Accept: "application/json"
135
- }
141
+ },
142
+ // Never follow redirects: validateDiscoveryUrl only checks the
143
+ // initial URL, so following a 3xx would let a validated host
144
+ // redirect discovery to a private/cloud-metadata address (CWE-918).
145
+ redirect: "error"
136
146
  });
137
147
  if (!response.ok) {
138
148
  return void 0;
@@ -172,7 +182,7 @@ function validateDiscoveryUrl(urlStr) {
172
182
  return false;
173
183
  }
174
184
  const host = normaliseHostname(url.hostname.toLowerCase());
175
- if (host === "localhost" || host === "metadata.google.internal" || host === "metadata.goog" || host.startsWith("127.") || host === "[::1]" || host === "0.0.0.0" || host.startsWith("10.") || host.startsWith("192.168.") || host.startsWith("169.254.")) {
185
+ if (host === "localhost" || host === "metadata.google.internal" || host === "metadata.goog" || host.startsWith("127.") || host === "[::1]" || host === "[::]" || host === "0.0.0.0" || host.startsWith("10.") || host.startsWith("192.168.") || host.startsWith("169.254.")) {
176
186
  import_logger.logger.warn(`Unsafe host for discovery URL: ${host}`);
177
187
  return false;
178
188
  }
@@ -206,5 +216,7 @@ function validateDiscoveryUrl(urlStr) {
206
216
  0 && (module.exports = {
207
217
  AuthorizationServerMetadataSchema,
208
218
  OAuth2DiscoveryManager,
209
- ProtectedResourceMetadataSchema
219
+ ProtectedResourceMetadataSchema,
220
+ normaliseHostname,
221
+ validateDiscoveryUrl
210
222
  });
@@ -32,6 +32,7 @@ __export(oauth2_utils_exports, {
32
32
  });
33
33
  module.exports = __toCommonJS(oauth2_utils_exports);
34
34
  var import_logger = require("../../utils/logger.js");
35
+ var import_oauth2_discovery = require("./oauth2_discovery.js");
35
36
  /**
36
37
  * @license
37
38
  * Copyright 2026 Google LLC
@@ -51,13 +52,23 @@ function getTokenEndpoint(authScheme) {
51
52
  return void 0;
52
53
  }
53
54
  async function fetchOAuth2Tokens(endpoint, body) {
55
+ if (!(0, import_oauth2_discovery.validateDiscoveryUrl)(endpoint)) {
56
+ throw new Error(
57
+ `SSRF protection: OAuth2 token endpoint '${endpoint}' is not allowed. Must use HTTPS and must not target private/loopback/cloud-metadata addresses.`
58
+ );
59
+ }
54
60
  try {
55
61
  const response = await fetch(endpoint, {
56
62
  method: "POST",
57
63
  headers: {
58
64
  "Content-Type": "application/x-www-form-urlencoded"
59
65
  },
60
- body: body.toString()
66
+ body: body.toString(),
67
+ // Never follow redirects: the SSRF blocklist only validates `endpoint`,
68
+ // so a validated host that responds with a 3xx could otherwise redirect
69
+ // this credential-bearing POST (client_secret/refresh_token) to a
70
+ // private/cloud-metadata address (CWE-918).
71
+ redirect: "error"
61
72
  });
62
73
  if (!response.ok) {
63
74
  throw new Error(`Token request failed with status ${response.status}`);
@@ -28,6 +28,7 @@ __export(common_exports, {
28
28
  AUTH_PREPROCESSOR: () => import_auth_preprocessor.AUTH_PREPROCESSOR,
29
29
  ActiveStreamingTool: () => import_active_streaming_tool.ActiveStreamingTool,
30
30
  Agent: () => import_llm_agent.LlmAgent,
31
+ AgentControlledContextCompactor: () => import_agent_controlled_context_compactor.AgentControlledContextCompactor,
31
32
  AgentTool: () => import_agent_tool.AgentTool,
32
33
  AgentTransferLlmRequestProcessor: () => import_agent_transfer_llm_request_processor.AgentTransferLlmRequestProcessor,
33
34
  ApigeeLlm: () => import_apigee_llm.ApigeeLlm,
@@ -48,6 +49,7 @@ __export(common_exports, {
48
49
  BuiltInCodeExecutor: () => import_built_in_code_executor.BuiltInCodeExecutor,
49
50
  CONTENT_REQUEST_PROCESSOR: () => import_content_request_processor.CONTENT_REQUEST_PROCESSOR,
50
51
  CodeExecutionLanguage: () => import_code_execution_utils.CodeExecutionLanguage,
52
+ ConsolidateContextTool: () => import_consolidate_context_tool.ConsolidateContextTool,
51
53
  ContentRequestProcessor: () => import_content_request_processor.ContentRequestProcessor,
52
54
  Context: () => import_context.Context,
53
55
  ContextCompactionTrigger: () => import_base_plugin.ContextCompactionTrigger,
@@ -66,12 +68,14 @@ __export(common_exports, {
66
68
  GoogleLLMVariant: () => import_variant_utils.GoogleLLMVariant,
67
69
  GoogleMapsGroundingTool: () => import_google_maps_grounding_tool.GoogleMapsGroundingTool,
68
70
  GoogleSearchTool: () => import_google_search_tool.GoogleSearchTool,
71
+ INTERACTIONS_REQUEST_PROCESSOR: () => import_interactions_request_processor.INTERACTIONS_REQUEST_PROCESSOR,
69
72
  InMemoryArtifactService: () => import_in_memory_artifact_service.InMemoryArtifactService,
70
73
  InMemoryCredentialService: () => import_in_memory_credential_service.InMemoryCredentialService,
71
74
  InMemoryMemoryService: () => import_in_memory_memory_service.InMemoryMemoryService,
72
75
  InMemoryPolicyEngine: () => import_security_plugin.InMemoryPolicyEngine,
73
76
  InMemoryRunner: () => import_in_memory_runner.InMemoryRunner,
74
77
  InMemorySessionService: () => import_in_memory_session_service.InMemorySessionService,
78
+ InteractionsRequestProcessor: () => import_interactions_request_processor.InteractionsRequestProcessor,
75
79
  InvocationContext: () => import_invocation_context.InvocationContext,
76
80
  LLMRegistry: () => import_registry.LLMRegistry,
77
81
  LOAD_ARTIFACTS: () => import_load_artifacts_tool.LOAD_ARTIFACTS,
@@ -112,9 +116,11 @@ __export(common_exports, {
112
116
  SkillToolset: () => import_skill_toolset.SkillToolset,
113
117
  State: () => import_state.State,
114
118
  StreamingMode: () => import_run_config.StreamingMode,
119
+ Task: () => import_task.Task,
115
120
  TokenBasedContextCompactor: () => import_token_based_context_compactor.TokenBasedContextCompactor,
116
121
  ToolAuthHandler: () => import_tool_auth_handler.ToolAuthHandler,
117
122
  ToolConfirmation: () => import_tool_confirmation.ToolConfirmation,
123
+ TrajectoryThoughtPruningCompactor: () => import_trajectory_thought_pruning_compactor.TrajectoryThoughtPruningCompactor,
118
124
  TruncatingContextCompactor: () => import_truncating_context_compactor.TruncatingContextCompactor,
119
125
  URL_CONTEXT: () => import_url_context_tool.URL_CONTEXT,
120
126
  UrlContextTool: () => import_url_context_tool.UrlContextTool,
@@ -124,10 +130,16 @@ __export(common_exports, {
124
130
  createEvent: () => import_event.createEvent,
125
131
  createEventActions: () => import_event_actions.createEventActions,
126
132
  createRestApiTool: () => import_rest_api_tool.createRestApiTool,
133
+ createResumabilityConfig: () => import_resumability_config.createResumabilityConfig,
127
134
  createSession: () => import_session.createSession,
135
+ determineAgentForResumption: () => import_runner.determineAgentForResumption,
136
+ findEventByFunctionCallId: () => import_functions.findEventByFunctionCallId,
137
+ findEventByLastFunctionResponseId: () => import_runner.findEventByLastFunctionResponseId,
138
+ findMatchingFunctionCall: () => import_functions.findMatchingFunctionCall,
128
139
  functionsExportedForTestingOnly: () => import_functions.functionsExportedForTestingOnly,
129
140
  geminiInitParams: () => import_google_llm.geminiInitParams,
130
141
  getAskUserConfirmationFunctionCalls: () => import_security_plugin.getAskUserConfirmationFunctionCalls,
142
+ getClientLabels: () => import_client_labels.getClientLabels,
131
143
  getFunctionCalls: () => import_event.getFunctionCalls,
132
144
  getFunctionResponses: () => import_event.getFunctionResponses,
133
145
  getLogger: () => import_logger.getLogger,
@@ -146,12 +158,14 @@ __export(common_exports, {
146
158
  isLlmAgent: () => import_llm_agent.isLlmAgent,
147
159
  isLoopAgent: () => import_loop_agent.isLoopAgent,
148
160
  isParallelAgent: () => import_parallel_agent.isParallelAgent,
161
+ isRoutableLlmAgent: () => import_runner.isRoutableLlmAgent,
149
162
  isRoutedAgent: () => import_routed_agent.isRoutedAgent,
150
163
  isRunner: () => import_runner.isRunner,
151
164
  isSequentialAgent: () => import_sequential_agent.isSequentialAgent,
152
165
  loadAllSkillsInDir: () => import_loader.loadAllSkillsInDir,
153
166
  loadSkillFromDir: () => import_loader.loadSkillFromDir,
154
167
  loadSkillFromZipBuffer: () => import_loader.loadSkillFromZipBuffer,
168
+ runWithClientLabel: () => import_client_labels.runWithClientLabel,
155
169
  setLogLevel: () => import_logger.setLogLevel,
156
170
  setLogger: () => import_logger.setLogger,
157
171
  stringifyContent: () => import_event.stringifyContent,
@@ -174,10 +188,12 @@ var import_agent_transfer_llm_request_processor = require("./agents/processors/a
174
188
  var import_base_llm_processor = require("./agents/processors/base_llm_processor.js");
175
189
  var import_content_request_processor = require("./agents/processors/content_request_processor.js");
176
190
  var import_context_compactor_request_processor = require("./agents/processors/context_compactor_request_processor.js");
191
+ var import_interactions_request_processor = require("./agents/processors/interactions_request_processor.js");
177
192
  var import_readonly_context = require("./agents/readonly_context.js");
178
193
  var import_routed_agent = require("./agents/routed_agent.js");
179
194
  var import_run_config = require("./agents/run_config.js");
180
195
  var import_sequential_agent = require("./agents/sequential_agent.js");
196
+ var import_resumability_config = require("./apps/resumability_config.js");
181
197
  var import_in_memory_artifact_service = require("./artifacts/in_memory_artifact_service.js");
182
198
  var import_auth_credential = require("./auth/auth_credential.js");
183
199
  var import_auth_handler = require("./auth/auth_handler.js");
@@ -193,8 +209,10 @@ var import_credential_refresher_registry = require("./auth/refresher/credential_
193
209
  var import_base_code_executor = require("./code_executors/base_code_executor.js");
194
210
  var import_built_in_code_executor = require("./code_executors/built_in_code_executor.js");
195
211
  var import_code_execution_utils = require("./code_executors/code_execution_utils.js");
212
+ var import_agent_controlled_context_compactor = require("./context/agent_controlled_context_compactor.js");
196
213
  var import_llm_summarizer = require("./context/summarizers/llm_summarizer.js");
197
214
  var import_token_based_context_compactor = require("./context/token_based_context_compactor.js");
215
+ var import_trajectory_thought_pruning_compactor = require("./context/trajectory_thought_pruning_compactor.js");
198
216
  var import_truncating_context_compactor = require("./context/truncating_context_compactor.js");
199
217
  var import_compacted_event = require("./events/compacted_event.js");
200
218
  var import_event = require("./events/event.js");
@@ -221,6 +239,7 @@ var import_state = require("./sessions/state.js");
221
239
  var import_agent_tool = require("./tools/agent_tool.js");
222
240
  var import_base_tool = require("./tools/base_tool.js");
223
241
  var import_base_toolset = require("./tools/base_toolset.js");
242
+ var import_consolidate_context_tool = require("./tools/consolidate_context_tool.js");
224
243
  var import_exit_loop_tool = require("./tools/exit_loop_tool.js");
225
244
  var import_function_tool = require("./tools/function_tool.js");
226
245
  var import_google_maps_grounding_tool = require("./tools/google_maps_grounding_tool.js");
@@ -233,9 +252,11 @@ var import_tool_confirmation = require("./tools/tool_confirmation.js");
233
252
  var import_url_context_tool = require("./tools/url_context_tool.js");
234
253
  var import_vertex_ai_search_tool = require("./tools/vertex_ai_search_tool.js");
235
254
  var import_vertex_rag_retrieval_tool = require("./tools/vertex_rag_retrieval_tool.js");
255
+ var import_client_labels = require("./utils/client_labels.js");
236
256
  var import_logger = require("./utils/logger.js");
237
257
  var import_model_name = require("./utils/model_name.js");
238
258
  var import_simple_zod_to_json = require("./utils/simple_zod_to_json.js");
259
+ var import_task = require("./utils/task.js");
239
260
  var import_variant_utils = require("./utils/variant_utils.js");
240
261
  var import_version = require("./version.js");
241
262
  var import_gcp_skill_registry = require("./skills/gcp_skill_registry.js");
@@ -245,11 +266,17 @@ var import_load_skill_resource_tool = require("./tools/skill/load_skill_resource
245
266
  var import_load_skill_tool = require("./tools/skill/load_skill_tool.js");
246
267
  var import_search_skills_tool = require("./tools/skill/search_skills_tool.js");
247
268
  var import_skill_toolset = require("./tools/skill/skill_toolset.js");
269
+ __reExport(common_exports, require("./artifacts/base_artifact_service.js"), module.exports);
270
+ __reExport(common_exports, require("./features/feature_registry.js"), module.exports);
271
+ __reExport(common_exports, require("./memory/base_memory_service.js"), module.exports);
272
+ __reExport(common_exports, require("./sessions/base_session_service.js"), module.exports);
273
+ __reExport(common_exports, require("./tools/base_tool.js"), module.exports);
248
274
  var import_openapi_spec_parser = require("./tools/openapi_tool/openapi_spec_parser/openapi_spec_parser.js");
249
275
  var import_operation_parser = require("./tools/openapi_tool/openapi_spec_parser/operation_parser.js");
250
276
  var import_tool_auth_handler = require("./tools/openapi_tool/openapi_spec_parser/tool_auth_handler.js");
251
277
  var import_openapi_toolset = require("./tools/openapi_tool/openapi_toolset.js");
252
278
  var import_rest_api_tool = require("./tools/openapi_tool/rest_api_tool.js");
279
+ __reExport(common_exports, require("./apps/app.js"), module.exports);
253
280
  __reExport(common_exports, require("./artifacts/base_artifact_service.js"), module.exports);
254
281
  __reExport(common_exports, require("./features/feature_registry.js"), module.exports);
255
282
  __reExport(common_exports, require("./memory/base_memory_service.js"), module.exports);
@@ -265,6 +292,7 @@ __reExport(common_exports, require("./tools/base_tool.js"), module.exports);
265
292
  AUTH_PREPROCESSOR,
266
293
  ActiveStreamingTool,
267
294
  Agent,
295
+ AgentControlledContextCompactor,
268
296
  AgentTool,
269
297
  AgentTransferLlmRequestProcessor,
270
298
  ApigeeLlm,
@@ -285,6 +313,7 @@ __reExport(common_exports, require("./tools/base_tool.js"), module.exports);
285
313
  BuiltInCodeExecutor,
286
314
  CONTENT_REQUEST_PROCESSOR,
287
315
  CodeExecutionLanguage,
316
+ ConsolidateContextTool,
288
317
  ContentRequestProcessor,
289
318
  Context,
290
319
  ContextCompactionTrigger,
@@ -303,12 +332,14 @@ __reExport(common_exports, require("./tools/base_tool.js"), module.exports);
303
332
  GoogleLLMVariant,
304
333
  GoogleMapsGroundingTool,
305
334
  GoogleSearchTool,
335
+ INTERACTIONS_REQUEST_PROCESSOR,
306
336
  InMemoryArtifactService,
307
337
  InMemoryCredentialService,
308
338
  InMemoryMemoryService,
309
339
  InMemoryPolicyEngine,
310
340
  InMemoryRunner,
311
341
  InMemorySessionService,
342
+ InteractionsRequestProcessor,
312
343
  InvocationContext,
313
344
  LLMRegistry,
314
345
  LOAD_ARTIFACTS,
@@ -349,9 +380,11 @@ __reExport(common_exports, require("./tools/base_tool.js"), module.exports);
349
380
  SkillToolset,
350
381
  State,
351
382
  StreamingMode,
383
+ Task,
352
384
  TokenBasedContextCompactor,
353
385
  ToolAuthHandler,
354
386
  ToolConfirmation,
387
+ TrajectoryThoughtPruningCompactor,
355
388
  TruncatingContextCompactor,
356
389
  URL_CONTEXT,
357
390
  UrlContextTool,
@@ -361,10 +394,16 @@ __reExport(common_exports, require("./tools/base_tool.js"), module.exports);
361
394
  createEvent,
362
395
  createEventActions,
363
396
  createRestApiTool,
397
+ createResumabilityConfig,
364
398
  createSession,
399
+ determineAgentForResumption,
400
+ findEventByFunctionCallId,
401
+ findEventByLastFunctionResponseId,
402
+ findMatchingFunctionCall,
365
403
  functionsExportedForTestingOnly,
366
404
  geminiInitParams,
367
405
  getAskUserConfirmationFunctionCalls,
406
+ getClientLabels,
368
407
  getFunctionCalls,
369
408
  getFunctionResponses,
370
409
  getLogger,
@@ -383,12 +422,14 @@ __reExport(common_exports, require("./tools/base_tool.js"), module.exports);
383
422
  isLlmAgent,
384
423
  isLoopAgent,
385
424
  isParallelAgent,
425
+ isRoutableLlmAgent,
386
426
  isRoutedAgent,
387
427
  isRunner,
388
428
  isSequentialAgent,
389
429
  loadAllSkillsInDir,
390
430
  loadSkillFromDir,
391
431
  loadSkillFromZipBuffer,
432
+ runWithClientLabel,
392
433
  setLogLevel,
393
434
  setLogger,
394
435
  stringifyContent,
@@ -400,5 +441,11 @@ __reExport(common_exports, require("./tools/base_tool.js"), module.exports);
400
441
  ...require("./features/feature_registry.js"),
401
442
  ...require("./memory/base_memory_service.js"),
402
443
  ...require("./sessions/base_session_service.js"),
444
+ ...require("./tools/base_tool.js"),
445
+ ...require("./apps/app.js"),
446
+ ...require("./artifacts/base_artifact_service.js"),
447
+ ...require("./features/feature_registry.js"),
448
+ ...require("./memory/base_memory_service.js"),
449
+ ...require("./sessions/base_session_service.js"),
403
450
  ...require("./tools/base_tool.js")
404
451
  });
@@ -0,0 +1,109 @@
1
+ /**
2
+ * @license
3
+ * Copyright 2026 Google LLC
4
+ * SPDX-License-Identifier: Apache-2.0
5
+ */
6
+
7
+ "use strict";
8
+ var __defProp = Object.defineProperty;
9
+ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
10
+ var __getOwnPropNames = Object.getOwnPropertyNames;
11
+ var __hasOwnProp = Object.prototype.hasOwnProperty;
12
+ var __export = (target, all) => {
13
+ for (var name in all)
14
+ __defProp(target, name, { get: all[name], enumerable: true });
15
+ };
16
+ var __copyProps = (to, from, except, desc) => {
17
+ if (from && typeof from === "object" || typeof from === "function") {
18
+ for (let key of __getOwnPropNames(from))
19
+ if (!__hasOwnProp.call(to, key) && key !== except)
20
+ __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
21
+ }
22
+ return to;
23
+ };
24
+ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
25
+ var agent_controlled_context_compactor_exports = {};
26
+ __export(agent_controlled_context_compactor_exports, {
27
+ AgentControlledContextCompactor: () => AgentControlledContextCompactor
28
+ });
29
+ module.exports = __toCommonJS(agent_controlled_context_compactor_exports);
30
+ var import_compacted_event = require("../events/compacted_event.js");
31
+ var import_event = require("../events/event.js");
32
+ var import_base_plugin = require("../plugins/base_plugin.js");
33
+ /**
34
+ * @license
35
+ * Copyright 2026 Google LLC
36
+ * SPDX-License-Identifier: Apache-2.0
37
+ */
38
+ class AgentControlledContextCompactor {
39
+ constructor(options) {
40
+ this.trigger = import_base_plugin.ContextCompactionTrigger.AgentControlled;
41
+ this.summarizer = options.summarizer;
42
+ }
43
+ shouldCompact(invocationContext) {
44
+ return invocationContext.session.state["temp:consolidate_context"] === true;
45
+ }
46
+ async compact(invocationContext) {
47
+ const events = invocationContext.session.events;
48
+ const activeEvents = this.getActiveEvents(events);
49
+ const consolidateToolCallIndex = activeEvents.reduce(
50
+ (acc, e, idx) => {
51
+ var _a, _b;
52
+ return ((_b = (_a = e.content) == null ? void 0 : _a.parts) == null ? void 0 : _b.some(
53
+ (p) => {
54
+ var _a2;
55
+ return ((_a2 = p.functionCall) == null ? void 0 : _a2.name) === "consolidate_context";
56
+ }
57
+ )) ? idx : acc;
58
+ },
59
+ -1
60
+ );
61
+ if (consolidateToolCallIndex <= 0) {
62
+ this.clearFlags(invocationContext);
63
+ return;
64
+ }
65
+ const eventsToCompact = activeEvents.slice(0, consolidateToolCallIndex);
66
+ const detail = invocationContext.session.state["temp:consolidate_context_detail"];
67
+ if (detail) {
68
+ eventsToCompact.push(
69
+ (0, import_event.createEvent)({
70
+ author: "system",
71
+ timestamp: eventsToCompact[eventsToCompact.length - 1].timestamp,
72
+ content: {
73
+ role: "user",
74
+ parts: [
75
+ {
76
+ text: `CRITICAL INSTRUCTION FOR SUMMARY: Please summarize the history. Focus especially on: ${detail}`
77
+ }
78
+ ]
79
+ }
80
+ })
81
+ );
82
+ }
83
+ try {
84
+ const compactedEvent = await this.summarizer.summarize(eventsToCompact);
85
+ invocationContext.session.events.push(compactedEvent);
86
+ } catch (error) {
87
+ console.error("Compaction failed:", error);
88
+ } finally {
89
+ this.clearFlags(invocationContext);
90
+ }
91
+ }
92
+ clearFlags(invocationContext) {
93
+ delete invocationContext.session.state["temp:consolidate_context"];
94
+ delete invocationContext.session.state["temp:consolidate_context_detail"];
95
+ }
96
+ getActiveEvents(events) {
97
+ const latest = events.filter(import_compacted_event.isCompactedEvent).pop();
98
+ return latest ? [
99
+ latest,
100
+ ...events.filter(
101
+ (e) => !(0, import_compacted_event.isCompactedEvent)(e) && e.timestamp > latest.endTime
102
+ )
103
+ ] : events;
104
+ }
105
+ }
106
+ // Annotate the CommonJS export names for ESM import in node:
107
+ 0 && (module.exports = {
108
+ AgentControlledContextCompactor
109
+ });