@google/adk 1.4.0 → 1.6.0

package/dist/cjs/sessions/vertex_ai_session_service.js

@@ -71,16 +71,14 @@ let VertexAiSessionService = class extends import_base_session_service.BaseSessi
       this.location,
       options.expressModeApiKey
     );
-    if (!options.sessions) {
-      if (!this.expressModeApiKey && (!this.projectId || !this.location)) {
-        throw new Error(
-          "Either (Project ID and Location) or an expressModeApiKey is required."
-        );
-      }
-    }
     if (options.sessions) {
       this.sessions = options.sessions;
     } else {
+      if (!this.projectId || !this.location) {
+        throw new Error(
+          this.expressModeApiKey ? import_vertex_ai_utils.EXPRESS_MODE_UNSUPPORTED_MESSAGE : "Project ID and Location are required."
+        );
+      }
       const client = new import_client.Client({
         project: this.projectId,
         location: this.location
@@ -104,13 +102,25 @@ let VertexAiSessionService = class extends import_base_session_service.BaseSessi
     }
     return match[3];
   }
+  /**
+   * Creates a session on Vertex AI Agent Engine.
+   *
+   * @throws if both `ttl` and `expireTime` are specified.
+   */
   async createSession({
     appName,
     userId,
     state,
-    sessionId
+    sessionId,
+    ttl,
+    expireTime
   }) {
     var _a;
+    if (ttl != null && expireTime != null) {
+      throw new Error(
+        "Cannot specify both 'ttl' and 'expireTime' simultaneously."
+      );
+    }
     const reasoningEngineId = this.getReasoningEngineId(appName);
     const filteredState = state ? (0, import_base_session_service.trimTempState)(state) : void 0;
     let apiResponse = await this.sessions.createInternal({
@@ -118,7 +128,9 @@ let VertexAiSessionService = class extends import_base_session_service.BaseSessi
       userId,
       config: {
         ...filteredState ? { sessionState: filteredState } : {},
-        ...sessionId ? { sessionId } : {}
+        ...sessionId ? { sessionId } : {},
+        ...ttl != null ? { ttl } : {},
+        ...expireTime != null ? { expireTime } : {}
       }
     });
     const operationName = apiResponse.name;
@@ -204,7 +216,7 @@ let VertexAiSessionService = class extends import_base_session_service.BaseSessi
       return session;
     } catch (error) {
       const err = error;
-      if (err.code === GRPC_NOT_FOUND || err.code === HTTP_NOT_FOUND) {
+      if (err.code === GRPC_NOT_FOUND || err.code === HTTP_NOT_FOUND || err.status === HTTP_NOT_FOUND) {
         return void 0;
       }
       import_logger.logger.error(`Error getting session from Vertex AI: ${err.message}`);

package/dist/cjs/skills/loader.js

@@ -57,6 +57,9 @@ const ALLOWED_FRONTMATTER_KEYS = /* @__PURE__ */ new Set([
   "description",
   "license",
   "allowed-tools",
+  // Camel-case alias: FrontmatterSchema's preprocessor derives `allowedTools`
+  // from `allowed-tools`, and `.loose()` passes either spelling through.
+  "allowedTools",
   "metadata",
   "compatibility"
 ]);
@@ -119,7 +122,7 @@ async function loadDir(directoryPath) {
   }
   return files;
 }
-function parseSkillMdContent(content) {
+function parseFrontmatterYaml(content) {
   if (!content.startsWith("---")) {
     throw new Error("SKILL.md must start with YAML frontmatter (---)");
   }
@@ -131,15 +134,34 @@ function parseSkillMdContent(content) {
   const body = parts.filter((_, i) => i >= 2).join("---").trim();
   try {
     const parsed = import_js_yaml.default.load(frontmatterStr);
-    if (typeof parsed !== "object" || parsed === null) {
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
       throw new Error("SKILL.md frontmatter must be a YAML mapping");
     }
-    const frontmatter = import_skill.FrontmatterSchema.parse(parsed);
-    return { frontmatter, body };
+    return { raw: parsed, body };
   } catch (e) {
     throw new Error(`Invalid YAML in frontmatter: ${e.message}`);
   }
 }
+function validateFrontmatter(raw) {
+  try {
+    return import_skill.FrontmatterSchema.parse(raw);
+  } catch (e) {
+    throw new Error(`Invalid YAML in frontmatter: ${e.message}`);
+  }
+}
+function parseSkillMdContent(content) {
+  const { raw, body } = parseFrontmatterYaml(content);
+  return { frontmatter: validateFrontmatter(raw), body };
+}
+function isDangerousZipEntryName(entryName) {
+  if (path.posix.isAbsolute(entryName) || path.win32.isAbsolute(entryName)) {
+    return true;
+  }
+  return entryName.split(/[/\\]/).some((segment) => segment === "..");
+}
+function isBareSkillName(name) {
+  return name !== "." && name !== ".." && path.basename(name) === name;
+}
 async function loadSkillFromDir(skillDir) {
   const resolvedDir = path.resolve(skillDir);
   const skill = await loadSkillFile(skillDir);
@@ -279,6 +301,11 @@ async function loadAllSkillsInDir(skillsBasePath) {
 function loadSkillFromZipBuffer(zipBuffer) {
   const zip = new import_adm_zip.default(zipBuffer);
   const entries = zip.getEntries();
+  for (const entry of entries) {
+    if (isDangerousZipEntryName(entry.entryName)) {
+      throw new Error(`Dangerous zip entry ignored: ${entry.entryName}`);
+    }
+  }
   let skillMdContent = "";
   for (const entry of entries) {
     if (entry.isDirectory) continue;
@@ -290,8 +317,15 @@ function loadSkillFromZipBuffer(zipBuffer) {
   if (!skillMdContent) {
     throw new Error("SKILL.md not found in zipped filesystem.");
   }
-  const { frontmatter: parsed, body } = parseSkillMdContent(skillMdContent);
-  const frontmatter = import_skill.FrontmatterSchema.parse(parsed);
+  const { raw, body } = parseFrontmatterYaml(skillMdContent);
+  const skillName = raw["name"];
+  if (!skillName) {
+    throw new Error("SKILL.md frontmatter must contain 'name'");
+  }
+  if (typeof skillName !== "string" || !isBareSkillName(skillName)) {
+    throw new Error(`Invalid skill name in SKILL.md: ${String(skillName)}`);
+  }
+  const frontmatter = validateFrontmatter(raw);
   const references = {};
   const assets = {};
   const scripts = {};

package/dist/cjs/tools/enterprise_web_search_tool.js

@@ -0,0 +1,81 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var enterprise_web_search_tool_exports = {};
+__export(enterprise_web_search_tool_exports, {
+  ENTERPRISE_WEB_SEARCH: () => ENTERPRISE_WEB_SEARCH,
+  EnterpriseWebSearchTool: () => EnterpriseWebSearchTool,
+  applyEnterpriseWebSearch: () => applyEnterpriseWebSearch
+});
+module.exports = __toCommonJS(enterprise_web_search_tool_exports);
+var import_model_name = require("../utils/model_name.js");
+var import_base_tool = require("./base_tool.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+function applyEnterpriseWebSearch(llmRequest) {
+  if (!llmRequest.model) {
+    return;
+  }
+  const modelCheckDisabled = (0, import_model_name.isGeminiModelIdCheckDisabled)();
+  llmRequest.config = llmRequest.config || {};
+  llmRequest.config.tools = llmRequest.config.tools || [];
+  if ((0, import_model_name.isGeminiModel)(llmRequest.model) || modelCheckDisabled) {
+    if ((0, import_model_name.isGemini1Model)(llmRequest.model) && llmRequest.config.tools.length > 0) {
+      throw new Error(
+        "Enterprise Web Search tool cannot be used with other tools in Gemini 1.x."
+      );
+    }
+    llmRequest.config.tools.push({ enterpriseWebSearch: {} });
+    return;
+  }
+  throw new Error(
+    `Enterprise Web Search tool is not supported for model ${llmRequest.model}`
+  );
+}
+class EnterpriseWebSearchTool extends import_base_tool.BaseTool {
+  constructor() {
+    super({
+      name: "enterprise_web_search",
+      description: "Enterprise Web Search Tool"
+    });
+  }
+  runAsync() {
+    return Promise.resolve();
+  }
+  async processLlmRequest({
+    llmRequest
+  }) {
+    applyEnterpriseWebSearch(llmRequest);
+  }
+}
+const ENTERPRISE_WEB_SEARCH = new EnterpriseWebSearchTool();
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ENTERPRISE_WEB_SEARCH,
+  EnterpriseWebSearchTool,
+  applyEnterpriseWebSearch
+});

package/dist/cjs/tools/example_tool.js

@@ -0,0 +1,68 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var example_tool_exports = {};
+__export(example_tool_exports, {
+  ExampleTool: () => ExampleTool
+});
+module.exports = __toCommonJS(example_tool_exports);
+var import_example_util = require("../examples/example_util.js");
+var import_llm_request = require("../models/llm_request.js");
+var import_base_tool = require("./base_tool.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+class ExampleTool extends import_base_tool.BaseTool {
+  constructor(examples) {
+    super({
+      // Name and description are not used because this tool only changes
+      // llmRequest.
+      name: "example_tool",
+      description: "example tool"
+    });
+    this.examples = examples;
+  }
+  async runAsync(_request) {
+    throw new Error("ExampleTool should not be called by model");
+  }
+  async processLlmRequest({
+    toolContext,
+    llmRequest
+  }) {
+    var _a, _b;
+    const parts = (_a = toolContext.userContent) == null ? void 0 : _a.parts;
+    if (!parts || !((_b = parts[0]) == null ? void 0 : _b.text)) {
+      return;
+    }
+    (0, import_llm_request.appendInstructions)(llmRequest, [
+      (0, import_example_util.buildExampleSi)(this.examples, parts[0].text, llmRequest.model)
+    ]);
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ExampleTool
+});

package/dist/cjs/tools/get_user_choice_tool.js

@@ -0,0 +1,53 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var get_user_choice_tool_exports = {};
+__export(get_user_choice_tool_exports, {
+  getUserChoiceTool: () => getUserChoiceTool
+});
+module.exports = __toCommonJS(get_user_choice_tool_exports);
+var import_zod = require("zod");
+var import_long_running_tool = require("./long_running_tool.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const getUserChoiceTool = new import_long_running_tool.LongRunningFunctionTool({
+  name: "get_user_choice",
+  description: "Presents a list of options to the user and awaits their selection.",
+  parameters: import_zod.z.object({
+    options: import_zod.z.array(import_zod.z.string()).describe("List of options to present to the user.")
+  }),
+  execute: async (input, context) => {
+    if (context) {
+      context.actions.skipSummarization = true;
+    }
+    return null;
+  }
+});
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getUserChoiceTool
+});

package/dist/cjs/tools/load_web_page.js

@@ -0,0 +1,250 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var load_web_page_exports = {};
+__export(load_web_page_exports, {
+  LOAD_WEB_PAGE: () => LOAD_WEB_PAGE,
+  loadWebPage: () => loadWebPage
+});
+module.exports = __toCommonJS(load_web_page_exports);
+var import_promises = require("node:dns/promises");
+var import_node_net = require("node:net");
+var import_zod = require("zod");
+var import_function_tool = require("./function_tool.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
+const DEFAULT_TIMEOUT_MS = 3e4;
+const BLOCKED_IPV4_CIDRS = [
+  "0.0.0.0/8",
+  // "this host on this network"
+  "10.0.0.0/8",
+  // private
+  "100.64.0.0/10",
+  // shared address space / CGNAT
+  "127.0.0.0/8",
+  // loopback
+  "169.254.0.0/16",
+  // link-local (includes GCP metadata 169.254.169.254)
+  "172.16.0.0/12",
+  // private
+  "192.0.0.0/24",
+  // IETF protocol assignments
+  "192.0.2.0/24",
+  // TEST-NET-1 (documentation)
+  "192.88.99.0/24",
+  // 6to4 relay anycast (deprecated)
+  "192.168.0.0/16",
+  // private
+  "198.18.0.0/15",
+  // benchmarking
+  "198.51.100.0/24",
+  // TEST-NET-2 (documentation)
+  "203.0.113.0/24",
+  // TEST-NET-3 (documentation)
+  "224.0.0.0/4",
+  // multicast
+  "240.0.0.0/4"
+  // reserved / future use (includes 255.255.255.255)
+].map(parseIpv4Cidr);
+const BLOCKED_IPV6_CIDRS = [
+  "::/128",
+  // unspecified
+  "::1/128",
+  // loopback
+  "64:ff9b:1::/48",
+  // local NAT64
+  "100::/64",
+  // discard-only
+  "2001:db8::/32",
+  // documentation
+  "fc00::/7",
+  // unique-local (ULA, private)
+  "fe80::/10",
+  // link-local
+  "ff00::/8"
+  // multicast
+].map(parseIpv6Cidr);
+function failedToFetchMessage(url) {
+  return `Failed to fetch url: ${url}`;
+}
+function isBlockedHostname(hostname) {
+  const normalized = hostname.replace(/\.+$/, "").toLowerCase();
+  return normalized === "localhost" || normalized.endsWith(".localhost");
+}
+function normalizeHost(hostname) {
+  return hostname.startsWith("[") ? hostname.slice(1, -1) : hostname;
+}
+function parseIpv4(address) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(address);
+  if (!match) {
+    return null;
+  }
+  const octets = match.slice(1).map(Number);
+  if (octets.some((octet) => octet > 255)) {
+    return null;
+  }
+  return octets;
+}
+function parseIpv6(address) {
+  if ((0, import_node_net.isIP)(address) !== 6) {
+    return null;
+  }
+  const [head, tail] = address.split("::");
+  const highGroups = head ? expandHextets(head) : [];
+  const lowGroups = tail ? expandHextets(tail) : [];
+  const compressed = address.includes("::") ? new Array(8 - highGroups.length - lowGroups.length).fill(0) : [];
+  return [...highGroups, ...compressed, ...lowGroups];
+}
+function expandHextets(fragment) {
+  const hextets = [];
+  for (const group of fragment.split(":")) {
+    if (group.includes(".")) {
+      const octets = parseIpv4(group);
+      hextets.push(octets[0] << 8 | octets[1], octets[2] << 8 | octets[3]);
+    } else {
+      hextets.push(parseInt(group, 16));
+    }
+  }
+  return hextets;
+}
+function ipv4ToInt(octets) {
+  return (octets[0] << 24 | octets[1] << 16 | octets[2] << 8 | octets[3]) >>> 0;
+}
+function hextetsToBigInt(hextets) {
+  let value = 0n;
+  for (const hextet of hextets) {
+    value = value << 16n | BigInt(hextet);
+  }
+  return value;
+}
+function parseIpv4Cidr(cidr) {
+  const [address, prefix] = cidr.split("/");
+  const mask = 4294967295 << 32 - Number(prefix) >>> 0;
+  return { base: (ipv4ToInt(parseIpv4(address)) & mask) >>> 0, mask };
+}
+function parseIpv6Cidr(cidr) {
+  const [address, prefix] = cidr.split("/");
+  return { base: hextetsToBigInt(parseIpv6(address)), prefix: Number(prefix) };
+}
+function isBlockedIpv4(octets) {
+  const value = ipv4ToInt(octets);
+  return BLOCKED_IPV4_CIDRS.some(
+    ({ base, mask }) => (value & mask) >>> 0 === base
+  );
+}
+function isBlockedIpv6(hextets) {
+  const value = hextetsToBigInt(hextets);
+  if (value >> 32n === 0xffffn) {
+    return isBlockedIpv4([
+      Number(value >> 24n & 0xffn),
+      Number(value >> 16n & 0xffn),
+      Number(value >> 8n & 0xffn),
+      Number(value & 0xffn)
+    ]);
+  }
+  return BLOCKED_IPV6_CIDRS.some(
+    ({ base, prefix }) => value >> BigInt(128 - prefix) === base >> BigInt(128 - prefix)
+  );
+}
+function isBlockedAddress(address) {
+  const octets = parseIpv4(address);
+  if (octets) {
+    return isBlockedIpv4(octets);
+  }
+  const hextets = parseIpv6(address);
+  if (hextets) {
+    return isBlockedIpv6(hextets);
+  }
+  return true;
+}
+async function resolveHostAddresses(hostname) {
+  if ((0, import_node_net.isIP)(hostname) !== 0) {
+    return [hostname];
+  }
+  const records = await (0, import_promises.lookup)(hostname, { all: true });
+  const addresses = [...new Set(records.map((record) => record.address))];
+  if (addresses.length === 0) {
+    throw new Error(`Unable to resolve host: ${hostname}`);
+  }
+  return addresses;
+}
+function assertUrlAllowed(url) {
+  const parsed = new URL(url);
+  if (!ALLOWED_SCHEMES.has(parsed.protocol)) {
+    throw new Error(`Unsupported url scheme: ${url}`);
+  }
+  if (isBlockedHostname(parsed.hostname)) {
+    throw new Error(`Blocked host: ${parsed.hostname}`);
+  }
+  return parsed;
+}
+async function validateResolvedAddresses(hostname) {
+  const addresses = await resolveHostAddresses(hostname);
+  if (addresses.some(isBlockedAddress)) {
+    throw new Error(`Blocked host: ${hostname}`);
+  }
+}
+function decodeHtmlEntities(text) {
+  return text.replace(/&nbsp;/g, " ").replace(/&#39;/g, "'").replace(/&#x27;/g, "'").replace(/&quot;/g, '"').replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+}
+function htmlToText(html) {
+  const withoutCode = html.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<style[\s\S]*?<\/style>/gi, " ").replace(/<!--[\s\S]*?-->/g, " ");
+  const text = decodeHtmlEntities(withoutCode.replace(/<[^>]+>/g, "\n"));
+  return text.split("\n").map((line) => line.trim()).filter((line) => line.split(/\s+/).filter(Boolean).length > 3).join("\n");
+}
+async function loadWebPage(url, options) {
+  var _a;
+  const timeoutMs = (_a = options == null ? void 0 : options.timeoutMs) != null ? _a : DEFAULT_TIMEOUT_MS;
+  try {
+    const parsed = assertUrlAllowed(url);
+    await validateResolvedAddresses(normalizeHost(parsed.hostname));
+    const response = await fetch(url, {
+      redirect: "manual",
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (response.status !== 200) {
+      return failedToFetchMessage(url);
+    }
+    return htmlToText(await response.text());
+  } catch {
+    return failedToFetchMessage(url);
+  }
+}
+const LOAD_WEB_PAGE = new import_function_tool.FunctionTool({
+  name: "load_web_page",
+  description: "Fetches the content at the given URL and returns the readable text extracted from the page.",
+  parameters: import_zod.z.object({
+    url: import_zod.z.string().describe("The URL to fetch and extract text from.")
+  }),
+  execute: ({ url }) => loadWebPage(url)
+});
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  LOAD_WEB_PAGE,
+  loadWebPage
+});