@google/adk 1.5.0 → 2.0.0

package/dist/esm/auth/credential_response_binding.js

@@ -0,0 +1,74 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+function readField(source, name) {
+  if (typeof source !== "object" || source === null) {
+    return void 0;
+  }
+  const record = source;
+  if (name in record) {
+    return record[name];
+  }
+  return record[name.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`)];
+}
+__name(readField, "readField");
+function readString(source, name) {
+  const value = readField(source, name);
+  return typeof value === "string" ? value : void 0;
+}
+__name(readString, "readString");
+function bindCredential(request, supplied) {
+  var _a;
+  const requested = request.exchangedAuthCredential;
+  if (!((_a = requested == null ? void 0 : requested.oauth2) == null ? void 0 : _a.authUri)) {
+    return supplied;
+  }
+  const suppliedOAuth2 = readField(supplied, "oauth2");
+  const answer = {};
+  const authResponseUri = readString(suppliedOAuth2, "authResponseUri");
+  if (authResponseUri !== void 0) {
+    answer.authResponseUri = authResponseUri;
+  }
+  const authCode = readString(suppliedOAuth2, "authCode");
+  if (authCode !== void 0) {
+    answer.authCode = authCode;
+  }
+  if (authResponseUri === void 0 && authCode === void 0) {
+    return void 0;
+  }
+  return {
+    ...requested,
+    oauth2: { ...requested.oauth2, ...answer }
+  };
+}
+__name(bindCredential, "bindCredential");
+function bindCredentialResponse(request, response) {
+  const { authScheme, credentialKey } = request;
+  if (!authScheme || !credentialKey) {
+    return void 0;
+  }
+  const supplied = readField(response, "exchangedAuthCredential");
+  if (typeof supplied !== "object" || supplied === null) {
+    return void 0;
+  }
+  const exchangedAuthCredential = bindCredential(request, supplied);
+  if (!exchangedAuthCredential) {
+    return void 0;
+  }
+  return {
+    authScheme,
+    credentialKey,
+    rawAuthCredential: request.rawAuthCredential,
+    exchangedAuthCredential
+  };
+}
+__name(bindCredentialResponse, "bindCredentialResponse");
+export {
+  bindCredentialResponse
+};

package/dist/esm/auth/credential_service/in_memory_credential_service.js

@@ -1,13 +1,26 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class InMemoryCredentialService {
+const _InMemoryCredentialService = class _InMemoryCredentialService {
   constructor() {
-    this.credentials = {};
+    /**
+     * A map from app name to a map from user ID to a map from credential key to
+     * credential.
+     *
+     * `appName`, `userId` and `credentialKey` are all attacker-influenced, so
+     * every level is created with `Object.create(null)`. On an ordinary `{}`
+     * literal a key of `__proto__` resolves to the inherited `__proto__`
+     * accessor rather than creating an own property, so nested assignment
+     * pollutes every object in the process, and a lookup of an inherited key
+     * such as `toString` returns a function instead of `undefined`.
+     */
+    this.credentials = /* @__PURE__ */ Object.create(null);
   }
   loadCredential(authConfig, toolContext) {
     const credentialBucket = this.getBucketForCurrentContext(toolContext);
@@ -22,14 +35,16 @@ class InMemoryCredentialService {
   getBucketForCurrentContext(toolContext) {
     const { appName, userId } = toolContext.invocationContext.session;
     if (!this.credentials[appName]) {
-      this.credentials[appName] = {};
+      this.credentials[appName] = /* @__PURE__ */ Object.create(null);
     }
     if (!this.credentials[appName][userId]) {
-      this.credentials[appName][userId] = {};
+      this.credentials[appName][userId] = /* @__PURE__ */ Object.create(null);
     }
     return this.credentials[appName][userId];
   }
-}
+};
+__name(_InMemoryCredentialService, "InMemoryCredentialService");
+let InMemoryCredentialService = _InMemoryCredentialService;
 export {
   InMemoryCredentialService
 };

package/dist/esm/auth/credential_service/session_state_credential_service.js

@@ -1,11 +1,13 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class SessionStateCredentialService {
+const _SessionStateCredentialService = class _SessionStateCredentialService {
   loadCredential(authConfig, toolContext) {
     return Promise.resolve(toolContext.state.get(authConfig.credentialKey));
   }
@@ -17,7 +19,9 @@ class SessionStateCredentialService {
       );
     }
   }
-}
+};
+__name(_SessionStateCredentialService, "SessionStateCredentialService");
+let SessionStateCredentialService = _SessionStateCredentialService;
 export {
   SessionStateCredentialService
 };

package/dist/esm/auth/exchanger/base_credential_exchanger.js

@@ -1,12 +1,16 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class CredentialExchangeError extends Error {
-}
+const _CredentialExchangeError = class _CredentialExchangeError extends Error {
+};
+__name(_CredentialExchangeError, "CredentialExchangeError");
+let CredentialExchangeError = _CredentialExchangeError;
 export {
   CredentialExchangeError
 };

package/dist/esm/auth/exchanger/credential_exchanger_registry.js

@@ -1,11 +1,13 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class CredentialExchangerRegistry {
+const _CredentialExchangerRegistry = class _CredentialExchangerRegistry {
   constructor() {
     this.exchangers = {};
   }
@@ -25,7 +27,9 @@ class CredentialExchangerRegistry {
   getExchanger(credentialType) {
     return this.exchangers[credentialType];
   }
-}
+};
+__name(_CredentialExchangerRegistry, "CredentialExchangerRegistry");
+let CredentialExchangerRegistry = _CredentialExchangerRegistry;
 export {
   CredentialExchangerRegistry
 };

package/dist/esm/auth/oauth2/oauth2_credential_exchanger.js

@@ -1,5 +1,7 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2026 Google LLC
@@ -19,7 +21,7 @@ import {
   getTokenEndpoint,
   parseAuthorizationCode
 } from "./oauth2_utils.js";
-class OAuth2CredentialExchanger {
+const _OAuth2CredentialExchanger = class _OAuth2CredentialExchanger {
   async exchange({
     authCredential,
     authScheme
@@ -49,7 +51,9 @@ class OAuth2CredentialExchanger {
       wasExchanged: false
     };
   }
-}
+};
+__name(_OAuth2CredentialExchanger, "OAuth2CredentialExchanger");
+let OAuth2CredentialExchanger = _OAuth2CredentialExchanger;
 function determineGrantType(authScheme) {
   var _a;
   if ("flows" in authScheme && authScheme.flows) {
@@ -64,6 +68,7 @@ function determineGrantType(authScheme) {
   }
   return void 0;
 }
+__name(determineGrantType, "determineGrantType");
 async function exchangeClientCredentials({
   authCredential,
   authScheme
@@ -103,6 +108,7 @@ async function exchangeClientCredentials({
     );
   }
 }
+__name(exchangeClientCredentials, "exchangeClientCredentials");
 async function exchangeAuthorizationCode({
   authCredential,
   authScheme
@@ -169,6 +175,7 @@ async function exchangeAuthorizationCode({
     );
   }
 }
+__name(exchangeAuthorizationCode, "exchangeAuthorizationCode");
 export {
   OAuth2CredentialExchanger,
   determineGrantType,

package/dist/esm/auth/oauth2/oauth2_credential_refresher.js

@@ -1,5 +1,7 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2026 Google LLC
@@ -11,7 +13,7 @@ import {
   getTokenEndpoint,
   isTokenExpired
 } from "./oauth2_utils.js";
-class OAuth2CredentialRefresher {
+const _OAuth2CredentialRefresher = class _OAuth2CredentialRefresher {
   /**
    * Check if the OAuth2 credential needs to be refreshed.
    *
@@ -79,7 +81,9 @@ class OAuth2CredentialRefresher {
       return authCredential;
     }
   }
-}
+};
+__name(_OAuth2CredentialRefresher, "OAuth2CredentialRefresher");
+let OAuth2CredentialRefresher = _OAuth2CredentialRefresher;
 export {
   OAuth2CredentialRefresher
 };

package/dist/esm/auth/oauth2/oauth2_discovery.js

@@ -1,5 +1,7 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2026 Google LLC
@@ -18,7 +20,7 @@ const ProtectedResourceMetadataSchema = z.object({
   resource: z.string(),
   authorization_servers: z.array(z.string()).default([])
 });
-class OAuth2DiscoveryManager {
+const _OAuth2DiscoveryManager = class _OAuth2DiscoveryManager {
   /**
    * Discovers the OAuth2 authorization server metadata.
    */
@@ -130,7 +132,9 @@ class OAuth2DiscoveryManager {
     }
     return void 0;
   }
-}
+};
+__name(_OAuth2DiscoveryManager, "OAuth2DiscoveryManager");
+let OAuth2DiscoveryManager = _OAuth2DiscoveryManager;
 function normaliseHostname(raw) {
   const stripped = raw.replace(/^\[|\]$/g, "");
   const m = stripped.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
@@ -143,6 +147,7 @@ function normaliseHostname(raw) {
   if (mDot) return mDot[1];
   return raw;
 }
+__name(normaliseHostname, "normaliseHostname");
 function validateDiscoveryUrl(urlStr) {
   try {
     const url = new URL(urlStr);
@@ -181,6 +186,7 @@ function validateDiscoveryUrl(urlStr) {
     return false;
   }
 }
+__name(validateDiscoveryUrl, "validateDiscoveryUrl");
 export {
   AuthorizationServerMetadataSchema,
   OAuth2DiscoveryManager,

package/dist/esm/auth/oauth2/oauth2_utils.js

@@ -1,5 +1,7 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2026 Google LLC
@@ -20,6 +22,7 @@ function getTokenEndpoint(authScheme) {
   }
   return void 0;
 }
+__name(getTokenEndpoint, "getTokenEndpoint");
 async function fetchOAuth2Tokens(endpoint, body) {
   if (!validateDiscoveryUrl(endpoint)) {
     throw new Error(
@@ -55,6 +58,7 @@ async function fetchOAuth2Tokens(endpoint, body) {
     throw e;
   }
 }
+__name(fetchOAuth2Tokens, "fetchOAuth2Tokens");
 function parseAuthorizationCode(uri) {
   try {
     const url = new URL(uri);
@@ -64,6 +68,7 @@ function parseAuthorizationCode(uri) {
     return void 0;
   }
 }
+__name(parseAuthorizationCode, "parseAuthorizationCode");
 function createOAuth2TokenRequestBody(params) {
   const body = new URLSearchParams();
   body.set("grant_type", params.grantType);
@@ -82,6 +87,7 @@ function createOAuth2TokenRequestBody(params) {
   }
   return body;
 }
+__name(createOAuth2TokenRequestBody, "createOAuth2TokenRequestBody");
 function isTokenExpired(token, leeway = 60) {
   if (typeof token.expiresAt !== "number") {
     return false;
@@ -89,6 +95,7 @@ function isTokenExpired(token, leeway = 60) {
   const expirationThreshold = token.expiresAt - leeway * 1e3;
   return expirationThreshold < Date.now();
 }
+__name(isTokenExpired, "isTokenExpired");
 export {
   createOAuth2TokenRequestBody,
   fetchOAuth2Tokens,

package/dist/esm/auth/refresher/base_credential_refresher.js

@@ -1,16 +1,20 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class CredentialRefresherError extends Error {
+const _CredentialRefresherError = class _CredentialRefresherError extends Error {
   constructor(message) {
     super(message);
     this.name = "CredentialRefresherError";
   }
-}
+};
+__name(_CredentialRefresherError, "CredentialRefresherError");
+let CredentialRefresherError = _CredentialRefresherError;
 export {
   CredentialRefresherError
 };

package/dist/esm/auth/refresher/credential_refresher_registry.js

@@ -1,12 +1,14 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
 import { AuthCredentialTypes } from "../auth_credential.js";
-class CredentialRefresherRegistry {
+const _CredentialRefresherRegistry = class _CredentialRefresherRegistry {
   constructor() {
     this.refreshers = {
       [AuthCredentialTypes.API_KEY]: void 0,
@@ -34,7 +36,9 @@ class CredentialRefresherRegistry {
   getRefresher(credentialType) {
     return this.refreshers[credentialType];
   }
-}
+};
+__name(_CredentialRefresherRegistry, "CredentialRefresherRegistry");
+let CredentialRefresherRegistry = _CredentialRefresherRegistry;
 export {
   CredentialRefresherRegistry
 };

package/dist/esm/code_executors/agent_engine_sandbox_code_executor.js

@@ -2,6 +2,7 @@ import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __decorateClass = (decorators, target, key, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
@@ -40,6 +41,7 @@ function mapLanguage(lang) {
       throw new Error(`Unsupported language for Agent Engine Sandbox: ${lang}`);
   }
 }
+__name(mapLanguage, "mapLanguage");
 let AgentEngineSandboxCodeExecutor = class extends BaseCodeExecutor {
   constructor(options = {}) {
     super();
@@ -273,6 +275,7 @@ let AgentEngineSandboxCodeExecutor = class extends BaseCodeExecutor {
     return sandboxName;
   }
 };
+__name(AgentEngineSandboxCodeExecutor, "AgentEngineSandboxCodeExecutor");
 AgentEngineSandboxCodeExecutor = __decorateClass([
   experimental
 ], AgentEngineSandboxCodeExecutor);

package/dist/esm/code_executors/base_code_executor.js

@@ -1,5 +1,7 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2025 Google LLC
@@ -12,8 +14,9 @@ const BASE_CODE_EXECUTOR_SIGNATURE_SYMBOL = Symbol.for(
 function isBaseCodeExecutor(obj) {
   return typeof obj === "object" && obj !== null && BASE_CODE_EXECUTOR_SIGNATURE_SYMBOL in obj && obj[BASE_CODE_EXECUTOR_SIGNATURE_SYMBOL] === true;
 }
+__name(isBaseCodeExecutor, "isBaseCodeExecutor");
 _a = BASE_CODE_EXECUTOR_SIGNATURE_SYMBOL;
-class BaseCodeExecutor {
+const _BaseCodeExecutor = class _BaseCodeExecutor {
   constructor() {
     /** A unique symbol to identify BaseCodeExecutor class. */
     this[_a] = true;
@@ -56,7 +59,9 @@ class BaseCodeExecutor {
      */
     this.executionResultDelimiters = ["```tool_output\n", "\n```"];
   }
-}
+};
+__name(_BaseCodeExecutor, "BaseCodeExecutor");
+let BaseCodeExecutor = _BaseCodeExecutor;
 export {
   BaseCodeExecutor,
   isBaseCodeExecutor

package/dist/esm/code_executors/built_in_code_executor.js

@@ -1,5 +1,7 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2025 Google LLC
@@ -14,7 +16,8 @@ const BUILT_IN_CODE_EXECUTOR_SIGNATURE_SYMBOL = Symbol.for(
 function isBuiltInCodeExecutor(obj) {
   return typeof obj === "object" && obj !== null && BUILT_IN_CODE_EXECUTOR_SIGNATURE_SYMBOL in obj && obj[BUILT_IN_CODE_EXECUTOR_SIGNATURE_SYMBOL] === true;
 }
-class BuiltInCodeExecutor extends (_b = BaseCodeExecutor, _a = BUILT_IN_CODE_EXECUTOR_SIGNATURE_SYMBOL, _b) {
+__name(isBuiltInCodeExecutor, "isBuiltInCodeExecutor");
+const _BuiltInCodeExecutor = class _BuiltInCodeExecutor extends (_b = BaseCodeExecutor, _a = BUILT_IN_CODE_EXECUTOR_SIGNATURE_SYMBOL, _b) {
   constructor() {
     super(...arguments);
     /** A unique symbol to identify BuiltInCodeExecutor class. */
@@ -38,7 +41,9 @@ class BuiltInCodeExecutor extends (_b = BaseCodeExecutor, _a = BUILT_IN_CODE_EXE
       `Gemini code execution tool is not supported for model ${llmRequest.model}`
     );
   }
-}
+};
+__name(_BuiltInCodeExecutor, "BuiltInCodeExecutor");
+let BuiltInCodeExecutor = _BuiltInCodeExecutor;
 export {
   BuiltInCodeExecutor,
   isBuiltInCodeExecutor

package/dist/esm/code_executors/code_execution_utils.js

@@ -1,5 +1,7 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2025 Google LLC
@@ -26,6 +28,7 @@ var CodeExecutionLanguage = /* @__PURE__ */ ((CodeExecutionLanguage2) => {
 function getEncodedFileContent(data) {
   return isBase64Encoded(data) ? data : base64Encode(data);
 }
+__name(getEncodedFileContent, "getEncodedFileContent");
 function extractCodeAndTruncateContent(content, codeBlockDelimiters) {
   var _a;
   if (!((_a = content.parts) == null ? void 0 : _a.length)) {
@@ -62,6 +65,7 @@ function extractCodeAndTruncateContent(content, codeBlockDelimiters) {
   content.parts.push(buildExecutableCodePart(codeStr));
   return codeStr;
 }
+__name(extractCodeAndTruncateContent, "extractCodeAndTruncateContent");
 function buildExecutableCodePart(code) {
   return {
     text: code,
@@ -71,6 +75,7 @@ function buildExecutableCodePart(code) {
     }
   };
 }
+__name(buildExecutableCodePart, "buildExecutableCodePart");
 function buildCodeExecutionResultPart(codeExecutionResult) {
   if (codeExecutionResult.stderr) {
     return {
@@ -99,6 +104,7 @@ ${codeExecutionResult.stdout}
     }
   };
 }
+__name(buildCodeExecutionResultPart, "buildCodeExecutionResultPart");
 function convertCodeExecutionParts(content, codeBlockDelimiter, executionResultDelimiters) {
   var _a;
   if (!((_a = content.parts) == null ? void 0 : _a.length)) {
@@ -116,6 +122,7 @@ function convertCodeExecutionParts(content, codeBlockDelimiter, executionResultD
     content.role = "user";
   }
 }
+__name(convertCodeExecutionParts, "convertCodeExecutionParts");
 export {
   CodeExecutionLanguage,
   FileContentEncoding,

package/dist/esm/code_executors/code_executor_context.js

@@ -1,5 +1,7 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2025 Google LLC
@@ -12,7 +14,7 @@ const PROCESSED_FILE_NAMES_KEY = "processed_input_files";
 const INPUT_FILE_KEY = "_code_executor_input_files";
 const ERROR_COUNT_KEY = "_code_executor_error_counts";
 const CODE_EXECUTION_RESULTS_KEY = "_code_execution_results";
-class CodeExecutorContext {
+const _CodeExecutorContext = class _CodeExecutorContext {
   constructor(sessionState) {
     this.sessionState = sessionState;
     var _a;
@@ -164,7 +166,9 @@ class CodeExecutorContext {
   getCodeExecutionContext() {
     return this.sessionState.get(CONTEXT_KEY) || {};
   }
-}
+};
+__name(_CodeExecutorContext, "CodeExecutorContext");
+let CodeExecutorContext = _CodeExecutorContext;
 export {
   CodeExecutorContext
 };

package/dist/esm/code_executors/unsafe_local_code_executor.js

@@ -1,11 +1,13 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-import { spawn } from "child_process";
+import { spawn } from "node:child_process";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -17,18 +19,28 @@ import {
   CodeExecutionLanguage
 } from "./code_execution_utils.js";
 const IS_WINDOWS = os.platform() === "win32";
+const POWERSHELL_BASE_ARGS = [
+  "-NoLogo",
+  "-NoProfile",
+  "-ExecutionPolicy",
+  "Bypass",
+  "-File"
+];
+const CMD_BASE_ARGS = ["/D", "/c"];
+function isPowerShellCommand(commandPath) {
+  return /^(powershell|pwsh)(\.exe)?$/i.test(path.win32.basename(commandPath));
+}
+__name(isPowerShellCommand, "isPowerShellCommand");
 async function createTempScriptFile(code, language, shellCommandPath) {
-  const tempDir = path.join(
-    os.tmpdir(),
-    "adk_js_unsafe_code_executor",
-    Date.now().toString() + "_" + Math.random().toString(36).slice(2)
+  const tempDir = await fs.mkdtemp(
+    path.join(os.tmpdir(), "adk_js_unsafe_code_executor_")
   );
-  await fs.mkdir(tempDir, { recursive: true });
   const ext = getExtensionForLanguage(language, shellCommandPath) || ".js";
   const filePath = path.join(tempDir, `script${ext}`);
   await fs.writeFile(filePath, code);
   return { filePath, tempDir };
 }
+__name(createTempScriptFile, "createTempScriptFile");
 function getExtensionForLanguage(language, shellCommandPath) {
   if (language === CodeExecutionLanguage.JAVASCRIPT) {
     return ".js";
@@ -43,6 +55,9 @@ function getExtensionForLanguage(language, shellCommandPath) {
     return ".bat";
   }
   if (language === CodeExecutionLanguage.SHELL) {
+    if (shellCommandPath && isPowerShellCommand(shellCommandPath)) {
+      return ".ps1";
+    }
     if (IS_WINDOWS) {
       if (shellCommandPath && shellCommandPath.toLowerCase().includes("cmd")) {
         return ".bat";
@@ -53,7 +68,8 @@ function getExtensionForLanguage(language, shellCommandPath) {
   }
   return void 0;
 }
-class UnsafeLocalCodeExecutor extends BaseCodeExecutor {
+__name(getExtensionForLanguage, "getExtensionForLanguage");
+const _UnsafeLocalCodeExecutor = class _UnsafeLocalCodeExecutor extends BaseCodeExecutor {
   constructor(options = {}) {
     var _a, _b, _c, _d;
     super();
@@ -101,17 +117,17 @@ class UnsafeLocalCodeExecutor extends BaseCodeExecutor {
         command = this.pythonCommandPath;
       } else if (language === CodeExecutionLanguage.SHELL) {
         command = this.shellCommandPath;
-        if (this.shellCommandPath.toLowerCase().includes("powershell")) {
-          args = ["-NoLogo", "-ExecutionPolicy", "Bypass", "-File", filePath];
+        if (isPowerShellCommand(this.shellCommandPath)) {
+          args = [...POWERSHELL_BASE_ARGS, filePath];
         } else if (this.shellCommandPath.toLowerCase().includes("cmd")) {
-          args = ["/c", filePath];
+          args = [...CMD_BASE_ARGS, filePath];
         }
       } else if (language === CodeExecutionLanguage.POWERSHELL) {
         command = IS_WINDOWS ? "powershell" : "pwsh";
-        args = ["-NoLogo", "-ExecutionPolicy", "Bypass", "-File", filePath];
+        args = [...POWERSHELL_BASE_ARGS, filePath];
       } else if (language === CodeExecutionLanguage.WINDOWS_CMD) {
         command = "cmd.exe";
-        args = ["/c", filePath];
+        args = [...CMD_BASE_ARGS, filePath];
       }
       if (params.codeExecutionInput.args) {
         if (Array.isArray(params.codeExecutionInput.args)) {
@@ -199,7 +215,9 @@ Code execution timed out after ${this.timeoutSeconds} seconds.`;
       }
     }
   }
-}
+};
+__name(_UnsafeLocalCodeExecutor, "UnsafeLocalCodeExecutor");
+let UnsafeLocalCodeExecutor = _UnsafeLocalCodeExecutor;
 export {
   UnsafeLocalCodeExecutor
 };