@google/adk 1.6.0 → 2.0.0

package/dist/types/plugins/base_plugin.d.ts

@@ -11,6 +11,8 @@ import { Event } from '../events/event.js';
 import { LlmRequest } from '../models/llm_request.js';
 import { LlmResponse } from '../models/llm_response.js';
 import { BaseTool } from '../tools/base_tool.js';
+import type { BaseNode } from '../workflow/base_node.js';
+import type { NodeContext } from '../workflow/node_context.js';
 /**
  * Trigger for context compaction.
  */
@@ -204,6 +206,39 @@ export declare abstract class BasePlugin {
         agent: BaseAgent;
         callbackContext: Context;
     }): Promise<Content | undefined>;
+    /**
+     * Callback executed before a workflow node runs.
+     *
+     * @param params.node The node that is about to run.
+     * @param params.nodeContext The node's execution context.
+     * @param params.input The input the node is about to receive.
+     * @returns An optional value. If anything other than `undefined` is returned,
+     *     the node's body is skipped and the returned value becomes its output,
+     *     which is how a plugin implements a node-level cache or a stub.
+     *     Returning `undefined` lets the node run normally.
+     */
+    beforeNodeCallback(params: {
+        node: BaseNode;
+        nodeContext: NodeContext;
+        input: unknown;
+    }): Promise<unknown>;
+    /**
+     * Callback executed after a workflow node has run.
+     *
+     * Not called for a node whose body was skipped by `beforeNodeCallback`, and
+     * not called when the node throws.
+     *
+     * @param params.node The node that has just run.
+     * @param params.nodeContext The node's execution context.
+     * @param params.output The output the node produced.
+     * @returns An optional value replacing the node's output. Returning
+     *     `undefined` keeps the original.
+     */
+    afterNodeCallback(params: {
+        node: BaseNode;
+        nodeContext: NodeContext;
+        output: unknown;
+    }): Promise<unknown>;
     /**
      * Callback executed before a request is sent to the model.
      *

package/dist/types/plugins/plugin_manager.d.ts

@@ -11,6 +11,8 @@ import { Event } from '../events/event.js';
 import { LlmRequest } from '../models/llm_request.js';
 import { LlmResponse } from '../models/llm_response.js';
 import { BaseTool } from '../tools/base_tool.js';
+import type { BaseNode } from '../workflow/base_node.js';
+import type { NodeContext } from '../workflow/node_context.js';
 import { BasePlugin, ContextCompactionTrigger } from './base_plugin.js';
 /**
  * Manages the registration and execution of plugins.
@@ -28,6 +30,8 @@ import { BasePlugin, ContextCompactionTrigger } from './base_plugin.js';
  */
 export declare class PluginManager {
     private readonly plugins;
+    /** Whether any plugin is registered. */
+    get hasPlugins(): boolean;
     /**
      * Initializes the plugin service.
      *
@@ -103,6 +107,22 @@ export declare class PluginManager {
         agent: BaseAgent;
         callbackContext: Context;
     }): Promise<Content | undefined>;
+    /**
+     * Runs the `beforeNodeCallback` for all plugins.
+     */
+    runBeforeNodeCallback({ node, nodeContext, input, }: {
+        node: BaseNode;
+        nodeContext: NodeContext;
+        input: unknown;
+    }): Promise<unknown>;
+    /**
+     * Runs the `afterNodeCallback` for all plugins.
+     */
+    runAfterNodeCallback({ node, nodeContext, output, }: {
+        node: BaseNode;
+        nodeContext: NodeContext;
+        output: unknown;
+    }): Promise<unknown>;
     /**
      * Runs the `beforeToolSelection` for all plugins.
      */

package/dist/types/plugins/security_plugin.d.ts

@@ -5,10 +5,11 @@
  */
 import { FunctionCall } from '@google/genai';
 import { Context } from '../agents/context.js';
+import { REQUEST_CONFIRMATION_FUNCTION_CALL_NAME } from '../agents/functions.js';
 import { Event } from '../events/event.js';
 import { BasePlugin } from '../plugins/base_plugin.js';
 import { BaseTool } from '../tools/base_tool.js';
-export declare const REQUEST_CONFIRMATION_FUNCTION_CALL_NAME = "adk_request_confirmation";
+export { REQUEST_CONFIRMATION_FUNCTION_CALL_NAME };
 /**
  * The outcome of a policy check.
  */
@@ -46,9 +47,10 @@ export declare class InMemoryPolicyEngine implements BasePolicyEngine {
     /**
      * Always returns {@link PolicyOutcome.ALLOW} for every tool call.
      *
+     * @param _context - The tool and its arguments; ignored.
      * @returns A promise resolving to an ALLOW result.
      */
-    evaluate(): Promise<PolicyCheckResult>;
+    evaluate(_context: ToolCallPolicyContext): Promise<PolicyCheckResult>;
 }
 /**
  *  Security Plugin for running Orcas agents.

package/dist/types/runner/in_memory_runner.d.ts

@@ -3,10 +3,10 @@
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-import { BaseAgent } from '../agents/base_agent.js';
 import { App } from '../apps/app.js';
 import { ResumabilityConfig } from '../apps/resumability_config.js';
 import { BasePlugin } from '../plugins/base_plugin.js';
+import { RunnableRoot } from '../workflow/run_node_as_invocation.js';
 import { Runner } from './runner.js';
 /**
  * A {@link Runner} pre-configured with in-memory services.
@@ -40,7 +40,7 @@ export declare class InMemoryRunner extends Runner {
      */
     constructor(params: {
         app?: App;
-        agent?: BaseAgent;
+        agent?: RunnableRoot;
         appName?: string;
         plugins?: BasePlugin[];
         resumabilityConfig?: ResumabilityConfig;

package/dist/types/runner/runner.d.ts

@@ -5,6 +5,7 @@
  */
 import { Content } from '@google/genai';
 import { BaseAgent } from '../agents/base_agent.js';
+import { LiveRequestQueue } from '../agents/live_request_queue.js';
 import { RunConfig } from '../agents/run_config.js';
 import { App } from '../apps/app.js';
 import { ResumabilityConfig } from '../apps/resumability_config.js';
@@ -16,6 +17,8 @@ import { BasePlugin } from '../plugins/base_plugin.js';
 import { PluginManager } from '../plugins/plugin_manager.js';
 import { BaseSessionService } from '../sessions/base_session_service.js';
 import { Session } from '../sessions/session.js';
+import type { RunnableNode } from '../workflow/graph.js';
+import { RunnableRoot } from '../workflow/run_node_as_invocation.js';
 /**
  * The configuration parameters for the Runner.
  */
@@ -29,9 +32,15 @@ export interface RunnerConfig {
      */
     appName?: string;
     /**
-     * The agent to run. Required if `app` is not provided.
+     * The agent or workflow to run. Required if `app` is not provided.
+     *
+     * A bare node — a `Workflow`, most usefully — is accepted as the root and
+     * driven directly, so a graph does not have to be wrapped by hand to be run.
+     * The accepted set is the one an edge takes: any other node-like value
+     * becomes the single node of a one-node workflow. Mirrors adk-python, whose
+     * `Runner.agent` is typed `BaseNode`.
      */
-    agent?: BaseAgent;
+    agent?: RunnableNode;
     /**
      * An optional list of plugins to apply globally across all agents.
      */
@@ -96,7 +105,11 @@ export declare function isRunner(obj: unknown): obj is Runner;
 export declare class Runner {
     readonly [RUNNER_SIGNATURE_SYMBOL] = true;
     readonly appName: string;
-    readonly agent: BaseAgent;
+    /**
+     * The root being run: an agent, or a bare node (a `Workflow`) that the
+     * runner drives directly.
+     */
+    readonly agent: RunnableRoot;
     readonly pluginManager: PluginManager;
     readonly artifactService?: BaseArtifactService;
     readonly sessionService: BaseSessionService;
@@ -145,6 +158,19 @@ export declare class Runner {
         abortSignal?: AbortSignal;
         customMetadata?: Record<string, unknown>;
     }): AsyncGenerator<Event, void, undefined>;
+    /**
+     * Runs whatever this runner was given as its root.
+     *
+     * An agent is run through `runAsync`, as always. A bare node — a `Workflow`
+     * handed to the runner directly — is driven by {@link runNodeAsInvocation}.
+     *
+     * Only the execution differs. Everything around it (the run callbacks, event
+     * persistence, cancellation) is shared, so the node path cannot drift from
+     * the agent path on the things that are not about execution. adk-python has
+     * two separate loops here and a TODO noting its node one lacks tracing and
+     * plugins; there is nothing to lack if there is only one loop.
+     */
+    private runRoot;
     /**
      * Saves artifacts from the message parts and replaces the inline data with
      * a file name placeholder and optional file reference.
@@ -171,6 +197,36 @@ export declare class Runner {
      * @returns True if the agent can transfer, False otherwise.
      */
     private isRoutableLlmAgent;
+    /**
+     * Runs the agent in the live (bidirectional streaming) mode.
+     *
+     * Model media events that carry raw inline bytes (audio, video, or image)
+     * are yielded but not appended to the session to avoid persisting large
+     * blobs; events with `fileData` references and most other live events
+     * (transcriptions, tool calls, usage) are persisted as in `runAsync`.
+     *
+     * This feature is **experimental** and its API may change.
+     *
+     * @param params.userId The user ID of the session.
+     * @param params.sessionId The session ID of the session.
+     * @param params.liveRequestQueue The queue used to feed the live model.
+     * @param params.runConfig The run config for the agent.
+     * @param params.abortSignal Optional signal to abort the live run.
+     * @param params.liveSessionResumptionHandle Optional session resumption
+     *     handle observed from a prior `runLive` cycle on the same conversation.
+     *     When set, the agent's live flow opens the connection with
+     *     `liveConnectConfig.sessionResumption.handle` so the server restores its
+     *     state instead of relying on client-side history replay.
+     * @yields The events generated by the agent.
+     */
+    runLive(params: {
+        userId: string;
+        sessionId: string;
+        liveRequestQueue: LiveRequestQueue;
+        runConfig?: RunConfig;
+        abortSignal?: AbortSignal;
+        liveSessionResumptionHandle?: string;
+    }): AsyncGenerator<Event, void, undefined>;
 }
 /**
  * Determines the next agent to run to continue the session. This is primarily

package/dist/types/sessions/base_session_service.d.ts

@@ -40,8 +40,8 @@ export interface GetSessionRequest extends CompositeSessionKey {
 export interface ListSessionsRequest {
     /** The name of the application. */
     appName: string;
-    /** The ID of the user. */
-    userId: string;
+    /** The ID of the user. Sessions of every user are listed if omitted. */
+    userId?: string;
     /** Maximum number of sessions to return. */
     limit?: number;
     /** Zero-based index of the first session to return. Ignored if `page` is set. */

package/dist/types/sessions/state.d.ts

@@ -3,6 +3,13 @@
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+import { SchemaLike } from '../utils/schema.js';
+/** Raised when a state mutation violates the declared state schema. */
+export declare class StateSchemaError extends TypeError {
+    constructor(message: string);
+}
+/** Type guard for {@link StateSchemaError}. */
+export declare function isStateSchemaError(e: unknown): e is StateSchemaError;
 /**
  * A state mapping that maintains the current value and the pending-commit
  * delta.
@@ -12,6 +19,11 @@ export declare class State {
     private value;
     /** The delta change to the current value that hasn't been committed. */
     private delta;
+    /**
+     * Declares the keys this state may hold and their types. When set, every
+     * mutation is checked against it; prefixed keys are exempt.
+     */
+    readonly schema?: SchemaLike | undefined;
     static readonly APP_PREFIX = "app:";
     static readonly USER_PREFIX = "user:";
     static readonly TEMP_PREFIX = "temp:";
@@ -19,7 +31,28 @@ export declare class State {
     /** The current value of the state. */
     value?: Record<string, unknown>, 
     /** The delta change to the current value that hasn't been committed. */
-    delta?: Record<string, unknown>);
+    delta?: Record<string, unknown>, 
+    /**
+     * Declares the keys this state may hold and their types. When set, every
+     * mutation is checked against it; prefixed keys are exempt.
+     */
+    schema?: SchemaLike | undefined);
+    /**
+     * Checks a whole delta against {@link schema}, for writes that reach the
+     * session without passing through this object — a node emitting an event
+     * that carries its own `stateDelta`.
+     */
+    validateDelta(delta: Record<string, unknown>): void;
+    /**
+     * Checks one key/value pair against {@link schema}, throwing
+     * {@link StateSchemaError} when the key is undeclared or its value does not
+     * match the declared type.
+     *
+     * Prefixed keys (`app:`, `user:`, `temp:`, or any other namespace) belong to
+     * a scope wider than this state and are never validated — the same carve-out
+     * adk-python makes.
+     */
+    private validate;
     /**
      * Returns the value of the state dict for the given key.
      *

package/dist/types/sessions/state_write_order.d.ts

@@ -0,0 +1,39 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Records a direct write of `key` into `state`, and — when the same write is
+ * being recorded in `delta` for later commit — stamps it there too, so the
+ * commit can tell whether it has since been superseded.
+ */
+export declare function recordStateWrite(state: object, delta: object | undefined, key: string): void;
+/**
+ * Copies the stamp `delta` holds for `key` onto `state`, for a writer that
+ * mirrors one logical write into more than one state object (a workflow node
+ * writes through to `session.state` as well as to its own view). Both objects
+ * then carry the same stamp, so neither can roll the other back.
+ */
+export declare function adoptDeltaStamp(state: object, delta: object, key: string): void;
+/**
+ * Whether committing `key` from `delta` into `state` should go ahead, recording
+ * the write when it should.
+ *
+ * Returns false only when the delta entry is stamped and a newer write to that
+ * key has already landed — the rollback this module exists to prevent.
+ */
+export declare function shouldApplyDeltaWrite(state: object, delta: object, key: string): boolean;
+/**
+ * Carries the stamp for one key from one delta object to another.
+ *
+ * A delta is copied several times between the write and the commit — a node
+ * drains its pending entries into a fresh map, `createEventActions` copies that
+ * into the event, `trimTempDeltaState` rebuilds it again — and each copy is a
+ * new object, so the stamps have to be carried with it. An entry that arrives
+ * at the commit unstamped is applied unconditionally, which is the old
+ * behaviour, so a missed hop degrades rather than breaks.
+ */
+export declare function carryDeltaStamp(from: object, to: object, key: string): void;
+/** {@link carryDeltaStamp} for every key `from` carries a stamp for. */
+export declare function carryDeltaStamps(from: object, to: object): void;

package/dist/types/telemetry/tracing.d.ts

@@ -44,6 +44,21 @@ export interface TraceAgentInvocationParams {
  * `server.*` attributes are not set pending confirmation from aabmass.
  */
 export declare function traceAgentInvocation({ agent, invocationContext, }: TraceAgentInvocationParams): void;
+export interface TraceWorkflowInvocationParams {
+    workflowName: string;
+    nodePath: string;
+    sessionId: string;
+}
+export declare function traceWorkflowInvocation({ workflowName, nodePath, sessionId, }: TraceWorkflowInvocationParams): void;
+export type NodeExecutionStatus = 'completed' | 'waiting' | 'failed';
+export interface TraceNodeExecutionParams {
+    nodePath: string;
+    runId: string;
+    attempt: number;
+    status: NodeExecutionStatus;
+    interruptCount: number;
+}
+export declare function traceNodeExecution({ nodePath, runId, attempt, status, interruptCount, }: TraceNodeExecutionParams): void;
 export interface TraceToolCallParams {
     tool: BaseTool;
     args: Record<string, unknown>;

package/dist/types/tools/base_tool.d.ts

@@ -80,6 +80,21 @@ export declare abstract class BaseTool {
      * @return A promise that resolves to the tool response.
      */
     abstract runAsync(request: RunAsyncToolRequest): Promise<unknown>;
+    /**
+     * Whether this tool needs a human to approve `args` before it runs.
+     *
+     * The gate itself lives in the tool that owns it (see `FunctionTool`), but
+     * the resume path has to ask the same question a turn later, to check that an
+     * approval it is about to honour belongs to a tool that gates at all. A tool
+     * that never gates returns false here, which is the safe default: an approval
+     * naming it is meaningless and gets rejected rather than executed. Mirrors
+     * Python's `BaseTool.check_require_confirmation`.
+     *
+     * @param _args The arguments the tool would run with.
+     * @param _toolContext The context of the call, when there is one.
+     * @return Whether the call requires confirmation.
+     */
+    checkRequireConfirmation(_args: Record<string, unknown>, _toolContext?: Context): Promise<boolean>;
     /**
      * Processes the outgoing LLM request for this tool.
      *

package/dist/types/tools/finish_task_tool.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { FunctionDeclaration, Schema } from '@google/genai';
+import { BaseTool, RunAsyncToolRequest, ToolProcessLlmRequest } from './base_tool.js';
+/** The name of the finish_task tool. */
+export declare const FINISH_TASK_TOOL_NAME = "finish_task";
+/**
+ * The result returned by {@link FinishTaskTool.runAsync} when validation passes.
+ * The task-mode wrapper uses this to distinguish a successful completion from a
+ * validation-error retry signal.
+ */
+export declare const FINISH_TASK_SUCCESS_RESULT = "Task completed.";
+/**
+ * Tool for signaling that a task-mode {@link LlmAgent} has completed its task.
+ *
+ * The tool's parameters mirror the agent's `outputSchema` (or a default single
+ * `result` string). The task-mode wrapper sniffs the `finish_task` function call
+ * and, on a successful function response, promotes the call's arguments to the
+ * node's output.
+ *
+ * Ported from `google/adk-python`
+ * `agents/llm/task/_finish_task_tool.py::FinishTaskTool`.
+ */
+export declare class FinishTaskTool extends BaseTool {
+    /** The schema describing the expected task output. */
+    private readonly outputSchema;
+    /**
+     * When the output schema is a non-object (primitive/array), the value is
+     * wrapped under this key (the GenAI API requires object-typed parameters).
+     * `undefined` for object schemas (the value lives at the top level of args).
+     */
+    readonly wrapperKey?: string;
+    constructor(outputSchema?: Schema);
+    _getDeclaration(): FunctionDeclaration;
+    processLlmRequest(request: ToolProcessLlmRequest): Promise<void>;
+    /**
+     * Extracts the task output from a `finish_task` call's arguments, applying the
+     * wrapper-key unwrapping when the schema is a non-object.
+     */
+    extractOutput(args: Record<string, unknown>): unknown;
+    runAsync({ args }: RunAsyncToolRequest): Promise<unknown>;
+    /** Returns any `required` keys the schema declares that are absent. */
+    private missingRequiredKeys;
+}

package/dist/types/tools/function_tool.d.ts

@@ -20,7 +20,13 @@ export type ToolExecuteArgument<TParameters extends ToolInputParameters> = TPara
 /**
  * The signature of the user-provided function executed by a {@link FunctionTool}.
  */
-export type ToolExecuteFunction<TParameters extends ToolInputParameters> = (input: ToolExecuteArgument<TParameters>, tool_context?: Context) => Promise<unknown> | unknown;
+export type ToolExecuteFunction<TParameters extends ToolInputParameters> = (input: ToolExecuteArgument<TParameters>, toolContext?: Context) => Promise<unknown> | unknown;
+/**
+ * Whether a {@link FunctionTool} requires user confirmation before it runs: a
+ * boolean, or a predicate over the (validated) call arguments and tool context.
+ * See {@link ToolOptions.requireConfirmation}.
+ */
+export type RequireConfirmation<TParameters extends ToolInputParameters> = boolean | ((input: ToolExecuteArgument<TParameters>, toolContext?: Context) => boolean | Promise<boolean>);
 /**
  * The configuration options for creating a function-based tool.
  * The `name`, `description` and `parameters` fields are used to generate the
@@ -35,6 +41,24 @@ export type ToolOptions<TParameters extends ToolInputParameters> = {
     parameters?: TParameters;
     execute: ToolExecuteFunction<TParameters>;
     isLongRunning?: boolean;
+    /**
+     * Whether this tool requires user confirmation before it runs. A boolean, or
+     * a predicate over the (validated) call arguments and tool context returning
+     * a boolean.
+     *
+     * The HITL gate is enforced when the tool is invoked through an `LlmAgent`
+     * turn: `agents/functions.ts` surfaces an `adk_request_confirmation`
+     * interrupt from the tool's `requestedToolConfirmations`, and the tool only
+     * executes once the user approves (via the
+     * `RequestConfirmationLlmRequestProcessor`).
+     *
+     * NOTE: a workflow `ToolNode` does not yet route through that path, so a
+     * `requireConfirmation` tool used directly as a node does not pause — it
+     * returns the "requires confirmation" error as its node output. Approval for
+     * workflow nodes is not wired up. Mirrors Python's
+     * `FunctionTool(require_confirmation=...)`.
+     */
+    requireConfirmation?: RequireConfirmation<TParameters>;
 };
 /**
  * A unique symbol to identify ADK agent classes.
@@ -60,6 +84,7 @@ export declare class FunctionTool<TParameters extends ToolInputParameters = unde
     readonly [FUNCTION_TOOL_SIGNATURE_SYMBOL] = true;
     private readonly execute;
     private readonly parameters?;
+    private readonly requireConfirmation;
     /**
      * The constructor acts as the user-friendly factory.
      * @param options The configuration for the tool.
@@ -78,5 +103,25 @@ export declare class FunctionTool<TParameters extends ToolInputParameters = unde
      * @returns A promise resolving to the function's return value.
      */
     runAsync(req: RunAsyncToolRequest): Promise<unknown>;
+    /**
+     * Whether this call is gated on human approval — the static flag, or the
+     * predicate evaluated against the validated arguments.
+     *
+     * @param args The arguments the tool would run with.
+     * @param toolContext The context of the call, when there is one.
+     * @return Whether the call requires confirmation.
+     */
+    checkRequireConfirmation(args: Record<string, unknown>, toolContext?: Context): Promise<boolean>;
+    /** Parses `args` against the parameter schema, when one is declared. */
+    private validateArgs;
+    /** Resolves `requireConfirmation`, which may be a flag or a predicate. */
+    private evaluateRequireConfirmation;
+    /**
+     * Evaluates the confirmation gate. Returns `undefined` if the tool may
+     * proceed; otherwise returns the function response payload to surface instead
+     * of running (a request-for-confirmation on the first pass, or a rejection
+     * once the user declined).
+     */
+    private checkConfirmation;
 }
 export {};

package/dist/types/tools/mcp/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * `@google/adk/tools/mcp` subpath: the MCP tools only, without the full ADK
+ * barrel. Also re-exported from `@google/adk`.
+ */
+export * from './load_mcp_resource_tool.js';
+export * from './mcp_session_manager.js';
+export * from './mcp_tool.js';
+export * from './mcp_toolset.js';

package/dist/types/tools/mcp/mcp_session_manager.d.ts

@@ -3,9 +3,9 @@
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import { StdioServerParameters } from '@modelcontextprotocol/sdk/client/stdio.js';
-import { StreamableHTTPClientTransportOptions } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import type { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import type { StdioServerParameters } from '@modelcontextprotocol/sdk/client/stdio.js';
+import type { StreamableHTTPClientTransportOptions } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 /**
  * Defines the parameters for establishing a connection to an MCP server using
  * standard input/output (stdio). This is typically used for running MCP servers

package/dist/types/tools/mcp/mcp_tool.d.ts

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { FunctionDeclaration } from '@google/genai';
-import { Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { Tool } from '@modelcontextprotocol/sdk/types.js';
 import { BaseTool, RunAsyncToolRequest } from '../base_tool.js';
 import { MCPSessionManager } from './mcp_session_manager.js';
 /**

package/dist/types/tools/mcp/mcp_toolset.d.ts

@@ -3,7 +3,7 @@
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-import { BlobResourceContents, Resource, TextResourceContents } from '@modelcontextprotocol/sdk/types.js';
+import type { BlobResourceContents, Resource, TextResourceContents } from '@modelcontextprotocol/sdk/types.js';
 import { ReadonlyContext } from '../../agents/readonly_context.js';
 import { BaseTool } from '../base_tool.js';
 import { BaseToolset, ToolPredicate } from '../base_toolset.js';

package/dist/types/tools/request_input_tool.d.ts

@@ -8,8 +8,13 @@ import { LongRunningFunctionTool } from './long_running_tool.js';
 /**
  * A long-running tool that presents a custom message to the user and awaits
  * unstructured or structured input.
+ *
+ * `response_schema` is spelled the way a workflow's `RequestInput` spells it on
+ * the wire (`RESPONSE_SCHEMA_ARG` in `workflow/utils/hitl_utils`), so a client
+ * reads one key whichever way the pause was raised — the dev UI builds its
+ * reply form from it either way.
  */
 export declare const requestInputTool: LongRunningFunctionTool<z.ZodObject<{
     message: z.ZodString;
-    responseSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    response_schema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>>;

package/dist/types/tools/skill/skill_toolset.d.ts

@@ -17,8 +17,10 @@ export declare class SkillToolset extends BaseToolset {
     additionalTools: Array<BaseTool | BaseToolset>;
     codeExecutor?: BaseCodeExecutor;
     registry?: SkillRegistry;
+    private readonly scriptOutputDir?;
     private toolCache;
     private fetchedSkillCache;
+    private tempOutputDir?;
     constructor(skills: Record<string, Skill> | Skill[], options?: {
         codeExecutor?: BaseCodeExecutor;
         additionalTools?: Array<BaseTool | BaseToolset>;
@@ -32,10 +34,34 @@ export declare class SkillToolset extends BaseToolset {
          * confirmation.
          */
         allowInlineScripts?: boolean;
+        /**
+         * Directory that files produced by `run_skill_script` /
+         * `run_skill_inline_script` are written into. Output file names come from
+         * the executed script, so this must be a directory dedicated to
+         * throwaway script output — never the application's working directory or
+         * a source tree.
+         *
+         * Defaults to a private, randomly named directory created under the OS
+         * temp dir on first use. Nothing removes that directory: `close()` runs
+         * once per invocation on a toolset instance that concurrent invocations
+         * share (see `Runner`), so it cannot tell whose output is still in use.
+         * Set this to own the location and the lifetime of the output.
+         */
+        scriptOutputDir?: string;
     });
     getTools(context?: ReadonlyContext): Promise<BaseTool[]>;
     close(): Promise<void>;
     getSkill(name: string): Skill | undefined;
+    /**
+     * Resolves the directory that script output files are materialized into.
+     *
+     * Script output file names are attacker-influenced (a prompt-injected skill
+     * controls what its script writes), so they must never be resolved against
+     * the host application's working directory. When no `scriptOutputDir` was
+     * configured this hands back a private temp directory instead, created once
+     * and reused for the lifetime of the toolset.
+     */
+    getScriptOutputDir(): Promise<string>;
     getOrFetchSkill(name: string, invocationId?: string): Promise<Skill | undefined>;
     processLlmRequest(toolContext: Context, llmRequest: LlmRequest): Promise<void>;
     private resolveAdditionalTools;