agent-starter-pack 0.3.3__py3-none-any.whl → 0.21.0__py3-none-any.whl

{src → agent_starter_pack}/cli/main.py

@@ -13,11 +13,15 @@
 # limitations under the License.
 
 import importlib.metadata
+import sys
 
 import click
 from rich.console import Console
 
 from .commands.create import create
+from .commands.enhance import enhance
+from .commands.list import list_agents
+from .commands.register_gemini_enterprise import register_gemini_enterprise
 from .commands.setup_cicd import setup_cicd
 from .utils import display_update_message
 
@@ -46,13 +50,17 @@ def print_version(ctx: click.Context, param: click.Parameter, value: bool) -> No
     help="Show the version and exit.",
 )
 def cli() -> None:
-    # Check for updates at startup
-    display_update_message()
+    # Check for updates at startup (skip if --agent-garden, -ag, or --locked is used)
+    if not any(flag in sys.argv for flag in ("--agent-garden", "-ag", "--locked")):
+        display_update_message()
 
 
 # Register commands
 cli.add_command(create)
+cli.add_command(enhance)
+cli.add_command(register_gemini_enterprise)
 cli.add_command(setup_cicd)
+cli.add_command(list_agents, name="list")
 
 
 if __name__ == "__main__":

{src → agent_starter_pack}/cli/utils/cicd.py

@@ -89,11 +89,7 @@ def setup_repository_name(
 
 
 def create_github_connection(
-    project_id: str,
-    region: str,
-    connection_name: str,
-    repository_name: str,
-    repository_owner: str,
+    project_id: str, region: str, connection_name: str
 ) -> tuple[str, str]:
     """Create and verify GitHub connection using gcloud command.
 
@@ -101,52 +97,132 @@ def create_github_connection(
         project_id: GCP project ID
         region: GCP region
         connection_name: Name for the GitHub connection
-        repository_name: Name of repository to create
-        repository_owner: Owner of repository
 
     Returns:
         tuple[str, str]: The OAuth token secret ID and the app installation ID
     """
     console.print("\n🔗 Creating GitHub connection...")
 
-    # Create repository if details provided
+    # First, ensure required APIs are enabled
+    console.print("🔧 Ensuring required APIs are enabled...")
     try:
-        # Check if repo exists
-        result = run_command(
+        # Enable Cloud Build API
+        run_command(
             [
-                "gh",
-                "repo",
-                "view",
-                f"{repository_owner}/{repository_name}",
-                "--json",
-                "name",
+                "gcloud",
+                "services",
+                "enable",
+                "cloudbuild.googleapis.com",
+                "--project",
+                project_id,
             ],
             capture_output=True,
-            check=False,
+            check=False,  # Don't fail if already enabled
         )
+        console.print("✅ Cloud Build API enabled")
 
-        if result.returncode != 0:
-            # Repository doesn't exist, create it
-            console.print(
-                f"\n📦 Creating GitHub repository: {repository_owner}/{repository_name}"
-            )
-            run_command(
-                [
-                    "gh",
-                    "repo",
-                    "create",
-                    f"{repository_owner}/{repository_name}",
-                    "--private",
-                    "--description",
-                    "Repository created by Terraform",
-                ]
-            )
-            console.print("✅ GitHub repository created")
-        else:
-            console.print("✅ Using existing GitHub repository")
+        # Enable Secret Manager API
+        run_command(
+            [
+                "gcloud",
+                "services",
+                "enable",
+                "secretmanager.googleapis.com",
+                "--project",
+                project_id,
+            ],
+            capture_output=True,
+            check=False,  # Don't fail if already enabled
+        )
+        console.print("✅ Secret Manager API enabled")
+
+        # Wait for the APIs to fully initialize and create the service account
+        console.print(
+            "⏳ Waiting for Cloud Build service account to be created (this typically takes 5-10 seconds)..."
+        )
+        time.sleep(10)
     except subprocess.CalledProcessError as e:
-        console.print(f"❌ Failed to create/check repository: {e!s}", style="bold red")
-        raise
+        console.print(f"⚠️ Could not enable required APIs: {e}", style="yellow")
+
+    # Get the Cloud Build service account and grant permissions with retry logic
+    try:
+        project_number_result = run_command(
+            [
+                "gcloud",
+                "projects",
+                "describe",
+                project_id,
+                "--format=value(projectNumber)",
+            ],
+            capture_output=True,
+            check=True,
+        )
+        project_number = project_number_result.stdout.strip()
+        cloud_build_sa = (
+            f"service-{project_number}@gcp-sa-cloudbuild.iam.gserviceaccount.com"
+        )
+
+        console.print(
+            "🔧 Granting Secret Manager permissions to Cloud Build service account..."
+        )
+
+        # Try to grant permissions with retry logic
+        max_retries = 3
+        for attempt in range(max_retries):
+            try:
+                # Grant Secret Manager Admin role to Cloud Build service account
+                result = run_command(
+                    [
+                        "gcloud",
+                        "projects",
+                        "add-iam-policy-binding",
+                        project_id,
+                        f"--member=serviceAccount:{cloud_build_sa}",
+                        "--role=roles/secretmanager.admin",
+                        "--condition=None",
+                    ],
+                    capture_output=True,
+                    check=True,
+                )
+                console.print(
+                    "✅ Secret Manager permissions granted to Cloud Build service account"
+                )
+                break
+            except subprocess.CalledProcessError as e:
+                if "does not exist" in str(e.stderr) and attempt < max_retries - 1:
+                    console.print(
+                        f"⚠️ Service account not ready yet (attempt {attempt + 1}/{max_retries}). Retrying in 10 seconds...",
+                        style="yellow",
+                    )
+                    time.sleep(10)
+                elif attempt < max_retries - 1:
+                    console.print(
+                        f"⚠️ Failed to grant permissions (attempt {attempt + 1}/{max_retries}). Retrying in 5 seconds...",
+                        style="yellow",
+                    )
+                    time.sleep(5)
+                else:
+                    console.print(
+                        f"⚠️ Could not grant Secret Manager permissions after {max_retries} attempts",
+                        style="yellow",
+                    )
+                    console.print(
+                        "You may need to manually grant the permissions if the connection creation fails."
+                    )
+                    # Don't fail here, let the connection creation attempt proceed
+
+        # Wait for IAM changes to propagate
+        console.print(
+            "⏳ Waiting for IAM permissions to propagate (this typically takes 5-10 seconds)..."
+        )
+        time.sleep(10)  # Give IAM time to propagate before proceeding
+    except subprocess.CalledProcessError as e:
+        console.print(
+            f"⚠️ Could not setup Cloud Build service account: {e}", style="yellow"
+        )
+        console.print(
+            "You may need to manually grant the permissions if the connection creation fails."
+        )
 
     def try_create_connection() -> subprocess.CompletedProcess[str]:
         cmd = [
@@ -170,6 +246,7 @@ def create_github_connection(
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
             text=True,
+            encoding="utf-8",
         )
 
         # Send 'y' followed by enter key to handle both the API enablement prompt and any other prompts
@@ -257,7 +334,10 @@ def create_github_connection(
                 return secret_id, app_installation_id
             elif status == "PENDING_USER_OAUTH" or status == "PENDING_INSTALL_APP":
                 if attempt < max_retries - 1:  # Don't print waiting on last attempt
-                    console.print("⏳ Waiting for GitHub authorization...")
+                    console.print("⏳ Waiting for authorization...")
+                    print(
+                        f"Console: https://console.cloud.google.com/cloud-build/repositories?project={project_id}"
+                    )
                     # Extract and print the action URI for user authentication
                     try:
                         action_uri = (
@@ -270,9 +350,9 @@ def create_github_connection(
                                 "\n🔑 Authentication Required:", style="bold yellow"
                             )
                             console.print(
-                                f"Please visit [link={action_uri}]this page[/link] to authenticate Cloud Build with GitHub:"
+                                f"Please visit [link={action_uri}][bold blue]this page[/bold blue][/link] to authenticate Cloud Build with GitHub:"
                             )
-                            console.print(f"{action_uri}", style="bold blue")
+                            print(f"\n{action_uri}\n")
                             console.print(
                                 "(Copy and paste the link into your browser if clicking doesn't work)"
                             )
@@ -305,12 +385,12 @@ class ProjectConfig:
     cicd_project_id: str
     agent: str
     deployment_target: str
+    repository_name: str
+    repository_owner: str
     region: str = "us-central1"
     dev_project_id: str | None = None
     project_name: str | None = None
-    repository_name: str | None = None
-    repository_owner: str | None = None
-    repository_exists: bool | None = None
+    create_repository: bool | None = None
     host_connection_name: str | None = None
     github_pat: str | None = None
     github_app_installation_id: str | None = None
@@ -447,6 +527,7 @@ def run_command(
     capture_output: bool = False,
     shell: bool = False,
     input: str | None = None,
+    env_vars: dict[str, str] | None = None,
 ) -> subprocess.CompletedProcess:
     """Run a command and display it to the user"""
     # Format command for display
@@ -455,6 +536,14 @@ def run_command(
     if cwd:
         print(f"📂 In directory: {cwd}")
 
+    # Prepare environment variables
+    env = None
+    if env_vars:
+        import os
+
+        env = os.environ.copy()
+        env.update(env_vars)
+
     # Run the command
     result = subprocess.run(
         cmd,
@@ -464,6 +553,7 @@ def run_command(
         text=True,
         shell=shell,
         input=input,
+        env=env,
     )
 
     # Display output if captured
@@ -517,6 +607,7 @@ def handle_github_authentication() -> None:
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
                 text=True,
+                encoding="utf-8",
             )
             stdout, stderr = process.communicate(input=token + "\n")
 
@@ -607,7 +698,7 @@ class E2EDeployment:
                 project_dir / "deployment" / "terraform" / "dev" / "vars" / "env.tfvars"
             )
 
-            with open(tf_vars_path) as f:
+            with open(tf_vars_path, encoding="utf-8") as f:
                 content = f.read()
 
             # Replace dev project ID
@@ -622,7 +713,7 @@ class E2EDeployment:
                 project_dir / "deployment" / "terraform" / "vars" / "env.tfvars"
             )
 
-            with open(tf_vars_path) as f:
+            with open(tf_vars_path, encoding="utf-8") as f:
                 content = f.read()
 
             # Replace all project IDs
@@ -655,7 +746,7 @@ class E2EDeployment:
             )
 
         # Write updated content
-        with open(tf_vars_path, "w") as f:
+        with open(tf_vars_path, "w", encoding="utf-8") as f:
             f.write(content)
 
     def setup_terraform_state(self, project_dir: Path, env: Environment) -> None:
@@ -709,7 +800,7 @@ class E2EDeployment:
             state_prefix = "dev" if is_dev_dir else "prod"
 
             backend_file = tf_dir / "backend.tf"
-            with open(backend_file, "w") as f:
+            with open(backend_file, "w", encoding="utf-8") as f:
                 f.write(f'''terraform {{
   backend "gcs" {{
     bucket = "{bucket_name}"

agent_starter_pack/cli/utils/gcp.py

@@ -0,0 +1,263 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# ruff: noqa: E722
+import os
+import subprocess
+import time
+
+# Suppress gRPC verbose logging
+os.environ["GRPC_VERBOSITY"] = "NONE"
+
+import google.auth
+from google.api_core.client_options import ClientOptions
+from google.api_core.exceptions import PermissionDenied
+from google.api_core.gapic_v1.client_info import ClientInfo
+from google.cloud.aiplatform import initializer
+from google.cloud.aiplatform_v1beta1.services.prediction_service import (
+    PredictionServiceClient,
+)
+from google.cloud.aiplatform_v1beta1.types.prediction_service import (
+    CountTokensRequest,
+)
+from rich.console import Console
+from rich.prompt import Confirm
+
+from agent_starter_pack.cli.utils.version import PACKAGE_NAME, get_current_version
+
+console = Console()
+
+_AUTH_ERROR_MESSAGE = (
+    "Looks like you are not authenticated with Google Cloud.\n"
+    "Please run: `gcloud auth login --update-adc`\n"
+    "Then set your project: `gcloud config set project YOUR_PROJECT_ID`"
+)
+
+
+def enable_vertex_ai_api(
+    project_id: str, auto_approve: bool = False, context: str | None = None
+) -> bool:
+    """Enable Vertex AI API with user confirmation and propagation waiting."""
+    api_name = "aiplatform.googleapis.com"
+
+    # First test if API is already working with a direct connection
+    if _test_vertex_ai_connection(project_id, context=context):
+        return True
+
+    if not auto_approve:
+        console.print(
+            f"Vertex AI API is not enabled in project '{project_id}'.", style="yellow"
+        )
+        console.print(
+            "To continue, we need to enable the Vertex AI API.", style="yellow"
+        )
+
+        if not Confirm.ask(
+            "Do you want to enable the Vertex AI API now?", default=True
+        ):
+            return False
+
+    try:
+        console.print("Enabling Vertex AI API...")
+        subprocess.run(
+            [
+                "gcloud",
+                "services",
+                "enable",
+                api_name,
+                "--project",
+                project_id,
+            ],
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+        console.print("✓ Vertex AI API enabled successfully")
+
+        # Wait for API propagation
+        console.print("⏳ Waiting for API availability to propagate...")
+        max_wait_time = 180  # 3 minutes
+        check_interval = 10  # 10 seconds
+        start_time = time.time()
+
+        while time.time() - start_time < max_wait_time:
+            if _test_vertex_ai_connection(project_id, context=context):
+                console.print("✓ Vertex AI API is now available")
+                return True
+            time.sleep(check_interval)
+            console.print("⏳ Still waiting for API propagation...")
+
+        console.print(
+            "⚠️ API propagation took longer than expected, but continuing...",
+            style="yellow",
+        )
+        return True
+
+    except subprocess.CalledProcessError as e:
+        console.print(f"Failed to enable Vertex AI API: {e.stderr}", style="bold red")
+        return False
+
+
+def _test_vertex_ai_connection(
+    project_id: str, location: str = "us-central1", context: str | None = None
+) -> bool:
+    """Test Vertex AI connection without raising exceptions."""
+    try:
+        credentials, _ = google.auth.default()
+        client = PredictionServiceClient(
+            credentials=credentials,
+            client_options=ClientOptions(
+                api_endpoint=f"{location}-aiplatform.googleapis.com"
+            ),
+            client_info=get_client_info(context),
+            transport=initializer.global_config._api_transport,
+        )
+        request = get_dummy_request(project_id=project_id)
+        client.count_tokens(request=request)
+        return True
+    except Exception:
+        return False
+
+
+def get_user_agent(context: str | None = None) -> str:
+    """Returns a custom user agent string."""
+    version = get_current_version()
+    prefix = "ag" if context == "agent-garden" else ""
+    return f"{prefix}{version}-{PACKAGE_NAME}/{prefix}{version}-{PACKAGE_NAME}"
+
+
+def get_client_info(context: str | None = None) -> ClientInfo:
+    """Returns ClientInfo with custom user agent."""
+    user_agent = get_user_agent(context)
+    return ClientInfo(client_library_version=user_agent, user_agent=user_agent)
+
+
+def get_dummy_request(project_id: str) -> CountTokensRequest:
+    """Creates a simple test request for Gemini."""
+    return CountTokensRequest(
+        contents=[{"role": "user", "parts": [{"text": "Hi"}]}],
+        endpoint=f"projects/{project_id}/locations/global/publishers/google/models/gemini-2.5-flash",
+    )
+
+
+def verify_vertex_connection(
+    project_id: str,
+    location: str = "us-central1",
+    auto_approve: bool = False,
+    context: str | None = None,
+) -> None:
+    """Verifies Vertex AI connection with a test Gemini request."""
+    # First try direct connection - if it works, we're done
+    if _test_vertex_ai_connection(project_id, location, context):
+        return
+
+    # If that failed, try to enable the API
+    if not enable_vertex_ai_api(project_id, auto_approve, context):
+        raise Exception("Vertex AI API is not enabled and user declined to enable it")
+
+    # After enabling, test again with proper error handling
+    credentials, _ = google.auth.default()
+    client = PredictionServiceClient(
+        credentials=credentials,
+        client_options=ClientOptions(
+            api_endpoint=f"{location}-aiplatform.googleapis.com"
+        ),
+        client_info=get_client_info(context),
+        transport=initializer.global_config._api_transport,
+    )
+    request = get_dummy_request(project_id=project_id)
+
+    try:
+        client.count_tokens(request=request)
+    except PermissionDenied as e:
+        error_message = str(e)
+        # Check if the error is specifically about API not being enabled
+        if (
+            "has not been used" in error_message
+            and "aiplatform.googleapis.com" in error_message
+        ):
+            # This shouldn't happen since we checked above, but handle it gracefully
+            console.print(
+                "⚠️ API may still be propagating, retrying in 30 seconds...",
+                style="yellow",
+            )
+            time.sleep(30)
+            try:
+                client.count_tokens(request=request)
+            except PermissionDenied:
+                raise Exception(
+                    "Vertex AI API is enabled but not yet available. Please wait a few more minutes and try again."
+                ) from e
+        else:
+            # Re-raise other permission errors
+            raise
+
+
+def verify_credentials() -> dict:
+    """Verify GCP credentials and return current project and account."""
+    try:
+        # Get credentials and project
+        credentials, project = google.auth.default()
+
+        # Try multiple methods to get account email
+        account = None
+
+        # Method 1: Try _account attribute
+        if hasattr(credentials, "_account"):
+            account = credentials._account
+
+        # Method 2: Try service_account_email
+        if not account and hasattr(credentials, "service_account_email"):
+            account = credentials.service_account_email
+
+        # Method 3: Try getting from token info if available
+        if not account and hasattr(credentials, "id_token"):
+            try:
+                import jwt
+
+                decoded = jwt.decode(
+                    credentials.id_token, options={"verify_signature": False}
+                )
+                account = decoded.get("email")
+            except:
+                pass
+
+        # Method 4: Try getting from gcloud config as fallback
+        if not account:
+            try:
+                result = subprocess.run(
+                    ["gcloud", "config", "get-value", "account"],
+                    capture_output=True,
+                    text=True,
+                )
+                account = result.stdout.strip()
+            except:
+                pass
+
+        # Fallback if all methods fail
+        if not account:
+            account = "Unknown account"
+
+        return {"project": project, "account": account}
+    except google.auth.exceptions.DefaultCredentialsError as e:
+        # Authentication error - provide friendly message
+        raise Exception(_AUTH_ERROR_MESSAGE) from e
+    except Exception as e:
+        # Check if the error message indicates authentication issues
+        error_str = str(e).lower()
+        if any(
+            keyword in error_str for keyword in ["credential", "auth", "login", "token"]
+        ):
+            raise Exception(_AUTH_ERROR_MESSAGE) from e
+        raise Exception(f"Failed to verify GCP credentials: {e!s}") from e