agentengine-sdk-python 0.7.0__py3-none-any.whl → 0.8.0__py3-none-any.whl

ksadk/sessions/resilient.py

@@ -159,6 +159,12 @@ class ResilientSessionService(BaseSessionService):
             return await self._hydrate(durable)
         return live
 
+    async def get_session_metadata(self, session_id: str) -> Optional[Session]:
+        ok, durable = await self._call_primary("get_session_metadata", session_id)
+        if ok and durable is not None:
+            return cast(Session, durable)
+        return await self.fallback.get_session_metadata(session_id)
+
     async def list_sessions(
         self,
         agent_id: str,
@@ -174,16 +180,14 @@ class ResilientSessionService(BaseSessionService):
             limit,
         )
         if ok:
-            for session in durable_sessions or []:
-                await self._hydrate(session)
-        return cast(
-            list[Session],
-            await self.fallback.list_sessions(agent_id, user_id, offset, limit),
-        )
+            return cast(list[Session], durable_sessions or [])
+        return await self.fallback.list_sessions(agent_id, user_id, offset, limit)
 
     async def count_sessions(self, agent_id: str, user_id: Optional[str] = None) -> int:
-        sessions = await self.list_sessions(agent_id, user_id)
-        return len(sessions)
+        ok, total = await self._call_primary("count_sessions", agent_id, user_id)
+        if ok:
+            return int(total or 0)
+        return await self.fallback.count_sessions(agent_id, user_id)
 
     async def delete_session(self, session_id: str) -> bool:
         deleted = await self.fallback.delete_session(session_id)
@@ -288,6 +292,30 @@ class ResilientSessionService(BaseSessionService):
             await self.fallback.count_events(session_id, after_seq_id, before_seq_id),
         )
 
+    async def get_events_for_agent(
+        self,
+        agent_id: str,
+        user_id: Optional[str] = None,
+        offset: Optional[int] = None,
+        limit: Optional[int] = None,
+    ) -> list[SessionEvent]:
+        ok, events = await self._call_primary(
+            "get_events_for_agent", agent_id, user_id, offset, limit
+        )
+        if ok:
+            return cast(list[SessionEvent], events)
+        return await self.fallback.get_events_for_agent(agent_id, user_id, offset, limit)
+
+    async def count_events_for_agent(
+        self,
+        agent_id: str,
+        user_id: Optional[str] = None,
+    ) -> int:
+        ok, total = await self._call_primary("count_events_for_agent", agent_id, user_id)
+        if ok:
+            return int(total or 0)
+        return await self.fallback.count_events_for_agent(agent_id, user_id)
+
     async def get_state(
         self,
         agent_id: str,

ksadk/skills/models.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from collections.abc import Iterable
 from dataclasses import dataclass
 from typing import Any
 
@@ -48,7 +49,9 @@ class SkillRef:
             name=str(payload.get("Name") or payload.get("name") or ""),
             description=str(payload.get("Description") or payload.get("description") or ""),
             status=str(payload.get("Status") or payload.get("status") or ""),
-            content_hash=ContentHash.parse(payload.get("ContentHash") or payload.get("content_hash")),
+            content_hash=ContentHash.parse(
+                payload.get("ContentHash") or payload.get("content_hash")
+            ),
             archive_uri=str(payload.get("ArchiveUri") or payload.get("archive_uri") or ""),
             aliases=_string_tuple(payload.get("Aliases") or payload.get("aliases")),
             tags=_string_tuple(payload.get("Tags") or payload.get("tags")),
@@ -65,7 +68,9 @@ class SkillRef:
         version_key = self.version_id or self.version
         if not version_key and self.content_hash:
             version_key = self.content_hash.value
-        return "__".join(part.replace("/", "_").replace(":", "_") for part in (identity, version_key) if part)
+        return "__".join(
+            part.replace("/", "_").replace(":", "_") for part in (identity, version_key) if part
+        )
 
     @property
     def is_active(self) -> bool:
@@ -90,14 +95,20 @@ class SkillListResponse:
         space_name: str = "",
     ) -> "SkillListResponse":
         data = payload.get("Data") or payload.get("data") or {}
-        skills_payload = data.get("Skills") or data.get("skills") or data.get("Items") or data.get("items") or []
+        skills_payload = (
+            data.get("Skills") or data.get("skills") or data.get("Items") or data.get("items") or []
+        )
         return cls(
             code=int(payload.get("Code") or payload.get("code") or 0),
             message=str(payload.get("Message") or payload.get("message") or ""),
             request_id=str(payload.get("RequestId") or payload.get("request_id") or ""),
             space_id=str(data.get("SkillSpaceId") or data.get("skill_space_id") or space_id),
-            space_name=str(data.get("SkillSpaceName") or data.get("skill_space_name") or space_name),
-            skills=[SkillRef.from_payload(item) for item in skills_payload if isinstance(item, dict)],
+            space_name=str(
+                data.get("SkillSpaceName") or data.get("skill_space_name") or space_name
+            ),
+            skills=[
+                SkillRef.from_payload(item) for item in skills_payload if isinstance(item, dict)
+            ],
         )
 
     def active_skills(self) -> list[SkillRef]:
@@ -107,6 +118,7 @@ class SkillListResponse:
 def _string_tuple(raw: Any) -> tuple[str, ...]:
     if raw is None:
         return ()
+    values: Iterable[Any]
     if isinstance(raw, str):
         values = raw.split(",")
     elif isinstance(raw, (list, tuple, set)):

ksadk/skills/package_store.py

@@ -79,11 +79,14 @@ class PackageStore:
         if not ref.content_hash:
             return
         if ref.content_hash.algorithm != "sha256":
-            raise SkillPackageError(f"Unsupported ContentHash algorithm: {ref.content_hash.algorithm}")
+            raise SkillPackageError(
+                f"Unsupported ContentHash algorithm: {ref.content_hash.algorithm}"
+            )
         actual = hashlib.sha256(content).hexdigest()
         if actual.lower() != ref.content_hash.value.lower():
             raise SkillPackageError(
-                f"ContentHash mismatch for {ref.name}: expected {ref.content_hash.render()}, got sha256:{actual}"
+                f"ContentHash mismatch for {ref.name}: expected "
+                f"{ref.content_hash.render()}, got sha256:{actual}"
             )
 
     def _safe_extract(self, archive_path: Path, extract_dir: Path) -> None:

ksadk/skills/runtime/agent.py

@@ -2,7 +2,6 @@ from __future__ import annotations
 
 import json
 import os
-import subprocess
 import sys
 from dataclasses import asdict
 from pathlib import Path
@@ -12,15 +11,29 @@ import httpx
 from ksadk.skills.loader import LocalSkill
 from ksadk.skills.models import SkillRef
 from ksadk.skills.package_store import PackageStore
+from ksadk.skills.runtime import loader as runtime_loader
+from ksadk.skills.runtime import registry as runtime_registry
 from ksadk.skills.runtime.base import normalize_skill_names
 from ksadk.skills.runtime.executor import (
     WorkflowExecution,
     execute_workflow,
+)
+from ksadk.skills.runtime.executor import (
     _can_run_web_artifacts_builder as _executor_can_run_web_artifacts_builder,
+)
+from ksadk.skills.runtime.executor import (
     _run_command as _executor_run_command,
+)
+from ksadk.skills.runtime.executor import (
     _run_web_artifacts_builder as _executor_run_web_artifacts_builder,
+)
+from ksadk.skills.runtime.executor import (
     _runtime_timeout as _executor_runtime_timeout,
+)
+from ksadk.skills.runtime.executor import (
     _safe_project_name as _executor_safe_project_name,
+)
+from ksadk.skills.runtime.executor import (
     _tail as _executor_tail,
 )
 from ksadk.skills.runtime.request import (
@@ -28,8 +41,6 @@ from ksadk.skills.runtime.request import (
     SkillWorkflowRequestError,
     parse_workflow_request,
 )
-from ksadk.skills.runtime import loader as runtime_loader
-from ksadk.skills.runtime import registry as runtime_registry
 
 
 def _skill_space_ids() -> list[str]:
@@ -109,7 +120,9 @@ def run_agent(
         print("workflow=")
         print(f"skill_spaces={','.join(_skill_space_ids())}")
         print("loaded_skills=")
-        print(f"workflow_result={json.dumps(asdict(execution), ensure_ascii=False, sort_keys=True)}")
+        print(
+            f"workflow_result={json.dumps(asdict(execution), ensure_ascii=False, sort_keys=True)}"
+        )
         return 1
 
     prompt = request.workflow_prompt
@@ -125,7 +138,9 @@ def run_agent(
     print(f"loaded_skills={','.join(skill.name for skill in loaded_skills)}")
     print(f"selected_skills={json.dumps(selected_skill_names, ensure_ascii=False, sort_keys=True)}")
     if _SKILL_LOAD_WARNINGS:
-        print(f"skill_warnings={json.dumps(_SKILL_LOAD_WARNINGS, ensure_ascii=False, sort_keys=True)}")
+        print(
+            f"skill_warnings={json.dumps(_SKILL_LOAD_WARNINGS, ensure_ascii=False, sort_keys=True)}"
+        )
     print(f"workflow_result={json.dumps(asdict(execution), ensure_ascii=False, sort_keys=True)}")
     return 0 if execution.status != "failed" else 1
 

ksadk/skills/runtime/artifacts.py

@@ -20,11 +20,7 @@ def parse_artifact_lines(stdout: str) -> list[str]:
 def collect_output_dir_artifacts(output_dir: Path) -> list[str]:
     if not output_dir.is_dir():
         return []
-    return [
-        str(path)
-        for path in sorted(output_dir.rglob("*"))
-        if path.is_file()
-    ]
+    return [str(path) for path in sorted(output_dir.rglob("*")) if path.is_file()]
 
 
 def merge_artifacts(*groups: list[str]) -> list[str]:

ksadk/skills/runtime/backends/e2b.py

@@ -7,9 +7,11 @@ from typing import Any
 
 from ksadk.sandbox import (
     E2BSandboxBackend,
-    SandboxInputFile as RuntimeSandboxInputFile,
     SandboxSpec,
 )
+from ksadk.sandbox import (
+    SandboxInputFile as RuntimeSandboxInputFile,
+)
 from ksadk.skills.runtime.base import (
     SandboxInputFile,
     SkillRuntimeError,
@@ -75,10 +77,10 @@ class E2BSkillRuntimeBackend:
     @classmethod
     def from_env(cls) -> "E2BSkillRuntimeBackend":
         try:
-            from e2b import Sandbox
+            from e2b import Sandbox  # type: ignore[import-untyped]
         except ImportError as exc:
             raise SkillRuntimeError(
-                "e2b>=2.0.0 is required for KSADK_SKILL_RUNTIME_BACKEND=e2b"
+                "e2b>=2.15.3,<2.25.0 is required for KSADK_SKILL_RUNTIME_BACKEND=e2b"
             ) from exc
         return cls(
             sandbox_cls=Sandbox,
@@ -87,7 +89,11 @@ class E2BSkillRuntimeBackend:
                 or os.environ.get("KSADK_SKILL_RUNTIME_TEMPLATE_ID")
                 or ""
             ),
-            timeout=int(os.environ.get("KSADK_SANDBOX_TIMEOUT") or os.environ.get("KSADK_SKILL_RUNTIME_TIMEOUT") or "900"),
+            timeout=int(
+                os.environ.get("KSADK_SANDBOX_TIMEOUT")
+                or os.environ.get("KSADK_SKILL_RUNTIME_TIMEOUT")
+                or "900"
+            ),
             allow_internet_access=_bool_env(
                 "KSADK_SANDBOX_ALLOW_INTERNET_ACCESS",
                 _bool_env("KSADK_SKILL_RUNTIME_ALLOW_INTERNET_ACCESS", True),

ksadk/skills/runtime/backends/local.py

@@ -17,6 +17,12 @@ from ksadk.skills.runtime.base import (
 )
 
 
+def _coerce_output(value: str | bytes | None) -> str:
+    if isinstance(value, bytes):
+        return value.decode("utf-8", errors="replace")
+    return value or ""
+
+
 class LocalProcessSkillRuntimeBackend:
     def __init__(self, agent_path: str | Path, timeout: int = 900):
         self.agent_path = Path(agent_path)
@@ -67,7 +73,13 @@ class LocalProcessSkillRuntimeBackend:
                     encoding="utf-8",
                 )
                 completed = subprocess.run(
-                    [sys.executable, "-u", str(self.agent_path), "--request-file", str(request_path)],
+                    [
+                        sys.executable,
+                        "-u",
+                        str(self.agent_path),
+                        "--request-file",
+                        str(request_path),
+                    ],
                     text=True,
                     capture_output=True,
                     timeout=timeout or self.timeout,
@@ -86,8 +98,8 @@ class LocalProcessSkillRuntimeBackend:
             return SkillRuntimeResult(
                 runtime_id=f"local:{session_id}",
                 exit_code=None,
-                stdout=exc.stdout or "",
-                stderr=exc.stderr or "",
+                stdout=_coerce_output(exc.stdout),
+                stderr=_coerce_output(exc.stderr),
                 duration_ms=int((time.monotonic() - started) * 1000),
                 timed_out=True,
                 error_type="TimeoutExpired",

ksadk/skills/runtime/base.py

@@ -57,8 +57,7 @@ class SkillRuntimeBackend(Protocol):
         env: dict[str, str] | None = None,
         input_files: list[SandboxInputFile] | None = None,
         timeout: int = 900,
-    ) -> SkillRuntimeResult:
-        ...
+    ) -> SkillRuntimeResult: ...
 
 
 def parse_output_files(stdout: str) -> list[str]:

ksadk/skills/runtime/executor.py

@@ -82,7 +82,10 @@ def _can_run_web_artifacts_builder(skill: LocalSkill, prompt: str) -> bool:
     if not init_script.exists() or not bundle_script.exists():
         return False
     normalized = prompt.lower()
-    return any(marker in normalized for marker in ("web-artifacts-builder", "artifact", "bundle", "html", "react"))
+    return any(
+        marker in normalized
+        for marker in ("web-artifacts-builder", "artifact", "bundle", "html", "react")
+    )
 
 
 def _can_run_generic_workflow(skill: LocalSkill) -> bool:
@@ -91,7 +94,9 @@ def _can_run_generic_workflow(skill: LocalSkill) -> bool:
 
 def _run_web_artifacts_builder(skill: LocalSkill) -> WorkflowExecution:
     workdir = _skill_workdir()
-    project_name = _safe_project_name(os.environ.get("KSADK_SKILL_ARTIFACT_PROJECT") or "ksadk-artifact")
+    project_name = _safe_project_name(
+        os.environ.get("KSADK_SKILL_ARTIFACT_PROJECT") or "ksadk-artifact"
+    )
     project_dir = workdir / project_name
     workdir.mkdir(parents=True, exist_ok=True)
     if project_dir.exists():
@@ -114,7 +119,9 @@ def _run_web_artifacts_builder(skill: LocalSkill) -> WorkflowExecution:
         timeout=timeout,
     )
     commands.append(bundle_result)
-    output_files = [str(project_dir / "bundle.html")] if (project_dir / "bundle.html").exists() else []
+    output_files = (
+        [str(project_dir / "bundle.html")] if (project_dir / "bundle.html").exists() else []
+    )
     status = "ok" if bundle_result["exit_code"] == 0 and output_files else "failed"
     return WorkflowExecution(
         status=status,

ksadk/skills/runtime/factory.py

@@ -2,10 +2,10 @@ from __future__ import annotations
 
 import os
 
-from ksadk.skills.runtime.base import SkillRuntimeBackend
 from ksadk.skills.runtime.backends.disabled import DisabledSkillRuntimeBackend
 from ksadk.skills.runtime.backends.e2b import E2BSkillRuntimeBackend
 from ksadk.skills.runtime.backends.local import LocalProcessSkillRuntimeBackend
+from ksadk.skills.runtime.base import SkillRuntimeBackend
 
 
 def _resolve_backend(backend: str | None = None) -> str:
@@ -20,7 +20,9 @@ def _resolve_backend(backend: str | None = None) -> str:
     if sandbox_backend and sandbox_backend not in {"disabled", "none", "off"}:
         return sandbox_backend
 
-    if os.environ.get("KSADK_SANDBOX_TEMPLATE_ID") or os.environ.get("KSADK_SKILL_RUNTIME_TEMPLATE_ID"):
+    if os.environ.get("KSADK_SANDBOX_TEMPLATE_ID") or os.environ.get(
+        "KSADK_SKILL_RUNTIME_TEMPLATE_ID"
+    ):
         return "e2b"
 
     return "disabled"

ksadk/skills/runtime/loader.py

@@ -37,8 +37,7 @@ def load_skills(
         return SkillLoadResult(skills=skills, warnings=warnings)
 
     cache_dir = Path(
-        os.environ.get("KSADK_SKILL_CACHE_DIR")
-        or Path(tempfile.gettempdir()) / "ksadk-skill-cache"
+        os.environ.get("KSADK_SKILL_CACHE_DIR") or Path(tempfile.gettempdir()) / "ksadk-skill-cache"
     )
     client = SkillServiceClient(
         base_url=service_url,

ksadk/skills/runtime/registry.py

@@ -7,8 +7,14 @@ from ksadk.skills.models import SkillRef
 from ksadk.skills.runtime.base import normalize_skill_names
 from ksadk.skills.service_env import (
     parse_skill_space_ids,
+)
+from ksadk.skills.service_env import (
     public_skill_space_ids as configured_public_skill_space_ids,
+)
+from ksadk.skills.service_env import (
     skill_space_ids as configured_skill_space_ids,
+)
+from ksadk.skills.service_env import (
     user_skill_space_ids as configured_user_skill_space_ids,
 )
 
@@ -44,14 +50,13 @@ def dedupe_skill_refs(skill_refs: list[SkillRef], *, seen_names: set[str]) -> li
 
 
 def select_public_skill_refs(skill_refs: list[SkillRef]) -> list[SkillRef]:
-    allowlist = {name.lower() for name in normalize_skill_names(os.environ.get("KSADK_PUBLIC_SKILL_ALLOWLIST", ""))}
+    allowlist = {
+        name.lower()
+        for name in normalize_skill_names(os.environ.get("KSADK_PUBLIC_SKILL_ALLOWLIST", ""))
+    }
     if not allowlist:
         return [skill for skill in skill_refs if skill.name]
-    return [
-        skill
-        for skill in skill_refs
-        if skill.name and skill.name.lower() in allowlist
-    ]
+    return [skill for skill in skill_refs if skill.name and skill.name.lower() in allowlist]
 
 
 def select_remote_skill_refs(
@@ -118,7 +123,9 @@ def match_skill_refs(
     return matches
 
 
-def _metadata_score(skill: SkillRef, normalized_prompt: str, prompt_tokens: set[str]) -> tuple[int, str]:
+def _metadata_score(
+    skill: SkillRef, normalized_prompt: str, prompt_tokens: set[str]
+) -> tuple[int, str]:
     if skill.name and skill.name.lower() in normalized_prompt:
         return 90, "name"
     for alias in skill.aliases:
@@ -144,7 +151,5 @@ def _metadata_score(skill: SkillRef, normalized_prompt: str, prompt_tokens: set[
 
 def _tokens(value: str) -> set[str]:
     return {
-        token
-        for token in re.split(r"[^0-9a-zA-Z\u4e00-\u9fff]+", value.lower())
-        if len(token) >= 2
+        token for token in re.split(r"[^0-9a-zA-Z\u4e00-\u9fff]+", value.lower()) if len(token) >= 2
     }

ksadk/skills/runtime/request.py

@@ -28,7 +28,9 @@ def parse_workflow_request(argv: list[str]) -> SkillWorkflowRequest:
     if has_request_file:
         return _request_from_json_file(_option_value(args, "--request-file"))
     if has_prompt_file:
-        return SkillWorkflowRequest(workflow_prompt=Path(_option_value(args, "--prompt-file")).read_text(encoding="utf-8"))
+        return SkillWorkflowRequest(
+            workflow_prompt=Path(_option_value(args, "--prompt-file")).read_text(encoding="utf-8")
+        )
     if not args:
         return SkillWorkflowRequest()
     return SkillWorkflowRequest(workflow_prompt=args[0])

ksadk/skills/service_client.py

@@ -9,9 +9,16 @@ import httpx
 import requests
 
 from ksadk.common.auth import AWSV4Auth
-
 from ksadk.skills.models import SkillListResponse, SkillRef
 
+_KOP_HOSTS = frozenset(
+    {
+        "aicp.inner.api.ksyun.com",
+        "aicp.internal.api.ksyun.com",
+        "aicp.api.ksyun.com",
+    }
+)
+
 
 class SkillServiceClient:
     def __init__(
@@ -31,14 +38,24 @@ class SkillServiceClient:
     ):
         self.base_url = _normalize_base_url(base_url)
         self.token = token
-        self.access_key = access_key or _env("KSADK_SKILL_SERVICE_ACCESS_KEY", "KSYUN_ACCESS_KEY", "KS3_ACCESS_KEY")
-        self.secret_key = secret_key or _env("KSADK_SKILL_SERVICE_SECRET_KEY", "KSYUN_SECRET_KEY", "KS3_SECRET_KEY")
+        self.access_key = access_key or _env(
+            "KSADK_SKILL_SERVICE_ACCESS_KEY", "KSYUN_ACCESS_KEY", "KS3_ACCESS_KEY"
+        )
+        self.secret_key = secret_key or _env(
+            "KSADK_SKILL_SERVICE_SECRET_KEY", "KSYUN_SECRET_KEY", "KS3_SECRET_KEY"
+        )
         self.account_id = account_id or _env("KSADK_SKILL_SERVICE_ACCOUNT_ID", "KSYUN_ACCOUNT_ID")
-        self.logical_region = region or _env("KSADK_SKILL_SERVICE_REGION", "KSYUN_REGION") or "cn-beijing-6"
+        self.logical_region = (
+            region or _env("KSADK_SKILL_SERVICE_REGION", "KSYUN_REGION") or "cn-beijing-6"
+        )
         self.region = _normalize_control_region(self.logical_region)
         self.custom_source = _resolve_custom_source(self.logical_region)
-        self.api_version = api_version or os.environ.get("KSADK_SKILL_SERVICE_API_VERSION", "2024-06-12")
-        self.sign_service = sign_service or os.environ.get("KSADK_SKILL_SERVICE_SIGN_SERVICE", "aicp")
+        self.api_version = api_version or os.environ.get(
+            "KSADK_SKILL_SERVICE_API_VERSION", "2024-06-12"
+        )
+        self.sign_service = sign_service or os.environ.get(
+            "KSADK_SKILL_SERVICE_SIGN_SERVICE", "aicp"
+        )
         self.extra_headers = dict(extra_headers or {})
         self.timeout = timeout
         self.transport = transport
@@ -76,7 +93,9 @@ class SkillServiceClient:
 
     def list_available_premade_skills(self) -> SkillListResponse:
         payload = self._get_json("ListAvailablePremadeSkills", {})
-        return SkillListResponse.from_payload(payload, space_id="public", space_name="Public Skills")
+        return SkillListResponse.from_payload(
+            payload, space_id="public", space_name="Public Skills"
+        )
 
     def get_skill_download_url(self, skill: SkillRef) -> str:
         action = "GetSkillDownloadUrl" if skill.version_id else "GetPremadeSkillDownloadUrl"
@@ -97,7 +116,7 @@ class SkillServiceClient:
         with httpx.Client(**self._client_kwargs()) as client:
             response = client.get(download_url)
             response.raise_for_status()
-            return response.content
+            return bytes(response.content)
 
     def _get_json(self, action: str, params: dict[str, Any]) -> dict[str, Any]:
         if self._is_kop_mode():
@@ -169,15 +188,15 @@ class SkillServiceClient:
                 "Set KSADK_SKILL_SERVICE_ACCESS_KEY/KSADK_SKILL_SERVICE_SECRET_KEY "
                 "or KSYUN_ACCESS_KEY/KSYUN_SECRET_KEY."
             )
-        response = self._requests().get(
+        requests_response = self._requests().get(
             self._kop_base_url() + "/",
             params=query,
             headers=headers,
             auth=self._auth.get_auth(),
             timeout=self.timeout,
         )
-        response.raise_for_status()
-        data = response.json()
+        requests_response.raise_for_status()
+        data = requests_response.json()
         if not isinstance(data, dict):
             raise ValueError(f"Skill Service returned non-object response for {action}")
         code = data.get("Code", data.get("code"))
@@ -196,12 +215,14 @@ class SkillServiceClient:
         return self._requests_session
 
     def _is_kop_mode(self) -> bool:
-        host = urlsplit(self.base_url).netloc.lower()
-        return (
-            host.endswith("aicp.inner.api.ksyun.com")
-            or host.endswith("aicp.internal.api.ksyun.com")
-            or host.endswith("aicp.api.ksyun.com")
-        )
+        """Match only exact, TLS-protected AICP control-plane endpoints.
+
+        A user-controlled URL such as ``aicp.api.ksyun.com.attacker.example``
+        must never receive KOP signing headers.
+        """
+        parsed = urlsplit(self.base_url)
+        host = (parsed.hostname or "").lower()
+        return parsed.scheme == "https" and host in _KOP_HOSTS
 
     def _kop_base_url(self) -> str:
         parsed = urlsplit(self.base_url)

ksadk/skills/tool_defs.py

@@ -12,9 +12,11 @@ from ksadk.skills.service_env import (
     public_skill_space_ids,
     resolve_skill_service_url,
     should_resolve_child_skill_service_url,
-    skill_space_ids as configured_skill_space_ids,
     user_skill_space_ids,
 )
+from ksadk.skills.service_env import (
+    skill_space_ids as configured_skill_space_ids,
+)
 
 RUNTIME_AGENT_ENV_NAMES = (
     "KSADK_SKILL_SERVICE_URL",
@@ -51,11 +53,7 @@ def _parse_skill_space_ids(*raw_values: str) -> list[str]:
 
 
 def runtime_agent_env_from_process(skill_space_ids: list[str] | None = None) -> dict[str, str]:
-    env = {
-        name: value
-        for name in RUNTIME_AGENT_ENV_NAMES
-        if (value := os.environ.get(name))
-    }
+    env = {name: value for name in RUNTIME_AGENT_ENV_NAMES if (value := os.environ.get(name))}
     if "KSADK_SKILL_SERVICE_ACCOUNT_ID" not in env and (
         account_id := os.environ.get("KSYUN_ACCOUNT_ID")
     ):
@@ -72,7 +70,11 @@ def runtime_agent_env_from_process(skill_space_ids: list[str] | None = None) ->
                 if value:
                     env[target] = value
                     break
-    if has_spaces and should_resolve_child_skill_service_url() and "KSADK_SKILL_SERVICE_URL" not in env:
+    if (
+        has_spaces
+        and should_resolve_child_skill_service_url()
+        and "KSADK_SKILL_SERVICE_URL" not in env
+    ):
         service_url = resolve_skill_service_url(require_spaces=False)
         if service_url:
             env["KSADK_SKILL_SERVICE_URL"] = service_url
@@ -125,7 +127,8 @@ def load_remote_skill_manifests(skill_space_ids: list[str] | None = None) -> lis
     seen: set[str] = set()
     limit = _manifest_limit()
     public_allowlist = {
-        name.lower() for name in normalize_skill_names(os.environ.get("KSADK_PUBLIC_SKILL_ALLOWLIST", ""))
+        name.lower()
+        for name in normalize_skill_names(os.environ.get("KSADK_PUBLIC_SKILL_ALLOWLIST", ""))
     }
     for space_id in user_spaces:
         listing = client.list_skills_by_space_id(space_id)
@@ -161,8 +164,10 @@ def build_skill_manifest_instruction(manifests: list[dict[str, str]]) -> str:
     lines = [
         "",
         "Available remote skills are listed below. Use them only when they match the user's task.",
-        "When a skill is useful, call execute_skills with the original workflow_prompt and skill_names set to the exact skill name.",
-        "Do not assume full skill instructions are already loaded; execute_skills loads selected skills on demand.",
+        "When a skill is useful, call execute_skills with the original workflow_prompt "
+        "and skill_names set to the exact skill name.",
+        "Do not assume full skill instructions are already loaded; execute_skills loads "
+        "selected skills on demand.",
         "",
         "Remote skills:",
     ]

ksadk/terminal_exec_policy.py

@@ -140,10 +140,9 @@ def validate_terminal_exec_argv(
 
     normalized = normalize_exec_argv(argv, policy_name=policy.name)
     allowed_exact = tuple(tuple(item) for item in policy.default_exact)
-    allowed_prefixes = (
-        tuple(tuple(item) for item in policy.default_prefixes)
-        + _env_allowlist_prefixes(policy.env_names, policy_name=policy.name)
-    )
+    allowed_prefixes = tuple(
+        tuple(item) for item in policy.default_prefixes
+    ) + _env_allowlist_prefixes(policy.env_names, policy_name=policy.name)
 
     if _matches_exact_or_prefix(
         normalized,