agentengine-sdk-python 0.8.3__py3-none-any.whl → 0.8.5__py3-none-any.whl

ksadk/builders/framework_requirements.py

@@ -8,8 +8,9 @@ FASTAPI_REQUIREMENT = "fastapi>=0.136.0,<0.137.0"
 STARLETTE_REQUIREMENT = "starlette>=1.0,<1.4"
 
 ADK_REQUIREMENTS = (
-    # goal-00: 与 ksadk 自身 adk extra 对齐,允许 1.34.x 与 2.x
+    # 与 ksadk 自身 adk extra 对齐，支持 1.x 与 2.x。
     "google-adk>=1.34.0,<3.0.0",
+    "greenlet>=1.0.0",
     "litellm>=1.0.0",
 )
 
@@ -22,8 +23,22 @@ LANGCHAIN_ECOSYSTEM_REQUIREMENTS = (
 
 DEEPAGENTS_REQUIREMENTS = ("deepagents>=0.6.2,<1.0.0",)
 
-# codex runtime:openai-codex SDK(自带 codex CLI 二进制,见 PyPI cli-bin wheel)
-CODEX_REQUIREMENTS = ("openai-codex==0.144.4",)
+# codex runtime:openai-codex SDK(自带 codex CLI 二进制,见 PyPI cli-bin wheel)。
+# 版本必须与 pyproject.toml 的 ksadk[codex] extra 保持一致:适配层
+# (ksadk/codex/client.py)依赖 app-server 私有协议,SDK/CLI 是精确 co-pin。
+CODEX_REQUIREMENTS = ("openai-codex==0.154.0",)
+
+# KsADK Harness is a managed LangGraph runtime.  Keep its checkpoint adapter
+# explicit: LangGraph split the SQLite saver into a separately distributed
+# package, so installing only ``langgraph`` leaves
+# ``langgraph.checkpoint.sqlite`` unavailable in a freshly built agent.
+HARNESS_REQUIREMENTS = (
+    "langgraph>=1.2.0,<1.3.0",
+    "langgraph-checkpoint-sqlite>=2.0.0",
+    "langchain>=1.3.14,<2.0.0",
+    "langchain-core>=1.5.0,<2.0.0",
+    "langchain-openai>=1.4.0,<2.0.0",
+)
 
 
 def code_requirements_for_framework(framework: str) -> list[str]:
@@ -45,6 +60,8 @@ def requirements_for_framework(framework: str) -> list[str]:
         return list(ADK_REQUIREMENTS)
     if normalized == "codex":
         return list(CODEX_REQUIREMENTS)
+    if normalized == "harness":
+        return list(HARNESS_REQUIREMENTS)
     if normalized in {"langchain", "langgraph", "deepagents"}:
         requirements = list(LANGCHAIN_ECOSYSTEM_REQUIREMENTS)
         if normalized == "deepagents":
@@ -60,6 +77,8 @@ def minimal_requirements_for_framework(framework: str) -> list[str]:
         return list(ADK_REQUIREMENTS)
     if normalized == "codex":
         return list(CODEX_REQUIREMENTS)
+    if normalized == "harness":
+        return list(HARNESS_REQUIREMENTS)
     if normalized in {"langchain", "langgraph", "deepagents"}:
         requirements = [
             "langchain>=1.3.14,<2.0.0",

ksadk/builders/ks3_uploader.py

@@ -2,6 +2,7 @@
 KS3 上传模块 - 金山云对象存储上传
 """
 
+import logging
 import os
 import socket
 import time
@@ -27,7 +28,15 @@ class KS3Uploader:
     UPLOAD_TIMEOUT_PER_MB_SECONDS = 4.0
     UPLOAD_TIMEOUT_MAX_SECONDS = 3600
 
-    def __init__(self, region: str = "cn-beijing-6", bucket: Optional[str] = None):
+    def __init__(
+        self,
+        region: str = "cn-beijing-6",
+        bucket: Optional[str] = None,
+        *,
+        access_key: Optional[str] = None,
+        secret_key: Optional[str] = None,
+        public_read: bool = True,
+    ):
         """初始化 KS3 上传器
 
         Args:
@@ -37,7 +46,15 @@ class KS3Uploader:
                    - 如果未指定，优先从环境变量 KS3_BUCKET 读取
                    - 如果环境变量也未设置，默认使用 agentengine-{region}
         """
+        # ks3sdk logs the signed Authorization header at INFO. Studio uploads
+        # run inside a long-lived server process, so keep that transport logger
+        # above INFO before any request can be emitted.
+        logging.getLogger("ks3.http").setLevel(logging.WARNING)
+
         self.region = region
+        self.access_key = access_key
+        self.secret_key = secret_key
+        self.public_read = public_read
 
         # 确定 bucket 名称 (优先级: 参数 > 环境变量 > 默认值)
         if bucket:
@@ -260,8 +277,12 @@ class KS3Uploader:
     def _upload_via_host(self, file_path: Path, object_key: str, host: str) -> bool:
         from ks3.connection import Connection  # type: ignore[import-untyped]
 
-        ak = os.environ.get("KSYUN_ACCESS_KEY") or os.environ.get("KS3_ACCESS_KEY")
-        sk = os.environ.get("KSYUN_SECRET_KEY") or os.environ.get("KS3_SECRET_KEY")
+        ak = self.access_key or os.environ.get("KSYUN_ACCESS_KEY") or os.environ.get(
+            "KS3_ACCESS_KEY"
+        )
+        sk = self.secret_key or os.environ.get("KSYUN_SECRET_KEY") or os.environ.get(
+            "KS3_SECRET_KEY"
+        )
 
         conn = Connection(
             ak,
@@ -291,10 +312,14 @@ class KS3Uploader:
                 resumable=True,
                 resumable_filename=str(resume_path),
             )
-            result = upload_task.upload(headers={"x-kss-acl": "public-read"})
+            headers = {"x-kss-acl": "public-read"} if self.public_read else {}
+            result = upload_task.upload(headers=headers)
         else:
             click.echo(f"   普通上传: {file_path.stat().st_size / (1024 * 1024):.2f} MB")
-            result = key.set_contents_from_filename(str(file_path), policy="public-read")
+            if self.public_read:
+                result = key.set_contents_from_filename(str(file_path), policy="public-read")
+            else:
+                result = key.set_contents_from_filename(str(file_path))
 
         status = getattr(result, "status", None)
         if status is None:
@@ -313,8 +338,12 @@ class KS3Uploader:
             成功返回 ks3:// URI, 失败返回 None
         """
         # 检查环境变量 (优先使用 KSYUN_* 金山云 IAM 凭证)
-        ak = os.environ.get("KSYUN_ACCESS_KEY") or os.environ.get("KS3_ACCESS_KEY")
-        sk = os.environ.get("KSYUN_SECRET_KEY") or os.environ.get("KS3_SECRET_KEY")
+        ak = self.access_key or os.environ.get("KSYUN_ACCESS_KEY") or os.environ.get(
+            "KS3_ACCESS_KEY"
+        )
+        sk = self.secret_key or os.environ.get("KSYUN_SECRET_KEY") or os.environ.get(
+            "KS3_SECRET_KEY"
+        )
 
         if not ak or not sk:
             click.secho("❌ 请在 .env 文件中设置金山云 IAM 凭证:", fg="red")

ksadk/builders/managed_runtime_builder.py

@@ -27,6 +27,7 @@ _MANIFEST_KEYS = (
     "soul_digest",
     "skills",
     "mcp_servers",
+    "plugins",
     "sandbox",
     "approval_mode",
     "context",

ksadk/cli/__init__.py

@@ -339,16 +339,44 @@ def _register_optional_command(cli: click.Group, module_path: str, *cmd_names: s
 
 
 def _register_commands():
+    # Runtime fast path: when the hosted entrypoint runs ``ksadk web`` the
+    # process only needs the web command. Importing the other commands here
+    # pulls in deploy/create/run deps (ks3, questionary, ...) that the hosted
+    # Python runtime image does not ship, so a full register crashes the
+    # runtime before the server starts. Only import what argv actually needs;
+    # ``--help`` and other exploratory invocations still register everything.
+    import sys as _sys
+
+    _argv = [a for a in _sys.argv[1:] if not a.startswith("-")]
+    _runtime_only = bool(_argv) and _argv[0] == "web"
+
+    from ksadk.cli.cmd_web import web
+
+    _add_command_once(cli, web)
+
+    # The desktop shell invokes exactly ``ksadk studio``. Avoid importing the
+    # full command registry (A2A, deploy, eval, etc.) on this hot path: those
+    # optional SDKs are unrelated to Studio and their import warnings used to
+    # obscure the real startup error. This also shortens the time to the first
+    # local health check in Electron.
+    if bool(_argv) and _argv[0] == "studio":
+        from ksadk.cli.cmd_studio import studio
+
+        _add_command_once(cli, studio)
+        return
+
+    if _runtime_only:
+        # Skip create/deploy/run/managed_runtime imports on the runtime path.
+        return
+
     from ksadk.cli.cmd_create import create
     from ksadk.cli.cmd_deploy import deploy
     from ksadk.cli.cmd_managed_runtime import managed_runtime
     from ksadk.cli.cmd_run import run
-    from ksadk.cli.cmd_web import web
 
     # 注册现有命令
     _add_command_once(cli, run)
     _add_command_once(cli, deploy)
-    _add_command_once(cli, web)
     _add_command_once(cli, managed_runtime)
 
     # init 作为主命令 (PRD 规范)
@@ -391,7 +419,7 @@ def _register_commands():
     _register_optional_command(cli, "ksadk.cli.cmd_hermes", "hermes")
 
 
-def main():
+def _main():
     # 全局加载 .env 文件
     try:
         from dotenv import find_dotenv, load_dotenv
@@ -443,6 +471,31 @@ def main():
     except ImportError:
         pass
 
+    # Studio and ordinary CLI commands consume the same saved workspace values.
+    from pathlib import Path
+
+    from ksadk.studio.configuration import WorkspaceConfiguration
+    from ksadk.studio.workspace import Workspace
+
+    try:
+        root = Path.cwd()
+        if any(
+            (root / ".agentkit" / name).is_file()
+            for name in ("config.yaml", "settings.yaml", "secrets.env")
+        ):
+            configuration = WorkspaceConfiguration(Workspace(root))
+            effective = configuration.environment()
+            os.environ.update(effective)
+            if (
+                "codexProxy" in configuration.settings()
+                and "KSADK_CODEX_USE_PROXY" not in effective
+            ):
+                os.environ.pop("KSADK_CODEX_USE_PROXY", None)
+    except Exception as error:
+        cli_error = cli_error_from_exception(error, show_help=False)
+        emit_cli_error(cli_error)
+        raise SystemExit(cli_error.exit_code) from None
+
     # 全局配置回退: .env 未设置的变量从 ~/.agentengine/settings.json 补充
     try:
         from ksadk.configs.global_config import get_env_from_global_config
@@ -476,5 +529,17 @@ def main():
         raise SystemExit(cli_error.exit_code) from None
 
 
+def main():
+    """Run the CLI without exposing a traceback for an operator interrupt."""
+
+    try:
+        return _main()
+    except KeyboardInterrupt:
+        # Ctrl+C can arrive while optional commands are still importing, before
+        # Click or Uvicorn installs its own signal handling.  Treat it as the
+        # same clean operator stop and preserve the conventional exit status.
+        raise SystemExit(130) from None
+
+
 if __name__ == "__main__":
     main()

ksadk/cli/cmd_config.py

@@ -184,7 +184,7 @@ def _apply_set_command(
     if not updates_yaml and not updates_env and invalid_items:
         raise usage_error(
             "至少提供一个有效的 KEY=VALUE 配置项。",
-            hints=["示例: `agentengine config set region=cn-beijing-6 OPENAI_MODEL_NAME=glm-5.2`"],
+            hints=["示例: `agentengine config set region=cn-beijing-6 OPENAI_MODEL_NAME=deepseek-v4.1-flash`"],
         )
 
     result = {
@@ -323,7 +323,7 @@ def _run_config_set_command(
     if not set_items:
         raise usage_error(
             "请至少提供一个 KEY=VALUE 配置项。",
-            hints=["示例: `agentengine config set region=cn-beijing-6 OPENAI_MODEL_NAME=glm-5.2`"],
+            hints=["示例: `agentengine config set region=cn-beijing-6 OPENAI_MODEL_NAME=deepseek-v4.1-flash`"],
         )
     return _apply_set_command(set_items, output_path, env_path, is_global)
 
@@ -464,7 +464,7 @@ def run_config_wizard(config_file: str | None, set_items: tuple, is_global: bool
 
     new_env["OPENAI_MODEL_NAME"] = _ask_or_exit(
         questionary.text(
-            "模型名称 (OPENAI_MODEL_NAME) [选填,默认使用金山云星流平台glm-5.2]:",
+            "模型名称 (OPENAI_MODEL_NAME) [选填,默认使用金山云星流平台deepseek-v4.1-flash]:",
             default=existing_env.get("OPENAI_MODEL_NAME", ""),
             style=_questionary_style(),
         )
@@ -784,7 +784,7 @@ def config_set(set_items: tuple, is_global: bool, output_mode: str | None):
     \b
     示例:
       agentengine config set region=cn-beijing-6
-      agentengine config set OPENAI_MODEL_NAME=glm-5.2 OPENAI_BASE_URL=https://example.com/v1
+      agentengine config set OPENAI_MODEL_NAME=deepseek-v4.1-flash OPENAI_BASE_URL=https://example.com/v1
       agentengine config set KSYUN_REGION=cn-beijing-6 --global
     """
     _ = output_mode

ksadk/cli/cmd_create.py

@@ -104,7 +104,7 @@ from google.adk.agents import Agent
 from google.adk.models.lite_llm import LiteLlm
 
 model = LiteLlm(
-    model=f"openai/{{os.getenv('OPENAI_MODEL_NAME', 'glm-5.2')}}",
+    model=f"openai/{{os.getenv('OPENAI_MODEL_NAME', 'deepseek-v4.1-flash')}}",
     api_base=os.getenv("OPENAI_BASE_URL"),
     api_key=os.getenv("OPENAI_API_KEY"),
     stream=True,  # 启用流式输出
@@ -147,7 +147,7 @@ from langchain.agents import create_agent
 from langchain_openai import ChatOpenAI
 
 llm = ChatOpenAI(
-    model=os.getenv("OPENAI_MODEL_NAME", "glm-5.2"),
+    model=os.getenv("OPENAI_MODEL_NAME", "deepseek-v4.1-flash"),
     base_url=os.getenv("OPENAI_BASE_URL"),
     api_key=os.getenv("OPENAI_API_KEY"),
     streaming=True,
@@ -194,7 +194,7 @@ from typing import TypedDict, Annotated
 import operator
 
 llm = ChatOpenAI(
-    model=os.getenv("OPENAI_MODEL_NAME", "glm-5.2"),
+    model=os.getenv("OPENAI_MODEL_NAME", "deepseek-v4.1-flash"),
     base_url=os.getenv("OPENAI_BASE_URL"),
     api_key=os.getenv("OPENAI_API_KEY"),
     streaming=True,
@@ -234,7 +234,7 @@ from deepagents import create_deep_agent
 from langchain_openai import ChatOpenAI
 
 llm = ChatOpenAI(
-    model=os.getenv("OPENAI_MODEL_NAME", "glm-5.2"),
+    model=os.getenv("OPENAI_MODEL_NAME", "deepseek-v4.1-flash"),
     base_url=os.getenv("OPENAI_BASE_URL"),
     api_key=os.getenv("OPENAI_API_KEY"),
     streaming=True,
@@ -671,7 +671,7 @@ def _generate_codex_env_content(global_env: dict) -> str:
         "# 本地 Codex 模型配置（仅用于 ksadk web，不会进入 ManagedRuntime bundle）",
         "# OPENAI_API_KEY=",
         f"OPENAI_BASE_URL={base_url}" if base_url else "# OPENAI_BASE_URL=",
-        f"OPENAI_MODEL_NAME={model_name}" if model_name else "# OPENAI_MODEL_NAME=glm-5.2",
+        f"OPENAI_MODEL_NAME={model_name}" if model_name else "# OPENAI_MODEL_NAME=deepseek-v4.1-flash",
         "",
         "# 可选：自定义上游仅支持 Chat Completions 时，强制启用协议转换代理",
         "# KSADK_CODEX_USE_PROXY=1",
@@ -1601,7 +1601,7 @@ runtime:
   name: codex
 
 # codex 的模型与开发者指令（CodexRuntimeAdapter 传入 codex thread）
-model: glm-5.2
+model: deepseek-v4.1-flash
 prompt: |
   你是 codex 编码助手。简洁回答,能跑命令验证就跑(shell 工具),中文回复。
 """,
@@ -1820,7 +1820,7 @@ KSYUN_REGION={ks_region}
         if model_name:
             env_content += f"OPENAI_MODEL_NAME={model_name}\n"
         else:
-            env_content += "# OPENAI_MODEL_NAME=glm-5.2\n"
+            env_content += "# OPENAI_MODEL_NAME=deepseek-v4.1-flash\n"
     elif framework == "hermes":
         env_content = f"""# ======================
 # Hermes 标准部署最小配置
@@ -1840,7 +1840,7 @@ KSYUN_REGION={ks_region}
         if model_name:
             env_content += f"OPENAI_MODEL_NAME={model_name}\n"
         else:
-            env_content += "# OPENAI_MODEL_NAME=glm-5.2\n"
+            env_content += "# OPENAI_MODEL_NAME=deepseek-v4.1-flash\n"
 
         env_content += """
 # Hermes runtime
@@ -1851,7 +1851,7 @@ HERMES_DASHBOARD_HOST=127.0.0.1
 HERMES_DASHBOARD_PORT=9119
 PORT=8080
 # HERMES_CONTEXT_LENGTH=200000
-# HERMES_FALLBACK_MODEL=deepseek-v4-pro
+# HERMES_FALLBACK_MODEL=glm-5.3-flash
 """
         env_example_content = """# ======================
 # Hermes 标准部署最小配置示例
@@ -1863,7 +1863,7 @@ KSYUN_REGION=cn-beijing-6
 
 OPENAI_API_KEY=your-model-api-key
 OPENAI_BASE_URL=https://kspmas.ksyun.com/v1/
-OPENAI_MODEL_NAME=glm-5.2
+OPENAI_MODEL_NAME=deepseek-v4.1-flash
 
 # Hermes runtime
 API_SERVER_ENABLED=true
@@ -1873,7 +1873,7 @@ HERMES_DASHBOARD_HOST=127.0.0.1
 HERMES_DASHBOARD_PORT=9119
 PORT=8080
 # HERMES_CONTEXT_LENGTH=200000
-# HERMES_FALLBACK_MODEL=deepseek-v4-pro
+# HERMES_FALLBACK_MODEL=glm-5.3-flash
 """
     elif framework == "codex":
         env_content = _generate_codex_env_content(global_env)
@@ -1893,7 +1893,7 @@ PORT=8080
         if model_name:
             env_content += f"OPENAI_MODEL_NAME={model_name}\n"
         else:
-            env_content += "# OPENAI_MODEL_NAME=glm-5.2\n"
+            env_content += "# OPENAI_MODEL_NAME=deepseek-v4.1-flash\n"
 
         env_content += """
 # ======================

ksadk/cli/cmd_hermes.py

@@ -24,6 +24,7 @@ from ksadk.cli.error_utils import remote_error, resolution_error
 from ksadk.cli.model_catalog import fetch_provider_model_metadata
 from ksadk.cli.network_options import build_network_payload, network_cli_kwargs, network_options
 from ksadk.cli.resource_common import (
+    build_component_config,
     CONTEXT_SETTINGS,
     ResourceActionSet,
     ResourceDescriptor,
@@ -65,8 +66,8 @@ from ksadk.hermes_terminal import (
 )
 
 DEFAULT_HERMES_IMAGE = "ghcr.io/kingsoftcloud/hermes-agent:v2026.7.7.2-ksadk-v070"
-DEFAULT_HERMES_CONTEXT_LENGTHS = (("glm-5.1", "200000"),)
-DEFAULT_HERMES_MODEL_NAME = "glm-5.2"
+DEFAULT_HERMES_CONTEXT_LENGTHS = (("deepseek-v4.1-flash", "128000"),)
+DEFAULT_HERMES_MODEL_NAME = "deepseek-v4.1-flash"
 DEFAULT_HERMES_PUBLIC_BASE_URL = "https://kspmas.ksyun.com/v1/"
 DEFAULT_HERMES_RUNTIME_BASE_URL = DEFAULT_HERMES_PUBLIC_BASE_URL
 KSPMAS_PUBLIC_BASES = (
@@ -163,6 +164,8 @@ def _build_hermes_update_payload(
         update_payload["storage"] = storage_config
     if network_payload:
         update_payload["network"] = network_payload
+    if payload.get("component_config"):
+        update_payload["component_config"] = payload["component_config"]
     return update_payload
 
 
@@ -428,6 +431,9 @@ def _render_hermes_dry_run(
 @click.option("--storage-size-gi", type=int, default=20, show_default=True, help="PVC 容量（Gi）")
 @click.option("--storage-mount-path", default=None, help="PVC 挂载目录（默认: /home/node/.hermes）")
 @click.option("--no-storage", is_flag=True, help="禁用默认 PVC 挂载")
+@click.option("--skill-space-id", "skill_space_ids", multiple=True, help="Skill 中心空间 ID（可重复传入多个）")
+@click.option("--sandbox-template-id", default=None, help="沙箱模板 ID（启用 E2B 沙箱执行 execute_skills）")
+@click.option("--sandbox-api-key", default=None, help="沙箱 API Key（可选，默认从服务端注入）")
 @env_options
 @click.option(
     "--observability/--no-observability",
@@ -468,6 +474,9 @@ def deploy(
     subnet_id: Optional[str],
     security_group_id: Optional[str],
     availability_zone: Optional[str],
+    skill_space_ids: tuple[str, ...],
+    sandbox_template_id: Optional[str],
+    sandbox_api_key: Optional[str],
     dry_run: bool,
     output_mode: str | None,
 ):
@@ -510,6 +519,9 @@ def deploy(
             include_storage_on_update=include_storage_on_update,
             extra_env=extra_env,
             env_file=env_file,
+            skill_space_ids=skill_space_ids,
+            sandbox_template_id=sandbox_template_id,
+            sandbox_api_key=sandbox_api_key,
             **network_cli_kwargs(
                 enable_public_access=enable_public_access,
                 enable_vpc_access=enable_vpc_access,
@@ -551,6 +563,9 @@ async def _deploy_hermes(
     subnet_id: str | None = None,
     security_group_id: str | None = None,
     availability_zone: str | None = None,
+    skill_space_ids: tuple[str, ...] = (),
+    sandbox_template_id: str | None = None,
+    sandbox_api_key: str | None = None,
     dry_run: bool = False,
 ) -> None:
     project_dir = Path(".").resolve()
@@ -606,6 +621,11 @@ async def _deploy_hermes(
         auto_dotenv=auto_dotenv,
         shell_keys=shell_keys,
     )
+    component_config = build_component_config(
+        skill_space_ids=skill_space_ids,
+        sandbox_template_id=sandbox_template_id,
+        sandbox_api_key=sandbox_api_key,
+    )
     payload = {
         "name": agent_name,
         "description": "Hermes Agent (managed by AgentEngine)",
@@ -619,6 +639,8 @@ async def _deploy_hermes(
         "env_vars": env_vars,
         "ui_config": {"profile": "hermes", "path": "/", "url": None},
     }
+    if component_config:
+        payload["component_config"] = component_config
     storage_config = build_storage_config(
         "hermes",
         no_storage=no_storage,

ksadk/cli/cmd_invoke.py

@@ -18,7 +18,6 @@ import click
 
 from ksadk.api import AgentEngineAPIError, AgentEngineClient
 from ksadk.cli.agent_ref import merge_agent_inputs, resolve_agent_ref, resolve_openclaw_ref
-from ksadk.cli.invoke_payload import build_chat_request
 from ksadk.cli.cmd_files import (
     _build_sync_payload,
     _collect_local_files_report,
@@ -27,6 +26,7 @@ from ksadk.cli.cmd_files import (
     _normalize_workspace_dir,
     _push_workspace_files,
 )
+from ksadk.cli.invoke_payload import build_chat_request
 from ksadk.cli.resource_common import (
     CONTEXT_SETTINGS,
     CompatibilityAliasCommand,
@@ -1311,7 +1311,15 @@ async def _invoke_once(
                     last_refresh_time = 0.0
                     full_reasoning = ""
                     async for chunk in _stream_chat(
-                        endpoint, message, api_key, session_id, True, insecure, model, api_format, default_model
+                        endpoint,
+                        message,
+                        api_key,
+                        session_id,
+                        True,
+                        insecure,
+                        model,
+                        api_format,
+                        default_model,
                     ):
                         content, reasoning = _extract_content(chunk)
 
@@ -1341,7 +1349,15 @@ async def _invoke_once(
                     live.refresh()  # 确保最后一次刷新
             else:
                 async for chunk in _stream_chat(
-                    endpoint, message, api_key, session_id, True, insecure, model, api_format, default_model
+                    endpoint,
+                    message,
+                    api_key,
+                    session_id,
+                    True,
+                    insecure,
+                    model,
+                    api_format,
+                    default_model,
                 ):
                     content, reasoning = _extract_content(chunk)
                     if reasoning:
@@ -1510,8 +1526,15 @@ def _extract_content(chunk: dict) -> tuple[str, str]:
     event_name = str(chunk.get("_event") or "")
     if event_name == "response.output_text.delta":
         return str(chunk.get("delta") or ""), ""
-    if event_name == "response.reasoning.delta":
-        return "", str(chunk.get("delta") or "")
+    # reasoning delta 有 4 个变体名(与 remote_runner / 前端 chatProtocol 对齐),
+    # 主 runtime 发 reasoning.delta,Studio shared_web 发 reasoning_summary_text.delta。
+    if event_name in {
+        "response.reasoning.delta",
+        "response.reasoning_text.delta",
+        "response.reasoning_summary.delta",
+        "response.reasoning_summary_text.delta",
+    }:
+        return "", str(chunk.get("delta") or chunk.get("text") or "")
     if event_name == "response.completed":
         return "", ""
 

ksadk/cli/cmd_managed_runtime.py

@@ -83,8 +83,20 @@ def managed_runtime(manifest_path: Path, port: int, host: str) -> None:
     """Serve one mounted, declarative ``agentengine.yaml`` in hosted mode."""
 
     manifest_path = manifest_path.resolve()
-    _load_managed_runtime_manifest(manifest_path)
+    manifest = _load_managed_runtime_manifest(manifest_path)
     work_dir = _prepare_writable_runtime_dir(manifest_path)
+    from ksadk.plugins.delivery import prepare_cloud_plugins
+
+    try:
+        prepare_cloud_plugins(manifest, work_dir)
+    except Exception as exc:
+        # Transport exceptions can contain signed URLs; keep startup logs secret-free.
+        import httpx
+
+        detail = "artifact transport failed" if isinstance(exc, httpx.HTTPError) else str(exc)
+        raise click.ClickException(
+            "plugin delivery failed before runtime startup: " + detail
+        ) from None
     # The command is a production process entrypoint, never a local UI action.
     # ``web`` owns the RuntimeAdapter composition, while no_open prevents an
     # accidental browser launch if this container is ever run with a display.

ksadk/cli/cmd_openclaw.py

@@ -46,6 +46,7 @@ from ksadk.cli.error_utils import abort_with_cli_error, remote_error, resolution
 from ksadk.cli.model_catalog import fetch_provider_model_catalog, find_model_in_catalog
 from ksadk.cli.network_options import build_network_payload, network_cli_kwargs, network_options
 from ksadk.cli.resource_common import (
+    build_component_config,
     CONTEXT_SETTINGS,
     ResourceActionDescriptor,
     ResourceDescriptor,
@@ -271,6 +272,7 @@ def _build_openclaw_update_payload(
     network_payload: dict[str, Any] | None,
     include_env: bool,
     include_storage: bool,
+    component_config: dict[str, Any] | None = None,
 ):
     """构建已有 OpenClaw 的最小更新请求，默认保留服务端现有配置。"""
     update_payload: dict[str, Any] = {
@@ -290,6 +292,8 @@ def _build_openclaw_update_payload(
         update_payload["storage"] = storage_config
     if network_payload:
         update_payload["network"] = network_payload
+    if component_config:
+        update_payload["component_config"] = component_config
     return update_payload
 
 
@@ -430,7 +434,7 @@ def _strip_provider_prefix(provider_id: str, model_id: str) -> str:
 def _default_openclaw_model_inputs(provider_id: str, model_id: str) -> list[str]:
     if str(provider_id or "").strip().lower() == "ksyun" and str(
         model_id or ""
-    ).strip().lower() in {"glm-5.1", "glm-5.2"}:
+    ).strip().lower() in {"deepseek-v4.1-flash", "glm-5.3-flash"}:
         return ["text"]
     return ["text", "image"]
 
@@ -2952,6 +2956,9 @@ def channel_doctor(
     "--storage-mount-path", default=None, help="PVC 挂载目录（默认: /home/node/.openclaw）"
 )
 @click.option("--no-storage", is_flag=True, help="禁用默认 PVC 挂载")
+@click.option("--skill-space-id", "skill_space_ids", multiple=True, help="Skill 中心空间 ID（可重复传入多个）")
+@click.option("--sandbox-template-id", default=None, help="沙箱模板 ID（启用 E2B 沙箱执行 execute_skills）")
+@click.option("--sandbox-api-key", default=None, help="沙箱 API Key（可选，默认从服务端注入）")
 @click.option(
     "--agent-id",
     "agent_id_opt",
@@ -2987,6 +2994,9 @@ def deploy(
     subnet_id: Optional[str],
     security_group_id: Optional[str],
     availability_zone: Optional[str],
+    skill_space_ids: tuple[str, ...],
+    sandbox_template_id: Optional[str],
+    sandbox_api_key: Optional[str],
     dry_run: bool,
 ):
     """部署 OpenClaw 到云端
@@ -3052,6 +3062,9 @@ def deploy(
                 mem0_region=mem0_region,
                 extra_env=extra_env,
                 env_file=env_file,
+                skill_space_ids=skill_space_ids,
+                sandbox_template_id=sandbox_template_id,
+                sandbox_api_key=sandbox_api_key,
                 storage_size_gi=storage_size_gi,
                 storage_mount_path=storage_mount_path,
                 no_storage=no_storage,
@@ -3101,6 +3114,9 @@ async def _deploy_openclaw(
     subnet_id: Optional[str] = None,
     security_group_id: Optional[str] = None,
     availability_zone: Optional[str] = None,
+    skill_space_ids: tuple[str, ...] = (),
+    sandbox_template_id: str | None = None,
+    sandbox_api_key: str | None = None,
     dry_run: bool,
 ):
     """异步部署 OpenClaw"""
@@ -3233,6 +3249,13 @@ async def _deploy_openclaw(
         "auth_type": "None",
         "inbound_identity_auth": "None",
     }
+    component_config = build_component_config(
+        skill_space_ids=skill_space_ids,
+        sandbox_template_id=sandbox_template_id,
+        sandbox_api_key=sandbox_api_key,
+    )
+    if component_config:
+        request_data["component_config"] = component_config
     if memory_config:
         request_data["memory_config"] = memory_config
     storage_config = build_storage_config(
@@ -3307,6 +3330,7 @@ async def _deploy_openclaw(
                     network_payload=network_payload,
                     include_env=include_env_on_update,
                     include_storage=include_storage_on_update,
+                    component_config=component_config,
                 )
                 await client.update_agent(existing_agent_id, update_payload)
             else:
@@ -3364,6 +3388,7 @@ async def _deploy_openclaw(
                         network_payload=network_payload,
                         include_env=include_env_on_update,
                         include_storage=include_storage_on_update,
+                        component_config=component_config,
                     )
                     res = await client.update_agent(existing_agent_id, update_payload)
                     agent_id = existing_agent_id