agentengine-sdk-python 0.8.4__py3-none-any.whl → 0.8.6__py3-none-any.whl

ksadk/plugins/providers/harness_tools.py

@@ -0,0 +1,455 @@
+"""Provider-owned execution of locked Python and SDK builtin tools."""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import json
+import os
+import re
+import signal
+import sqlite3
+import sys
+from collections.abc import Mapping
+from pathlib import Path
+from typing import Any
+
+from ksadk.harness.tool_output import publish_tool_output
+from ksadk.harness.tools import HarnessTool
+
+LOCKED_PYTHON_EXECUTION_POLICY_DIGEST = (
+    "sha256:" + hashlib.sha256(b"ksadk.python-source-bytes/v1").hexdigest()
+)
+
+
+def python_tool_bundle_path(digest: str) -> Path:
+    if not re.fullmatch(r"sha256:[0-9a-f]{64}", digest):
+        raise ValueError("Python Tool requires a locked source SHA-256")
+    return Path("capabilities/tools") / f"{digest[7:]}.py"
+
+
+_EXECUTE = """
+import asyncio, contextlib, hashlib, importlib.util, inspect, json, sys
+from pathlib import Path
+path, name, expected_digest = sys.argv[1:]
+with contextlib.redirect_stdout(sys.stderr):
+    arguments = json.load(sys.stdin)
+    source = None
+    try:
+        pinned_path = Path(path)
+        if pinned_path.resolve(strict=True) == pinned_path:
+            source = pinned_path.read_bytes()
+    except (OSError, ValueError):
+        pass
+    if source is None or 'sha256:' + hashlib.sha256(source).hexdigest() != expected_digest:
+        result = {'version': 'ksadk.python-source-bytes/v1', 'status': 'source_rejected'}
+    else:
+        spec = importlib.util.spec_from_file_location('locked_tool', path)
+        module = importlib.util.module_from_spec(spec)
+        # Compile exactly the verified bytes. SourceFileLoader may read a .pyc
+        # even with -B, or reopen a changed path after the digest check.
+        exec(compile(source, path, 'exec'), module.__dict__)
+        value = getattr(module, name)(**arguments)
+        if inspect.isawaitable(value):
+            value = asyncio.run(value)
+        result = {'version': 'ksadk.python-source-bytes/v1', 'status': 'ok', 'value': value}
+print(json.dumps(result, ensure_ascii=False))
+"""
+
+_EXECUTE_BUILTIN = """
+import contextlib, json, sqlite3, sys, threading
+from dataclasses import asdict
+wire_stdout = sys.stdout
+output_bytes = 0
+output_lock = threading.Lock()
+sys.path.insert(0, sys.argv[1])
+with contextlib.redirect_stdout(sys.stderr):
+    from pathlib import Path
+    from ksadk.toolsets import get_agentengine_tools
+    import ksadk.toolsets.platform as platform
+    import ksadk.toolsets.sandbox as sandbox
+    import ksadk.toolsets.workspace as workspace
+    import ksadk.toolsets.workspace_state as state
+    from ksadk.toolsets.workspace_read_budget import SourceReadBudget, source_read_budget_scope
+    from ksadk.harness.tool_output import tool_output_scope
+    resolved_workspace_root = lambda: Path(sys.argv[2])
+    # Builtin modules import workspace_root by value. Patch every consumer so
+    # file tools, status tools, and command execution share the exact policy
+    # root passed by the managed provider.
+    workspace.workspace_root = resolved_workspace_root
+    platform.workspace_root = resolved_workspace_root
+    sandbox.workspace_root = resolved_workspace_root
+    tool = get_agentengine_tools(include=[sys.argv[3]], mode='direct')[0]
+    arguments = json.load(sys.stdin)
+    source_budget = SourceReadBudget.from_transport(json.loads(sys.argv[6]))
+
+    def public_output(channel, text):
+        global output_bytes
+        if sys.argv[3] != 'run_command' or channel not in {'stdout', 'stderr'}:
+            return
+        with output_lock:
+            text = str(text)[:max(0, 32768 - output_bytes)]
+            output_bytes += len(text)
+            for offset in range(0, len(text), 4096):
+                print('KSADK_PUBLIC_OUTPUT:' + json.dumps(
+                    {'channel': channel, 'text': text[offset:offset + 4096]},
+                    ensure_ascii=False), file=wire_stdout, flush=True)
+
+    def invoke_builtin():
+        with source_read_budget_scope(source_budget), tool_output_scope(public_output):
+            return tool.invoke(arguments) if hasattr(tool, 'invoke') else tool(**arguments)
+
+    # File observations and mutations share the persistent revision guard.
+    # Commands, searches, listings and unrelated tools do not consume it and
+    # must not hold its write transaction throughout their execution.
+    stateful = sys.argv[3] in {
+        'read_workspace_file', 'write_workspace_file', 'write_workspace_files',
+        'edit_workspace_file', 'multi_edit_workspace_file', 'delete_workspace_file',
+    }
+    if stateful:
+        db_path = Path(sys.argv[4])
+        db_path.parent.mkdir(parents=True, exist_ok=True)
+        with sqlite3.connect(db_path, timeout=10) as db:
+            db.execute('CREATE TABLE IF NOT EXISTS reads (session TEXT PRIMARY KEY, data TEXT)')
+            db.execute('BEGIN IMMEDIATE')
+            row = db.execute('SELECT data FROM reads WHERE session=?', (sys.argv[5],)).fetchone()
+            if row:
+                for item in json.loads(row[0]):
+                    state.record_read_state(state.WorkspaceReadState(**item))
+            value = invoke_builtin()
+            snapshot = [asdict(item) for item in state._READ_STATE.values()]
+            db.execute('INSERT OR REPLACE INTO reads VALUES (?, ?)',
+                       (sys.argv[5], json.dumps(snapshot)))
+    else:
+        value = invoke_builtin()
+print(json.dumps(value, ensure_ascii=False))
+"""
+
+
+def _supervised_script(script: str) -> str:
+    """Stop the owned process group if its supervisor dies, including SIGKILL.
+
+    Cooperative cleanup in the parent cannot run after a hard kill. This is
+    lifecycle cleanup for trusted host tools, not a sandbox or an undo promise.
+    """
+    return f"""
+import os, signal, threading, time
+_supervisor_pid = {os.getpid()}
+def _check_supervisor():
+    if os.getppid() != _supervisor_pid:
+        os.killpg(os.getpgrp(), signal.SIGKILL)
+def _watch_supervisor():
+    while True:
+        _check_supervisor()
+        time.sleep(0.05)
+_check_supervisor()
+threading.Thread(target=_watch_supervisor, daemon=True).start()
+""" + script
+
+
+def validate_tool_executor(contract: Mapping[str, Any]) -> dict[str, Any] | None:
+    """Validate the same executor contract at build time and provider activation."""
+    name = str(contract.get("name", ""))
+    executor = contract.get("executor", "builtin")
+    if executor == "python":
+        return None
+    if executor != "builtin":
+        raise ValueError(
+            f"Tool {name} 的执行类型 {executor} 尚不支持直接绑定到 KsADK Harness；"
+            "MCP 工具请通过 MCP Server 绑定，延迟工具请绑定具体工具。"
+        )
+    # Unrestricted dispatchers can reach tools outside the Agent's locked bindings.
+    from ksadk.toolsets import META_DISPATCHER_TOOL_NAMES
+
+    if name in META_DISPATCHER_TOOL_NAMES:
+        raise ValueError(f"Tool {name} 不能绕过绑定范围；请绑定需要执行的具体工具")
+    from ksadk.toolsets import describe_agentengine_tools
+
+    try:
+        descriptors = describe_agentengine_tools(include=[name], mode="direct")
+    except ValueError as exc:
+        raise ValueError(f"Tool {name} 没有可用的 SDK 内置实现") from exc
+    if len(descriptors) != 1 or descriptors[0]["name"] != name:
+        raise ValueError(f"Tool {name} 必须引用具体工具，不能引用工具组")
+    if not descriptors[0].get("enabled", True):
+        raise ValueError(f"Tool {name} 的执行后端尚未配置，请配置后端或取消绑定")
+    return descriptors[0]
+
+
+def _plain(value: Any) -> Any:
+    if isinstance(value, Mapping):
+        return {key: _plain(item) for key, item in value.items()}
+    if isinstance(value, (list, tuple)):
+        return [_plain(item) for item in value]
+    return value
+
+
+def _resolved_agent_id(resolved: Mapping[str, Any]) -> str:
+    """Read the canonical Agent id from a compiled resolved spec.
+
+    Current bundles store it as the top-level ``agentId``.  Keep the legacy
+    metadata fallback for older hand-authored fixtures and bundles, but never
+    assume that a source-draft metadata object survives compilation.
+    """
+    direct = str(resolved.get("agentId") or "").strip()
+    if direct:
+        return direct
+    metadata = resolved.get("metadata")
+    if isinstance(metadata, Mapping):
+        return str(metadata.get("id") or "").strip()
+    return ""
+
+
+def _reserve_tool_call(
+    *,
+    database: Path,
+    run_id: str,
+    tool_name: str,
+    limit: int,
+) -> int:
+    """Atomically reserve a bounded Tool call before any side effect starts."""
+    if not run_id:
+        raise RuntimeError(
+            f"Tool {tool_name} has a per-run limit but the runtime did not provide a run id"
+        )
+    database.parent.mkdir(parents=True, exist_ok=True)
+    with sqlite3.connect(database, timeout=10) as db:
+        db.execute(
+            "CREATE TABLE IF NOT EXISTS tool_call_quotas ("
+            "run_id TEXT NOT NULL, tool_name TEXT NOT NULL, calls INTEGER NOT NULL, "
+            "PRIMARY KEY (run_id, tool_name))"
+        )
+        db.execute("BEGIN IMMEDIATE")
+        row = db.execute(
+            "SELECT calls FROM tool_call_quotas WHERE run_id=? AND tool_name=?",
+            (run_id, tool_name),
+        ).fetchone()
+        calls = int(row[0]) if row else 0
+        if calls >= limit:
+            raise RuntimeError(
+                f"Tool {tool_name} reached its hard per-run limit of {limit}; "
+                "do not retry it and finish with the evidence already collected"
+            )
+        calls += 1
+        db.execute(
+            "INSERT INTO tool_call_quotas(run_id, tool_name, calls) VALUES (?, ?, ?) "
+            "ON CONFLICT(run_id, tool_name) DO UPDATE SET calls=excluded.calls",
+            (run_id, tool_name, calls),
+        )
+    return calls
+
+
+def assemble_python_tools(
+    root: Path, resolved: dict[str, Any], *, workspace_root: Path | None = None,
+    mcp_server_names: frozenset[str] = frozenset(),
+):
+    """Load descriptors only; source code runs after the engine's approval gate."""
+    tools: dict[str, HarnessTool] = {}
+    approvals: set[str] = set()
+    granted = set(resolved.get("security", {}).get("allowedPermissions", []))
+    bound_mcp = {
+        item.get("name") for item in resolved.get("capabilities", {}).get("mcpServers", ())
+        if item.get("enabled", True)
+    }
+    for contract in resolved.get("capabilities", {}).get("tools", []):
+        contract = _plain(contract)
+        if not contract.get("enabled", True):
+            continue
+        if (
+            contract.get("executor") == "mcp"
+            and contract.get("mcpServer") in bound_mcp & mcp_server_names
+        ):
+            # Executed by the projected MCP runtime, never by the host Python dispatcher.
+            continue
+        descriptor = validate_tool_executor(contract)
+        if descriptor is None and "process:host-user" not in granted:
+            raise ValueError("Python Tool requires explicit host execution permission")
+        if set(contract.get("permissions", [])) - granted:
+            raise ValueError("Python Tool requests permissions not granted by this Agent")
+        path = None
+        if descriptor is None:
+            digest = str(contract.get("sourceSha256") or "")
+            path = (root / python_tool_bundle_path(digest)).resolve()
+            if not path.is_relative_to(root.resolve()) or not path.is_file():
+                raise ValueError("Python Tool source is missing from the locked Bundle")
+            if "sha256:" + hashlib.sha256(path.read_bytes()).hexdigest() != digest:
+                raise ValueError("Python Tool source digest mismatch")
+        name = str(contract["name"])
+        if name in tools:
+            raise ValueError("Duplicate Python Tool name")
+        if (
+            contract.get("approval") != "never"
+            or contract.get("sideEffect")
+            in {
+                "write",
+                "external",
+            }
+            or (
+                descriptor
+                and (descriptor.get("side_effects") or descriptor.get("requires_approval"))
+            )
+        ):
+            approvals.add(name)
+
+        async def invoke(
+            arguments, call_id, *, path=path, contract=contract, descriptor=descriptor
+        ):
+            del call_id
+            env = {}
+            execution_root = root
+            from ksadk.runtime_context import get_current_tool_execution_context_or_default
+
+            tool_context = get_current_tool_execution_context_or_default()
+            from ksadk.harness.execution_policy import current_execution_policy
+
+            policy = current_execution_policy()
+            policy_root = policy.workspace_root if policy is not None else None
+            writable_root = policy_root or workspace_root or root
+            state_root = (
+                policy.tool_state_root
+                if policy is not None and policy.tool_state_root is not None
+                else writable_root
+            )
+            max_calls = contract.get("maxCallsPerRun")
+            if max_calls is not None:
+                _reserve_tool_call(
+                    database=state_root
+                    / ".harness-tools"
+                    / "state"
+                    / "tool-call-quotas.sqlite",
+                    run_id=tool_context.run_id,
+                    tool_name=str(contract["name"]),
+                    limit=int(max_calls),
+                )
+            if descriptor is None:
+                command = [_EXECUTE, str(path), contract["callableName"], contract["sourceSha256"]]
+            else:
+                from ksadk.toolsets.workspace_identity import identity_workspace_root
+
+                # Trusted SDK code only. Approval is owned by the Managed Loop;
+                # do not ask a second time inside the builtin gateway.
+                execution_root = writable_root.resolve()
+                execution_root.mkdir(parents=True, exist_ok=True)
+                env = dict(
+                    os.environ, KSADK_TOOL_APPROVAL_MODE="full",
+                    KSADK_PROJECT_DIR=str(execution_root),
+                    KSADK_STUDIO_AGENT_ID=_resolved_agent_id(resolved),
+                    AGENTENGINE_UI_DIR=str(state_root / ".harness-tools" / "ui"),
+                )
+                scoped_root = policy_root or identity_workspace_root(
+                    (workspace_root or root) / ".harness-tools" / "workspace"
+                ).resolve()
+                from ksadk.toolsets.workspace_read_budget import current_source_read_budget
+
+                source_budget = (
+                    current_source_read_budget()
+                    if contract["name"] == "read_workspace_file" else None
+                )
+                command = [
+                    _EXECUTE_BUILTIN,
+                    str(Path(__file__).resolve().parents[3]),
+                    str(scoped_root),
+                    contract["name"],
+                    str(
+                        state_root
+                        / ".harness-tools"
+                        / "state"
+                        / (hashlib.sha256(str(scoped_root).encode()).hexdigest() + ".sqlite")
+                    ),
+                    tool_context.session_id or "default",
+                    json.dumps(source_budget.transport() if source_budget is not None else None),
+                ]
+            process = await asyncio.create_subprocess_exec(
+                sys.executable,
+                "-B",
+                "-I",
+                "-c",
+                _supervised_script(command[0]),
+                *command[1:],
+                stdin=asyncio.subprocess.PIPE,
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.DEVNULL,
+                cwd=execution_root,
+                env=env,
+                start_new_session=True,
+            )
+            async def consume_output():
+                    process.stdin.write(json.dumps(arguments).encode())
+                    await process.stdin.drain()
+                    process.stdin.close()
+                    output = bytearray()
+                    pending = bytearray()
+                    allow_progress = descriptor is not None and contract["name"] == "run_command"
+                    prefix = b'KSADK_PUBLIC_OUTPUT:'
+                    while chunk := await process.stdout.read(65536):
+                        pending.extend(chunk)
+                        while b'\n' in pending:
+                            line, _, tail = pending.partition(b'\n')
+                            pending = bytearray(tail)
+                            if allow_progress and line.startswith(prefix):
+                                progress = json.loads(line[len(prefix):])
+                                publish_tool_output(progress.get('channel'), progress.get('text'))
+                            else:
+                                output.extend(line + b'\n')
+                        if len(output) + len(pending) > 1_048_576:
+                            raise ValueError("Tool 输出超过 1 MiB 限制")
+                    output.extend(pending)
+                    await process.wait()
+                    if process.returncode:
+                        raise RuntimeError(
+                            f"Tool {contract['name']} 执行失败，请检查参数与运行环境"
+                        )
+                    value = json.loads(output)
+                    if descriptor is None:
+                        if (
+                            not isinstance(value, dict)
+                            or value.get("version") != "ksadk.python-source-bytes/v1"
+                        ):
+                            raise RuntimeError("Locked Python worker returned an invalid protocol")
+                        if value.get("status") == "source_rejected":
+                            return {
+                                "ok": False,
+                                "error_type": "tool_source_integrity",
+                                "error_message": (
+                                    "Locked Python Tool source is unavailable or changed"
+                                ),
+                            }
+                        if value.get("status") != "ok" or "value" not in value:
+                            raise RuntimeError("Locked Python worker returned an invalid protocol")
+                        return value["value"]
+                    return value
+            completed = False
+            try:
+                result = await asyncio.wait_for(
+                    consume_output(), timeout=contract.get("timeoutSeconds", 20)
+                )
+                completed = True
+                return result
+            finally:
+                # An exited group leader can leave descendants holding stdout
+                # and performing writes. A failed/cancelled foreground call
+                # retains cleanup ownership until its group has been stopped.
+                if not completed or process.returncode is None:
+                    try:
+                        os.killpg(process.pid, signal.SIGKILL)
+                    except ProcessLookupError:
+                        # Natural exit must not replace the original error or
+                        # cancellation with an unrelated cleanup exception.
+                        pass
+                await process.wait()
+
+        tools[name] = HarnessTool(
+            name=name,
+            description=(
+                str(contract.get("description", ""))
+                + (
+                    f" Hard limit: at most {int(contract['maxCallsPerRun'])} calls per run."
+                    if contract.get("maxCallsPerRun") is not None
+                    else ""
+                )
+            ),
+            parameters=contract.get("inputSchema", {}),
+            handler=invoke,
+            source="sdk-builtin" if descriptor else "locked-python",
+        )
+    return tools, approvals

ksadk/plugins/providers/legacy_catalog.py

@@ -46,7 +46,7 @@ def _provider_manifest(
         "compatibility": {
             "kernelApi": ">=1,<2",
             "runtimeProtocols": ["agentkit.runtime/v1"],
-            "python": ">=3.10,<3.15" if runtime == "python" else None,
+            "python": ">=3.12,<3.15" if runtime == "python" else None,
         },
         "healthContract": "plugin.health/v1",
         "provenance": {

ksadk/plugins/providers/mcp_projection.py

@@ -3,9 +3,9 @@
 from __future__ import annotations
 
 import asyncio
-from collections.abc import Awaitable, Sequence
+from collections.abc import Awaitable, Callable, Sequence
 from contextlib import AsyncExitStack
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from typing import Protocol, runtime_checkable
 
 from ksadk.harness.config import McpToolSpec
@@ -46,6 +46,22 @@ class ReleasableStaticMCPSource(Protocol):
     async def release_harness_mcp_specs(self, specs: Sequence[McpToolSpec]) -> None: ...
 
 
+@dataclass(frozen=True)
+class MCPResourcePin:
+    name: str
+    generation: str
+    descriptor_digest: str
+
+
+@dataclass(frozen=True)
+class MCPRuntimeCredential:
+    """Ephemeral host callbacks; never part of a spec, lock or Run snapshot."""
+
+    name: str
+    token: Callable[[], Awaitable[str]] = field(repr=False)
+    available: Callable[[], Awaitable[bool]] = field(repr=False)
+
+
 @dataclass
 class MCPProjectionLease:
     """Projected connector specs and their activation-owned cleanup."""
@@ -53,7 +69,35 @@ class MCPProjectionLease:
     specs: tuple[McpToolSpec, ...]
     owners: tuple[str, ...]
     _cleanup: AsyncExitStack
+    _checks: tuple[Callable[[], Awaitable[bool]], ...] = ()
+    _activation_available: Callable[[], bool] | None = None
+    resource_pins: tuple[MCPResourcePin, ...] = ()
     _close_task: asyncio.Task[None] | None = None
+    runtime_credentials: tuple[MCPRuntimeCredential, ...] = ()
+    _runtime_checks: tuple[Callable[[], Awaitable[bool]], ...] = ()
+
+    async def available(self) -> bool:
+        """Check original owners; never replace specs with a newer lease."""
+        return await self._available(self._checks)
+
+    async def runtime_available(self) -> bool:
+        """Admit only clients explicitly consuming owned runtime credentials."""
+        return await self._available(self._runtime_checks or self._checks)
+
+    async def _available(self, checks: tuple[Callable[[], Awaitable[bool]], ...]) -> bool:
+        if self._close_task is not None:
+            return False
+        try:
+            if self._activation_available is not None and not self._activation_available():
+                return False
+            for check in checks:
+                if await check() is not True:
+                    return False
+            return self._close_task is None and (
+                self._activation_available is None or self._activation_available() is True
+            )
+        except Exception:
+            return False
 
     async def aclose(self) -> None:
         if self._close_task is None:
@@ -86,6 +130,10 @@ async def project_mcp_capabilities(
     cleanup = AsyncExitStack()
     specs: list[McpToolSpec] = []
     owners: list[str] = []
+    checks: list[Callable[[], Awaitable[bool]]] = []
+    runtime_checks: list[Callable[[], Awaitable[bool]]] = []
+    runtime_credentials: list[MCPRuntimeCredential] = []
+    resource_pins: list[MCPResourcePin] = []
     names: set[str] = set()
     try:
         for binding in capabilities.all("mcp.connector/v1"):
@@ -120,6 +168,46 @@ async def project_mcp_capabilities(
                     "mcp_capability_incompatible",
                     f"plugin {binding.plugin_id} cannot project MCP connector config",
                 )
+            lease_check = getattr(runtime, "activation_mcp_specs_available", None)
+            if callable(lease_check):
+
+                async def check(source=runtime, selected=projected_specs):
+                    return await source.activation_mcp_specs_available(selected)
+
+                checks.append(check)
+            else:
+                checks.append(runtime.health)
+            credentials = getattr(runtime, "activation_mcp_runtime_credentials", None)
+            selected_credentials = (
+                tuple(credentials(projected_specs)) if callable(credentials) else ()
+            )
+            if any(
+                not isinstance(item, MCPRuntimeCredential)
+                or item.name not in {spec.name for spec in projected_specs}
+                for item in selected_credentials
+            ) or len({item.name for item in selected_credentials}) != len(selected_credentials):
+                raise PluginHostError("mcp_credential_invalid", "invalid MCP runtime credential")
+            if selected_credentials and {item.name for item in selected_credentials} != {
+                spec.name for spec in projected_specs
+            }:
+                raise PluginHostError(
+                    "mcp_credential_invalid", "partial MCP runtime credential ownership"
+                )
+            runtime_credentials.extend(selected_credentials)
+            runtime_checks.extend(item.available for item in selected_credentials)
+            # A connector with no rotating credential keeps its original probe.
+            if not selected_credentials:
+                runtime_checks.append(checks[-1])
+            resource_refs = getattr(runtime, "activation_mcp_resource_pins", None)
+            if callable(resource_refs):
+                selected_pins = tuple(resource_refs(projected_specs))
+                if any(
+                    not isinstance(pin, MCPResourcePin)
+                    or pin.name not in {spec.name for spec in projected_specs}
+                    for pin in selected_pins
+                ):
+                    raise PluginHostError("mcp_resource_pin_invalid", "invalid MCP resource pin")
+                resource_pins.extend(selected_pins)
             for spec in projected_specs:
                 if not isinstance(spec, McpToolSpec) or not spec.name.strip():
                     raise PluginHostError(
@@ -138,7 +226,16 @@ async def project_mcp_capabilities(
         close = asyncio.create_task(cleanup.aclose())
         await _finish_owned_task(close)
         raise
-    return MCPProjectionLease(tuple(specs), tuple(owners), cleanup)
+    return MCPProjectionLease(
+        tuple(specs),
+        tuple(owners),
+        cleanup,
+        tuple(checks),
+        capabilities.activation_available,
+        tuple(resource_pins),
+        runtime_credentials=tuple(runtime_credentials),
+        _runtime_checks=tuple(runtime_checks),
+    )
 
 
 __all__ = [

ksadk/plugins/providers/platform_resources.py

@@ -99,7 +99,7 @@ def platform_resource_mcp_manifest() -> PluginManifest:
                     "compatibility": {
                         "kernelApi": ">=1,<2",
                         "runtimeProtocols": ["agentkit.runtime/v1", "2025-06-18"],
-                        "python": ">=3.10,<3.15",
+                        "python": ">=3.12,<3.15",
                     },
                     "healthContract": "plugin.health/v1",
                     "provenance": {
@@ -126,8 +126,9 @@ def _activation_operations(
 ) -> tuple[str, ...]:
     """Narrow an admitted maximum to the immutable Agent memory policy."""
 
-    read_operations = tuple(operation for operation in allowed if operation != "save_memory")
-    if "save_memory" not in allowed or write_authorizer is None:
+    write_operations = {"save_memory", "update_memory", "delete_memory"}
+    read_operations = tuple(operation for operation in allowed if operation not in write_operations)
+    if not write_operations.intersection(allowed) or write_authorizer is None:
         return tuple(operation for operation in read_operations if operation != "memory_status")
     resolved = bundle.resolved_agent_spec
     memory = resolved.get("memory") if isinstance(resolved, Mapping) else None
@@ -144,9 +145,18 @@ def _activation_operations(
         or str(rollout.get("memoryWrite") or "off") != "enabled"
     ):
         return tuple(operation for operation in read_operations if operation != "memory_status")
-    return tuple(operation for operation in allowed if operation in {
-        "load_memory", "save_memory", "memory_status",
-    })
+    return tuple(
+        operation
+        for operation in allowed
+        if operation
+        in {
+            "load_memory",
+            "save_memory",
+            "update_memory",
+            "delete_memory",
+            "memory_status",
+        }
+    )
 
 
 def _profile_config(profile: CompositionProfile) -> Mapping[str, Any]:

ksadk/plugins/providers/shipped_dsh.py

@@ -145,7 +145,10 @@ def shipped_dsh_host_command(
     executable = str(python_executable or sys.executable).strip()
     if not executable or "\x00" in executable:
         raise PluginHostError(spec.error_code("host_invalid"), "Python host executable is invalid")
-    return executable, "-m", "ksadk.plugins.providers.dsh_descriptor_host", spec.key
+    # The descriptor host is launched as a child of the signed desktop
+    # runtime.  ``-B`` keeps Python from creating __pycache__ files inside the
+    # app bundle (which would invalidate its code signature after launch).
+    return executable, "-B", "-m", "ksadk.plugins.providers.dsh_descriptor_host", spec.key
 
 
 class _ExecutionRuntime(Protocol):