agentengine-sdk-python 0.8.4__py3-none-any.whl → 0.8.6__py3-none-any.whl

ksadk/builders/container_builder.py

@@ -561,45 +561,27 @@ runtime_context = RuntimeLaunchContext(
     detection=detection_result,
     config=dict(runtime_build_config),
 )
-# managed A2A:KSADK_A2A_RUNTIME_ID 非空时挂 discovery card + 完整数据面 route。
-# discovery card 让 server 探测；数据面 route 让 gateway 转发的 JSON-RPC/REST
-# 能真正落到本 runtime 的 A2A 协议端点（路线 C 直连）。
-_managed_a2a_card = None
-_a2a_config = None
+# Runtime identity is available before registration for discovery.  Operator
+# enables the complete composition only after every Secret projection exists.
+_managed_a2a_bootstrap = None
 _a2a_adapter = None
 if os.environ.get("KSADK_A2A_RUNTIME_ID", "").strip():
-    from ksadk.managed_a2a_card import build_managed_a2a_card_if_configured
-
-    _managed_a2a_card = build_managed_a2a_card_if_configured()
-    try:
-        from ksadk.a2a.routes import A2AConfig
+    if os.environ.get("KSADK_A2A_MANAGED_BOOTSTRAP_ENABLED", "").strip().lower() == "true":
+        from ksadk.a2a.platform import build_managed_a2a_bootstrap_from_env
         from ksadk.runtime.factory import create_runtime_adapter
 
         _a2a_adapter = create_runtime_adapter(runtime_context)
-        _base = (
-            os.environ.get("KSADK_A2A_INTERNAL_BASE_URL", "").strip()
-            or "http://localhost:8080"
-        )
-        _a2a_config = A2AConfig(
-            enabled=True,
-            base_url=_base,
-            agent_name=(
-                os.environ.get("KSADK_A2A_AGENT_NAME", "").strip()
-                or os.environ.get("KSADK_A2A_RUNTIME_ID", "").strip()
-            ),
-            streaming=True,
-            task_store_dsn="sqlite+aiosqlite:///.agentengine/a2a_tasks.db",
-        )
-    except Exception as _e:
-        logger.warning(f"managed A2A 数据面装配失败,回退 discovery-only: {{_e}}")
-        _a2a_config = None
-        _a2a_adapter = None
+        _managed_a2a_bootstrap = build_managed_a2a_bootstrap_from_env()
+    else:
+        from ksadk.managed_a2a_card import build_managed_a2a_card_if_configured
+
+        _managed_a2a_bootstrap = build_managed_a2a_card_if_configured()
 app = create_runtime_app(
     RuntimeAppConfig(
         runtime_type=detection_result.type.value,
         runtime_executor=RuntimeExecutor(build_default_runtime_registry()),
         launch_context=runtime_context,
-        a2a=_a2a_config or _managed_a2a_card,
+        a2a=_managed_a2a_bootstrap,
         a2a_runtime_adapter=_a2a_adapter,
     ),
     configure_runtime_app,

ksadk/builders/framework_requirements.py

@@ -19,12 +19,28 @@ LANGCHAIN_ECOSYSTEM_REQUIREMENTS = (
     "langchain-openai>=1.4.0,<2.0.0",
     "langchain-core>=1.5.0,<2.0.0",
     "langgraph>=1.2.0,<1.3.0",
+    # Plain Code runtimes use the local SQLite checkpoint backend by default.
+    "langgraph-checkpoint-sqlite>=2.0.0",
 )
 
 DEEPAGENTS_REQUIREMENTS = ("deepagents>=0.6.2,<1.0.0",)
 
-# codex runtime:openai-codex SDK(自带 codex CLI 二进制,见 PyPI cli-bin wheel)
-CODEX_REQUIREMENTS = ("openai-codex==0.144.4",)
+# codex runtime:openai-codex SDK(自带 codex CLI 二进制,见 PyPI cli-bin wheel)。
+# 版本必须与 pyproject.toml 的 ksadk[codex] extra 保持一致:适配层
+# (ksadk/codex/client.py)依赖 app-server 私有协议,SDK/CLI 是精确 co-pin。
+CODEX_REQUIREMENTS = ("openai-codex==0.154.0",)
+
+# KsADK Harness is a managed LangGraph runtime.  Keep its checkpoint adapter
+# explicit: LangGraph split the SQLite saver into a separately distributed
+# package, so installing only ``langgraph`` leaves
+# ``langgraph.checkpoint.sqlite`` unavailable in a freshly built agent.
+HARNESS_REQUIREMENTS = (
+    "langgraph>=1.2.0,<1.3.0",
+    "langgraph-checkpoint-sqlite>=2.0.0",
+    "langchain>=1.3.14,<2.0.0",
+    "langchain-core>=1.5.0,<2.0.0",
+    "langchain-openai>=1.4.0,<2.0.0",
+)
 
 
 def code_requirements_for_framework(framework: str) -> list[str]:
@@ -46,6 +62,8 @@ def requirements_for_framework(framework: str) -> list[str]:
         return list(ADK_REQUIREMENTS)
     if normalized == "codex":
         return list(CODEX_REQUIREMENTS)
+    if normalized == "harness":
+        return list(HARNESS_REQUIREMENTS)
     if normalized in {"langchain", "langgraph", "deepagents"}:
         requirements = list(LANGCHAIN_ECOSYSTEM_REQUIREMENTS)
         if normalized == "deepagents":
@@ -61,6 +79,8 @@ def minimal_requirements_for_framework(framework: str) -> list[str]:
         return list(ADK_REQUIREMENTS)
     if normalized == "codex":
         return list(CODEX_REQUIREMENTS)
+    if normalized == "harness":
+        return list(HARNESS_REQUIREMENTS)
     if normalized in {"langchain", "langgraph", "deepagents"}:
         requirements = [
             "langchain>=1.3.14,<2.0.0",

ksadk/builders/managed_runtime_builder.py

@@ -28,6 +28,7 @@ _MANIFEST_KEYS = (
     "skills",
     "mcp_servers",
     "plugins",
+    "remote_agents",
     "sandbox",
     "approval_mode",
     "context",
@@ -163,6 +164,17 @@ class ManagedRuntimeBuilder(BaseBuilder):
         runtime_name = str(runtime.get("name") or "").strip().lower()
         if runtime_name != "codex":
             return "当前 ManagedRuntime v1 仅支持 runtime.name: codex"
+        if "remoteAgents" in config:
+            return "ManagedRuntime YAML 请使用 remote_agents 字段，不能静默忽略 remoteAgents"
+        if "remote_agents" in config:
+            from ksadk.plugins.host import PluginHostError
+            from ksadk.plugins.providers.codex import _bundle_a2a_experts
+            try:
+                _bundle_a2a_experts(config)
+            except (ValueError, PluginHostError):
+                # Validation errors can include authored input. Keep the CLI
+                # failure deterministic without echoing manifest data.
+                return "A2A_EXPERT_BINDING_INVALID: 请检查固定绑定、调用方式和执行策略"
         return None
 
     @staticmethod

ksadk/builders/source_provenance.py

@@ -0,0 +1,87 @@
+"""Collect immutable source and installed-package provenance."""
+
+from __future__ import annotations
+
+import importlib.metadata as importlib_metadata
+import json
+import subprocess
+from pathlib import Path
+from typing import Any, Optional
+
+
+def _git_provenance(start: Path) -> Optional[dict]:
+    """返回 start 所在 git 仓库的提交信息;非 git 目录返回 None。"""
+
+    def _git(*args: str) -> Optional[str]:
+        try:
+            proc = subprocess.run(
+                ["git", "-C", str(start), *args],
+                capture_output=True,
+                text=True,
+                timeout=10,
+            )
+        except Exception:
+            return None
+        if proc.returncode != 0:
+            return None
+        return proc.stdout.strip()
+
+    toplevel = _git("rev-parse", "--show-toplevel")
+    if not toplevel:
+        return None
+    commit = _git("rev-parse", "HEAD")
+    branch = _git("rev-parse", "--abbrev-ref", "HEAD")
+    status = _git("status", "--porcelain")
+    return {
+        "repo_root": toplevel,
+        "commit": commit,
+        "branch": branch or None,
+        "dirty": bool(status),
+    }
+
+
+def _package_provenance(package_name: str, package_root: Path, *, git_reader: Any) -> dict:
+    """采集被 vendored 包的安装来源:dist 元信息 / 本地路径 / git 提交。"""
+
+    info: dict[str, Any] = {
+        "source_dir": str(package_root),
+        "dist_version": None,
+        "installer": None,
+        "direct_url": None,
+        "source_type": "unknown",
+        "git": None,
+    }
+    try:
+        dist = importlib_metadata.distribution(package_name)
+    except Exception:
+        dist = None
+    if dist is not None:
+        info["dist_version"] = dist.version
+        installer = (dist.read_text("INSTALLER") or "").strip()
+        info["installer"] = installer or None
+        raw_direct_url = dist.read_text("direct_url.json")
+        if raw_direct_url:
+            try:
+                direct_url = json.loads(raw_direct_url)
+            except ValueError:
+                direct_url = None
+            if isinstance(direct_url, dict):
+                info["direct_url"] = direct_url.get("url")
+                url = str(direct_url.get("url") or "")
+                dir_info = direct_url.get("dir_info") or {}
+                archive_info = direct_url.get("archive_info") or {}
+                if url.startswith("file://"):
+                    if dir_info.get("editable"):
+                        info["source_type"] = "editable-install"
+                    elif url.endswith(".whl"):
+                        info["source_type"] = "local-wheel"
+                    else:
+                        info["source_type"] = "local-path"
+                elif archive_info:
+                    info["source_type"] = "remote-dist"
+    if info["direct_url"] is None and info["dist_version"] is not None:
+        # pip 从 index 安装的常规 dist 通常不写 direct_url.json
+        info["source_type"] = "installed-dist"
+    if info["source_type"] in {"editable-install", "local-path", "unknown"}:
+        info["git"] = git_reader(package_root)
+    return info

ksadk/cli/__init__.py

@@ -354,6 +354,17 @@ def _register_commands():
 
     _add_command_once(cli, web)
 
+    # The desktop shell invokes exactly ``ksadk studio``. Avoid importing the
+    # full command registry (A2A, deploy, eval, etc.) on this hot path: those
+    # optional SDKs are unrelated to Studio and their import warnings used to
+    # obscure the real startup error. This also shortens the time to the first
+    # local health check in Electron.
+    if bool(_argv) and _argv[0] == "studio":
+        from ksadk.cli.cmd_studio import studio
+
+        _add_command_once(cli, studio)
+        return
+
     if _runtime_only:
         # Skip create/deploy/run/managed_runtime imports on the runtime path.
         return
@@ -460,6 +471,31 @@ def _main():
     except ImportError:
         pass
 
+    # Studio and ordinary CLI commands consume the same saved workspace values.
+    from pathlib import Path
+
+    from ksadk.studio.configuration import WorkspaceConfiguration
+    from ksadk.studio.workspace import Workspace
+
+    try:
+        root = Path.cwd()
+        if any(
+            (root / ".agentkit" / name).is_file()
+            for name in ("config.yaml", "settings.yaml", "secrets.env")
+        ):
+            configuration = WorkspaceConfiguration(Workspace(root))
+            effective = configuration.environment()
+            os.environ.update(effective)
+            if (
+                "codexProxy" in configuration.settings()
+                and "KSADK_CODEX_USE_PROXY" not in effective
+            ):
+                os.environ.pop("KSADK_CODEX_USE_PROXY", None)
+    except Exception as error:
+        cli_error = cli_error_from_exception(error, show_help=False)
+        emit_cli_error(cli_error)
+        raise SystemExit(cli_error.exit_code) from None
+
     # 全局配置回退: .env 未设置的变量从 ~/.agentengine/settings.json 补充
     try:
         from ksadk.configs.global_config import get_env_from_global_config

ksadk/cli/cmd_a2a.py

@@ -199,6 +199,49 @@ def register(agent_path: Path, url: str, name: str | None, description: str, ski
     click.echo(MessageToJson(card_obj, indent=2))
 
 
+@a2a.command("register-hosted", context_settings=_HELP)
+@click.option("--agent-id", required=True, help="已通过 deploy 创建的托管运行时 ID")
+@click.option("--space-id", "space_ids", multiple=True, required=True, help="加入的 A2A Space；可重复")
+@click.option("--region", required=True, help="显式选择环境/区域，例如 pre-online")
+def register_hosted(agent_id: str, space_ids: Sequence[str], region: str):
+    """将已部署的 hosted Agent 注册为可被 Space 内其他 Agent 调用的服务。"""
+    from ksadk.api.client import AgentEngineClient
+
+    agent_id, region = agent_id.strip(), region.strip()
+    spaces = list(dict.fromkeys(space.strip() for space in space_ids))
+    if not agent_id or not region or any(not space for space in spaces):
+        raise click.UsageError("agent-id、space-id 和 region 不得为空")
+
+    async def run():
+        client = AgentEngineClient(region=region)
+        try:
+            preview = await client._action_async(
+                "GetAToARuntimeConfig", {"AgentId": agent_id}, preserve_case=True,
+            )
+            card = preview.get("AgentCard")
+            if not isinstance(card, dict) or not card:
+                raise ValueError("Runtime AgentCard unavailable")
+            result = await client._action_async("CreateAToAAgent", {
+                "Source": "hosted", "AgentId": agent_id, "A2ASpaceIds": spaces,
+                "AgentCard": card,
+            })
+        except Exception as exc:
+            # An ambiguous response is not automatically retried: registration
+            # may already exist. Never print private upstream bodies or routes.
+            code = getattr(exc, "code", None)
+            raise click.ClickException(
+                f"Hosted A2A 注册失败（code={code or 'unavailable'}）；请查询注册状态后再重试"
+            ) from None
+        finally:
+            await client.close()
+        click.echo(json.dumps({
+            "a2a_agent_id": result.get("a2_a_agent_id", result.get("A2AAgentId")),
+            "status": result.get("status", result.get("Status")),
+        }, ensure_ascii=False))
+
+    asyncio.run(run())
+
+
 # ---------------------------------------------------------------------------
 # discover / call / status / cancel(Space 内动态发现与调用,经 A2ASpaceClient)
 # ---------------------------------------------------------------------------

ksadk/cli/cmd_build.py

@@ -285,6 +285,15 @@ async def _build_code(
     if not result.success:
         raise validation_error(result.error_message or "构建失败")
 
+    if result.artifact_path is not None:
+        from ksadk.builders.code_builder import _sha256_file, read_code_deployment_contract
+
+        result.metadata["code_checksum"] = _sha256_file(result.artifact_path)
+        contract = read_code_deployment_contract(result.artifact_path)
+        if contract and contract.get("schema") == "ksadk-code-deployment/v1":
+            result.metadata["code_command"] = contract.get("command")
+            result.metadata["code_kernel_contract_digest"] = contract.get("agentKernelContractDigest")
+
     agent_name = result.metadata.get("agent_name", agent_path.name)
 
     # 上传到 KS3

ksadk/cli/cmd_config.py

@@ -184,7 +184,7 @@ def _apply_set_command(
     if not updates_yaml and not updates_env and invalid_items:
         raise usage_error(
             "至少提供一个有效的 KEY=VALUE 配置项。",
-            hints=["示例: `agentengine config set region=cn-beijing-6 OPENAI_MODEL_NAME=glm-5.2`"],
+            hints=["示例: `agentengine config set region=cn-beijing-6 OPENAI_MODEL_NAME=deepseek-v4.1-flash`"],
         )
 
     result = {
@@ -323,7 +323,7 @@ def _run_config_set_command(
     if not set_items:
         raise usage_error(
             "请至少提供一个 KEY=VALUE 配置项。",
-            hints=["示例: `agentengine config set region=cn-beijing-6 OPENAI_MODEL_NAME=glm-5.2`"],
+            hints=["示例: `agentengine config set region=cn-beijing-6 OPENAI_MODEL_NAME=deepseek-v4.1-flash`"],
         )
     return _apply_set_command(set_items, output_path, env_path, is_global)
 
@@ -464,7 +464,7 @@ def run_config_wizard(config_file: str | None, set_items: tuple, is_global: bool
 
     new_env["OPENAI_MODEL_NAME"] = _ask_or_exit(
         questionary.text(
-            "模型名称 (OPENAI_MODEL_NAME) [选填,默认使用金山云星流平台glm-5.2]:",
+            "模型名称 (OPENAI_MODEL_NAME) [选填,默认使用金山云星流平台deepseek-v4.1-flash]:",
             default=existing_env.get("OPENAI_MODEL_NAME", ""),
             style=_questionary_style(),
         )
@@ -784,7 +784,7 @@ def config_set(set_items: tuple, is_global: bool, output_mode: str | None):
     \b
     示例:
       agentengine config set region=cn-beijing-6
-      agentengine config set OPENAI_MODEL_NAME=glm-5.2 OPENAI_BASE_URL=https://example.com/v1
+      agentengine config set OPENAI_MODEL_NAME=deepseek-v4.1-flash OPENAI_BASE_URL=https://example.com/v1
       agentengine config set KSYUN_REGION=cn-beijing-6 --global
     """
     _ = output_mode

ksadk/cli/cmd_create.py

@@ -104,7 +104,7 @@ from google.adk.agents import Agent
 from google.adk.models.lite_llm import LiteLlm
 
 model = LiteLlm(
-    model=f"openai/{{os.getenv('OPENAI_MODEL_NAME', 'glm-5.2')}}",
+    model=f"openai/{{os.getenv('OPENAI_MODEL_NAME', 'deepseek-v4.1-flash')}}",
     api_base=os.getenv("OPENAI_BASE_URL"),
     api_key=os.getenv("OPENAI_API_KEY"),
     stream=True,  # 启用流式输出
@@ -147,7 +147,7 @@ from langchain.agents import create_agent
 from langchain_openai import ChatOpenAI
 
 llm = ChatOpenAI(
-    model=os.getenv("OPENAI_MODEL_NAME", "glm-5.2"),
+    model=os.getenv("OPENAI_MODEL_NAME", "deepseek-v4.1-flash"),
     base_url=os.getenv("OPENAI_BASE_URL"),
     api_key=os.getenv("OPENAI_API_KEY"),
     streaming=True,
@@ -194,7 +194,7 @@ from typing import TypedDict, Annotated
 import operator
 
 llm = ChatOpenAI(
-    model=os.getenv("OPENAI_MODEL_NAME", "glm-5.2"),
+    model=os.getenv("OPENAI_MODEL_NAME", "deepseek-v4.1-flash"),
     base_url=os.getenv("OPENAI_BASE_URL"),
     api_key=os.getenv("OPENAI_API_KEY"),
     streaming=True,
@@ -234,7 +234,7 @@ from deepagents import create_deep_agent
 from langchain_openai import ChatOpenAI
 
 llm = ChatOpenAI(
-    model=os.getenv("OPENAI_MODEL_NAME", "glm-5.2"),
+    model=os.getenv("OPENAI_MODEL_NAME", "deepseek-v4.1-flash"),
     base_url=os.getenv("OPENAI_BASE_URL"),
     api_key=os.getenv("OPENAI_API_KEY"),
     streaming=True,
@@ -671,7 +671,7 @@ def _generate_codex_env_content(global_env: dict) -> str:
         "# 本地 Codex 模型配置（仅用于 ksadk web，不会进入 ManagedRuntime bundle）",
         "# OPENAI_API_KEY=",
         f"OPENAI_BASE_URL={base_url}" if base_url else "# OPENAI_BASE_URL=",
-        f"OPENAI_MODEL_NAME={model_name}" if model_name else "# OPENAI_MODEL_NAME=glm-5.2",
+        f"OPENAI_MODEL_NAME={model_name}" if model_name else "# OPENAI_MODEL_NAME=deepseek-v4.1-flash",
         "",
         "# 可选：自定义上游仅支持 Chat Completions 时，强制启用协议转换代理",
         "# KSADK_CODEX_USE_PROXY=1",
@@ -1601,7 +1601,7 @@ runtime:
   name: codex
 
 # codex 的模型与开发者指令（CodexRuntimeAdapter 传入 codex thread）
-model: glm-5.2
+model: deepseek-v4.1-flash
 prompt: |
   你是 codex 编码助手。简洁回答,能跑命令验证就跑(shell 工具),中文回复。
 """,
@@ -1820,7 +1820,7 @@ KSYUN_REGION={ks_region}
         if model_name:
             env_content += f"OPENAI_MODEL_NAME={model_name}\n"
         else:
-            env_content += "# OPENAI_MODEL_NAME=glm-5.2\n"
+            env_content += "# OPENAI_MODEL_NAME=deepseek-v4.1-flash\n"
     elif framework == "hermes":
         env_content = f"""# ======================
 # Hermes 标准部署最小配置
@@ -1840,7 +1840,7 @@ KSYUN_REGION={ks_region}
         if model_name:
             env_content += f"OPENAI_MODEL_NAME={model_name}\n"
         else:
-            env_content += "# OPENAI_MODEL_NAME=glm-5.2\n"
+            env_content += "# OPENAI_MODEL_NAME=deepseek-v4.1-flash\n"
 
         env_content += """
 # Hermes runtime
@@ -1851,7 +1851,7 @@ HERMES_DASHBOARD_HOST=127.0.0.1
 HERMES_DASHBOARD_PORT=9119
 PORT=8080
 # HERMES_CONTEXT_LENGTH=200000
-# HERMES_FALLBACK_MODEL=deepseek-v4-pro
+# HERMES_FALLBACK_MODEL=glm-5.3-flash
 """
         env_example_content = """# ======================
 # Hermes 标准部署最小配置示例
@@ -1863,7 +1863,7 @@ KSYUN_REGION=cn-beijing-6
 
 OPENAI_API_KEY=your-model-api-key
 OPENAI_BASE_URL=https://kspmas.ksyun.com/v1/
-OPENAI_MODEL_NAME=glm-5.2
+OPENAI_MODEL_NAME=deepseek-v4.1-flash
 
 # Hermes runtime
 API_SERVER_ENABLED=true
@@ -1873,7 +1873,7 @@ HERMES_DASHBOARD_HOST=127.0.0.1
 HERMES_DASHBOARD_PORT=9119
 PORT=8080
 # HERMES_CONTEXT_LENGTH=200000
-# HERMES_FALLBACK_MODEL=deepseek-v4-pro
+# HERMES_FALLBACK_MODEL=glm-5.3-flash
 """
     elif framework == "codex":
         env_content = _generate_codex_env_content(global_env)
@@ -1893,7 +1893,7 @@ PORT=8080
         if model_name:
             env_content += f"OPENAI_MODEL_NAME={model_name}\n"
         else:
-            env_content += "# OPENAI_MODEL_NAME=glm-5.2\n"
+            env_content += "# OPENAI_MODEL_NAME=deepseek-v4.1-flash\n"
 
         env_content += """
 # ======================

ksadk/cli/cmd_deploy.py

@@ -104,6 +104,8 @@ console = get_console()
     default=None,
     help="Serverless 部署模式；默认从 agentengine.yaml 推断",
 )
+@click.option("--a2a-space-id", help="绑定 A2A Space（Serverless）；省略时保留已有绑定")
+@click.option("--a2a-runtime-profile", type=click.Choice(["managed-a2a", "managed-a2a-basic", "managed-a2a-memory"]), help="A2A 能力配置；需同时指定 --a2a-space-id")
 @click.option("--namespace", default="default", help="K8s 命名空间")
 @click.option("--port", "-p", default=8000, help="服务端口 (default: 8000)")
 @click.option("--registry", help="镜像仓库地址 (k8s/serverless Container 模式)")
@@ -148,6 +150,8 @@ def deploy(
     region: str,
     account_id: str,
     artifact_type: str,
+    a2a_space_id: str | None,
+    a2a_runtime_profile: str | None,
     namespace: str,
     port: int,
     registry: str,
@@ -250,6 +254,8 @@ def deploy(
             repackage=repackage,
             dry_run_context=dry_run_context,
             agent_id=agent_id,
+            a2a_space_id=a2a_space_id,
+            a2a_runtime_profile=a2a_runtime_profile,
         ),
         dry_run=dry_run,
         on_dry_run=render_deploy_dry_run,
@@ -326,11 +332,20 @@ async def _deploy_async(
     *,
     repackage: bool = False,
     agent_id: str | None = None,
+    a2a_space_id: str | None = None,
+    a2a_runtime_profile: str | None = None,
 ):
     """异步部署流程"""
     from ksadk.deployment import DeploymentManager, DeployStatus, DeployTarget
     from ksadk.detection import FrameworkDetector
 
+    if a2a_runtime_profile and not a2a_space_id:
+        raise validation_error("--a2a-runtime-profile requires --a2a-space-id")
+    if a2a_space_id is not None:
+        a2a_space_id = a2a_space_id.strip()
+        if target != "serverless" or not a2a_space_id:
+            raise validation_error("--a2a-space-id 需要非空 Space ID，且仅支持 Serverless 部署")
+
     agent_path = Path(agent_dir).resolve()
     config = _load_config(agent_path)
     try:
@@ -385,6 +400,11 @@ async def _deploy_async(
 
     resolved_runtime = None
     if effective_artifact_type == "ManagedRuntime":
+        if image:
+            raise validation_error(
+                "ManagedRuntime 不支持 --image；镜像由服务端 Runtime catalog 选择。"
+                "请通过 runtime.version 指定已登记的运行时版本。"
+            )
         if detection_result.type.value != "codex":
             raise validation_error("ManagedRuntime v1 目前仅支持 framework: codex")
         if ks3_path:
@@ -443,6 +463,8 @@ async def _deploy_async(
             "runtime_name": resolved_runtime.name if resolved_runtime else "",
             "runtime_version": resolved_runtime.version if resolved_runtime else "",
             "agent_id": agent_id,
+            "a2a_space_id": a2a_space_id,
+            "a2a_runtime_profile": a2a_runtime_profile,
         },
     )
 
@@ -611,7 +633,9 @@ async def _deploy_async(
             # CreateAgent callback may still be pending, so presenting it as a
             # completed deployment is misleading (and hides a broken
             # callback/data-plane handoff).
-            if result.status == DeployStatus.RUNNING:
+            if result.metadata.get("update_accepted"):
+                print_info("Agent 更新请求已提交，服务端将在后台执行，请稍后查看 Agent 状态")
+            elif result.status == DeployStatus.RUNNING:
                 print_success("部署成功")
             else:
                 print_info("部署请求已提交，等待实例就绪")
@@ -631,7 +655,8 @@ async def _deploy_async(
                 print_kv("信息", result.message)
 
             # 9. 自动创建版本快照 (仅热更新时，首次部署平台自动创建 v1)
-            is_update = result.message and "已更新" in result.message
+            is_update = (not result.metadata.get("update_accepted")
+                         and result.message and "已更新" in result.message)
             if result.agent_id and is_update and not no_version and not dry_run:
                 from ksadk.cli.deploy_utils import auto_release_version
 

ksadk/cli/cmd_hermes.py

@@ -24,6 +24,7 @@ from ksadk.cli.error_utils import remote_error, resolution_error
 from ksadk.cli.model_catalog import fetch_provider_model_metadata
 from ksadk.cli.network_options import build_network_payload, network_cli_kwargs, network_options
 from ksadk.cli.resource_common import (
+    build_component_config,
     CONTEXT_SETTINGS,
     ResourceActionSet,
     ResourceDescriptor,
@@ -65,8 +66,8 @@ from ksadk.hermes_terminal import (
 )
 
 DEFAULT_HERMES_IMAGE = "ghcr.io/kingsoftcloud/hermes-agent:v2026.7.7.2-ksadk-v070"
-DEFAULT_HERMES_CONTEXT_LENGTHS = (("glm-5.1", "200000"),)
-DEFAULT_HERMES_MODEL_NAME = "glm-5.2"
+DEFAULT_HERMES_CONTEXT_LENGTHS = (("deepseek-v4.1-flash", "128000"),)
+DEFAULT_HERMES_MODEL_NAME = "deepseek-v4.1-flash"
 DEFAULT_HERMES_PUBLIC_BASE_URL = "https://kspmas.ksyun.com/v1/"
 DEFAULT_HERMES_RUNTIME_BASE_URL = DEFAULT_HERMES_PUBLIC_BASE_URL
 KSPMAS_PUBLIC_BASES = (
@@ -163,6 +164,8 @@ def _build_hermes_update_payload(
         update_payload["storage"] = storage_config
     if network_payload:
         update_payload["network"] = network_payload
+    if payload.get("component_config"):
+        update_payload["component_config"] = payload["component_config"]
     return update_payload
 
 
@@ -428,6 +431,9 @@ def _render_hermes_dry_run(
 @click.option("--storage-size-gi", type=int, default=20, show_default=True, help="PVC 容量（Gi）")
 @click.option("--storage-mount-path", default=None, help="PVC 挂载目录（默认: /home/node/.hermes）")
 @click.option("--no-storage", is_flag=True, help="禁用默认 PVC 挂载")
+@click.option("--skill-space-id", "skill_space_ids", multiple=True, help="Skill 中心空间 ID（可重复传入多个）")
+@click.option("--sandbox-template-id", default=None, help="沙箱模板 ID（启用 E2B 沙箱执行 execute_skills）")
+@click.option("--sandbox-api-key", default=None, help="沙箱 API Key（可选，默认从服务端注入）")
 @env_options
 @click.option(
     "--observability/--no-observability",
@@ -468,6 +474,9 @@ def deploy(
     subnet_id: Optional[str],
     security_group_id: Optional[str],
     availability_zone: Optional[str],
+    skill_space_ids: tuple[str, ...],
+    sandbox_template_id: Optional[str],
+    sandbox_api_key: Optional[str],
     dry_run: bool,
     output_mode: str | None,
 ):
@@ -510,6 +519,9 @@ def deploy(
             include_storage_on_update=include_storage_on_update,
             extra_env=extra_env,
             env_file=env_file,
+            skill_space_ids=skill_space_ids,
+            sandbox_template_id=sandbox_template_id,
+            sandbox_api_key=sandbox_api_key,
             **network_cli_kwargs(
                 enable_public_access=enable_public_access,
                 enable_vpc_access=enable_vpc_access,
@@ -551,6 +563,9 @@ async def _deploy_hermes(
     subnet_id: str | None = None,
     security_group_id: str | None = None,
     availability_zone: str | None = None,
+    skill_space_ids: tuple[str, ...] = (),
+    sandbox_template_id: str | None = None,
+    sandbox_api_key: str | None = None,
     dry_run: bool = False,
 ) -> None:
     project_dir = Path(".").resolve()
@@ -606,6 +621,11 @@ async def _deploy_hermes(
         auto_dotenv=auto_dotenv,
         shell_keys=shell_keys,
     )
+    component_config = build_component_config(
+        skill_space_ids=skill_space_ids,
+        sandbox_template_id=sandbox_template_id,
+        sandbox_api_key=sandbox_api_key,
+    )
     payload = {
         "name": agent_name,
         "description": "Hermes Agent (managed by AgentEngine)",
@@ -619,6 +639,8 @@ async def _deploy_hermes(
         "env_vars": env_vars,
         "ui_config": {"profile": "hermes", "path": "/", "url": None},
     }
+    if component_config:
+        payload["component_config"] = component_config
     storage_config = build_storage_config(
         "hermes",
         no_storage=no_storage,