agentengine-sdk-python 0.8.5__py3-none-any.whl → 0.8.6__py3-none-any.whl

ksadk/studio/plugin_runtime_admission.py

@@ -0,0 +1,57 @@
+"""Admission fencing for Studio plugin-runtime maintenance windows."""
+
+from __future__ import annotations
+
+import asyncio
+from collections.abc import Awaitable, Callable
+from typing import TypeVar
+
+from ksadk.plugins.host import PluginHostError
+
+_T = TypeVar("_T")
+
+
+class RuntimeAdmissionGate:
+    """Wait through bounded profile refreshes without admitting stale hosts."""
+
+    def __init__(self) -> None:
+        self._open = True
+        self._ready = asyncio.Event()
+        self._ready.set()
+
+    @property
+    def is_open(self) -> bool:
+        return self._open
+
+    def suspend(self) -> None:
+        self._open = False
+        self._ready.clear()
+
+    def resume(self) -> None:
+        self._open = True
+        self._ready.set()
+
+    def close(self) -> None:
+        self._open = False
+        self._ready.set()
+
+    async def wait(self) -> None:
+        try:
+            await asyncio.wait_for(self._ready.wait(), timeout=60)
+        except TimeoutError as exc:
+            raise PluginHostError(
+                "plugin_runtime_reconfiguring",
+                "Studio plugin runtime is still reconfiguring after 60 seconds",
+            ) from exc
+
+    async def resolve(self, factory: Callable[[], Awaitable[_T]]) -> _T:
+        deadline = asyncio.get_running_loop().time() + 60
+        while True:
+            try:
+                return await factory()
+            except PluginHostError as exc:
+                if exc.code != "plugin_runtime_reconfiguring" or (
+                    asyncio.get_running_loop().time() >= deadline
+                ):
+                    raise
+                await asyncio.sleep(0)

ksadk/studio/presentation.py

@@ -0,0 +1,92 @@
+"""Shared live/replay conversation projection for a persisted Studio Run."""
+
+from ksadk.conversations.contracts import ConversationItem
+from ksadk.conversations.runtime_projection import (
+    RuntimeConversationProjection,
+    conversation_identity,
+)
+from ksadk.events.canonical import parse_runtime_event
+from ksadk.events.content import DataContent
+
+
+class StudioConversationProjection:
+    def __init__(self, session_id, profile):
+        self.session_id = session_id
+        self.profile = profile
+        self.projection = None
+        self.prefix = []
+
+    def apply(self, event):
+        if event.type == "run.created":
+            self.session_id = event.data.get("sessionId") or self.session_id
+            return event.model_copy(
+                update={"data": {**event.data, "presentationProfile": self.profile}}
+            )
+        raw = event.data.get("runtimeEvent")
+        if not isinstance(raw, dict) or raw.get("schema_version") != 2:
+            item = event.data.get("conversationItem")
+            if self.projection is not None and isinstance(item, dict):
+                scoped = self.projection.scope_ledger_item(ConversationItem.model_validate(item))
+                scoped = scoped.model_copy(update={"run_id": event.run_id})
+                return event.model_copy(
+                    update={
+                        "data": {
+                            **event.data,
+                            "conversationItem": scoped.model_dump(
+                                mode="json", by_alias=True, exclude_none=True
+                            ),
+                        }
+                    }
+                )
+            return event
+        canonical = parse_runtime_event(raw)
+        snapshot = getattr(canonical, "snapshot", None) or getattr(canonical, "initial", None)
+        parts = snapshot.parts if snapshot else (getattr(canonical, "update", None),)
+        managed = any(
+            isinstance(part, DataContent)
+            and isinstance(part.data, dict)
+            and part.data.get("schema") == "execution.scope/v1"
+            for part in parts
+        )
+        if self.projection is None and not managed:
+            # Legacy providers may emit terminal-only snapshots or multiple
+            # resume lifecycles. Preserve that contract until a managed scope
+            # opts into the stricter canonical presentation lane.
+            self.prefix.append(canonical)
+            if self.profile == "agent-block-v1" and isinstance(
+                event.data.get("conversationItem"), dict
+            ):
+                item = dict(event.data["conversationItem"])
+                item["itemId"] = conversation_identity(
+                    canonical.run_id, canonical.scope_id, item["itemId"]
+                )
+                item["nativeRef"] = {**item.get("nativeRef", {}), "scopeId": canonical.scope_id}
+                return event.model_copy(update={"data": {**event.data, "conversationItem": item}})
+            return event
+        if self.projection is None:
+            if not self.session_id:
+                raise ValueError("presentation requires a persisted session identity")
+            self.projection = RuntimeConversationProjection(
+                self.session_id, profile=self.profile, kernel_interactions=True
+            )
+            for previous in self.prefix:
+                self.projection.apply(previous)
+            self.prefix.clear()
+        item = self.projection.apply(canonical)
+        data = dict(event.data)
+        if item is None:
+            data.pop("conversationItem", None)
+        else:
+            item = item.model_copy(update={"run_id": event.run_id})
+            data["conversationItem"] = item.model_dump(
+                mode="json", by_alias=True, exclude_none=True
+            )
+        event_type = event.type
+        if item is None and canonical.event_type in {
+            "interaction.requested",
+            "interaction.resolved",
+        }:
+            # Do not fall back to an actionable legacy form/approval event.
+            event_type = "runtime.interaction_observed"
+            data["interactionReadOnly"] = True
+        return event.model_copy(update={"type": event_type, "data": data})

ksadk/studio/public_output_store.py

@@ -0,0 +1,69 @@
+"""Run-scoped, bounded, redacted text artifacts; never raw tool receipts."""
+
+import hashlib
+import json
+import re
+
+from ksadk.harness.tool_display import display_text
+from ksadk.studio.errors import StudioError
+
+
+class PublicOutputStore:
+    MAX_BYTES = 1_048_576
+    MAX_RUN_BYTES = 8 * MAX_BYTES
+    MAX_FILES = 64
+
+    def __init__(self, workspace):
+        self.workspace = workspace
+
+    def _directory(self, run_id):
+        identity = hashlib.sha256(run_id.encode()).hexdigest()
+        return self.workspace.resolve(f".agentkit/assets/public-tool-output/{identity}")
+
+    def retain(self, run_id, text, *, incomplete=False):
+        # Sanitize a bounded prefix before persistence, including incomplete PEM
+        # blocks. Never save the original string, args, URLs or filesystem path.
+        bounded = text[: self.MAX_BYTES]
+        public = display_text(bounded, self.MAX_BYTES).encode("utf-8")
+        truncated = incomplete or len(text) > len(bounded) or len(public) > self.MAX_BYTES
+        public = public[: self.MAX_BYTES].decode("utf-8", errors="ignore")
+        body = json.dumps({"text": public, "truncated": truncated}, ensure_ascii=False)
+        encoded = body.encode("utf-8")
+        identity = hashlib.sha256(encoded).hexdigest()
+        directory = self._directory(run_id)
+        directory.mkdir(parents=True, exist_ok=True)
+        files = tuple(directory.glob("*.json"))
+        target = directory / f"{identity}.json"
+        if target.is_file() and not target.is_symlink():
+            return identity
+        if (
+            len(files) >= self.MAX_FILES
+            or sum(p.stat().st_size for p in files) + len(encoded) > self.MAX_RUN_BYTES
+        ):
+            return None
+        self.workspace.atomic_write_text(target.relative_to(self.workspace.root), body)
+        return identity
+
+    def read(self, run_id, identity):
+        missing = StudioError(
+            "PUBLIC_OUTPUT_NOT_FOUND", "公开输出不存在或不可访问", status_code=404
+        )
+        if not isinstance(identity, str) or not re.fullmatch(r"[0-9a-f]{64}", identity):
+            raise missing
+        target = self._directory(run_id) / f"{identity}.json"
+        if (
+            target.is_symlink()
+            or not target.is_file()
+            or target.stat().st_size > self.MAX_BYTES * 6 + 128
+        ):
+            raise missing
+        encoded = target.read_bytes()
+        if hashlib.sha256(encoded).hexdigest() != identity:
+            raise missing
+        try:
+            data = json.loads(encoded)
+            if not isinstance(data["text"], str) or type(data["truncated"]) is not bool:
+                raise ValueError("invalid artifact")
+        except (ValueError, KeyError, TypeError) as exc:
+            raise missing from exc
+        return data

ksadk/studio/resource_authority.py

@@ -19,8 +19,9 @@ from urllib.parse import urlsplit, urlunsplit
 import requests
 from pydantic import Field, model_validator
 
-from ksadk.knowledge_base.client import KnowledgeBaseClient
+from ksadk.common.cloud_headers import build_cloud_headers
 from ksadk.identity.resolver import iam_endpoint_candidates, is_inner_account_error
+from ksadk.knowledge_base.client import KnowledgeBaseClient
 from ksadk.memory.adk.backends.sdk_ltm_backend import SdkLTMBackend
 from ksadk.plugins.contracts import PluginContractModel
 from ksadk.resource_runtime.contracts import Identifier, ResourceConfig, ResourceRef
@@ -40,6 +41,7 @@ _KSYUN_INTERNAL_HTTP_HOSTS = frozenset(
         "iam.internal.api.ksyun.com",
         "aicp.inner.api.ksyun.com",
         "aicp.internal.api.ksyun.com",
+        "agent-api-pre.kspmas-internal.ksyun.com",
     }
 )
 
@@ -184,7 +186,7 @@ class _HardenedSdkTransport:
                 method=request.method,
                 url=url,
                 data=request.data,
-                headers=dict(request.header),
+                headers=build_cloud_headers(request.header),
                 auth=request.auth,
                 timeout=self.timeout,
                 verify=True,
@@ -602,7 +604,13 @@ def resource_allowed_operations(config: ResourceConfig) -> tuple[ResourceOperati
     if kind == "knowledge-base":
         return ("search_knowledge_base",)
     if kind == "memory-instance":
-        return ("load_memory", "save_memory", "memory_status")
+        return (
+            "load_memory",
+            "save_memory",
+            "update_memory",
+            "delete_memory",
+            "memory_status",
+        )
     return ("list_skills", "search_skills", "load_skill", "read_skill_resource")
 
 

ksadk/studio/resource_catalog.py

@@ -48,7 +48,7 @@ from ksadk.studio.python_tool_inspection import PythonToolInspector
 from ksadk.studio.repository import load_yaml_file
 from ksadk.studio.skill_discovery import SkillDiscoveryService
 from ksadk.studio.workspace import Workspace
-from ksadk.toolsets import describe_agentengine_tools, get_agentengine_tools
+from ksadk.toolsets import describe_agentengine_tools
 
 _SLUG = re.compile(r"[^a-z0-9]+")
 _MAX_SKILL_ARCHIVE_BYTES = 50 * 1024 * 1024
@@ -1128,10 +1128,6 @@ class LocalResourceCatalog:
     def _build_builtin_tools(self) -> Iterable[ResourceDescriptor]:
         from ksadk.toolsets import META_DISPATCHER_TOOL_NAMES
 
-        runtime_tools = {
-            str(getattr(tool, "name", None) or getattr(tool, "__name__", "")): tool
-            for tool in get_agentengine_tools(profile="coding", mode="direct")
-        }
         for descriptor in describe_agentengine_tools(profile="coding", mode="direct"):
             name = str(descriptor["name"])
             if name in META_DISPATCHER_TOOL_NAMES:
@@ -1148,18 +1144,18 @@ class LocalResourceCatalog:
                 )
                 if workspace_permission not in permissions:
                     permissions.append(workspace_permission)
-            runtime_tool = runtime_tools.get(name)
-            args_schema = getattr(runtime_tool, "args_schema", None)
-            input_schema = (
-                args_schema.model_json_schema()
-                if args_schema is not None and hasattr(args_schema, "model_json_schema")
-                else {"type": "object", "properties": {}}
-            )
+            input_schema = descriptor.get("input_schema")
+            if not isinstance(input_schema, dict):
+                raise ValueError(f"Builtin tool {name} has no argument contract")
             tool = ToolContract(
                 name=name,
                 version="1.0.0",
                 description=str(descriptor.get("description") or ""),
                 input_schema=input_schema,
+                # Browser inspection may spend 30 s loading and another 30 s
+                # capturing a busy page. The generic 20 s Python Tool lease
+                # killed it before Playwright could return a repairable error.
+                timeout_seconds=90 if name == "browser_inspect_workspace" else 20,
                 permissions=permissions,
                 side_effect=cast(Any, side_effect),
                 approval="always" if descriptor.get("requires_approval") else "never",