agenticstar-platform 3.2.1__tar.gz → 3.2.3__tar.gz

{agenticstar_platform-3.2.1 → agenticstar_platform-3.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agenticstar-platform
-Version: 3.2.1
+Version: 3.2.3
 Summary: AGENTICSTAR Platform SDK - Enterprise AI Agent Infrastructure
 Project-URL: Homepage, https://developers.fd.agenticstar.tm.softbank.jp/
 Project-URL: Documentation, https://developers.fd.agenticstar.tm.softbank.jp/
@@ -224,6 +224,7 @@ Environment variable contract:
 | `REQUEST_SOURCE` / `AGENT_ID` | Same as above (optional) | — |
 | `DB_HOST` / `DB_PORT` / `DB_DATABASE` / `DB_USER` / `DB_PASSWORD` | Env var settings at agent registration (`PostgreSQLConfig.from_env()` contract) | ✅ |
 | `WEBHOOK_URL` | Env var settings at agent registration | ✅ |
+| `ASTER_NOTIFY_TOKEN` | Injected by the Marketplace executor for each execution (SDK >= 3.2.2 sends it as `Authorization: Bearer` on the webhook notification) | — |
 
 Terminal event rules:
 
@@ -235,7 +236,8 @@ Terminal event rules:
 If you need the low-level API (to compose handlers yourself), pass
 `create_marketplace_handler(data_access, webhook_url, user_id, conversation_id, message_id)`
 (a composite handler for DB persistence + webhook notification; requires the `[db]` + `[webhook]`
-extras) directly to `EventEmitter`, as before.
+extras) directly to `EventEmitter`, as before. Without a `token_provider`, it sends the
+`ASTER_NOTIFY_TOKEN` env var as `Authorization: Bearer` when it is set (SDK >= 3.2.2).
 
 ### 2.4 Report completion for a cycle execution (SDK >= 3.0.14, `mp-chat/1`)
 
@@ -471,6 +473,24 @@ config = AzureBlobConfig.from_dict({
 client = AzureBlobStorageClient(config)
 ```
 
+S3 without access keys (3.2.3): leave `aws_access_key_id` and `aws_secret_access_key` both out (or
+empty). The client then passes no keys and lets boto3 find the credentials with its default
+credential chain (for example IRSA on EKS, environment variables, `~/.aws` files, EKS Pod Identity
+or an EC2 instance role; boto3 decides which one is used first). This is what an EKS Pod with IRSA
+needs; do not also give that Pod `AWS_ACCESS_KEY_ID` in its env, which boto3 checks before IRSA.
+The role needs S3 access to the bucket. Give both keys or neither: only one of them raises
+`StorageConfigError`.
+
+```python
+from agenticstar_platform.storage import S3StorageClient, S3Config
+
+config = S3Config.from_dict({
+    "bucket_name": "your-bucket",
+    "region_name": "us-east-1",
+})
+client = S3StorageClient(config)
+```
+
 ### Telemetry / LLM Usage Tracking (Marketplace)
 
 `TelemetryAccess` (under `db` module) writes records to the `ai_telemetry` table. **Unknown fields are stored in the `metadata` jsonb column automatically** — no schema migration is required to add new tracking dimensions.
@@ -734,8 +754,9 @@ async def run(context):
 
 **Ending a step as not completed** (SDK ≥ 3.2.1). When your agent cannot complete the step and running it again would
 give the same result — the instructions are missing, a setting is wrong — call `context.incomplete(reason, comment)` and
-return. The platform does not retry the step automatically; it asks a person to check it and shows the reason and the
-comment in the execution record.
+return. The platform does not retry the step automatically; it asks a person to check it and shows the reason in the
+execution record. A platform that reads the end-of-run report (below) also shows the comment there; Marketplace 3.2.0
+does not show the comment.
 
 ```python
 async def run(context):
@@ -1107,6 +1128,20 @@ See the [developer portal](https://developers.fd.agenticstar.tm.softbank.jp/) fo
 
 ## Changelog
 
+### 3.2.3 (2026-11-04) — storage: S3 without access keys (IRSA) / events: a failed run ends the chat message
+
+3.2.2 was not published to PyPI; 3.2.3 includes its change (the notify token below).
+
+- **`S3StorageClient` works without access keys.** Leave `aws_access_key_id` and `aws_secret_access_key` both out (or empty) and the client passes no keys and lets boto3 find the credentials with its default credential chain (for example IRSA on EKS with `AWS_ROLE_ARN` + `AWS_WEB_IDENTITY_TOKEN_FILE`, environment variables, `~/.aws` files, EKS Pod Identity or an EC2 instance role; boto3 decides the order). Before, the client raised `StorageConfigError: S3 requires aws_access_key_id and aws_secret_access_key` on an EKS runner Pod that has only IRSA. Giving only one of the two keys still raises `StorageConfigError` (it is a configuration mistake, and the client does not silently fall back to other credentials). Both keys work as before, exactly as given (a non-blank key is not stripped); an empty or whitespace-only key, including a `SecretStr`, counts as not given. With no keys the client is created even when boto3 finds no credentials; the first call then fails (for example `object_exists()` returns `False`). `S3Config` keeps its field order, so positional construction is unchanged; `S3Config.from_dict` no longer requires the two keys.
+- **A failed run ends the chat message.** `create_marketplace_handler` (and so `run_marketplace_agent`) now sends `COMPLETION_FAILURE` with `finish_reason: "stop"`, the same as the platform's own agent worker. The chat front ends a message only on `"stop"`; with the previous `"error"` the failure text was added but the message kept showing as in progress. The failure is told by the message text, as before. `WebhookEventHandler` used on its own keeps `"error"` by default, so a receiver of your own that tells failures by `"error"` is unchanged; the new argument `failure_finish_reason="stop"` sends what the chat front expects. If you pointed `create_marketplace_handler` at a receiver of your own that needs `"error"`, build `WebhookEventHandler` yourself instead.
+- docs: "Ending a step as not completed" now says that the execution record shows the reason, and that the comment is shown only by a platform that reads the end-of-run report (Marketplace 3.2.0 does not show it). In 3.2.1 and 3.2.2 that section said the record shows the comment. The SDK's behavior is unchanged.
+
+### 3.2.2 (2026-10-30) — events: the webhook notification carries the execution's notify token (`ASTER_NOTIFY_TOKEN`)
+
+- **`create_marketplace_handler(...)` sends `Authorization: Bearer <token>` on the webhook notification when the `ASTER_NOTIFY_TOKEN` env var is set.** The Marketplace executor issues this token for each execution and passes it to the agent Pod; the platform checks it when it receives the notification. Without a `token_provider` argument, the handler reads the env var each time it sends. When the env var is missing or empty, no `Authorization` header is sent, as before. A `token_provider` you pass is used as before, and the env var is not read. `run_marketplace_agent` uses this default, so a runner agent sends the token without code changes.
+- `WebhookEventHandler` used on its own does not read `ASTER_NOTIFY_TOKEN`; as before, it sends an `Authorization` header only when you give one (through its `token_provider` or `headers`).
+- To use it, rebuild the agent image with this SDK.
+
 ### 3.2.1 (2026-10-28) — workflow: end a step as not completed (`context.incomplete`) with an end-of-run report / a fake runtime for testing (`agenticstar_platform.workflow.testing`)
 
 - **New `WorkflowContext.incomplete(reason, comment=None)`.** An agent that cannot complete its step, where running it again would give the same result (missing instructions, a wrong setting), ends the step as `incomplete` with `reason` as the reason code. The platform does not retry it automatically and asks a person to check it. `reason` follows the rules of `report_completion()` (lowercase snake_case of at most 32 characters; any other value becomes `incomplete` with a warning); `comment` is cut at 2,048 UTF-16 code units. The declaration comes after an audit persistence failure, cancellation, the deadline, the execution being closed elsewhere, a pod stop signal and a denied tool call, and before an exception (an exception after the declaration still ends as `incomplete`), an invalid output, a skip and a missing required output. A second declaration is not recorded. See "Ending a step as not completed" in the Workflow Runner section.
@@ -1553,4 +1588,4 @@ Marketplace SDK reliability fixes (surfaced while building agents from the guide
 
 ## Version
 
-3.2.1
+3.2.3

{agenticstar_platform-3.2.1 → agenticstar_platform-3.2.3}/README.md

@@ -143,6 +143,7 @@ Environment variable contract:
 | `REQUEST_SOURCE` / `AGENT_ID` | Same as above (optional) | — |
 | `DB_HOST` / `DB_PORT` / `DB_DATABASE` / `DB_USER` / `DB_PASSWORD` | Env var settings at agent registration (`PostgreSQLConfig.from_env()` contract) | ✅ |
 | `WEBHOOK_URL` | Env var settings at agent registration | ✅ |
+| `ASTER_NOTIFY_TOKEN` | Injected by the Marketplace executor for each execution (SDK >= 3.2.2 sends it as `Authorization: Bearer` on the webhook notification) | — |
 
 Terminal event rules:
 
@@ -154,7 +155,8 @@ Terminal event rules:
 If you need the low-level API (to compose handlers yourself), pass
 `create_marketplace_handler(data_access, webhook_url, user_id, conversation_id, message_id)`
 (a composite handler for DB persistence + webhook notification; requires the `[db]` + `[webhook]`
-extras) directly to `EventEmitter`, as before.
+extras) directly to `EventEmitter`, as before. Without a `token_provider`, it sends the
+`ASTER_NOTIFY_TOKEN` env var as `Authorization: Bearer` when it is set (SDK >= 3.2.2).
 
 ### 2.4 Report completion for a cycle execution (SDK >= 3.0.14, `mp-chat/1`)
 
@@ -390,6 +392,24 @@ config = AzureBlobConfig.from_dict({
 client = AzureBlobStorageClient(config)
 ```
 
+S3 without access keys (3.2.3): leave `aws_access_key_id` and `aws_secret_access_key` both out (or
+empty). The client then passes no keys and lets boto3 find the credentials with its default
+credential chain (for example IRSA on EKS, environment variables, `~/.aws` files, EKS Pod Identity
+or an EC2 instance role; boto3 decides which one is used first). This is what an EKS Pod with IRSA
+needs; do not also give that Pod `AWS_ACCESS_KEY_ID` in its env, which boto3 checks before IRSA.
+The role needs S3 access to the bucket. Give both keys or neither: only one of them raises
+`StorageConfigError`.
+
+```python
+from agenticstar_platform.storage import S3StorageClient, S3Config
+
+config = S3Config.from_dict({
+    "bucket_name": "your-bucket",
+    "region_name": "us-east-1",
+})
+client = S3StorageClient(config)
+```
+
 ### Telemetry / LLM Usage Tracking (Marketplace)
 
 `TelemetryAccess` (under `db` module) writes records to the `ai_telemetry` table. **Unknown fields are stored in the `metadata` jsonb column automatically** — no schema migration is required to add new tracking dimensions.
@@ -653,8 +673,9 @@ async def run(context):
 
 **Ending a step as not completed** (SDK ≥ 3.2.1). When your agent cannot complete the step and running it again would
 give the same result — the instructions are missing, a setting is wrong — call `context.incomplete(reason, comment)` and
-return. The platform does not retry the step automatically; it asks a person to check it and shows the reason and the
-comment in the execution record.
+return. The platform does not retry the step automatically; it asks a person to check it and shows the reason in the
+execution record. A platform that reads the end-of-run report (below) also shows the comment there; Marketplace 3.2.0
+does not show the comment.
 
 ```python
 async def run(context):
@@ -1026,6 +1047,20 @@ See the [developer portal](https://developers.fd.agenticstar.tm.softbank.jp/) fo
 
 ## Changelog
 
+### 3.2.3 (2026-11-04) — storage: S3 without access keys (IRSA) / events: a failed run ends the chat message
+
+3.2.2 was not published to PyPI; 3.2.3 includes its change (the notify token below).
+
+- **`S3StorageClient` works without access keys.** Leave `aws_access_key_id` and `aws_secret_access_key` both out (or empty) and the client passes no keys and lets boto3 find the credentials with its default credential chain (for example IRSA on EKS with `AWS_ROLE_ARN` + `AWS_WEB_IDENTITY_TOKEN_FILE`, environment variables, `~/.aws` files, EKS Pod Identity or an EC2 instance role; boto3 decides the order). Before, the client raised `StorageConfigError: S3 requires aws_access_key_id and aws_secret_access_key` on an EKS runner Pod that has only IRSA. Giving only one of the two keys still raises `StorageConfigError` (it is a configuration mistake, and the client does not silently fall back to other credentials). Both keys work as before, exactly as given (a non-blank key is not stripped); an empty or whitespace-only key, including a `SecretStr`, counts as not given. With no keys the client is created even when boto3 finds no credentials; the first call then fails (for example `object_exists()` returns `False`). `S3Config` keeps its field order, so positional construction is unchanged; `S3Config.from_dict` no longer requires the two keys.
+- **A failed run ends the chat message.** `create_marketplace_handler` (and so `run_marketplace_agent`) now sends `COMPLETION_FAILURE` with `finish_reason: "stop"`, the same as the platform's own agent worker. The chat front ends a message only on `"stop"`; with the previous `"error"` the failure text was added but the message kept showing as in progress. The failure is told by the message text, as before. `WebhookEventHandler` used on its own keeps `"error"` by default, so a receiver of your own that tells failures by `"error"` is unchanged; the new argument `failure_finish_reason="stop"` sends what the chat front expects. If you pointed `create_marketplace_handler` at a receiver of your own that needs `"error"`, build `WebhookEventHandler` yourself instead.
+- docs: "Ending a step as not completed" now says that the execution record shows the reason, and that the comment is shown only by a platform that reads the end-of-run report (Marketplace 3.2.0 does not show it). In 3.2.1 and 3.2.2 that section said the record shows the comment. The SDK's behavior is unchanged.
+
+### 3.2.2 (2026-10-30) — events: the webhook notification carries the execution's notify token (`ASTER_NOTIFY_TOKEN`)
+
+- **`create_marketplace_handler(...)` sends `Authorization: Bearer <token>` on the webhook notification when the `ASTER_NOTIFY_TOKEN` env var is set.** The Marketplace executor issues this token for each execution and passes it to the agent Pod; the platform checks it when it receives the notification. Without a `token_provider` argument, the handler reads the env var each time it sends. When the env var is missing or empty, no `Authorization` header is sent, as before. A `token_provider` you pass is used as before, and the env var is not read. `run_marketplace_agent` uses this default, so a runner agent sends the token without code changes.
+- `WebhookEventHandler` used on its own does not read `ASTER_NOTIFY_TOKEN`; as before, it sends an `Authorization` header only when you give one (through its `token_provider` or `headers`).
+- To use it, rebuild the agent image with this SDK.
+
 ### 3.2.1 (2026-10-28) — workflow: end a step as not completed (`context.incomplete`) with an end-of-run report / a fake runtime for testing (`agenticstar_platform.workflow.testing`)
 
 - **New `WorkflowContext.incomplete(reason, comment=None)`.** An agent that cannot complete its step, where running it again would give the same result (missing instructions, a wrong setting), ends the step as `incomplete` with `reason` as the reason code. The platform does not retry it automatically and asks a person to check it. `reason` follows the rules of `report_completion()` (lowercase snake_case of at most 32 characters; any other value becomes `incomplete` with a warning); `comment` is cut at 2,048 UTF-16 code units. The declaration comes after an audit persistence failure, cancellation, the deadline, the execution being closed elsewhere, a pod stop signal and a denied tool call, and before an exception (an exception after the declaration still ends as `incomplete`), an invalid output, a skip and a missing required output. A second declaration is not recorded. See "Ending a step as not completed" in the Workflow Runner section.
@@ -1472,4 +1507,4 @@ Marketplace SDK reliability fixes (surfaced while building agents from the guide
 
 ## Version
 
-3.2.1
+3.2.3

{agenticstar_platform-3.2.1 → agenticstar_platform-3.2.3}/agenticstar_platform/__init__.py

@@ -9,7 +9,7 @@ import importlib
 import importlib.util
 from typing import TYPE_CHECKING
 
-__version__ = "3.2.1"
+__version__ = "3.2.3"
 
 # Common utilities are internal - not exported as public API
 # Use agenticstar_platform.common for internal SDK development only

{agenticstar_platform-3.2.1 → agenticstar_platform-3.2.3}/agenticstar_platform/events/handlers.py

@@ -33,6 +33,7 @@ Example:
 import asyncio
 import json
 import logging
+import os
 from typing import Any, Callable, Dict, List, Optional
 
 from .types import EventType
@@ -249,6 +250,7 @@ class WebhookEventHandler:
         chunk_type_map: Optional[Dict[EventType, str]] = None,
         request_source: Optional[str] = None,
         message_type_map: Optional[Dict[EventType, str]] = None,
+        failure_finish_reason: str = "error",
     ):
         """
         WebhookEventHandlerを初期化
@@ -269,6 +271,10 @@ class WebhookEventHandler:
             message_type_map: EventType→トップレベルtypeのカスタムマッピング
                 （オプション）。省略時は HITL系→"vnc_hitl_event"、
                 PROGRESS_MESSAGE→"progress_message" を切り替えるデフォルトを使用。
+            failure_finish_reason: COMPLETION_FAILURE の finish_reason（既定 "error"。3.2.3）。
+                AgenticStar のチャット画面（chatboardfront の監視）へ送るときは "stop" にする:
+                受信側は "stop" のときだけメッセージを終わらせ、"error" は読まない（本体の worker も
+                失敗を "stop" で送る）。create_marketplace_handler はこれを "stop" にして作る
 
         Example:
             >>> handler = WebhookEventHandler(
@@ -309,10 +315,10 @@ class WebhookEventHandler:
             EventType.FINAL_RESULT: None,
         }
 
-        # finish_reasonマッピング
+        # finish_reasonマッピング（失敗の値は failure_finish_reason。既定 "error" は従来どおり）
         self._finish_reason_map = {
             EventType.COMPLETION_SUCCESS: "stop",
-            EventType.COMPLETION_FAILURE: "error",
+            EventType.COMPLETION_FAILURE: failure_finish_reason,
         }
 
         logger.debug(
@@ -502,6 +508,20 @@ class CompositeEventHandler:
             return None
 
 
+# 完了の知らせ（/webhook/notify）に付ける実行ごとのトークンの env。
+# Marketplace executor が実行ごとに発行し、会話の Pod に渡す。受信側（front の監視）が
+# Authorization: Bearer で確かめる。
+NOTIFY_TOKEN_ENV = "ASTER_NOTIFY_TOKEN"
+
+
+def _notify_token_from_env() -> Optional[str]:
+    """env ASTER_NOTIFY_TOKEN から知らせのトークンを返す（無い・空なら None）
+
+    create_marketplace_handler の既定の token_provider。送るたびに env を読む。
+    """
+    return os.environ.get(NOTIFY_TOKEN_ENV) or None
+
+
 def create_marketplace_handler(
     data_access: Any,
     webhook_url: str,
@@ -522,12 +542,19 @@ def create_marketplace_handler(
         user_id: ユーザーID
         conversation_id: 会話ID
         message_id: メッセージID
-        token_provider: 認証トークン取得関数（オプション）
+        token_provider: 認証トークン取得関数（オプション）。
+            省略時（None）は env ASTER_NOTIFY_TOKEN を送るたびに読む既定の関数を使い、
+            値があれば Webhook に Authorization: Bearer <値> を付ける。env が無い・空なら付けない
+            （Marketplace executor が実行ごとに発行して Pod に渡すトークン。呼び出し側のコードは
+            変えなくてよい。SDK 3.2.2 から）。明示した場合はその関数だけを使い、env は読まない。
         request_source: リクエスト発信元（"internal" / "external"）。
             受信側で Progress SSE 配信 と 外部Webhook送信 の振り分けに使われる。
             外部API経由（extapi）からの呼び出しでは "external" を指定すること。
             通常はPod起動スクリプトで os.environ.get("REQUEST_SOURCE", "internal") を渡す。
 
+    失敗の完了（COMPLETION_FAILURE）は finish_reason "stop" で送る（3.2.3。チャット画面は "stop" で
+    メッセージを終わらせる。WebhookEventHandler の既定 "error" とは違う）。
+
     Returns:
         CompositeEventHandler: DB + Webhookの複合ハンドラー
 
@@ -561,8 +588,14 @@ def create_marketplace_handler(
         webhook_url=webhook_url,
         conversation_id=conversation_id,
         message_id=message_id,
-        token_provider=token_provider,
+        token_provider=(
+            token_provider if token_provider is not None else _notify_token_from_env
+        ),
         request_source=request_source,
+        # 失敗も "stop"（3.2.3）: 受信側のチャット画面（chatboardfront の監視）は "stop" のときだけ
+        # メッセージを終わらせ、"error" は読まない。本体の worker も COMPLETION_FAILURE を "stop" で送る
+        # （src/subscribers/common.py の get_finish_reason）。失敗の中身は本文で伝わる
+        failure_finish_reason="stop",
     )
 
     return CompositeEventHandler([db_handler, webhook_handler])

{agenticstar_platform-3.2.1 → agenticstar_platform-3.2.3}/agenticstar_platform/runner.py

@@ -67,7 +67,7 @@ from .db import DataAccess, PostgreSQLConfig, create_postgresql_manager
 from .db.execution_access import ExecutionAccess
 from .db.started_fence import StartedFenceTaken, take_started_fence
 from .events import EventEmitter, EventType
-from .events.handlers import create_marketplace_handler
+from .events.handlers import NOTIFY_TOKEN_ENV, create_marketplace_handler
 
 logger = logging.getLogger(__name__)
 
@@ -315,6 +315,8 @@ async def arun_marketplace_agent(
             conversation_id=identity["CONVERSATION_ID"],
             message_id=identity["MESSAGE_ID"],
             request_source=request_source or env.get("REQUEST_SOURCE", "internal"),
+            # 完了の知らせの実行ごとのトークン（3.2.2）。identity・WEBHOOK_URL と同じく渡された env から読む
+            token_provider=lambda: env.get(NOTIFY_TOKEN_ENV) or None,
         )
 
         execution_id = identity["EXECUTION_ID"]

{agenticstar_platform-3.2.1 → agenticstar_platform-3.2.3}/agenticstar_platform/storage/base.py

@@ -243,12 +243,33 @@ def _blank_to_none(value: Any) -> Optional[str]:
     return text if text else None
 
 
+def _blank_key_to_none(value: Any) -> Any:
+    """鍵の値が None・空・空白だけなら None、それ以外は渡された値をそのまま返す。
+
+    ``_blank_to_none`` と違い、空でない値は strip しない (S3 互換のストレージの鍵の前後の空白も
+    署名に使われる値の一部)。``SecretStr`` は中身で空かどうかを見て、空でなければ包んだまま返す。
+    """
+    if value is None:
+        return None
+    raw = value.get_secret_value() if hasattr(value, "get_secret_value") else value
+    if raw is None or not str(raw).strip():
+        return None
+    return value
+
+
 @dataclass
 class S3Config:
     """AWS S3設定
 
+    認証は 2 通り (3.2.3):
+    - ``aws_access_key_id`` と ``aws_secret_access_key`` の両方があればそれを使う (従来どおり)
+    - 両方とも無ければ鍵を渡さず、boto3 の既定の探し方に任せる
+      (EKS の IRSA・環境変数・~/.aws の設定・EKS Pod Identity・EC2 のインスタンスロールなど。どれを先に使うかは boto3 が決める)
+    片方だけのときは設定の誤りとして ``S3StorageClient`` が ``StorageConfigError`` を上げる。
+    空文字・空白だけの値は「無し」として扱う (設定ファイルで空にしたときの形)。
+
     Example:
-        >>> # 辞書から作成
+        >>> # 鍵で認証 (従来)
         >>> config = S3Config.from_dict({
         ...     "bucket_name": "my-bucket",
         ...     "aws_access_key_id": "AKIAXXXXXXX",
@@ -256,6 +277,12 @@ class S3Config:
         ...     "region_name": "ap-northeast-1"
         ... })
         >>>
+        >>> # 鍵なし (IRSA など boto3 の既定の探し方)
+        >>> config = S3Config.from_dict({
+        ...     "bucket_name": "my-bucket",
+        ...     "region_name": "us-east-1"
+        ... })
+        >>>
         >>> # クライアント初期化
         >>> client = S3StorageClient(config)
 
@@ -263,8 +290,8 @@ class S3Config:
         aws_access_key_id, aws_secret_access_keyはrepr=Falseでログ出力から除外されます。
     """
     bucket_name: str
-    aws_access_key_id: str = field(repr=False)  # シークレット: reprから除外
-    aws_secret_access_key: str = field(repr=False)  # シークレット: reprから除外
+    aws_access_key_id: Optional[str] = field(default=None, repr=False)  # シークレット: reprから除外
+    aws_secret_access_key: Optional[str] = field(default=None, repr=False)  # シークレット: reprから除外
     region_name: str = "us-east-1"
     # 共通オプション
     enabled: bool = True
@@ -277,19 +304,35 @@ class S3Config:
     # S3固有オプション
     endpoint_url: Optional[str] = None  # MinIO等のS3互換ストレージ用
 
+    def __post_init__(self) -> None:
+        # 設定ファイルで `aws_access_key_id = ""` と書いた形 (SecretStr("") も) を「無し」に正規化する。
+        # 空でない値は変えない
+        self.aws_access_key_id = _blank_key_to_none(self.aws_access_key_id)
+        self.aws_secret_access_key = _blank_key_to_none(self.aws_secret_access_key)
+
     @property
     def provider(self) -> StorageProvider:
         return StorageProvider.AWS_S3
 
+    @property
+    def uses_access_keys(self) -> bool:
+        """鍵の 2 つで認証するか (False なら boto3 の既定の探し方)"""
+        return self.aws_access_key_id is not None and self.aws_secret_access_key is not None
+
     def __str__(self) -> str:
-        return f"S3Config(bucket_name={self.bucket_name!r}, region_name={self.region_name!r}, credentials=***)"
+        credentials = "***" if self.uses_access_keys else "default"
+        return (
+            f"S3Config(bucket_name={self.bucket_name!r}, region_name={self.region_name!r}, "
+            f"credentials={credentials})"
+        )
 
     @classmethod
     def from_dict(cls, data: Dict[str, Any]) -> "S3Config":
         """辞書からS3Configを作成
 
         Args:
-            data: 設定辞書
+            data: 設定辞書。``aws_access_key_id`` と ``aws_secret_access_key`` は
+                両方を書くか、両方を省く (省くと boto3 の既定の探し方。IRSA など)
 
         Returns:
             S3Config instance
@@ -301,11 +344,12 @@ class S3Config:
             ...     "aws_secret_access_key": "secretkey",
             ...     "region_name": "ap-northeast-1"
             ... })
+            >>> config = S3Config.from_dict({"bucket_name": "my-bucket"})
         """
         return cls(
             bucket_name=data["bucket_name"],
-            aws_access_key_id=data["aws_access_key_id"],
-            aws_secret_access_key=data["aws_secret_access_key"],
+            aws_access_key_id=data.get("aws_access_key_id"),
+            aws_secret_access_key=data.get("aws_secret_access_key"),
             region_name=data.get("region_name", "us-east-1"),
             enabled=data.get("enabled", True),
             max_file_size=data.get("max_file_size", 5 * 1024 * 1024 * 1024),

{agenticstar_platform-3.2.1 → agenticstar_platform-3.2.3}/agenticstar_platform/storage/s3.py

@@ -65,6 +65,9 @@ class S3StorageClient(StorageClientBase):
         )
         client = S3StorageClient(config)
         result = await client.upload_file("/path/to/file.txt")
+
+        # 鍵なし: boto3 の既定の探し方 (EKS の IRSA・インスタンスロールなど)
+        client = S3StorageClient(S3Config(bucket_name="my-bucket", region_name="us-east-1"))
     """
 
     def __init__(self, config: S3Config):
@@ -89,20 +92,29 @@ class S3StorageClient(StorageClientBase):
         if not config.bucket_name:
             raise StorageConfigError("S3 bucket_name is required")
 
-        if not config.aws_access_key_id or not config.aws_secret_access_key:
+        has_key_id = config.aws_access_key_id is not None
+        has_secret = config.aws_secret_access_key is not None
+        if has_key_id != has_secret:
+            # 片方だけは書き損じ。既定の探し方に黙って倒すと別の資格情報で動いてしまう
             raise StorageConfigError(
-                "S3 requires aws_access_key_id and aws_secret_access_key"
+                "S3 needs both aws_access_key_id and aws_secret_access_key, or neither "
+                "(leave both out to use the default AWS credential chain, e.g. IRSA on EKS)"
             )
 
         self._s3_config: S3Config = config
         self._s3_client = None
 
         try:
-            session = boto3.Session(
-                aws_access_key_id=self._get_api_key(config.aws_access_key_id),
-                aws_secret_access_key=self._get_api_key(config.aws_secret_access_key),
-                region_name=config.region_name,
-            )
+            if config.uses_access_keys:
+                session = boto3.Session(
+                    aws_access_key_id=self._get_api_key(config.aws_access_key_id),
+                    aws_secret_access_key=self._get_api_key(config.aws_secret_access_key),
+                    region_name=config.region_name,
+                )
+            else:
+                # 鍵を渡さない: boto3 の既定の探し方に任せる（IRSA（AWS_ROLE_ARN・AWS_WEB_IDENTITY_TOKEN_FILE）・
+                # 環境変数・~/.aws・EKS Pod Identity・インスタンスロールなど。どれを先に使うかは boto3 が決める）
+                session = boto3.Session(region_name=config.region_name)
 
             client_kwargs = {}
             if config.endpoint_url:
@@ -113,7 +125,8 @@ class S3StorageClient(StorageClientBase):
 
             logger.info(
                 f"S3StorageClient initialized - bucket={config.bucket_name}, "
-                f"region={config.region_name}"
+                f"region={config.region_name}, "
+                f"credentials={'access_keys' if config.uses_access_keys else 'default_chain'}"
             )
 
         except Exception as e:

{agenticstar_platform-3.2.1 → agenticstar_platform-3.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agenticstar-platform"
-version = "3.2.1"
+version = "3.2.3"
 description = "AGENTICSTAR Platform SDK - Enterprise AI Agent Infrastructure"
 readme = "README.md"
 license = "MIT"

{agenticstar_platform-3.2.1 → agenticstar_platform-3.2.3}/tests/events/test_handler_type_routing.py

@@ -16,7 +16,7 @@ aiohttp = pytest.importorskip("aiohttp")
 from aiohttp import web  # noqa: E402
 
 
-async def _receive_payloads(events):
+async def _receive_payloads(events, make_handler=None):
     """実 HTTP サーバーを起動し、events を送信して受信ペイロード一覧を返す"""
     received = []
 
@@ -33,8 +33,9 @@ async def _receive_payloads(events):
     port = site._server.sockets[0].getsockname()[1]
 
     try:
-        handler = WebhookEventHandler(
-            webhook_url=f"http://127.0.0.1:{port}/webhook/notify",
+        url = f"http://127.0.0.1:{port}/webhook/notify"
+        handler = make_handler(url) if make_handler else WebhookEventHandler(
+            webhook_url=url,
             conversation_id="conv-1",
             message_id="msg-1",
             request_source="external",
@@ -84,6 +85,62 @@ async def test_webhook_top_level_type_routing():
     assert all(p["data"]["request_source"] == "external" for p in payloads)
 
 
+class _AcceptingDataAccess:
+    """DatabaseEventHandler の保存先の代わり（insert を記録して成功を返す）"""
+
+    def __init__(self):
+        self.rows = []
+
+    async def insert(self, table, row):
+        self.rows.append((table, row))
+        return {"success": True}
+
+
+async def test_marketplace_handler_sends_failure_as_stop_like_the_worker():
+    """create_marketplace_handler は失敗の完了も finish_reason "stop"（3.2.3）。
+
+    受信側（chatboardfront monitoring.js）は "stop" のときだけメッセージを終わらせ、"error" は読まない。
+    本体 PodWebhookSubscriber も COMPLETION_FAILURE を "stop" で送る。途中のイベントには付けない。
+    run_marketplace_agent もこの handler を使う。
+    """
+    from agenticstar_platform.events.handlers import create_marketplace_handler
+
+    data_access = _AcceptingDataAccess()
+    payloads = await _receive_payloads(
+        [
+            StreamingEvent(EventType.PHASE_START, "e1", "処理開始"),
+            StreamingEvent(EventType.COMPLETION_FAILURE, "e1", "agent failed: ValueError: boom"),
+        ],
+        make_handler=lambda url: create_marketplace_handler(
+            data_access=data_access, webhook_url=url, user_id="u1",
+            conversation_id="conv-1", message_id="msg-1", request_source="internal",
+            token_provider=lambda: None,
+        ),
+    )
+
+    assert payloads[0]["data"]["finish_reason"] is None
+    assert payloads[1]["type"] == "append_message"
+    assert payloads[1]["data"]["chunk_type"] == "content"
+    assert payloads[1]["data"]["content"] == {"content": "agent failed: ValueError: boom"}
+    assert payloads[1]["data"]["finish_reason"] == "stop"
+    assert len(data_access.rows) == 2  # DB への保存は今どおり
+
+
+async def test_webhook_handler_keeps_error_for_failure_by_default():
+    """WebhookEventHandler を単体で使う受け口は今どおり "error"（3.2.3 の後も変わらない）。引数で "stop" にできる"""
+    failure = StreamingEvent(EventType.COMPLETION_FAILURE, "e1", "boom")
+    default = await _receive_payloads([failure])
+    assert default[0]["data"]["finish_reason"] == "error"
+
+    stop = await _receive_payloads(
+        [failure],
+        make_handler=lambda url: WebhookEventHandler(
+            webhook_url=url, conversation_id="conv-1", message_id="msg-1", failure_finish_reason="stop",
+        ),
+    )
+    assert stop[0]["data"]["finish_reason"] == "stop"
+
+
 def test_build_content_data_shapes():
     vnc = StreamingEvent(
         EventType.HITL_REQUIRED_BROWSER_VNC, "e1", "VNC", metadata={"vnc_url": "u"},