agentkernel 0.7.0__tar.gz → 0.8.1__tar.gz

{agentkernel-0.7.0 → agentkernel-0.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: agentkernel
-Version: 0.7.0
+Version: 0.8.1
 Summary: Agent Kernel - Unified AI Agents Runtime
 Author: Yaala Labs
 Author-email: Yaala Labs <agentkernel@yaalalabs.com>
@@ -26,6 +26,8 @@ Requires-Dist: chromadb>=0.4.0 ; extra == 'chromadb'
 Requires-Dist: crewai>=1.15.0 ; extra == 'crewai'
 Requires-Dist: openinference-instrumentation-crewai>=0.1.16 ; extra == 'crewai'
 Requires-Dist: openinference-instrumentation-litellm>=0.1.28 ; extra == 'crewai'
+Requires-Dist: daytona>=0.198.0,<0.199 ; extra == 'daytona'
+Requires-Dist: e2b-code-interpreter>=2.8.0 ; extra == 'e2b'
 Requires-Dist: google-cloud-firestore>=2.19.0 ; extra == 'gcp'
 Requires-Dist: google-auth>=2.0.0 ; extra == 'gmail'
 Requires-Dist: google-auth-oauthlib>=1.0.0 ; extra == 'gmail'
@@ -86,6 +88,8 @@ Provides-Extra: azure
 Provides-Extra: chromadb
 Provides-Extra: cli
 Provides-Extra: crewai
+Provides-Extra: daytona
+Provides-Extra: e2b
 Provides-Extra: gcp
 Provides-Extra: gmail
 Provides-Extra: instagram
@@ -126,7 +130,7 @@ Agent Kernel is a lightweight **AI agent runtime** and adapter layer for buildin
 - **Multi-Framework Support**: OpenAI Agents SDK, CrewAI, LangGraph, Google ADK, Smolagents, and Pydantic AI
 - **Session Management**: Built-in session abstraction with pluggable storage backends
 - **Knowledge Bases**: Unified `KnowledgeBase` interface with ChromaDB, Neo4j, and Starburst/Trino backends via `KnowledgeBuilder`
-- **Sandbox**: Execute agent-generated code and shell commands in an isolated, permission-bounded environment with pluggable providers (`local_subprocess`, `docker`), workload profiles, policy enforcement, and per-user identity
+- **Sandbox**: Execute agent-generated code and shell commands in an isolated, permission-bounded environment with pluggable providers (`local_subprocess`, `docker`, `e2b`, `daytona`, `ec2_ssm`), workload profiles, policy enforcement, and per-user identity
 - **Flexible Deployment**: Interactive CLI, REST API, serverless, or containerized deployment — see the "Multi-Cloud Deployment" section below
 - **Pluggable Architecture**: Easy to extend with custom framework adapters
 - **MCP Server**: Built-in Model Context Protocol server for exposing agents as MCP tools and exposing any custom tool
@@ -154,10 +158,14 @@ For LLM-based thread naming with Conversation Thread Support:
 pip install "agentkernel[thread]"
 ```
 
-For the Docker sandbox provider (the `local_subprocess` provider needs no extra):
+For the sandbox providers (the `local_subprocess` provider needs no extra; `ec2_ssm` rides
+the `aws` extra):
 
 ```bash
-pip install "agentkernel[sandbox-docker]"
+pip install "agentkernel[sandbox-docker]"   # docker provider
+pip install "agentkernel[e2b]"              # e2b cloud provider
+pip install "agentkernel[daytona]"          # daytona cloud provider
+pip install "agentkernel[aws]"              # ec2_ssm provider (boto3)
 ```
 
 **Requirements:**
@@ -1124,9 +1132,15 @@ Key fields:
 - **`enabled`** (`AK_SANDBOX__ENABLED`, default `false`) — master switch; inert when off.
 - **`agents`** — agent names the tools/prompt attach to; omit for all agents.
 - **`type`** (per profile) — `local_subprocess` (no isolation; dev/test), `docker`
-  (container isolation; `sandbox-docker` extra), or a dotted path to your own `SandboxProvider`.
+  (container isolation; `sandbox-docker` extra), `e2b` (managed micro-VMs; `e2b` extra),
+  `daytona` (cloud containers; `daytona` extra), `ec2_ssm` (attach to an existing EC2
+  instance via SSM; `aws` extra), or a dotted path to your own `SandboxProvider`.
 - **`scope`** — `per_call` (fresh per execution), `per_session` (persists across turns),
   `per_runtime` (one shared sandbox per profile).
+- **`environment`** — `managed` (default; the provider creates and disposes sandboxes) or
+  `attached` (deliberately connect to an existing environment the framework never owns,
+  e.g. an EC2 instance via `ec2_ssm`; requires the provider's `attach_to` and is validated
+  against the provider's lifecycle capabilities at startup).
 - **`policy`** — network egress, filesystem paths, cpu/memory, timeout; enforced per provider,
   fail-closed under `strict`.
 - **`identity.mode`** + **`principal_resolver`** — run code under the agent's or the invoking

{agentkernel-0.7.0 → agentkernel-0.8.1}/README.md

@@ -11,7 +11,7 @@ Agent Kernel is a lightweight **AI agent runtime** and adapter layer for buildin
 - **Multi-Framework Support**: OpenAI Agents SDK, CrewAI, LangGraph, Google ADK, Smolagents, and Pydantic AI
 - **Session Management**: Built-in session abstraction with pluggable storage backends
 - **Knowledge Bases**: Unified `KnowledgeBase` interface with ChromaDB, Neo4j, and Starburst/Trino backends via `KnowledgeBuilder`
-- **Sandbox**: Execute agent-generated code and shell commands in an isolated, permission-bounded environment with pluggable providers (`local_subprocess`, `docker`), workload profiles, policy enforcement, and per-user identity
+- **Sandbox**: Execute agent-generated code and shell commands in an isolated, permission-bounded environment with pluggable providers (`local_subprocess`, `docker`, `e2b`, `daytona`, `ec2_ssm`), workload profiles, policy enforcement, and per-user identity
 - **Flexible Deployment**: Interactive CLI, REST API, serverless, or containerized deployment — see the "Multi-Cloud Deployment" section below
 - **Pluggable Architecture**: Easy to extend with custom framework adapters
 - **MCP Server**: Built-in Model Context Protocol server for exposing agents as MCP tools and exposing any custom tool
@@ -39,10 +39,14 @@ For LLM-based thread naming with Conversation Thread Support:
 pip install "agentkernel[thread]"
 ```
 
-For the Docker sandbox provider (the `local_subprocess` provider needs no extra):
+For the sandbox providers (the `local_subprocess` provider needs no extra; `ec2_ssm` rides
+the `aws` extra):
 
 ```bash
-pip install "agentkernel[sandbox-docker]"
+pip install "agentkernel[sandbox-docker]"   # docker provider
+pip install "agentkernel[e2b]"              # e2b cloud provider
+pip install "agentkernel[daytona]"          # daytona cloud provider
+pip install "agentkernel[aws]"              # ec2_ssm provider (boto3)
 ```
 
 **Requirements:**
@@ -1009,9 +1013,15 @@ Key fields:
 - **`enabled`** (`AK_SANDBOX__ENABLED`, default `false`) — master switch; inert when off.
 - **`agents`** — agent names the tools/prompt attach to; omit for all agents.
 - **`type`** (per profile) — `local_subprocess` (no isolation; dev/test), `docker`
-  (container isolation; `sandbox-docker` extra), or a dotted path to your own `SandboxProvider`.
+  (container isolation; `sandbox-docker` extra), `e2b` (managed micro-VMs; `e2b` extra),
+  `daytona` (cloud containers; `daytona` extra), `ec2_ssm` (attach to an existing EC2
+  instance via SSM; `aws` extra), or a dotted path to your own `SandboxProvider`.
 - **`scope`** — `per_call` (fresh per execution), `per_session` (persists across turns),
   `per_runtime` (one shared sandbox per profile).
+- **`environment`** — `managed` (default; the provider creates and disposes sandboxes) or
+  `attached` (deliberately connect to an existing environment the framework never owns,
+  e.g. an EC2 instance via `ec2_ssm`; requires the provider's `attach_to` and is validated
+  against the provider's lifecycle capabilities at startup).
 - **`policy`** — network egress, filesystem paths, cpu/memory, timeout; enforced per provider,
   fail-closed under `strict`.
 - **`identity.mode`** + **`principal_resolver`** — run code under the agent's or the invoking

{agentkernel-0.7.0 → agentkernel-0.8.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "agentkernel"
-version = "0.7.0"
+version = "0.8.1"
 description = "Agent Kernel - Unified AI Agents Runtime"
 readme = "README.md"
 requires-python = ">=3.12,<3.14"
@@ -162,8 +162,14 @@ multimodal = [
 sandbox-docker = [
     "docker>=7.0.0",
 ]
-# The e2b, daytona, and kubernetes sandbox extras land with their providers in post-merge
-# iterations 9-10 (version floors confirmed against current SDKs at that point).
+e2b = [
+    "e2b-code-interpreter>=2.8.0",
+]
+daytona = [
+    # <0.199: from 0.199 the daytona api clients require pydantic>=2.13.4, which conflicts
+    # with crewai's pydantic<2.13 pin; 0.198 accepts pydantic>=2.11 and has the same SDK surface.
+    "daytona>=0.198.0,<0.199",
+]
 
 [project.scripts]
 ak = "agentkernel.cli.ak:main"

{agentkernel-0.7.0 → agentkernel-0.8.1}/src/agentkernel/cli/cli.py

@@ -1,9 +1,9 @@
 import asyncio
 import logging
 import readline  # Enables line editing and history features for input() in the CLI
+import threading
 
 from ..core import AgentService
-from ..core.config import AKConfig
 
 ak_cli_logger = logging.getLogger("ak.cli")
 
@@ -47,6 +47,32 @@ class CLI:
                 self._print(f"  {agent.name}")
             self._print()
 
+    @staticmethod
+    async def _ainput(prompt: str) -> str:
+        """
+        Reads a line of input without blocking the event loop, so background tasks keep running between turns.
+        The reader is a daemon thread, so Ctrl+C exits instead of waiting on a thread parked in `input()`.
+        :param prompt: The prompt to display to the user.
+        :return: The line entered by the user.
+        """
+        loop = asyncio.get_running_loop()
+        future: asyncio.Future[str] = loop.create_future()
+
+        def resolve(setter, value):
+            if not future.done():
+                setter(value)
+
+        def read():
+            try:
+                line = input(prompt)
+            except BaseException as e:  # noqa: BLE001 - relayed to the awaiting caller
+                loop.call_soon_threadsafe(resolve, future.set_exception, e)
+            else:
+                loop.call_soon_threadsafe(resolve, future.set_result, line)
+
+        threading.Thread(target=read, daemon=True, name="ak-cli-input").start()
+        return await future
+
     async def run(self):
         self._print("AgentKernel CLI (type !help for commands or !quit to exit):")
         self._service.select()
@@ -57,7 +83,7 @@ class CLI:
         while True:
             try:
                 name = self._service.agent.name if self._service.agent else "none"
-                prompt = input(f"({name}) >> ")
+                prompt = await self._ainput(f"({name}) >> ")
                 if not prompt.strip():
                     continue
                 if prompt.startswith("!"):

{agentkernel-0.7.0 → agentkernel-0.8.1}/src/agentkernel/core/base.py

@@ -1,8 +1,10 @@
 import asyncio
 import contextvars
+import copy
 import logging
+import pickle
 from abc import ABC, abstractmethod
-from collections.abc import AsyncGenerator, Iterator
+from collections.abc import AsyncGenerator, Iterator, Mapping
 from enum import Enum
 from typing import Any, ClassVar, Self, cast
 
@@ -10,6 +12,8 @@ from .hooks import PostHook, PreHook
 from .model import AgentReply, AgentRequest
 from .util.key_value_cache import KeyValueCache
 
+_log = logging.getLogger("ak.core.runner")
+
 
 class Session:
     """
@@ -39,6 +43,7 @@ class Session:
 
         VOLATILE_CACHE = "v_cache"
         NON_VOLATILE_CACHE = "nv_cache"
+        FRAMEWORK_CONTEXT = "framework_context"
 
     current_session: ClassVar[contextvars.ContextVar[Self | None]] = contextvars.ContextVar("current_session", default=None)
 
@@ -157,6 +162,35 @@ class Session:
         """
         return cast(KeyValueCache, self.get(Session.Keys.NON_VOLATILE_CACHE.value))
 
+    def get_framework_context(self) -> dict | None:
+        """
+        Returns the live per-run framework context dict, so hooks can edit it in place.
+        Never auto-creates the key: absent means "nothing injected", {} means "injected but empty".
+        :return: The stored framework context dict, or None when the key is absent.
+        """
+        return self.get(Session.Keys.FRAMEWORK_CONTEXT.value)
+
+    def set_framework_context(self, context: dict) -> dict:
+        """
+        Seeds or replaces the per-run framework context carried across turns.
+        :param context: The context dict to store. Must be picklable, since sessions are persisted with pickle.
+        :return: The stored context dict.
+        :raises TypeError: If context is not a dict.
+        """
+        if not isinstance(context, dict):
+            raise TypeError(
+                f"Session '{self._id}' framework_context must be a dict, got "
+                f"{type(context).__name__}. The reserved framework_context key carries a "
+                f"per-run context/state dict; wrap the value in a dict before setting it."
+            )
+        return self.set(Session.Keys.FRAMEWORK_CONTEXT.value, context)
+
+    def clear_framework_context(self) -> None:
+        """
+        Deletes the per-run framework context, so nothing is injected on the next turn.
+        """
+        self.delete(Session.Keys.FRAMEWORK_CONTEXT.value)
+
     def set(self, key: str, value: Any) -> Any:
         """
         Sets a session data object for the specified key.
@@ -220,6 +254,92 @@ class Runner(ABC):
         """
         return self._name
 
+    def _load_framework_context(self, session: Session | None) -> dict | None:
+        """
+        Loads the per-run framework context to inject into this run.
+        Returns a deep copy, so a failed run leaves the stored context intact.
+        :param session: The session to read the framework context from, or None.
+        :return: A deep copy of the stored dict, or None when nothing is stored.
+        :raises TypeError: If the stored value is not a dict.
+        """
+        if session is None:
+            return None
+        stored = session.get_framework_context()
+        if stored is None:
+            return None
+        if not isinstance(stored, dict):
+            raise TypeError(
+                f"Session '{session.id}' framework_context must be a dict, got "
+                f"{type(stored).__name__}. The reserved framework_context key carries a "
+                f"per-run context/state dict; wrap the value in a dict before setting it."
+            )
+        return copy.deepcopy(stored)
+
+    def _store_framework_context(self, session: Session | None, incoming: dict | None, produced: Mapping[str, Any] | None) -> None:
+        """
+        Merges the framework's post-run state over the context loaded this turn and stores the result.
+        Keys the framework touched win; untouched caller keys are preserved. No-op when nothing was loaded.
+        :param session: The session to write the merged context back to, or None.
+        :param incoming: The context loaded this turn, or None when nothing was stored.
+        :param produced: The framework's post-run state, or None.
+        """
+        if session is None or incoming is None:
+            return
+        merged = dict(incoming)
+        if produced:
+            merged.update(produced)
+        self._ensure_framework_context_picklable(session, merged)
+        session.set_framework_context(merged)
+
+    @staticmethod
+    def _not_picklable(value: Any) -> bool:
+        """
+        Checks whether the given value can be pickled.
+        :param value: The value to test.
+        :return: True if the value cannot be pickled.
+        """
+        try:
+            pickle.dumps(value)
+            return False
+        except Exception:
+            return True
+
+    @classmethod
+    def _ensure_framework_context_picklable(cls, session: Session, ctx: Mapping[str, Any]) -> None:
+        """
+        Fails fast if the context cannot be pickled, before it can break the session store.
+        :param session: The session whose id is named in the error.
+        :param ctx: The framework context to validate.
+        :raises TypeError: If any value in ctx is not pickle-serializable.
+        """
+        try:
+            pickle.dumps(ctx)
+        except Exception as exc:
+            offender = next(
+                (f"{k!r} ({type(v).__name__})" for k, v in ctx.items() if cls._not_picklable(v)),
+                "<unknown key>",
+            )
+            raise TypeError(
+                f"Session '{session.id}' framework_context is not picklable; "
+                f"offending entry: {offender}. framework_context values must be "
+                f"pickle-serializable so the session can be persisted."
+            ) from exc
+
+    @staticmethod
+    def _log_framework_context_stream_failure(session: Session | None, error: Exception) -> None:
+        """
+        Logs a framework context write-back failure at the end of a streamed run instead of raising it.
+        Raising here would surface as a transport error and skip the turn's session store.
+        :param session: The session whose write-back failed.
+        :param error: The exception raised while producing or storing the context.
+        """
+        session_id = session.id if session is not None else "<none>"
+        _log.error(
+            f"Session '{session_id}': framework_context write-back was skipped at the end of a "
+            f"streamed run; the previously stored context is left intact. Error: {error}",
+            exc_info=error,
+        )
+
     @abstractmethod
     async def run(self, agent: Any, session: Session, requests: list[AgentRequest]) -> AgentReply:
         """
@@ -351,3 +471,16 @@ class Agent(ABC):
 
         for tool in SystemToolFactory.get_all(self.name):
             self.attach_tool(tool.func)
+
+    @staticmethod
+    def _append_tools(agent: Any, wrapped: list[Any]) -> None:
+        """
+        Appends already-wrapped tools to a framework agent's list-based `tools` attribute, skipping duplicates.
+        :param agent: The framework-native agent holding the `tools` attribute.
+        :param wrapped: The wrapped tools to attach.
+        """
+        for w in wrapped:
+            if not hasattr(agent, "tools") or agent.tools is None:
+                agent.tools = []
+            if w not in agent.tools:
+                agent.tools.append(w)

{agentkernel-0.7.0 → agentkernel-0.8.1}/src/agentkernel/core/config.py

@@ -427,6 +427,22 @@ class _SandboxE2BConfig(BaseModel):
 class _SandboxDaytonaConfig(BaseModel):
     api_key_env: str = Field(default="DAYTONA_API_KEY", description="Name of the environment variable holding the Daytona API key")
     target: Optional[str] = Field(default=None, description="Daytona target/region; None uses the SDK default")
+    image: Optional[str] = Field(
+        default=None,
+        description="Container image for the sandbox (e.g. 'python:3.12-slim' or a registry image). Mutually exclusive with 'snapshot'; when neither is set Daytona uses its default snapshot.",
+    )
+    snapshot: Optional[str] = Field(
+        default=None,
+        description="Named Daytona snapshot to launch from. Mutually exclusive with 'image'; when neither is set Daytona uses its default snapshot.",
+    )
+    env_vars: dict[str, str] = Field(default_factory=dict, description="Environment variables set inside the sandbox")
+
+    @model_validator(mode="after")
+    def _image_snapshot_exclusive(self) -> "_SandboxDaytonaConfig":
+        """A sandbox launches from exactly one base — reject configuring both."""
+        if self.image and self.snapshot:
+            raise ValueError("daytona config sets both 'image' and 'snapshot'; they are mutually exclusive — pick one")
+        return self
 
 
 class _SandboxBedrockAgentCoreConfig(BaseModel):
@@ -446,10 +462,10 @@ class _SandboxEC2SSMConfig(BaseModel):
     attach_to: Optional[str] = Field(default=None, description="EC2 instance id to run commands against via SSM (attach-only)")
 
 
-class _SandboxBrokerConfig(BaseModel):
+class _ExecutionBrokerConfig(BaseModel):
     flavor: str = Field(
         default="thread",
-        description="Broker flavor: 'embedded' | 'thread' (in-process, available now) | a dotted path to a SandboxBroker subclass. The AWS 'sqs' flavor is planned in a later iteration.",
+        description="Broker flavor: 'embedded' | 'thread' (in-process, available now) | a dotted path to an ExecutionBroker subclass. The AWS 'sqs' flavor is planned in a later iteration.",
     )
     wait_timeout: float = Field(default=60.0, description="Max seconds a synchronous wait blocks before promotion to a task (0 = always promote)")
     inline_payload_max_bytes: int = Field(
@@ -478,6 +494,12 @@ class _SandboxProfileConfig(BaseModel):
         pattern="^(per_call|per_session|per_runtime)$",
         description="Sandbox lifetime: 'per_call' (new per execution), 'per_session' (per AK session), or 'per_runtime' (shared)",
     )
+    environment: str = Field(
+        default="managed",
+        pattern="^(managed|attached)$",
+        description="Environment lifecycle: 'managed' (the provider creates and disposes sandboxes) or 'attached' "
+        "(deliberately connect to an existing environment the framework never owns; requires the provider's attach_to)",
+    )
     idle_timeout: int = Field(default=1800, description="Seconds of inactivity before a sandbox session is closed on next touch")
     identity: _SandboxIdentityConfig = Field(default_factory=_SandboxIdentityConfig, description="Execution identity configuration")
     policy: _SandboxPolicyConfig = Field(
@@ -508,7 +530,7 @@ class _SandboxConfig(BaseModel):
         default=None, description="Dotted path to a PrincipalResolver mapping the session/agent to a SandboxPrincipal"
     )
     tool_output_max_chars: int = Field(default=8000, description="Maximum characters of tool output returned to the agent before truncation")
-    broker: _SandboxBrokerConfig = Field(default_factory=_SandboxBrokerConfig, description="Sandbox broker configuration")
+    broker: _ExecutionBrokerConfig = Field(default_factory=_ExecutionBrokerConfig, description="Sandbox broker configuration")
     profiles: dict[str, _SandboxProfileConfig] = Field(
         default_factory=dict, description="Named workload profiles, each selecting a provider and its policy/identity"
     )
@@ -522,6 +544,11 @@ class _SandboxConfig(BaseModel):
         pattern="^(per_call|per_session|per_runtime)$",
         description="Single-backend sugar: scope for the synthesized default profile",
     )
+    environment: Optional[str] = Field(
+        default=None,
+        pattern="^(managed|attached)$",
+        description="Single-backend sugar: environment lifecycle for the synthesized default profile",
+    )
     local_subprocess: Optional[_SandboxLocalSubprocessConfig] = Field(
         default=None, description="Single-backend sugar: 'local_subprocess' provider configuration"
     )
@@ -554,6 +581,8 @@ class _SandboxConfig(BaseModel):
             }
             if self.scope is not None:
                 profile_kwargs["scope"] = self.scope
+            if self.environment is not None:
+                profile_kwargs["environment"] = self.environment
             self.profiles = {self.default_profile: _SandboxProfileConfig(**profile_kwargs)}
         return self
 

{agentkernel-0.7.0 → agentkernel-0.8.1}/src/agentkernel/deployment/azure/akfunction.py

@@ -41,6 +41,8 @@ class AzureFunctions:
 
             if isinstance(body, dict) and body.get("body") is not None:
                 body = BaseRunRequest.model_validate(body["body"])
+            elif isinstance(body, dict) and body:
+                body = BaseRunRequest.model_validate(body)
             else:
                 raise ValueError("Invalid request, request body cannot be empty or null")