agentkit-sdk-python 0.5.5__tar.gz → 0.5.6__tar.gz

{agentkit_sdk_python-0.5.5/agentkit_sdk_python.egg-info → agentkit_sdk_python-0.5.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentkit-sdk-python
-Version: 0.5.5
+Version: 0.5.6
 Summary: Python SDK for transforming any AI agent into a production-ready application. Framework-agnostic primitives for runtime, memory, authentication, and tools with volcengine-managed infrastructure.
 Author-email: Xiangrui Cheng <innsdcc@gmail.com>, Yumeng Bao <baoyumeng.123@gmail.com>, Yaozheng Fang <fangyozheng@gmail.com>, Guodong Li <cu.eric.lee@gmail.com>
 License:                                  Apache License

{agentkit_sdk_python-0.5.5 → agentkit_sdk_python-0.5.6}/agentkit/client/base_service_client.py

@@ -23,7 +23,7 @@ from dataclasses import dataclass
 
 from volcengine.ApiInfo import ApiInfo
 from volcengine.base.Service import Service
-from volcengine.Credentials import Credentials
+from volcengine.Credentials import Credentials as VolcCredentials
 from volcengine.ServiceInfo import ServiceInfo
 
 from agentkit.platform import (
@@ -31,9 +31,22 @@ from agentkit.platform import (
     resolve_credentials,
     resolve_endpoint,
 )
+from agentkit.platform.configuration import Credentials as PlatformCredentials
+from agentkit.platform.provider import CloudProvider
 from agentkit.utils.ve_sign import ensure_x_custom_source_header
 
 T = TypeVar("T")
+_CREDENTIAL_ERROR_TOKENS = frozenset(
+    {
+        "invalidaccesskeyid",
+        "invalidaccesskey",
+        "signaturedoesnotmatch",
+        "expiredtoken",
+        "invalidsecuritytoken",
+        "invalidtoken",
+        "requestexpired",
+    }
+)
 
 
 @dataclass
@@ -94,6 +107,9 @@ class BaseServiceClient(Service):
         """
         if platform_config is None:
             platform_config = VolcConfiguration()
+        self._platform_config = platform_config
+        self._explicit_credentials = bool(access_key and secret_key)
+        self._credential_source: Optional[str] = None
 
         creds = resolve_credentials(
             service=service,
@@ -101,6 +117,7 @@ class BaseServiceClient(Service):
             explicit_secret_key=secret_key or None,
             platform_config=platform_config,
         )
+        self._credential_source = getattr(creds, "source", None)
 
         ep = resolve_endpoint(
             service=service,
@@ -132,7 +149,7 @@ class BaseServiceClient(Service):
         self.service_info = ServiceInfo(
             host=self.host,
             header=effective_header,
-            credentials=Credentials(
+            credentials=VolcCredentials(
                 ak=self.access_key,
                 sk=self.secret_key,
                 service=self.service,
@@ -152,6 +169,57 @@ class BaseServiceClient(Service):
         # need setting ak/sk after initializing Service to avoid volcengine SDK bugs
         self.set_ak(self.access_key)
         self.set_sk(self.secret_key)
+        if self.session_token:
+            self.set_session_token(self.session_token)
+
+    def _should_auto_refresh_vefaas_credentials(self) -> bool:
+        if self._explicit_credentials:
+            return False
+        if self._platform_config.provider != CloudProvider.VOLCENGINE:
+            return False
+        return self._credential_source == "vefaas"
+
+    def _apply_credentials(self, creds: PlatformCredentials) -> bool:
+        new_token = creds.session_token or ""
+        old_token = self.session_token or ""
+        if (
+            creds.access_key == self.access_key
+            and creds.secret_key == self.secret_key
+            and new_token == old_token
+        ):
+            return False
+
+        self.access_key = creds.access_key
+        self.secret_key = creds.secret_key
+        self.session_token = creds.session_token
+
+        self.service_info.credentials = VolcCredentials(
+            ak=self.access_key,
+            sk=self.secret_key,
+            service=self.service,
+            region=self.region,
+            session_token=self.session_token or "",
+        )
+        self.set_ak(self.access_key)
+        self.set_sk(self.secret_key)
+        self.set_session_token(self.session_token or "")
+        return True
+
+    def _refresh_credentials_if_needed(self, *, force: bool = False) -> bool:
+        if not self._should_auto_refresh_vefaas_credentials():
+            return False
+        creds = self._platform_config.get_vefaas_iam_credentials(force=force)
+        if not creds:
+            return False
+        return self._apply_credentials(creds)
+
+    def _is_probable_credential_error_code(self, code: str) -> bool:
+        c = (code or "").lower()
+        return c in _CREDENTIAL_ERROR_TOKENS
+
+    def _is_probable_credential_error_text(self, text: str) -> bool:
+        t = (text or "").lower()
+        return any(token in t for token in _CREDENTIAL_ERROR_TOKENS)
 
     def _build_api_info(self) -> Dict[str, ApiInfo]:
         """
@@ -213,27 +281,47 @@ class BaseServiceClient(Service):
         Raises:
             Exception: If API call fails or returns an error
         """
-        # Make API call
-        try:
-            res = self.json(
-                api=api_action,
-                params=params or {},
-                body=json.dumps(request.model_dump(by_alias=True, exclude_none=True)),
-            )
-        except Exception as e:
-            raise Exception(f"Failed to {api_action}: {str(e)}")
-
-        if not res:
-            raise Exception(f"Empty response from {api_action} request.")
-
-        # Parse response
-        response_data = json.loads(res)
-
-        # Check for errors
-        metadata = response_data.get("ResponseMetadata", {})
-        if metadata.get("Error"):
-            error_msg = metadata.get("Error", {}).get("Message", "Unknown error")
-            raise Exception(f"Failed to {api_action}: {error_msg}")
-
-        # Return typed response
-        return response_type(**response_data.get("Result", {}))
+        self._refresh_credentials_if_needed()
+        last_error: Optional[BaseException] = None
+
+        for attempt in (0, 1):
+            if attempt == 1:
+                self._refresh_credentials_if_needed(force=True)
+
+            try:
+                res = self.json(
+                    api=api_action,
+                    params=params or {},
+                    body=json.dumps(
+                        request.model_dump(by_alias=True, exclude_none=True)
+                    ),
+                )
+            except Exception as e:
+                last_error = e
+                if attempt == 0 and self._is_probable_credential_error_text(str(e)):
+                    continue
+                raise Exception(f"Failed to {api_action}: {str(e)}") from e
+
+            if not res:
+                raise Exception(f"Empty response from {api_action} request.")
+
+            response_data = json.loads(res)
+            metadata = response_data.get("ResponseMetadata", {})
+            if metadata.get("Error"):
+                err = metadata.get("Error", {}) or {}
+                error_code = str(err.get("Code") or "")
+                error_msg = str(err.get("Message") or "Unknown error")
+                if attempt == 0 and (
+                    self._is_probable_credential_error_code(error_code)
+                    or self._is_probable_credential_error_text(error_msg)
+                ):
+                    continue
+                raise Exception(f"Failed to {api_action}: {error_msg}")
+
+            return response_type(**response_data.get("Result", {}))
+
+        if last_error is not None:
+            raise Exception(
+                f"Failed to {api_action}: {str(last_error)}"
+            ) from last_error
+        raise Exception(f"Failed to {api_action}: Unknown error")

{agentkit_sdk_python-0.5.5 → agentkit_sdk_python-0.5.6}/agentkit/platform/__init__.py

@@ -88,7 +88,9 @@ def resolve_credentials(
     # 1. Explicit args take absolute precedence
     if explicit_access_key and explicit_secret_key:
         return Credentials(
-            access_key=explicit_access_key, secret_key=explicit_secret_key
+            access_key=explicit_access_key,
+            secret_key=explicit_secret_key,
+            source="explicit_args",
         )
 
     cfg = platform_config or VolcConfiguration()

{agentkit_sdk_python-0.5.5 → agentkit_sdk_python-0.5.6}/agentkit/platform/configuration.py

@@ -17,7 +17,10 @@ from __future__ import annotations
 import json
 import logging
 import os
+import threading
+import time
 from dataclasses import dataclass
+from datetime import datetime, timezone
 from pathlib import Path
 from typing import Optional, Dict
 
@@ -43,6 +46,8 @@ from agentkit.utils.global_config_io import (
 logger = logging.getLogger(__name__)
 
 VEFAAS_IAM_CREDENTIAL_PATH = "/var/run/secrets/iam/credential"
+VEFAAS_IAM_CREDENTIAL_FALLBACK_TTL_SECONDS = 60
+VEFAAS_IAM_CREDENTIAL_MIN_VALIDITY_SECONDS = 60
 
 
 @dataclass
@@ -59,6 +64,8 @@ class Credentials:
     access_key: str
     secret_key: str
     session_token: Optional[str] = None
+    expires_at: Optional[datetime] = None
+    source: Optional[str] = None
 
     def __repr__(self) -> str:
         masked_sk = "*" * 6
@@ -68,7 +75,9 @@ class Credentials:
         return (
             f"Credentials(access_key='{self.access_key}', "
             f"secret_key='{masked_sk}', "
-            f"session_token={'***' if self.session_token else 'None'})"
+            f"session_token={'***' if self.session_token else 'None'}, "
+            f"expires_at={self.expires_at.isoformat() if self.expires_at else 'None'}, "
+            f"source={self.source or 'None'})"
         )
 
 
@@ -115,6 +124,15 @@ class VolcConfiguration:
             or normalize_cloud_provider(cfg_provider)
             or CloudProvider.VOLCENGINE
         )
+        self._vefaas_cache_mtime_ns: Optional[int] = None
+        self._vefaas_cache_loaded_at_monotonic: Optional[float] = None
+        self._vefaas_cache_credentials: Optional[Credentials] = None
+        self._vefaas_lock = threading.Lock()
+
+    def get_vefaas_iam_credentials(
+        self, *, force: bool = False
+    ) -> Optional[Credentials]:
+        return self._get_credential_from_vefaas_iam(force=force)
 
     @property
     def provider(self) -> CloudProvider:
@@ -202,11 +220,13 @@ class VolcConfiguration:
         """
         # 1. Explicit
         if self._ak and self._sk:
-            return Credentials(
+            creds = Credentials(
                 access_key=self._ak,
                 secret_key=self._sk,
                 session_token=self._token,
+                source="explicit",
             )
+            return creds
 
         # 2. Service-specific Environment Variables
         if creds := self._get_service_env_credentials(service_key):
@@ -293,7 +313,7 @@ class VolcConfiguration:
                 sk = sk or _get(f"VOLC_{svc_upper}_SECRETKEY")
 
         if ak and sk:
-            return Credentials(access_key=ak, secret_key=sk)
+            return Credentials(access_key=ak, secret_key=sk, source="dotenv")
 
         # Global keys
         if self._provider == CloudProvider.BYTEPLUS:
@@ -304,7 +324,7 @@ class VolcConfiguration:
             sk = _get("VOLCENGINE_SECRET_KEY") or _get("VOLC_SECRETKEY")
 
         if ak and sk:
-            return Credentials(access_key=ak, secret_key=sk)
+            return Credentials(access_key=ak, secret_key=sk, source="dotenv")
 
         return None
 
@@ -323,7 +343,7 @@ class VolcConfiguration:
                 sk = sk or os.getenv(f"VOLC_{svc_upper}_SECRETKEY")
 
         if ak and sk:
-            return Credentials(access_key=ak, secret_key=sk)
+            return Credentials(access_key=ak, secret_key=sk, source="service_env")
         return None
 
     def _get_global_env_credentials(self) -> Optional[Credentials]:
@@ -335,7 +355,7 @@ class VolcConfiguration:
             sk = os.getenv("VOLCENGINE_SECRET_KEY") or os.getenv("VOLC_SECRETKEY")
 
         if ak and sk:
-            return Credentials(access_key=ak, secret_key=sk)
+            return Credentials(access_key=ak, secret_key=sk, source="global_env")
         return None
 
     def _get_config_file_credentials(self) -> Optional[Credentials]:
@@ -346,10 +366,14 @@ class VolcConfiguration:
             gc_ak = get_global_config_str("volcengine", "access_key")
             gc_sk = get_global_config_str("volcengine", "secret_key")
         if gc_ak and gc_sk:
-            return Credentials(access_key=gc_ak, secret_key=gc_sk)
+            return Credentials(
+                access_key=gc_ak, secret_key=gc_sk, source="global_config"
+            )
         return None
 
-    def _get_credential_from_vefaas_iam(self) -> Optional[Credentials]:
+    def _get_credential_from_vefaas_iam(
+        self, *, force: bool = False
+    ) -> Optional[Credentials]:
         """
         Internal helper to attempt retrieving credentials from VeFaaS IAM environment.
         """
@@ -359,15 +383,90 @@ class VolcConfiguration:
         if not path.exists():
             return None
 
+        try:
+            mtime_ns = path.stat().st_mtime_ns
+        except Exception:
+            return None
+
+        now = datetime.now(tz=timezone.utc)
+
+        def _get_cached_if_usable(
+            *, min_validity_seconds: int
+        ) -> Optional[Credentials]:
+            with self._vefaas_lock:
+                cached = self._vefaas_cache_credentials
+                if not cached or self._vefaas_cache_mtime_ns != mtime_ns:
+                    return None
+
+                if cached.expires_at is None:
+                    loaded_at = self._vefaas_cache_loaded_at_monotonic
+                    if loaded_at is None:
+                        return None
+                    if (
+                        time.monotonic() - loaded_at
+                        <= VEFAAS_IAM_CREDENTIAL_FALLBACK_TTL_SECONDS
+                    ):
+                        return cached
+                    return None
+
+                if (cached.expires_at - now).total_seconds() > min_validity_seconds:
+                    return cached
+                return None
+
+        if not force:
+            cached = _get_cached_if_usable(
+                min_validity_seconds=VEFAAS_IAM_CREDENTIAL_MIN_VALIDITY_SECONDS
+            )
+            if cached is not None:
+                return cached
+
         try:
             with open(path, "r") as f:
                 cred_dict = json.load(f)
-                return Credentials(
-                    access_key=cred_dict.get("access_key_id", ""),
-                    secret_key=cred_dict.get("secret_access_key", ""),
-                    session_token=cred_dict.get("session_token", ""),
+                access_key = str(cred_dict.get("access_key_id") or "")
+                secret_key = str(cred_dict.get("secret_access_key") or "")
+                session_token = str(cred_dict.get("session_token") or "") or None
+
+                expired_time_raw = cred_dict.get("expired_time")
+                expires_at: Optional[datetime] = None
+                if expired_time_raw:
+                    try:
+                        s = str(expired_time_raw)
+                        if s.endswith("Z"):
+                            s = s[:-1] + "+00:00"
+                        expires_at = datetime.fromisoformat(s)
+                        if expires_at.tzinfo is None:
+                            expires_at = expires_at.replace(tzinfo=timezone.utc)
+                        expires_at = expires_at.astimezone(timezone.utc)
+                    except Exception:
+                        expires_at = None
+
+                if not access_key or not secret_key:
+                    return None
+
+                if expires_at is not None:
+                    if expires_at <= now:
+                        return None
+
+                creds = Credentials(
+                    access_key=access_key,
+                    secret_key=secret_key,
+                    session_token=session_token,
+                    expires_at=expires_at,
+                    source="vefaas",
                 )
+                with self._vefaas_lock:
+                    self._vefaas_cache_mtime_ns = mtime_ns
+                    self._vefaas_cache_loaded_at_monotonic = time.monotonic()
+                    self._vefaas_cache_credentials = creds
+                return creds
         except Exception as e:
+            if not force:
+                cached = _get_cached_if_usable(
+                    min_validity_seconds=VEFAAS_IAM_CREDENTIAL_MIN_VALIDITY_SECONDS
+                )
+                if cached is not None:
+                    return cached
             logger.warning(f"Found VeFaaS credential file but failed to parse: {e}")
             return None
 

{agentkit_sdk_python-0.5.5 → agentkit_sdk_python-0.5.6}/agentkit/version.py

@@ -12,4 +12,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-VERSION = "0.5.5"
+VERSION = "0.5.6"

{agentkit_sdk_python-0.5.5 → agentkit_sdk_python-0.5.6/agentkit_sdk_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentkit-sdk-python
-Version: 0.5.5
+Version: 0.5.6
 Summary: Python SDK for transforming any AI agent into a production-ready application. Framework-agnostic primitives for runtime, memory, authentication, and tools with volcengine-managed infrastructure.
 Author-email: Xiangrui Cheng <innsdcc@gmail.com>, Yumeng Bao <baoyumeng.123@gmail.com>, Yaozheng Fang <fangyozheng@gmail.com>, Guodong Li <cu.eric.lee@gmail.com>
 License:                                  Apache License

{agentkit_sdk_python-0.5.5 → agentkit_sdk_python-0.5.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agentkit-sdk-python"
-version = "0.5.5"
+version = "0.5.6"
 description = "Python SDK for transforming any AI agent into a production-ready application. Framework-agnostic primitives for runtime, memory, authentication, and tools with volcengine-managed infrastructure."
 readme = "README.md"
 requires-python = ">=3.10"