agentkit-sdk-python 0.5.9__tar.gz → 0.6.0__tar.gz

{agentkit_sdk_python-0.5.9 → agentkit_sdk_python-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentkit-sdk-python
-Version: 0.5.9
+Version: 0.6.0
 Summary: Python SDK for transforming any AI agent into a production-ready application. Framework-agnostic primitives for runtime, memory, authentication, and tools with volcengine-managed infrastructure.
 Author-email: Xiangrui Cheng <innsdcc@gmail.com>, Yumeng Bao <baoyumeng.123@gmail.com>, Yaozheng Fang <fangyozheng@gmail.com>, Guodong Li <cu.eric.lee@gmail.com>
 License:                                  Apache License
@@ -238,6 +238,7 @@ Requires-Dist: tos>=2.8.7
 Requires-Dist: volcengine
 Requires-Dist: pyfiglet>=1.0.2
 Requires-Dist: typing_extensions>=4.12
+Requires-Dist: websocket-client>=1.8.0
 Requires-Dist: pyreadline3; sys_platform == "win32"
 Provides-Extra: extensions
 Provides-Extra: toolkit

{agentkit_sdk_python-0.5.9 → agentkit_sdk_python-0.6.0}/agentkit/apps/agent_server_app/agent_server_app.py

@@ -49,6 +49,13 @@ from veadk.runner import Runner
 from agentkit.apps.agent_server_app.middleware import (
     AgentkitTelemetryHTTPMiddleware,
 )
+from agentkit.apps.agent_server_app.origin import (
+    add_cors_compat_middleware,
+    adk_supports_regex_origins,
+    resolve_agentkit_allow_origins,
+    split_allow_origins,
+    supports_get_fast_api_kwarg,
+)
 from agentkit.apps.agent_server_app.telemetry import telemetry
 from agentkit.apps.base_app import BaseAgentkitApp
 
@@ -101,6 +108,7 @@ class AgentkitAgentServerApp(BaseAgentkitApp):
         *,
         app: App | None = None,
         allow_origins: list[str] | None = None,
+        allow_origin_regex: str | list[str] | None = None,
     ) -> None:
         super().__init__()
 
@@ -153,9 +161,36 @@ class AgentkitAgentServerApp(BaseAgentkitApp):
                 await handler()
             yield
 
-        self.app = self.server.get_fast_api_app(
-            lifespan=lifespan, allow_origins=allow_origins
+        resolved_allow_origins = resolve_agentkit_allow_origins(
+            allow_origins=allow_origins,
+            allow_origin_regex=allow_origin_regex,
+        )
+        get_fast_api_app = self.server.get_fast_api_app
+        get_fast_api_app_kwargs: dict[str, Any] = {"lifespan": lifespan}
+        supports_allow_origins = supports_get_fast_api_kwarg(
+            get_fast_api_app, "allow_origins"
         )
+        supports_regex_origins = adk_supports_regex_origins()
+        needs_cors_compat_middleware = False
+
+        if supports_allow_origins:
+            if supports_regex_origins:
+                get_fast_api_app_kwargs["allow_origins"] = (
+                    resolved_allow_origins or None
+                )
+            else:
+                literal_origins, combined_regex = split_allow_origins(
+                    resolved_allow_origins
+                )
+                get_fast_api_app_kwargs["allow_origins"] = literal_origins or None
+                needs_cors_compat_middleware = combined_regex is not None
+        else:
+            needs_cors_compat_middleware = bool(resolved_allow_origins)
+
+        self.app = get_fast_api_app(**get_fast_api_app_kwargs)
+
+        if needs_cors_compat_middleware:
+            add_cors_compat_middleware(self.app, resolved_allow_origins)
 
         @self.app.post("/run_sse")
         async def run_agent_sse(req: RunAgentRequest) -> StreamingResponse:

agentkit_sdk_python-0.6.0/agentkit/apps/agent_server_app/origin.py

@@ -0,0 +1,190 @@
+# Copyright (c) 2025 Beijing Volcano Engine Technology Co., Ltd. and/or its affiliates.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import inspect
+import os
+import re
+from collections.abc import Callable
+from typing import Any
+
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+
+_REGEX_PREFIX = "regex:"
+
+DEFAULT_AGENTKIT_ALLOW_ORIGINS = ["*"]
+
+STRICT_AGENTKIT_HOSTED_ORIGINS = [
+    "https://console.volcengine.com",
+    "https://console.byteplus.com",
+    "regex:https://.*\\.volcengine\\.com",
+    "regex:https://.*\\.volceapi\\.com",
+    "regex:https://.*\\.byteplus\\.com",
+    "regex:https://.*\\.byteplusapi\\.com",
+]
+
+
+def resolve_agentkit_allow_origins(
+    *,
+    allow_origins: list[str] | None,
+    allow_origin_regex: str | list[str] | None = None,
+) -> list[str]:
+    """Resolve AgentKit CORS origins with SDK defaults and env overrides."""
+
+    env_origins = _get_env_list("AGENTKIT_ALLOW_ORIGINS", "ADK_ALLOW_ORIGINS")
+    env_regexes = _get_env_list(
+        "AGENTKIT_ALLOW_ORIGIN_REGEX",
+        "ADK_ALLOW_ORIGIN_REGEX",
+    )
+    if allow_origins is not None:
+        origins = list(allow_origins)
+    elif env_origins is not None or env_regexes is not None:
+        origins = env_origins or []
+    elif _truthy_env("AGENTKIT_DISABLE_DEFAULT_ALLOW_ORIGINS"):
+        origins = []
+    else:
+        origins = list(DEFAULT_AGENTKIT_ALLOW_ORIGINS)
+
+    if allow_origin_regex is None:
+        regexes = env_regexes or []
+    else:
+        regexes = _as_list(allow_origin_regex)
+
+    resolved = [_normalize_origin(origin) for origin in origins]
+    resolved.extend(_normalize_regex(pattern) for pattern in regexes)
+
+    deduped = _dedupe(resolved)
+    _validate_regex_origins(deduped)
+    return deduped
+
+
+def split_allow_origins(allow_origins: list[str]) -> tuple[list[str], str | None]:
+    """Split ADK-style origins into literal origins and a combined regex."""
+
+    literal_origins: list[str] = []
+    regex_patterns: list[str] = []
+    for origin in allow_origins:
+        if origin.startswith(_REGEX_PREFIX):
+            pattern = origin[len(_REGEX_PREFIX) :]
+            if pattern:
+                regex_patterns.append(pattern)
+        else:
+            literal_origins.append(origin)
+
+    return literal_origins, "|".join(regex_patterns) if regex_patterns else None
+
+
+def supports_get_fast_api_kwarg(func: Callable[..., Any], kwarg_name: str) -> bool:
+    """Return whether a callable accepts a given keyword argument."""
+
+    try:
+        signature = inspect.signature(func)
+    except (TypeError, ValueError):
+        return True
+
+    for parameter in signature.parameters.values():
+        if parameter.kind == inspect.Parameter.VAR_KEYWORD:
+            return True
+    return kwarg_name in signature.parameters
+
+
+def adk_supports_regex_origins() -> bool:
+    """Return whether installed ADK understands `regex:` allow_origins entries."""
+
+    try:
+        from google.adk.cli import adk_web_server
+
+        return hasattr(adk_web_server, "_parse_cors_origins")
+    except Exception:
+        return False
+
+
+def add_cors_compat_middleware(app: FastAPI, allow_origins: list[str]) -> None:
+    """Add CORS middleware for ADK versions that cannot parse regex origins."""
+
+    literal_origins, allow_origin_regex = split_allow_origins(allow_origins)
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=literal_origins,
+        allow_origin_regex=allow_origin_regex,
+        allow_credentials=True,
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
+
+
+def _normalize_origin(origin: str) -> str:
+    origin = origin.strip()
+    if not origin or origin == "*" or origin.startswith(_REGEX_PREFIX):
+        return origin
+    if "*" in origin:
+        return _normalize_regex(_glob_to_regex(origin))
+    return origin
+
+
+def _normalize_regex(pattern: str) -> str:
+    pattern = pattern.strip()
+    if not pattern:
+        return pattern
+    if pattern.startswith(_REGEX_PREFIX):
+        return pattern
+    return f"{_REGEX_PREFIX}{pattern}"
+
+
+def _glob_to_regex(origin: str) -> str:
+    return re.escape(origin).replace("\\*", ".*")
+
+
+def _validate_regex_origins(origins: list[str]) -> None:
+    for origin in origins:
+        if not origin.startswith(_REGEX_PREFIX):
+            continue
+        pattern = origin[len(_REGEX_PREFIX) :]
+        try:
+            re.compile(pattern)
+        except re.error as e:
+            raise ValueError(f"Invalid allow origin regex '{pattern}': {e}") from e
+
+
+def _get_env_list(*names: str) -> list[str] | None:
+    for name in names:
+        value = os.getenv(name)
+        if value is None:
+            continue
+        return [item.strip() for item in value.split(",") if item.strip()]
+    return None
+
+
+def _truthy_env(name: str) -> bool:
+    value = os.getenv(name, "")
+    return value.lower() in {"1", "true", "yes", "on"}
+
+
+def _as_list(value: str | list[str] | None) -> list[str]:
+    if value is None:
+        return []
+    if isinstance(value, str):
+        return [value]
+    return list(value)
+
+
+def _dedupe(values: list[str]) -> list[str]:
+    seen: set[str] = set()
+    deduped: list[str] = []
+    for value in values:
+        if not value or value in seen:
+            continue
+        seen.add(value)
+        deduped.append(value)
+    return deduped

agentkit_sdk_python-0.6.0/agentkit/auth/__init__.py

@@ -0,0 +1,100 @@
+# Copyright (c) 2025 Beijing Volcano Engine Technology Co., Ltd. and/or its affiliates.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""agentkit.auth — passwordless / SSO authentication for AgentKit.
+
+A self-contained, dependency-free library (Python stdlib only) that lets a CLI
+or any developer's program obtain Volcengine credentials in two ways:
+
+* **AK/SK** — long-lived access keys from env / config (the existing behaviour).
+* **SSO (OAuth 2.0 / OIDC)** — interactive browser login against a UserPool
+  (federating Feishu / ByteDance-SSO / any OIDC IdP), exchanged for **short-lived
+  STS credentials** via ``AssumeRoleWithOIDC``. No AK/SK ever touches disk.
+
+The library is intentionally decoupled from the rest of the AgentKit SDK: it has
+no import dependency on ``agentkit.client`` / ``agentkit.platform`` and can be
+vendored or used on its own::
+
+    from agentkit.auth import login, load_session, AuthProfile
+
+    profile = AuthProfile(
+        name="my-pool",
+        issuer="https://userpool-<uid>.userpool.auth.id.cn-beijing.volces.com",
+        client_id="<PUBLIC_CLI_CLIENT_ID>",
+        role_trn="trn:iam::<ACCOUNT_ID>:role/<ROLE_NAME>",
+        provider_trn="trn:iam::<ACCOUNT_ID>:oidc-provider/<PROVIDER_NAME>",
+        region="cn-beijing",
+    )
+    session = login(profile)            # opens a browser, returns an AuthSession
+    creds = session.credentials()        # -> StsCredentials(ak, sk, token, expires_at)
+
+The SDK wires this into its credential-resolution chain (see
+``agentkit.platform.configuration``) so that ``agentkit login`` once makes every
+subsequent command work with the resulting STS credentials — and an expired STS
+session auto-refreshes from the cached OIDC refresh token without a new browser
+round-trip.
+"""
+
+from __future__ import annotations
+
+from agentkit.auth.errors import AuthError, NetworkError, SsoError
+from agentkit.auth.oauth import OAuthClient, run_loopback_login
+from agentkit.auth.profile import (
+    AuthProfile,
+    active_profile_name,
+    address_to_profile_name,
+    clear_active_profile,
+    list_profiles,
+    load_profile,
+    save_profile,
+    set_active_profile,
+)
+from agentkit.auth.providers import (
+    AkSkCredentialProvider,
+    CredentialProvider,
+    SsoStsCredentialProvider,
+)
+from agentkit.auth.resolve import discover_cli_config, resolve_profile
+from agentkit.auth.session import AuthSession, StsCredentials
+from agentkit.auth.sso import login, load_session, logout, whoami
+from agentkit.auth.sts import assume_role_with_oidc, get_caller_identity
+
+__all__ = [
+    "AuthError",
+    "AuthProfile",
+    "AuthSession",
+    "AkSkCredentialProvider",
+    "CredentialProvider",
+    "NetworkError",
+    "OAuthClient",
+    "SsoError",
+    "SsoStsCredentialProvider",
+    "StsCredentials",
+    "active_profile_name",
+    "address_to_profile_name",
+    "assume_role_with_oidc",
+    "clear_active_profile",
+    "discover_cli_config",
+    "get_caller_identity",
+    "list_profiles",
+    "load_profile",
+    "load_session",
+    "login",
+    "logout",
+    "resolve_profile",
+    "run_loopback_login",
+    "save_profile",
+    "set_active_profile",
+    "whoami",
+]

agentkit_sdk_python-0.6.0/agentkit/auth/_openapi.py

@@ -0,0 +1,173 @@
+# Copyright (c) 2025 Beijing Volcano Engine Technology Co., Ltd. and/or its affiliates.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Minimal signed Volcengine OpenAPI client for the auth ADMIN commands.
+
+Stdlib-only SigV4 (reusing :mod:`agentkit.auth._sigv4`) so the admin path that
+provisions the UserPool client / IAM OIDC provider / STS role carries no
+third-party dependency. Used only by ``agentkit auth admin`` — the end-user login
+path never touches it. A mandatory ``GetCallerIdentity`` guard runs before any write.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import urllib.error
+import urllib.parse
+import urllib.request
+
+from agentkit.auth._sigv4 import sign_headers
+from agentkit.auth.errors import AuthError
+from agentkit.auth.ssl_trust import harden_default_ssl_context
+
+_HOST = "open.volcengineapi.com"
+# Services whose OpenAPI reads parameters from the query string, not a JSON body.
+_QUERY_PARAM_SERVICES = {"iam"}
+
+# Map common Volcengine error-code fragments to an actionable next step. Surfaced on
+# ApiError.hint so a raw mid-provision failure tells the operator what to fix, not just
+# the opaque code (important on a cold account where services/quotas aren't set up).
+_REMEDIATION = (
+    ("notinwhitelist", "this feature needs per-account whitelisting — request it, or use the default path (ticket mode / inline JWKS)."),
+    ("servicenotfound", "this Volcengine service may not be enabled on this account — enable it in the console, then re-run."),
+    ("invalidaction", "this service/action may be unavailable on this account — confirm the service is enabled (run `agentkit auth admin doctor`)."),
+    ("nosuchentity", "the referenced IAM/AgentKit resource is missing — if it is 'AgentKitSandboxAccess', activate AgentKit on this account first."),
+    ("policynotexist", "the referenced policy is missing — activate AgentKit on this account so its system policies exist."),
+    ("accessdenied", "the provisioning credentials lack permission for this action — use an admin AK/SK with IAM/AgentKit rights."),
+    ("nopermission", "the provisioning credentials lack permission for this action — use an admin AK/SK with IAM/AgentKit rights."),
+    ("unauthorized", "the provisioning credentials lack permission for this action — use an admin AK/SK with IAM/AgentKit rights."),
+    ("limitexceeded", "an account quota/limit was hit — request a quota increase or remove unused resources."),
+    ("quota", "an account quota/limit was hit — request a quota increase or remove unused resources."),
+    ("throttl", "the API is throttling — retry shortly."),
+)
+
+
+def remediation_for(code: str) -> str | None:
+    """Best-effort actionable hint for a Volcengine error code, or None."""
+    c = (code or "").lower()
+    for frag, hint in _REMEDIATION:
+        if frag in c:
+            return hint
+    return None
+
+
+class ApiError(AuthError):
+    """A Volcengine OpenAPI call returned an error. Subclasses AuthError so the CLI's
+    ``except AuthError`` handlers surface it as a clean message, not a traceback.
+
+    Carries an actionable ``hint`` derived from the error code where possible."""
+
+    def __init__(self, action: str, code: str, message: str) -> None:
+        super().__init__(f"{action}: {code}: {message}", hint=remediation_for(code))
+        self.action = action
+        self.code = code
+        self.message = message
+
+
+class OpenApiClient:
+    """Signed Volcengine OpenAPI caller with an account guard (admin use only)."""
+
+    def __init__(
+        self,
+        *,
+        access_key: str | None = None,
+        secret_key: str | None = None,
+        session_token: str | None = None,
+        region: str = "cn-beijing",
+        expect_account: str | None = None,
+        harden_ssl: bool = True,
+    ) -> None:
+        if harden_ssl:
+            harden_default_ssl_context()
+        self.ak = access_key or os.getenv("VOLCENGINE_ACCESS_KEY") or os.getenv("VOLC_ACCESSKEY")
+        self.sk = secret_key or os.getenv("VOLCENGINE_SECRET_KEY") or os.getenv("VOLC_SECRETKEY")
+        self.token = session_token or os.getenv("VOLCENGINE_SESSION_TOKEN")
+        if not (self.ak and self.sk):
+            raise AuthError(
+                "admin provisioning needs Volcengine credentials.",
+                hint="export VOLCENGINE_ACCESS_KEY / VOLCENGINE_SECRET_KEY for the account that owns the UserPool.",
+            )
+        self.region = region
+        ident = self.call("sts", "GetCallerIdentity", "2018-01-01", {})
+        self.account_id = str(ident.get("AccountId") or "")
+        if expect_account and self.account_id != expect_account:
+            raise AuthError(
+                f"refusing to provision: caller account {self.account_id} != expected {expect_account}"
+            )
+
+    def call(self, service: str, action: str, version: str, body: dict) -> dict:
+        if service in _QUERY_PARAM_SERVICES:
+            query = {"Action": action, "Version": version}
+            for k, v in body.items():
+                if isinstance(v, (list, tuple)):
+                    for i, item in enumerate(v):
+                        query[f"{k}.{i + 1}"] = str(item)
+                else:
+                    query[k] = str(v)
+            payload = b""
+        else:
+            query = {"Action": action, "Version": version}
+            payload = json.dumps(body).encode()
+        headers = sign_headers(
+            "POST", _HOST, query, payload,
+            access_key=self.ak, secret_key=self.sk, service=service, region=self.region,
+            session_token=self.token,
+        )
+        url = f"https://{_HOST}/?{urllib.parse.urlencode(query)}"
+        req = urllib.request.Request(url, data=payload, headers=headers, method="POST")
+        try:
+            raw = urllib.request.urlopen(req, timeout=30).read()
+        except urllib.error.HTTPError as exc:
+            raw = exc.read()
+        data = json.loads(raw)
+        err = (data.get("ResponseMetadata") or {}).get("Error")
+        if err:
+            raise ApiError(action, str(err.get("Code")), str(err.get("Message")))
+        return data.get("Result") or {}
+
+    def call_get(self, service: str, action: str, version: str, params: dict) -> dict:
+        """GET-style signed call (params in the query string) — e.g. the vpc service."""
+        query = {"Action": action, "Version": version}
+        for k, v in params.items():
+            if isinstance(v, (list, tuple)):
+                for i, item in enumerate(v):
+                    query[f"{k}.{i + 1}"] = str(item)
+            else:
+                query[k] = str(v)
+        headers = sign_headers(
+            "GET", _HOST, query, b"",
+            access_key=self.ak, secret_key=self.sk, service=service, region=self.region,
+            session_token=self.token,
+        )
+        url = f"https://{_HOST}/?{urllib.parse.urlencode(query)}"
+        req = urllib.request.Request(url, headers=headers, method="GET")
+        try:
+            raw = urllib.request.urlopen(req, timeout=30).read()
+        except urllib.error.HTTPError as exc:
+            raw = exc.read()
+        data = json.loads(raw)
+        err = (data.get("ResponseMetadata") or {}).get("Error")
+        if err:
+            raise ApiError(action, str(err.get("Code")), str(err.get("Message")))
+        return data.get("Result") or {}
+
+    def call_ok(self, service, action, version, body, *, ok=("Exist", "Duplicate", "Conflict", "AlreadyExist")):
+        """Like :meth:`call` but swallow 'already exists'-style errors (idempotent ensure)."""
+        try:
+            return self.call(service, action, version, body)
+        except ApiError as exc:
+            if any(tok.lower() in exc.code.lower() for tok in ok):
+                return {}
+            raise

agentkit_sdk_python-0.6.0/agentkit/auth/_redact.py

@@ -0,0 +1,55 @@
+# Copyright (c) 2025 Beijing Volcano Engine Technology Co., Ltd. and/or its affiliates.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Secret redaction for log/error output.
+
+Auth flows shuttle tokens and STS secrets around; any of them can end up in an
+exception body or a debug print. :func:`redact` scrubs the high-entropy strings
+(JWTs, bearer/STS tokens, ``ak/sk`` style secrets) before they are surfaced.
+"""
+
+from __future__ import annotations
+
+import re
+
+# JWTs: three base64url segments separated by dots.
+_JWT = re.compile(r"\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b")
+# Volcengine STS / access tokens and long opaque secrets (>= 16 url-safe chars).
+_OPAQUE = re.compile(r"\b[A-Za-z0-9/+_-]{16,}={0,2}\b")
+# Explicit secret-bearing query/JSON/header fields.
+_FIELD = re.compile(
+    r"(?i)(\"?(?:access_token|refresh_token|id_token|client_secret|secret_access_key"
+    r"|secretkey|accesskeyid|accesskey|sessiontoken|session_token|authorization"
+    r"|apikey|api_key|token|password)\"?\s*[:=]\s*\"?(?:bearer\s+)?)"
+    r"([^\"&\s,}]+)"
+)
+
+
+def redact(text: str) -> str:
+    """Return ``text`` with credential-looking substrings replaced by ``***``."""
+    if not text:
+        return text
+    text = _FIELD.sub(lambda m: m.group(1) + "***", text)
+    text = _JWT.sub("***", text)
+    text = _OPAQUE.sub("***", text)
+    return text
+
+
+def mask(secret: str | None, *, keep: int = 4) -> str:
+    """Mask a secret, keeping only the last ``keep`` characters for recognition."""
+    if not secret:
+        return "<none>"
+    if len(secret) <= keep:
+        return "*" * len(secret)
+    return "*" * (len(secret) - keep) + secret[-keep:]