agentkit-sdk-python 0.6.3__tar.gz → 0.6.4__tar.gz

{agentkit_sdk_python-0.6.3 → agentkit_sdk_python-0.6.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentkit-sdk-python
-Version: 0.6.3
+Version: 0.6.4
 Summary: Python SDK for transforming any AI agent into a production-ready application. Framework-agnostic primitives for runtime, memory, authentication, and tools with volcengine-managed infrastructure.
 Author-email: Xiangrui Cheng <innsdcc@gmail.com>, Yumeng Bao <baoyumeng.123@gmail.com>, Yaozheng Fang <fangyozheng@gmail.com>, Guodong Li <cu.eric.lee@gmail.com>
 License:                                  Apache License
@@ -226,6 +226,7 @@ Requires-Dist: opentelemetry-exporter-otlp-proto-grpc<=1.37.0,>=1.32.1
 Requires-Dist: opentelemetry-sdk<=1.37.0,>=1.32.1
 Requires-Dist: pydantic>=2.11.9
 Requires-Dist: requests>=2.32.5
+Requires-Dist: PyJWT>=2.10.1
 Requires-Dist: uvicorn>=0.37.0
 Requires-Dist: pyyaml
 Requires-Dist: python-dotenv>=1.1.0

{agentkit_sdk_python-0.6.3 → agentkit_sdk_python-0.6.4}/agentkit/auth/session.py

@@ -77,6 +77,26 @@ def _effective_expiry(
     return datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(seconds=duration_seconds)
 
 
+def _jwt_expired(token: str, skew_seconds: int) -> bool:
+    """True if a JWT is expired, within ``skew_seconds`` of expiry, or unreadable.
+
+    Reads only the ``exp`` claim (no signature check — the harness endpoint verifies
+    the signature; we just decide locally whether to refresh). An unparseable token or
+    a missing/invalid ``exp`` is treated as expired so we refresh rather than send a
+    token that will be rejected."""
+    try:
+        import jwt as _jwt
+
+        claims = _jwt.decode(token, options={"verify_signature": False, "verify_exp": False})
+    except Exception:
+        return True
+    exp = claims.get("exp")
+    if not isinstance(exp, (int, float)):
+        return True
+    now = datetime.datetime.now(datetime.timezone.utc).timestamp()
+    return now >= (exp - skew_seconds)
+
+
 @dataclass(frozen=True)
 class StsCredentials:
     """Short-lived Volcengine STS credentials."""
@@ -104,11 +124,17 @@ class AuthSession:
         refresh_token: str | None = None,
         sts: StsCredentials | None = None,
         duration_seconds: int = 3600,
+        id_token: str | None = None,
+        access_token: str | None = None,
     ) -> None:
         self.profile = profile
         self._refresh_token = refresh_token
         self._sts = sts
         self._duration = duration_seconds
+        # OIDC tokens kept for data-plane (JWT) auth — the id_token is the inbound
+        # credential for `agentkit invoke harness`; access_token is stored for parity.
+        self._id_token = id_token
+        self._access_token = access_token
         self._lock = threading.Lock()
 
     # -- persistence ----------------------------------------------------------
@@ -118,6 +144,8 @@ class AuthSession:
             "profile": self.profile.name,
             "issuer": self.profile.issuer,
             "refresh_token": self._refresh_token,
+            "id_token": self._id_token,
+            "access_token": self._access_token,
             "duration_seconds": self._duration,
             "sts": None
             if sts is None
@@ -151,6 +179,8 @@ class AuthSession:
             refresh_token=blob.get("refresh_token"),
             sts=sts,
             duration_seconds=int(blob.get("duration_seconds") or 3600),
+            id_token=blob.get("id_token"),
+            access_token=blob.get("access_token"),
         )
 
     # -- credentials ----------------------------------------------------------
@@ -180,6 +210,67 @@ class AuthSession:
             assert self._sts is not None
             return self._sts
 
+    # -- data-plane JWT (id_token) --------------------------------------------
+    def valid_id_token(self, *, skew_seconds: int = 60, force_refresh: bool = False) -> str:
+        """Return a currently-valid OIDC ``id_token`` for data-plane (JWT) auth.
+
+        Used by ``agentkit invoke harness`` as the inbound Bearer credential — it never
+        touches STS. Refreshes via the ``refresh_token`` (``grant_type=refresh_token`` at
+        the UserPool token endpoint) when the cached id_token is missing, within
+        ``skew_seconds`` of expiry, or when ``force_refresh`` is set (e.g. the harness
+        returned 401). Raises :class:`AuthError` pointing at ``agentkit login`` when no
+        refresh is possible.
+        """
+        with self._lock:
+            if not force_refresh and self._id_token and not _jwt_expired(self._id_token, skew_seconds):
+                return self._id_token
+            with _profile_file_lock(self.profile.name):
+                # Re-read under the lock to pick up any sibling's rotated refresh_token /
+                # refreshed STS — so we neither refresh with a stale refresh_token nor clobber
+                # a sibling's update when we save below.
+                blob = store.load_session(self.profile.name)
+                if blob:
+                    sibling = AuthSession.from_blob(self.profile, blob)
+                    self._refresh_token = sibling._refresh_token or self._refresh_token
+                    self._sts = sibling._sts or self._sts
+                    if not force_refresh and sibling._id_token and not _jwt_expired(sibling._id_token, skew_seconds):
+                        self._id_token = sibling._id_token
+                        self._access_token = sibling._access_token or self._access_token
+                        return self._id_token
+                self._refresh_id_token_locked()
+            assert self._id_token is not None
+            return self._id_token
+
+    def _refresh_id_token_locked(self) -> None:
+        if not self._refresh_token:
+            raise AuthError(
+                "no id_token and no refresh token available; re-login required.",
+                hint="run `agentkit login` to start a new browser session.",
+            )
+        from agentkit.auth.ssl_trust import harden_default_ssl_context
+
+        harden_default_ssl_context()
+        client = OAuthClient(self.profile.issuer, self.profile.client_id, scope=self.profile.scope)
+        try:
+            token = client.refresh(self._refresh_token)
+        except AuthError as exc:
+            raise AuthError(
+                "session refresh failed — the login has expired or was revoked.",
+                hint="run `agentkit login` to log in again.",
+            ) from exc
+        id_token = str(token.get("id_token") or "")
+        if not id_token:
+            raise AuthError(
+                "refresh did not return an id_token; re-login required.",
+                hint="ensure the OAuth scope includes 'openid' (OIDC requires an ID Token).",
+            )
+        self._id_token = id_token
+        if token.get("access_token"):
+            self._access_token = str(token["access_token"])
+        if token.get("refresh_token"):
+            self._refresh_token = str(token["refresh_token"])
+        self.save()
+
     def _renew_locked(self) -> None:
         if not self._refresh_token:
             raise AuthError(
@@ -199,6 +290,10 @@ class AuthSession:
                 "refresh did not return an id_token; re-login required.",
                 hint="ensure the OAuth scope includes 'openid' (OIDC requires an ID Token).",
             )
+        # Keep the freshly-issued OIDC tokens for data-plane (JWT) auth, not just STS.
+        self._id_token = id_token
+        if token.get("access_token"):
+            self._access_token = str(token["access_token"])
         # A rotated refresh token, if returned, must replace the old one.
         if token.get("refresh_token"):
             self._refresh_token = str(token["refresh_token"])

{agentkit_sdk_python-0.6.3 → agentkit_sdk_python-0.6.4}/agentkit/auth/sso.py

@@ -102,7 +102,15 @@ def login(
         account_id=account,
     )
     session = AuthSession(
-        prof, refresh_token=refresh_token, sts=sts, duration_seconds=duration_seconds
+        prof,
+        refresh_token=refresh_token,
+        sts=sts,
+        duration_seconds=duration_seconds,
+        # Persist the OIDC tokens so the data plane (`agentkit invoke harness`) can use
+        # the id_token as its inbound Bearer credential. Store the real id_token (not the
+        # access_token fallback used above for AssumeRoleWithOIDC).
+        id_token=token.get("id_token"),
+        access_token=token.get("access_token"),
     )
     session.save()
     # Mark this profile active so separate CLI invocations (e.g. `sandbox create`)

{agentkit_sdk_python-0.6.3 → agentkit_sdk_python-0.6.4}/agentkit/sdk/skills/client.py

@@ -28,6 +28,8 @@ from .types import (
     DeleteSkillResponse,
     DeleteSkillSpaceRequest,
     DeleteSkillSpaceResponse,
+    GenTempTosObjectUrlRequest,
+    GenTempTosObjectUrlResponse,
     GetSkillInfoRequest,
     GetSkillInfoResponse,
     GetSkillRequest,
@@ -69,6 +71,7 @@ class AgentkitSkillsClient(BaseAgentkitClient):
         "CreateSkillSpace": "CreateSkillSpace",
         "DeleteSkill": "DeleteSkill",
         "DeleteSkillSpace": "DeleteSkillSpace",
+        "GenTempTosObjectUrl": "GenTempTosObjectUrl",
         "GetSkill": "GetSkill",
         "GetSkillInfo": "GetSkillInfo",
         "GetSkillSpace": "GetSkillSpace",
@@ -133,6 +136,15 @@ class AgentkitSkillsClient(BaseAgentkitClient):
             response_type=DeleteSkillSpaceResponse,
         )
 
+    def gen_temp_tos_object_url(
+        self, request: GenTempTosObjectUrlRequest
+    ) -> GenTempTosObjectUrlResponse:
+        return self._invoke_api(
+            api_action="GenTempTosObjectUrl",
+            request=request,
+            response_type=GenTempTosObjectUrlResponse,
+        )
+
     def get_skill(self, request: GetSkillRequest) -> GetSkillResponse:
         return self._invoke_api(
             api_action="GetSkill",

{agentkit_sdk_python-0.6.3 → agentkit_sdk_python-0.6.4}/agentkit/sdk/skills/types.py

@@ -18,7 +18,7 @@
 from __future__ import annotations
 
 from typing import Optional
-from pydantic import BaseModel, Field
+from pydantic import AliasChoices, BaseModel, Field
 
 
 class SkillsBaseModel(BaseModel):
@@ -354,3 +354,23 @@ class UpdateSkillSpaceRequest(SkillsBaseModel):
 
 class UpdateSkillSpaceResponse(SkillsBaseModel):
     pass
+
+
+class GenTempTosObjectUrlRequest(SkillsBaseModel):
+    project_name: str = Field(..., alias="ProjectName")
+    skill_name: str = Field(..., alias="SkillName")
+
+
+class GenTempTosObjectUrlResponse(SkillsBaseModel):
+    # The exact response key is tolerated across known spellings; `extra="allow"`
+    # keeps any other returned fields so callers can fast-fail with full context
+    # when no URL is present.
+    model_config = {"populate_by_name": True, "extra": "allow"}
+
+    url: Optional[str] = Field(
+        default=None,
+        validation_alias=AliasChoices(
+            "Url", "TosUrl", "TempUrl", "ObjectUrl", "PresignedUrl"
+        ),
+        serialization_alias="Url",
+    )

{agentkit_sdk_python-0.6.3 → agentkit_sdk_python-0.6.4}/agentkit/toolkit/cli/cli.py

@@ -36,6 +36,7 @@ from agentkit.toolkit.cli.cli_knowledge import knowledge_app
 from agentkit.toolkit.cli.cli_tools import tools_app
 from agentkit.toolkit.cli.cli_runtime import runtime_app
 from agentkit.toolkit.cli.cli_skills import skills_app
+from agentkit.toolkit.cli.cli_skill import skill_app
 from agentkit.toolkit.cli.sandbox.cli import sandbox_app
 from agentkit.toolkit.cli.cli_auth import (
     auth_app,
@@ -47,6 +48,7 @@ from agentkit.toolkit.cli.cli_auth import (
 from agentkit.toolkit.cli.cli_add import add_app
 from agentkit.toolkit.cli.cli_list import list_app
 from agentkit.toolkit.cli.cli_delete import delete_app
+from agentkit.toolkit.cli.cli_logs import logs_command
 
 # Note: Avoid importing heavy packages at the top to keep CLI startup fast
 
@@ -109,6 +111,7 @@ app.command(name="deploy")(deploy_command)
 app.command(name="launch")(launch_command)
 app.command(name="status")(status_command)
 app.command(name="destroy")(destroy_command)
+app.command(name="logs")(logs_command)
 
 # Auth: top-level convenience commands + an `auth` group for profiles.
 app.command(name="login")(login_command)
@@ -123,6 +126,7 @@ app.add_typer(knowledge_app, name="knowledge")
 app.add_typer(tools_app, name="tools")
 app.add_typer(runtime_app, name="runtime")
 app.add_typer(skills_app, name="skills")
+app.add_typer(skill_app, name="skill")
 app.add_typer(sandbox_app, name="sandbox")
 app.add_typer(invoke_app, name="invoke")
 app.add_typer(add_app, name="add")

agentkit_sdk_python-0.6.4/agentkit/toolkit/cli/cli_delete.py

@@ -0,0 +1,186 @@
+# Copyright (c) 2025 Beijing Volcano Engine Technology Co., Ltd. and/or its affiliates.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""AgentKit CLI - ``delete`` commands.
+
+``agentkit delete credential <name>`` removes an inbound auth config. The
+config is addressed by ``InboundAuthConfigId``, so the name is first resolved
+to its id via ``ListInboundAuthConfigs``.
+"""
+
+from typing import Optional
+
+import typer
+from rich.console import Console
+
+console = Console()
+
+delete_app = typer.Typer(
+    name="delete",
+    help="Delete AgentKit resources.",
+    add_completion=False,
+)
+
+
+@delete_app.command("credential")
+def delete_credential_command(
+    name: str = typer.Argument(..., help="Credential name to delete."),
+    region: Optional[str] = typer.Option(
+        None,
+        "--region",
+        help=(
+            "Region override for this command (e.g. cn-beijing, cn-shanghai). "
+            "Defaults to VOLCENGINE_AGENTKIT_REGION/VOLCENGINE_REGION/global config."
+        ),
+    ),
+):
+    """Delete a credential (inbound auth config) by name."""
+    from agentkit.toolkit.cli.utils import PaginationHelper
+    from agentkit.sdk.identity.client import AgentkitIdentityClient
+    from agentkit.sdk.identity import types as it
+
+    client = AgentkitIdentityClient(region=(region or "").strip())
+
+    def build_request(next_token_val):
+        return it.ListInboundAuthConfigsRequest(
+            max_results=50,
+            next_token=next_token_val,
+        )
+
+    configs, _, _ = PaginationHelper.fetch_all_pages(
+        request_func=client.list_inbound_auth_configs,
+        request_builder=build_request,
+        max_results=50,
+        next_token=None,
+        fetch_all=True,
+        max_batches=None,
+        sleep_ms=0,
+    )
+
+    matches = [c for c in configs if c.config_name == name]
+    if not matches:
+        console.print(f"[red]Error: credential '{name}' not found.[/red]")
+        raise typer.Exit(1)
+
+    for config in matches:
+        config_id = config.inbound_auth_config_id
+        if not config_id:
+            continue
+        client.delete_inbound_auth_config(
+            it.DeleteInboundAuthConfigRequest(inbound_auth_config_id=config_id)
+        )
+
+    console.print(f"[green]✓ Deleted credential '{name}'[/green]")
+
+
+@delete_app.command("harness")
+def delete_harness_command(
+    name: str = typer.Option(..., "--name", help="Harness runtime name to delete."),
+    region: Optional[str] = typer.Option(
+        None,
+        "--region",
+        help=(
+            "Region override for this command (e.g. cn-beijing, cn-shanghai). "
+            "Defaults to VOLCENGINE_AGENTKIT_REGION/VOLCENGINE_REGION/global config."
+        ),
+    ),
+    timeout: int = typer.Option(
+        300, "--timeout", help="Max seconds to wait for the async deletion to finish."
+    ),
+):
+    """Delete a harness runtime by name.
+
+    Resolves ``--name`` to a runtime and only deletes it when it carries the
+    deploy-time harness tag (``agentkit:agenttype=harness``):
+
+    * not found            -> reports it and exits non-zero;
+    * exists, not a harness -> warns and refuses to delete (exits non-zero);
+    * exists and a harness  -> deletes it, then polls until the deletion (which
+      is asynchronous) actually completes.
+    """
+    import time
+
+    from agentkit.toolkit.cli.utils import PaginationHelper
+    from agentkit.sdk.runtime.client import AgentkitRuntimeClient
+    from agentkit.sdk.runtime import types as rt
+    from agentkit.toolkit.harness.deploy import HARNESS_TAG_KEY, HARNESS_TAG_VALUE
+
+    client = AgentkitRuntimeClient(region=(region or "").strip())
+
+    def build_request(next_token_val):
+        return rt.ListRuntimesRequest(max_results=50, next_token=next_token_val)
+
+    runtimes, _, _ = PaginationHelper.fetch_all_pages(
+        request_func=client.list_runtimes,
+        request_builder=build_request,
+        max_results=50,
+        next_token=None,
+        fetch_all=True,
+        max_batches=None,
+        sleep_ms=0,
+    )
+
+    matches = [r for r in runtimes if r.name == name]
+    if not matches:
+        console.print(f"[yellow]Harness '{name}' not found.[/yellow]")
+        raise typer.Exit(1)
+
+    def _is_harness(runtime) -> bool:
+        return any(
+            tag.key == HARNESS_TAG_KEY and tag.value == HARNESS_TAG_VALUE
+            for tag in (runtime.tags or [])
+        )
+
+    harness_matches = [r for r in matches if _is_harness(r)]
+    if not harness_matches:
+        console.print(
+            f"[red]✗ '{name}' exists but is not a harness runtime "
+            f"(missing {HARNESS_TAG_KEY}={HARNESS_TAG_VALUE} tag). "
+            "Refusing to delete.[/red]"
+        )
+        raise typer.Exit(1)
+
+    for runtime in harness_matches:
+        runtime_id = runtime.runtime_id
+        console.print(
+            f"[cyan]Deleting harness '{name}' (runtime_id: {runtime_id})...[/cyan]"
+        )
+        client.delete_runtime(rt.DeleteRuntimeRequest(runtime_id=runtime_id))
+
+        # Deletion is asynchronous: poll get_runtime until it reports the runtime
+        # is gone (the API raises InvalidAgentKitRuntime.NotFound once removed).
+        deadline = time.monotonic() + timeout
+        with console.status(
+            f"[cyan]Waiting for '{name}' deletion...[/cyan]", spinner="dots"
+        ):
+            while True:
+                try:
+                    current = client.get_runtime(
+                        rt.GetRuntimeRequest(runtime_id=runtime_id)
+                    )
+                except Exception as exc:
+                    if "InvalidAgentKitRuntime.NotFound" in str(exc):
+                        break
+                    raise
+                if time.monotonic() > deadline:
+                    console.print(
+                        f"[red]✗ Timed out after {timeout}s waiting for '{name}' "
+                        f"deletion (last status: {current.status}).[/red]"
+                    )
+                    raise typer.Exit(1)
+                time.sleep(3)
+
+        console.print(
+            f"[green]✓ Deleted harness '{name}' (runtime_id: {runtime_id})[/green]"
+        )

{agentkit_sdk_python-0.6.3 → agentkit_sdk_python-0.6.4}/agentkit/toolkit/cli/cli_deploy.py

@@ -15,7 +15,7 @@
 """AgentKit CLI - Deploy command implementation."""
 
 from pathlib import Path
-from typing import Optional
+from typing import Callable, Dict, Optional
 
 import typer
 from rich.console import Console
@@ -25,6 +25,17 @@ from rich.console import Console
 console = Console()
 
 
+def _prompt_harness_update(info: Dict) -> bool:
+    """Interactive [y/N] confirmation to update an existing same-name harness."""
+    version = info.get("version")
+    version_label = f"v{version}" if version is not None else "unknown"
+    return typer.confirm(
+        f"Harness '{info['name']}' already exists (current version "
+        f"{version_label}). Update it to a new version?",
+        default=False,
+    )
+
+
 def deploy_command(
     config_file: Path = typer.Option("agentkit.yaml", help="Configuration file"),
     harness: Optional[str] = typer.Option(
@@ -52,6 +63,12 @@ def deploy_command(
         "--allowed-id",
         help="Comma-separated allowed client IDs for OAuth2/JWT auth (harness deploy).",
     ),
+    yes: bool = typer.Option(
+        False,
+        "--yes",
+        "-y",
+        help="Harness deploy: update an existing same-name harness without prompting.",
+    ),
 ):
     """Deploy the Agent to target environment."""
     from agentkit.toolkit.executors import DeployExecutor
@@ -66,6 +83,7 @@ def deploy_command(
             secret_key=volcengine_secret_key,
             discovery_url=discovery_url,
             allowed_id=allowed_id,
+            assume_yes=yes,
         )
         return
 
@@ -107,9 +125,12 @@ def _deploy_harness(
     secret_key,
     discovery_url,
     allowed_id,
+    assume_yes: bool = False,
 ):
     """Deploy a harness spec <name>.harness.json from the current directory."""
-    from agentkit.toolkit.sdk import deploy_harness
+    import sys
+
+    from agentkit.toolkit.sdk import deploy_harness, HarnessDeployAborted
     from agentkit.toolkit.cli.console_reporter import ConsoleReporter
     from agentkit.toolkit.context import ExecutionContext
 
@@ -118,15 +139,35 @@ def _deploy_harness(
     reporter = ConsoleReporter()
     ExecutionContext.set_reporter(reporter)
 
-    result = deploy_harness(
-        name=name,
-        region=region,
-        access_key=access_key,
-        secret_key=secret_key,
-        discovery_url=discovery_url,
-        allowed_id=allowed_id,
-        reporter=reporter,
-    )
+    # Decide how a same-name harness collision is resolved:
+    #   --yes        -> update without prompting
+    #   tty          -> prompt [y/N]
+    #   non-tty      -> on_conflict=None, so deploy_harness fast-fails
+    on_conflict: Optional[Callable[[Dict], bool]] = None
+    if assume_yes:
+        on_conflict = lambda info: True  # noqa: E731
+    elif sys.stdin.isatty():
+        on_conflict = _prompt_harness_update
+
+    # Surface fast-fail input/validation errors (missing spec, missing creds,
+    # name collision) as a clean CLI error + exit code, not a raw traceback.
+    try:
+        result = deploy_harness(
+            name=name,
+            region=region,
+            access_key=access_key,
+            secret_key=secret_key,
+            discovery_url=discovery_url,
+            allowed_id=allowed_id,
+            reporter=reporter,
+            on_conflict=on_conflict,
+        )
+    except HarnessDeployAborted:
+        console.print("[yellow]Harness deploy cancelled.[/yellow]")
+        return
+    except (ValueError, FileNotFoundError, NotADirectoryError) as exc:
+        console.print(f"[red]❌ Harness deploy failed: {exc}[/red]")
+        raise typer.Exit(1)
 
     if not result.success:
         console.print(f"[red]❌ Harness deploy failed: {result.error}[/red]")