agentkit-sdk-python 0.6.3__tar.gz → 0.6.5__tar.gz

{agentkit_sdk_python-0.6.3 → agentkit_sdk_python-0.6.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentkit-sdk-python
-Version: 0.6.3
+Version: 0.6.5
 Summary: Python SDK for transforming any AI agent into a production-ready application. Framework-agnostic primitives for runtime, memory, authentication, and tools with volcengine-managed infrastructure.
 Author-email: Xiangrui Cheng <innsdcc@gmail.com>, Yumeng Bao <baoyumeng.123@gmail.com>, Yaozheng Fang <fangyozheng@gmail.com>, Guodong Li <cu.eric.lee@gmail.com>
 License:                                  Apache License
@@ -226,6 +226,7 @@ Requires-Dist: opentelemetry-exporter-otlp-proto-grpc<=1.37.0,>=1.32.1
 Requires-Dist: opentelemetry-sdk<=1.37.0,>=1.32.1
 Requires-Dist: pydantic>=2.11.9
 Requires-Dist: requests>=2.32.5
+Requires-Dist: PyJWT>=2.10.1
 Requires-Dist: uvicorn>=0.37.0
 Requires-Dist: pyyaml
 Requires-Dist: python-dotenv>=1.1.0

{agentkit_sdk_python-0.6.3 → agentkit_sdk_python-0.6.5}/agentkit/auth/session.py

@@ -77,6 +77,26 @@ def _effective_expiry(
     return datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(seconds=duration_seconds)
 
 
+def _jwt_expired(token: str, skew_seconds: int) -> bool:
+    """True if a JWT is expired, within ``skew_seconds`` of expiry, or unreadable.
+
+    Reads only the ``exp`` claim (no signature check — the harness endpoint verifies
+    the signature; we just decide locally whether to refresh). An unparseable token or
+    a missing/invalid ``exp`` is treated as expired so we refresh rather than send a
+    token that will be rejected."""
+    try:
+        import jwt as _jwt
+
+        claims = _jwt.decode(token, options={"verify_signature": False, "verify_exp": False})
+    except Exception:
+        return True
+    exp = claims.get("exp")
+    if not isinstance(exp, (int, float)):
+        return True
+    now = datetime.datetime.now(datetime.timezone.utc).timestamp()
+    return now >= (exp - skew_seconds)
+
+
 @dataclass(frozen=True)
 class StsCredentials:
     """Short-lived Volcengine STS credentials."""
@@ -104,11 +124,17 @@ class AuthSession:
         refresh_token: str | None = None,
         sts: StsCredentials | None = None,
         duration_seconds: int = 3600,
+        id_token: str | None = None,
+        access_token: str | None = None,
     ) -> None:
         self.profile = profile
         self._refresh_token = refresh_token
         self._sts = sts
         self._duration = duration_seconds
+        # OIDC tokens kept for data-plane (JWT) auth — the id_token is the inbound
+        # credential for `agentkit invoke harness`; access_token is stored for parity.
+        self._id_token = id_token
+        self._access_token = access_token
         self._lock = threading.Lock()
 
     # -- persistence ----------------------------------------------------------
@@ -118,6 +144,8 @@ class AuthSession:
             "profile": self.profile.name,
             "issuer": self.profile.issuer,
             "refresh_token": self._refresh_token,
+            "id_token": self._id_token,
+            "access_token": self._access_token,
             "duration_seconds": self._duration,
             "sts": None
             if sts is None
@@ -151,6 +179,8 @@ class AuthSession:
             refresh_token=blob.get("refresh_token"),
             sts=sts,
             duration_seconds=int(blob.get("duration_seconds") or 3600),
+            id_token=blob.get("id_token"),
+            access_token=blob.get("access_token"),
         )
 
     # -- credentials ----------------------------------------------------------
@@ -180,6 +210,67 @@ class AuthSession:
             assert self._sts is not None
             return self._sts
 
+    # -- data-plane JWT (id_token) --------------------------------------------
+    def valid_id_token(self, *, skew_seconds: int = 60, force_refresh: bool = False) -> str:
+        """Return a currently-valid OIDC ``id_token`` for data-plane (JWT) auth.
+
+        Used by ``agentkit invoke harness`` as the inbound Bearer credential — it never
+        touches STS. Refreshes via the ``refresh_token`` (``grant_type=refresh_token`` at
+        the UserPool token endpoint) when the cached id_token is missing, within
+        ``skew_seconds`` of expiry, or when ``force_refresh`` is set (e.g. the harness
+        returned 401). Raises :class:`AuthError` pointing at ``agentkit login`` when no
+        refresh is possible.
+        """
+        with self._lock:
+            if not force_refresh and self._id_token and not _jwt_expired(self._id_token, skew_seconds):
+                return self._id_token
+            with _profile_file_lock(self.profile.name):
+                # Re-read under the lock to pick up any sibling's rotated refresh_token /
+                # refreshed STS — so we neither refresh with a stale refresh_token nor clobber
+                # a sibling's update when we save below.
+                blob = store.load_session(self.profile.name)
+                if blob:
+                    sibling = AuthSession.from_blob(self.profile, blob)
+                    self._refresh_token = sibling._refresh_token or self._refresh_token
+                    self._sts = sibling._sts or self._sts
+                    if not force_refresh and sibling._id_token and not _jwt_expired(sibling._id_token, skew_seconds):
+                        self._id_token = sibling._id_token
+                        self._access_token = sibling._access_token or self._access_token
+                        return self._id_token
+                self._refresh_id_token_locked()
+            assert self._id_token is not None
+            return self._id_token
+
+    def _refresh_id_token_locked(self) -> None:
+        if not self._refresh_token:
+            raise AuthError(
+                "no id_token and no refresh token available; re-login required.",
+                hint="run `agentkit login` to start a new browser session.",
+            )
+        from agentkit.auth.ssl_trust import harden_default_ssl_context
+
+        harden_default_ssl_context()
+        client = OAuthClient(self.profile.issuer, self.profile.client_id, scope=self.profile.scope)
+        try:
+            token = client.refresh(self._refresh_token)
+        except AuthError as exc:
+            raise AuthError(
+                "session refresh failed — the login has expired or was revoked.",
+                hint="run `agentkit login` to log in again.",
+            ) from exc
+        id_token = str(token.get("id_token") or "")
+        if not id_token:
+            raise AuthError(
+                "refresh did not return an id_token; re-login required.",
+                hint="ensure the OAuth scope includes 'openid' (OIDC requires an ID Token).",
+            )
+        self._id_token = id_token
+        if token.get("access_token"):
+            self._access_token = str(token["access_token"])
+        if token.get("refresh_token"):
+            self._refresh_token = str(token["refresh_token"])
+        self.save()
+
     def _renew_locked(self) -> None:
         if not self._refresh_token:
             raise AuthError(
@@ -199,6 +290,10 @@ class AuthSession:
                 "refresh did not return an id_token; re-login required.",
                 hint="ensure the OAuth scope includes 'openid' (OIDC requires an ID Token).",
             )
+        # Keep the freshly-issued OIDC tokens for data-plane (JWT) auth, not just STS.
+        self._id_token = id_token
+        if token.get("access_token"):
+            self._access_token = str(token["access_token"])
         # A rotated refresh token, if returned, must replace the old one.
         if token.get("refresh_token"):
             self._refresh_token = str(token["refresh_token"])

{agentkit_sdk_python-0.6.3 → agentkit_sdk_python-0.6.5}/agentkit/auth/sso.py

@@ -102,7 +102,15 @@ def login(
         account_id=account,
     )
     session = AuthSession(
-        prof, refresh_token=refresh_token, sts=sts, duration_seconds=duration_seconds
+        prof,
+        refresh_token=refresh_token,
+        sts=sts,
+        duration_seconds=duration_seconds,
+        # Persist the OIDC tokens so the data plane (`agentkit invoke harness`) can use
+        # the id_token as its inbound Bearer credential. Store the real id_token (not the
+        # access_token fallback used above for AssumeRoleWithOIDC).
+        id_token=token.get("id_token"),
+        access_token=token.get("access_token"),
     )
     session.save()
     # Mark this profile active so separate CLI invocations (e.g. `sandbox create`)

{agentkit_sdk_python-0.6.3 → agentkit_sdk_python-0.6.5}/agentkit/sdk/skills/client.py

@@ -28,6 +28,8 @@ from .types import (
     DeleteSkillResponse,
     DeleteSkillSpaceRequest,
     DeleteSkillSpaceResponse,
+    GenTempTosObjectUrlRequest,
+    GenTempTosObjectUrlResponse,
     GetSkillInfoRequest,
     GetSkillInfoResponse,
     GetSkillRequest,
@@ -69,6 +71,7 @@ class AgentkitSkillsClient(BaseAgentkitClient):
         "CreateSkillSpace": "CreateSkillSpace",
         "DeleteSkill": "DeleteSkill",
         "DeleteSkillSpace": "DeleteSkillSpace",
+        "GenTempTosObjectUrl": "GenTempTosObjectUrl",
         "GetSkill": "GetSkill",
         "GetSkillInfo": "GetSkillInfo",
         "GetSkillSpace": "GetSkillSpace",
@@ -133,6 +136,15 @@ class AgentkitSkillsClient(BaseAgentkitClient):
             response_type=DeleteSkillSpaceResponse,
         )
 
+    def gen_temp_tos_object_url(
+        self, request: GenTempTosObjectUrlRequest
+    ) -> GenTempTosObjectUrlResponse:
+        return self._invoke_api(
+            api_action="GenTempTosObjectUrl",
+            request=request,
+            response_type=GenTempTosObjectUrlResponse,
+        )
+
     def get_skill(self, request: GetSkillRequest) -> GetSkillResponse:
         return self._invoke_api(
             api_action="GetSkill",

{agentkit_sdk_python-0.6.3 → agentkit_sdk_python-0.6.5}/agentkit/sdk/skills/types.py

@@ -18,7 +18,7 @@
 from __future__ import annotations
 
 from typing import Optional
-from pydantic import BaseModel, Field
+from pydantic import AliasChoices, BaseModel, Field
 
 
 class SkillsBaseModel(BaseModel):
@@ -354,3 +354,23 @@ class UpdateSkillSpaceRequest(SkillsBaseModel):
 
 class UpdateSkillSpaceResponse(SkillsBaseModel):
     pass
+
+
+class GenTempTosObjectUrlRequest(SkillsBaseModel):
+    project_name: str = Field(..., alias="ProjectName")
+    skill_name: str = Field(..., alias="SkillName")
+
+
+class GenTempTosObjectUrlResponse(SkillsBaseModel):
+    # The exact response key is tolerated across known spellings; `extra="allow"`
+    # keeps any other returned fields so callers can fast-fail with full context
+    # when no URL is present.
+    model_config = {"populate_by_name": True, "extra": "allow"}
+
+    url: Optional[str] = Field(
+        default=None,
+        validation_alias=AliasChoices(
+            "Url", "TosUrl", "TempUrl", "ObjectUrl", "PresignedUrl"
+        ),
+        serialization_alias="Url",
+    )

{agentkit_sdk_python-0.6.3 → agentkit_sdk_python-0.6.5}/agentkit/toolkit/cli/cli.py

@@ -36,6 +36,7 @@ from agentkit.toolkit.cli.cli_knowledge import knowledge_app
 from agentkit.toolkit.cli.cli_tools import tools_app
 from agentkit.toolkit.cli.cli_runtime import runtime_app
 from agentkit.toolkit.cli.cli_skills import skills_app
+from agentkit.toolkit.cli.cli_skill import skill_app
 from agentkit.toolkit.cli.sandbox.cli import sandbox_app
 from agentkit.toolkit.cli.cli_auth import (
     auth_app,
@@ -47,6 +48,7 @@ from agentkit.toolkit.cli.cli_auth import (
 from agentkit.toolkit.cli.cli_add import add_app
 from agentkit.toolkit.cli.cli_list import list_app
 from agentkit.toolkit.cli.cli_delete import delete_app
+from agentkit.toolkit.cli.cli_logs import logs_command
 
 # Note: Avoid importing heavy packages at the top to keep CLI startup fast
 
@@ -109,6 +111,7 @@ app.command(name="deploy")(deploy_command)
 app.command(name="launch")(launch_command)
 app.command(name="status")(status_command)
 app.command(name="destroy")(destroy_command)
+app.command(name="logs")(logs_command)
 
 # Auth: top-level convenience commands + an `auth` group for profiles.
 app.command(name="login")(login_command)
@@ -123,6 +126,7 @@ app.add_typer(knowledge_app, name="knowledge")
 app.add_typer(tools_app, name="tools")
 app.add_typer(runtime_app, name="runtime")
 app.add_typer(skills_app, name="skills")
+app.add_typer(skill_app, name="skill")
 app.add_typer(sandbox_app, name="sandbox")
 app.add_typer(invoke_app, name="invoke")
 app.add_typer(add_app, name="add")