agentkit-sdk-python 0.8.3__tar.gz → 0.8.5__tar.gz

{agentkit_sdk_python-0.8.3 → agentkit_sdk_python-0.8.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentkit-sdk-python
-Version: 0.8.3
+Version: 0.8.5
 Summary: Python SDK for transforming any AI agent into a production-ready application. Framework-agnostic primitives for runtime, memory, authentication, and tools with volcengine-managed infrastructure.
 Author-email: Xiangrui Cheng <innsdcc@gmail.com>, Yumeng Bao <baoyumeng.123@gmail.com>, Yaozheng Fang <fangyozheng@gmail.com>, Guodong Li <cu.eric.lee@gmail.com>
 License:                                  Apache License

{agentkit_sdk_python-0.8.3 → agentkit_sdk_python-0.8.5}/agentkit/auth/_openapi.py

@@ -12,18 +12,22 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-"""Minimal signed Volcengine OpenAPI client for the auth ADMIN commands.
+"""Minimal signed OpenAPI client for the auth ADMIN commands.
 
 Stdlib-only SigV4 (reusing :mod:`agentkit.auth._sigv4`) so the admin path that
 provisions the UserPool client / IAM OIDC provider / STS role carries no
 third-party dependency. Used only by ``agentkit auth admin`` — the end-user login
 path never touches it. A mandatory ``GetCallerIdentity`` guard runs before any write.
+
+Credentials and the OpenAPI gateway host are resolved through the SDK's unified,
+Cloud-Provider-aware chain (:class:`agentkit.platform.configuration.VolcConfiguration`),
+so ``CLOUD_PROVIDER=byteplus`` uses ``BYTEPLUS_ACCESS_KEY`` / ``BYTEPLUS_SECRET_KEY``
+and ``open.byteplusapi.com`` instead of the Volcengine equivalents.
 """
 
 from __future__ import annotations
 
 import json
-import os
 import urllib.error
 import urllib.parse
 import urllib.request
@@ -31,8 +35,9 @@ import urllib.request
 from agentkit.auth._sigv4 import sign_headers
 from agentkit.auth.errors import AuthError
 from agentkit.auth.ssl_trust import harden_default_ssl_context
+from agentkit.platform.configuration import VolcConfiguration
+from agentkit.platform.provider import CloudProvider
 
-_HOST = "open.volcengineapi.com"
 # Services whose OpenAPI reads parameters from the query string, not a JSON body.
 _QUERY_PARAM_SERVICES = {"iam"}
 
@@ -85,21 +90,51 @@ class OpenApiClient:
         access_key: str | None = None,
         secret_key: str | None = None,
         session_token: str | None = None,
-        region: str = "cn-beijing",
+        region: str | None = None,
         expect_account: str | None = None,
         harden_ssl: bool = True,
     ) -> None:
         if harden_ssl:
             harden_default_ssl_context()
-        self.ak = access_key or os.getenv("VOLCENGINE_ACCESS_KEY") or os.getenv("VOLC_ACCESSKEY")
-        self.sk = secret_key or os.getenv("VOLCENGINE_SECRET_KEY") or os.getenv("VOLC_SECRETKEY")
-        self.token = session_token or os.getenv("VOLCENGINE_SESSION_TOKEN")
-        if not (self.ak and self.sk):
+        # Credentials/region come from the SDK's unified provider-aware chain
+        # (CLOUD_PROVIDER=volcengine|byteplus), so the admin path accepts the same
+        # sources as the runtime clients: BYTEPLUS_* on BytePlus, VOLCENGINE_* /
+        # VOLC_* on Volcengine, plus ~/.agentkit/config.yaml.
+        cfg = VolcConfiguration(
+            region=region,
+            access_key=access_key,
+            secret_key=secret_key,
+            session_token=session_token,
+        )
+        self.provider = cfg.provider
+        if self.provider == CloudProvider.BYTEPLUS:
+            provider_label = "BytePlus"
+            self.cred_env_hint = "BYTEPLUS_ACCESS_KEY / BYTEPLUS_SECRET_KEY"
+        else:
+            provider_label = "Volcengine"
+            self.cred_env_hint = "VOLCENGINE_ACCESS_KEY / VOLCENGINE_SECRET_KEY"
+        try:
+            creds = cfg.get_service_credentials("iam")
+        except ValueError as exc:
+            raise AuthError(
+                f"admin provisioning needs {provider_label} credentials.",
+                hint=f"export {self.cred_env_hint} for the account that owns the UserPool.",
+            ) from exc
+        if creds.source == "sso-sts":
+            # `agentkit login` stores the END-USER sandbox STS role; provisioning
+            # UserPool/IAM resources needs the account's long-lived admin AK/SK.
             raise AuthError(
-                "admin provisioning needs Volcengine credentials.",
-                hint="export VOLCENGINE_ACCESS_KEY / VOLCENGINE_SECRET_KEY for the account that owns the UserPool.",
+                "admin provisioning cannot use the SSO login session (it carries the "
+                "end-user sandbox role, not account admin rights).",
+                hint=f"export {self.cred_env_hint} for the account that owns the UserPool.",
             )
-        self.region = region
+        self.ak = creds.access_key
+        self.sk = creds.secret_key
+        self.token = session_token or creds.session_token
+        # Every admin control-plane call signs against the provider's top OpenAPI
+        # gateway — the same host that serves the provider's IAM service.
+        self._host = cfg.get_service_endpoint("iam").host
+        self.region = cfg.region
         ident = self.call("sts", "GetCallerIdentity", "2018-01-01", {})
         self.account_id = str(ident.get("AccountId") or "")
         if expect_account and self.account_id != expect_account:
@@ -121,11 +156,11 @@ class OpenApiClient:
             query = {"Action": action, "Version": version}
             payload = json.dumps(body).encode()
         headers = sign_headers(
-            "POST", _HOST, query, payload,
+            "POST", self._host, query, payload,
             access_key=self.ak, secret_key=self.sk, service=service, region=self.region,
             session_token=self.token,
         )
-        url = f"https://{_HOST}/?{urllib.parse.urlencode(query)}"
+        url = f"https://{self._host}/?{urllib.parse.urlencode(query)}"
         req = urllib.request.Request(url, data=payload, headers=headers, method="POST")
         try:
             raw = urllib.request.urlopen(req, timeout=30).read()
@@ -147,11 +182,11 @@ class OpenApiClient:
             else:
                 query[k] = str(v)
         headers = sign_headers(
-            "GET", _HOST, query, b"",
+            "GET", self._host, query, b"",
             access_key=self.ak, secret_key=self.sk, service=service, region=self.region,
             session_token=self.token,
         )
-        url = f"https://{_HOST}/?{urllib.parse.urlencode(query)}"
+        url = f"https://{self._host}/?{urllib.parse.urlencode(query)}"
         req = urllib.request.Request(url, headers=headers, method="GET")
         try:
             raw = urllib.request.urlopen(req, timeout=30).read()

{agentkit_sdk_python-0.8.3 → agentkit_sdk_python-0.8.5}/agentkit/auth/admin.py

@@ -73,9 +73,10 @@ class CliAccessCoords:
     client_id: str
     role_trn: str
     provider_trn: str
+    sts_host: str | None = None  # provider STS endpoint (None = Volcengine default)
 
     def discovery_doc(self) -> dict:
-        return {
+        doc = {
             "issuer": self.issuer,
             "client_id": self.client_id,
             "role_trn": self.role_trn,
@@ -84,12 +85,68 @@ class CliAccessCoords:
             "transport": "sts",
             "scope": "openid profile email offline_access",
         }
+        if self.sts_host:
+            doc["sts_host"] = self.sts_host
+        return doc
+
+
+def tos_public_host(region: str) -> str:
+    """Provider-aware public host of the TOS static-site endpoint for *region*.
+
+    ``tos-<region>.volces.com`` on Volcengine, ``tos-<region>.bytepluses.com`` on
+    BytePlus — resolved from the platform service registry, not hardcoded here.
+    """
+    from agentkit.platform.configuration import VolcConfiguration
+
+    return VolcConfiguration(region=region).get_service_endpoint("tos").host
+
+
+def sts_public_host(region: str) -> str:
+    """Provider-aware STS endpoint for *region*, from the platform service registry.
+
+    Published in the discovery doc as ``sts_host`` so the end-user login exchanges
+    the id_token against the pool's own cloud (BytePlus pools must not call the
+    Volcengine STS).
+    """
+    from agentkit.platform.configuration import VolcConfiguration
+
+    return VolcConfiguration(region=region).get_service_endpoint("sts").host
 
 
 def _issuer(user_pool_uid: str, region: str) -> str:
+    # Volcengine UserPool issuer domain template — LAST-RESORT fallback only.
+    # The real issuer is read from the platform (GetUserPool.IssuerUrl), which is
+    # provider-correct by construction; this template is wrong on BytePlus.
     return f"https://userpool-{user_pool_uid}.userpool.auth.id.{region}.volces.com"
 
 
+def _pool_info(api: OpenApiClient, user_pool_uid: str) -> dict:
+    """Best-effort GetUserPool detail; {} when the call fails."""
+    try:
+        return api.call("id", "GetUserPool", "2025-10-30", {"UserPoolUid": user_pool_uid})
+    except (ApiError, AuthError):
+        return {}
+
+
+def resolve_issuer(api: OpenApiClient, user_pool_uid: str, region: str) -> str:
+    """The pool's real issuer URL, read from the platform.
+
+    ``GetUserPool`` returns ``IssuerUrl`` (and ``Domain`` / ``CustomDomain``), so the
+    issuer is whatever domain the current cloud provider actually serves — no
+    hardcoded domain. IAM's ``CreateOIDCProvider`` validates the issuer's OIDC
+    discovery endpoint, so a template-guessed domain fails on BytePlus.
+    Falls back to the Volcengine template only if the platform returns nothing.
+    """
+    info = _pool_info(api, user_pool_uid)
+    issuer = str(info.get("IssuerUrl") or "").rstrip("/")
+    if issuer:
+        return issuer
+    domain = str(info.get("CustomDomain") or info.get("Domain") or "").strip()
+    if domain:
+        return f"https://{domain}"
+    return _issuer(user_pool_uid, region)
+
+
 def identity_console_url(region: str = "cn-beijing", *, user_pool_uid: str | None = None) -> str:
     """Volcengine console URL for the Identity (UserPool) management page.
 
@@ -100,16 +157,47 @@ def identity_console_url(region: str = "cn-beijing", *, user_pool_uid: str | Non
 
 
 def create_user_pool(name: str, *, region: str = "cn-beijing", api: OpenApiClient | None = None) -> tuple[str, str]:
-    """Create a UserPool; return ``(uid, issuer)``."""
+    """Create (or, on a re-run, reuse) the UserPool named ``name``; return ``(uid, issuer)``.
+
+    A same-name pool left by an earlier run is reused instead of failing with
+    ``Duplicated`` — sso-setup must stay idempotent to re-run.
+    """
     api = api or OpenApiClient(region=region)
-    res = api.call("id", "CreateUserPool", "2025-10-30", {
-        "Name": name, "Description": "AgentKit CLI login pool",
-        "PasswordSignInEnabled": True, "SelfSignUpEnabled": False,
-    })
+    try:
+        res = api.call("id", "CreateUserPool", "2025-10-30", {
+            "Name": name, "Description": "AgentKit CLI login pool",
+            "PasswordSignInEnabled": True, "SelfSignUpEnabled": False,
+        })
+    except ApiError as exc:
+        if not any(k in exc.code for k in ("Duplicat", "Exist", "Conflict")):
+            raise
+        existing = _find_pool_by_name(api, name)
+        if not existing:
+            raise
+        return existing, resolve_issuer(api, existing, region)
     uid = str(res.get("Uid") or res.get("uid") or "")
     if not uid:
         raise AuthError(f"CreateUserPool returned no uid: {json.dumps(res)[:200]}")
-    return uid, _issuer(uid, region)
+    return uid, resolve_issuer(api, uid, region)
+
+
+def _find_pool_by_name(api: OpenApiClient, name: str) -> str | None:
+    """Uid of the pool named ``name``, or None. Raises if the name is ambiguous."""
+    matches: list[str] = []
+    page = 1
+    while page <= 10:  # 500 pools is far beyond any real account
+        r = api.call("id", "ListUserPools", "2025-10-30", {"PageNumber": page, "PageSize": 50})
+        data = r.get("Data") or []
+        matches += [str(p.get("Uid")) for p in data if p.get("Name") == name and p.get("Uid")]
+        if len(data) < 50:
+            break
+        page += 1
+    if len(matches) > 1:
+        raise AuthError(
+            f"{len(matches)} user pools are named {name!r}; pass the intended one "
+            "explicitly with --user-pool <uid>."
+        )
+    return matches[0] if matches else None
 
 
 def _ensure_cli_client(api: OpenApiClient, user_pool_uid: str, client_name: str = CLI_CLIENT_NAME) -> str:
@@ -182,18 +270,33 @@ def _ensure_role(
 ) -> None:
     trust = {"Statement": [{"Effect": "Allow", "Principal": {"Federated": [provider_trn]},
                             "Action": ["sts:AssumeRoleWithOIDC"]}]}
+    # Probe existence BEFORE CreateRole: an account at its RolesPerAccount quota
+    # returns LimitExceeded before the duplicate-name check, which would wrongly
+    # kill re-runs (and --role-name reuse) even though the role is already there.
+    role_exists = True
     try:
-        api.call("iam", "CreateRole", "2018-01-01", {
-            "RoleName": role_name, "DisplayName": role_name,
-            "TrustPolicyDocument": json.dumps(trust), "MaxSessionDuration": 3600,
-            "Description": "STS role for AgentKit CLI (UserPool federated)",
-        })
+        api.call("iam", "GetRole", "2018-01-01", {"RoleName": role_name})
     except ApiError as exc:
-        if "Exist" not in exc.code and "Conflict" not in exc.code:
+        if not any(k in exc.code for k in ("NotExist", "NoSuchEntity", "NotFound")):
             raise
+        role_exists = False
+    if role_exists:
         api.call("iam", "UpdateRole", "2018-01-01",
                  {"RoleName": role_name, "TrustPolicyDocument": json.dumps(trust),
                   "MaxSessionDuration": 3600})
+    else:
+        try:
+            api.call("iam", "CreateRole", "2018-01-01", {
+                "RoleName": role_name, "DisplayName": role_name,
+                "TrustPolicyDocument": json.dumps(trust), "MaxSessionDuration": 3600,
+                "Description": "STS role for AgentKit CLI (UserPool federated)",
+            })
+        except ApiError as exc:
+            if "Exist" not in exc.code and "Conflict" not in exc.code:
+                raise
+            api.call("iam", "UpdateRole", "2018-01-01",
+                     {"RoleName": role_name, "TrustPolicyDocument": json.dumps(trust),
+                      "MaxSessionDuration": 3600})
     doc = {"Statement": [{"Effect": "Allow", "Action": list(ROLE_ACTIONS), "Resource": ["*"]}]}
     api.call_ok("iam", "CreatePolicy", "2018-01-01",
                 {"PolicyName": policy_name, "PolicyDocument": json.dumps(doc),
@@ -233,7 +336,7 @@ def provision_cli_access(
     """
     api = api or OpenApiClient(region=region, expect_account=account_id)
     acct = account_id or api.account_id
-    issuer = _issuer(user_pool_uid, region)
+    issuer = resolve_issuer(api, user_pool_uid, region)
     client_id = _ensure_cli_client(api, user_pool_uid, client_name)
     if not client_id:
         raise AuthError("could not create or find the public CLI client")
@@ -243,6 +346,7 @@ def provision_cli_access(
     return CliAccessCoords(
         account_id=acct, region=region, user_pool_uid=user_pool_uid, issuer=issuer,
         client_id=client_id, role_trn=f"trn:iam::{acct}:role/{role_name}", provider_trn=provider_trn,
+        sts_host=sts_public_host(region),
     )
 
 
@@ -277,7 +381,12 @@ def ensure_federation(
     preset = _IDP_PRESETS.get(idp)
     if not preset:
         raise AuthError(f"unknown idp {idp!r}; supported: {', '.join(_IDP_PRESETS)}")
-    callback = f"{_issuer(user_pool_uid, region)}/login/generic_oauth/callback"
+    # The platform publishes the pool's exact OAuth callback; derive it from the
+    # resolved issuer only when the field is absent.
+    info = _pool_info(api, user_pool_uid)
+    callback = str(info.get("OauthLoginCallbackUrl") or "") or (
+        f"{resolve_issuer(api, user_pool_uid, region)}/login/generic_oauth/callback"
+    )
     lst = api.call("id", "ListIdentityProviders", "2025-10-30",
                    {"UserPoolUID": user_pool_uid, "PageNumber": 1, "PageSize": 50})
     for it in (lst.get("Data") or lst.get("data") or []):
@@ -349,7 +458,7 @@ def sso_setup(
     if custom_domain:
         manual.append(
             f"把自定义域名指向该 bucket:CNAME {custom_domain} -> "
-            f"{bucket}.tos-{region}.volces.com,并配置 https 证书(TOS/CDN)。"
+            f"{bucket}.{tos_public_host(region)},并配置 https 证书(TOS/CDN)。"
         )
     return SsoSetupResult(login_address=url, coords=coords, manual_steps=manual)
 
@@ -371,18 +480,28 @@ def publish_discovery(
     The returned URL is what the end user types: ``agentkit login <url>``.
     """
     try:
-        import os as _os
-
         import tos  # type: ignore
     except Exception as exc:  # pragma: no cover - optional dep
         raise AuthError(
             "publishing needs the `tos` package (`pip install tos`), or host the "
             "discovery doc yourself.",
         ) from exc
-    ak = access_key or _os.getenv("VOLCENGINE_ACCESS_KEY")
-    sk = secret_key or _os.getenv("VOLCENGINE_SECRET_KEY")
-    token = session_token or _os.getenv("VOLCENGINE_SESSION_TOKEN")
-    endpoint = f"tos-{coords.region}.volces.com"
+    from agentkit.platform.configuration import VolcConfiguration
+
+    cfg = VolcConfiguration(
+        region=coords.region, access_key=access_key, secret_key=secret_key,
+        session_token=session_token,
+    )
+    try:
+        creds = cfg.get_service_credentials("tos")
+    except ValueError as exc:
+        raise AuthError(
+            "publishing the discovery doc needs cloud credentials for TOS.",
+            hint=str(exc).split("\n")[0],
+        ) from exc
+    ak, sk = creds.access_key, creds.secret_key
+    token = session_token or creds.session_token
+    endpoint = cfg.get_service_endpoint("tos").host
     client = tos.TosClientV2(ak, sk, endpoint, coords.region, security_token=token)
     try:
         client.create_bucket(bucket, acl=tos.ACLType.ACL_Public_Read)
@@ -453,7 +572,7 @@ def preflight(api: OpenApiClient, *, credential_hosting: bool = True) -> list[di
             checks.append({"name": name, "status": "warn", "detail": str(exc)[:80], "fix": fix})
 
     probe("caller identity (STS)", lambda: f"account {api.account_id}",
-          "export a valid admin VOLCENGINE_ACCESS_KEY / _SECRET_KEY")
+          f"export a valid admin {api.cred_env_hint}")
     def _pools():
         r = api.call("id", "ListUserPools", "2025-10-30", {"PageNumber": 1, "PageSize": 1})
         return f"reachable ({r.get('TotalCount') or r.get('Total') or len(r.get('Items') or r.get('Data') or [])}+ pools)"

{agentkit_sdk_python-0.8.3 → agentkit_sdk_python-0.8.5}/agentkit/auth/profile.py

@@ -35,7 +35,7 @@ from agentkit.auth.errors import AuthError
 
 _PROFILE_FIELDS = {
     "name", "issuer", "client_id", "role_trn", "provider_trn",
-    "region", "scope", "transport", "address",
+    "region", "scope", "transport", "address", "sts_host",
 }
 
 
@@ -52,6 +52,7 @@ class AuthProfile:
     scope: str = "openid profile email offline_access"
     transport: str = "sts"  # "sts" (sandbox) | reserved for future transports
     address: str | None = None  # the login address this profile was resolved from
+    sts_host: str | None = None  # provider STS endpoint from the discovery doc (None = Volcengine default)
 
     def validate(self) -> "AuthProfile":
         missing = [k for k in ("name", "issuer", "client_id", "role_trn") if not getattr(self, k)]

{agentkit_sdk_python-0.8.3 → agentkit_sdk_python-0.8.5}/agentkit/auth/resolve.py

@@ -55,6 +55,7 @@ _ALIASES = {
     "region": ("region",),
     "transport": ("transport",),
     "scope": ("scope",),
+    "sts_host": ("sts_host", "stsHost"),
 }
 
 
@@ -175,7 +176,7 @@ def resolve_profile(address: str, *, timeout: float = _TIMEOUT, harden_ssl: bool
     return AuthProfile(
         name=name, issuer=str(issuer), client_id=str(client_id), role_trn=str(role_trn),
         provider_trn=provider_trn, region=region, scope=scope, transport=transport,
-        address=base,
+        address=base, sts_host=disc.get("sts_host"),
     ).validate()
 
 

{agentkit_sdk_python-0.8.3 → agentkit_sdk_python-0.8.5}/agentkit/auth/session.py

@@ -304,6 +304,7 @@ class AuthSession:
             self.profile.role_trn,
             self.profile.provider_trn,
             duration_seconds=self._duration,
+            host=self.profile.sts_host,
         )
         self._sts = StsCredentials(
             access_key=assumed.access_key_id,

{agentkit_sdk_python-0.8.3 → agentkit_sdk_python-0.8.5}/agentkit/auth/sso.py

@@ -80,13 +80,14 @@ def login(
     refresh_token = token.get("refresh_token")
 
     assumed = assume_role_with_oidc(
-        id_token, prof.role_trn, prof.provider_trn, duration_seconds=duration_seconds
+        id_token, prof.role_trn, prof.provider_trn, duration_seconds=duration_seconds,
+        host=prof.sts_host,
     )
     account = None
     try:
         ident = get_caller_identity(
             assumed.access_key_id, assumed.secret_access_key, assumed.session_token,
-            region=prof.region,
+            region=prof.region, host=prof.sts_host,
         )
         account = ident.get("AccountId")
     except Exception:
@@ -154,7 +155,8 @@ def whoami(profile: str | None = None, *, harden_ssl: bool = True) -> dict:
         raise AuthError("not logged in.", hint="run `agentkit login` first.")
     creds = session.credentials()
     ident = get_caller_identity(
-        creds.access_key, creds.secret_key, creds.session_token, region=session.profile.region
+        creds.access_key, creds.secret_key, creds.session_token,
+        region=session.profile.region, host=session.profile.sts_host,
     )
     ident["_profile"] = session.profile.name
     ident["_expires_at"] = creds.expires_at.isoformat() if creds.expires_at else None

{agentkit_sdk_python-0.8.3 → agentkit_sdk_python-0.8.5}/agentkit/auth/sts.py

@@ -73,13 +73,16 @@ def assume_role_with_oidc(
     role_session_name: str = "agentkit-cli",
     duration_seconds: int = 3600,
     timeout: float = _TIMEOUT,
+    host: str | None = None,
 ) -> AssumedRole:
     """Exchange an OIDC ``id_token`` for temporary STS credentials.
 
-    Anonymous call — the token is the credential. ``host`` MUST be
-    ``sts.volcengineapi.com``; the token is too long for the query string so it
-    travels in the POST body.
+    Anonymous call — the token is the credential; it is too long for the query
+    string so it travels in the POST body. ``host`` is the STS endpoint from the
+    login profile (the discovery doc's ``sts_host``, so BytePlus pools use the
+    BytePlus STS); it defaults to the Volcengine endpoint for older docs.
     """
+    sts_host = host or STS_HOST
     params = {
         "RoleTrn": role_trn,
         "OIDCToken": id_token,
@@ -89,7 +92,7 @@ def assume_role_with_oidc(
     if provider_trn:
         params["OIDCProviderTrn"] = provider_trn
     body = urllib.parse.urlencode(params).encode("utf-8")
-    url = f"https://{STS_HOST}/?Action=AssumeRoleWithOIDC&Version={STS_VERSION}"
+    url = f"https://{sts_host}/?Action=AssumeRoleWithOIDC&Version={STS_VERSION}"
     req = urllib.request.Request(
         url, data=body, headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST"
     )
@@ -103,7 +106,7 @@ def assume_role_with_oidc(
             "id_token's aud is in the provider's client-id allow-list.",
         ) from exc
     except urllib.error.URLError as exc:
-        raise NetworkError(f"cannot reach STS endpoint ({STS_HOST}): {exc.reason}") from exc
+        raise NetworkError(f"cannot reach STS endpoint ({sts_host}): {exc.reason}") from exc
 
     try:
         creds = json.loads(raw)["Result"]["Credentials"]
@@ -121,15 +124,17 @@ def get_caller_identity(
     *,
     region: str = "cn-beijing",
     timeout: float = _TIMEOUT,
+    host: str | None = None,
 ) -> dict:
     """Return the verified identity (``AccountId`` / ``IdentityType`` / ``UserId``)."""
+    sts_host = host or STS_HOST
     query = {"Action": "GetCallerIdentity", "Version": STS_VERSION}
     headers = sign_headers(
-        "POST", STS_HOST, query, b"",
+        "POST", sts_host, query, b"",
         access_key=access_key, secret_key=secret_key, service="sts", region=region,
         session_token=session_token,
     )
-    url = f"https://{STS_HOST}/?" + urllib.parse.urlencode(query)
+    url = f"https://{sts_host}/?" + urllib.parse.urlencode(query)
     req = urllib.request.Request(url, data=b"", headers=headers, method="POST")
     try:
         raw = urllib.request.urlopen(req, timeout=timeout).read()
@@ -137,5 +142,5 @@ def get_caller_identity(
         detail = redact(exc.read().decode("utf-8", "replace"))[:200]
         raise SsoError(f"GetCallerIdentity failed: {detail}") from exc
     except urllib.error.URLError as exc:
-        raise NetworkError(f"cannot reach STS endpoint ({STS_HOST}): {exc.reason}") from exc
+        raise NetworkError(f"cannot reach STS endpoint ({sts_host}): {exc.reason}") from exc
     return json.loads(raw).get("Result") or {}

{agentkit_sdk_python-0.8.3 → agentkit_sdk_python-0.8.5}/agentkit/platform/configuration.py

@@ -146,7 +146,8 @@ class VolcConfiguration:
         1. Explicitly passed in constructor
         2. Environment variable (VOLCENGINE_REGION / VOLC_REGION)
         3. Global config file (~/.agentkit/config.yaml)
-        4. Default (cn-beijing)
+        4. Environment variable (REGION)
+        5. Default (cn-beijing)
         """
         if self._region:
             return self._region
@@ -163,6 +164,7 @@ class VolcConfiguration:
                 or os.getenv("VOLC_REGION")
                 or get_global_config_str("region")
                 or get_global_config_str("volcengine", "region")
+                or os.getenv("REGION")
             )
 
         if base_region:
@@ -409,7 +411,9 @@ class VolcConfiguration:
         else:
             ak = os.getenv("VOLCENGINE_ACCESS_KEY") or os.getenv("VOLC_ACCESSKEY")
             sk = os.getenv("VOLCENGINE_SECRET_KEY") or os.getenv("VOLC_SECRETKEY")
-            token = os.getenv("VOLCENGINE_SESSION_TOKEN") or os.getenv("VOLC_SESSIONTOKEN")
+            token = os.getenv("VOLCENGINE_SESSION_TOKEN") or os.getenv(
+                "VOLC_SESSIONTOKEN"
+            )
 
         if ak and sk:
             return Credentials(

{agentkit_sdk_python-0.8.3 → agentkit_sdk_python-0.8.5}/agentkit/sdk/identity/client.py

@@ -16,7 +16,8 @@ from __future__ import annotations
 
 from typing import Dict
 
-from agentkit.client import BaseAgentkitClient
+from agentkit.client.base_service_client import BaseServiceClient
+from agentkit.platform.configuration import VolcConfiguration
 from agentkit.sdk.identity.types import (
     CreateInboundAuthConfigRequest,
     CreateInboundAuthConfigResponse,
@@ -27,7 +28,7 @@ from agentkit.sdk.identity.types import (
 )
 
 
-class AgentkitIdentityClient(BaseAgentkitClient):
+class AgentkitIdentityClient(BaseServiceClient):
     """AgentKit Identity / Inbound Auth Config Service."""
 
     API_ACTIONS: Dict[str, str] = {
@@ -44,11 +45,16 @@ class AgentkitIdentityClient(BaseAgentkitClient):
         session_token: str = "",
     ) -> None:
         super().__init__(
+            service="agent_identity",
             access_key=access_key,
             secret_key=secret_key,
             region=region,
             session_token=session_token,
             service_name="identity",
+            platform_config=VolcConfiguration(
+                region=region or None,
+                provider="volcengine",
+            ),
         )
 
     def create_inbound_auth_config(