google-agents-cli 1.12.0__tar.gz → 1.13.0__tar.gz

{google_agents_cli-1.12.0 → google_agents_cli-1.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: google-agents-cli
-Version: 1.12.0
+Version: 1.13.0
 Summary: Agents CLI — Agent Development Lifecycle toolchain for ADK
 Author-email: Google LLC <agents-cli-dev-pypi@google.com>
 Requires-Python: >=3.11
@@ -12,27 +12,30 @@ License-File: LICENSE
 Requires-Dist: click>=8.1.8,<9
 Requires-Dist: PyYAML>=6.0.2,<7
 Requires-Dist: cookiecutter>=2.6.0,<3
-Requires-Dist: jinja2>=3.1.0
+Requires-Dist: jinja2>=3.1.0,<4
 Requires-Dist: google-cloud-aiplatform[evaluation]>=2.2.0,<3
-Requires-Dist: google-cloud-resource-manager>=1.12.0
-Requires-Dist: google-auth[pyopenssl]>=2.47.0
+Requires-Dist: google-cloud-resource-manager>=1.12.0,<2
+Requires-Dist: google-auth[pyopenssl]>=2.47.0,<3
 Requires-Dist: pyopenssl<26.2
-Requires-Dist: rich>=13.7.0
-Requires-Dist: backoff>=2.2.1
-Requires-Dist: requests>=2.31.0
-Requires-Dist: websockets>=13.0
+Requires-Dist: rich>=13.7.0,<16
+Requires-Dist: backoff>=2.2.1,<3
+Requires-Dist: requests>=2.31.0,<3
+Requires-Dist: websockets>=13.0,<17
 Requires-Dist: a2a-sdk>=1.0,<2
 Requires-Dist: protobuf>=5.29.5,<7
 Requires-Dist: tomlkit>=0.13.0,<1
-Requires-Dist: psutil>=5.9.0
-Requires-Dist: python-dotenv>=1.0.0
-Requires-Dist: pathspec>=0.12.1
-Requires-Dist: filelock>=3.12,<4
-Requires-Dist: packaging>=24
+Requires-Dist: psutil>=5.9.0,<8
+Requires-Dist: python-dotenv>=1.0.0,<2
+Requires-Dist: pathspec>=0.12.1,<2
+Requires-Dist: filelock>=4.2.1,<5
+Requires-Dist: packaging>=24,<27
 Requires-Dist: pydantic>=2.10,<3
-Requires-Dist: ruff ; extra == "lint"
-Requires-Dist: ty ; extra == "lint"
-Requires-Dist: codespell ; extra == "lint"
+Requires-Dist: starlette>=1.0,<2
+Requires-Dist: uvicorn>=0.34,<1
+Requires-Dist: httpx>=0.28,<1
+Requires-Dist: ruff>=0.15,<0.16 ; extra == "lint"
+Requires-Dist: ty>=0.0.38,<0.1 ; extra == "lint"
+Requires-Dist: codespell>=2.4,<3 ; extra == "lint"
 Project-URL: documentation, https://google.github.io/agents-cli/
 Project-URL: homepage, https://github.com/google/agents-cli
 Project-URL: issues, https://github.com/google/agents-cli/issues
@@ -193,7 +196,7 @@ Yes. `agents-cli scaffold enhance` adds deployment and CI/CD to existing project
 Yes. The CLI works standalone — you can run `agents-cli scaffold`, `eval`, `deploy`, and every other command directly from your terminal. The skills just make it easier for coding agents to do it for you.
 
 **How can I extend `agents-cli` with other skills?**<br>
-`agents-cli` skills cover the agent-building lifecycle (scaffold, ADK code patterns, evals, deploy, publish, observability). For adjacent concerns, you could install another skill suite alongside. For example, [agent-skills](https://github.com/addyosmani/agent-skills) covers general software-engineering workflows (ideation, spec gates, planning, code review), and [google/skills](https://github.com/google/skills) covers Google Cloud foundations (BigQuery, Cloud Run, Firebase, GKE).
+`agents-cli` skills cover the agent-building lifecycle (scaffold, ADK code patterns, evals, deploy, publish, observability). For adjacent concerns, you could install another skill suite alongside. For example, [agent-skills](https://github.com/addyosmani/agent-skills) covers general software-engineering workflows (ideation, spec gates, planning, code review), and [google/skills](https://github.com/google/skills) covers Google Cloud foundations (BigQuery, Cloud Run, Firebase, GKE). [genai-factory](https://github.com/GoogleCloudPlatform/genai-factory) has Terraform blueprints for enterprise GenAI infrastructure and ships as an extension: `agents-cli extension add GoogleCloudPlatform/genai-factory`.
 
 ## Feedback
 
@@ -219,7 +222,9 @@ it in Cloud Logging. It records only the metadata such as command name
 (e.g. `deploy`, `scaffold.create`), exit code, error class, duration (measured
 from command dispatch to exit, so it excludes CLI startup), CLI/Python versions,
 and OS — never file contents, arguments, or other input. Commands added by
-extensions are recorded without their names.
+extensions are recorded without their names. A command an extension serves is
+marked as such, and the extension is named only if it was installed from a
+repository in the `google` GitHub organization.
 
 The request that writes the entry also carries usage metadata in its
 `User-Agent` and `X-Goog-Api-Client` headers, which Google receives for

{google_agents_cli-1.12.0 → google_agents_cli-1.13.0}/README.md

@@ -152,7 +152,7 @@ Yes. `agents-cli scaffold enhance` adds deployment and CI/CD to existing project
 Yes. The CLI works standalone — you can run `agents-cli scaffold`, `eval`, `deploy`, and every other command directly from your terminal. The skills just make it easier for coding agents to do it for you.
 
 **How can I extend `agents-cli` with other skills?**<br>
-`agents-cli` skills cover the agent-building lifecycle (scaffold, ADK code patterns, evals, deploy, publish, observability). For adjacent concerns, you could install another skill suite alongside. For example, [agent-skills](https://github.com/addyosmani/agent-skills) covers general software-engineering workflows (ideation, spec gates, planning, code review), and [google/skills](https://github.com/google/skills) covers Google Cloud foundations (BigQuery, Cloud Run, Firebase, GKE).
+`agents-cli` skills cover the agent-building lifecycle (scaffold, ADK code patterns, evals, deploy, publish, observability). For adjacent concerns, you could install another skill suite alongside. For example, [agent-skills](https://github.com/addyosmani/agent-skills) covers general software-engineering workflows (ideation, spec gates, planning, code review), and [google/skills](https://github.com/google/skills) covers Google Cloud foundations (BigQuery, Cloud Run, Firebase, GKE). [genai-factory](https://github.com/GoogleCloudPlatform/genai-factory) has Terraform blueprints for enterprise GenAI infrastructure and ships as an extension: `agents-cli extension add GoogleCloudPlatform/genai-factory`.
 
 ## Feedback
 
@@ -178,7 +178,9 @@ it in Cloud Logging. It records only the metadata such as command name
 (e.g. `deploy`, `scaffold.create`), exit code, error class, duration (measured
 from command dispatch to exit, so it excludes CLI startup), CLI/Python versions,
 and OS — never file contents, arguments, or other input. Commands added by
-extensions are recorded without their names.
+extensions are recorded without their names. A command an extension serves is
+marked as such, and the extension is named only if it was installed from a
+repository in the `google` GitHub organization.
 
 The request that writes the entry also carries usage metadata in its
 `User-Agent` and `X-Goog-Api-Client` headers, which Google receives for

{google_agents_cli-1.12.0 → google_agents_cli-1.13.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "google-agents-cli"
-version = "1.12.0"
+version = "1.13.0"
 description = "Agents CLI — Agent Development Lifecycle toolchain for ADK"
 readme = "README.md"
 license = "Apache-2.0"
@@ -15,29 +15,33 @@ dependencies = [
   "click>=8.1.8,<9",
   "PyYAML>=6.0.2,<7",
   "cookiecutter>=2.6.0,<3",
-  "jinja2>=3.1.0",
+  "jinja2>=3.1.0,<4",
   "google-cloud-aiplatform[evaluation]>=2.2.0,<3",
-  "google-cloud-resource-manager>=1.12.0",
-  "google-auth[pyopenssl]>=2.47.0",
+  "google-cloud-resource-manager>=1.12.0,<2",
+  "google-auth[pyopenssl]>=2.47.0,<3",
   # pyOpenSSL 26.2 forbids mutating a used SSL Context; urllib3 does it per
   # connection under google-auth's mTLS shim (urllib3#5107). Lift when fixed.
   "pyopenssl<26.2",
-  "rich>=13.7.0",
-  "backoff>=2.2.1",
-  "requests>=2.31.0",
-  "websockets>=13.0",
+  "rich>=13.7.0,<16",
+  "backoff>=2.2.1,<3",
+  "requests>=2.31.0,<3",
+  "websockets>=13.0,<17",
   "a2a-sdk>=1.0,<2",
   # Pin the a2a-sdk (>=5.29.5) .. aiplatform (<7) window so pip won't chase
   # protobuf 7 and backtrack into old google-api-core (protobuf<5).
   "protobuf>=5.29.5,<7",
   "tomlkit>=0.13.0,<1",
-  "psutil>=5.9.0",
-  "python-dotenv>=1.0.0",
-  "pathspec>=0.12.1",
-  "filelock>=3.12,<4",
-  "packaging>=24",
+  "psutil>=5.9.0,<8",
+  "python-dotenv>=1.0.0,<2",
+  "pathspec>=0.12.1,<2",
+  "filelock>=4.2.1,<5",
+  "packaging>=24,<27",
   # 2.10+: earlier versions emit `enum` beside `const`, which the schema sync test sees.
   "pydantic>=2.10,<3",
+  # Agent Command Center server (`agents-cli command-center`).
+  "starlette>=1.0,<2",
+  "uvicorn>=0.34,<1",
+  "httpx>=0.28,<1",
 ]
 
 [project.urls]
@@ -68,9 +72,9 @@ include = [
 
 [project.optional-dependencies]
 lint = [
-    "ruff",
-    "ty",
-    "codespell",
+    "ruff>=0.15,<0.16",
+    "ty>=0.0.38,<0.1",
+    "codespell>=2.4,<3",
 ]
 
 [tool.pytest.ini_options]
@@ -84,12 +88,12 @@ log_cli_date_format = "%Y-%m-%d %H:%M:%S"
 
 [dependency-groups]
 dev = [
-    "pytest>=9.0.2",
-    "pytest-mock>=3.15.1",
-    "pytest-rerunfailures>=15.0",
-    "pytest-xdist>=3.6.1",
-    "pytest-cov>=4.1.0",
-    "jsonschema>=4.20",
+    "pytest>=9.0.2,<10",
+    "pytest-mock>=3.15.1,<4",
+    "pytest-rerunfailures>=15.0,<17",
+    "pytest-xdist>=3.6.1,<4",
+    "pytest-cov>=4.1.0,<8",
+    "jsonschema>=4.20,<5",
 ]
 
 [tool.ruff]

{google_agents_cli-1.12.0 → google_agents_cli-1.13.0}/src/google/agents/cli/_adk_client.py

@@ -139,9 +139,10 @@ def run_sse(
         if "charset" not in resp.headers.get("Content-Type", "").lower():
             resp.encoding = "utf-8"
         for line in resp.iter_lines(decode_unicode=True):
-            if not isinstance(line, str) or not line.startswith("data: "):
+            # The space after "data:" is optional; ADK Java's server omits it.
+            if not isinstance(line, str) or not line.startswith("data:"):
                 continue
-            data_str = line[len("data: ") :]
+            data_str = line[len("data:") :]
             try:
                 yield json.loads(data_str)
             except json.JSONDecodeError:

{google_agents_cli-1.12.0 → google_agents_cli-1.13.0}/src/google/agents/cli/_click.py

@@ -18,6 +18,7 @@ from __future__ import annotations
 
 import importlib
 import inspect
+from dataclasses import dataclass
 from typing import Any
 
 import click
@@ -33,10 +34,20 @@ COMMAND_PATH_META_KEY = "agents_cli.command_path"
 # view (``--help``, or a group given no subcommand) can be told apart from a
 # run. Consumed by ``_telemetry``.
 COMMAND_INVOKED_META_KEY = "agents_cli.command_invoked"
-# Marks a recorded path segment that an extension serves: ``generate~ext`` for
-# an overridden built-in. A command an extension adds is recorded as the bare
-# marker, never by name, since the extension author chose that name.
-EXTENSION_PATH_MARKER = "~ext"
+# Separates a recorded path segment from the extension that serves it:
+# ``generate~<name>`` for a first-party extension's override, ``generate~ext``
+# for any other. A command an extension adds is recorded as ``~<extension>``,
+# never by name, since the extension author chose that name.
+EXTENSION_PATH_SEPARATOR = "~"
+_UNNAMED_EXTENSION = "ext"
+
+
+@dataclass(frozen=True)
+class _Override:
+    command: click.Command
+    extension_name: str
+    # Only a first-party extension is recorded by name.
+    first_party: bool
 
 
 class LazyGroup(click.Group):
@@ -64,7 +75,7 @@ class LazyGroup(click.Group):
         self._lazy_commands: dict[str, tuple[str, str]] = {}
         # name -> experiment label
         self._experiment_gates: dict[str, str] = {}
-        self._overrides: dict[str, click.Command] = {}
+        self._overrides: dict[str, _Override] = {}
         self._hidden: set[str] = set()
 
     def add_lazy_command(
@@ -95,6 +106,12 @@ class LazyGroup(click.Group):
         if hidden:
             self._hidden.add(name)
 
+    def add_override(
+        self, name: str, cmd: click.Command, extension_name: str, first_party: bool
+    ) -> None:
+        """Serve `name` with `cmd` from extension `extension_name`."""
+        self._overrides[name] = _Override(cmd, extension_name, first_party)
+
     @property
     def hidden_commands(self) -> frozenset[str]:
         """Names registered with `hidden=True`: invocable, but not listed."""
@@ -121,7 +138,7 @@ class LazyGroup(click.Group):
         if not self._is_visible(cmd_name):
             return None
         if cmd_name in self._overrides:
-            return self._overrides[cmd_name]
+            return self._overrides[cmd_name].command
         if cmd_name in self._lazy_commands and cmd_name not in self.commands:
             import_path, _ = self._lazy_commands[cmd_name]
             module_path, attr = import_path.split(":")
@@ -151,17 +168,23 @@ class LazyGroup(click.Group):
         Overrides only apply to built-ins and added commands never share a
         built-in's name, so an extension-served built-in name is an override.
         """
-        if cmd_name not in self._overrides:
+        override = self._overrides.get(cmd_name)
+        if override is None:
             return cmd_name
-        if cmd_name in self._lazy_commands or cmd_name in self.commands:
-            return f"{cmd_name}{EXTENSION_PATH_MARKER}"
-        return EXTENSION_PATH_MARKER
+        is_builtin = cmd_name in self._lazy_commands or cmd_name in self.commands
+        recorded_name = cmd_name if is_builtin else ""
+        extension = (
+            override.extension_name if override.first_party else _UNNAMED_EXTENSION
+        )
+        return f"{recorded_name}{EXTENSION_PATH_SEPARATOR}{extension}"
 
     def format_commands(self, ctx: click.Context, formatter: click.HelpFormatter) -> None:
         rows: list[tuple[str, str]] = []
         for name in self.list_commands(ctx):
             if name in self._overrides:
-                rows.append((name, self._overrides[name].get_short_help_str(limit=1000)))
+                rows.append(
+                    (name, self._overrides[name].command.get_short_help_str(limit=1000))
+                )
                 continue
             if name in self.commands:
                 # Don't truncate — Click's default of 45 would cut our docstring summaries.

{google_agents_cli-1.12.0 → google_agents_cli-1.13.0}/src/google/agents/cli/_experiments.py

@@ -32,6 +32,8 @@ _REGISTRY: dict[str, Experiment] = {
     "adk_java": Experiment("adk_java", bool, False),
     "adk_kotlin": Experiment("adk_kotlin", bool, False),
     "adk_typescript": Experiment("adk_typescript", bool, False),
+    # Hides Agent Command Center (`command-center`, `acc`, `cc`) while in progress.
+    "command_center": Experiment("command_center", bool, False),
 }
 
 

google_agents_cli-1.13.0/src/google/agents/cli/_gcloud_auth.py

@@ -0,0 +1,290 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Let gcloud subprocesses fall back to Application Default Credentials.
+
+gcloud reads only its own credential store, never ADC, so in an environment
+that has ADC but no `gcloud auth login` (CI with a service account key, a
+container with ADC mounted) every gcloud command fails with "You do not
+currently have an active account selected". When gcloud has no account of its
+own, agents-cli hands it an ADC access token instead.
+"""
+
+import json
+import logging
+import math
+import os
+import subprocess
+import time
+from collections.abc import Mapping, Sequence
+from dataclasses import dataclass
+
+from google.agents.cli._runner import run_resolved
+from google.agents.cli._tools import ToolNotExecutableError, ToolNotFoundError
+
+_ACCESS_TOKEN_ENV = "CLOUDSDK_AUTH_ACCESS_TOKEN"
+# Any of these means the user already chose how gcloud authenticates.
+_GCLOUD_AUTH_OVERRIDE_ENVS = (
+    _ACCESS_TOKEN_ENV,
+    "CLOUDSDK_AUTH_ACCESS_TOKEN_FILE",
+    "CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE",
+)
+# gcloud command groups that never send credentials, so they skip the account check.
+_CREDENTIAL_FREE_GROUPS = frozenset(
+    {"components", "config", "help", "info", "topic", "version"}
+)
+# gcloud's config folder defaults to one under these (~/.config/gcloud, or
+# %APPDATA%\gcloud on Windows).
+_GCLOUD_CONFIG_DIR_ENVS = frozenset({"HOME", "APPDATA"})
+# A release track goes before the command group, as in `gcloud beta auth login`.
+_RELEASE_TRACKS = frozenset({"alpha", "beta"})
+# `gcloud auth` subcommands that only read credentials; any other one may change
+# the account gcloud or ADC signs in as.
+_READ_ONLY_AUTH_COMMANDS = frozenset(
+    {"list", "print-access-token", "print-identity-token"}
+)
+# A missing or blocked gcloud, which matters when adc_token_for_gcloud() is
+# called directly rather than from a gcloud call that already found gcloud.
+_GCLOUD_RUN_ERRORS = (
+    ToolNotFoundError,
+    ToolNotExecutableError,
+    OSError,
+    subprocess.TimeoutExpired,
+)
+# gcloud doesn't say when a token it prints expires, so reuse it only briefly.
+_GCLOUD_TOKEN_TTL_SECONDS = 300
+
+
+@dataclass(frozen=True)
+class _CachedToken:
+    token: str | None
+    expires_at: float  # A time.monotonic() deadline.
+
+
+_cached_token: _CachedToken | None = None
+# Whether gcloud has credentials of its own, per gcloud environment (see
+# _gcloud_env_key). Cleared when a `gcloud auth` command may change accounts.
+_own_credentials: dict[tuple[tuple[str, str], ...], bool] = {}
+
+
+def fallback_token_env(
+    gcloud_args: Sequence[str], env: Mapping[str, str] | None
+) -> dict[str, str] | None:
+    """Return the environment for a gcloud subprocess with an ADC token added.
+
+    Returns None, meaning "run gcloud as is", when the command is a
+    `gcloud auth` command or doesn't use credentials, or when
+    `adc_token_for_gcloud` returns None.
+
+    Args:
+        gcloud_args: The gcloud arguments, without the leading "gcloud".
+        env: The environment the caller passes to the subprocess, or None for
+            the current process environment.
+    """
+    command = _command_path(gcloud_args)
+    group = command[0] if command else None
+    # `gcloud auth` commands manage gcloud's own credentials; a token would
+    # override them (e.g. print-identity-token fails with one).
+    if group == "auth":
+        if not _READ_ONLY_AUTH_COMMANDS.intersection(command[1:]):
+            # The account may change, so check it again on the next call.
+            _clear_caches()
+        return None
+    if group is None or group in _CREDENTIAL_FREE_GROUPS:
+        return None
+    base_env = dict(os.environ if env is None else env)
+    token = adc_token_for_gcloud(base_env)
+    if token is None:
+        return None
+    return {**base_env, _ACCESS_TOKEN_ENV: token}
+
+
+def adc_token_for_gcloud(env: Mapping[str, str] | None = None) -> str | None:
+    """Return the ADC token that gcloud commands from agents-cli run with.
+
+    Returns None when gcloud uses its own credentials: an active account, or
+    an access token or credential file set in the environment or in gcloud's
+    config. Also returns None when ADC is unavailable.
+
+    Args:
+        env: The environment gcloud runs with, or None for the current
+            process environment.
+    """
+    base_env = os.environ if env is None else env
+    if any(base_env.get(name) for name in _GCLOUD_AUTH_OVERRIDE_ENVS):
+        return None
+    if _gcloud_has_own_credentials(base_env):
+        return None
+    token = _get_adc_token()
+    if token is not None:
+        logging.debug("gcloud has no credentials of its own; passing it the ADC token.")
+    return token
+
+
+def _command_path(gcloud_args: Sequence[str]) -> list[str]:
+    """The command group and subcommands, without flags or a release track.
+
+    Global flags before the group must use the `--flag=value` form, or their
+    value would be taken for the group.
+    """
+    command = [arg for arg in gcloud_args if not arg.startswith("-")]
+    if command and command[0] in _RELEASE_TRACKS:
+        return command[1:]
+    return command
+
+
+def _clear_caches() -> None:
+    # Imported here: auth imports _runner, which imports this module lazily.
+    from google.agents.cli.auth import reset_adc_credentials
+
+    global _cached_token
+    _cached_token = None
+    _own_credentials.clear()
+    reset_adc_credentials()
+
+
+def _gcloud_has_own_credentials(env: Mapping[str, str]) -> bool:
+    # The checks run with the gcloud call's own environment: a CLOUDSDK_CONFIG
+    # or CLOUDSDK_ACTIVE_CONFIG_NAME there selects other accounts and config.
+    key = _gcloud_env_key(env)
+    if key not in _own_credentials:
+        check_env = dict(env)
+        _own_credentials[key] = _gcloud_has_active_account(
+            check_env
+        ) or _gcloud_auth_configured(check_env)
+    return _own_credentials[key]
+
+
+def _gcloud_env_key(env: Mapping[str, str]) -> tuple[tuple[str, str], ...]:
+    """The variables that change which accounts and config gcloud reads."""
+    return tuple(
+        sorted(
+            (name, value)
+            for name, value in env.items()
+            if name.startswith("CLOUDSDK_") or name in _GCLOUD_CONFIG_DIR_ENVS
+        )
+    )
+
+
+def _gcloud_has_active_account(env: dict[str, str]) -> bool:
+    try:
+        result = run_resolved(
+            [
+                "gcloud",
+                "auth",
+                "list",
+                "--filter=status:ACTIVE",
+                "--format=value(account)",
+            ],
+            env=env,
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            timeout=30,
+        )
+    except _GCLOUD_RUN_ERRORS as e:
+        logging.debug("Could not list gcloud accounts: %s", e)
+        return True
+    # If gcloud can't tell, leave it alone rather than override an account it may have.
+    return result.returncode != 0 or bool(result.stdout.strip())
+
+
+def _gcloud_auth_configured(env: dict[str, str]) -> bool:
+    """Whether gcloud's config sets an access token file or credential file.
+
+    `gcloud auth list` shows no account for these, and the ADC token would
+    take precedence over them.
+    """
+    try:
+        result = run_resolved(
+            ["gcloud", "config", "list", "--format=json(auth)"],
+            env=env,
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            timeout=30,
+        )
+    except _GCLOUD_RUN_ERRORS as e:
+        logging.debug("Could not read the gcloud config: %s", e)
+        return True
+    if result.returncode != 0:
+        return True
+    try:
+        # gcloud prints `{"auth": {...}}`, or `null` when no auth property is set.
+        auth = (json.loads(result.stdout.strip() or "null") or {}).get("auth") or {}
+        return bool(auth.get("access_token_file") or auth.get("credential_file_override"))
+    except (json.JSONDecodeError, AttributeError) as e:
+        logging.debug("Could not parse the gcloud auth config: %s", e)
+        return True
+
+
+def _get_adc_token() -> str | None:
+    global _cached_token
+    if _cached_token is not None and time.monotonic() < _cached_token.expires_at:
+        return _cached_token.token
+
+    # Imported here: auth imports _runner, which imports this module lazily.
+    import google.auth.exceptions
+    from google.auth.transport.requests import Request as GoogleAuthRequest
+
+    from google.agents.cli.auth import get_adc_credentials
+
+    try:
+        credentials, _ = get_adc_credentials()
+        # The cached credentials refresh only when expired, so a long command
+        # doesn't pay for a token request on every gcloud call.
+        if not credentials.valid:
+            credentials.refresh(GoogleAuthRequest())
+        return credentials.token
+    except (google.auth.exceptions.DefaultCredentialsError, OSError) as e:
+        # gcloud reads the same ADC file, so it can't find a token either. An
+        # unreadable GOOGLE_APPLICATION_CREDENTIALS file raises OSError.
+        logging.debug("No Application Default Credentials for gcloud: %s", e)
+        _cached_token = _CachedToken(None, math.inf)
+        return None
+    except google.auth.exceptions.RefreshError as e:
+        # google-auth can't refresh some user credentials that gcloud can, e.g.
+        # when the organization requires reauthentication.
+        logging.debug("google-auth could not refresh ADC: %s", e)
+    except google.auth.exceptions.GoogleAuthError as e:
+        # Not cached: a network error may pass before the next gcloud call.
+        logging.debug("Could not get an ADC access token: %s", e)
+        return None
+
+    token = _print_adc_token_with_gcloud()
+    ttl = _GCLOUD_TOKEN_TTL_SECONDS if token else math.inf
+    _cached_token = _CachedToken(token, time.monotonic() + ttl)
+    return token
+
+
+def _print_adc_token_with_gcloud() -> str | None:
+    try:
+        result = run_resolved(
+            ["gcloud", "auth", "application-default", "print-access-token", "--quiet"],
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            timeout=30,
+        )
+    except _GCLOUD_RUN_ERRORS as e:
+        logging.debug("Could not print the ADC access token: %s", e)
+        return None
+    if result.returncode != 0 or not result.stdout.strip():
+        # gcloud then fails with its own "run gcloud auth login" message.
+        logging.debug("No Application Default Credentials for gcloud: %s", result.stderr)
+        return None
+    return result.stdout.strip()

{google_agents_cli-1.12.0 → google_agents_cli-1.13.0}/src/google/agents/cli/_gcp_project.py

@@ -14,7 +14,10 @@
 
 """GCP project resolution and lookup utilities."""
 
+import json
+import logging
 import os
+from dataclasses import dataclass
 
 import click
 
@@ -91,3 +94,44 @@ def get_gcp_project_number(project_id: str) -> str | None:
     if project_id.isdigit():
         return project_id
     return None
+
+
+@dataclass(frozen=True)
+class ProjectAncestor:
+    """A resource a project sits under, as `gcloud projects get-ancestors` lists it."""
+
+    id: str
+    # "project", "folder" or "organization".
+    type: str
+
+
+def get_gcp_project_ancestors(project_id: str) -> list[ProjectAncestor] | None:
+    """Get the resource hierarchy a project sits in.
+
+    Args:
+        project_id: GCP project ID or project number.
+
+    Returns:
+        The ancestry (possibly empty), or None if it can't be read.
+    """
+    res = run(
+        ["gcloud", "projects", "get-ancestors", project_id, "--format=json"],
+        check=False,
+        capture=True,
+        print_cmd=False,
+    )
+    if res.returncode != 0:
+        logging.warning(
+            "Could not read the ancestry of project %s: %s",
+            project_id,
+            res.stderr.strip(),
+        )
+        return None
+    try:
+        return [
+            ProjectAncestor(id=entry["id"], type=entry["type"])
+            for entry in json.loads(res.stdout)
+        ]
+    except (json.JSONDecodeError, TypeError, KeyError) as e:
+        logging.warning("Could not read the ancestry of project %s: %s", project_id, e)
+        return None