ory-adk 0.13.9__tar.gz

ory_adk-0.13.9/.gitignore

@@ -0,0 +1,36 @@
+node_modules/
+dist/
+*.tsbuildinfo
+.env
+.env.local
+
+# Python (uv workspace under python/)
+.venv/
+__pycache__/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+build/
+*.pyc
+
+# Debug logs
+*.log
+
+# Harness sandbox dirs
+.sandbox/
+
+# Staged install-surface repo contents (see scripts/sync-install-surfaces.mjs)
+.install-surfaces/
+
+# Local dev environment (local Ory stack + Verdaccio registry)
+.ory-dev/
+
+# Worktrees for changes
+.worktrees/
+.claude/worktrees/
+
+# Gemini CLI extension assets — materialized at install time from
+# @ory/argus templates. The repo source is the canonical templates;
+# these subdirs are generated wherever the install runs.
+packages/gemini-cli/gemini-extension/skills/
+packages/gemini-cli/gemini-extension/commands/

ory_adk-0.13.9/PKG-INFO

@@ -0,0 +1,48 @@
+Metadata-Version: 2.4
+Name: ory-adk
+Version: 0.13.9
+Summary: Ory Agent Security for the Google Agent Development Kit (ADK) — per-tool authorization, tracing, and identity propagation via before/after tool callbacks. Built on ory-argus.
+Author: Ory
+License-Expression: Apache-2.0
+Keywords: adk,agent,agent-development-kit,ai,authorization,google,ory
+Requires-Python: >=3.10
+Requires-Dist: google-adk>=1.0
+Requires-Dist: ory-argus<1,>=0.8
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# ory-adk
+
+Ory Agent Security for the [Google Agent Development Kit (ADK)](https://google.github.io/adk-docs/).
+
+Authorizes every tool call against Ory Permissions via ADK's before/after tool callbacks,
+traces invocations, and propagates user → agent → sub-agent identity — built on
+[`ory-argus`](https://pypi.org/project/ory-argus/).
+
+```bash
+pip install ory-adk
+```
+
+```python
+from google.adk.agents import Agent
+from ory_adk import ory_before_tool_callback, ory_after_tool_callback
+
+agent = Agent(
+    name="assistant",
+    model="gemini-2.5-flash",
+    tools=[search, send_email],
+    before_tool_callback=ory_before_tool_callback(),   # gate every tool call
+    after_tool_callback=ory_after_tool_callback(),     # trace completions
+)
+```
+
+In **enforce** mode (`ORY_PERMISSION_MODE=enforce`) a denied tool is skipped — ADK returns
+the denial to the model and the tool never runs. In **observe** mode (default) the tool runs
+and a `permission.observe_deny` span is recorded. When the model delegates to a sub-agent
+(`transfer_to_agent`), a sub-agent identity + agent→subagent delegation are recorded.
+
+Credentials come from the shared `~/.config/ory-agent-plugins/config.json`, so a login from
+any Ory harness or `ory-argus login` is reused automatically. See
+[docs/sdk-integrations.md](https://github.com/ory-corp/ory-agent-plugins/blob/main/docs/sdk-integrations.md).

ory_adk-0.13.9/README.md

@@ -0,0 +1,33 @@
+# ory-adk
+
+Ory Agent Security for the [Google Agent Development Kit (ADK)](https://google.github.io/adk-docs/).
+
+Authorizes every tool call against Ory Permissions via ADK's before/after tool callbacks,
+traces invocations, and propagates user → agent → sub-agent identity — built on
+[`ory-argus`](https://pypi.org/project/ory-argus/).
+
+```bash
+pip install ory-adk
+```
+
+```python
+from google.adk.agents import Agent
+from ory_adk import ory_before_tool_callback, ory_after_tool_callback
+
+agent = Agent(
+    name="assistant",
+    model="gemini-2.5-flash",
+    tools=[search, send_email],
+    before_tool_callback=ory_before_tool_callback(),   # gate every tool call
+    after_tool_callback=ory_after_tool_callback(),     # trace completions
+)
+```
+
+In **enforce** mode (`ORY_PERMISSION_MODE=enforce`) a denied tool is skipped — ADK returns
+the denial to the model and the tool never runs. In **observe** mode (default) the tool runs
+and a `permission.observe_deny` span is recorded. When the model delegates to a sub-agent
+(`transfer_to_agent`), a sub-agent identity + agent→subagent delegation are recorded.
+
+Credentials come from the shared `~/.config/ory-agent-plugins/config.json`, so a login from
+any Ory harness or `ory-argus login` is reused automatically. See
+[docs/sdk-integrations.md](https://github.com/ory-corp/ory-agent-plugins/blob/main/docs/sdk-integrations.md).

ory_adk-0.13.9/pyproject.toml

@@ -0,0 +1,23 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "ory-adk"
+version = "0.13.9"
+description = "Ory Agent Security for the Google Agent Development Kit (ADK) — per-tool authorization, tracing, and identity propagation via before/after tool callbacks. Built on ory-argus."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "Apache-2.0"
+authors = [{ name = "Ory" }]
+keywords = ["ory", "google", "adk", "agent-development-kit", "authorization", "agent", "ai"]
+dependencies = [
+    "ory-argus>=0.8,<1",
+    "google-adk>=1.0",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "ruff>=0.6"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/ory_adk"]

ory_adk-0.13.9/src/ory_adk/__init__.py

@@ -0,0 +1,19 @@
+"""Ory Agent Security for the Google Agent Development Kit (ADK).
+
+    from google.adk.agents import Agent
+    from ory_adk import ory_before_tool_callback, ory_after_tool_callback
+
+    agent = Agent(
+        name="assistant", model="gemini-2.5-flash", tools=[...],
+        before_tool_callback=ory_before_tool_callback(),
+        after_tool_callback=ory_after_tool_callback(),
+    )
+"""
+
+from __future__ import annotations
+
+from .callbacks import ory_after_tool_callback, ory_before_tool_callback
+
+__version__ = "0.13.9"
+
+__all__ = ["ory_before_tool_callback", "ory_after_tool_callback", "__version__"]

ory_adk-0.13.9/src/ory_adk/callbacks.py

@@ -0,0 +1,83 @@
+"""Ory Agent Security for the Google Agent Development Kit (ADK).
+
+ADK exposes a first-class per-tool gate: ``before_tool_callback`` runs before every tool
+call and **skips the tool when it returns a dict** (that dict becomes the tool response).
+``ory_before_tool_callback()`` authorizes each call against Ory Permissions:
+
+  - allow / observe / fail-open / interactive → return ``None`` (the tool runs).
+  - deny (enforce) → return ``{"error": "Ory: permission denied …"}`` so ADK skips the tool
+    and hands the model the denial.
+
+``ory_after_tool_callback()`` records the ``tool.complete`` span. Register both as
+constructor kwargs:
+
+    from google.adk.agents import Agent
+    from ory_adk import ory_before_tool_callback, ory_after_tool_callback
+
+    agent = Agent(
+        name="assistant", model="gemini-2.5-flash", tools=[...],
+        before_tool_callback=ory_before_tool_callback(),
+        after_tool_callback=ory_after_tool_callback(),
+    )
+
+All gate logic lives in ``ory_argus``; the callbacks only read ``tool.name`` + the ``args``
+dict and return plain values, so this module imports without ``google-adk`` present.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ory_argus import OryAgentClient, complete, gate, register_subagent, session_start
+
+HARNESS = "google-adk"
+# ADK emits this as a tool call when the model delegates to a sub-agent.
+_TRANSFER_TOOL = "transfer_to_agent"
+
+
+def ory_before_tool_callback(
+    *, client: OryAgentClient | None = None, can_block: bool = True, project_url: str | None = None
+):
+    """Build an ADK ``before_tool_callback`` that gates each tool through Ory."""
+    c = client or OryAgentClient.from_env(HARNESS)
+    state: dict = {}
+
+    def before_tool_callback(tool: Any, args: dict, tool_context: Any) -> dict | None:
+        if not state.get("started"):
+            state["started"] = True
+            try:
+                session_start(c, harness=HARNESS, project_url=project_url)
+            except Exception as err:  # noqa: BLE001 — session gate must never break the agent
+                c.logger.warn("session_start.failed", {"message": str(err)})
+
+        tool_name = getattr(tool, "name", None) or "unknown"
+
+        # Sub-agent delegation: ADK signals a handoff via a `transfer_to_agent` tool call.
+        if tool_name == _TRANSFER_TOOL:
+            target = (args or {}).get("agent_name")
+            if target:
+                try:
+                    register_subagent(c, harness=HARNESS, sub_agent_type=target, project_url=project_url)
+                except Exception as err:  # noqa: BLE001
+                    c.logger.warn("subagent.register.failed", {"target": target, "message": str(err)})
+
+        result = gate(c, harness=HARNESS, tool_name=tool_name, tool_args=args, can_block=can_block)
+        if result.blocked:
+            return {"error": result.denial_message or "Ory: permission denied"}
+        return None  # proceed (or let the next callback run)
+
+    return before_tool_callback
+
+
+def ory_after_tool_callback(*, client: OryAgentClient | None = None):
+    """Build an ADK ``after_tool_callback`` that records a ``tool.complete`` span."""
+    c = client or OryAgentClient.from_env(HARNESS)
+
+    def after_tool_callback(tool: Any, args: dict, tool_context: Any, tool_response: Any) -> dict | None:
+        complete(c, tool_name=getattr(tool, "name", "unknown"), output=tool_response)
+        return None  # keep the tool's response unchanged
+
+    return after_tool_callback
+
+
+__all__ = ["HARNESS", "ory_before_tool_callback", "ory_after_tool_callback"]

ory_adk-0.13.9/tests/test_callbacks.py

@@ -0,0 +1,72 @@
+"""Hermetic tests for the Google ADK before/after tool callbacks (mocked Ory).
+
+Covers the native veto shape (a denial dict returned from the before-callback, which ADK
+substitutes for the tool result) and request-shape extraction (``tool.name``), plus the
+after-callback ``tool.complete`` surface. The full permission decision matrix is core-owned
+(``ory-argus/tests/test_adapters.py``).
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+import pytest
+
+from ory_adk import callbacks as cb_mod  # type: ignore
+from ory_adk import ory_after_tool_callback, ory_before_tool_callback  # type: ignore
+from ory_argus.client import PrincipalIdentity
+from ory_argus.testing import (
+    create_mock_client,
+    get_trace_spans,
+    stub_permission_allowed,
+    stub_permission_denied,
+)
+
+
+@pytest.fixture(autouse=True)
+def _isolate(monkeypatch, tmp_path):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
+    monkeypatch.delenv("ORY_PERMISSION_MODE", raising=False)
+    # Avoid the session gate's network calls in unit tests.
+    monkeypatch.setattr(cb_mod, "session_start", lambda *a, **k: None)
+
+
+def client_with_user():
+    c = create_mock_client(harness="google-adk")
+    c.set_user_principal(PrincipalIdentity(subject="user:alice"))
+    return c
+
+
+def _tool(name="search"):
+    return SimpleNamespace(name=name, description="d")
+
+
+def test_allow_returns_none():
+    c = client_with_user()
+    stub_permission_allowed(c)
+    cb = ory_before_tool_callback(client=c)
+    # Returning None tells ADK to run the tool normally.
+    assert cb(_tool("search"), {"q": 1}, None) is None
+    invoke = get_trace_spans(c, "tool.invoke")[0]
+    assert invoke.attributes["allowed"] is True
+    # Tool name pulled from the ADK tool object's ``name``.
+    assert invoke.attributes["toolName"] == "search"
+
+
+def test_enforce_returns_denial_dict(monkeypatch):
+    monkeypatch.setenv("ORY_PERMISSION_MODE", "enforce")
+    c = client_with_user()
+    stub_permission_denied(c)
+    cb = ory_before_tool_callback(client=c)
+    out = cb(_tool("rm"), {}, None)
+    # Native veto shape: a non-None dict is substituted for the tool result by ADK,
+    # so the real tool never executes.
+    assert isinstance(out, dict) and "permission denied" in out["error"].lower()
+    assert get_trace_spans(c, "tool.block")[0].attributes["blocked"] is True
+
+
+def test_after_callback_records_complete():
+    c = client_with_user()
+    after = ory_after_tool_callback(client=c)
+    assert after(_tool("search"), {}, None, {"result": "ok"}) is None
+    assert get_trace_spans(c, "tool.complete")[0].attributes["toolName"] == "search"

ory_adk-0.13.9/tests/test_realsdk.py

@@ -0,0 +1,55 @@
+"""Real-SDK test: attach the Ory callbacks to a real ADK ``Agent`` and gate.
+
+Runs only when ``google.adk`` is importable; the default workspace venv skips it. Validates
+that the real ``Agent`` constructor accepts our ``before_tool_callback`` / ``after_tool_callback``
+(the registration shape) and that the callback denies a real ``BaseTool`` in enforce mode.
+The permission decision is stubbed (no backend).
+"""
+
+from __future__ import annotations
+
+import pytest
+
+pytest.importorskip("google.adk")
+
+from google.adk.agents import Agent  # noqa: E402
+
+from ory_adk import callbacks as cb_mod  # noqa: E402
+from ory_adk import ory_after_tool_callback, ory_before_tool_callback  # noqa: E402
+from ory_argus.adapters import GateResult  # noqa: E402
+from ory_argus.permissions import PermissionDecision  # noqa: E402
+from ory_argus.testing import create_mock_client  # noqa: E402
+
+
+def test_callbacks_attach_to_real_agent():
+    agent = Agent(
+        name="ory_e2e_assistant",
+        model="gemini-2.5-flash",
+        before_tool_callback=ory_before_tool_callback(client=create_mock_client(harness="google-adk")),
+        after_tool_callback=ory_after_tool_callback(client=create_mock_client(harness="google-adk")),
+    )
+    assert agent.before_tool_callback is not None
+    assert agent.after_tool_callback is not None
+
+
+def test_before_callback_denies_real_base_tool(monkeypatch):
+    monkeypatch.setattr(cb_mod, "session_start", lambda *a, **k: None)
+    monkeypatch.setattr(
+        cb_mod, "gate",
+        lambda client, **kw: GateResult(
+            proceed=False, blocked=True, decision=PermissionDecision(kind="deny"),
+            subject="User:t", namespace="AgentTools", denial_message="Ory: permission denied",
+        ),
+    )
+
+    # A real ADK FunctionTool wrapping a plain function.
+    from google.adk.tools import FunctionTool
+
+    def my_real_tool(query: str) -> str:
+        """A real tool."""
+        return query
+
+    tool = FunctionTool(func=my_real_tool)
+    cb = ory_before_tool_callback(client=create_mock_client(harness="google-adk"))
+    out = cb(tool, {"query": "x"}, None)
+    assert isinstance(out, dict) and "permission denied" in out["error"].lower()