Merge branch 'main' into feat/openapi-tool-httpx-client-factory

Author: xuanyang15

.agents/skills/adk-sample-creator/SKILL.md

@@ -27,6 +27,9 @@ Use snake_case for the folder name (e.g., `dynamic_nodes`, `fan_out_fan_in`).
 
 The `agent.py` should focus on demonstrating a specific feature or agent pattern. Use absolute imports for testing convenience.
 
+> [!IMPORTANT]
+> **Model Selection**: Do not set the `model` parameter explicitly (e.g., `model="gemini-2.5-flash"`) on `Agent` instances in sample agents. Instead, let them default to the system-configured model, unless a specific model is explicitly requested by the user.
+
 Choose one of the following patterns:
 
 #### Pattern A: Workflows (for complex graphs)
@@ -74,7 +77,6 @@ from google.adk.tools import google_search  # example
 ```python
 root_agent = Agent(
     name="standalone_assistant",
-    model="gemini-2.5-flash",
     instruction="You are a helpful assistant.",
     description="An assistant that can help with queries.",
     tools=[google_search],

.github/workflows/check-file-contents.yml

@@ -100,3 +100,37 @@ jobs:
           else
             echo "✅ No relevant Python files found."
           fi
+
+      - name: Check for hardcoded googleapis.com endpoints
+        run: |
+          git fetch origin ${GITHUB_BASE_REF}
+          CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' || true)
+          if [ -n "$CHANGED_FILES" ]; then
+            echo "Checking for hardcoded endpoints in: $CHANGED_FILES"
+
+            # 1. Identify files containing any googleapis.com URL.
+            set +e
+            FILES_WITH_ENDPOINTS=$(grep -lE 'https?://[a-zA-Z0-9.-]+\.googleapis\.com' $CHANGED_FILES)
+            
+            # 2. From those, identify files that are MISSING the required mTLS version.
+            if [ -n "$FILES_WITH_ENDPOINTS" ]; then
+              FILES_MISSING_MTLS=$(grep -L '.mtls.googleapis.com' $FILES_WITH_ENDPOINTS)
+            fi
+            set -e
+
+            if [ -n "$FILES_MISSING_MTLS" ]; then
+              echo "❌ Found hardcoded googleapis.com endpoints without mTLS support."
+              echo "The following files must define both standard and mTLS (.mtls.googleapis.com) endpoints"
+              echo "to support dynamic endpoint selection as required by security policy:"
+              echo "$FILES_MISSING_MTLS"
+              echo ""
+              echo "To fix this, please follow these steps:"
+              echo "1. Initialize an AuthorizedSession with your credentials."
+              echo "2. Use 'mtls.has_default_client_cert_source() from google-auth' to check for available client certificates."
+              echo "3. If certificates are present, use 'session.configure_mtls_channel()'."
+              echo "4. Dynamically select the '.mtls.' variant of the endpoint when mTLS is active."
+              exit 1
+            else
+              echo "✅ All hardcoded endpoints have corresponding mTLS definitions or no endpoints found."
+            fi
+          fi

.github/workflows/copybara-pr-handler.yml

@@ -58,14 +58,19 @@ jobs:
                 console.log(`Committer: ${committer}`);
 
                 // Check if this is a Copybara commit
-                if (committer !== 'Copybara-Service') {
+                const isCopybara = committer === 'Copybara-Service' ||
+                                   commit.author?.email === 'genai-sdk-bot@google.com' ||
+                                   message.includes('GitOrigin-RevId:') ||
+                                   message.includes('PiperOrigin-RevId:');
+
+                if (!isCopybara) {
                   console.log('Not a Copybara commit, skipping');
                   continue;
                 }
 
                 // Extract PR number from commit message
-                // Pattern: "Merge https://github.com/google/adk-python/pull/3333"
-                const prMatch = message.match(/Merge https:\/\/github\.com\/google\/adk-python\/pull\/(\d+)/);
+                // Pattern matches both "Merge https://..." and "Merge: https://..."
+                const prMatch = message.match(/Merge:?\s+https:\/\/github\.com\/google\/adk-python\/pull\/(\d+)/);
 
                 if (!prMatch) {
                   console.log('No PR number found in Copybara commit message');

.github/workflows/issue-monitor.yml

@@ -58,6 +58,6 @@ jobs:
           REPO: ${{ github.event.repository.name }}
           CONCURRENCY_LIMIT: 3
           INITIAL_FULL_SCAN: ${{ github.event.inputs.full_scan == 'true' }}
-          LLM_MODEL_NAME: "gemini-2.5-flash"
+          LLM_MODEL_NAME: "gemini-3.5-flash"
           PYTHONPATH: contributing/samples/adk_team
         run: python -m adk_issue_monitoring_agent.main

.github/workflows/pre-commit.yml

@@ -16,13 +16,13 @@ name: Pre-commit Checks
 
 on:
   push:
-    branches: [main, v2]
+    branches: [main, v1, v2]
     paths:
       - '**.py'
       - '.pre-commit-config.yaml'
       - 'pyproject.toml'
   pull_request:
-    branches: [main, v2]
+    branches: [main, v1, v2]
     paths:
       - '**.py'
       - '.pre-commit-config.yaml'

.github/workflows/python-unit-tests.yml

@@ -2,16 +2,17 @@ name: Python Unit Tests
 
 on:
   push:
-    branches: [ main ]
+    branches: [main, v1, v2]
   pull_request:
-    branches: [ main, v2 ]
+    branches: [main, v1, v2]
 
 permissions:
   contents: read
 
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     strategy:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]

.github/workflows/stale-bot.yml

@@ -38,7 +38,7 @@ jobs:
           OWNER: ${{ github.repository_owner }}
           REPO: adk-python
           CONCURRENCY_LIMIT: 3
-          LLM_MODEL_NAME: "gemini-2.5-flash"
+          LLM_MODEL_NAME: "gemini-3.5-flash"
           PYTHONPATH: contributing/samples/adk_team
 
         run: python -m adk_stale_agent.main

.gitignore

@@ -104,6 +104,7 @@ Thumbs.db
 .adk/
 .claude/
 .jetski*
+.antigravity*
 CLAUDE.md
 .cursor/
 .cursorrules

README.md

@@ -93,7 +93,7 @@ root_agent = Workflow(
 # Interactive CLI
 adk run path/to/my_agent
 
-# Web UI
+# Web UI (supports multi-agent directories or pointing directly to a single agent folder)
 adk web path/to/agents_dir
 ```
 

contributing/adk_project_overview_and_architecture.md

@@ -83,7 +83,7 @@ async def health_check():
 
 By default, the ADK API server expects an explicit application context in all requests (e.g., via the `/apps/{app_name}/...` path or in the payload body).
 
-However, if the environment variable `ADK_DEFAULT_APP_NAME` is set, the server will automatically resolve and fall back to the default application whenever a request lacks an explicit app name:
+However, if the environment variable `ADK_DEFAULT_APP_NAME` is set, or if the server is running in **single agent mode** (when pointing directly to a directory containing an agent instead of a directory of agents), the server will automatically resolve and fall back to that agent as the default application whenever a request lacks an explicit app name. In single agent mode, the local agent takes precedence over the `ADK_DEFAULT_APP_NAME` environment variable.
 
 - **URL Path-Rewriting (Production Endpoints)**: Requests to production endpoints that omit the `/apps/{app_name}` prefix (such as `/users/{user_id}/sessions` or `/app-info`) are automatically rewritten by an internal ASGI middleware to target the default application. (Note: `/dev` and `/builder` endpoints are excluded from rewriting).
 - **Agent Execution & Streaming**: Requests to `/run`, `/run_sse`, or `/run_live` that omit the `app_name` parameter in their payload body or query string will automatically resolve to the default application.