Merge branch 'main' into fix-thought-signature-pruning

Author: rohityan

contributing/samples/adk_team/adk_pr_triaging_agent/agent.py

@@ -236,7 +236,7 @@ def list_untriaged_pull_requests(pr_count: int) -> dict[str, Any]:
   query = f"repo:{OWNER}/{REPO} is:open is:pr"
   params = {
       "q": query,
-      "sort": "created",
+      "sort": "updated",
       "order": "desc",
       "per_page": 100,
       "page": 1,

src/google/adk/cli/cli_tools_click.py

@@ -2000,7 +2000,6 @@ def cli_api_server(
     "cloud_run",
     context_settings={
         "allow_extra_args": True,
-        "allow_interspersed_args": False,
     },
 )
 @click.option(
@@ -2177,34 +2176,7 @@ def cli_deploy_cloud_run(
 
   _warn_if_with_ui(with_ui)
 
-  # Parse arguments to separate gcloud args (after --) from regular args
-  gcloud_args = []
-  if "--" in ctx.args:
-    separator_index = ctx.args.index("--")
-    gcloud_args = ctx.args[separator_index + 1 :]
-    regular_args = ctx.args[:separator_index]
-
-    # If there are regular args before --, that's an error
-    if regular_args:
-      click.secho(
-          "Error: Unexpected arguments after agent path and before '--':"
-          f" {' '.join(regular_args)}. \nOnly arguments after '--' are passed"
-          " to gcloud.",
-          fg="red",
-          err=True,
-      )
-      ctx.exit(2)
-  else:
-    # No -- separator, treat all args as an error to enforce the new behavior
-    if ctx.args:
-      click.secho(
-          f"Error: Unexpected arguments: {' '.join(ctx.args)}. \nUse '--' to"
-          " separate gcloud arguments, e.g.: adk deploy cloud_run [options]"
-          " agent_path -- --min-instances=2",
-          fg="red",
-          err=True,
-      )
-      ctx.exit(2)
+  gcloud_args = ctx.args
 
   try:
     from . import cli_deploy

src/google/adk/integrations/parameter_manager/parameter_client.py

@@ -26,9 +26,17 @@
 from google.oauth2 import service_account
 
 from ... import version
+from ...utils import mtls_utils
 
 USER_AGENT = f"google-adk/{version.__version__}"
 
+_DEFAULT_REGIONAL_ENDPOINT_TEMPLATE = (
+    "parametermanager.{location}.rep.googleapis.com"
+)
+_DEFAULT_MTLS_REGIONAL_ENDPOINT_TEMPLATE = (
+    "parametermanager.{location}.rep.mtls.googleapis.com"
+)
+
 
 class ParameterManagerClient:
   """A client for interacting with Google Cloud Parameter Manager.
@@ -113,7 +121,11 @@ def __init__(
     client_options = None
     if location:
       client_options = {
-          "api_endpoint": f"parametermanager.{location}.rep.googleapis.com"
+          "api_endpoint": mtls_utils.get_api_endpoint(
+              location,
+              _DEFAULT_REGIONAL_ENDPOINT_TEMPLATE,
+              _DEFAULT_MTLS_REGIONAL_ENDPOINT_TEMPLATE,
+          )
       }
 
     self._client = parametermanager_v1.ParameterManagerClient(

src/google/adk/models/interactions_utils.py

@@ -1166,6 +1166,53 @@ def _get_latest_user_contents(
   return latest_user_contents
 
 
+async def _create_interactions(
+    api_client: Client,
+    *,
+    create_kwargs: dict[str, Any],
+    stream: bool,
+) -> AsyncGenerator[LlmResponse, None]:
+  """Issue ``interactions.create`` and convert the response(s) to LlmResponses.
+
+  This is the shared transport + conversion loop. The caller assembles
+  ``create_kwargs`` (``model`` or ``agent``, ``input``, ``tools``, etc.); this
+  helper owns issuing the call and mapping the stream to ``LlmResponse``s.
+
+  Args:
+    api_client: The Google GenAI client.
+    create_kwargs: Keyword arguments passed verbatim to
+      ``api_client.aio.interactions.create`` (excluding ``stream``).
+    stream: Whether to stream the response.
+
+  Yields:
+    LlmResponse objects converted from interaction responses.
+  """
+  current_interaction_id: str | None = None
+
+  if stream:
+    responses = await api_client.aio.interactions.create(
+        **create_kwargs, stream=True
+    )
+    aggregated_parts: list[types.Part] = []
+    async for event in responses:
+      logger.debug(build_interactions_event_log(event))
+      interaction_id = _extract_stream_interaction_id(event)
+      if interaction_id:
+        current_interaction_id = interaction_id
+      llm_response = convert_interaction_event_to_llm_response(
+          event, aggregated_parts, current_interaction_id
+      )
+      if llm_response:
+        yield llm_response
+  else:
+    interaction = await api_client.aio.interactions.create(
+        **create_kwargs, stream=False
+    )
+    logger.info('Interaction response received.')
+    logger.debug(build_interactions_response_log(interaction))
+    yield convert_interaction_to_llm_response(interaction)
+
+
 async def generate_content_via_interactions(
     api_client: Client,
     llm_request: LlmRequest,
@@ -1227,49 +1274,18 @@ async def generate_content_via_interactions(
       )
   )
 
-  # Track the current interaction ID from responses
-  current_interaction_id: str | None = None
-
-  if stream:
-    # Streaming mode
-    responses = await api_client.aio.interactions.create(
-        model=llm_request.model,
-        input=input_steps,
-        stream=True,
-        system_instruction=system_instruction,
-        tools=interaction_tools if interaction_tools else None,
-        generation_config=generation_config if generation_config else None,
-        previous_interaction_id=previous_interaction_id,
-    )
-
-    aggregated_parts: list[types.Part] = []
-    async for event in responses:
-      # Log the streaming event
-      logger.debug(build_interactions_event_log(event))
-
-      interaction_id = _extract_stream_interaction_id(event)
-      if interaction_id:
-        current_interaction_id = interaction_id
-      llm_response = convert_interaction_event_to_llm_response(
-          event, aggregated_parts, current_interaction_id
-      )
-      if llm_response:
-        yield llm_response
-
-  else:
-    # Non-streaming mode
-    interaction = await api_client.aio.interactions.create(
-        model=llm_request.model,
-        input=input_steps,
-        stream=False,
-        system_instruction=system_instruction,
-        tools=interaction_tools if interaction_tools else None,
-        generation_config=generation_config if generation_config else None,
-        previous_interaction_id=previous_interaction_id,
-    )
-
-    # Log the response
-    logger.info('Interaction response received from the model.')
-    logger.debug(build_interactions_response_log(interaction))
-
-    yield convert_interaction_to_llm_response(interaction)
+  # Assemble the create() kwargs for the model path and delegate the
+  # transport + conversion loop to the shared helper.
+  create_kwargs: dict[str, Any] = {
+      'model': llm_request.model,
+      'input': input_steps,
+      'system_instruction': system_instruction,
+      'tools': interaction_tools if interaction_tools else None,
+      'generation_config': generation_config if generation_config else None,
+      'previous_interaction_id': previous_interaction_id,
+  }
+
+  async for llm_response in _create_interactions(
+      api_client, create_kwargs=create_kwargs, stream=stream
+  ):
+    yield llm_response

src/google/adk/utils/mtls_utils.py

@@ -0,0 +1,68 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Utilities for mTLS regional endpoint resolution."""
+
+from __future__ import annotations
+
+import enum
+import os
+
+from google.auth.transport import mtls
+
+
+class MtlsEndpoint(enum.Enum):
+  """Enum for the mTLS endpoint setting."""
+
+  AUTO = "auto"
+  ALWAYS = "always"
+  NEVER = "never"
+
+
+def use_client_cert_effective() -> bool:
+  """Returns whether client certificate should be used for mTLS."""
+  try:
+    return mtls.should_use_client_cert()
+  except (ImportError, AttributeError):
+    return (
+        os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false").lower()
+        == "true"
+    )
+
+
+def get_api_endpoint(
+    location: str, default_template: str, mtls_template: str
+) -> str:
+  """Returns API endpoint based on mTLS configuration and cert availability.
+
+  Args:
+      location: The region location.
+      default_template: Template for default regional endpoint (e.g.
+        "secretmanager.{location}.rep.googleapis.com").
+      mtls_template: Template for mTLS regional endpoint (e.g.
+        "secretmanager.{location}.rep.mtls.googleapis.com").
+  """
+  use_mtls_endpoint_str = os.getenv(
+      "GOOGLE_API_USE_MTLS_ENDPOINT", MtlsEndpoint.AUTO.value
+  ).lower()
+  try:
+    use_mtls_endpoint = MtlsEndpoint(use_mtls_endpoint_str)
+  except ValueError:
+    use_mtls_endpoint = MtlsEndpoint.AUTO
+
+  if (use_mtls_endpoint == MtlsEndpoint.ALWAYS) or (
+      use_mtls_endpoint == MtlsEndpoint.AUTO and use_client_cert_effective()
+  ):
+    return mtls_template.format(location=location)
+  return default_template.format(location=location)