Merge branch 'main' into fix/gke-deploy-gcloud-windows

Author: rohityan

contributing/samples/context_management/session_state_agent/agent.py

@@ -168,8 +168,8 @@ async def after_agent_callback(callback_context: CallbackContext):
     name='root_agent',
     description='a verification agent.',
     instruction=(
-        'Log all users query with `log_query` tool. Must always remind user you'
-        ' cannot answer second query because your setup.'
+        'Reply to the user. Must always remind user you cannot answer a second'
+        ' query because your setup.'
     ),
     model='gemini-3.5-flash',
     before_agent_callback=before_agent_callback,

src/google/adk/artifacts/artifact_util.py

@@ -20,6 +20,8 @@
 
 from google.genai import types
 
+from ..errors import input_validation_error
+
 
 class ParsedArtifactUri(NamedTuple):
   """The result of parsing an artifact URI."""
@@ -113,3 +115,22 @@ def is_artifact_ref(artifact: types.Part) -> bool:
       and artifact.file_data.file_uri
       and artifact.file_data.file_uri.startswith("artifact://")
   )
+
+
+def validate_artifact_reference_scope(
+    *,
+    app_name: str,
+    user_id: str,
+    session_id: str | None,
+    parsed_uri: ParsedArtifactUri,
+) -> None:
+  """Ensures artifact references cannot escape the caller's scope."""
+  if parsed_uri.app_name != app_name or parsed_uri.user_id != user_id:
+    raise input_validation_error.InputValidationError(
+        "Artifact references must stay within the same app and user scope."
+    )
+  if parsed_uri.session_id is not None and parsed_uri.session_id != session_id:
+    raise input_validation_error.InputValidationError(
+        "Session-scoped artifact references must stay within the same"
+        " session scope."
+    )

src/google/adk/artifacts/file_artifact_service.py

@@ -25,6 +25,7 @@
 from typing import Union
 from urllib.parse import unquote
 from urllib.parse import urlparse
+from urllib.request import url2pathname
 
 from google.genai import types
 from pydantic import alias_generators
@@ -59,7 +60,10 @@ def _file_uri_to_path(uri: str) -> Optional[Path]:
   parsed = urlparse(uri)
   if parsed.scheme != "file":
     return None
-  return Path(unquote(parsed.path))
+  path_str = unquote(parsed.path)
+  if os.name == "nt":
+    path_str = url2pathname(path_str)
+  return Path(path_str)
 
 
 _USER_NAMESPACE_PREFIX = "user:"

src/google/adk/artifacts/gcs_artifact_service.py

@@ -252,10 +252,17 @@ def _save_artifact(
       if not file_uri:
         raise InputValidationError("Artifact file_data must have a file_uri.")
       if artifact_util.is_artifact_ref(artifact):
-        if not artifact_util.parse_artifact_uri(file_uri):
+        parsed_uri = artifact_util.parse_artifact_uri(file_uri)
+        if not parsed_uri:
           raise InputValidationError(
               f"Invalid artifact reference URI: {file_uri}"
           )
+        artifact_util.validate_artifact_reference_scope(
+            app_name=app_name,
+            user_id=user_id,
+            session_id=session_id,
+            parsed_uri=parsed_uri,
+        )
       # Store the URI and mime_type (if any) as blob metadata; no content to upload.
       metadata = {
           **(blob.metadata or {}),
@@ -315,6 +322,12 @@ def _load_artifact(
           raise InputValidationError(
               f"Invalid artifact reference URI: {file_uri}"
           )
+        artifact_util.validate_artifact_reference_scope(
+            app_name=app_name,
+            user_id=user_id,
+            session_id=session_id,
+            parsed_uri=parsed_uri,
+        )
         return self._load_artifact(
             app_name=parsed_uri.app_name,
             user_id=parsed_uri.user_id,

src/google/adk/artifacts/in_memory_artifact_service.py

@@ -128,10 +128,19 @@ async def save_artifact(
       artifact_version.mime_type = "text/plain"
     elif artifact.file_data is not None:
       if artifact_util.is_artifact_ref(artifact):
-        if not artifact_util.parse_artifact_uri(artifact.file_data.file_uri):
+        parsed_uri = artifact_util.parse_artifact_uri(
+            artifact.file_data.file_uri
+        )
+        if not parsed_uri:
           raise InputValidationError(
               f"Invalid artifact reference URI: {artifact.file_data.file_uri}"
           )
+        artifact_util.validate_artifact_reference_scope(
+            app_name=app_name,
+            user_id=user_id,
+            session_id=session_id,
+            parsed_uri=parsed_uri,
+        )
         # If it's a valid artifact URI, we store the artifact part as-is.
         # And we don't know the mime type until we load it.
       else:
@@ -180,6 +189,12 @@ async def load_artifact(
             "Invalid artifact reference URI:"
             f" {artifact_data.file_data.file_uri}"
         )
+      artifact_util.validate_artifact_reference_scope(
+          app_name=app_name,
+          user_id=user_id,
+          session_id=session_id,
+          parsed_uri=parsed_uri,
+      )
       return await self.load_artifact(
           app_name=parsed_uri.app_name,
           user_id=parsed_uri.user_id,

src/google/adk/cli/service_registry.py

@@ -72,6 +72,7 @@ def my_session_factory(uri: str, **kwargs):
 from typing import Protocol
 from urllib.parse import unquote
 from urllib.parse import urlparse
+from urllib.request import url2pathname
 
 from ..artifacts.base_artifact_service import BaseArtifactService
 from ..memory.base_memory_service import BaseMemoryService
@@ -310,7 +311,12 @@ def file_artifact_factory(uri: str, **_):
       )
     if not parsed_uri.path:
       raise ValueError("file:// artifact URIs must include a path component.")
-    artifact_path = Path(unquote(parsed_uri.path))
+
+    artifact_path_str = unquote(parsed_uri.path)
+    if os.name == "nt":
+      artifact_path_str = url2pathname(artifact_path_str)
+
+    artifact_path = Path(artifact_path_str)
     return FileArtifactService(root_dir=artifact_path)
 
   registry.register_artifact_service("memory", memory_artifact_factory)

src/google/adk/events/event.py

@@ -171,6 +171,7 @@ def _accept_convenience_kwargs(cls, data: Any) -> Any:
     if not isinstance(data, dict):
       return data
 
+    data = dict(data)
     field_names: set[str] = set(cls.model_fields.keys())
     for f in cls.model_fields.values():
       if f.alias:

src/google/adk/telemetry/_instrumentation.py

@@ -125,7 +125,6 @@ def record_llm_response(
 def _record_agent_metrics(
     agent_name: str,
     elapsed_s: float,
-    events: object,
     caught_error: Exception | None,
 ) -> None:
   try:
@@ -134,7 +133,6 @@ def _record_agent_metrics(
         elapsed_s,
         caught_error,
     )
-    _metrics.record_agent_workflow_steps(agent_name, events)
   except Exception:  # pylint: disable=broad-exception-caught
     logger.exception("Failed to record agent metrics for agent %s", agent_name)
 
@@ -196,7 +194,6 @@ async def record_agent_invocation(
     _record_agent_metrics(
         agent.name,
         _metrics.get_elapsed_s(span, start_time),
-        getattr(getattr(ctx, "session", None), "events", []),
         caught_error,
     )
     _flush_invoke_agent_metrics(tel_ctx, agent.name)

src/google/adk/telemetry/_metrics.py

@@ -27,7 +27,6 @@
 from opentelemetry.semconv.attributes import error_attributes
 
 if TYPE_CHECKING:
-  from google.adk.events.event import Event
   from google.adk.models.llm_request import LlmRequest
   from google.adk.models.llm_response import LlmResponse
   from opentelemetry.trace import Span
@@ -91,24 +90,6 @@
         81.92,
     ],
 )
-_agent_workflow_steps = meter.create_histogram(
-    "gen_ai.agent.workflow.steps",
-    unit="1",
-    description="Length of agentic workflow (# of events).",
-    explicit_bucket_boundaries_advisory=[
-        1,
-        2,
-        4,
-        8,
-        16,
-        32,
-        64,
-        128,
-        256,
-        512,
-        1024,
-    ],
-)
 _client_operation_duration = (
     gen_ai_metrics.create_gen_ai_client_operation_duration(meter)
 )
@@ -198,13 +179,6 @@ def record_invoke_agent_tool_calls(agent_name: str, count: int) -> None:
   _invoke_agent_tool_calls.record(count, attributes=attrs)
 
 
-def record_agent_workflow_steps(agent_name: str, events: list[Event]):
-  """Records the number of steps in the agent workflow by counting the number of events."""
-  attrs = {gen_ai_attributes.GEN_AI_AGENT_NAME: agent_name}
-  count = sum(1 for event in events if event.author == agent_name)
-  _agent_workflow_steps.record(count, attributes=attrs)
-
-
 def record_tool_execution_duration(
     tool_name: str,
     tool_type: str,

src/google/adk/telemetry/node_tracing.py

@@ -186,10 +186,6 @@ def _use_invoke_workflow_span(
   # The flag rides along the otel_context propagated to child nodes, so nested
   # workflows see it set.
   nested = bool(context_api.get_value(_ENTRYPOINT_WORKFLOW_KEY, otel_context))
-  if not nested:
-    otel_context = context_api.set_value(
-        _ENTRYPOINT_WORKFLOW_KEY, True, otel_context
-    )
   attributes: dict[str, AttributeValue] = {
       GEN_AI_OPERATION_NAME: "invoke_workflow",
       GEN_AI_CONVERSATION_ID: conversation_id,
@@ -207,11 +203,14 @@ def _use_invoke_workflow_span(
   start_s = time.monotonic()
   workflow_span: Span | None = None
   try:
-    with tracer.start_as_current_span(
-        name=span_name,
-        attributes=attributes,
-        context=otel_context,
-    ) as span:
+    with (
+        tracer.start_as_current_span(
+            name=span_name,
+            attributes=attributes,
+            context=otel_context,
+        ) as span,
+        _mark_nested_workflows(),
+    ):
       workflow_span = span
       yield span
   finally:
@@ -221,3 +220,14 @@ def _use_invoke_workflow_span(
         nested=nested,
         error=sys.exc_info()[1],
     )
+
+
+@contextmanager
+def _mark_nested_workflows() -> Iterator[None]:
+  token = context_api.attach(
+      context_api.set_value(_ENTRYPOINT_WORKFLOW_KEY, True)
+  )
+  try:
+    yield
+  finally:
+    context_api.detach(token)