Merge branch 'main' into fix/harden-set-model-response-fallback

Author: vietnamesekid

contributing/samples/live_bidi_streaming_parallel_tools_agent/README.md

@@ -0,0 +1,38 @@
+# Simple Live (Bidi-Streaming) Agent with Parallel Tools
+This project provides a basic example of a live, [bidirectional streaming](https://google.github.io/adk-docs/streaming/) agent that demonstrates parallel tool execution.
+
+## Getting Started
+
+Follow these steps to get the agent up and running:
+
+1.  **Start the ADK Web Server**
+    Open your terminal, navigate to the root directory that contains the
+    `live_bidi_streaming_parallel_tools_agent` folder, and execute the following
+    command:
+    ```bash
+    adk web
+    ```
+
+2.  **Access the ADK Web UI**
+    Once the server is running, open your web browser and navigate to the URL 
+    provided in the terminal (it will typically be `http://localhost:8000`).
+
+3.  **Select the Agent**
+    In the top-left corner of the ADK Web UI, use the dropdown menu to select 
+    this agent (`live_bidi_streaming_parallel_tools_agent`).
+
+4.  **Start Streaming**
+    Click on the **Audio** icon located near the chat input 
+    box to begin the streaming session.
+
+5.  **Interact with the Agent**
+    You can now begin talking to the agent, and it will respond in real-time.
+    Try asking it to perform multiple actions at once, for example: "Turn on the
+    lights and the TV at the same time." The agent will be able to invoke both
+    `turn_on_lights` and `turn_on_tv` tools in parallel.
+
+## Usage Notes
+
+* You only need to click the **Audio** button once to initiate the
+ stream. The current version does not support stopping and restarting the stream
+  by clicking the button again during a session.

contributing/samples/live_bidi_streaming_parallel_tools_agent/__init__.py

@@ -0,0 +1,15 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from . import agent

contributing/samples/live_bidi_streaming_parallel_tools_agent/agent.py

@@ -0,0 +1,36 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+from google.adk.agents.llm_agent import Agent
+
+
+def turn_on_lights():
+  """Turn on the lights."""
+  print("turn_on_lights")
+  return {"status": "OK"}
+
+
+def turn_on_tv():
+  """Turn on the tv."""
+  print("turn_on_tv")
+  return {"status": "OK"}
+
+
+root_agent = Agent(
+    model="gemini-live-2.5-flash-native-audio",
+    name="Home_helper",
+    instruction="Be polite and answer all user's questions.",
+    tools=[turn_on_lights, turn_on_tv],
+)

src/google/adk/integrations/secret_manager/__init__.py

@@ -0,0 +1,19 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from .secret_client import SecretManagerClient
+
+__all__ = [
+    'SecretManagerClient',
+]

src/google/adk/integrations/secret_manager/secret_client.py

@@ -0,0 +1,121 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import annotations
+
+import json
+from typing import cast
+from typing import Optional
+
+import google.auth
+from google.auth import default as default_service_credential
+import google.auth.transport.requests
+from google.cloud import secretmanager
+from google.oauth2 import service_account
+
+
+class SecretManagerClient:
+  """A client for interacting with Google Cloud Secret Manager.
+
+  This class provides a simplified interface for retrieving secrets from
+  Secret Manager, handling authentication using either a service account
+  JSON keyfile (passed as a string) or a preexisting authorization token.
+
+  Attributes:
+      _credentials:  Google Cloud credentials object (ServiceAccountCredentials
+        or Credentials).
+      _client: Secret Manager client instance.
+  """
+
+  def __init__(
+      self,
+      service_account_json: Optional[str] = None,
+      auth_token: Optional[str] = None,
+  ):
+    """Initializes the SecretManagerClient.
+
+    Args:
+        service_account_json:  The content of a service account JSON keyfile (as
+          a string), not the file path.  Must be valid JSON.
+        auth_token: An existing Google Cloud authorization token.
+
+    Raises:
+        ValueError: If neither `service_account_json` nor `auth_token` is
+        provided,
+            or if both are provided.  Also raised if the service_account_json
+            is not valid JSON.
+        google.auth.exceptions.GoogleAuthError: If authentication fails.
+    """
+    if service_account_json:
+      try:
+        credentials = service_account.Credentials.from_service_account_info(
+            json.loads(service_account_json)
+        )
+      except json.JSONDecodeError as e:
+        raise ValueError(f"Invalid service account JSON: {e}") from e
+    elif auth_token:
+      credentials = google.auth.credentials.Credentials(
+          token=auth_token,
+          refresh_token=None,
+          token_uri=None,
+          client_id=None,
+          client_secret=None,
+      )
+      request = google.auth.transport.requests.Request()
+      credentials.refresh(request)
+    else:
+      try:
+        credentials, _ = default_service_credential(
+            scopes=["https://www.googleapis.com/auth/cloud-platform"]
+        )
+      except Exception as e:
+        raise ValueError(
+            "'service_account_json' or 'auth_token' are both missing, and"
+            f" error occurred while trying to use default credentials: {e}"
+        ) from e
+
+    if not credentials:
+      raise ValueError(
+          "Must provide either 'service_account_json' or 'auth_token', not both"
+          " or neither."
+      )
+
+    self._credentials = credentials
+    self._client = secretmanager.SecretManagerServiceClient(
+        credentials=self._credentials
+    )
+
+  def get_secret(self, resource_name: str) -> str:
+    """Retrieves a secret from Google Cloud Secret Manager.
+
+    Args:
+        resource_name: The full resource name of the secret, in the format
+          "projects/*/secrets/*/versions/*".  Usually you want the "latest"
+          version, e.g.,
+          "projects/my-project/secrets/my-secret/versions/latest".
+
+    Returns:
+        The secret payload as a string.
+
+    Raises:
+        google.api_core.exceptions.GoogleAPIError: If the Secret Manager API
+            returns an error (e.g., secret not found, permission denied).
+        Exception: For other unexpected errors.
+    """
+    try:
+      response = self._client.access_secret_version(name=resource_name)
+      return cast(str, response.payload.data.decode("UTF-8"))
+    except Exception as e:
+      raise e  # Re-raise the exception to allow for handling by the caller
+      # Consider logging the exception here before re-raising.

src/google/adk/models/gemini_llm_connection.py

@@ -20,6 +20,7 @@
 
 from google.genai import types
 
+from ..utils import model_name_utils
 from ..utils.content_utils import filter_audio_parts
 from ..utils.context_utils import Aclosing
 from ..utils.variant_utils import GoogleLLMVariant
@@ -99,7 +100,6 @@ async def send_content(self, content: types.Content):
     Args:
       content: The content to send to the model.
     """
-
     assert content.parts
     if content.parts[0].function_response:
       # All parts have to be function responses.
@@ -112,12 +112,30 @@ async def send_content(self, content: types.Content):
       )
     else:
       logger.debug('Sending LLM new content %s', content)
-      await self._gemini_session.send(
-          input=types.LiveClientContent(
-              turns=[content],
-              turn_complete=True,
-          )
+      is_gemini_31 = model_name_utils.is_gemini_3_1_flash_live(
+          self._model_version
       )
+      is_gemini_api = self._api_backend == GoogleLLMVariant.GEMINI_API
+
+      # As of now, Gemini 3.1 Flash Live is only available in Gemini API, not
+      # Vertex AI.
+      if (
+          is_gemini_31
+          and is_gemini_api
+          and len(content.parts) == 1
+          and content.parts[0].text
+      ):
+        logger.debug('Using send_realtime_input for Gemini 3.1 text input')
+        await self._gemini_session.send_realtime_input(
+            text=content.parts[0].text
+        )
+      else:
+        await self._gemini_session.send(
+            input=types.LiveClientContent(
+                turns=[content],
+                turn_complete=True,
+            )
+        )
 
   async def send_realtime(self, input: RealtimeInput):
     """Sends a chunk of audio or a frame of video to the model in realtime.
@@ -128,7 +146,26 @@ async def send_realtime(self, input: RealtimeInput):
     if isinstance(input, types.Blob):
       # The blob is binary and is very large. So let's not log it.
       logger.debug('Sending LLM Blob.')
-      await self._gemini_session.send_realtime_input(media=input)
+      is_gemini_31 = model_name_utils.is_gemini_3_1_flash_live(
+          self._model_version
+      )
+      is_gemini_api = self._api_backend == GoogleLLMVariant.GEMINI_API
+
+      # As of now, Gemini 3.1 Flash Live is only available in Gemini API, not
+      # Vertex AI.
+      if is_gemini_31 and is_gemini_api:
+        if input.mime_type and input.mime_type.startswith('audio/'):
+          await self._gemini_session.send_realtime_input(audio=input)
+        elif input.mime_type and input.mime_type.startswith('image/'):
+          await self._gemini_session.send_realtime_input(video=input)
+        else:
+          logger.warning(
+              'Blob not sent. Unknown or empty mime type for'
+              ' send_realtime_input: %s',
+              input.mime_type,
+          )
+      else:
+        await self._gemini_session.send_realtime_input(media=input)
 
     elif isinstance(input, types.ActivityStart):
       logger.debug('Sending LLM activity start signal.')
@@ -166,6 +203,7 @@ async def receive(self) -> AsyncGenerator[LlmResponse, None]:
     """
 
     text = ''
+    tool_call_parts = []
     async with Aclosing(self._gemini_session.receive()) as agen:
       # TODO(b/440101573): Reuse StreamingResponseAggregator to accumulate
       # partial content and emit responses as needed.
@@ -295,6 +333,13 @@ async def receive(self) -> AsyncGenerator[LlmResponse, None]:
             if text:
               yield self.__build_full_text_response(text)
               text = ''
+            if tool_call_parts:
+              logger.debug('Returning aggregated tool_call_parts')
+              yield LlmResponse(
+                  content=types.Content(role='model', parts=tool_call_parts),
+                  model_version=self._model_version,
+              )
+              tool_call_parts = []
             yield LlmResponse(
                 turn_complete=True,
                 interrupted=message.server_content.interrupted,
@@ -316,17 +361,14 @@ async def receive(self) -> AsyncGenerator[LlmResponse, None]:
                   model_version=self._model_version,
               )
         if message.tool_call:
+          logger.debug('Received tool call: %s', message.tool_call)
           if text:
             yield self.__build_full_text_response(text)
             text = ''
-          parts = [
+          tool_call_parts.extend([
               types.Part(function_call=function_call)
               for function_call in message.tool_call.function_calls
-          ]
-          yield LlmResponse(
-              content=types.Content(role='model', parts=parts),
-              model_version=self._model_version,
-          )
+          ])
         if message.session_resumption_update:
           logger.debug('Received session resumption message: %s', message)
           yield (
@@ -335,6 +377,12 @@ async def receive(self) -> AsyncGenerator[LlmResponse, None]:
                   model_version=self._model_version,
               )
           )
+      if tool_call_parts:
+        logger.debug('Exited loop with pending tool_call_parts')
+        yield LlmResponse(
+            content=types.Content(role='model', parts=tool_call_parts),
+            model_version=self._model_version,
+        )
 
   async def close(self):
     """Closes the llm server connection."""