Merge remote-tracking branch 'origin/main' into fix-thought-signature-pruning

Author: its-amann

.github/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "2.3.0"
+  ".": "2.4.0"
 }

.github/release-please-config.json

@@ -57,5 +57,5 @@
       ]
     }
   },
-  "last-release-sha": "0cb4c814928f579bfbac9b9e1f95669e4304e089"
+  "last-release-sha": "44d747ed5eaf543b5b8d22e0088f8a7c7eeee846"
 }

CHANGELOG.md

@@ -15,6 +15,7 @@
 from __future__ import annotations
 
 import logging
+from typing import AsyncGenerator
 
 from google.genai import types
 
@@ -443,7 +444,7 @@ async def _run_compaction_for_sliding_window(
     session_service: BaseSessionService,
     *,
     skip_token_compaction: bool = False,
-):
+) -> AsyncGenerator[Event, None]:
   """Runs compaction for SlidingWindowCompactor.
 
   This method implements the sliding window compaction logic. It determines
@@ -521,30 +522,35 @@ async def _run_compaction_for_sliding_window(
   Args:
     app: The application instance.
     session: The session containing events to compact.
-    session_service: The session service for appending events.
+    session_service: The session service, used by the token-threshold fallback.
     skip_token_compaction: Whether to skip token-threshold compaction.
+
+  Yields:
+    The sliding-window compaction event, if one is produced. The caller (the
+    runner loop) is responsible for appending it to the session, so that
+    persistence of this event stays at the runtime's synchronization point.
   """
   events = session.events
   if not events:
-    return None
+    return
 
   config = app.events_compaction_config
   if config is None:
-    return None
+    return
 
   # Prefer token-threshold compaction if configured and triggered.
   if not skip_token_compaction and _has_token_threshold_config(config):
     token_compacted = await _run_compaction_for_token_threshold(
         app, session, session_service
     )
     if token_compacted:
-      return None
+      return
 
   if not _has_sliding_window_config(config):
-    return None
+    return
 
   if config.compaction_interval is None or config.overlap_size is None:
-    return None
+    return
 
   # Find the last compaction event and its range.
   last_compacted_end_timestamp = 0.0
@@ -573,7 +579,7 @@ async def _run_compaction_for_sliding_window(
   ]
 
   if len(new_invocation_ids) < config.compaction_interval:
-    return None  # Not enough new invocations to trigger compaction.
+    return  # Not enough new invocations to trigger compaction.
 
   # Determine the range of invocations to compact.
   # The end of the compaction range is the last of the new invocations.
@@ -613,20 +619,20 @@ async def _run_compaction_for_sliding_window(
       events_to_compact = _longest_self_contained_prefix(events_to_compact)
 
   if not events_to_compact:
-    return None
+    return
 
   if app.root_agent is None:
-    return None
+    return
   _ensure_compaction_summarizer(config=config, agent=app.root_agent)
   if config.summarizer is None:
-    return None
+    return
 
   compaction_event = await _summarize_events_with_trace(
       session=session,
       config=config,
       events_to_compact=events_to_compact,
       trigger='sliding_window',
   )
-  if compaction_event:
-    await session_service.append_event(session=session, event=compaction_event)
   logger.debug('Event compactor finished.')
+  if compaction_event:
+    yield compaction_event

src/google/adk/apps/compaction.py

@@ -134,32 +134,3 @@ def validate_artifact_reference_scope(
         "Session-scoped artifact references must stay within the same"
         " session scope."
     )
-
-
-def validate_path_segment(value: str, field_name: str) -> None:
-  """Rejects values that could alter the constructed path.
-
-  Args:
-    value: The caller-supplied identifier (e.g. user_id or session_id).
-    field_name: Human-readable name used in the error message.
-
-  Raises:
-    InputValidationError: If the value contains path separators, traversal
-      segments, or null bytes.
-  """
-  if not value:
-    raise input_validation_error.InputValidationError(
-        f"{field_name} must not be empty."
-    )
-  if "\x00" in value:
-    raise input_validation_error.InputValidationError(
-        f"{field_name} must not contain null bytes."
-    )
-  if "/" in value or "\\" in value:
-    raise input_validation_error.InputValidationError(
-        f"{field_name} {value!r} must not contain path separators."
-    )
-  if value in (".", "..") or ".." in value.split("/"):
-    raise input_validation_error.InputValidationError(
-        f"{field_name} {value!r} must not contain traversal segments."
-    )

src/google/adk/artifacts/artifact_util.py

@@ -34,7 +34,6 @@
 from pydantic import ValidationError
 from typing_extensions import override
 
-from . import artifact_util
 from ..errors.input_validation_error import InputValidationError
 from .base_artifact_service import ArtifactVersion
 from .base_artifact_service import BaseArtifactService
@@ -143,14 +142,39 @@ def _is_user_scoped(session_id: Optional[str], filename: str) -> bool:
   return session_id is None or _file_has_user_namespace(filename)
 
 
+def _validate_path_segment(value: str, field_name: str) -> None:
+  """Rejects values that could alter the constructed filesystem path.
+
+  Args:
+    value: The caller-supplied identifier (e.g. user_id or session_id).
+    field_name: Human-readable name used in the error message.
+
+  Raises:
+    InputValidationError: If the value contains path separators, traversal
+      segments, or null bytes.
+  """
+  if not value:
+    raise InputValidationError(f"{field_name} must not be empty.")
+  if "\x00" in value:
+    raise InputValidationError(f"{field_name} must not contain null bytes.")
+  if "/" in value or "\\" in value:
+    raise InputValidationError(
+        f"{field_name} {value!r} must not contain path separators."
+    )
+  if value in (".", "..") or ".." in value.split("/"):
+    raise InputValidationError(
+        f"{field_name} {value!r} must not contain traversal segments."
+    )
+
+
 def _user_artifacts_dir(base_root: Path) -> Path:
   """Returns the path that stores user-scoped artifacts."""
   return base_root / "artifacts"
 
 
 def _session_artifacts_dir(base_root: Path, session_id: str) -> Path:
   """Returns the path that stores session-scoped artifacts."""
-  artifact_util.validate_path_segment(session_id, "session_id")
+  _validate_path_segment(session_id, "session_id")
   return base_root / "sessions" / session_id / "artifacts"
 
 
@@ -232,7 +256,7 @@ def __init__(self, root_dir: Path | str):
 
   def _base_root(self, user_id: str, /) -> Path:
     """Returns the artifacts root directory for a user."""
-    artifact_util.validate_path_segment(user_id, "user_id")
+    _validate_path_segment(user_id, "user_id")
     return self.root_dir / "users" / user_id
 
   def _scope_root(
@@ -245,7 +269,7 @@ def _scope_root(
     base = self._base_root(user_id)
     if _is_user_scoped(session_id, filename):
       return _user_artifacts_dir(base)
-    if session_id is None:
+    if not session_id:
       raise InputValidationError(
           "Session ID must be provided for session-scoped artifacts."
       )
@@ -519,7 +543,7 @@ def _list_artifact_keys_sync(
 
     base_root = self._base_root(user_id)
 
-    if session_id is not None:
+    if session_id:
       session_root = _session_artifacts_dir(base_root, session_id)
       for artifact_dir in _iter_artifact_dirs(session_root):
         metadata = self._latest_metadata(artifact_dir)

src/google/adk/artifacts/file_artifact_service.py

@@ -167,16 +167,13 @@ def _get_blob_prefix(
       session_id: Optional[str] = None,
   ) -> str:
     """Constructs the blob name prefix in GCS for a given artifact."""
-    artifact_util.validate_path_segment(app_name, "app_name")
-    artifact_util.validate_path_segment(user_id, "user_id")
     if self._file_has_user_namespace(filename):
       return f"{app_name}/{user_id}/user/{filename}"
 
     if session_id is None:
       raise InputValidationError(
           "Session ID must be provided for session-scoped artifacts."
       )
-    artifact_util.validate_path_segment(session_id, "session_id")
     return f"{app_name}/{user_id}/{session_id}/{filename}"
 
   def _get_blob_name(
@@ -371,10 +368,6 @@ def _load_artifact(
   def _list_artifact_keys(
       self, app_name: str, user_id: str, session_id: Optional[str]
   ) -> list[str]:
-    artifact_util.validate_path_segment(app_name, "app_name")
-    artifact_util.validate_path_segment(user_id, "user_id")
-    if session_id is not None:
-      artifact_util.validate_path_segment(session_id, "session_id")
     filenames = set()
 
     if session_id:

src/google/adk/artifacts/gcs_artifact_service.py

@@ -85,16 +85,13 @@ def _artifact_path(
     Returns:
         The constructed artifact path.
     """
-    artifact_util.validate_path_segment(app_name, "app_name")
-    artifact_util.validate_path_segment(user_id, "user_id")
     if self._file_has_user_namespace(filename):
       return f"{app_name}/{user_id}/user/{filename}"
 
     if session_id is None:
       raise InputValidationError(
           "Session ID must be provided for session-scoped artifacts."
       )
-    artifact_util.validate_path_segment(session_id, "session_id")
     return f"{app_name}/{user_id}/{session_id}/{filename}"
 
   @override
@@ -218,10 +215,6 @@ async def load_artifact(
   async def list_artifact_keys(
       self, *, app_name: str, user_id: str, session_id: Optional[str] = None
   ) -> list[str]:
-    artifact_util.validate_path_segment(app_name, "app_name")
-    artifact_util.validate_path_segment(user_id, "user_id")
-    if session_id is not None:
-      artifact_util.validate_path_segment(session_id, "session_id")
     usernamespace_prefix = f"{app_name}/{user_id}/user/"
     session_prefix = (
         f"{app_name}/{user_id}/{session_id}/" if session_id else None

src/google/adk/artifacts/in_memory_artifact_service.py

@@ -23,13 +23,17 @@
 from typing import Optional
 from typing import Tuple
 
+from google.adk.utils import _mtls_utils
 import google.auth
 import google.auth.exceptions
 from google.auth.transport.requests import AuthorizedSession
 from google.auth.transport.requests import Request
 import requests
 
 _VERTEX_AI_ENDPOINT = "https://{location}-aiplatform.googleapis.com/v1beta1"
+_VERTEX_AI_MTLS_ENDPOINT = (
+    "https://{location}-aiplatform.mtls.googleapis.com/v1beta1"
+)
 
 
 def check_adc() -> bool:
@@ -75,7 +79,18 @@ def _call_vertex_express_api(
   """Calls a Vertex AI Express API."""
   credentials, _ = google.auth.default()
   session = AuthorizedSession(credentials)
-  url = f"{_VERTEX_AI_ENDPOINT.format(location=location)}/vertexExpress{action}"
+
+  if _mtls_utils.use_client_cert_effective():
+    session.configure_mtls_channel()
+    endpoint = _mtls_utils.get_api_endpoint(
+        location=location,
+        default_template=_VERTEX_AI_ENDPOINT,
+        mtls_template=_VERTEX_AI_MTLS_ENDPOINT,
+    )
+  else:
+    endpoint = _VERTEX_AI_ENDPOINT.format(location=location)
+
+  url = f"{endpoint}/vertexExpress{action}"
   headers = {
       "Content-Type": "application/json",
   }