Merge branch 'main' into feat/loop-agent-iteration-metadata

Author: rohityan

contributing/samples/context_management/session_state_agent/agent.py

@@ -168,8 +168,8 @@ async def after_agent_callback(callback_context: CallbackContext):
     name='root_agent',
     description='a verification agent.',
     instruction=(
-        'Log all users query with `log_query` tool. Must always remind user you'
-        ' cannot answer second query because your setup.'
+        'Reply to the user. Must always remind user you cannot answer a second'
+        ' query because your setup.'
     ),
     model='gemini-3.5-flash',
     before_agent_callback=before_agent_callback,

src/google/adk/artifacts/artifact_util.py

@@ -20,6 +20,8 @@
 
 from google.genai import types
 
+from ..errors import input_validation_error
+
 
 class ParsedArtifactUri(NamedTuple):
   """The result of parsing an artifact URI."""
@@ -113,3 +115,22 @@ def is_artifact_ref(artifact: types.Part) -> bool:
       and artifact.file_data.file_uri
       and artifact.file_data.file_uri.startswith("artifact://")
   )
+
+
+def validate_artifact_reference_scope(
+    *,
+    app_name: str,
+    user_id: str,
+    session_id: str | None,
+    parsed_uri: ParsedArtifactUri,
+) -> None:
+  """Ensures artifact references cannot escape the caller's scope."""
+  if parsed_uri.app_name != app_name or parsed_uri.user_id != user_id:
+    raise input_validation_error.InputValidationError(
+        "Artifact references must stay within the same app and user scope."
+    )
+  if parsed_uri.session_id is not None and parsed_uri.session_id != session_id:
+    raise input_validation_error.InputValidationError(
+        "Session-scoped artifact references must stay within the same"
+        " session scope."
+    )

src/google/adk/artifacts/file_artifact_service.py

@@ -25,6 +25,7 @@
 from typing import Union
 from urllib.parse import unquote
 from urllib.parse import urlparse
+from urllib.request import url2pathname
 
 from google.genai import types
 from pydantic import alias_generators
@@ -59,7 +60,10 @@ def _file_uri_to_path(uri: str) -> Optional[Path]:
   parsed = urlparse(uri)
   if parsed.scheme != "file":
     return None
-  return Path(unquote(parsed.path))
+  path_str = unquote(parsed.path)
+  if os.name == "nt":
+    path_str = url2pathname(path_str)
+  return Path(path_str)
 
 
 _USER_NAMESPACE_PREFIX = "user:"

src/google/adk/artifacts/gcs_artifact_service.py

@@ -252,10 +252,17 @@ def _save_artifact(
       if not file_uri:
         raise InputValidationError("Artifact file_data must have a file_uri.")
       if artifact_util.is_artifact_ref(artifact):
-        if not artifact_util.parse_artifact_uri(file_uri):
+        parsed_uri = artifact_util.parse_artifact_uri(file_uri)
+        if not parsed_uri:
           raise InputValidationError(
               f"Invalid artifact reference URI: {file_uri}"
           )
+        artifact_util.validate_artifact_reference_scope(
+            app_name=app_name,
+            user_id=user_id,
+            session_id=session_id,
+            parsed_uri=parsed_uri,
+        )
       # Store the URI and mime_type (if any) as blob metadata; no content to upload.
       metadata = {
           **(blob.metadata or {}),
@@ -315,6 +322,12 @@ def _load_artifact(
           raise InputValidationError(
               f"Invalid artifact reference URI: {file_uri}"
           )
+        artifact_util.validate_artifact_reference_scope(
+            app_name=app_name,
+            user_id=user_id,
+            session_id=session_id,
+            parsed_uri=parsed_uri,
+        )
         return self._load_artifact(
             app_name=parsed_uri.app_name,
             user_id=parsed_uri.user_id,

src/google/adk/artifacts/in_memory_artifact_service.py

@@ -128,10 +128,19 @@ async def save_artifact(
       artifact_version.mime_type = "text/plain"
     elif artifact.file_data is not None:
       if artifact_util.is_artifact_ref(artifact):
-        if not artifact_util.parse_artifact_uri(artifact.file_data.file_uri):
+        parsed_uri = artifact_util.parse_artifact_uri(
+            artifact.file_data.file_uri
+        )
+        if not parsed_uri:
           raise InputValidationError(
               f"Invalid artifact reference URI: {artifact.file_data.file_uri}"
           )
+        artifact_util.validate_artifact_reference_scope(
+            app_name=app_name,
+            user_id=user_id,
+            session_id=session_id,
+            parsed_uri=parsed_uri,
+        )
         # If it's a valid artifact URI, we store the artifact part as-is.
         # And we don't know the mime type until we load it.
       else:
@@ -180,6 +189,12 @@ async def load_artifact(
             "Invalid artifact reference URI:"
             f" {artifact_data.file_data.file_uri}"
         )
+      artifact_util.validate_artifact_reference_scope(
+          app_name=app_name,
+          user_id=user_id,
+          session_id=session_id,
+          parsed_uri=parsed_uri,
+      )
       return await self.load_artifact(
           app_name=parsed_uri.app_name,
           user_id=parsed_uri.user_id,

src/google/adk/cli/service_registry.py

@@ -72,6 +72,7 @@ def my_session_factory(uri: str, **kwargs):
 from typing import Protocol
 from urllib.parse import unquote
 from urllib.parse import urlparse
+from urllib.request import url2pathname
 
 from ..artifacts.base_artifact_service import BaseArtifactService
 from ..memory.base_memory_service import BaseMemoryService
@@ -310,7 +311,12 @@ def file_artifact_factory(uri: str, **_):
       )
     if not parsed_uri.path:
       raise ValueError("file:// artifact URIs must include a path component.")
-    artifact_path = Path(unquote(parsed_uri.path))
+
+    artifact_path_str = unquote(parsed_uri.path)
+    if os.name == "nt":
+      artifact_path_str = url2pathname(artifact_path_str)
+
+    artifact_path = Path(artifact_path_str)
     return FileArtifactService(root_dir=artifact_path)
 
   registry.register_artifact_service("memory", memory_artifact_factory)

src/google/adk/events/event.py

@@ -171,6 +171,7 @@ def _accept_convenience_kwargs(cls, data: Any) -> Any:
     if not isinstance(data, dict):
       return data
 
+    data = dict(data)
     field_names: set[str] = set(cls.model_fields.keys())
     for f in cls.model_fields.values():
       if f.alias:

src/google/adk/flows/llm_flows/functions.py

@@ -668,7 +668,7 @@ async def handle_function_calls_live(
     invocation_context: InvocationContext,
     function_call_event: Event,
     tools_dict: dict[str, BaseTool],
-) -> Event:
+) -> Event | None:
   """Calls the functions and returns the function response event."""
   from ...agents.llm_agent import LlmAgent
 

src/google/adk/integrations/agent_identity/_iam_connector_credentials_provider.py

@@ -238,7 +238,7 @@ async def get_auth_credential(
       logger.debug("Auth credential obtained immediately.")
       return _construct_auth_credential(response)
 
-    if metadata and metadata.consent_pending:
+    if metadata is not None and "consent_pending" in metadata:
       # Get 2-legged OAuth token. Allow enough time for token exchange.
       try:
         operation = await self._poll_credentials(

src/google/adk/integrations/bigquery/data_insights_tool.py

@@ -13,17 +13,13 @@
 # limitations under the License.
 from __future__ import annotations
 
-import json
 from typing import Any
 from typing import Dict
 from typing import List
 
 from google.adk.tools import _gda_stream_util
 from google.auth.credentials import Credentials
-from google.cloud import bigquery
-import requests
 
-from . import client
 from .config import BigQueryToolConfig
 
 _GDA_CLIENT_ID = "GOOGLE_ADK"
@@ -117,48 +113,39 @@ def ask_data_insights(
   """
   try:
     location = "global"
-    if not credentials.token:
-      error_message = (
-          "Error: The provided credentials object does not have a valid access"
-          " token.\n\nThis is often because the credentials need to be"
-          " refreshed or require specific API scopes. Please ensure the"
-          " credentials are prepared correctly before calling this"
-          " function.\n\nThere may be other underlying causes as well."
-      )
-      return {
-          "status": "ERROR",
-          "error_details": "ask_data_insights requires a valid access token.",
+    session, endpoint = _gda_stream_util.get_gda_session(credentials)
+    with session:
+      headers = {
+          "Content-Type": "application/json",
+          "X-Goog-API-Client": _GDA_CLIENT_ID,
       }
-    headers = {
-        "Authorization": f"Bearer {credentials.token}",
-        "Content-Type": "application/json",
-        "X-Goog-API-Client": _GDA_CLIENT_ID,
-    }
-    ca_url = f"https://geminidataanalytics.googleapis.com/v1beta/projects/{project_id}/locations/{location}:chat"
+      ca_url = (
+          f"{endpoint}/v1beta/projects/{project_id}/locations/{location}:chat"
+      )
 
-    instructions = """**INSTRUCTIONS - FOLLOW THESE RULES:**
+      instructions = """**INSTRUCTIONS - FOLLOW THESE RULES:**
     1.  **CONTENT:** Your answer should present the supporting data and then provide a conclusion based on that data, including relevant details and observations where possible.
     2.  **ANALYSIS DEPTH:** Your analysis must go beyond surface-level observations. Crucially, you must prioritize metrics that measure impact or outcomes over metrics that simply measure volume or raw counts. For open-ended questions, explore the topic from multiple perspectives to provide a holistic view.
     3.  **OUTPUT FORMAT:** Your entire response MUST be in plain text format ONLY.
     4.  **NO CHARTS:** You are STRICTLY FORBIDDEN from generating any charts, graphs, images, or any other form of visualization.
     """
 
-    ca_payload = {
-        "project": f"projects/{project_id}",
-        "messages": [{"userMessage": {"text": user_query_with_context}}],
-        "inlineContext": {
-            "datasourceReferences": {
-                "bq": {"tableReferences": table_references}
-            },
-            "systemInstruction": instructions,
-            "options": {"chart": {"image": {"noImage": {}}}},
-        },
-        "clientIdEnum": _GDA_CLIENT_ID,
-    }
+      ca_payload = {
+          "project": f"projects/{project_id}",
+          "messages": [{"userMessage": {"text": user_query_with_context}}],
+          "inlineContext": {
+              "datasourceReferences": {
+                  "bq": {"tableReferences": table_references}
+              },
+              "systemInstruction": instructions,
+              "options": {"chart": {"image": {"noImage": {}}}},
+          },
+          "clientIdEnum": _GDA_CLIENT_ID,
+      }
 
-    resp = _gda_stream_util.get_stream(
-        ca_url, ca_payload, headers, settings.max_query_result_rows
-    )
+      resp = _gda_stream_util.get_stream(
+          session, ca_url, ca_payload, headers, settings.max_query_result_rows
+      )
   except Exception as ex:  # pylint: disable=broad-except
     return {
         "status": "ERROR",