Merge branch 'main' into fix/mcp-mtls-auth-header-case

Author: rohityan

pyproject.toml

@@ -154,6 +154,7 @@ optional-dependencies.extensions = [
   "llama-index-embeddings-google-genai>=0.3",
   "llama-index-readers-file>=0.4",
   "lxml>=5.3",
+  "openai>=2.20,<3",
   "pypika>=0.50",
   "toolbox-adk>=1,<2",
 ]
@@ -224,7 +225,7 @@ optional-dependencies.test = [
   "llama-index-readers-file>=0.4",
   "lxml>=5.3",
   "mcp>=1.24,<2",
-  "openai>=1.100.2",
+  "openai>=2.20,<3",
   "opentelemetry-exporter-gcp-logging>=1.9.0a0,<=1.12.0a0",
   "opentelemetry-exporter-gcp-monitoring>=1.9.0a0,<2",
   "opentelemetry-exporter-gcp-trace>=1.9,<2",

src/google/adk/agents/config_agent_utils.py

@@ -82,6 +82,31 @@ def _resolve_agent_class(agent_class: str) -> type[BaseAgent]:
   )
 
 
+_BLOCKED_YAML_KEYS = frozenset({"args"})
+_ENFORCE_YAML_KEY_DENYLIST = False
+
+
+def _set_enforce_yaml_key_denylist(value: bool) -> None:
+  global _ENFORCE_YAML_KEY_DENYLIST
+  _ENFORCE_YAML_KEY_DENYLIST = value
+
+
+def _check_config_for_blocked_keys(node: Any, filename: str) -> None:
+  """Recursively check if the configuration contains any blocked keys."""
+  if isinstance(node, dict):
+    for key, value in node.items():
+      if key in _BLOCKED_YAML_KEYS:
+        raise ValueError(
+            f"Blocked key {key!r} found in {filename!r}. "
+            f"The '{key}' field is not allowed in agent configurations "
+            "because it can execute arbitrary code."
+        )
+      _check_config_for_blocked_keys(value, filename)
+  elif isinstance(node, list):
+    for item in node:
+      _check_config_for_blocked_keys(item, filename)
+
+
 def _load_config_from_path(config_path: str) -> AgentConfig:
   """Load an agent's configuration from a YAML file.
 
@@ -102,6 +127,9 @@ def _load_config_from_path(config_path: str) -> AgentConfig:
   with open(config_path, "r", encoding="utf-8") as f:
     config_data = yaml.safe_load(f)
 
+  if _ENFORCE_YAML_KEY_DENYLIST:
+    _check_config_for_blocked_keys(config_data, config_path)
+
   return AgentConfig.model_validate(config_data)
 
 

src/google/adk/cli/fast_api.py

@@ -486,6 +486,12 @@ def get_fast_api_app(
     The configured FastAPI application instance.
   """
 
+  # Enable the YAML key denylist for config loads if the web UI is enabled.
+  if web:
+    from ..agents import config_agent_utils
+
+    config_agent_utils._set_enforce_yaml_key_denylist(True)
+
   # Detect single agent mode
   agents_path = Path(agents_dir).resolve()
   is_single_agent = is_single_agent_directory(agents_path)

src/google/adk/flows/llm_flows/contents.py

@@ -69,6 +69,12 @@ async def run_async(
           id_pairing_model_types.append(LiteLlm)
         except (ImportError, OSError):
           pass
+        try:
+          from ...labs.openai import OpenAIResponsesLlm
+
+          id_pairing_model_types.append(OpenAIResponsesLlm)
+        except (ImportError, OSError):
+          pass
         if isinstance(canonical_model, tuple(id_pairing_model_types)):
           preserve_function_call_ids = True
 

src/google/adk/flows/llm_flows/functions.py

@@ -23,6 +23,7 @@
 import contextvars
 import copy
 import inspect
+import json
 import logging
 import threading
 from typing import Any
@@ -1181,6 +1182,9 @@ def __build_response_event(
     tool_context: ToolContext,
     invocation_context: InvocationContext,
 ) -> Event:
+  # Capture the raw result for display purposes before any normalization.
+  display_result = function_result
+
   # Specs requires the result to be a dict.
   if not isinstance(function_result, dict):
     function_result = {'result': function_result}
@@ -1198,6 +1202,25 @@ def __build_response_event(
       function_response_parts,
   )
 
+  # When summarization is skipped, ensure a displayable text part is added so
+  # the tool's output is not lost in UIs that don't render function responses.
+  # Control-flow tools (e.g. exit_loop) set skip_summarization but return no
+  # meaningful output; their None result is normalized to {'result': None}, so
+  # skip those to avoid emitting a noisy "null" text part.
+  has_displayable_result = display_result is not None and display_result != {
+      'result': None
+  }
+  if (
+      tool_context.actions.skip_summarization
+      and 'error' not in function_result
+      and has_displayable_result
+  ):
+    if isinstance(display_result, str):
+      result_text = display_result
+    else:
+      result_text = json.dumps(display_result, ensure_ascii=False, default=str)
+    content.parts.append(types.Part.from_text(text=result_text))
+
   function_response_event = Event(
       invocation_id=invocation_context.invocation_id,
       author=invocation_context.agent.name,

src/google/adk/labs/openai/__init__.py

@@ -13,7 +13,11 @@
 # limitations under the License.
 
 from ._openai_llm import OpenAILlm
+from ._openai_responses_llm import AzureOpenAIResponsesLlm
+from ._openai_responses_llm import OpenAIResponsesLlm
 
 __all__ = [
+    'AzureOpenAIResponsesLlm',
     'OpenAILlm',
+    'OpenAIResponsesLlm',
 ]

src/google/adk/labs/openai/_openai_llm.py

@@ -46,6 +46,7 @@
 from ...models.base_llm import BaseLlm
 from ...models.llm_request import LlmRequest
 from ...models.llm_response import LlmResponse
+from ._openai_schema import enforce_strict_openai_schema
 
 logger = logging.getLogger("google_adk." + __name__)
 
@@ -180,29 +181,6 @@ def _content_to_openai_messages(
   return messages
 
 
-def _enforce_strict_openai_schema(schema: dict[str, Any]) -> None:
-  """Recursively transforms a JSON schema for OpenAI strict structured outputs."""
-  if not isinstance(schema, dict):
-    return
-  if "$ref" in schema:
-    for key in list(schema.keys()):
-      if key != "$ref":
-        del schema[key]
-    return
-  if schema.get("type") == "object" and "properties" in schema:
-    schema["additionalProperties"] = False
-    schema["required"] = sorted(schema["properties"].keys())
-  for defn in schema.get("$defs", {}).values():
-    _enforce_strict_openai_schema(defn)
-  for prop in schema.get("properties", {}).values():
-    _enforce_strict_openai_schema(prop)
-  for key in ("anyOf", "oneOf", "allOf"):
-    for item in schema.get(key, []):
-      _enforce_strict_openai_schema(item)
-  if "items" in schema and isinstance(schema["items"], dict):
-    _enforce_strict_openai_schema(schema["items"])
-
-
 def _update_type_string(value: Any):
   """Lowercases nested JSON schema type strings for OpenAI compatibility."""
   if isinstance(value, list):
@@ -406,7 +384,7 @@ async def generate_content_async(
           schema_name = str(schema_dict["title"])
 
       if schema_dict:
-        _enforce_strict_openai_schema(schema_dict)
+        enforce_strict_openai_schema(schema_dict)
         response_format = {
             "type": "json_schema",
             "json_schema": {