uPj@ UdZddlZddlmZddlmZmZmZmZm Z m Z ddl m Z ddl mZmZddlmZddlmZdd lmZmZed g Zeed <d edefdZded eddfdZdededefdZdZej?deege eefdede d efdZ ejCdeege eefdede d efdZ"ejCdeege eefdede#de d efdZ$ejKdeege eefdede#de d efdZ&ejCdeege eefdede#de d efdZ'y) aD Google AI Studio Managed Agents API Proxy Endpoints. Exposes Gemini's /v1beta/agents surface through the LiteLLM proxy so that user curl commands transfer 1-to-1 by swapping the host + auth header. Routes: POST /v1beta/agents -> acreate_agent GET /v1beta/agents -> alist_agents GET /v1beta/agents/{name} -> aget_agent DELETE /v1beta/agents/{name} -> adelete_agent GET /v1beta/agents/{name}/versions -> alist_agent_versions These are distinct from the A2A agent registry at /v1/agents. N)Final) APIRouterDepends HTTPExceptionRequestResponsestatus)ORJSONResponse)LitellmUserRolesUserAPIKeyAuth)user_api_key_auth)ProxyBaseLLMRequestProcessing)_read_request_body_safe_get_request_query_paramszgemini managed agents)tagsrouteruser_api_key_dictreturnc|jtjk(xs'|jtjjk(S)N) user_roler PROXY_ADMINvalue)rs t/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/google_endpoints/agents_endpoints.py_is_proxy_adminr"s=##'7'C'CC M  & &*:*F*F*L*L Ldatactt|ry|jdryttjd)u SECURITY: refuse to use the proxy's shared GOOGLE_API_KEY / GEMINI_API_KEY env fallback for non-admin callers on Gemini managed-agent CRUD endpoints. These endpoints are part of ``llm_api_routes`` so any authenticated LLM key can reach them, but unlike ``/v1beta/models/...:generateContent`` they are *not* routed through ``model_list`` — the only credential source is either the per-request ``litellm_params_template`` or the env var fallback. Without this guard, any ordinary proxy user could list, create, or delete managed agents inside the operator's Gemini project using the operator's key. Proxy admins (master key) keep the env-fallback convenience for ops use. Napi_keyzGemini managed-agent endpoints require a caller-supplied Gemini api_key (via 'litellm_params_template'). Falling back to the proxy's GOOGLE_API_KEY / GEMINI_API_KEY env vars is only permitted for proxy admins.) status_codedetail)rgetrr HTTP_401_UNAUTHORIZED)rrs r%_enforce_caller_supplied_provider_keyr#)s:"() xx  00 * rrequestcPt|}|s|S|jd}|rb t|trt j |n|}t|tr*|jD]\}}|j|||S#tj tf$ri}YYwxYw)a For GET/DELETE endpoints that cannot carry a JSON body, read a JSON-encoded ``litellm_params_template`` query parameter and merge its contents into *data*, without overwriting keys that are already present (e.g. path params like ``name`` or the fixed ``custom_llm_provider``). This mirrors the ``litellm_params_template`` handling in ``create_gemini_agent`` and is the supported way for multi-tenant callers to supply per-request credentials on non-POST endpoints: .. code-block:: bash curl "http://localhost:4000/v1beta/agents?litellm_params_template=%7B%22api_key%22%3A%22AIza...%22%7D" \ -H "Authorization: Bearer sk-..." Credentials MUST NOT be passed as plain flat query parameters (e.g. ``?api_key=AIza...``) because URL query strings appear verbatim in web-server access logs, CDN edge logs, browser history, and Referer headers. Use the ``litellm_params_template`` JSON body field on POST requests, or the JSON-encoded query parameter above for GET/DELETE. litellm_params_template) rr! isinstancestrjsonloadsJSONDecodeError ValueErrordictitems setdefault)rr$ query_params raw_templatetemplatekeyrs r_merge_query_params_into_datar4Is,9AL  &**+DEL 3=lC3Ptzz,/VbH h %&nn. , UU+ , K $$j1 H s'BB%$B%c bddlm}m}m}m}m}m}m}m}m }m } m } t|||||||||| |  S)Nr general_settings llm_router proxy_configproxy_logging_objselect_data_generator user_api_baseuser_max_tokens user_modeluser_request_timeoutuser_temperatureversion) litellm.proxy.proxy_serverr7r8r9r:r;r<r=r>r?r@rAr-r6s r_proxy_server_importsrCpsF     )!+3#'1)  rz/v1beta/agents) dependenciesresponse_classfastapi_responsec2Kt}t|d{}|jddxsi}t|tr"|j D]\}}||vs |||<|j ddt||t|} |j|||d|d|d |d |d |d d|d |d|d|d|d|dd{S77#t$r)} |j| ||d|dd{7d} ~ wwxYww)a Create a named custom agent on the Gemini side. Example: ```bash curl -X POST "http://localhost:4000/v1beta/agents" \ -H "Authorization: Bearer sk-..." \ -H "Content-Type: application/json" \ -d '{ "name": "my-custom-slides-agent", "base_agent": "waverunner", "instructions": "You are a helpful assistant that creates slides.", "base_environment": { "type": "remote", "sources": [ {"type": "gcs", "source": "gs://eap-templates/slides-skill", "target": "/.agents/skills/slides-skill"} ] } }' ``` )r$Nr&custom_llm_providergeminir acreate_agentr:r8r7r9r;r>r@r?r=r<rAr$rFr route_typer:r8r7r9r;modelr>r@r?r=r<rAerr:rA) rCrpopr'r-r.r/r#rbase_process_llm_request Exception_handle_llm_api_exception) r$rFrsrvrr&r3r processorrPs rcreate_gemini_agentrWsu@'(C*7;;D%)XX.G%N%TRT)401779 "JC$!S  " OO)84)$0AB4$?I 77-/&!"56<( !34^,"%&="><( !34!$%;!< 12o. N!8   < $  77/!"56 N 8     sYDCAD"1DAC"C C"D C"" D+D D  DDDcrKt}ddi}t||t||t|} |j |||d|d|d|d|d|d d |d |d |d |d|d|dd {S7#t $r)}|j |||d|dd {7d }~wwxYww)u List all custom agents on the Gemini side. Pass per-request Gemini credentials via the JSON-encoded ``litellm_params_template`` query parameter. Flat query parameters (e.g. ``?api_key=AIza...``) are intentionally ignored — see ``_merge_query_params_into_data`` for the rationale. ```bash curl "http://localhost:4000/v1beta/agents?litellm_params_template=%7B%22api_key%22%3A%22AIza...%22%7D" \ -H "Authorization: Bearer sk-..." ``` rHrIrJ alist_agentsr:r8r7r9r;Nr>r@r?r=r<rArLrOrCr4r#rrRrSrT)r$rFrrUrrVrPs rlist_gemini_agentsr[s.'(C.9D!$0)$0AB4$?I 77-/%!"56<( !34^,"%&="><( !34!$%;!< 12o. N!8    $  77/!"56 N 8     sG3B7AB;B<B?B7B B4 B/)B,*B//B44B7z/v1beta/agents/{name}namectKt}|dd}t||t||t|} |j |||d|d|d|d|d|d d |d |d |d |d|d|dd {S7#t $r)}|j |||d|dd {7d }~wwxYww)u Get a specific custom agent by name. Pass per-request Gemini credentials via the JSON-encoded ``litellm_params_template`` query parameter. Flat query parameters (e.g. ``?api_key=AIza...``) are intentionally ignored — see ``_merge_query_params_into_data`` for the rationale. ```bash curl "http://localhost:4000/v1beta/agents/my-custom-slides-agent?litellm_params_template=%7B%22api_key%22%3A%22AIza...%22%7D" \ -H "Authorization: Bearer sk-..." ``` rIr\rHrJ aget_agentr:r8r7r9r;Nr>r@r?r=r<rArLrOrZr$r\rFrrUrrVrPs rget_gemini_agentras0'(CAD!$0)$0AB4$?I 77-/#!"56<( !34^,"%&="><( !34!$%;!< 12o. N!8    $  77/!"56 N 8     G4B8AB<B=BB8B B5 B0*B-+B00B55B8ctKt}|dd}t||t||t|} |j |||d|d|d|d|d|d d |d |d |d |d|d|dd {S7#t $r)}|j |||d|dd {7d }~wwxYww)u Delete a custom agent by name. Pass per-request Gemini credentials via the JSON-encoded ``litellm_params_template`` query parameter. Flat query parameters (e.g. ``?api_key=AIza...``) are intentionally ignored — see ``_merge_query_params_into_data`` for the rationale. ```bash curl -X DELETE "http://localhost:4000/v1beta/agents/my-custom-slides-agent?litellm_params_template=%7B%22api_key%22%3A%22AIza...%22%7D" \ -H "Authorization: Bearer sk-..." ``` rIr^rJ adelete_agentr:r8r7r9r;Nr>r@r?r=r<rArLrOrZr`s rdelete_gemini_agentreIs0'(CAD!$0)$0AB4$?I 77-/&!"56<( !34^,"%&="><( !34!$%;!< 12o. N!8    $  77/!"56 N 8     rbz/v1beta/agents/{name}/versionsctKt}|dd}t||t||t|} |j |||d|d|d|d|d|d d |d |d |d |d|d|dd {S7#t $r)}|j |||d|dd {7d }~wwxYww)u List versions of a custom agent. Pass per-request Gemini credentials via the JSON-encoded ``litellm_params_template`` query parameter. Flat query parameters (e.g. ``?api_key=AIza...``) are intentionally ignored — see ``_merge_query_params_into_data`` for the rationale. ```bash curl "http://localhost:4000/v1beta/agents/my-custom-slides-agent/versions?litellm_params_template=%7B%22api_key%22%3A%22AIza...%22%7D" \ -H "Authorization: Bearer sk-..." ``` rIr^rJalist_agent_versionsr:r8r7r9r;Nr>r@r?r=r<rArLrOrZr`s rlist_gemini_agent_versionsrhs0'(CAD!$0)$0AB4$?I 77-/-!"56<( !34^,"%&="><( !34!$%;!< 12o. N!8    $  77/!"56 N 8     rb)(__doc__r)typingrfastapirrrrrr fastapi.responsesr litellm.proxy._typesr r $litellm.proxy.auth.user_api_key_authr 'litellm.proxy.common_request_processingr-litellm.proxy.common_utils.http_parsing_utilsrrr__annotations__boolrr-r#r4rCpostrWr!r[r(radeletererhrrrvsu  PP,ABQ  7899~$ % @$$w$4$N<+,-! )00A(B@ @ @ &@  @ F+,-! )00A(B1 1 1 &1  1 h+,-! )00A(B 2 2 2 2 & 2  2 j+,-!)00A(B 2 2 2 2 & 2  2 j$+,-! )00A(B 2 2 2 2 & 2  2 r