From 3402fe42ae75ac930def7e64c2aa35cc26fd4c3d Mon Sep 17 00:00:00 2001
From: "yanan.zhangyn" <yanan.zhangyn@bytedance.com>
Date: Mon, 24 Aug 2026 11:47:03 +0800
Subject: [PATCH] fix(studio): enforce Google ADK floor for Sidecar

---
 tests/cli/test_managed_sidecar_source.py | 9 ++++++---
 veadk/cli/managed_sidecar_source.py      | 5 ++++-
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/tests/cli/test_managed_sidecar_source.py b/tests/cli/test_managed_sidecar_source.py
index fd616d95f..624d99899 100644
--- a/tests/cli/test_managed_sidecar_source.py
+++ b/tests/cli/test_managed_sidecar_source.py
@@ -46,14 +46,14 @@ def _package(root: Path) -> Path:
     return package
 
 
-def test_rewrite_uses_source_snapshot_and_pins_public_sdk() -> None:
+def test_rewrite_uses_source_snapshot_and_pins_runtime_dependencies() -> None:
     rewritten = rewrite_managed_sidecar_requirements(
         "\n".join(
             (
                 "veadk-python[harness-sidecar]>=1.1.1",
                 "agentkit_sdk_python>=0.8.0,<0.9.0",
                 "agentkit-harness-sidecar-integration==0.1.0",
-                "google-adk>=1.34.0",
+                "google_adk==1.23.0",
                 "mcp==1.20.0",
                 "",
             )
@@ -65,9 +65,10 @@ def test_rewrite_uses_source_snapshot_and_pins_public_sdk() -> None:
     assert "agentkit-harness-sidecar-integration" not in rewritten
     assert rewritten.splitlines()[1] == "agentkit-sdk-python==0.8.1"
     assert rewritten.splitlines().count("agentkit-sdk-python==0.8.1") == 1
-    assert "google-adk>=1.34.0" in rewritten
     assert rewritten.splitlines().count("mcp==1.26.0") == 1
     assert "mcp==1.20.0" not in rewritten
+    assert rewritten.splitlines().count("google-adk>=1.34.0") == 1
+    assert "google_adk==1.23.0" not in rewritten
 
 
 def test_rewrite_preserves_comments_and_rejects_missing_veadk() -> None:
@@ -118,6 +119,8 @@ def test_stage_copies_only_safe_runtime_source_and_rewrites_requirements(
     requirements = (project / "requirements.txt").read_text(encoding="utf-8")
     assert requirements.splitlines().count("agentkit-sdk-python==0.8.1") == 1
     assert requirements.splitlines().count("mcp==1.26.0") == 1
+    assert requirements.splitlines().count("google-adk>=1.34.0") == 1
+    assert "\ngoogle-adk\n" not in f"\n{requirements}"
     assert "veadk-python[" not in requirements
 
 
diff --git a/veadk/cli/managed_sidecar_source.py b/veadk/cli/managed_sidecar_source.py
index 70380e6a3..fdef489be 100644
--- a/veadk/cli/managed_sidecar_source.py
+++ b/veadk/cli/managed_sidecar_source.py
@@ -26,11 +26,13 @@
 _REMOVED_DISTRIBUTIONS = {
     "agentkit-sdk-python",
     "agentkit-harness-sidecar-integration",
+    "google-adk",
     "mcp",
     "veadk-python",
 }
 _MANAGED_SDK_REQUIREMENT = "agentkit-sdk-python==0.8.1"
 _MANAGED_MCP_REQUIREMENT = "mcp==1.26.0"
+_MANAGED_ADK_REQUIREMENT = "google-adk>=1.34.0"
 _IGNORED_PARTS = {".git", "__pycache__", "webui"}
 _IGNORED_SUFFIXES = {".pyc", ".pyo"}
 _BLOCKED_SUFFIXES = {".key", ".p12", ".pem", ".pfx"}
@@ -68,7 +70,7 @@ def _canonical_requirement_name(line: str) -> str | None:
 
 
 def rewrite_managed_sidecar_requirements(requirements: str) -> str:
-    """Use in-snapshot VeADK and install the approved public SDK explicitly."""
+    """Use in-snapshot VeADK and install approved runtime dependencies."""
 
     lines: list[str] = []
     veadk_removed = False
@@ -84,6 +86,7 @@ def rewrite_managed_sidecar_requirements(requirements: str) -> str:
         "# veadk-python is provided by the Studio-managed public source snapshot.",
         _MANAGED_SDK_REQUIREMENT,
         _MANAGED_MCP_REQUIREMENT,
+        _MANAGED_ADK_REQUIREMENT,
         *lines,
     ]
     return "\n".join(lines).rstrip() + "\n"