[wujiaming-ai]

No description provided.

[cuericlee]

Code review: opt-in content safety plugin

Reviewed the full diff against the google-adk>=2.7.0,<2.8.0 contract (BasePlugin, PluginManager, runners.py, base_llm_flow.py, and both tool-execution paths in functions.py). Overall this is a well-structured, strictly opt-in feature, and the critical interception paths (streaming partials withheld until audited, before_tool short-circuiting real execution, on_event replacement before persistence/yield) are covered by real Runner e2e tests. Conditionally ready to merge; I'd suggest clarifying finding 1 first.

Suggested clarifications / fixes

1. Multimodal content is never audited (scope gap). StateBuilder extracts only part.text and skips thoughts, so image/audio/video/file inputs at before_model and multimodal model outputs at after_model produce a skipped (allow) result. If text-only auditing is intentional for this PR, please state it explicitly in the module docs/README; otherwise document a follow-up strategy.

2. Redaction is key-only. state._redact replaces values only by dictionary key name; secrets embedded in string values (e.g. logs like token=..., JSON strings, Authorization: Bearer ...) are sent to the decision API verbatim. Consider regex-based redaction for string values, or document that this is best-effort and not DLP.

3. Delimiter injection in the defuse wrapper. Audited text is wrapped in <untrusted>...</untrusted> without escaping, so a literal </untrusted> in user input or a tool response can close the "untrusted" section early from the judge model's perspective. Escaping angle brackets (or using a random per-request delimiter) would close this.

4. Connection setup per audit. DecisionClient.judge creates and tears down a new httpx.AsyncClient on every call, with up to four serial audits per turn (10s timeout each). Reusing a client across the plugin's lifetime (and optionally skipping/short-circuiting overlapping before_tool/after_tool audits) would avoid amplifying judge-service tail latency onto every agent request.

5. after_tool cannot undo side effects. In ADK 2.7.1 the tool runs first; an after_tool dict only replaces the function response seen by the model, it does not roll back executed actions. before_tool is the real gate. Worth calling out in the docs so users don't over-trust the four-checkpoint framing.

6. Minor: only _audits is bounded by _MAX_INVOCATIONS; _stream_buffers and _audited_text_hashes rely on after_run_callback always firing and could grow if a run is cancelled before cleanup — consider bounding them too.

7. Minor: llm_shield_app_id is accepted (silently unused) when provider=decision; a cross-field validation or warning would help. Also consider documenting that only the last user message and latest tool response are included in the before_model audit window.

Notes

• I did not execute the test suite locally (no google-adk 2.7.x environment); findings above come from static reading plus cross-checking the pinned ADK source.
• Default-question quality/false-positive rate is a model-side concern outside this review; the opt-in live test is a good pre-release signal.

Happy to expand any item with file/line references.