feat(studio): support VeStack deployment and personal sandbox agents

.dockerignore

@@ -0,0 +1,14 @@
+.git
+.github
+.venv
+.pytest_cache
+.ruff_cache
+**/__pycache__
+**/*.pyc
+.env
+.env.*
+frontend/node_modules
+frontend/coverage
+frontend/.vite
+dist
+build

.gitattributes

@@ -1,3 +1,3 @@
 # Minified build artifacts can contain semantic whitespace inside template literals.
-veadk/webui/assets/*.js -whitespace
+veadk/webui/assets/**/*.js -whitespace
 *.sh text eol=lf

docker/Dockerfile.vestack

@@ -0,0 +1,56 @@
+# syntax is intentionally omitted: VeStack BuildKit may not reach Docker Hub.
+ARG PYTHON_IMAGE=python:3.12-slim
+FROM ${PYTHON_IMAGE}
+ARG VEADK_INSTALL_DEPENDENCIES=1
+
+WORKDIR /app
+COPY . /src/veadk-python
+RUN if [ "${VEADK_INSTALL_DEPENDENCIES}" = "1" ]; then \
+      python -m pip install --no-cache-dir \
+        --find-links=/src/veadk-python/docker/vendor \
+        /src/veadk-python; \
+    else \
+      python -m pip install --no-cache-dir \
+        --find-links=/src/veadk-python/docker/vendor \
+        "agentkit-sdk-python>=0.8.0" \
+        "google-adk==2.2.0" \
+        "mcp==1.26.0" \
+        "aiomysql==0.3.2" \
+        "asyncpg>=0.29.0" \
+        "deprecated==1.2.18" \
+        "pydantic-settings==2.10.1" \
+        "pymysql==1.1.1" \
+        "pypdfium2>=4.30.0" \
+        "python-frontmatter==1.1.0" \
+        "trafilatura>=2.0,<2.1" \
+        "trustedmcp==0.0.5" \
+        "vikingdb-python-sdk>=0.1.3" \
+        "volcengine-python-sdk>=5.0.36" \
+        "wrapt==1.17.2" \
+      && python -m pip install --no-cache-dir --no-deps \
+        "litellm==1.83.14" \
+      && python -m pip install --no-cache-dir --no-deps \
+        /src/veadk-python/docker/vendor/fastmcp_slim-*.whl \
+        /src/veadk-python/docker/vendor/fastmcp-*.whl \
+      && python -m pip install --no-cache-dir --no-deps \
+        /src/veadk-python/docker/vendor/openviking_sdk-*.whl \
+        /src/veadk-python; \
+    fi \
+    && rm -rf /src/veadk-python
+
+COPY docker/vestack-entrypoint.sh /app/run.sh
+RUN chmod 0755 /app/run.sh
+
+ENV PYTHONUNBUFFERED=1 \
+    CLOUD_PROVIDER=volcengine \
+    AGENTKIT_CLOUD_PROVIDER=volcengine \
+    VOLCENGINE_AGENTKIT_HOST=top.vestack.cloud \
+    VOLCENGINE_AGENTKIT_SCHEME=http \
+    VOLCENGINE_AGENTKIT_REGION=cn-bj \
+    VOLCENGINE_AGENTKIT_SERVICE=agentkit
+
+EXPOSE 8000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/ping', timeout=3)" || exit 1
+
+ENTRYPOINT ["/app/run.sh"]

docker/Dockerfile.vestack-overlay

@@ -0,0 +1,11 @@
+# Incremental VeStack image used when a previously validated Studio base image
+# already contains all runtime dependencies.  Only runtime modules changed by
+# the VeStack endpoint adaptation are replaced.
+ARG BASE_IMAGE
+FROM ${BASE_IMAGE}
+
+# Keep every current VeADK module and Studio BFF module on one source revision.
+# A narrow two-file overlay can import symbols absent from an older validated
+# base image even when its third-party dependency layer is still compatible.
+COPY veadk /usr/local/lib/python3.12/site-packages/veadk
+COPY frontend/server /usr/local/lib/python3.12/site-packages/frontend/server

docker/README.vestack.md

@@ -0,0 +1,35 @@
+# VeADK Studio on VeStack
+
+This image runs the Studio FastAPI BFF and React UI directly on port 8000. It is
+intended for VeStack environments where the public-cloud VeFaaS Application/BFF
+workflow is unavailable and a prebuilt image must be attached to a Function.
+
+Build for the VeFaaS data plane:
+
+```bash
+docker build --platform linux/amd64 \
+  -f docker/Dockerfile.vestack \
+  --build-arg PYTHON_IMAGE=<reachable-python-3.12-image> \
+  -t <vestack-registry>/<namespace>/veadk-studio:<tag> .
+```
+
+If the selected VeStack base image already contains the VEADK runtime
+dependencies, also pass `--build-arg VEADK_INSTALL_DEPENDENCIES=0`. This avoids
+resolving the entire dependency graph against an incomplete private PyPI mirror;
+the current repository and wheels staged under `docker/vendor/` are still
+installed.
+
+Stage the wheels absent from the VeStack mirror before using that mode:
+
+```bash
+python -m pip download --no-deps \
+  'openviking-sdk>=0.1.3' 'fastmcp==3.4.7' 'fastmcp-slim==3.4.7' \
+  -d docker/vendor
+```
+
+The runtime defaults to the VeStack TOP endpoint and `gateway` authentication,
+which expects the AgentKit/APIG gateway to authenticate requests. For a direct
+browser route, set `VEADK_STUDIO_AUTH_MODE=frontend` and configure the Identity
+user pool/client.
+Long-lived AK/SK values must not be placed in the image or Function environment;
+bind an IAM role and let VeFaaS mount rotating STS credentials instead.

docker/vendor/.gitignore

@@ -0,0 +1,2 @@
+*.whl
+!.gitkeep

docker/vestack-entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+set -eu
+
+: "${CLOUD_PROVIDER:=volcengine}"
+: "${AGENTKIT_CLOUD_PROVIDER:=${CLOUD_PROVIDER}}"
+: "${VOLCENGINE_AGENTKIT_HOST:=top.vestack.cloud}"
+: "${VOLCENGINE_AGENTKIT_SCHEME:=http}"
+: "${VOLCENGINE_AGENTKIT_REGION:=cn-bj}"
+: "${VOLCENGINE_AGENTKIT_SERVICE:=agentkit}"
+: "${VEADK_STUDIO_AUTH_MODE:=gateway}"
+: "${VEADK_STUDIO_LISTEN_PORT:=${_FAAS_RUNTIME_PORT:-8000}}"
+
+export CLOUD_PROVIDER AGENTKIT_CLOUD_PROVIDER
+export VOLCENGINE_AGENTKIT_HOST VOLCENGINE_AGENTKIT_SCHEME
+export VOLCENGINE_AGENTKIT_REGION VOLCENGINE_AGENTKIT_SERVICE
+
+exec python -m veadk.cli.cli studio \
+  --provider "${CLOUD_PROVIDER}" \
+  --auth-mode "${VEADK_STUDIO_AUTH_MODE}" \
+  --host 0.0.0.0 \
+  --port "${VEADK_STUDIO_LISTEN_PORT}"