refactor(config): promote helm-values generation to agentex.config.helm_values

[max-parke-scale]

What

Promotes the manifest + environments.yaml → helm-values mapping from agentex.lib.cli.handlers.deploy_handlers into a new slim-safe module, agentex.config.helm_values — the same treatment #396 gave the config models. The mapping depends only on the stdlib and the agentex.config models, but living in the heavy ADK forced server-side deployers (egp-api-backend's Temporal deploy workflow) to fork it, and the forks have drifted.

Step 1 of the plan in AGX1-357 (later steps move the policy defaults into the agentex-agent chart; this PR deliberately keeps them).

How the consumer differences are absorbed

• repository / image_tag are explicit kwargs — the CLI resolves InputDeployOverrides falling back to the manifest image before calling; server-side deployers pass their freshly-built image.
• acp_module is an optional kwarg — the CLI passes the filesystem-resolved module (resolution stays in agentex.lib.cli.utils.path_utils, which needs the agent source tree); the default is a pure-string derivation from local_development.paths.acp.
• The promoted function raises ValueError; the CLI wrapper keeps its signature and maps to DeploymentError.
• auth_utils._encode_principal_context_from_env_config now delegates to the promoted encode_principal_context (single source for the AUTH_PRINCIPAL_B64 encoding).
• deploy_handlers re-exports the historical names (TEMPORAL_WORKER_KEY, convert_env_vars_dict_to_list, _deep_merge, add_acp_command_to_helm_values, merge_deployment_configs) so existing imports keep working — pinned by tests, mirroring test_config_shims.py.

Also: BuildContext.dockerignore now declares its default as default=None — pyright doesn't recognize the positional form (the repo lint gate flagged the new tests' BuildContext(...) constructions), and every other optional field in these modules already uses the keyword.

Behavior

Output is unchanged for all callers: same values dict, same defaults (autoscaling, pullPolicy, command injection), same conditional module resolution when helm_overrides provides command. The only observable delta is that two before/after-merge logger.info dumps of the full helm values no longer fire mid-merge (the final "Deploying with the following helm values" log remains); those dumps include env-var values, so they were also dubious to emit from a server.

Slim-safety verified: scripts/check-slim-deps passes, and a differential import check shows agentex.config.helm_values pulls in exactly what agentex.config.agent_manifest already does (no agentex.lib, no yaml/temporalio).

Tests

• tests/test_helm_values.py — pins the values contract (skeleton, env precedence, credentials→secretEnvVars, temporal blocks, principal encoding, pull secrets, deep-merge, error cases). The chart contract previously had no tests in this repo.
• tests/lib/cli/test_deploy_handlers.py — wrapper parity with the promoted core, override resolution, DeploymentError mapping, fallback + skip behavior for module resolution, back-compat re-exports.
• 90 passed across the new tests + tests/lib/cli/ + tests/test_config_shims.py; ruff clean.

🧑‍💻🤖 — posted via Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​agentex-sdk@​0.12.0 ⏵ 0.13.0	+5
	pypi/​agentex-client@​0.12.0 ⏵ 0.13.0	+1

View full report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​agentex-sdk@​0.12.0 ⏵ 0.13.0	+5
	pypi/​agentex-client@​0.12.0 ⏵ 0.13.0	+1

View full report