@ai_mind/dsh-a2a 1.1.0 → 1.1.1

package/README.md

@@ -228,6 +228,16 @@ JSON-RPC 方法名：`SendMessage`、`SendStreamingMessage`、`GetTask`、`ListT
 
 凭据来源（可组合）：`auth.clients[{id,token}]`、`auth.tokens[]`、`auth.token`、`auth.tokenEnv`（环境变量，支持逗号/换行分隔多个）。启用鉴权后 Agent Card 会自动声明 `securitySchemes` 与 `securityRequirements`。
 
+内联令牌可以直接写在插件配置里（设置页的「A2A 访问令牌（内联）」字段等价）：
+
+```yaml
+auth:
+  mode: bearer
+  token: 'your-long-random-token'
+```
+
+> 在设置页输入令牌时，如果 `auth.mode` 还是 `none`，保存会自动切换为 `bearer`。令牌不会回显；它会以明文保存在 profile 的 `cordis.patch.yml`（权限 600），生产环境建议改用 `auth.tokenEnv` 或 `auth.clients`。
+
 **每个凭据是一个独立的租户边界**：任务与 Push 配置按凭据 id 隔离，客户端 A 看不到客户端 B 的任务。未鉴权时所有 loopback 调用方共享 `anonymous` 作用域。
 
 ### 默认安全姿态

package/client.js

@@ -72,11 +72,11 @@ window.__ModuleLoader__.load({
       saveError: '保存失败',
       reload: '重新读取',
       dirty: '有未保存的修改',
-      token: '访问令牌',
-      tokenHint: '写回 profile YAML；推荐改用 auth.tokenEnv 从环境变量读取。',
-      tokenPlaceholder: '留空保持不变',
+      token: 'A2A 访问令牌（内联）',
+      tokenHint: '保存后写入插件配置的 auth.token；如果鉴权模式为 none，会自动切换为 bearer。值不会回显。',
+      tokenPlaceholder: '输入新的访问令牌',
       clearToken: '清除已保存的内联令牌',
-      tokenConfigured: '已配置内联令牌',
+      tokenConfigured: '已配置内联令牌（值不会回显）',
       tokenNotConfigured: '未配置内联令牌',
       tokenEnvConfigured: '环境变量已配置：{name}',
       openCard: '打开 Agent Card',
@@ -183,11 +183,11 @@ window.__ModuleLoader__.load({
       saveError: 'Save failed',
       reload: 'Reload',
       dirty: 'Unsaved changes',
-      token: 'Access token',
-      tokenHint: 'Stored in the profile YAML. Prefer auth.tokenEnv instead.',
-      tokenPlaceholder: 'Leave empty to keep',
+      token: 'A2A access token (inline)',
+      tokenHint: 'Saved as auth.token in the plugin config. A mode of "none" switches to bearer automatically. The value is never echoed.',
+      tokenPlaceholder: 'Enter a new access token',
       clearToken: 'Clear the saved inline token',
-      tokenConfigured: 'Inline token configured',
+      tokenConfigured: 'Inline token configured (value is never shown)',
       tokenNotConfigured: 'No inline token',
       tokenEnvConfigured: 'Environment variable: {name}',
       openCard: 'Open Agent Card',
@@ -653,7 +653,7 @@ window.__ModuleLoader__.load({
         const secretBlock = panel
           ? h(
               'div',
-              { className: 'a2aui-group' },
+              { className: 'a2aui-group', key: 'inline-token' },
               h('h5', { className: 'a2aui-group-title' }, t('token')),
               h(
                 'div',
@@ -704,8 +704,8 @@ window.__ModuleLoader__.load({
             ? h(
                 'div',
                 { className: 'a2aui-form' },
-                ...groups.map(([group, fields]) =>
-                  h(
+                ...groups.flatMap(([group, fields]) => {
+                  const node = h(
                     'div',
                     { className: 'a2aui-group', key: group },
                     h('h5', { className: 'a2aui-group-title' }, groupLabel(t, group)),
@@ -717,9 +717,9 @@ window.__ModuleLoader__.load({
                         h('div', null, renderControl(field)),
                       ),
                     ),
-                  ),
-                ),
-                secretBlock,
+                  )
+                  return group === 'auth' ? [node, secretBlock] : [node]
+                }),
                 h(
                   'div',
                   { className: 'a2aui-form-foot' },

package/lib/panel.js

@@ -286,7 +286,7 @@ export function createPanelRouter({ ctx, config, mountPath, logger, status, heal
     res.setHeader('Cache-Control', 'no-store')
     res.json({
       ok: true,
-      plugin: { name: PLUGIN_NAME, version: '1.1.0' },
+      plugin: { name: PLUGIN_NAME, version: '1.1.1' },
       mountPath,
       ...payload,
       ...(typeof status === 'function' ? { server: status() } : {}),
@@ -342,6 +342,9 @@ export function createPanelRouter({ ctx, config, mountPath, logger, status, heal
         if (typeof body.token !== 'string') throw new Error('token must be a string')
         if (body.token.trim() === '') throw new Error('token must not be empty')
         setAt(next, 'auth.token', body.token)
+        // A token with auth.mode "none" would be stored but never used. Treat
+        // an explicitly supplied token as the intent to enable bearer auth.
+        if ((next.auth?.mode ?? 'none') === 'none') setAt(next, 'auth.mode', 'bearer')
       }
 
       const normalized = normalizeConfig(next)
@@ -380,7 +383,7 @@ export function createPanelRouter({ ctx, config, mountPath, logger, status, heal
     logger.info('[a2a] configuration updated from the settings panel')
     res.json({
       ok: true,
-      plugin: { name: PLUGIN_NAME, version: '1.1.0' },
+      plugin: { name: PLUGIN_NAME, version: '1.1.1' },
       mountPath,
       ...describe(live, liveEntry, []),
       ...(typeof status === 'function' ? { server: status() } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai_mind/dsh-a2a",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Production A2A (Agent2Agent) v1.0 server for DeepSeek Harness agents: JSON-RPC + HTTP+JSON bindings, streaming, tasks, push notifications and signed Agent Cards.",
   "type": "module",
   "license": "MIT",