@amaster.ai/dsh-a2a 0.1.38 → 0.1.39

package/README.md

@@ -14,11 +14,11 @@ dsh plugin --profile my-agent add @amaster.ai/dsh-a2a
 
 ## Native inbox execution
 
-`inbox.enabled: true` uses the official DSH inbox (`Agent.send`) for ordinary `next-turn` input and `next-step` steering. Tested with the unmodified npm runtime `0.2.1-rc.5`; no core patch is required. The queue and its durable projection belong to DSH. The plugin only materializes messages, attaches A2A task identities, and translates execution events.
+`inbox.enabled: true` uses the official DSH inbox (`Agent.send`) for ordinary `next-turn` input and `next-step` steering. Tested with the unmodified npm runtime `0.2.1-rc.5`; no core patch is required. Cold task recovery scans committed input once per batch and groups it by task, preserving input order. The queue and its durable projection belong to DSH. The plugin only materializes messages, attaches A2A task identities, and translates execution events.
 
 Standard `SendMessage` / `SendStreamingMessage`, task queries, cancellation and task subscriptions keep their official meanings. Optional inbox metadata forwards `target` and `wakeup` to DSH. `wakeup: false` leaves an idle driver parked; it does not prevent an active driver from consuming pending input. A later real waking message releases pending input.
 
-The same-process `a2aInbox` service exposes `resolve`, `content`, `enqueue`, `promote`, `cancel`, `get`, `update`, `move`, `remove`, `clearPending`, and `executePending`, plus the existing pause/wake/resume controls. Pending-only clearing preserves active work; context clearing discards all work.
+The same-process `a2aInbox` service exposes `recoveryCandidates`, `resolve`, `content`, `enqueue`, `promote`, `cancel`, `get`, `update`, `move`, `remove`, `clearPending`, and `executePending`, plus the existing pause/wake/resume controls. Pending-only clearing preserves active work; context clearing discards all work.
 
 Pause is process-local and writes no custom required session event. After restart, restored input stays parked until a waking admission or explicit execution. Retention recovery accepts snapshots under the historical extension URI as well as the current URI, writes only the current metadata key, and clears both keys after consumption. Explicit resume durably transfers input to a fresh task before waking it; retry after an interrupted cleanup reuses the existing replacement instead of replaying its input.
 
@@ -54,6 +54,41 @@ Select `taskStore: filesystem` with `filesystem.root` pointing at a retained dir
 
 After a crash, the host discovers sessions, calls `a2aInbox.resolve(contextId)` and supplies a real attributed waking input through the normal API. Restored unclaimed inputs keep their original task ownership. Startup scanning and scheduling remain host responsibilities. Explicit cancellation stays terminal and discards only the canceled task's input. This does not promise exactly-once external side effects, replay of consumed input, or replay of the interrupted active model call.
 
+#### Discovering recovery candidates
+
+`await a2aInbox.recoveryCandidates(call?)` returns sorted, distinct context IDs
+from nonterminal task checkpoints in the caller's SDK tenant/user scope (default:
+the anonymous default scope). It does not open session logs, create agents,
+resolve contexts or wake input. Pass the same `call` to
+`a2aInbox.resolve(contextId, call)` to restore tasks from that scope. Prepare host
+identity before resolving a context;
+the host still decides whether restored work should run. Paused, input-required
+and interrupted tasks can all be candidates, including tasks with no remaining
+unclaimed input. Completed, canceled, failed and rejected tasks are excluded;
+retained input on a terminal task still requires explicit `resume`.
+
+Context IDs identify agents globally within one plugin instance; the TaskStore
+scope is not a separate agent namespace. Resolving an already loading or loaded
+context with a different explicit tenant/user scope rejects. Existing host
+controls without a call context continue to address that loaded agent.
+
+No separate index or storage configuration is needed. Discovery uses the same
+atomic summaries as task listing: bounded snapshot prefixes under
+`filesystem.root`, Redis keys under the configured prefix, or object metadata in
+the configured GCS bucket. Each call enumerates the scope once, without sorting
+or hydrating full task pages. Old, malformed or oversized summaries fall back to
+reading their snapshots; unreadable snapshots and backend errors reject the
+call. Custom TaskStores without the optional discovery method use exhaustive
+task pagination. Task listing counts, filters and cursor semantics are unchanged.
+
+Discovery remains O(task count) in lightweight summaries; it is not a
+pending-only index. It covers surviving task snapshots, not orphaned session
+logs. Keep the host's session-scan fallback for deployments whose historical
+tasks were not durably stored or have expired. The memory backend has no restart
+durability. Redis persistence must be configured separately, and its task TTL
+(default 24 hours) still applies. Durable recovery also requires retained DSH
+session logs and materialized files; a TaskStore alone does not preserve them.
+
 ### Graceful host shutdown
 
 Set `inbox: { enabled: true, shutdown: retain-pending }` on both sides of a restart to retain unclaimed A2A `next-step` and `next-turn` input. Keep durable session persistence, the TaskStore and materialized files on retained storage. This is a host configuration policy, not wire metadata. The default `shutdown: cancel` keeps the existing terminal-on-unload behavior.
@@ -308,8 +343,8 @@ slow readers independently of the LLM/Langfuse integration gate.
 - **Host admission and settlement.** `ctx.on('a2a/before-followup', async (detail) => { ... })` runs before every user message enters the agent inbox. Its detail contains `agent`, `contextId`, `taskId`, the original `a2aMessage`, `dshMessageId`, `requestHeaders`, and an abort `signal`; rejection fails the A2A task without enqueueing the message. A host may inspect its own A2A message metadata here; the plugin does not interpret it. The existing `a2a/message-admitted` event remains an observational tap after insertion. A host can register `ctx.on('a2a/task-settlement', async ({ agent, contextId, taskId, reason, signal }, next) => { await hostWork; return next(); })`. The hook starts after the first completed turn and may wait for any number of autonomous follow-ups, including none. The plugin streams their events under the same task ID and publishes the latest turn's final status when the hook resolves. Cancel, clear, and disposal abort the signal and release the waiter. Without this hook, the first completed turn settles as before. The host must end its wait when its work is done; the plugin does not infer that from product metadata.
 - **Agents are full preset citizens.** Each task's agent is created with the deployment's default model selection (`agentDefaultModel`) and mounts its agent preset (the web profile keeps all tools inside presets — without one the agent would see an empty tool catalog). `agent.preset` pins a specific preset.
 - **Streaming aggregation.** Text deltas of a turn share one `messageId`, so clients accumulate them into a single message; reasoning deltas ride a separate `messageId` and are marked `metadata.dshAgent.kind: 'thought'`. The turn-final event's message carries the full assembled text, so blocking `SendMessage` clients read the answer from `result.task.status.message`. Tool calls/results are data parts marked `tool-call` / `tool-result`; token usage lands in `metadata.usage` of the final event. A2A 1.0 has no `final` flag — terminal and interrupted states close the stream.
-- **Message parts beyond text.** File parts can carry inline bytes or a `url`; the plugin downloads URLs over http/https, bounded to 64 MiB and 30 s. Downloads default to public IP addresses and revalidate every redirect. In a trusted intranet, set `urlDownloads.allowPrivate: true` to allow every private or loopback host without an allowlist; `urlDownloads.allowedHosts` remains available to allow only named hosts. Supported images use the composed attachment store (`ctx.attachments`, e.g. `@deepseek-ai/dsh-attachment-local`) to reach vision-capable models. Non-image files use a configured materializer or persist under `uploadsDir` (default `<OS temp>/dsh-a2a-uploads/<date>/`, names sanitized cross-platform, collisions suffixed), even when an attachment store exists. The prompt references the resulting readable path inside a `<document>` tag. Ensure the local directory is readable by the agent's tools. `data` parts become `<data>` JSON text. A turn never fails because a part kind is unsupported.
-- **Remote execution files.** A deployment can register `ctx.provide('a2aFileMaterializer', { materializeFile })`, using the exported `A2aFileMaterializer` type. The callback receives `{ contextId, bytes, filename, mediaType }` (with a sanitized basename) and returns `{ readablePath }`, a path readable by that context's file/shell tools. When configured, non-image FileParts use the materializer instead of `ctx.attachments.saveFile()`; the model receives the returned `<document path="...">`. Images keep the existing attachment handling. A failed callback yields a delivery note, never a host-path fallback. The deployment owns sandbox selection, upload, and lifetime; no E2B SDK is required by this plugin.
+- **Message parts beyond text.** File parts can carry inline bytes or a `url`; the plugin downloads URLs over http/https, bounded to 64 MiB and 30 s, including the DNS-validation wait. Downloads default to public IP addresses and revalidate every redirect. In a trusted intranet, set `urlDownloads.allowPrivate: true` to allow every private or loopback host without an allowlist; `urlDownloads.allowedHosts` remains available to allow only named hosts. Supported images use the composed attachment store (`ctx.attachments`, e.g. `@deepseek-ai/dsh-attachment-local`) to reach vision-capable models. Non-image files use a configured materializer or persist under `uploadsDir` (default `<OS temp>/dsh-a2a-uploads/<date>/`, names sanitized cross-platform, duplicate names stored in unique `upload-*` subdirectories), even when an attachment store exists. The prompt references the resulting readable path inside a `<document>` tag. Ensure the local directory is readable by the agent's tools. `data` parts become `<data>` JSON text. A turn never fails because a part kind is unsupported.
+- **Remote execution files.** A deployment can register `ctx.provide('a2aFileMaterializer', { materializeFile })`, using the exported `A2aFileMaterializer` type. The callback receives `{ contextId, bytes, filename, mediaType, signal? }` (with a sanitized basename) and returns `{ readablePath }`, a path readable by that context's file/shell tools. When configured, non-image FileParts use the materializer instead of `ctx.attachments.saveFile()`; the model receives the returned `<document path="...">`. Images keep the existing attachment handling. A failed callback yields a delivery note, never a host-path fallback. Task cancellation, context clearing, and plugin unload stop waiting for file preparation. Materializers should honor the optional abort signal to stop their underlying work; a backend that ignores it may still finish independently. The deployment owns sandbox selection, upload, and lifetime; no E2B SDK is required by this plugin.
 - **Local execution files.** Without a remote materializer, inline and downloaded non-image FileParts persist under `uploadsDir`; the `<document>` envelope carries the path, source URL, media type, size, and original filename when sanitization or a collision changes it. Images still use native attachment handling.
 - **Tool approvals.** When the profile composes `@deepseek-ai/dsh-user-approval` with policy `ask`, A2A-owned agents answer `approval/request` by publishing `input-required` with a DataPart `{ requestId, toolName, reason?, callId? }`. Reply on the same `taskId`/`contextId` with one DataPart `{ requestId, callId?, outcome: "allowed-once" | "rejected" }`. The reply settles the waiting tool call inside the original dsh turn; it does not create another user message or billing turn. Invalid, duplicate, and withdrawn replies are rejected. `never` policy rejects inside dsh before the A2A answerer is called. The approval service is optional; without it, `ask` fails closed as usual.
 - **Custom approval payloads.** A deployment may register `ctx.provide('a2aApprovalCodec', codec)` before this plugin starts. The exported `A2aApprovalCodec` has `encode(request)` and `decode(message)` methods; `decode` returns `{ requestId?, callId?, outcome }` only for a supported one-shot decision. A unique `callId` can replace `requestId` for legacy clients. Reject unsupported outcomes in the decoder; never translate `proceed_always` into `allowed-once`. Other message types, including question, plan, and UI markup, remain outside this plugin.
@@ -366,6 +401,8 @@ A2A task snapshots retain protocol history and artifacts; [dsh-storage](../dsh-s
 - `redis` — task JSON under `<keyPrefix>:tasks:<scope>:<taskId>` with a TTL; requires the `ioredis` peer
 - `gcs` — gzipped task JSON at `<prefix>/<scope>/<taskId>/metadata.json.gz`; requires the `@google-cloud/storage` peer. `archiveWorkspace()` (tar of the workspace) exists but is not wired to the lifecycle yet.
 
+Task listing scans lightweight summaries and loads full snapshots only for the selected page. Filesystem and Redis snapshots carry the summary in the same JSON write; GCS stores it as object metadata in the same upload. Scoped legacy snapshots and oversized summaries fall back to full reads, so no migration is required. Listing still enumerates and sorts the summaries in the caller's scope; this is not a database query index. Filtering, totals, cursor ordering, history, and optional artifacts keep the same API semantics.
+
 `<scope>` is a hash of the A2A tenant and user. Older unscoped Redis/GCS task records are not read after this upgrade; migrate known records into their scope or let them expire before rollout.
 
 ## Security

package/lib/bridge.js

@@ -41,6 +41,7 @@ export class A2aBridge {
     executing = new Map();
     asked = new Map();
     approvals = new Map();
+    preparing = new Map();
     codec;
     delegation = new AsyncLocalStorage();
     children = new WeakMap();
@@ -230,14 +231,24 @@ export class A2aBridge {
                 ...(this.inbox ? { keepInboxOnDispose: true } : {}),
             });
     }
-    /** A2A parts → dsh content blocks; throws only when no part is usable. */
-    async buildContent(message, contextId) {
-        const attachments = this.ctx.get('attachments');
-        const materializer = this.ctx.get('a2aFileMaterializer');
-        return buildMessageContent(message.parts, attachments, uploadsDir(this.options.uploadsDir), materializer ? { contextId, materializer } : undefined, {
-            allowPrivate: this.options.downloadAllowPrivate,
-            allowedHosts: this.options.downloadAllowedHosts,
-        });
+    /** A2A parts → dsh content blocks; rejects unusable messages and cancellation. */
+    async buildContent(message, contextId, signal, taskId = message.taskId) {
+        const abort = new AbortController();
+        this.preparing.set(abort, { contextId, taskId });
+        const readSignal = signal ? AbortSignal.any([signal, abort.signal]) : abort.signal;
+        try {
+            const attachments = this.ctx.get('attachments');
+            const materializer = this.ctx.get('a2aFileMaterializer');
+            const content = await buildMessageContent(message.parts, attachments, uploadsDir(this.options.uploadsDir), materializer ? { contextId, materializer } : undefined, {
+                allowPrivate: this.options.downloadAllowPrivate,
+                allowedHosts: this.options.downloadAllowedHosts,
+            }, readSignal);
+            readSignal.throwIfAborted();
+            return content;
+        }
+        finally {
+            this.preparing.delete(abort);
+        }
     }
     isClearing(contextId) {
         return this.clearing.has(contextId);
@@ -524,6 +535,9 @@ export class A2aBridge {
         if (this.clearing.has(contextId))
             throw new Error('Context is already being cleared.');
         this.clearing.add(contextId);
+        for (const [abort, pending] of this.preparing)
+            if (pending.contextId === contextId)
+                abort.abort();
         try {
             await this.inbox?.clear(contextId);
             await Promise.allSettled([...(this.creating.get(contextId) ?? [])]);
@@ -560,9 +574,16 @@ export class A2aBridge {
     }
     /** Abort the task's active turn; returns the contextId when the task is live. */
     cancel(taskId) {
+        let preparingContext;
+        for (const [abort, pending] of this.preparing) {
+            if (pending.taskId !== taskId)
+                continue;
+            preparingContext = pending.contextId;
+            abort.abort();
+        }
         const entry = this.tasks.get(taskId);
         if (!entry)
-            return undefined;
+            return preparingContext;
         const staleTurn = entry.turnActive;
         this.settleEntry(entry, 'Task canceled by request.');
         entry.staleTurn ||= staleTurn;
@@ -578,6 +599,8 @@ export class A2aBridge {
     }
     /** Dispose every owned agent (plugin unload / server shutdown). */
     async dispose() {
+        for (const abort of this.preparing.keys())
+            abort.abort();
         try {
             await this.inbox?.shutdown();
         }

package/lib/content.js

@@ -17,7 +17,7 @@
  * raw bytes and must degrade, never fail.
  */
 import { lookup as dnsLookup } from 'node:dns/promises';
-import { mkdir, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, writeFile } from 'node:fs/promises';
 import { request as httpRequest } from 'node:http';
 import { request as httpsRequest } from 'node:https';
 import { BlockList, isIP } from 'node:net';
@@ -26,9 +26,32 @@ import path from 'node:path';
 /** Cap on one url part download. */
 const MAX_DOWNLOAD_BYTES = 64 * 1024 * 1024;
 const DOWNLOAD_TIMEOUT_MS = 30_000;
-export async function buildMessageContent(parts, attachments, dir, materialization, downloads = {}) {
+/** Stop waiting even when a backend cannot cancel its underlying work. */
+async function abortable(work, signal) {
+    if (!signal)
+        return work;
+    let onAbort;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((_, reject) => {
+                onAbort = () => reject(signal.reason);
+                if (signal.aborted)
+                    onAbort();
+                else
+                    signal.addEventListener('abort', onAbort, { once: true });
+            }),
+        ]);
+    }
+    finally {
+        signal.removeEventListener('abort', onAbort);
+    }
+}
+export async function buildMessageContent(parts, attachments, dir, materialization, downloads = {}, signal) {
     const content = [];
+    signal?.throwIfAborted();
     for (const part of parts) {
+        signal?.throwIfAborted();
         const c = part.content;
         if (!c)
             continue;
@@ -42,7 +65,7 @@ export async function buildMessageContent(parts, attachments, dir, materializati
                 break;
             case 'raw':
             case 'url':
-                content.push(await fileContent(c, part, attachments, dir, materialization, downloads));
+                content.push(await abortable(fileContent(c, part, attachments, dir, materialization, downloads, signal), signal));
                 break;
             default:
                 // A part kind this SDK version predates: keep it visible, never drop.
@@ -67,14 +90,14 @@ function failNote(part, mediaType, uri, label, error) {
     return note(part, mediaType, uri, uri ? text.replaceAll(uri, redactedUri(uri) ?? '[redacted URL]') : text);
 }
 /** Resolve one file part to an attachment block or a workspace file. */
-async function fileContent(c, part, attachments, dir, materialization, downloads) {
+async function fileContent(c, part, attachments, dir, materialization, downloads, signal) {
     let bytes;
     let mediaType = part.mediaType;
     let uri;
     try {
         if (c.$case === 'url') {
             uri = c.value;
-            const got = await download(uri, downloads);
+            const got = await download(uri, downloads, signal);
             bytes = got.bytes;
             mediaType ||= got.mediaType ?? '';
         }
@@ -83,11 +106,14 @@ async function fileContent(c, part, attachments, dir, materialization, downloads
         }
     }
     catch (error) {
+        signal?.throwIfAborted();
         return failNote(part, mediaType, uri, 'failed to read a file part', error);
     }
+    signal?.throwIfAborted();
     const image = attachments?.imageLimits.mediaTypes.includes(mediaType.toLowerCase());
     if (attachments && image) {
-        const block = await saveAttachment(attachments, bytes, mediaType, part.filename);
+        const block = await saveAttachment(attachments, bytes, mediaType, part.filename, signal);
+        signal?.throwIfAborted();
         if (block)
             return block;
     }
@@ -98,27 +124,31 @@ async function fileContent(c, part, attachments, dir, materialization, downloads
                 bytes,
                 filename: sanitizeUploadFileName(part.filename),
                 mediaType,
+                signal,
             });
+            signal?.throwIfAborted();
             if (!readablePath)
                 throw new Error('materializer returned no readable path');
             return documentBlock(uri, mediaType, bytes.byteLength, readablePath, part.filename);
         }
         catch (error) {
+            signal?.throwIfAborted();
             console.error('[dsh-a2a] failed to materialize a file part:', error);
             return note(part, mediaType, uri, 'file materialization failed');
         }
     }
     try {
         const name = sanitizeUploadFileName(part.filename);
-        const filePath = await persistUpload(dir, name, bytes);
+        const filePath = await persistUpload(dir, name, bytes, signal);
         return documentBlock(uri, mediaType, bytes.byteLength, filePath, part.filename);
     }
     catch (error) {
+        signal?.throwIfAborted();
         return failNote(part, mediaType, uri, 'failed to persist a file part', error);
     }
 }
 /** Commit part bytes to the store: image path first, verbatim file on refusal. */
-async function saveAttachment(attachments, bytes, mediaType, filename) {
+async function saveAttachment(attachments, bytes, mediaType, filename, signal) {
     const name = filename || undefined;
     if (attachments.imageLimits.mediaTypes.includes(mediaType.toLowerCase())) {
         try {
@@ -130,33 +160,37 @@ async function saveAttachment(attachments, bytes, mediaType, filename) {
             return { type: 'image', attachment };
         }
         catch (error) {
+            signal?.throwIfAborted();
             console.error('[dsh-a2a] image admission failed; storing the bytes as a file:', error);
         }
     }
+    signal?.throwIfAborted();
     try {
         const attachment = await attachments.saveFile({ data: bytes, name });
         return { type: 'file', attachment };
     }
     catch (error) {
+        signal?.throwIfAborted();
         console.error('[dsh-a2a] failed to store an attachment:', error);
         return undefined;
     }
 }
 /** Save one upload under the upload dir; returns the absolute path. */
-async function persistUpload(dir, name, bytes) {
+async function persistUpload(dir, name, bytes, signal) {
     await mkdir(dir, { recursive: true });
-    const { name: stem, ext } = path.parse(name);
-    for (let attempt = 0;; attempt++) {
-        const candidate = path.join(dir, attempt === 0 ? name : `${stem}-${attempt}${ext}`);
-        try {
-            await writeFile(candidate, bytes, { flag: 'wx' });
-            return candidate;
-        }
-        catch (error) {
-            if (error.code !== 'EEXIST')
-                throw error;
-        }
+    let candidate = path.join(dir, name);
+    try {
+        await writeFile(candidate, bytes, { flag: 'wx', signal });
+        return candidate;
     }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    // A unique directory preserves even near-limit UTF-8 filenames without probing old suffixes.
+    candidate = path.join(await mkdtemp(path.join(dir, 'upload-')), name);
+    await writeFile(candidate, bytes, { flag: 'wx', signal });
+    return candidate;
 }
 // Windows refuses these device stems regardless of extension.
 const WINDOWS_RESERVED_STEMS = new Set('CON PRN AUX NUL COM1 COM2 COM3 COM4 COM5 COM6 COM7 COM8 COM9 LPT1 LPT2 LPT3 LPT4 LPT5 LPT6 LPT7 LPT8 LPT9'.split(' '));
@@ -283,92 +317,101 @@ async function safeAddresses(hostname, allowedHosts, allowPrivate) {
     return addresses;
 }
 /** Fetch one url part's bytes over http(s), bounded in size, redirects, address and time. */
-async function download(uri, options) {
+async function download(uri, options, requestedSignal) {
     const allowedHosts = new Set((options.allowedHosts ?? []).map((host) => host.replace(/^\[|\]$/g, '').toLowerCase()));
     const controller = new AbortController();
+    const signal = requestedSignal
+        ? AbortSignal.any([requestedSignal, controller.signal])
+        : controller.signal;
+    signal.throwIfAborted();
     const timeout = setTimeout(() => controller.abort(new Error('download timed out')), DOWNLOAD_TIMEOUT_MS);
     timeout.unref();
     try {
-        let current = new URL(uri);
-        for (let redirect = 0;; redirect++) {
-            if (current.protocol !== 'http:' && current.protocol !== 'https:') {
-                throw new Error(`unsupported scheme "${current.protocol}"`);
-            }
-            await safeAddresses(current.hostname, allowedHosts, options.allowPrivate === true);
-            const response = await new Promise((resolve, reject) => {
-                const request = (current.protocol === 'http:' ? httpRequest : httpsRequest)(current, {
-                    signal: controller.signal,
-                    lookup: (hostname, lookupOptions, callback) => {
-                        const allowed = options.allowPrivate === true ||
-                            allowedHosts.has(hostname.replace(/^\[|\]$/g, '').toLowerCase());
-                        const resolving = allowed
-                            ? dnsLookup(hostname, { all: lookupOptions.all ?? false }).then((entry) => Array.isArray(entry) ? entry : [entry])
-                            : safeAddresses(hostname, allowedHosts, false);
-                        void resolving.then((addresses) => {
-                            if (lookupOptions.all)
-                                return callback(null, addresses);
-                            const { address, family } = addresses[0];
-                            callback(null, address, family);
-                            return addresses;
-                        }, (error) => callback(error, '', 0));
-                    },
-                }, resolve);
-                request.on('socket', (socket) => {
-                    socket.once('connect', () => {
-                        if (options.allowPrivate === true)
-                            return;
-                        if (allowedHosts.has(current.hostname.replace(/^\[|\]$/g, '').toLowerCase()))
-                            return;
-                        try {
-                            assertPublicAddress(socket.remoteAddress ?? '');
-                        }
-                        catch (error) {
-                            request.destroy(error);
-                        }
+        return await abortable((async () => {
+            let current = new URL(uri);
+            for (let redirect = 0;; redirect++) {
+                if (current.protocol !== 'http:' && current.protocol !== 'https:') {
+                    throw new Error(`unsupported scheme "${current.protocol}"`);
+                }
+                await safeAddresses(current.hostname, allowedHosts, options.allowPrivate === true);
+                signal.throwIfAborted();
+                const response = await new Promise((resolve, reject) => {
+                    const request = (current.protocol === 'http:' ? httpRequest : httpsRequest)(current, {
+                        signal,
+                        lookup: (hostname, lookupOptions, callback) => {
+                            const allowed = options.allowPrivate === true ||
+                                allowedHosts.has(hostname.replace(/^\[|\]$/g, '').toLowerCase());
+                            const resolving = allowed
+                                ? dnsLookup(hostname, { all: lookupOptions.all ?? false }).then((entry) => Array.isArray(entry) ? entry : [entry])
+                                : safeAddresses(hostname, allowedHosts, false);
+                            void resolving.then((addresses) => {
+                                if (lookupOptions.all)
+                                    return callback(null, addresses);
+                                const { address, family } = addresses[0];
+                                callback(null, address, family);
+                                return addresses;
+                            }, (error) => callback(error, '', 0));
+                        },
+                    }, resolve);
+                    request.on('socket', (socket) => {
+                        socket.once('connect', () => {
+                            if (options.allowPrivate === true)
+                                return;
+                            if (allowedHosts.has(current.hostname.replace(/^\[|\]$/g, '').toLowerCase()))
+                                return;
+                            try {
+                                assertPublicAddress(socket.remoteAddress ?? '');
+                            }
+                            catch (error) {
+                                request.destroy(error);
+                            }
+                        });
                     });
+                    request.on('error', reject);
+                    request.end();
                 });
-                request.on('error', reject);
-                request.end();
-            });
-            const status = response.statusCode ?? 0;
-            const location = response.headers.location;
-            if ([301, 302, 303, 307, 308].includes(status) && location) {
-                response.resume();
-                if (redirect >= 5)
-                    throw new Error('too many download redirects');
-                current = new URL(location, current);
-                continue;
-            }
-            if (status < 200 || status >= 300) {
-                response.resume();
-                throw new Error(`HTTP ${status}`);
-            }
-            const declared = Number(response.headers['content-length']);
-            if (declared > MAX_DOWNLOAD_BYTES) {
-                response.destroy();
-                throw new Error(`exceeds the ${MAX_DOWNLOAD_BYTES}-byte download limit`);
-            }
-            const chunks = [];
-            let total = 0;
-            try {
-                for await (const chunk of response) {
-                    total += chunk.byteLength;
-                    if (total > MAX_DOWNLOAD_BYTES) {
-                        throw new Error(`exceeds the ${MAX_DOWNLOAD_BYTES}-byte download limit`);
+                signal.throwIfAborted();
+                const status = response.statusCode ?? 0;
+                const location = response.headers.location;
+                if ([301, 302, 303, 307, 308].includes(status) && location) {
+                    response.resume();
+                    if (redirect >= 5)
+                        throw new Error('too many download redirects');
+                    current = new URL(location, current);
+                    continue;
+                }
+                if (status < 200 || status >= 300) {
+                    response.resume();
+                    throw new Error(`HTTP ${status}`);
+                }
+                const declared = Number(response.headers['content-length']);
+                if (declared > MAX_DOWNLOAD_BYTES) {
+                    response.destroy();
+                    throw new Error(`exceeds the ${MAX_DOWNLOAD_BYTES}-byte download limit`);
+                }
+                const chunks = [];
+                let total = 0;
+                try {
+                    for await (const chunk of response) {
+                        signal.throwIfAborted();
+                        total += chunk.byteLength;
+                        if (total > MAX_DOWNLOAD_BYTES) {
+                            throw new Error(`exceeds the ${MAX_DOWNLOAD_BYTES}-byte download limit`);
+                        }
+                        chunks.push(chunk);
                     }
-                    chunks.push(chunk);
                 }
+                catch (error) {
+                    response.destroy();
+                    throw error;
+                }
+                const contentType = response.headers['content-type'];
+                const mediaType = (Array.isArray(contentType) ? contentType[0] : contentType)
+                    ?.split(';')[0]
+                    .trim();
+                return { bytes: Buffer.concat(chunks, total), mediaType: mediaType || undefined };
             }
-            catch (error) {
-                response.destroy();
-                throw error;
-            }
-            const contentType = response.headers['content-type'];
-            const mediaType = (Array.isArray(contentType) ? contentType[0] : contentType)
-                ?.split(';')[0]
-                .trim();
-            return { bytes: Buffer.concat(chunks, total), mediaType: mediaType || undefined };
-        }
+        })(), signal);
     }
     finally {
         clearTimeout(timeout);

package/lib/executor.js

@@ -83,7 +83,7 @@ export class DshAgentExecutor {
                 await this.bridge.waitForTurn(approval.entry);
                 return;
             }
-            const content = await this.bridge.buildContent(userMessage, contextId);
+            const content = await this.bridge.buildContent(userMessage, contextId, undefined, taskId);
             const { entry, freshTask } = await this.bridge.ensureTask(taskId, contextId);
             eventBus.publish(freshTask
                 ? // First contact: the submitted anchor carries the user message
@@ -108,12 +108,13 @@ export class DshAgentExecutor {
             if (this.bridge.isClearing(contextId))
                 this.suppressTask?.(taskId);
             const message = error instanceof Error ? error.message : String(error);
+            const canceled = error instanceof Error && error.name === 'AbortError';
             if (!anchored) {
-                eventBus.publish(taskEvent(taskId, contextId, TaskState.TASK_STATE_FAILED, {
+                eventBus.publish(taskEvent(taskId, contextId, canceled ? TaskState.TASK_STATE_CANCELED : TaskState.TASK_STATE_FAILED, {
                     message: agentTextMessage(taskId, contextId, message),
                 }));
             }
-            eventBus.publish(terminalStatusUpdate(taskId, contextId, 'failed', message));
+            eventBus.publish(terminalStatusUpdate(taskId, contextId, canceled ? 'canceled' : 'failed', message));
         }
         finally {
             eventBus.finished();