@botbotgo/agent-harness 0.0.186 → 0.0.188

package/README.md

@@ -953,10 +953,12 @@ ACP transport notes:
 
 - `serveAcpStdio(runtime)` exposes newline-delimited JSON-RPC over stdio for local IDE, CLI, or subprocess clients.
 - `serveAcpHttp(runtime)` exposes JSON-RPC over HTTP plus SSE runtime events so remote operator surfaces can connect without importing the runtime in-process.
-- `serveA2aHttp(runtime)` exposes a minimal A2A-compatible HTTP JSON-RPC bridge plus agent card discovery, mapping `message/send`, `tasks/get`, and `tasks/cancel` onto the existing session/request runtime surface.
-- `serveAgUiHttp(runtime)` exposes a minimal AG-UI-compatible HTTP SSE bridge that projects `run + output.delta + final result` onto `RUN_STARTED`, `TEXT_MESSAGE_*`, and `RUN_FINISHED` events for UI clients.
+- `serveA2aHttp(runtime)` exposes an A2A-compatible HTTP JSON-RPC bridge plus agent card discovery, mapping both existing methods such as `message/send` and newer aliases such as `SendMessage`, `GetTask`, `ListTasks`, `CancelTask`, and `SubscribeToTask` onto the existing session/request runtime surface.
+- `serveAgUiHttp(runtime)` exposes an AG-UI-compatible HTTP SSE bridge that projects runtime lifecycle, text output, upstream thinking, step progress, and tool calls onto `RUN_*`, `TEXT_MESSAGE_*`, `THINKING_TEXT_MESSAGE_*`, `STEP_*`, and `TOOL_CALL_*` events for UI clients.
 - `createRuntimeMcpServer(runtime)` and `serveRuntimeMcpOverStdio(runtime)` expose the persisted runtime control surface itself as MCP tools, including sessions, requests, approvals, artifacts, events, and package export helpers.
 - `listRequestEvents(...)` and `exportRequestPackage(...)` are the request-first inspection helpers.
 - `exportRequestPackage(...)` and `exportSessionPackage(...)` package stable runtime records, transcript, approvals, events, and artifacts for operator tooling without reaching into persistence internals.
-- `runtime/default.governance.remoteMcp` can now deny or allow specific MCP servers, raise approval requirements by transport, and stamp transport-based risk tiers into runtime governance bundles.
+- `runtime/default.governance.remoteMcp` can now deny or allow specific MCP servers, raise approval requirements by transport, and stamp transport-based risk tiers into runtime governance bundles. MCP server catalogs can also declare trust tier, access mode, tenant scope, approval policy, prompt-injection risk, and OAuth scope metadata so governance bundles capture why one remote tool is treated as high-risk.
+- `runtime/default.observability.tracing` can now describe exporter metadata such as OTLP endpoints and propagation mode, so frozen runtime snapshots keep trace-correlation plus operator-visible export context without exposing backend-private span internals.
+- `agent-harness runtime health`, `agent-harness runtime approvals list|watch`, and `agent-harness runtime runs list|tail` provide a thin operator CLI over persisted runtime health, approval queues, and active run state.
 - detailed A2A adapter guidance lives in [`docs/a2a-bridge.md`](docs/a2a-bridge.md)

package/README.zh.md

@@ -912,10 +912,12 @@ ACP transport 说明：
 
 - `serveAcpStdio(runtime)` 提供基于 stdio 的 newline-delimited JSON-RPC，适合本地 IDE、CLI 或子进程客户端。
 - `serveAcpHttp(runtime)` 提供基于 HTTP 的 JSON-RPC 与 SSE runtime events，适合远程 operator surface 或独立控制面接入。
-- `serveA2aHttp(runtime)` 提供最小可用的 A2A HTTP JSON-RPC bridge 与 agent card discovery，把 `message/send`、`tasks/get`、`tasks/cancel` 映射到现有 session/request runtime surface。
-- `serveAgUiHttp(runtime)` 提供最小可用的 AG-UI HTTP SSE bridge，把现有 `run + output.delta + final result` 投影成 `RUN_STARTED`、`TEXT_MESSAGE_*` 与 `RUN_FINISHED` 事件，便于 UI 客户端直接接入。
+- `serveA2aHttp(runtime)` 提供 A2A HTTP JSON-RPC bridge 与 agent card discovery，同时兼容 `message/send` 这类旧方法，以及 `SendMessage`、`GetTask`、`ListTasks`、`CancelTask`、`SubscribeToTask` 这类更新的方法别名，并统一映射到现有 session/request runtime surface。
+- `serveAgUiHttp(runtime)` 提供 AG-UI HTTP SSE bridge，把 runtime 生命周期、文本输出、upstream thinking、step 进度与 tool call 投影成 `RUN_*`、`TEXT_MESSAGE_*`、`THINKING_TEXT_MESSAGE_*`、`STEP_*` 与 `TOOL_CALL_*` 事件，便于 UI 客户端直接接入。
 - `createRuntimeMcpServer(runtime)` 与 `serveRuntimeMcpOverStdio(runtime)` 会把持久化 runtime 控制面本身暴露成 MCP tools，包括 sessions、requests、approvals、artifacts、events 与 package export helpers。
 - `listRequestEvents(...)` 与 `exportRequestPackage(...)` 是 request-first 的检查 helper。
 - `exportRequestPackage(...)` 与 `exportSessionPackage(...)` 可把稳定 runtime 记录、transcript、approvals、events 和 artifacts 打包给 operator tooling，而不必直接访问 persistence 内部实现。
-- `runtime/default.governance.remoteMcp` 现在可以按 MCP server 或 transport 做 allow/deny、审批升级，并把 transport 风险等级写进 runtime governance bundles。
+- `runtime/default.governance.remoteMcp` 现在可以按 MCP server 或 transport 做 allow/deny、审批升级，并把 transport 风险等级写进 runtime governance bundles。MCP server catalog 也可以声明 trust tier、access mode、tenant scope、approval policy、prompt-injection risk 与 OAuth scope 元数据，让治理快照能解释为什么某个远端工具被视为高风险。
+- `runtime/default.observability.tracing` 现在可描述 OTLP endpoint 和 propagation mode 这类 exporter 元数据，使冻结的 runtime snapshot 在保留 trace correlation 的同时，也能保留对 operator 有意义的导出上下文，而不暴露 backend 私有 span 细节。
+- `agent-harness runtime health`、`agent-harness runtime approvals list|watch` 与 `agent-harness runtime runs list|tail` 提供了一层轻量 operator CLI，可直接查看 runtime health、审批队列和运行状态。
 - 更详细的 A2A 适配层开发说明见 [`docs/a2a-bridge.md`](docs/a2a-bridge.md)

package/dist/cli.js

@@ -14,6 +14,11 @@ function renderUsage() {
   agent-harness acp serve [--workspace <path>] [--transport stdio|http] [--host <hostname>] [--port <port>]
   agent-harness a2a serve [--workspace <path>] [--host <hostname>] [--port <port>]
   agent-harness ag-ui serve [--workspace <path>] [--host <hostname>] [--port <port>]
+  agent-harness runtime health [--workspace <path>] [--json]
+  agent-harness runtime approvals list [--workspace <path>] [--status <pending|approved|edited|rejected|expired>] [--json]
+  agent-harness runtime approvals watch [--workspace <path>] [--status <pending|approved|edited|rejected|expired>] [--poll-ms <ms>] [--once] [--json]
+  agent-harness runtime runs list [--workspace <path>] [--agent <agentId>] [--thread <threadId>] [--state <state>] [--json]
+  agent-harness runtime runs tail [--workspace <path>] [--agent <agentId>] [--thread <threadId>] [--state <state>] [--poll-ms <ms>] [--once] [--json]
   agent-harness runtime-mcp serve [--workspace <path>]
 `;
 }
@@ -151,6 +156,91 @@ function parseHttpServeOptions(args, serviceLabel = "HTTP") {
     }
     return { workspaceRoot, hostname, port };
 }
+function parseRuntimeInspectOptions(args) {
+    let workspaceRoot;
+    let json = false;
+    let once = false;
+    let pollMs = 1000;
+    let status;
+    let state;
+    let agentId;
+    let threadId;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--workspace" || arg === "--status" || arg === "--state" || arg === "--agent" || arg === "--thread" || arg === "--poll-ms") {
+            const value = args[index + 1];
+            if (!value) {
+                return { json, once, pollMs, status, state, agentId, threadId, error: `Missing value for ${arg}` };
+            }
+            if (arg === "--workspace") {
+                workspaceRoot = value;
+            }
+            else if (arg === "--status") {
+                status = value;
+            }
+            else if (arg === "--state") {
+                state = value;
+            }
+            else if (arg === "--agent") {
+                agentId = value;
+            }
+            else if (arg === "--thread") {
+                threadId = value;
+            }
+            else {
+                const parsedPoll = Number.parseInt(value, 10);
+                if (!Number.isFinite(parsedPoll) || parsedPoll <= 0) {
+                    return { json, once, pollMs, status, state, agentId, threadId, error: `Invalid poll interval: ${value}` };
+                }
+                pollMs = parsedPoll;
+            }
+            index += 1;
+            continue;
+        }
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--once") {
+            once = true;
+            continue;
+        }
+        return { workspaceRoot, json, once, pollMs, status, state, agentId, threadId, error: `Unknown option: ${arg}` };
+    }
+    return { workspaceRoot, json, once, pollMs, status, state, agentId, threadId };
+}
+function renderJson(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+async function sleep(ms) {
+    await new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+function renderApprovalList(approvals) {
+    if (approvals.length === 0) {
+        return "No approvals matched.\n";
+    }
+    return approvals.map((approval) => {
+        const status = typeof approval.status === "string" ? approval.status : "unknown";
+        const toolName = typeof approval.toolName === "string" ? approval.toolName : "unknown_tool";
+        const approvalId = typeof approval.approvalId === "string" ? approval.approvalId : "unknown";
+        const reason = typeof approval.approvalReason === "string" ? ` reason=${approval.approvalReason}` : "";
+        return `${approvalId} status=${status} tool=${toolName}${reason}`;
+    }).join("\n") + "\n";
+}
+function renderRunList(runs) {
+    if (runs.length === 0) {
+        return "No runs matched.\n";
+    }
+    return runs.map((run) => {
+        const runId = typeof run.runId === "string" ? run.runId : "unknown";
+        const threadId = typeof run.threadId === "string" ? run.threadId : "unknown";
+        const agentId = typeof run.agentId === "string" ? run.agentId : "unknown";
+        const state = typeof run.state === "string" ? run.state : "unknown";
+        return `${runId} thread=${threadId} agent=${agentId} state=${state}`;
+    }).join("\n") + "\n";
+}
 export async function runCli(argv, io = {}, deps = {}) {
     const cwd = io.cwd ?? process.cwd();
     const stdout = io.stdout ?? ((message) => process.stdout.write(message));
@@ -320,6 +410,78 @@ export async function runCli(argv, io = {}, deps = {}) {
             return 1;
         }
     }
+    if (command === "runtime") {
+        const [subcommand, possibleNestedCommand, ...remainingArgs] = [projectName, ...rest];
+        if (!subcommand) {
+            stderr(renderUsage());
+            return 1;
+        }
+        const nestedCommand = (subcommand === "approvals" || subcommand === "runs") && possibleNestedCommand
+            ? possibleNestedCommand
+            : undefined;
+        const subcommandArgs = nestedCommand ? remainingArgs : [possibleNestedCommand, ...remainingArgs].filter((item) => typeof item === "string");
+        const parsed = parseRuntimeInspectOptions(subcommandArgs);
+        if (parsed.error) {
+            stderr(`${parsed.error}\n`);
+            stderr(renderUsage());
+            return 1;
+        }
+        try {
+            const runtime = await createHarness(path.resolve(cwd, parsed.workspaceRoot ?? "."));
+            const workspacePath = path.resolve(cwd, parsed.workspaceRoot ?? ".");
+            if (subcommand === "health") {
+                const snapshot = await runtime.getHealth();
+                stdout(parsed.json ? renderJson(snapshot) : `Runtime health ${workspacePath}: ${snapshot.status}\n`);
+                if (!parsed.json) {
+                    stdout(renderJson(snapshot));
+                }
+                await runtime.stop();
+                return 0;
+            }
+            if (subcommand === "approvals" && (nestedCommand === "list" || nestedCommand === "watch")) {
+                const renderApprovals = async () => {
+                    const approvals = await runtime.listApprovals(parsed.status ? { status: parsed.status } : undefined);
+                    stdout(parsed.json ? renderJson(approvals) : renderApprovalList(approvals));
+                };
+                await renderApprovals();
+                if (nestedCommand === "watch" && !parsed.once) {
+                    for (;;) {
+                        await sleep(parsed.pollMs);
+                        await renderApprovals();
+                    }
+                }
+                await runtime.stop();
+                return 0;
+            }
+            if (subcommand === "runs" && (nestedCommand === "list" || nestedCommand === "tail")) {
+                const renderRuns = async () => {
+                    const runs = await runtime.listRuns({
+                        ...(parsed.agentId ? { agentId: parsed.agentId } : {}),
+                        ...(parsed.threadId ? { threadId: parsed.threadId } : {}),
+                        ...(parsed.state ? { state: parsed.state } : {}),
+                    });
+                    stdout(parsed.json ? renderJson(runs) : renderRunList(runs));
+                };
+                await renderRuns();
+                if (nestedCommand === "tail" && !parsed.once) {
+                    for (;;) {
+                        await sleep(parsed.pollMs);
+                        await renderRuns();
+                    }
+                }
+                await runtime.stop();
+                return 0;
+            }
+            await runtime.stop();
+            stderr(renderUsage());
+            return 1;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            stderr(`${message}\n`);
+            return 1;
+        }
+    }
     stderr(renderUsage());
     return 1;
 }

package/dist/config/runtime/workspace.yaml

@@ -150,3 +150,32 @@ spec:
         - socket hang up
         - econnreset
         - timed out
+
+  # agent-harness feature: runtime-owned governance defaults for remote MCP access and approval escalation.
+  # Keep transport-specific and trust-specific policy here rather than scattering it across app code.
+  governance:
+    remoteMcp:
+      requireApprovalTransports:
+        - websocket
+      riskByTransport:
+        http: medium
+        sse: medium
+        websocket: high
+      inputRiskHintsByTransport:
+        http: ["remote-http"]
+        sse: ["remote-sse"]
+        websocket: ["remote-websocket"]
+
+  # agent-harness feature: runtime observability defaults for health and tracing/export alignment.
+  # These settings are runtime-owned metadata for operator tooling and downstream trace/export integration.
+  observability:
+    health:
+      enabled: true
+      evaluateIntervalSeconds: 30
+      emitEvents: true
+    tracing:
+      enabled: true
+      propagation: w3c-tracecontext
+      exporters:
+        - type: otlp-http
+          endpoint: https://otel.example.com/v1/traces

package/dist/contracts/runtime.d.ts

@@ -106,6 +106,12 @@ export type RuntimeGovernanceToolPolicy = {
     category: "local" | "backend" | "mcp" | "provider-native";
     mcpServerRef?: string;
     mcpTransport?: string;
+    mcpTrustTier?: "trusted" | "reviewed" | "untrusted";
+    mcpAccess?: "read-only" | "read-write";
+    tenantScope?: "workspace" | "project" | "tenant" | "cross-tenant";
+    approvalReason?: string;
+    promptInjectionRisk?: RuntimeGovernanceRiskLevel;
+    oauthScopes?: string[];
     risk: RuntimeGovernanceRiskLevel;
     requiresApproval: boolean;
     approvalPolicy: "explicit-hitl" | "runtime-default" | "none";

package/dist/contracts/workspace.d.ts

@@ -72,6 +72,16 @@ export type ParsedMcpServerObject = {
     cwd?: string;
     token?: string;
     headers?: Record<string, string>;
+    trustTier?: "trusted" | "reviewed" | "untrusted";
+    access?: "read-only" | "read-write";
+    tenantScope?: "workspace" | "project" | "tenant" | "cross-tenant";
+    approvalPolicy?: "always" | "write" | "never";
+    promptInjectionRisk?: "low" | "medium" | "high";
+    oauth?: {
+        provider?: string;
+        scopes?: string[];
+    };
+    labels?: string[];
     sourcePath: string;
 };
 export type ParsedToolObject = {
@@ -239,6 +249,7 @@ export type CompiledAgentBinding = {
         capabilities?: RuntimeCapabilities;
         resilience?: Record<string, unknown>;
         governance?: Record<string, unknown>;
+        observability?: Record<string, unknown>;
         deepagent?: {
             description?: string;
             passthrough?: Record<string, unknown>;

package/dist/package-version.d.ts

@@ -1 +1 @@
-export declare const AGENT_HARNESS_VERSION = "0.0.185";
+export declare const AGENT_HARNESS_VERSION = "0.0.187";

package/dist/package-version.js

@@ -1 +1 @@
-export const AGENT_HARNESS_VERSION = "0.0.185";
+export const AGENT_HARNESS_VERSION = "0.0.187";

package/dist/protocol/a2a/http.d.ts

@@ -17,6 +17,7 @@ export type A2aAgentCard = {
     name: string;
     description: string;
     version: string;
+    protocolVersion?: string;
     url: string;
     preferredTransport: "JSONRPC";
     provider?: {
@@ -24,6 +25,9 @@ export type A2aAgentCard = {
         url?: string;
     };
     documentationUrl?: string;
+    defaultAgentId?: string;
+    supportsAuthenticatedExtendedCard?: boolean;
+    supportedInterfaces?: string[];
     capabilities: {
         streaming: boolean;
         pushNotifications: boolean;
@@ -43,6 +47,7 @@ export type A2aTaskState = "submitted" | "working" | "input-required" | "complet
 type A2aTaskStatus = {
     state: A2aTaskState;
     timestamp: string;
+    messageId?: string;
     message?: {
         role: "agent";
         parts: Array<{

package/dist/protocol/a2a/http.js

@@ -97,6 +97,22 @@ function parseTaskLocatorParams(params) {
     }
     return { taskId };
 }
+function parseTaskListParams(params) {
+    if (!params || typeof params !== "object" || Array.isArray(params)) {
+        return { limit: 20 };
+    }
+    const typed = params;
+    const limitValue = typeof typed.limit === "number" && Number.isFinite(typed.limit)
+        ? Math.max(1, Math.min(100, Math.trunc(typed.limit)))
+        : 20;
+    return {
+        ...(typeof typed.agentId === "string" && typed.agentId.trim().length > 0 ? { agentId: typed.agentId.trim() } : {}),
+        ...(typeof typed.contextId === "string" && typed.contextId.trim().length > 0 ? { contextId: typed.contextId.trim() } : {}),
+        ...(typeof typed.state === "string" && typed.state.trim().length > 0 ? { state: typed.state.trim() } : {}),
+        ...(typeof typed.cursor === "string" && typed.cursor.trim().length > 0 ? { cursor: typed.cursor.trim() } : {}),
+        limit: limitValue,
+    };
+}
 function mapRunState(state) {
     switch (state) {
         case "queued":
@@ -134,6 +150,63 @@ function contentToText(content) {
         .trim();
     return text.length > 0 ? text : undefined;
 }
+function toSessionRecord(session) {
+    if (!session) {
+        return null;
+    }
+    return {
+        sessionId: session.threadId,
+        entryAgentId: session.entryAgentId,
+        currentAgentId: session.currentAgentId,
+        currentState: session.currentState,
+        latestRequestId: session.latestRunId,
+        createdAt: session.createdAt,
+        updatedAt: session.updatedAt,
+        messages: session.messages,
+        requests: session.runs.map((run) => ({
+            requestId: run.runId,
+            sessionId: run.threadId,
+            agentId: run.agentId,
+            executionMode: run.executionMode,
+            adapterKind: run.adapterKind,
+            createdAt: run.createdAt,
+            updatedAt: run.updatedAt,
+            state: run.state,
+            checkpointRef: run.checkpointRef,
+            resumable: run.resumable,
+            startedAt: run.startedAt,
+            endedAt: run.endedAt,
+            lastActivityAt: run.lastActivityAt,
+            currentAgentId: run.currentAgentId,
+            delegationChain: run.delegationChain,
+            runtimeSnapshot: run.runtimeSnapshot,
+        })),
+        pendingDecision: session.pendingDecision,
+    };
+}
+function toRequestRecord(request) {
+    if (!request) {
+        return null;
+    }
+    return {
+        requestId: request.runId,
+        sessionId: request.threadId,
+        agentId: request.agentId,
+        executionMode: request.executionMode,
+        adapterKind: request.adapterKind,
+        createdAt: request.createdAt,
+        updatedAt: request.updatedAt,
+        state: request.state,
+        checkpointRef: request.checkpointRef,
+        resumable: request.resumable,
+        startedAt: request.startedAt,
+        endedAt: request.endedAt,
+        lastActivityAt: request.lastActivityAt,
+        currentAgentId: request.currentAgentId,
+        delegationChain: request.delegationChain,
+        runtimeSnapshot: request.runtimeSnapshot,
+    };
+}
 function buildTaskFromSessionAndRequest(session, request, approvals, output, failureMessage) {
     if (!session || !request) {
         return null;
@@ -193,52 +266,22 @@ async function buildTaskFromRuntime(runtime, requestId) {
     }
     const session = await runtime.getThread(request.threadId);
     const approvals = await runtime.listApprovals({ threadId: request.threadId, runId: request.runId });
-    return buildTaskFromSessionAndRequest(session ? {
-        sessionId: session.threadId,
-        entryAgentId: session.entryAgentId,
-        currentAgentId: session.currentAgentId,
-        currentState: session.currentState,
-        latestRequestId: session.latestRunId,
-        createdAt: session.createdAt,
-        updatedAt: session.updatedAt,
-        messages: session.messages,
-        requests: session.runs.map((run) => ({
-            requestId: run.runId,
-            sessionId: run.threadId,
-            agentId: run.agentId,
-            executionMode: run.executionMode,
-            adapterKind: run.adapterKind,
-            createdAt: run.createdAt,
-            updatedAt: run.updatedAt,
-            state: run.state,
-            checkpointRef: run.checkpointRef,
-            resumable: run.resumable,
-            startedAt: run.startedAt,
-            endedAt: run.endedAt,
-            lastActivityAt: run.lastActivityAt,
-            currentAgentId: run.currentAgentId,
-            delegationChain: run.delegationChain,
-            runtimeSnapshot: run.runtimeSnapshot,
-        })),
-        pendingDecision: session.pendingDecision,
-    } : null, {
-        requestId: request.runId,
-        sessionId: request.threadId,
-        agentId: request.agentId,
-        executionMode: request.executionMode,
-        adapterKind: request.adapterKind,
-        createdAt: request.createdAt,
-        updatedAt: request.updatedAt,
-        state: request.state,
-        checkpointRef: request.checkpointRef,
-        resumable: request.resumable,
-        startedAt: request.startedAt,
-        endedAt: request.endedAt,
-        lastActivityAt: request.lastActivityAt,
-        currentAgentId: request.currentAgentId,
-        delegationChain: request.delegationChain,
-        runtimeSnapshot: request.runtimeSnapshot,
-    }, approvals);
+    return buildTaskFromSessionAndRequest(toSessionRecord(session), toRequestRecord(request), approvals);
+}
+async function listTasksFromRuntime(runtime, params) {
+    const runs = await runtime.listRuns({
+        ...(params.agentId ? { agentId: params.agentId } : {}),
+        ...(params.contextId ? { threadId: params.contextId } : {}),
+        ...(params.state ? { state: params.state } : {}),
+    });
+    const startIndex = params.cursor ? Number.parseInt(Buffer.from(params.cursor, "base64url").toString("utf8"), 10) || 0 : 0;
+    const page = runs.slice(startIndex, startIndex + params.limit);
+    const tasks = (await Promise.all(page.map((run) => buildTaskFromRuntime(runtime, run.runId)))).filter((task) => Boolean(task));
+    const nextIndex = startIndex + page.length;
+    return {
+        tasks,
+        ...(nextIndex < runs.length ? { nextCursor: Buffer.from(String(nextIndex), "utf8").toString("base64url") } : {}),
+    };
 }
 function buildAgentCard(runtime, options) {
     const inventory = runtime.describeWorkspaceInventory();
@@ -253,8 +296,23 @@ function buildAgentCard(runtime, options) {
         name: options.agentName,
         description: options.agentDescription,
         version: "0.1.0",
+        protocolVersion: "1.0",
         url: options.rpcUrl,
         preferredTransport: "JSONRPC",
+        supportsAuthenticatedExtendedCard: false,
+        supportedInterfaces: [
+            "message/send",
+            "tasks/send",
+            "tasks/get",
+            "tasks/list",
+            "tasks/cancel",
+            "tasks/subscribe",
+            "SendMessage",
+            "GetTask",
+            "ListTasks",
+            "CancelTask",
+            "SubscribeToTask",
+        ],
         capabilities: {
             streaming: false,
             pushNotifications: false,
@@ -302,7 +360,7 @@ export async function serveA2aOverHttp(runtime, options = {}) {
                     return;
                 }
                 try {
-                    if (payload.method === "message/send" || payload.method === "tasks/send") {
+                    if (payload.method === "message/send" || payload.method === "tasks/send" || payload.method === "SendMessage") {
                         const parsed = parseMessageSendParams(payload.params);
                         const result = await runtime.run({
                             agentId: parsed.agentId ?? options.defaultAgentId,
@@ -313,56 +371,11 @@ export async function serveA2aOverHttp(runtime, options = {}) {
                         const session = await runtime.getThread(result.threadId);
                         const requestRecord = await runtime.getRun(result.runId);
                         const approvals = await runtime.listApprovals({ threadId: result.threadId, runId: result.runId });
-                        const task = buildTaskFromSessionAndRequest(session ? {
-                            sessionId: session.threadId,
-                            entryAgentId: session.entryAgentId,
-                            currentAgentId: session.currentAgentId,
-                            currentState: session.currentState,
-                            latestRequestId: session.latestRunId,
-                            createdAt: session.createdAt,
-                            updatedAt: session.updatedAt,
-                            messages: session.messages,
-                            requests: session.runs.map((run) => ({
-                                requestId: run.runId,
-                                sessionId: run.threadId,
-                                agentId: run.agentId,
-                                executionMode: run.executionMode,
-                                adapterKind: run.adapterKind,
-                                createdAt: run.createdAt,
-                                updatedAt: run.updatedAt,
-                                state: run.state,
-                                checkpointRef: run.checkpointRef,
-                                resumable: run.resumable,
-                                startedAt: run.startedAt,
-                                endedAt: run.endedAt,
-                                lastActivityAt: run.lastActivityAt,
-                                currentAgentId: run.currentAgentId,
-                                delegationChain: run.delegationChain,
-                                runtimeSnapshot: run.runtimeSnapshot,
-                            })),
-                            pendingDecision: session.pendingDecision,
-                        } : null, requestRecord ? {
-                            requestId: requestRecord.runId,
-                            sessionId: requestRecord.threadId,
-                            agentId: requestRecord.agentId,
-                            executionMode: requestRecord.executionMode,
-                            adapterKind: requestRecord.adapterKind,
-                            createdAt: requestRecord.createdAt,
-                            updatedAt: requestRecord.updatedAt,
-                            state: requestRecord.state,
-                            checkpointRef: requestRecord.checkpointRef,
-                            resumable: requestRecord.resumable,
-                            startedAt: requestRecord.startedAt,
-                            endedAt: requestRecord.endedAt,
-                            lastActivityAt: requestRecord.lastActivityAt,
-                            currentAgentId: requestRecord.currentAgentId,
-                            delegationChain: requestRecord.delegationChain,
-                            runtimeSnapshot: requestRecord.runtimeSnapshot,
-                        } : null, approvals, result.output);
+                        const task = buildTaskFromSessionAndRequest(toSessionRecord(session), toRequestRecord(requestRecord), approvals, result.output);
                         writeJson(response, 200, toSuccess(payload.id ?? null, task));
                         return;
                     }
-                    if (payload.method === "tasks/get") {
+                    if (payload.method === "tasks/get" || payload.method === "GetTask") {
                         const { taskId } = parseTaskLocatorParams(payload.params);
                         const task = await buildTaskFromRuntime(runtime, taskId);
                         if (!task) {
@@ -372,13 +385,35 @@ export async function serveA2aOverHttp(runtime, options = {}) {
                         writeJson(response, 200, toSuccess(payload.id ?? null, task));
                         return;
                     }
-                    if (payload.method === "tasks/cancel") {
+                    if (payload.method === "tasks/list" || payload.method === "ListTasks") {
+                        const taskList = await listTasksFromRuntime(runtime, parseTaskListParams(payload.params));
+                        writeJson(response, 200, toSuccess(payload.id ?? null, taskList));
+                        return;
+                    }
+                    if (payload.method === "tasks/cancel" || payload.method === "CancelTask") {
                         const { taskId } = parseTaskLocatorParams(payload.params);
                         const result = await runtime.cancelRun({ runId: taskId, reason: "Cancelled via A2A bridge." });
                         const task = await buildTaskFromRuntime(runtime, result.runId);
                         writeJson(response, 200, toSuccess(payload.id ?? null, task));
                         return;
                     }
+                    if (payload.method === "tasks/subscribe" || payload.method === "SubscribeToTask") {
+                        const { taskId } = parseTaskLocatorParams(payload.params);
+                        const task = await buildTaskFromRuntime(runtime, taskId);
+                        if (!task) {
+                            writeJson(response, 200, toError(payload.id ?? null, -32004, "Task not found."));
+                            return;
+                        }
+                        writeJson(response, 200, toSuccess(payload.id ?? null, {
+                            task,
+                            streamable: false,
+                            pushNotifications: false,
+                            nextPollAfterMs: task.status.state === "completed" || task.status.state === "failed" || task.status.state === "canceled"
+                                ? 0
+                                : 1_000,
+                        }));
+                        return;
+                    }
                     writeJson(response, 200, toError(payload.id ?? null, -32601, `Unknown A2A method: ${payload.method}`));
                 }
                 catch (error) {

package/dist/protocol/ag-ui/http.d.ts

@@ -20,6 +20,28 @@ export type AgUiEvent = (AgUiBaseEvent & {
     threadId: string;
     runId: string;
     input?: MessageContent;
+}) | (AgUiBaseEvent & {
+    type: "STEP_STARTED";
+    stepId: string;
+    title: string;
+    category: "llm" | "tool" | "skill" | "memory" | "chain" | "approval";
+}) | (AgUiBaseEvent & {
+    type: "STEP_FINISHED";
+    stepId: string;
+    title: string;
+    category: "llm" | "tool" | "skill" | "memory" | "chain" | "approval";
+    status: "completed" | "failed";
+}) | (AgUiBaseEvent & {
+    type: "THINKING_TEXT_MESSAGE_START";
+    messageId: string;
+    role: "assistant";
+}) | (AgUiBaseEvent & {
+    type: "THINKING_TEXT_MESSAGE_CONTENT";
+    messageId: string;
+    delta: string;
+}) | (AgUiBaseEvent & {
+    type: "THINKING_TEXT_MESSAGE_END";
+    messageId: string;
 }) | (AgUiBaseEvent & {
     type: "TEXT_MESSAGE_START";
     messageId: string;
@@ -31,6 +53,25 @@ export type AgUiEvent = (AgUiBaseEvent & {
 }) | (AgUiBaseEvent & {
     type: "TEXT_MESSAGE_END";
     messageId: string;
+}) | (AgUiBaseEvent & {
+    type: "TOOL_CALL_START";
+    toolCallId: string;
+    toolName: string;
+}) | (AgUiBaseEvent & {
+    type: "TOOL_CALL_ARGS";
+    toolCallId: string;
+    toolName: string;
+    args: unknown;
+}) | (AgUiBaseEvent & {
+    type: "TOOL_CALL_RESULT";
+    toolCallId: string;
+    toolName: string;
+    result: unknown;
+    isError?: boolean;
+}) | (AgUiBaseEvent & {
+    type: "TOOL_CALL_END";
+    toolCallId: string;
+    toolName: string;
 }) | (AgUiBaseEvent & {
     type: "RUN_FINISHED";
     threadId: string;

package/dist/protocol/ag-ui/http.js

@@ -1,5 +1,6 @@
 import { createServer } from "node:http";
 import { createPersistentId } from "../../utils/id.js";
+import { createUpstreamTimelineReducer } from "../../upstream-events.js";
 function normalizePath(value, fallback) {
     const source = typeof value === "string" && value.trim().length > 0 ? value.trim() : fallback;
     return source.startsWith("/") ? source : `/${source}`;
@@ -55,6 +56,63 @@ function toRunStarted(event, input) {
         input,
     };
 }
+function asObject(value) {
+    return typeof value === "object" && value !== null ? value : null;
+}
+function readUpstreamEventName(event) {
+    return typeof asObject(event)?.event === "string" ? String(asObject(event)?.event) : "";
+}
+function readUpstreamToolName(event) {
+    return typeof asObject(event)?.name === "string" ? String(asObject(event)?.name) : "";
+}
+function readUpstreamRunType(event) {
+    return typeof asObject(event)?.run_type === "string" ? String(asObject(event)?.run_type) : "";
+}
+function isToolStartEvent(event) {
+    const eventName = readUpstreamEventName(event);
+    return eventName === "on_tool_start" || (eventName === "on_chain_start" && readUpstreamRunType(event) === "tool");
+}
+function isToolTerminalEvent(event) {
+    const eventName = readUpstreamEventName(event);
+    return eventName === "on_tool_end"
+        || eventName === "on_tool_error"
+        || ((eventName === "on_chain_end" || eventName === "on_chain_error") && readUpstreamRunType(event) === "tool");
+}
+function readToolArgs(event) {
+    const typed = asObject(event);
+    const data = asObject(typed?.data);
+    if (!data || !("input" in data)) {
+        return undefined;
+    }
+    return data.input;
+}
+function createToolCallState() {
+    const activeToolCallIds = new Map();
+    return {
+        start(toolName) {
+            const toolCallId = `tool-${createPersistentId()}`;
+            const activeIds = activeToolCallIds.get(toolName) ?? [];
+            activeIds.push(toolCallId);
+            activeToolCallIds.set(toolName, activeIds);
+            return toolCallId;
+        },
+        peek(toolName) {
+            const activeIds = activeToolCallIds.get(toolName);
+            return activeIds?.at(-1);
+        },
+        finish(toolName) {
+            const activeIds = activeToolCallIds.get(toolName);
+            if (!activeIds || activeIds.length === 0) {
+                return undefined;
+            }
+            const toolCallId = activeIds.pop();
+            if (!activeIds.length) {
+                activeToolCallIds.delete(toolName);
+            }
+            return toolCallId;
+        },
+    };
+}
 export async function serveAgUiOverHttp(runtime, options = {}) {
     const hostname = options.hostname?.trim() || "127.0.0.1";
     const port = typeof options.port === "number" && Number.isFinite(options.port) ? options.port : 0;
@@ -74,7 +132,11 @@ export async function serveAgUiOverHttp(runtime, options = {}) {
         let runId;
         let threadId;
         let messageId;
+        let thinkingMessageId;
         let textMessageStarted = false;
+        let thinkingMessageStarted = false;
+        const toolCalls = createToolCallState();
+        const upstreamReducer = createUpstreamTimelineReducer();
         const ensureTextStart = async () => {
             if (textMessageStarted) {
                 return;
@@ -88,6 +150,37 @@ export async function serveAgUiOverHttp(runtime, options = {}) {
                 role: "assistant",
             });
         };
+        const ensureThinkingTextStart = async () => {
+            if (thinkingMessageStarted) {
+                return;
+            }
+            thinkingMessageId = thinkingMessageId ?? `thinking-${createPersistentId()}`;
+            thinkingMessageStarted = true;
+            await writeSseEvent(response, {
+                type: "THINKING_TEXT_MESSAGE_START",
+                timestamp: createTimestamp(),
+                messageId: thinkingMessageId,
+                role: "assistant",
+            });
+        };
+        const closeOpenMessages = async () => {
+            if (thinkingMessageStarted) {
+                await writeSseEvent(response, {
+                    type: "THINKING_TEXT_MESSAGE_END",
+                    timestamp: createTimestamp(),
+                    messageId: thinkingMessageId,
+                });
+                thinkingMessageStarted = false;
+            }
+            if (textMessageStarted) {
+                await writeSseEvent(response, {
+                    type: "TEXT_MESSAGE_END",
+                    timestamp: createTimestamp(),
+                    messageId: messageId,
+                });
+                textMessageStarted = false;
+            }
+        };
         try {
             const body = await readRequestBody(request);
             const input = parseRunInput(JSON.parse(body));
@@ -120,6 +213,92 @@ export async function serveAgUiOverHttp(runtime, options = {}) {
                             });
                         }
                     },
+                    onUpstreamEvent: async (event) => {
+                        const eventName = readUpstreamEventName(event);
+                        const toolName = readUpstreamToolName(event);
+                        if (isToolStartEvent(event) && toolName) {
+                            const toolCallId = toolCalls.start(toolName);
+                            await writeSseEvent(response, {
+                                type: "TOOL_CALL_START",
+                                timestamp: createTimestamp(),
+                                toolCallId,
+                                toolName,
+                            });
+                            const args = readToolArgs(event);
+                            if (args !== undefined) {
+                                await writeSseEvent(response, {
+                                    type: "TOOL_CALL_ARGS",
+                                    timestamp: createTimestamp(),
+                                    toolCallId,
+                                    toolName,
+                                    args,
+                                });
+                            }
+                        }
+                        const projections = upstreamReducer.consume(event);
+                        for (const projection of projections) {
+                            if (projection.type === "thinking") {
+                                if (!projection.text) {
+                                    continue;
+                                }
+                                await ensureThinkingTextStart();
+                                await writeSseEvent(response, {
+                                    type: "THINKING_TEXT_MESSAGE_CONTENT",
+                                    timestamp: createTimestamp(),
+                                    messageId: thinkingMessageId,
+                                    delta: projection.text,
+                                });
+                                continue;
+                            }
+                            if (projection.type === "step") {
+                                if (projection.status === "started") {
+                                    await writeSseEvent(response, {
+                                        type: "STEP_STARTED",
+                                        timestamp: createTimestamp(),
+                                        stepId: projection.key,
+                                        title: projection.step,
+                                        category: projection.category,
+                                    });
+                                    continue;
+                                }
+                                await writeSseEvent(response, {
+                                    type: "STEP_FINISHED",
+                                    timestamp: createTimestamp(),
+                                    stepId: projection.key,
+                                    title: projection.step,
+                                    category: projection.category,
+                                    status: projection.status,
+                                });
+                                continue;
+                            }
+                            const toolCallId = toolCalls.peek(projection.toolName) ?? toolCalls.start(projection.toolName);
+                            await writeSseEvent(response, {
+                                type: "TOOL_CALL_RESULT",
+                                timestamp: createTimestamp(),
+                                toolCallId,
+                                toolName: projection.toolName,
+                                result: projection.output,
+                                ...(projection.isError !== undefined ? { isError: projection.isError } : {}),
+                            });
+                        }
+                        if (isToolTerminalEvent(event) && toolName) {
+                            const toolCallId = toolCalls.finish(toolName) ?? `tool-${createPersistentId()}`;
+                            await writeSseEvent(response, {
+                                type: "TOOL_CALL_END",
+                                timestamp: createTimestamp(),
+                                toolCallId,
+                                toolName,
+                            });
+                        }
+                        if (eventName === "on_chat_model_end" && thinkingMessageStarted) {
+                            await writeSseEvent(response, {
+                                type: "THINKING_TEXT_MESSAGE_END",
+                                timestamp: createTimestamp(),
+                                messageId: thinkingMessageId,
+                            });
+                            thinkingMessageStarted = false;
+                        }
+                    },
                 },
             });
             runId = runId ?? result.runId;
@@ -133,13 +312,7 @@ export async function serveAgUiOverHttp(runtime, options = {}) {
                     delta: result.output,
                 });
             }
-            if (textMessageStarted) {
-                await writeSseEvent(response, {
-                    type: "TEXT_MESSAGE_END",
-                    timestamp: createTimestamp(),
-                    messageId: messageId,
-                });
-            }
+            await closeOpenMessages();
             await writeSseEvent(response, {
                 type: "RUN_FINISHED",
                 timestamp: createTimestamp(),
@@ -151,6 +324,7 @@ export async function serveAgUiOverHttp(runtime, options = {}) {
             });
         }
         catch (error) {
+            await closeOpenMessages();
             await writeSseEvent(response, {
                 type: "RUN_ERROR",
                 timestamp: createTimestamp(),

package/dist/resource/mcp-tool-support.d.ts

@@ -9,6 +9,16 @@ export type McpServerConfig = {
     url?: string;
     token?: string;
     headers?: Record<string, string>;
+    trustTier?: "trusted" | "reviewed" | "untrusted";
+    access?: "read-only" | "read-write";
+    tenantScope?: "workspace" | "project" | "tenant" | "cross-tenant";
+    approvalPolicy?: "always" | "write" | "never";
+    promptInjectionRisk?: "low" | "medium" | "high";
+    oauth?: {
+        provider?: string;
+        scopes?: string[];
+    };
+    labels?: string[];
 };
 export type McpToolDescriptor = {
     name: string;

package/dist/resource/mcp-tool-support.js

@@ -14,6 +14,13 @@ function readStringRecord(value) {
     const entries = Object.entries(value).filter((entry) => typeof entry[1] === "string");
     return entries.length > 0 ? Object.fromEntries(entries) : undefined;
 }
+function readStringArray(value) {
+    if (!Array.isArray(value)) {
+        return undefined;
+    }
+    const entries = value.filter((item) => typeof item === "string" && item.trim().length > 0).map((item) => item.trim());
+    return entries.length > 0 ? entries : undefined;
+}
 function normalizeMcpTransport(value) {
     if (value === "stdio" || value === "http" || value === "sse" || value === "websocket") {
         return value;
@@ -40,6 +47,13 @@ export function readMcpServerConfig(workspace, tool) {
             url: server.url,
             token: server.token,
             headers: server.headers,
+            trustTier: server.trustTier,
+            access: server.access,
+            tenantScope: server.tenantScope,
+            approvalPolicy: server.approvalPolicy,
+            promptInjectionRisk: server.promptInjectionRisk,
+            oauth: server.oauth,
+            labels: server.labels,
         };
     }
     const config = typeof tool.config === "object" && tool.config
@@ -60,6 +74,31 @@ export function readMcpServerConfig(workspace, tool) {
         url: typeof mcpServer.url === "string" ? mcpServer.url.trim() : undefined,
         token: typeof mcpServer.token === "string" ? mcpServer.token : undefined,
         headers: readStringRecord(mcpServer.headers),
+        trustTier: mcpServer.trustTier === "trusted" || mcpServer.trustTier === "reviewed" || mcpServer.trustTier === "untrusted"
+            ? mcpServer.trustTier
+            : undefined,
+        access: mcpServer.access === "read-only" || mcpServer.access === "read-write" ? mcpServer.access : undefined,
+        tenantScope: mcpServer.tenantScope === "workspace" ||
+            mcpServer.tenantScope === "project" ||
+            mcpServer.tenantScope === "tenant" ||
+            mcpServer.tenantScope === "cross-tenant"
+            ? mcpServer.tenantScope
+            : undefined,
+        approvalPolicy: mcpServer.approvalPolicy === "always" || mcpServer.approvalPolicy === "write" || mcpServer.approvalPolicy === "never"
+            ? mcpServer.approvalPolicy
+            : undefined,
+        promptInjectionRisk: mcpServer.promptInjectionRisk === "low" || mcpServer.promptInjectionRisk === "medium" || mcpServer.promptInjectionRisk === "high"
+            ? mcpServer.promptInjectionRisk
+            : undefined,
+        oauth: typeof mcpServer.oauth === "object" && mcpServer.oauth
+            ? {
+                provider: typeof mcpServer.oauth.provider === "string"
+                    ? mcpServer.oauth.provider
+                    : undefined,
+                scopes: readStringArray(mcpServer.oauth.scopes),
+            }
+            : undefined,
+        labels: readStringArray(mcpServer.labels),
     };
 }
 function createMcpCacheKey(config) {
@@ -72,6 +111,13 @@ function createMcpCacheKey(config) {
         url: config.url ?? "",
         token: config.token ?? "",
         headers: config.headers ?? {},
+        trustTier: config.trustTier ?? "",
+        access: config.access ?? "",
+        tenantScope: config.tenantScope ?? "",
+        approvalPolicy: config.approvalPolicy ?? "",
+        promptInjectionRisk: config.promptInjectionRisk ?? "",
+        oauth: config.oauth ?? {},
+        labels: config.labels ?? [],
     });
 }
 async function createConnectedMcpClient(config) {

package/dist/runtime/harness/run/governance.js

@@ -23,6 +23,12 @@ function classifyRisk(policy) {
     if (policy.requiresApproval) {
         return "high";
     }
+    if (policy.mcpTrustTier === "untrusted" || policy.tenantScope === "cross-tenant" || policy.promptInjectionRisk === "high") {
+        return "high";
+    }
+    if (policy.mcpAccess === "read-write" || policy.promptInjectionRisk === "medium") {
+        return "medium";
+    }
     const target = `${policy.toolName} ${policy.description}`;
     if (policy.toolType === "mcp" && WRITE_LIKE_PATTERN.test(target)) {
         return "high";
@@ -69,12 +75,27 @@ function readRemoteMcpMetadata(tool) {
     const config = asObject(tool.config);
     const mcpReference = asObject(config?.mcp);
     const inlineServer = asObject(config?.mcpServer);
+    const oauth = asObject(inlineServer?.oauth);
     const transport = typeof inlineServer?.transport === "string" && inlineServer.transport.trim().length > 0
         ? inlineServer.transport.trim()
         : undefined;
+    const readEnum = (value, allowed) => typeof value === "string" && allowed.includes(value) ? value : undefined;
+    const oauthScopes = readStringArray(oauth?.scopes);
     return {
         ...(normalizeServerRef(mcpReference?.serverRef) ? { serverRef: normalizeServerRef(mcpReference?.serverRef) } : {}),
         ...(transport ? { transport } : {}),
+        ...(readEnum(inlineServer?.trustTier, ["trusted", "reviewed", "untrusted"]) ? { trustTier: readEnum(inlineServer?.trustTier, ["trusted", "reviewed", "untrusted"]) } : {}),
+        ...(readEnum(inlineServer?.access, ["read-only", "read-write"]) ? { access: readEnum(inlineServer?.access, ["read-only", "read-write"]) } : {}),
+        ...(readEnum(inlineServer?.tenantScope, ["workspace", "project", "tenant", "cross-tenant"])
+            ? { tenantScope: readEnum(inlineServer?.tenantScope, ["workspace", "project", "tenant", "cross-tenant"]) }
+            : {}),
+        ...(readEnum(inlineServer?.approvalPolicy, ["always", "write", "never"])
+            ? { approvalPolicy: readEnum(inlineServer?.approvalPolicy, ["always", "write", "never"]) }
+            : {}),
+        ...(readEnum(inlineServer?.promptInjectionRisk, ["low", "medium", "high"])
+            ? { promptInjectionRisk: readEnum(inlineServer?.promptInjectionRisk, ["low", "medium", "high"]) }
+            : {}),
+        ...(oauthScopes.length > 0 ? { oauthScopes } : {}),
     };
 }
 function matchesToolPolicy(rule, policy) {
@@ -156,8 +177,34 @@ function applyRemoteMcpGovernance(binding, policies) {
 }
 export function buildRuntimeGovernanceBundles(binding) {
     const toolPolicies = applyGovernanceOverrides(binding, applyRemoteMcpGovernance(binding, getBindingPrimaryTools(binding).map((tool) => {
-        const requiresApproval = toolRequiresRuntimeApproval(tool);
         const remoteMcp = readRemoteMcpMetadata(tool);
+        const writeLikeRemoteMcp = tool.type === "mcp" && (remoteMcp.access === "read-write" || WRITE_LIKE_PATTERN.test(`${tool.name} ${tool.description}`));
+        const requiresApproval = toolRequiresRuntimeApproval(tool) ||
+            remoteMcp.trustTier === "untrusted" ||
+            remoteMcp.approvalPolicy === "always" ||
+            (remoteMcp.approvalPolicy === "write" && writeLikeRemoteMcp) ||
+            remoteMcp.tenantScope === "cross-tenant";
+        const approvalReason = remoteMcp.trustTier === "untrusted"
+            ? "untrusted-mcp-server"
+            : remoteMcp.tenantScope === "cross-tenant"
+                ? "cross-tenant-mcp-access"
+                : remoteMcp.approvalPolicy === "always"
+                    ? "remote-mcp-approval-policy"
+                    : remoteMcp.approvalPolicy === "write" && writeLikeRemoteMcp
+                        ? "high-risk-mcp-write"
+                        : requiresApproval && tool.type === "mcp"
+                            ? "high-risk-mcp-write"
+                            : undefined;
+        const inputRiskHints = inputHints(binding, tool);
+        if (remoteMcp.access === "read-write") {
+            inputRiskHints.push("remote-write-access");
+        }
+        if (remoteMcp.tenantScope === "cross-tenant") {
+            inputRiskHints.push("cross-tenant-scope");
+        }
+        if (remoteMcp.promptInjectionRisk) {
+            inputRiskHints.push(`prompt-injection-${remoteMcp.promptInjectionRisk}`);
+        }
         return {
             toolName: tool.name,
             toolId: tool.id,
@@ -165,17 +212,27 @@ export function buildRuntimeGovernanceBundles(binding) {
             category: toCategory(tool.type),
             ...(remoteMcp.serverRef ? { mcpServerRef: remoteMcp.serverRef } : {}),
             ...(remoteMcp.transport ? { mcpTransport: remoteMcp.transport } : {}),
+            ...(remoteMcp.trustTier ? { mcpTrustTier: remoteMcp.trustTier } : {}),
+            ...(remoteMcp.access ? { mcpAccess: remoteMcp.access } : {}),
+            ...(remoteMcp.tenantScope ? { tenantScope: remoteMcp.tenantScope } : {}),
+            ...(remoteMcp.promptInjectionRisk ? { promptInjectionRisk: remoteMcp.promptInjectionRisk } : {}),
+            ...(remoteMcp.oauthScopes && remoteMcp.oauthScopes.length > 0 ? { oauthScopes: remoteMcp.oauthScopes } : {}),
+            ...(approvalReason ? { approvalReason } : {}),
             risk: classifyRisk({
                 toolType: tool.type,
                 requiresApproval,
                 toolName: tool.name,
                 description: tool.description,
                 config: tool.config,
+                mcpTrustTier: remoteMcp.trustTier,
+                mcpAccess: remoteMcp.access,
+                tenantScope: remoteMcp.tenantScope,
+                promptInjectionRisk: remoteMcp.promptInjectionRisk,
             }),
             requiresApproval,
             approvalPolicy: tool.hitl?.enabled === true ? "explicit-hitl" : requiresApproval ? "runtime-default" : "none",
             hasInputSchema: compiledToolHasInputSchema(tool),
-            inputRiskHints: inputHints(binding, tool),
+            inputRiskHints: Array.from(new Set(inputRiskHints)),
         };
     })));
     if (toolPolicies.length === 0) {

package/dist/runtime/harness/run/inspection.js

@@ -20,8 +20,28 @@ function readTracingConfig(binding) {
 }
 function buildRuntimeSnapshotTracing(binding, runId) {
     const tracing = readTracingConfig(binding);
+    const observability = asObject(binding.harnessRuntime.observability);
+    const runtimeTracing = asObject(observability?.tracing);
+    const exporters = Array.isArray(runtimeTracing?.exporters)
+        ? runtimeTracing.exporters
+            .filter((item) => typeof item === "object" && item !== null && !Array.isArray(item))
+            .map((item) => ({
+            type: typeof item.type === "string" ? item.type : "custom",
+            ...(typeof item.endpoint === "string" ? { endpoint: item.endpoint } : {}),
+        }))
+        : [];
     if (!tracing) {
-        return undefined;
+        if (!runtimeTracing || runId === undefined || runtimeTracing.enabled === false) {
+            return undefined;
+        }
+        return {
+            enabled: true,
+            correlationId: runId,
+            metadata: {
+                ...(typeof runtimeTracing.propagation === "string" ? { propagation: runtimeTracing.propagation } : {}),
+                ...(exporters.length > 0 ? { exporters } : {}),
+            },
+        };
     }
     const enabled = tracing.enabled !== false;
     if (!enabled || !runId) {
@@ -33,7 +53,15 @@ function buildRuntimeSnapshotTracing(binding, runId) {
         enabled: true,
         correlationId: runId,
         ...(tags.length > 0 ? { tags } : {}),
-        ...(metadata && Object.keys(metadata).length > 0 ? { metadata: { ...metadata } } : {}),
+        ...((metadata && Object.keys(metadata).length > 0) || exporters.length > 0 || typeof runtimeTracing?.propagation === "string"
+            ? {
+                metadata: {
+                    ...(metadata ? { ...metadata } : {}),
+                    ...(typeof runtimeTracing?.propagation === "string" ? { propagation: runtimeTracing.propagation } : {}),
+                    ...(exporters.length > 0 ? { exporters } : {}),
+                },
+            }
+            : {}),
     };
 }
 export function buildRunRuntimeSnapshot(binding, options) {

package/dist/workspace/agent-binding-compiler.js

@@ -341,6 +341,7 @@ export function compileBinding(workspaceRoot, agent, agents, referencedSubagentI
         ? asObject(runtimeDefaults?.filesystem)
         : undefined;
     const runtimeGovernanceDefaults = asObject(runtimeDefaults?.governance);
+    const runtimeObservabilityDefaults = asObject(runtimeDefaults?.observability);
     const compiledFilesystemConfig = agent.executionMode === "langchain-v1"
         ? mergeConfigObjects(runtimeFilesystemDefaults, getAgentExecutionObject(agent, "filesystem", { executionMode: "langchain-v1" }))
         : undefined;
@@ -357,6 +358,7 @@ export function compileBinding(workspaceRoot, agent, agents, referencedSubagentI
             capabilities: inferAgentCapabilities(agent),
             resilience,
             ...(runtimeGovernanceDefaults ? { governance: runtimeGovernanceDefaults } : {}),
+            ...(runtimeObservabilityDefaults ? { observability: runtimeObservabilityDefaults } : {}),
             ...(agent.executionMode === "deepagent"
                 ? {
                     deepagent: {

package/dist/workspace/resource-compilers.js

@@ -117,6 +117,7 @@ export function parseMcpServerObject(object) {
     const value = object.value;
     const env = asObject(value.env);
     const headers = asObject(value.headers);
+    const oauth = asObject(value.oauth);
     const transport = String(value.transport ??
         (typeof value.url === "string" && value.url.trim() ? "http" : undefined) ??
         (typeof value.command === "string" && value.command.trim() ? "stdio" : undefined) ??
@@ -131,6 +132,29 @@ export function parseMcpServerObject(object) {
         cwd: typeof value.cwd === "string" ? value.cwd : undefined,
         token: typeof value.token === "string" ? value.token : undefined,
         headers: headers ? Object.fromEntries(Object.entries(headers).filter((entry) => typeof entry[1] === "string")) : undefined,
+        trustTier: value.trustTier === "trusted" || value.trustTier === "reviewed" || value.trustTier === "untrusted"
+            ? value.trustTier
+            : undefined,
+        access: value.access === "read-only" || value.access === "read-write" ? value.access : undefined,
+        tenantScope: value.tenantScope === "workspace" ||
+            value.tenantScope === "project" ||
+            value.tenantScope === "tenant" ||
+            value.tenantScope === "cross-tenant"
+            ? value.tenantScope
+            : undefined,
+        approvalPolicy: value.approvalPolicy === "always" || value.approvalPolicy === "write" || value.approvalPolicy === "never"
+            ? value.approvalPolicy
+            : undefined,
+        promptInjectionRisk: value.promptInjectionRisk === "low" || value.promptInjectionRisk === "medium" || value.promptInjectionRisk === "high"
+            ? value.promptInjectionRisk
+            : undefined,
+        oauth: oauth
+            ? {
+                provider: typeof oauth.provider === "string" ? oauth.provider : undefined,
+                scopes: asStringArray(oauth.scopes),
+            }
+            : undefined,
+        labels: asStringArray(value.labels),
         sourcePath: object.sourcePath,
     };
 }

package/dist/workspace/tool-hydration.js

@@ -15,6 +15,13 @@ function toMcpServerConfig(server) {
         url: server.url,
         token: server.token,
         headers: server.headers,
+        trustTier: server.trustTier,
+        access: server.access,
+        tenantScope: server.tenantScope,
+        approvalPolicy: server.approvalPolicy,
+        promptInjectionRisk: server.promptInjectionRisk,
+        oauth: server.oauth,
+        labels: server.labels,
     };
 }
 function readStringArray(value) {
@@ -108,6 +115,29 @@ function mergeReferencedMcpServer(referencedServer, item, agentId, name, sourceP
             ...(referencedServer.headers ?? {}),
             ...(readStringRecord(item.headers) ?? {}),
         },
+        trustTier: item.trustTier === "trusted" || item.trustTier === "reviewed" || item.trustTier === "untrusted"
+            ? item.trustTier
+            : referencedServer.trustTier,
+        access: item.access === "read-only" || item.access === "read-write" ? item.access : referencedServer.access,
+        tenantScope: item.tenantScope === "workspace" ||
+            item.tenantScope === "project" ||
+            item.tenantScope === "tenant" ||
+            item.tenantScope === "cross-tenant"
+            ? item.tenantScope
+            : referencedServer.tenantScope,
+        approvalPolicy: item.approvalPolicy === "always" || item.approvalPolicy === "write" || item.approvalPolicy === "never"
+            ? item.approvalPolicy
+            : referencedServer.approvalPolicy,
+        promptInjectionRisk: item.promptInjectionRisk === "low" || item.promptInjectionRisk === "medium" || item.promptInjectionRisk === "high"
+            ? item.promptInjectionRisk
+            : referencedServer.promptInjectionRisk,
+        oauth: asObject(item.oauth)
+            ? {
+                provider: typeof asObject(item.oauth)?.provider === "string" ? asObject(item.oauth)?.provider : referencedServer.oauth?.provider,
+                scopes: readStringArray(asObject(item.oauth)?.scopes) || referencedServer.oauth?.scopes,
+            }
+            : referencedServer.oauth,
+        labels: readStringArray(item.labels).length > 0 ? readStringArray(item.labels) : referencedServer.labels,
         sourcePath,
     };
 }
@@ -220,6 +250,16 @@ export async function hydrateAgentMcpTools(agents, mcpServers, tools) {
                         mcp: {
                             serverRef: `mcp/${serverId}`,
                         },
+                        mcpServer: {
+                            transport: parsedServer.transport,
+                            ...(parsedServer.trustTier ? { trustTier: parsedServer.trustTier } : {}),
+                            ...(parsedServer.access ? { access: parsedServer.access } : {}),
+                            ...(parsedServer.tenantScope ? { tenantScope: parsedServer.tenantScope } : {}),
+                            ...(parsedServer.approvalPolicy ? { approvalPolicy: parsedServer.approvalPolicy } : {}),
+                            ...(parsedServer.promptInjectionRisk ? { promptInjectionRisk: parsedServer.promptInjectionRisk } : {}),
+                            ...(parsedServer.oauth ? { oauth: parsedServer.oauth } : {}),
+                            ...(parsedServer.labels && parsedServer.labels.length > 0 ? { labels: parsedServer.labels } : {}),
+                        },
                     },
                     mcpRef: remoteTool.name,
                     bundleRefs: [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbotgo/agent-harness",
-  "version": "0.0.186",
+  "version": "0.0.188",
   "description": "Workspace runtime for multi-agent applications",
   "type": "module",
   "packageManager": "npm@10.9.2",