@botbotgo/agent-harness 0.0.214 → 0.0.216

package/README.md

@@ -130,6 +130,7 @@ The public API spans a full product runtime—persistent records, memory and evi
 - **Governed workspace runtime:** YAML-owned routing, concurrency, maintenance, MCP policy, runtime governance bundles, and approval defaults for sensitive memory or write-like MCP side effects.
 
 If you integrate external clients, treat `deepagents-acp` as the primary protocol direction: clients connect through that surface while `agent-harness` keeps persistence, recovery, approvals, and operator control on the runtime side.
+Keep the standard stack split explicit: MCP connects agents to resources and tools, A2A bridges task exchange between agent platforms, ACP is the client-to-runtime boundary, AG-UI is the UI event surface, and runtime MCP exposes the operator control plane.
 
 ## The problem this solves
 
@@ -267,6 +268,7 @@ These scenarios map most directly to what the runtime is built for:
 
 - Enterprise internal agent runtime: approvals, restart-safe recovery, operator evidence, and policy-owned MCP access.
 - Code modernization runtime: long-running coding flows, approval checkpoints, resumable runs, and exported evidence packages.
+- Agent-ops and remediation workflow runtime: parallel agent attempts, human review gates, durable evidence, and operator visibility for security or maintenance work.
 - Protocol bridge runtime: ACP, A2A, AG-UI, and runtime MCP on one stable control plane instead of bespoke per-surface glue.
 
 Typical runtime governance defaults now look like:
@@ -1022,7 +1024,7 @@ ACP transport notes:
 - `serveAcpHttp(runtime)` exposes JSON-RPC over HTTP plus SSE runtime events so remote operator surfaces can connect without importing the runtime in-process.
 - ACP transport validation now covers the reference-client core flow: capability discovery, request submit, session lookup, request lookup, invalid-JSON handling, notification calls without response ids, stdio JSON-RPC, and HTTP plus SSE runtime notifications.
 - For the thinnest editor or CLI starter, begin with `agent-harness acp serve --workspace . --transport stdio` and mirror the `examples/protocol-hello-world/app/acp-stdio-hello-world.mjs` wire shape. Applications that want an in-process reference client can use `createAcpStdioClient(...)` to issue JSON-RPC requests and route runtime notifications without hand-rolling line parsing.
-- `serveA2aHttp(runtime)` exposes an A2A-compatible HTTP JSON-RPC bridge plus agent card discovery, mapping both existing methods such as `message/send` and newer aliases such as `SendMessage`, `GetTask`, `ListTasks`, `CancelTask`, and `SubscribeToTask` onto the existing session/request runtime surface.
+- `serveA2aHttp(runtime)` exposes an A2A-compatible HTTP JSON-RPC bridge plus agent card discovery, mapping both existing methods such as `message/send` and A2A v1.0 PascalCase methods such as `SendMessage`, `GetTask`, `ListTasks`, `CancelTask`, and `SubscribeToTask` onto the existing session/request runtime surface. The v1.0 path publishes `supportedInterfaces`, `TASK_STATE_*` statuses, the `{ task }` `SendMessage` wrapper, and explicit unsupported errors for streaming or push notifications.
 - `serveAgUiHttp(runtime)` exposes an AG-UI-compatible HTTP SSE bridge that projects runtime lifecycle, text output, upstream thinking, step progress, and tool calls onto `RUN_*`, `TEXT_MESSAGE_*`, `THINKING_TEXT_MESSAGE_*`, `STEP_*`, and `TOOL_CALL_*` events for UI clients.
 - `createRuntimeMcpServer(runtime)` and `serveRuntimeMcpOverStdio(runtime)` expose the persisted runtime control surface itself as MCP tools, including sessions, requests, approvals, artifacts, events, and package export helpers.
 - `listRequestEvents(...)` and `exportRequestPackage(...)` are the request-first inspection helpers.

package/README.zh.md

@@ -126,6 +126,7 @@ try {
 - **受治理的工作区运行时：** 由 YAML 持有的路由、并发、维护、MCP 策略、runtime governance bundles，以及针对敏感 memory 或写类 MCP 副作用的默认审批门槛。
 
 若你的产品需要对接外部客户端，可从本节理解边界：`deepagents-acp` 是主要的外部协议接入方向；持久化、恢复、审批与运行控制仍由 `agent-harness` 在运行时侧承担。
+协议栈分工也要保持明确：MCP 连接资源和工具，A2A 承接 agent 平台之间的 task exchange，ACP 是 client-to-runtime 边界，AG-UI 是 UI 事件面，runtime MCP 则把 operator control plane 以 MCP tools 暴露出去。
 
 ## 这能解决什么问题
 
@@ -263,6 +264,7 @@ AI 让 agent 逻辑、工具调用和工作流代码更容易生成，真正更
 
 - 企业内部智能体运行时：审批、重启恢复、运维侧证据链，以及由策略约束的 MCP 访问控制。
 - 代码现代化运行时：长链路 coding flow、审批检查点、可恢复 runs，以及可导出的运行证据包。
+- Agent ops 与 remediation workflow runtime：并行 agent 尝试、人工 review gate、持久证据包，以及面向安全或维护任务的 operator visibility。
 - 协议桥接运行时：ACP、A2A、AG-UI 与 runtime MCP 共用一套稳定控制面，而不是为每个对外入口各写一层集成胶水。
 
 一套常见的 runtime 治理默认值大致如下：
@@ -980,7 +982,7 @@ ACP transport 说明：
 - `serveAcpHttp(runtime)` 提供基于 HTTP 的 JSON-RPC 与 SSE runtime events，适合远程界面或独立控制面接入。
 - ACP transport 现已覆盖核心参考客户端流程验证：capability discovery、request submit、session lookup、request lookup、invalid JSON 处理、无 id notification 不返回响应，以及 stdio JSON-RPC 与 HTTP + SSE runtime notifications。
 - 如果要从最薄的一层 editor / CLI starter 开始，优先用 `agent-harness acp serve --workspace . --transport stdio`，并直接参考 `examples/protocol-hello-world/app/acp-stdio-hello-world.mjs` 的 wire shape。需要在应用内使用 reference client 时，可直接用 `createAcpStdioClient(...)` 发起 JSON-RPC 请求并分流 runtime notifications，避免每个 sidecar 自己重写 line parsing。
-- `serveA2aHttp(runtime)` 提供 A2A HTTP JSON-RPC bridge 与 agent card discovery，同时兼容 `message/send` 这类旧方法，以及 `SendMessage`、`GetTask`、`ListTasks`、`CancelTask`、`SubscribeToTask` 这类更新的方法别名，并统一映射到现有 session/request 运行记录。
+- `serveA2aHttp(runtime)` 提供 A2A HTTP JSON-RPC bridge 与 agent card discovery，同时兼容 `message/send` 这类旧方法，以及 `SendMessage`、`GetTask`、`ListTasks`、`CancelTask`、`SubscribeToTask` 这类 A2A v1.0 PascalCase 方法，并统一映射到现有 session/request 运行记录。v1.0 路径会发布 `supportedInterfaces`、`TASK_STATE_*` 状态、`SendMessage` 的 `{ task }` wrapper，并对 streaming 或 push notification 返回明确 unsupported error。
 - `serveAgUiHttp(runtime)` 提供 AG-UI HTTP SSE bridge，把 runtime 生命周期、文本输出、upstream thinking、step 进度与 tool call 投影成 `RUN_*`、`TEXT_MESSAGE_*`、`THINKING_TEXT_MESSAGE_*`、`STEP_*` 与 `TOOL_CALL_*` 事件，便于 UI 客户端直接接入。
 - `createRuntimeMcpServer(runtime)` 与 `serveRuntimeMcpOverStdio(runtime)` 会把持久化 runtime 控制面本身暴露成 MCP tools，包括 sessions、requests、approvals、artifacts、events 与 package export helpers。
 - `listRequestEvents(...)` 与 `exportRequestPackage(...)` 是 request-first 的检查 helper。

package/dist/package-version.d.ts

@@ -1 +1 @@
-export declare const AGENT_HARNESS_VERSION = "0.0.213";
+export declare const AGENT_HARNESS_VERSION = "0.0.215";

package/dist/package-version.js

@@ -1 +1 @@
-export const AGENT_HARNESS_VERSION = "0.0.213";
+export const AGENT_HARNESS_VERSION = "0.0.215";

package/dist/protocol/a2a/http.d.ts

@@ -18,20 +18,23 @@ export type A2aAgentCard = {
     description: string;
     version: string;
     protocolVersion?: string;
-    url: string;
-    preferredTransport: "JSONRPC";
+    url?: string;
+    preferredTransport?: "JSONRPC";
     provider?: {
         organization?: string;
         url?: string;
     };
     documentationUrl?: string;
     defaultAgentId?: string;
-    supportsAuthenticatedExtendedCard?: boolean;
-    supportedInterfaces?: string[];
+    supportedInterfaces: Array<{
+        url: string;
+        protocolBinding: "JSONRPC";
+        protocolVersion: "1.0";
+    }>;
     capabilities: {
         streaming: boolean;
         pushNotifications: boolean;
-        stateTransitionHistory: boolean;
+        extendedAgentCard: boolean;
     };
     defaultInputModes: string[];
     defaultOutputModes: string[];
@@ -43,16 +46,17 @@ export type A2aAgentCard = {
         examples: string[];
     }>;
 };
-export type A2aTaskState = "submitted" | "working" | "input-required" | "completed" | "failed" | "canceled";
+export type A2aTaskState = "TASK_STATE_SUBMITTED" | "TASK_STATE_WORKING" | "TASK_STATE_INPUT_REQUIRED" | "TASK_STATE_COMPLETED" | "TASK_STATE_FAILED" | "TASK_STATE_CANCELED";
 type A2aTaskStatus = {
     state: A2aTaskState;
     timestamp: string;
     messageId?: string;
     message?: {
-        role: "agent";
+        role: "ROLE_AGENT";
+        messageId: string;
         parts: Array<{
-            type: "text";
             text: string;
+            mediaType: "text/plain";
         }>;
     };
 };
@@ -62,17 +66,19 @@ export type A2aTask = {
     kind: "task";
     status: A2aTaskStatus;
     history: Array<{
-        role: "user" | "agent";
+        role: "ROLE_USER" | "ROLE_AGENT";
+        messageId: string;
         parts: Array<{
-            type: "text";
             text: string;
+            mediaType: "text/plain";
         }>;
     }>;
     artifacts: Array<{
+        artifactId: string;
         name: string;
         parts: Array<{
-            type: "text";
             text: string;
+            mediaType: "text/plain";
         }>;
     }>;
     metadata: Record<string, unknown>;

package/dist/protocol/a2a/http.js

@@ -41,11 +41,16 @@ function parseTextPart(part) {
         return null;
     }
     const typed = part;
-    if (typed.type !== "text" || typeof typed.text !== "string" || typed.text.trim().length === 0) {
+    if (typeof typed.text !== "string"
+        || typed.text.trim().length === 0
+        || (typed.type !== undefined && typed.type !== "text")) {
         return null;
     }
     return typed.text;
 }
+function normalizeUserRole(role) {
+    return typeof role === "string" ? role.toLowerCase().replace(/^role_/, "") : "";
+}
 function parseMessageSendParams(params) {
     if (!params || typeof params !== "object" || Array.isArray(params)) {
         throw new Error("A2A message/send requires params object.");
@@ -56,9 +61,9 @@ function parseMessageSendParams(params) {
         throw new Error("A2A message/send requires `message`.");
     }
     const typedMessage = message;
-    const role = typeof typedMessage.role === "string" ? typedMessage.role : "";
+    const role = normalizeUserRole(typedMessage.role);
     if (role !== "user") {
-        throw new Error("A2A message/send currently supports only `user` role messages.");
+        throw new Error("A2A message/send currently supports only `user` / `ROLE_USER` role messages.");
     }
     const parts = Array.isArray(typedMessage.parts) ? typedMessage.parts : [];
     const textParts = parts.map(parseTextPart).filter((item) => Boolean(item));
@@ -67,7 +72,9 @@ function parseMessageSendParams(params) {
     }
     const sessionId = typeof typed.contextId === "string" && typed.contextId.trim().length > 0
         ? typed.contextId.trim()
-        : undefined;
+        : typeof typedMessage.contextId === "string" && typedMessage.contextId.trim().length > 0
+            ? typedMessage.contextId.trim()
+            : undefined;
     const agentId = typeof typed.agentId === "string" && typed.agentId.trim().length > 0
         ? typed.agentId.trim()
         : undefined;
@@ -102,39 +109,71 @@ function parseTaskListParams(params) {
         return { limit: 20 };
     }
     const typed = params;
-    const limitValue = typeof typed.limit === "number" && Number.isFinite(typed.limit)
-        ? Math.max(1, Math.min(100, Math.trunc(typed.limit)))
+    const rawLimit = typeof typed.pageSize === "number" && Number.isFinite(typed.pageSize)
+        ? typed.pageSize
+        : typeof typed.limit === "number" && Number.isFinite(typed.limit)
+            ? typed.limit
+            : 20;
+    const limitValue = typeof rawLimit === "number" && Number.isFinite(rawLimit)
+        ? Math.max(1, Math.min(100, Math.trunc(rawLimit)))
         : 20;
     return {
         ...(typeof typed.agentId === "string" && typed.agentId.trim().length > 0 ? { agentId: typed.agentId.trim() } : {}),
         ...(typeof typed.contextId === "string" && typed.contextId.trim().length > 0 ? { contextId: typed.contextId.trim() } : {}),
-        ...(typeof typed.state === "string" && typed.state.trim().length > 0 ? { state: typed.state.trim() } : {}),
-        ...(typeof typed.cursor === "string" && typed.cursor.trim().length > 0 ? { cursor: typed.cursor.trim() } : {}),
+        ...(typeof typed.status === "string" && typed.status.trim().length > 0
+            ? { state: typed.status.trim() }
+            : typeof typed.state === "string" && typed.state.trim().length > 0
+                ? { state: typed.state.trim() }
+                : {}),
+        ...(typeof typed.pageToken === "string" && typed.pageToken.trim().length > 0
+            ? { cursor: typed.pageToken.trim() }
+            : typeof typed.cursor === "string" && typed.cursor.trim().length > 0
+                ? { cursor: typed.cursor.trim() }
+                : {}),
         limit: limitValue,
     };
 }
 function mapRunState(state) {
     switch (state) {
         case "queued":
-            return "submitted";
+            return "TASK_STATE_SUBMITTED";
         case "running":
-            return "working";
+            return "TASK_STATE_WORKING";
         case "waiting_for_approval":
-            return "input-required";
+            return "TASK_STATE_INPUT_REQUIRED";
         case "completed":
-            return "completed";
+            return "TASK_STATE_COMPLETED";
         case "cancelled":
-            return "canceled";
+            return "TASK_STATE_CANCELED";
         case "failed":
         default:
+            return "TASK_STATE_FAILED";
+    }
+}
+function mapTaskStatusToRunState(state) {
+    switch (state?.toLowerCase().replace(/^task_state_/, "").replace(/_/g, "-")) {
+        case "submitted":
+            return "queued";
+        case "working":
+            return "running";
+        case "input-required":
+            return "waiting_for_approval";
+        case "completed":
+            return "completed";
+        case "failed":
             return "failed";
+        case "canceled":
+        case "cancelled":
+            return "cancelled";
+        default:
+            return undefined;
     }
 }
 function toTextParts(text) {
     if (typeof text !== "string" || text.length === 0) {
         return [];
     }
-    return [{ type: "text", text }];
+    return [{ text, mediaType: "text/plain" }];
 }
 function contentToText(content) {
     if (typeof content === "string") {
@@ -230,7 +269,8 @@ function buildTaskFromSessionAndRequest(session, request, approvals, output, fai
             timestamp: request.updatedAt,
             ...(statusText ? {
                 message: {
-                    role: "agent",
+                    role: "ROLE_AGENT",
+                    messageId: `${request.requestId}:status`,
                     parts: toTextParts(statusText),
                 },
             } : {}),
@@ -238,13 +278,15 @@ function buildTaskFromSessionAndRequest(session, request, approvals, output, fai
         history: [
             ...(latestUserText
                 ? [{
-                        role: "user",
+                        role: "ROLE_USER",
+                        messageId: `${request.requestId}:user`,
                         parts: toTextParts(latestUserText),
                     }]
                 : []),
             ...(latestAgentText
                 ? [{
-                        role: "agent",
+                        role: "ROLE_AGENT",
+                        messageId: `${request.requestId}:agent`,
                         parts: toTextParts(latestAgentText),
                     }]
                 : []),
@@ -269,18 +311,23 @@ async function buildTaskFromRuntime(runtime, requestId) {
     return buildTaskFromSessionAndRequest(toSessionRecord(session), toRequestRecord(request), approvals);
 }
 async function listTasksFromRuntime(runtime, params) {
+    const runState = mapTaskStatusToRunState(params.state);
     const runs = await runtime.listRuns({
         ...(params.agentId ? { agentId: params.agentId } : {}),
         ...(params.contextId ? { threadId: params.contextId } : {}),
-        ...(params.state ? { state: params.state } : {}),
+        ...(runState ? { state: runState } : {}),
     });
     const startIndex = params.cursor ? Number.parseInt(Buffer.from(params.cursor, "base64url").toString("utf8"), 10) || 0 : 0;
     const page = runs.slice(startIndex, startIndex + params.limit);
     const tasks = (await Promise.all(page.map((run) => buildTaskFromRuntime(runtime, run.runId)))).filter((task) => Boolean(task));
     const nextIndex = startIndex + page.length;
+    const nextPageToken = nextIndex < runs.length ? Buffer.from(String(nextIndex), "utf8").toString("base64url") : "";
     return {
         tasks,
-        ...(nextIndex < runs.length ? { nextCursor: Buffer.from(String(nextIndex), "utf8").toString("base64url") } : {}),
+        pageSize: params.limit,
+        totalSize: runs.length,
+        nextPageToken,
+        ...(nextPageToken ? { nextCursor: nextPageToken } : {}),
     };
 }
 function buildAgentCard(runtime, options) {
@@ -296,33 +343,36 @@ function buildAgentCard(runtime, options) {
         name: options.agentName,
         description: options.agentDescription,
         version: "0.1.0",
+        // Older JSON-RPC clients may still read these top-level fields; A2A v1.0 discovery uses `supportedInterfaces`.
         protocolVersion: "1.0",
         url: options.rpcUrl,
         preferredTransport: "JSONRPC",
-        supportsAuthenticatedExtendedCard: false,
         supportedInterfaces: [
-            "message/send",
-            "tasks/send",
-            "tasks/get",
-            "tasks/list",
-            "tasks/cancel",
-            "tasks/subscribe",
-            "SendMessage",
-            "GetTask",
-            "ListTasks",
-            "CancelTask",
-            "SubscribeToTask",
+            {
+                url: options.rpcUrl,
+                protocolBinding: "JSONRPC",
+                protocolVersion: "1.0",
+            },
         ],
         capabilities: {
             streaming: false,
             pushNotifications: false,
-            stateTransitionHistory: true,
+            extendedAgentCard: false,
         },
-        defaultInputModes: ["text"],
-        defaultOutputModes: ["text"],
+        defaultInputModes: ["text/plain"],
+        defaultOutputModes: ["text/plain"],
         skills,
     };
 }
+function isV1Method(method) {
+    return /^[A-Z]/.test(method);
+}
+function toSendMessageResult(method, task) {
+    if (!task || !isV1Method(method)) {
+        return task;
+    }
+    return { task };
+}
 export async function serveA2aOverHttp(runtime, options = {}) {
     const hostname = options.hostname?.trim() || "127.0.0.1";
     const port = typeof options.port === "number" && Number.isFinite(options.port) ? options.port : 0;
@@ -372,14 +422,18 @@ export async function serveA2aOverHttp(runtime, options = {}) {
                         const requestRecord = await runtime.getRun(result.runId);
                         const approvals = await runtime.listApprovals({ threadId: result.threadId, runId: result.runId });
                         const task = buildTaskFromSessionAndRequest(toSessionRecord(session), toRequestRecord(requestRecord), approvals, result.output);
-                        writeJson(response, 200, toSuccess(payload.id ?? null, task));
+                        writeJson(response, 200, toSuccess(payload.id ?? null, toSendMessageResult(payload.method, task)));
+                        return;
+                    }
+                    if (payload.method === "SendStreamingMessage") {
+                        writeJson(response, 200, toError(payload.id ?? null, -32004, "A2A streaming is not supported by this bridge."));
                         return;
                     }
                     if (payload.method === "tasks/get" || payload.method === "GetTask") {
                         const { taskId } = parseTaskLocatorParams(payload.params);
                         const task = await buildTaskFromRuntime(runtime, taskId);
                         if (!task) {
-                            writeJson(response, 200, toError(payload.id ?? null, -32004, "Task not found."));
+                            writeJson(response, 200, toError(payload.id ?? null, -32001, "Task not found."));
                             return;
                         }
                         writeJson(response, 200, toSuccess(payload.id ?? null, task));
@@ -401,19 +455,34 @@ export async function serveA2aOverHttp(runtime, options = {}) {
                         const { taskId } = parseTaskLocatorParams(payload.params);
                         const task = await buildTaskFromRuntime(runtime, taskId);
                         if (!task) {
-                            writeJson(response, 200, toError(payload.id ?? null, -32004, "Task not found."));
+                            writeJson(response, 200, toError(payload.id ?? null, -32001, "Task not found."));
+                            return;
+                        }
+                        if (payload.method === "SubscribeToTask") {
+                            writeJson(response, 200, toError(payload.id ?? null, -32004, "A2A streaming subscriptions are not supported by this bridge."));
                             return;
                         }
                         writeJson(response, 200, toSuccess(payload.id ?? null, {
                             task,
                             streamable: false,
                             pushNotifications: false,
-                            nextPollAfterMs: task.status.state === "completed" || task.status.state === "failed" || task.status.state === "canceled"
+                            nextPollAfterMs: task.status.state === "TASK_STATE_COMPLETED" || task.status.state === "TASK_STATE_FAILED" || task.status.state === "TASK_STATE_CANCELED"
                                 ? 0
                                 : 1_000,
                         }));
                         return;
                     }
+                    if (payload.method === "CreateTaskPushNotificationConfig"
+                        || payload.method === "GetTaskPushNotificationConfig"
+                        || payload.method === "ListTaskPushNotificationConfigs"
+                        || payload.method === "DeleteTaskPushNotificationConfig") {
+                        writeJson(response, 200, toError(payload.id ?? null, -32003, "A2A push notifications are not supported by this bridge."));
+                        return;
+                    }
+                    if (payload.method === "GetExtendedAgentCard") {
+                        writeJson(response, 200, toError(payload.id ?? null, -32004, "A2A extended agent cards are not supported by this bridge."));
+                        return;
+                    }
                     writeJson(response, 200, toError(payload.id ?? null, -32601, `Unknown A2A method: ${payload.method}`));
                 }
                 catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbotgo/agent-harness",
-  "version": "0.0.214",
+  "version": "0.0.216",
   "description": "Workspace runtime for multi-agent applications",
   "license": "MIT",
   "type": "module",