@pi-in-go/pigpen-a2a 0.1.0

package/extensions/a2a/fakepig_test.go

@@ -0,0 +1,212 @@
+package a2aext
+
+// The fake `pig --mode rpc`: the test binary re-executed (Skill step 3, "fake external CLI").
+// It speaks the JSONL protocol of `pig --mode rpc` for the commands the worker uses and logs
+// what it saw to $A2A_FAKE_LOG so tests can assert on the argv, environment and abort.
+
+import (
+	"bufio"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/signal"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestMain(m *testing.M) {
+	if os.Getenv("A2A_FAKE_PIG") == "1" {
+		fakePig()
+		return
+	}
+	os.Exit(m.Run())
+}
+
+type fakeLog struct {
+	Terminated bool              `json:"terminated"`
+	Args       []string          `json:"args"`
+	Cwd        string            `json:"cwd"`
+	Env        map[string]string `json:"env"`
+	PID        int               `json:"pid"`
+	Prompt     string            `json:"prompt"`
+	Started    bool              `json:"started"`
+	Aborted    bool              `json:"aborted"`
+	Finished   bool              `json:"finished"`
+	ChildPID   int               `json:"childPid"`
+}
+
+func fakePig() {
+	logPath := os.Getenv("A2A_FAKE_LOG")
+	cwd, _ := os.Getwd()
+	entry := fakeLog{Args: os.Args[1:], Cwd: cwd, PID: os.Getpid(), Env: map[string]string{}}
+	for _, kv := range os.Environ() {
+		k, v, _ := strings.Cut(kv, "=")
+		entry.Env[k] = v
+	}
+	save := func() {
+		if logPath == "" {
+			return
+		}
+		b, _ := json.Marshal(entry)
+		_ = os.WriteFile(logPath, b, 0o600)
+	}
+	save()
+	// A graceful stop (SIGTERM) is recorded; "IGNORE_TERM" prompts ignore it too, so only SIGKILL ends them.
+	term := make(chan os.Signal, 1)
+	signal.Notify(term, syscall.SIGTERM)
+	go func() {
+		<-term
+		entry.Terminated = true
+		save()
+		if !strings.Contains(entry.Prompt, "IGNORE_TERM") {
+			os.Exit(0)
+		}
+	}()
+	out := bufio.NewWriter(os.Stdout)
+	emit := func(v map[string]any) {
+		b, _ := json.Marshal(v)
+		out.Write(append(b, '\n'))
+		out.Flush()
+	}
+	settle := func(stop string, text, errMsg string) {
+		msg := map[string]any{"role": "assistant", "stopReason": stop, "content": []any{map[string]any{"type": "text", "text": text}}}
+		if errMsg != "" {
+			msg["errorMessage"] = errMsg
+		}
+		emit(map[string]any{"type": "message_end", "message": msg})
+		emit(map[string]any{"type": "agent_end", "willRetry": false})
+		emit(map[string]any{"type": "agent_settled"})
+		entry.Finished = true
+		save()
+	}
+	in := bufio.NewScanner(os.Stdin)
+	in.Buffer(make([]byte, 1<<20), 1<<24)
+	for in.Scan() {
+		var cmd struct {
+			ID      string `json:"id"`
+			Type    string `json:"type"`
+			Message string `json:"message"`
+		}
+		if json.Unmarshal(in.Bytes(), &cmd) != nil {
+			continue
+		}
+		switch cmd.Type {
+		case "prompt":
+			entry.Prompt, entry.Started = cmd.Message, true
+			save()
+			if strings.Contains(cmd.Message, "REJECT") {
+				emit(map[string]any{"id": cmd.ID, "type": "response", "command": "prompt", "success": false, "error": "secret internal reason"})
+				continue
+			}
+			if strings.Contains(cmd.Message, "ORPHAN") {
+				// A tool that outlives the turn: a child in the worker's process group that nobody waits for.
+				child := exec.Command("sleep", "60")
+				if child.Start() == nil {
+					entry.ChildPID = child.Process.Pid
+					save()
+				}
+			}
+			emit(map[string]any{"id": cmd.ID, "type": "response", "command": "prompt", "success": true})
+			emit(map[string]any{"type": "agent_start"})
+			emit(map[string]any{"type": "message_start", "message": map[string]any{"role": "assistant"}})
+			switch {
+			case strings.Contains(cmd.Message, "NEEDUI"):
+				emit(map[string]any{"type": "extension_ui_request", "id": "ui-1", "method": "confirm", "title": "sure?"})
+				select {} // a real PiG would wait for the answer
+			case strings.Contains(cmd.Message, "IGNORE_ABORT"), strings.Contains(cmd.Message, "IGNORE_TERM"):
+				select {} // hang until killed
+			case strings.Contains(cmd.Message, "SLOW"):
+				emit(map[string]any{"type": "message_update", "assistantMessageEvent": map[string]any{"type": "text_delta", "contentIndex": 0, "delta": "working"}})
+				// wait for abort in the read loop
+			case strings.Contains(cmd.Message, "FAIL"):
+				settle("error", "", "provider exploded with secret sk-123")
+			case strings.Contains(cmd.Message, "TOOL"):
+				emit(map[string]any{"type": "tool_execution_start", "toolCallId": "t1", "toolName": "read", "args": map[string]any{"path": "x"}})
+				emit(map[string]any{"type": "tool_execution_end", "toolCallId": "t1", "toolName": "read", "result": map[string]any{"content": []any{}}, "isError": false})
+				emit(map[string]any{"type": "message_update", "assistantMessageEvent": map[string]any{"type": "text_delta", "contentIndex": 0, "delta": "done"}})
+				settle("stop", "done", "")
+			default:
+				h := len(cmd.Message) / 2
+				emit(map[string]any{"type": "message_update", "assistantMessageEvent": map[string]any{"type": "text_delta", "contentIndex": 0, "delta": "echo: " + cmd.Message[:h]}})
+				emit(map[string]any{"type": "message_update", "assistantMessageEvent": map[string]any{"type": "text_delta", "contentIndex": 0, "delta": cmd.Message[h:]}})
+				settle("stop", "echo: "+cmd.Message, "")
+			}
+		case "abort":
+			entry.Aborted = true
+			save()
+			emit(map[string]any{"id": cmd.ID, "type": "response", "command": "abort", "success": true})
+			settle("aborted", "working", "")
+		}
+	}
+}
+
+// fakeWorkerConfig points a WorkerConfig at the fake pig and returns the log path.
+func fakeWorkerConfig(t *testing.T) (WorkerConfig, string, func(string) string) {
+	t.Helper()
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	logPath := t.TempDir() + "/fake.log"
+	env := map[string]string{
+		"A2A_FAKE_PIG": "1", "A2A_FAKE_LOG": logPath, "PATH": os.Getenv("PATH"), "HOME": "/home/x",
+		"PIG_HOME": "/pig/home", "PIG_CODING_AGENT_DIR": "/pig/agent",
+		"TOKEN_A": tokenA, "OPENAI_API_KEY": "sk-passthrough", "SOMETHING_SECRET": "leak",
+	}
+	cfg := WorkerConfig{Command: exe, Tools: []string{"read", "grep", "find", "ls"}, Cwd: t.TempDir(), GraceSeconds: 1,
+		PassEnv: []string{"A2A_FAKE_PIG", "A2A_FAKE_LOG", "OPENAI_API_KEY"}}
+	return cfg, logPath, func(k string) string { return env[k] }
+}
+
+func readFakeLog(t *testing.T, path string) fakeLog {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		b, err := os.ReadFile(path)
+		var l fakeLog
+		if err == nil && json.Unmarshal(b, &l) == nil && l.PID != 0 {
+			return l
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("no fake pig log at %s: %v", path, err)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
+func waitFakeLog(t *testing.T, path string, ok func(fakeLog) bool) fakeLog {
+	t.Helper()
+	deadline := time.Now().Add(10 * time.Second)
+	for {
+		l := readFakeLog(t, path)
+		if ok(l) {
+			return l
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("condition not reached: %+v", l)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
+func processAlive(pid int) bool {
+	p, err := os.FindProcess(pid)
+	if err != nil {
+		return false
+	}
+	return p.Signal(syscall.Signal(0)) == nil
+}
+
+func argValue(args []string, flag string) string {
+	for i, a := range args {
+		if a == flag && i+1 < len(args) {
+			return args[i+1]
+		}
+	}
+	return ""
+}
+
+var _ = fmt.Sprintf

package/extensions/a2a/gaps_test.go

@@ -0,0 +1,59 @@
+package a2aext
+
+import "testing"
+
+// Every gap between the A2A 1.0 specification / a2a-go and this adapter is a named, skipped
+// test (Skill step 3: "document every gap as a named skipped test, never silently").
+// port/PORT.md lists them with the count.
+
+func TestGap_GRPCTransportBinding(t *testing.T) {
+	t.Skip("gap: only the JSON-RPC binding is served. a2a-go has gRPC and REST bindings; each is another authenticated surface to secure and test. Owner decision to add.")
+}
+
+func TestGap_RESTTransportBinding(t *testing.T) {
+	t.Skip("gap: the HTTP+JSON (REST) binding is not served, only JSON-RPC. See GRPC gap.")
+}
+
+func TestGap_PushNotifications(t *testing.T) {
+	t.Skip("gap: push notification configs are not supported (the card says pushNotifications=false). Webhook delivery needs SSRF policy for peer-supplied URLs.")
+}
+
+func TestGap_ProtocolV03Compatibility(t *testing.T) {
+	t.Skip("gap: A2A 0.3 peers are refused with VERSION_NOT_SUPPORTED (server) and no 0.3 client transport is enabled. a2a-go ships a2acompat/a2av0; enabling it needs an owner decision because 0.3 has different task-state and auth semantics.")
+}
+
+func TestGap_ExtendedAgentCard(t *testing.T) {
+	t.Skip("gap: GetExtendedAgentCard is not supported; the card is the same for every caller.")
+}
+
+func TestGap_PersistentTaskStore(t *testing.T) {
+	t.Skip("gap: the task store is in memory. Tasks and their status are lost when the listener restarts, although each context's PiG session file persists on disk and a new task in the same contextId continues it.")
+}
+
+func TestGap_InputRequiredFromPiG(t *testing.T) {
+	t.Skip("gap: a PiG turn never ends in input-required; the worker runs headless and extension UI requests are not surfaced to the peer. Peers see completed, failed or canceled.")
+}
+
+func TestGap_FileAndDataParts(t *testing.T) {
+	t.Skip("gap: only text parts are accepted and produced. File, raw and data parts are refused, not dropped.")
+}
+
+func TestGap_OAuth2AndMutualTLSAuthentication(t *testing.T) {
+	t.Skip("gap: server authentication is static bearer tokens named by environment variable, mapped to a principal and tenant. OAuth2/OIDC validation and mTLS client certificates are not implemented; the client sends a bearer token or custom headers only.")
+}
+
+func TestGap_SignedAgentCards(t *testing.T) {
+	t.Skip("gap: agent card signatures are neither produced nor verified.")
+}
+
+func TestGap_SubscribeToTaskAfterRestart(t *testing.T) {
+	t.Skip("gap: SubscribeToTask works only while the task is live in this process (see the persistent task store gap).")
+}
+
+func TestGap_ClientStreamingProgressToTheModel(t *testing.T) {
+	t.Skip("gap: a2a_send waits for a terminal or input-required state and reports progress through the tool update channel only; there is no long-poll or resubscribe tool for tasks that outlive the call.")
+}
+
+func TestGap_ClientResubscribeTool(t *testing.T) {
+	t.Skip("gap: the client tools do not resubscribe to a remote task's stream; a2a_task get/cancel and a2a_send (which streams) cover the model's needs. The server side does support SubscribeToTask for a live task (TestSubscribeToALiveTaskDeliversTheRest).")
+}

package/extensions/a2a/go.mod

@@ -0,0 +1,15 @@
+module github.com/MichaelKinsy/pigpen/a2a
+
+go 1.26.0
+
+// PiG resolves this requirement to the version-matched staged SDK at build time.
+require github.com/MichaelKinsy/PiG/extensions/sdk v0.4.1
+
+require github.com/a2aproject/a2a-go/v2 v2.6.0
+
+require (
+	github.com/google/uuid v1.6.0 // indirect
+	golang.org/x/mod v0.38.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+)
+

package/extensions/a2a/go.sum

@@ -0,0 +1,14 @@
+github.com/MichaelKinsy/PiG/extensions/sdk v0.4.1 h1:Ql9sTkc6dvAXaYQLq5nxqmSZgqu8S0L53ZTs8MkOuxw=
+github.com/MichaelKinsy/PiG/extensions/sdk v0.4.1/go.mod h1:4j0XhCW0EPOBWvqYE7XKjTvIAahI7K1VyyW3KpjTKj8=
+github.com/a2aproject/a2a-go/v2 v2.6.0 h1:QflB0gHxOP0o5quvA/h9EbYgfOsmRsSmFkeBYtKdwwk=
+github.com/a2aproject/a2a-go/v2 v2.6.0/go.mod h1:rvFIb0sBJl2qmJRYU2fQxI6hhIQksmGGMEhT/uRwWww=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=

package/extensions/a2a/interop_test.go

@@ -0,0 +1,163 @@
+package a2aext
+
+// Interoperability with kagent. kagent speaks A2A 1.0 through a2a-go v2 (kagent's go.mod
+// requires github.com/a2aproject/a2a-go/v2 v2.6.0, the version pinned here). The test drives a
+// real kagent A2A server: kagent's own adk/pkg/a2a/server package with an echo executor
+// (port/interop/kagent, built by scripts/interop-kagent.mjs from a kagent checkout).
+// Without KAGENT_A2A_ECHO the tests are skipped, by name, and the report says so.
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/a2aproject/a2a-go/v2/a2a"
+	"github.com/a2aproject/a2a-go/v2/a2aclient"
+)
+
+func startKagentEcho(t *testing.T) string {
+	t.Helper()
+	bin := os.Getenv("KAGENT_A2A_ECHO")
+	if bin == "" {
+		t.Skip("no kagent-compatible A2A endpoint: set KAGENT_A2A_ECHO to the binary built by scripts/interop-kagent.mjs (needs a kagent checkout, KAGENT_GO_DIR)")
+	}
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	port := fmt.Sprint(ln.Addr().(*net.TCPAddr).Port)
+	ln.Close()
+	cmd := exec.Command(bin, "-port", port)
+	cmd.Env = []string{"PATH=" + os.Getenv("PATH"), "HOME=" + t.TempDir()}
+	out, _ := cmd.StderrPipe()
+	if err := cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	go func() { // keep the pipe drained
+		sc := bufio.NewScanner(out)
+		for sc.Scan() {
+		}
+	}()
+	t.Cleanup(func() { _ = cmd.Process.Kill(); _ = cmd.Wait() })
+	base := "http://127.0.0.1:" + port
+	deadline := time.Now().Add(20 * time.Second)
+	for {
+		resp, err := http.Get(base + "/.well-known/agent-card.json")
+		if err == nil {
+			resp.Body.Close()
+			return base
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("kagent echo did not start: %v", err)
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+}
+
+func TestInterop_KagentServerAsRemote(t *testing.T) {
+	base := startKagentEcho(t)
+	// kagent's card advertises the in-cluster URL, so callers use the configured URL as the endpoint (skipCard),
+	// exactly as kagent's own CLI does.
+	rs := NewRemotes(map[string]RemoteAgent{"kagent": {URL: base, SkipCard: true, TimeoutSeconds: 30}}, envFrom(nil))
+	var progress strings.Builder
+	sum, err := rs.Send(context.Background(), SendArgs{Agent: "kagent", Message: "hello kagent"}, func(s string) { progress.WriteString(s) })
+	if err != nil {
+		t.Fatal(err)
+	}
+	if sum.State != "completed" || sum.Text != "kagent echo: hello kagent" || sum.TaskID == "" || sum.ContextID == "" {
+		t.Fatalf("%+v", sum)
+	}
+	got, err := rs.GetTask(context.Background(), "kagent", sum.TaskID)
+	if err == nil && got.State != "completed" {
+		t.Fatalf("get: %+v", got)
+	}
+	// Continue the context.
+	next, err := rs.Send(context.Background(), SendArgs{Agent: "kagent", Message: "again", ContextID: sum.ContextID}, nil)
+	if err != nil || next.ContextID != sum.ContextID || next.TaskID == sum.TaskID {
+		t.Fatalf("context continuation: %+v %v", next, err)
+	}
+}
+
+func TestInterop_KagentCardHostIsNotTrustedWithCredentials(t *testing.T) {
+	base := startKagentEcho(t)
+	rs := NewRemotes(map[string]RemoteAgent{"kagent": {URL: base, BearerTokenEnv: "KAGENT_TOKEN", TimeoutSeconds: 30}}, envFrom(map[string]string{"KAGENT_TOKEN": "kagent-token-value"}))
+	_, err := rs.Send(context.Background(), SendArgs{Agent: "kagent", Message: "hello"}, nil)
+	if err == nil || !strings.Contains(err.Error(), "skipCard") {
+		t.Fatalf("kagent's card names an in-cluster host; the client must not send a token there: %v", err)
+	}
+}
+
+func TestInterop_KagentCancelReachesTheRemoteTask(t *testing.T) {
+	base := startKagentEcho(t)
+	rs := NewRemotes(map[string]RemoteAgent{"kagent": {URL: base, SkipCard: true, TimeoutSeconds: 30}}, envFrom(nil))
+	ctx, cancel := context.WithCancel(context.Background())
+	errc := make(chan error, 1)
+	ids := make(chan string, 1)
+	go func() {
+		_, err := rs.Send(ctx, SendArgs{Agent: "kagent", Message: "sleep", OnTask: func(id, _ string) { ids <- id }}, nil)
+		errc <- err
+	}()
+	var id string
+	select {
+	case id = <-ids:
+	case <-time.After(10 * time.Second):
+		t.Fatal("kagent never reported the task")
+	}
+	cancel()
+	if err := <-errc; err == nil {
+		t.Fatal("cancelled Send must fail")
+	}
+	waitFor(t, func() bool {
+		s, err := rs.GetTask(context.Background(), "kagent", id)
+		return err == nil && s.State == "canceled"
+	}, "the kagent task to be canceled")
+}
+
+// kagentHeaders reproduces kagent's own CLI client (go/core/cli/internal/a2a/client.go): an A2A v1
+// client with the JSON-RPC transport, no card resolution, and static headers including A2A-Version.
+type kagentHeaders map[string]string
+
+func (h kagentHeaders) Before(ctx context.Context, req *a2aclient.Request) (context.Context, any, error) {
+	for k, v := range h {
+		req.ServiceParams.Append(k, v)
+	}
+	return ctx, nil, nil
+}
+
+func (kagentHeaders) After(context.Context, *a2aclient.Response) error { return nil }
+
+func TestInterop_KagentClientShapeAgainstThisServer(t *testing.T) {
+	w := &scriptedWorker{}
+	s := startServer(t, serverConfig(), w)
+	hc := &http.Client{Transport: bearerTransport{token: tokenA}, Timeout: 30 * time.Second}
+	c, err := a2aclient.NewFromEndpoints(context.Background(),
+		[]*a2a.AgentInterface{{URL: "http://" + s.Addr(), ProtocolVersion: a2a.Version, ProtocolBinding: a2a.TransportProtocolJSONRPC}},
+		a2aclient.WithJSONRPCTransport(hc),
+		a2aclient.WithCallInterceptors(kagentHeaders{a2a.SvcParamVersion: string(a2a.Version)}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	res, err := c.SendMessage(context.Background(), &a2a.SendMessageRequest{Message: textMessage("from a kagent-shaped client")})
+	task := mustTask(t, res, err)
+	if task.Status.State != a2a.TaskStateCompleted || taskText(task) != "echo: from a kagent-shaped client" {
+		t.Fatalf("%s %q", task.Status.State, taskText(task))
+	}
+	var events int
+	for ev, err := range c.SendStreamingMessage(context.Background(), &a2a.SendMessageRequest{Message: textMessage("stream")}) {
+		if err != nil {
+			t.Fatal(err)
+		}
+		_ = ev
+		events++
+	}
+	if events < 3 {
+		t.Fatalf("a stream has a task, chunks and a final status; got %d events", events)
+	}
+}

package/extensions/a2a/procattr_other.go

@@ -0,0 +1,25 @@
+//go:build !windows
+
+package a2aext
+
+import (
+	"errors"
+	"os"
+	"os/exec"
+	"syscall"
+)
+
+// configureProcess puts the worker in its own process group so a tool it started
+// (a shell, for instance) dies with it.
+func configureProcess(cmd *exec.Cmd) { cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true} }
+
+func terminateTree(p *os.Process) error { return ignoreGone(syscall.Kill(-p.Pid, syscall.SIGTERM)) }
+
+func killTree(p *os.Process) error { return ignoreGone(syscall.Kill(-p.Pid, syscall.SIGKILL)) }
+
+func ignoreGone(err error) error {
+	if errors.Is(err, syscall.ESRCH) || errors.Is(err, os.ErrProcessDone) {
+		return nil
+	}
+	return err
+}

package/extensions/a2a/procattr_windows.go

@@ -0,0 +1,26 @@
+//go:build windows
+
+package a2aext
+
+import (
+	"errors"
+	"os"
+	"os/exec"
+	"syscall"
+)
+
+const createNewProcessGroup = 0x00000200
+
+// configureProcess hides the console window and starts a new process group.
+func configureProcess(cmd *exec.Cmd) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true, CreationFlags: createNewProcessGroup}
+}
+
+func terminateTree(p *os.Process) error { return killTree(p) }
+
+func killTree(p *os.Process) error {
+	if err := p.Kill(); err != nil && !errors.Is(err, os.ErrProcessDone) {
+		return err
+	}
+	return nil
+}

package/extensions/a2a/resubscribe_test.go

@@ -0,0 +1,113 @@
+package a2aext
+
+// Stream resubscription while the task is live (roadmap: "stream resubscription ... in both directions").
+// After a restart nothing can be resubscribed: that is TestGap_SubscribeToTaskAfterRestart.
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/a2aproject/a2a-go/v2/a2a"
+)
+
+func TestSubscribeToALiveTaskDeliversTheRest(t *testing.T) {
+	gate := make(chan struct{})
+	started := make(chan struct{})
+	w := &scriptedWorker{run: func(ctx context.Context, tn Turn, up func(Update)) (Result, error) {
+		up(Update{Text: "part one "})
+		close(started)
+		select {
+		case <-gate:
+		case <-ctx.Done():
+			return Result{}, ctx.Err()
+		}
+		up(Update{Text: "part two"})
+		return Result{Text: "part one part two"}, nil
+	}}
+	s := startServer(t, serverConfig(), w)
+	base := "http://" + s.Addr()
+	first := a2aClient(t, base, tokenA)
+
+	taskID := make(chan a2a.TaskID, 1)
+	go func() {
+		sent := false
+		for ev, err := range first.SendStreamingMessage(context.Background(), &a2a.SendMessageRequest{Message: textMessage("long")}) {
+			if err != nil {
+				return
+			}
+			if !sent {
+				taskID <- ev.TaskInfo().TaskID
+				sent = true
+			}
+		}
+	}()
+	id := <-taskID
+	waitChan(t, started, "the worker")
+
+	// Another caller is not the owner: the task does not exist for them. Their subscription must end with
+	// an error and never deliver an event, not even after the task moves on (a2a-go v2.6.0 alone would attach them).
+	bob := a2aClient(t, base, tokenB)
+	var bobEvents atomic.Int32
+	var bobErr atomic.Value
+	bobDone := make(chan struct{})
+	bobCtx, stopBob := context.WithTimeout(context.Background(), 15*time.Second)
+	defer stopBob()
+	go func() {
+		defer close(bobDone)
+		for _, err := range bob.SubscribeToTask(bobCtx, &a2a.SubscribeToTaskRequest{ID: id}) {
+			if err != nil {
+				bobErr.Store(err)
+				return
+			}
+			bobEvents.Add(1)
+		}
+	}()
+	waitChan(t, bobDone, "the refused subscription to end")
+	if bobEvents.Load() != 0 || bobErr.Load() == nil || !errors.Is(bobErr.Load().(error), a2a.ErrTaskNotFound) {
+		t.Fatalf("a caller outside the task's tenant subscribed to it: %d events, err %v", bobEvents.Load(), bobErr.Load())
+	}
+
+	// The owner, on a fresh connection, gets the remaining events and the terminal state.
+	again := a2aClient(t, base, tokenA)
+	var got strings.Builder
+	var final a2a.TaskState
+	done := make(chan struct{})
+	subscribed := make(chan struct{})
+	var once sync.Once
+	go func() {
+		defer close(done)
+		for ev, err := range again.SubscribeToTask(context.Background(), &a2a.SubscribeToTaskRequest{ID: id}) {
+			if err != nil {
+				t.Logf("subscribe error: %v", err)
+				return
+			}
+			switch e := ev.(type) {
+			case *a2a.Task: // the snapshot the subscription starts with
+				for _, art := range e.Artifacts {
+					for _, p := range art.Parts {
+						got.WriteString(p.Text())
+					}
+				}
+				final = e.Status.State
+			case *a2a.TaskArtifactUpdateEvent:
+				for _, p := range e.Artifact.Parts {
+					got.WriteString(p.Text())
+				}
+			case *a2a.TaskStatusUpdateEvent:
+				final = e.Status.State
+			}
+			once.Do(func() { close(subscribed) }) // the snapshot proves the subscription is live
+		}
+	}()
+	waitChan(t, subscribed, "the subscription's first event")
+	close(gate)
+	waitChan(t, done, "the subscription to end")
+	if final != a2a.TaskStateCompleted || !strings.Contains(got.String(), "part two") {
+		t.Fatalf("final %s, text %q", final, got.String())
+	}
+}