@ryubyte/dsh-a2a 0.1.3 → 0.1.5

package/lib/index.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir, networkInterfaces } from "node:os";
 import { dirname, join } from "node:path";
-import { homedir } from "node:os";
 //#region src/protocol.ts
 /**
 * A2A (Agent2Agent) Protocol v1.0 — TypeScript type definitions.
@@ -418,6 +418,17 @@ async function registerAgentTools(tools, options) {
 		connectionId,
 		card
 	});
+	const contextByAgent = /* @__PURE__ */ new Map();
+	const fallbackContextKey = "\0fallback";
+	const contextFor = (agentId) => {
+		const key = agentId ?? fallbackContextKey;
+		let ctxId = contextByAgent.get(key);
+		if (ctxId === void 0) {
+			ctxId = `a2a-out-${crypto.randomUUID()}`;
+			contextByAgent.set(key, ctxId);
+		}
+		return ctxId;
+	};
 	let disposers = [];
 	if (options.mapSkills === false || skills.length === 0) {
 		const name = normalizeToolName(`a2a__${options.name}__agent`);
@@ -425,7 +436,7 @@ async function registerAgentTools(tools, options) {
 			id: "agent",
 			name: options.name,
 			description: `${card.name}: ${card.description} (no skills advertised)`
-		}));
+		}, contextFor));
 		if (dispose) disposers = [{
 			name,
 			dispose
@@ -434,7 +445,7 @@ async function registerAgentTools(tools, options) {
 		const out = [];
 		for (const skill of skills) {
 			const name = skillToToolName(options.name, skill);
-			const dispose = tools.register?.(makeTool(name, client, skill));
+			const dispose = tools.register?.(makeTool(name, client, skill, contextFor));
 			if (dispose) out.push({
 				name,
 				dispose
@@ -451,7 +462,7 @@ async function registerAgentTools(tools, options) {
 		}
 	}));
 }
-function makeTool(name, client, skill) {
+function makeTool(name, client, skill, contextFor) {
 	return {
 		name,
 		description: [skill.description, ...skill.examples?.length ? [`Examples: ${skill.examples.join(" | ")}`] : []].filter(Boolean).join("\n"),
@@ -474,6 +485,7 @@ function makeTool(name, client, skill) {
 			const message = {
 				messageId: crypto.randomUUID(),
 				role: "ROLE_USER",
+				contextId: contextFor(exec.agent?.id),
 				parts: [{ text: args.prompt }]
 			};
 			try {
@@ -567,10 +579,12 @@ var A2AServer = class {
 	execute;
 	listeners = /* @__PURE__ */ new Set();
 	baseUrl;
+	/** Abort controllers for in-flight tasks, so CancelTask can abort the executor. */
+	running = /* @__PURE__ */ new Map();
 	constructor(options, store = new TaskStore()) {
 		this.options = options;
 		this.store = store;
-		this.execute = options.execute ?? defaultExecutor;
+		this.execute = options.execute ?? notConfiguredExecutor;
 		this.endpointPath = options.endpointPath ?? "/a2a";
 		this.baseUrl = options.baseUrl;
 		this.card = this.buildCard();
@@ -586,6 +600,25 @@ var A2AServer = class {
 			url: `${this.baseUrl}${this.endpointPath}`
 		}));
 	}
+	/**
+	* Set or clear the shared bearer token that gates the inbound endpoint at
+	* runtime. Rebuilds the AgentCard so the `bearerAuth` security scheme is
+	* advertised (token set) or withdrawn (token cleared); `authorized()` reads
+	* `options.authToken` on each request, so the gate flips immediately. Pass
+	* `undefined` or an empty string to disable token gating.
+	*/
+	setAuthToken(token) {
+		this.options.authToken = token && token.length > 0 ? token : void 0;
+		if (this.options.authToken) applyAuthScheme(this.card, this.options.authToken);
+		else {
+			delete this.card.securitySchemes;
+			delete this.card.securityRequirements;
+		}
+	}
+	/** Whether the inbound endpoint is currently token-gated. */
+	get authConfigured() {
+		return Boolean(this.options.authToken);
+	}
 	buildCard() {
 		const iface = {
 			url: `${this.baseUrl.replace(/\/$/, "")}${this.endpointPath}`,
@@ -593,7 +626,8 @@ var A2AServer = class {
 			protocolVersion: "1.0"
 		};
 		const skills = this.options.skills ?? [];
-		return {
+		const token = this.options.authToken;
+		const card = {
 			name: this.options.agentName,
 			description: this.options.agentDescription,
 			version: this.options.agentVersion,
@@ -612,6 +646,18 @@ var A2AServer = class {
 			skills,
 			...this.options.iconUrl ? { iconUrl: this.options.iconUrl } : {}
 		};
+		applyAuthScheme(card, token);
+		return card;
+	}
+	/** True when the request carries the configured bearer token. */
+	authorized(req) {
+		const token = this.options.authToken;
+		if (!token) return true;
+		const h = req.headers ?? {};
+		const auth = h["authorization"] ?? h["Authorization"];
+		if (!auth) return false;
+		const m = /^Bearer\s+(.+)$/i.exec(auth.trim());
+		return !!m && m[1] === token;
 	}
 	emit(ev) {
 		for (const l of this.listeners) l(ev);
@@ -625,6 +671,19 @@ var A2AServer = class {
 			body: JSON.stringify(this.card)
 		};
 		if (req.method === "POST" && path === this.endpointPath) {
+			if (!this.authorized(req)) return {
+				status: 401,
+				contentType: "application/json",
+				body: JSON.stringify({
+					jsonrpc: "2.0",
+					id: null,
+					error: {
+						code: -32001,
+						message: "Unauthorized"
+					}
+				}),
+				headers: { "WWW-Authenticate": "Bearer" }
+			};
 			let payload;
 			try {
 				payload = JSON.parse(body);
@@ -671,6 +730,10 @@ var A2AServer = class {
 			})}\n\n`);
 			return { status: 200 };
 		}
+		if (!this.authorized(req)) return {
+			status: 401,
+			headers: { "WWW-Authenticate": "Bearer" }
+		};
 		let payload;
 		try {
 			payload = JSON.parse(body);
@@ -748,14 +811,16 @@ var A2AServer = class {
 			contextId,
 			status: this.store.get(taskId).status
 		} });
-		const signal = new AbortController().signal;
+		const controller = new AbortController();
+		this.running.set(taskId, controller);
 		try {
 			const reply = await this.execute({
 				message: msg,
 				taskId,
 				contextId,
-				signal
+				signal: controller.signal
 			});
+			if (controller.signal.aborted || isTerminal(this.store.get(taskId)?.status.state)) return;
 			this.store.addArtifact(taskId, {
 				artifactId: "result",
 				parts: reply.parts,
@@ -772,6 +837,7 @@ var A2AServer = class {
 				lastChunk: true
 			} });
 		} catch (err) {
+			if (controller.signal.aborted || isTerminal(this.store.get(taskId)?.status.state)) return;
 			const message = {
 				messageId: crypto.randomUUID(),
 				role: "ROLE_AGENT",
@@ -784,6 +850,8 @@ var A2AServer = class {
 				contextId,
 				status: this.store.get(taskId).status
 			} });
+		} finally {
+			this.running.delete(taskId);
 		}
 	}
 	async dispatch(rpc) {
@@ -831,6 +899,7 @@ var A2AServer = class {
 					code: A2A_ERROR_CODES.TASK_CANCEL_NOT_ALLOWED,
 					message: `Task ${id} already in terminal state ${task.status.state}`
 				};
+				this.running.get(id)?.abort();
 				this.store.setStatus(id, "TASK_STATE_CANCELED");
 				this.options.onTaskSettled?.(id);
 				return this.store.get(id);
@@ -859,6 +928,20 @@ var A2AServer = class {
 		};
 	}
 };
+/**
+* Advertise the `bearerAuth` HTTP security scheme on an AgentCard when a token
+* is configured. Mutates in place; a no-op when `token` is falsy. Shared by
+* {@link A2AServer.buildCard} and {@link A2AServer.setAuthToken}.
+*/
+function applyAuthScheme(card, token) {
+	if (!token) return;
+	card.securitySchemes = { bearerAuth: {
+		type: "http",
+		scheme: "bearer",
+		bearerFormat: "opaque"
+	} };
+	card.securityRequirements = [{ schemes: { bearerAuth: [] } }];
+}
 /** Pull task ids out of a dispatch result for inbound peer tracking. */
 function extractTaskIds(result) {
 	if (!result || typeof result !== "object") return [];
@@ -876,11 +959,34 @@ const defaultSkills = [{
 	outputModes: ["text/plain"]
 }];
 /**
-* Default executor: run the incoming prompt through the system shell and
+* Safe default executor: refuses to act, telling the caller to inject a real
+* executor. Used when an `A2AServer` is constructed without an `execute`
+* option, so an inbound message never triggers arbitrary action (in particular
+* never a shell command) unless the operator explicitly configured one.
+*/
+const notConfiguredExecutor = async ({ message }) => {
+	const text = message.parts.map((p) => "text" in p ? p.text : "").filter(Boolean).join("\n").slice(0, 120);
+	const detail = text ? ` (prompt: ${text}…)` : "";
+	return {
+		messageId: crypto.randomUUID(),
+		role: "ROLE_AGENT",
+		parts: [{ text: `no executor configured — inject one via the \`execute\` option${detail}` }]
+	};
+};
+/**
+* Shell executor: run the incoming prompt through the system shell and
 * return the captured stdout/stderr as the task artifact. Honors the
 * AbortSignal (task cancellation / shutdown) by killing the child process.
+*
+* This is local-testing-only: arbitrary text from an inbound message becomes
+* a `/bin/sh -c` command, so only use it against a trusted client. It is
+* deliberately NOT the default — pass it explicitly to opt in:
+*
+* ```ts
+* const server = new A2AServer({ ..., execute: shellExecutor }, store);
+* ```
 */
-const defaultExecutor = async ({ message, signal }) => {
+const shellExecutor = async ({ message, signal }) => {
 	const text = message.parts.map((p) => "text" in p ? p.text : "").filter(Boolean).join("\n");
 	if (!text.trim()) return {
 		messageId: crypto.randomUUID(),
@@ -920,6 +1026,179 @@ const defaultExecutor = async ({ message, signal }) => {
 		};
 	}
 };
+/**
+* Backwards-compatible alias for {@link shellExecutor}. Kept for code that
+* explicitly opted into the shell executor before it was renamed; the safe
+* default for `A2AServer` is now {@link notConfiguredExecutor}, so using
+* this alias still requires an explicit opt-in.
+*/
+const defaultExecutor = shellExecutor;
+/** Flatten A2A message parts into a single prompt string (text parts only). */
+function partsToPrompt(parts) {
+	return parts.map((p) => "text" in p && typeof p.text === "string" ? p.text : "").filter(Boolean).join("\n").trim();
+}
+/** Read the last assistant message's text off an agent's derived history. */
+function lastAssistantText(agent) {
+	const history = agent.session.deriveMessages();
+	for (let i = history.length - 1; i >= 0; i--) if (history[i].role === "assistant") return history[i].content.map((b) => b.type === "text" && typeof b.text === "string" ? b.text : "").filter(Boolean).join("\n").trim();
+	return "";
+}
+/** Derive a stable session id for an A2A context id. */
+function sessionIdForContext(contextId) {
+	return `a2a-${contextId}`;
+}
+/**
+* DSH agent executor: forward each inbound A2A task to this harness's own agent
+* loop and return the assistant reply as the task artifact.
+*
+* ONE A2A CONTEXT ⇒ ONE SESSION. A2A already scopes a conversation by
+* `contextId`, so this executor keeps one workspace-bound agent session per
+* context: the first task for a context `create()`s it (session id derived from
+* the context, `meta.cwd` from `opts.cwd`), and later tasks for the same
+* context reuse the SAME live agent so history accumulates. Distinct contexts
+* get distinct sessions. A fresh process that sees a known context first tries
+* `resume()` (load persisted history), falling back to `create()`.
+*
+* Sessions are NOT disposed per task — a disposed session couldn't accumulate
+* context. The returned executor exposes {@link DshAgentExecutor.disposeAll} so
+* the plugin disposes every live per-context session on unload/teardown.
+*
+* Per-context work is serialized on a promise chain so concurrent tasks for the
+* same context (and the shared `whenIdle()` — a whole-agent quiescence signal,
+* not a per-message one) can't interleave. Different contexts run in parallel.
+*
+* Enable this via the plugin's `execute` precedence in `index.ts`; it is not
+* `A2AServer`'s default (the default stays {@link notConfiguredExecutor}).
+*/
+function createDshAgentExecutor(agents, opts) {
+	const plugin = opts.plugin ?? "a2a";
+	const handles = /* @__PURE__ */ new Map();
+	const tails = /* @__PURE__ */ new Map();
+	/**
+	* Get or open the live agent for a context. Returns the agent and whether it
+	* was JUST opened (so the caller fires the one-time onSessionOpened hook after
+	* the first prompt lands, keeping "open" and "first message" atomic per tail).
+	* `justOpened` is true only on the create/resume path — a cached handle returns
+	* false — so it alone gates the once-per-context hook; serialization on the
+	* per-context tail guarantees no two openings race.
+	*/
+	const agentFor = async (contextId) => {
+		const sessionId = sessionIdForContext(contextId);
+		const existing = handles.get(contextId);
+		if (existing) return {
+			agent: existing.agent,
+			sessionId,
+			justOpened: false
+		};
+		const agentOptions = opts.resolveAgentOptions?.() ?? opts.agentOptions;
+		const withModel = agentOptions ? { agentOptions } : {};
+		const presets = opts.agentPresets;
+		let presetId;
+		let setup;
+		if (presets) try {
+			presetId = (await presets.resolve()).id;
+			if (!presetId) throw new Error("agent preset roster resolved to no id");
+			setup = async (agentCtx) => {
+				await presets.mount(agentCtx, presetId);
+			};
+		} catch (err) {
+			throw new Error(`a2a: failed to resolve agent preset: ${err.message}`);
+		}
+		const createOptions = {
+			sessionId,
+			...presetId ? { meta: {
+				cwd: opts.cwd,
+				agentPreset: presetId
+			} } : { meta: { cwd: opts.cwd } },
+			...withModel,
+			...setup ? { setup } : {}
+		};
+		let handle;
+		try {
+			handle = await agents.create(createOptions);
+		} catch (err) {
+			if (/already (has|owns)|persisted/i.test(err.message)) handle = await agents.resume({
+				resumeSessionId: sessionId,
+				...withModel,
+				...setup ? { setup } : {}
+			});
+			else throw err;
+		}
+		handles.set(contextId, handle);
+		return {
+			agent: handle.agent,
+			sessionId,
+			justOpened: true
+		};
+	};
+	/** Run one turn on a context's session, serialized behind its tail. */
+	const runTurn = async (contextId, prompt, signal) => {
+		const { agent, sessionId, justOpened } = await agentFor(contextId);
+		const onAbort = () => agent.cancel("a2a-canceled");
+		if (signal?.aborted) onAbort();
+		else signal?.addEventListener("abort", onAbort, { once: true });
+		const userMessage = Object.freeze({
+			id: crypto.randomUUID(),
+			role: "user",
+			content: [{
+				type: "text",
+				text: prompt
+			}],
+			source: {
+				kind: "plugin",
+				plugin
+			}
+		});
+		agent.send(userMessage, "next-turn", true);
+		if (justOpened) try {
+			await opts.onSessionOpened?.({
+				sessionId,
+				contextId,
+				session: agent.session,
+				firstPrompt: prompt
+			});
+		} catch {}
+		await agent.whenIdle();
+		return lastAssistantText(agent);
+	};
+	const executor = (async ({ message, contextId, signal }) => {
+		const prompt = partsToPrompt(message.parts);
+		if (!prompt) return {
+			messageId: crypto.randomUUID(),
+			role: "ROLE_AGENT",
+			parts: [{ text: "No prompt provided." }]
+		};
+		const ctxKey = contextId;
+		const run = (tails.get(ctxKey) ?? Promise.resolve()).catch(() => {}).then(() => runTurn(ctxKey, prompt, signal));
+		tails.set(ctxKey, run);
+		try {
+			const replyText = await run;
+			const text = signal?.aborted ? `(canceled) ${replyText}`.trim() : replyText || "(no reply)";
+			return {
+				messageId: crypto.randomUUID(),
+				role: "ROLE_AGENT",
+				parts: [{ text }]
+			};
+		} catch (err) {
+			return {
+				messageId: crypto.randomUUID(),
+				role: "ROLE_AGENT",
+				parts: [{ text: `DSH agent executor error: ${err.message}` }]
+			};
+		} finally {
+			if (tails.get(ctxKey) === run) tails.delete(ctxKey);
+		}
+	});
+	executor.disposeAll = async () => {
+		const live = [...handles.values()];
+		const pending = [...tails.values()];
+		handles.clear();
+		tails.clear();
+		await Promise.allSettled(pending);
+		await Promise.allSettled(live.map((h) => h.dispose()));
+	};
+	return executor;
+}
 //#endregion
 //#region src/dashboard.ts
 /** Registry of live A2A connections, both directions. */
@@ -1077,7 +1356,8 @@ var DashboardRegistry = class {
 					ok: false,
 					message: "discover-agent requires agentCardUrl"
 				};
-				return this.hooks.discoverAgent ? this.hooks.discoverAgent(url) : {
+				const bearerToken = payload?.bearerToken || void 0;
+				return this.hooks.discoverAgent ? this.hooks.discoverAgent(url, { bearerToken }) : {
 					ok: false,
 					message: "discover-agent is not wired"
 				};
@@ -1089,7 +1369,8 @@ var DashboardRegistry = class {
 					ok: false,
 					message: "add-agent requires agentCardUrl"
 				};
-				return this.hooks.addAgent ? this.hooks.addAgent(name, url) : {
+				const bearerToken = payload?.bearerToken || void 0;
+				return this.hooks.addAgent ? this.hooks.addAgent(name, url, { bearerToken }) : {
 					ok: false,
 					message: "add-agent is not wired (client mode not mounted)"
 				};
@@ -1106,6 +1387,13 @@ var DashboardRegistry = class {
 				ok: false,
 				message: "server control is not wired (server mode not mounted)"
 			};
+			case "set-server-auth": {
+				const token = payload?.authToken || void 0;
+				return this.hooks.setServerAuthToken ? this.hooks.setServerAuthToken(token) : {
+					ok: false,
+					message: "set-server-auth is not wired (server mode not mounted)"
+				};
+			}
 			case "server-status": return this.hooks.serverStatus ? Promise.resolve(this.hooks.serverStatus()) : {
 				ok: false,
 				message: "server-status is not wired (server mode not mounted)"
@@ -1191,6 +1479,30 @@ function profileNameFromArgv() {
 	}
 }
 /**
+* Best-effort profile-name fallback for launchers that resolve a profile
+* WITHOUT writing `--profile` back into argv.
+*
+* The dsh `web` subcommand is a hardcoded alias for `--profile web`: the
+* launcher resolves the name internally and boots the web profile, but the
+* process argv keeps the original tokens (`node …/dsh web [flags]`) — there
+* is no `--profile` flag and no environment variable naming the profile. So
+* when {@link profileNameFromArgv} finds nothing, check whether the first
+* non-flag token after argv[0] is a known dsh subcommand alias:
+*
+*   - `web`            → boot profile `web` (alias, never followed by a name)
+*   - `--profile <n>`  → already handled above
+*   - anything else    → unknown/not a profile alias (e.g. `plugin`, which
+*                        is a management mode, not a boot; returns undefined)
+*
+* Returns undefined when argv carries no recognizable alias, letting the
+* caller fall through to the cwd-based resolution steps.
+*/
+function profileNameFromDshAlias() {
+	const argv = process.argv ?? [];
+	if (argv.includes("--profile") || argv.some((a) => a.startsWith("--profile="))) return void 0;
+	if (argv[2] === "web") return "web";
+}
+/**
 * Resolve the a2a.json path for the current process, without depending on
 * the launch directory. The plugin must work no matter where `dsh` was
 * started from (dsh does NOT chdir into the profile directory), so this
@@ -1200,7 +1512,9 @@ function profileNameFromArgv() {
 *
 * Order:
 *   0. `$DSH_HOME/profiles/<argv --profile>/a2a.json` — the active profile
-*      as named on the command line (most authoritative; works from ANY cwd)
+*      as named on the command line (most authoritative; works from ANY cwd).
+*      Also matches the `dsh web` alias, which boots profile `web` without
+*      writing `--profile` into argv.
 *   1. `cwd/a2a.json` — explicit when launched inside a profile dir
 *   2. outward from cwd: the nearest ancestor holding `a2a.json` — covers
 *      launching from e.g. a repo checkout whose parent chain includes the
@@ -1218,7 +1532,7 @@ function resolveConfigPath() {
 	const cwd = process.cwd();
 	const home = process.env.DSH_HOME ?? join(homedir(), ".dsh");
 	const base = cwd.split(/[\\/]/).pop() ?? "";
-	const profileName = profileNameFromArgv();
+	const profileName = profileNameFromArgv() ?? profileNameFromDshAlias();
 	if (profileName && profileName !== "." && profileName !== ".." && !profileName.includes("/") && !profileName.includes("\\")) {
 		const argvFile = join(home, "profiles", profileName, A2A_CONFIG_FILENAME);
 		if (existsSync(argvFile)) return argvFile;
@@ -1291,6 +1605,7 @@ function mergePersisted(base, persisted) {
 		if (pServer.agentDescription) merged.agentDescription = pServer.agentDescription;
 		if (pServer.agentVersion) merged.agentVersion = pServer.agentVersion;
 		if (pServer.endpointPath) merged.endpointPath = pServer.endpointPath;
+		if (pServer.authToken !== void 0) merged.authToken = pServer.authToken;
 		if (pServer.skills) merged.skills = pServer.skills;
 	}
 	return merged;
@@ -1599,8 +1914,9 @@ function apply(ctx, config = {}) {
 						message: `connection ${connectionId} reconnected as ${newId}`
 					};
 				},
-				addAgent: async (name, agentCardUrl) => {
-					const cid = await connect(name, agentCardUrl, true);
+				addAgent: async (name, agentCardUrl, opts) => {
+					const bearerToken = opts?.bearerToken;
+					const cid = await connect(name, agentCardUrl, true, { bearerToken });
 					if (!cid) return {
 						ok: false,
 						message: `failed to connect to ${agentCardUrl}`
@@ -1609,7 +1925,8 @@ function apply(ctx, config = {}) {
 						name,
 						agentCardUrl,
 						configured: true,
-						enabled: true
+						enabled: true,
+						bearerToken
 					});
 					persistAgents();
 					return {
@@ -1617,11 +1934,11 @@ function apply(ctx, config = {}) {
 						message: `agent "${name}" connected as ${cid} (saved to ${configPath})`
 					};
 				},
-				discoverAgent: async (agentCardUrl) => {
+				discoverAgent: async (agentCardUrl, opts) => {
 					try {
 						const card = await fetchAgentCard(agentCardUrl, {
 							timeoutMs: mergedConfig.timeoutMs ?? 8e3,
-							bearerToken: mergedConfig.bearerToken
+							bearerToken: opts?.bearerToken ?? mergedConfig.bearerToken
 						});
 						const iface = pickInterface(card);
 						return {
@@ -1724,8 +2041,37 @@ function apply(ctx, config = {}) {
 		ctx.inject(["webServer"], (ctx) => {
 			ctx.effect(() => {
 				const webServer = ctx.webServer;
-				const baseUrl = mergedConfig.baseUrl ?? `http://${webServer.host === "0.0.0.0" ? "127.0.0.1" : webServer.host}:${webServer.port}`;
+				const baseUrl = mergedConfig.baseUrl ?? inferBaseUrl(webServer.host, webServer.port);
 				const endpointPath = mergedConfig.endpointPath ?? DEFAULT_ENDPOINT;
+				let execute = mergedConfig.execute;
+				let executorKind = execute ? "custom" : "none";
+				let disposeExecutor;
+				if (!execute) {
+					const agents = probeAgentRegistry(ctx);
+					if (agents) {
+						const inboundCwd = inboundSessionCwd(configPath);
+						const dshExec = createDshAgentExecutor(agents, {
+							cwd: inboundCwd,
+							plugin: "a2a",
+							agentPresets: probeAgentPresets(ctx),
+							resolveAgentOptions: () => {
+								const sel = probeAgentDefaultModel(ctx)?.currentSelection();
+								if (!sel?.model && !sel?.provider) return void 0;
+								return {
+									provider: sel.provider,
+									model: sel.model
+								};
+							},
+							onSessionOpened: ({ session, firstPrompt }) => {
+								probeSessionTitle(ctx)?.rename(session, `A2A: ${summarize(firstPrompt)}`);
+							}
+						});
+						execute = dshExec;
+						disposeExecutor = () => dshExec.disposeAll();
+						executorKind = "dsh-agent";
+						logger?.info?.(`[a2a] server executor: DSH agent session per A2A context (cwd ${inboundCwd})`);
+					}
+				}
 				const server = new A2AServer({
 					baseUrl,
 					agentName: mergedConfig.agentName ?? "DSH Agent",
@@ -1733,7 +2079,8 @@ function apply(ctx, config = {}) {
 					agentVersion: mergedConfig.agentVersion ?? "0.1.0",
 					skills: mergedConfig.skills,
 					endpointPath,
-					execute: mergedConfig.execute,
+					execute,
+					authToken: mergedConfig.authToken,
 					onInbound: (facts) => {
 						const peerId = dashboard.touchInbound({
 							headers: facts.headers,
@@ -1780,17 +2127,23 @@ function apply(ctx, config = {}) {
 							}
 							const body = await readBody(req);
 							if (isStream) {
-								res.writeHead(200, {
-									"content-type": "text/event-stream",
-									"cache-control": "no-cache",
-									connection: "keep-alive"
-								});
-								await server.handleStream(toServerReq(req), body, (frame) => res.write(frame));
+								const stream = await server.handleStream(toServerReq(req), body, (frame) => res.write(frame));
+								if (stream.status !== 200) {
+									res.writeHead(stream.status, {
+										"content-type": "text/plain",
+										...stream.headers ?? {}
+									});
+									res.end("Unauthorized");
+									return;
+								}
 								res.end();
 								return;
 							}
 							const out = await server.handle(toServerReq(req), body);
-							res.writeHead(out.status, { "content-type": out.contentType });
+							res.writeHead(out.status, {
+								"content-type": out.contentType,
+								...out.headers ?? {}
+							});
 							res.end(out.body);
 						}
 					}));
@@ -1813,7 +2166,9 @@ function apply(ctx, config = {}) {
 						name: s.name,
 						description: s.description
 					})),
-					customExecutor: Boolean(mergedConfig.execute)
+					customExecutor: Boolean(mergedConfig.execute),
+					executor: executorKind,
+					authConfigured: server.authConfigured
 				});
 				dashboard.setHooks({
 					setServerEnabled: async (enable) => {
@@ -1838,6 +2193,27 @@ function apply(ctx, config = {}) {
 							message: "A2A server disabled"
 						};
 					},
+					setServerAuthToken: async (token) => {
+						server.setAuthToken(token);
+						const next = loadConfig();
+						next.server = {
+							...next.server ?? {},
+							authToken: token && token.length > 0 ? token : void 0
+						};
+						const res = saveConfig(next);
+						if (!res.ok) {
+							logger?.error?.(`[a2a] failed to persist authToken to ${res.path}: ${res.message}`);
+							return {
+								ok: false,
+								message: `applied in-memory but failed to save: ${res.message}`
+							};
+						}
+						logger?.info?.(`[a2a] inbound authToken ${token ? "set" : "cleared"} (saved to ${res.path})`);
+						return {
+							ok: true,
+							message: token ? "已设置入站鉴权 token" : "已清除入站鉴权 token"
+						};
+					},
 					serverStatus: () => ({
 						ok: true,
 						message: JSON.stringify({
@@ -1848,11 +2224,140 @@ function apply(ctx, config = {}) {
 				});
 				return () => {
 					unregisterRoutes();
+					disposeExecutor?.().catch((err) => logger?.error?.(`[a2a] executor dispose failed: ${err.message}`));
 				};
 			}, "a2a: server routes");
 		});
 	}
 }
+/**
+* Probe for a usable agent registry WITHOUT taking an inject dependency on it.
+*
+* `ctx.agents` (the registry) can be present while `create()` still rejects —
+* that happens on a bare dsh-base profile that has the agent layer but no
+* agent-loop plugin to register the creation factory. We can't cheaply tell
+* "factory registered" apart from "registry present" without attempting a
+* create, so this returns the registry when it's structurally usable and lets
+* {@link createDshAgentExecutor} degrade to a readable error if a later
+* `create()` rejects.
+*/
+function probeAgentRegistry(ctx) {
+	return probeService(ctx, "agents", "create");
+}
+/**
+* Probe for the agent-preset roster service (`ctx.agentPresets`, owned by
+* `@deepseek-ai/dsh-agent-presets`) without an inject dependency. When the
+* deployment composes presets (`dsh-web-app` mounts the roster with a
+* `default: standard`), inbound sessions must be composed from the same
+* preset or they publish against the empty global layer — tools, prompt
+* sections, and skills all absent. Absent rosters keep legacy behavior.
+*/
+function probeAgentPresets(ctx) {
+	return probeService(ctx, "agentPresets", "resolve");
+}
+/**
+* Probe for the deployment default-model service without an inject dependency.
+* Returns undefined when the service is absent, so the executor simply creates
+* the agent without a seeded selection — fine for compositions that seed the
+* model another way.
+*/
+function probeAgentDefaultModel(ctx) {
+	return probeService(ctx, "agentDefaultModel", "currentSelection");
+}
+/** Probe `ctx.sessionTitle` (optional). Used to name inbound sessions. */
+function probeSessionTitle(ctx) {
+	return probeService(ctx, "sessionTitle", "rename");
+}
+/**
+* Read a strict service off the reflection layer and confirm it exposes the
+* named method, without taking an inject dependency. Returns undefined when the
+* service is absent, its fiber inactive, or the method missing.
+*/
+function probeService(ctx, name, method) {
+	try {
+		const svc = ctx.reflect?.get(name, true);
+		if (svc && typeof svc[method] === "function") return svc;
+	} catch {}
+}
+/**
+* One-line title summary from a prompt: first line, whitespace-collapsed, cut
+* to a display-friendly length on a word boundary when possible.
+*/
+function summarize(prompt, maxChars = 40) {
+	const text = prompt.replace(/\s+/g, " ").trim();
+	if (text.length <= maxChars) return text || "(empty)";
+	const cut = text.slice(0, maxChars);
+	const sp = cut.lastIndexOf(" ");
+	return `${(sp > maxChars * .6 ? cut.slice(0, sp) : cut).trimEnd()}…`;
+}
+/**
+* Absolute cwd for inbound per-context sessions: a `.a2a-sessions` subdir of
+* the profile directory (the dir holding `a2a.json`), kept separate from the
+* profile root so inbound sessions don't crowd the user's interactive
+* conversations there. They surface in the session list's "Ungrouped" bucket,
+* named `A2A: <summary>`. Created if missing (persistence writes under it);
+* falls back to cwd on any failure.
+*/
+function inboundSessionCwd(configPath) {
+	try {
+		const dir = join(dirname(configPath), ".a2a-sessions");
+		mkdirSync(dir, { recursive: true });
+		return dir;
+	} catch {
+		return process.cwd();
+	}
+}
+/**
+* Derive the public base URL advertised in the AgentCard from the real wire
+* listen address, when the operator did not pin `baseUrl` in config.
+*
+* The A2A AgentCard must carry a URL a REMOTE caller can reach. When the web
+* server binds only loopback (`127.0.0.1`), that address is correct. But when
+* it binds every interface (`0.0.0.0`), advertising `127.0.0.1` is wrong for
+* every non-local caller — it points at the caller's own loopback. In that
+* case pick the machine's best-known LAN address (the primary non-loopback
+* IPv4 of the interface that routes to the default gateway), and only fall
+* back to loopback when no such address exists. IPv6 link-local is skipped
+* (not reachable without a scope id).
+*
+* @param host - the web server's configured bind host ('127.0.0.1' | '0.0.0.0').
+* @param port - the OS-assigned (or configured) listen port.
+* @returns a scheme+host+port URL for Agents to call back into this DSH.
+*/
+function inferBaseUrl(host, port) {
+	return `http://${host === "0.0.0.0" ? primaryLanAddress() ?? "127.0.0.1" : host || "127.0.0.1"}:${port}`;
+}
+/**
+* Best single LAN IPv4 for this machine: the address of the non-loopback
+* interface whose route reaches the default gateway (the address a remote
+* peer on the same subnet would use to reach us). Returns undefined when the
+* machine has no non-loopback IPv4 (e.g. offline / containers).
+*
+* Prefers IPv4 (A2A URLs here are v4-style), skips link-local (169.254.0.0/16)
+* and CGNAT (100.64.0.0/10) ranges, which are useless to advertise.
+*/
+function primaryLanAddress() {
+	try {
+		const ifaces = networkInterfaces();
+		let candidate;
+		for (const name of Object.keys(ifaces)) {
+			const addrs = ifaces[name] ?? [];
+			for (const a of addrs) {
+				if (a.family !== "IPv4" || a.internal) continue;
+				const ip = a.address;
+				if (ip.startsWith("169.254.")) continue;
+				const first = Number(ip.split(".")[0]);
+				const second = Number(ip.split(".")[1]);
+				if (first === 100 && second >= 64 && second <= 127) continue;
+				if (!candidate) candidate = ip;
+				if (name === "en0" || name === "eth0" || name === "ens3" || name === "ens5") return ip;
+			}
+		}
+		return candidate;
+	} catch {
+		return;
+	}
+}
 /** Drain the request body from a Node IncomingMessage. */
 async function readBody(req) {
 	return new Promise((resolve, reject) => {
@@ -1893,4 +2398,4 @@ function toServerReq(req) {
 	};
 }
 //#endregion
-export { A2AClient, A2AError, A2AServer, A2A_ERROR_CODES, A2A_METHODS, DashboardRegistry, Role, TaskState, TaskStore, apply, defaultExecutor, defaultSkills, fetchAgentCard, getSharedRegistry, inject, isTerminal, name, registerAgentTools };
+export { A2AClient, A2AError, A2AServer, A2A_ERROR_CODES, A2A_METHODS, DashboardRegistry, Role, TaskState, TaskStore, apply, createDshAgentExecutor, defaultExecutor, defaultSkills, fetchAgentCard, getSharedRegistry, inferBaseUrl, inject, isTerminal, name, notConfiguredExecutor, registerAgentTools, shellExecutor };