@ryubyte/dsh-a2a 0.1.3 → 0.1.5

package/src/client/index.ts

@@ -115,6 +115,10 @@ export function DashboardSection(_props: SectionProps): ReactElement {
   const [tab, setTab] = useState<'out' | 'in' | 'serve'>('out');
   /** connection ids whose skill list is expanded in the outbound tab. */
   const [expanded, setExpanded] = useState<Set<string>>(new Set());
+  /** Optional bearer token for the add-agent form (outbound). */
+  const [addToken, setAddToken] = useState('');
+  /** Inbound authToken input (serve tab); empty string means "clear". */
+  const [authInput, setAuthInput] = useState('');
 
   interface ServeStatus {
     enabled: boolean;
@@ -125,7 +129,12 @@ export function DashboardSection(_props: SectionProps): ReactElement {
     endpoint?: string;
     agentCardUrl?: string;
     skills?: Array<{ id: string; name: string; description?: string }>;
+    /** Legacy: true when a custom executor was injected (kept for old snapshots). */
     customExecutor?: boolean;
+    /** How inbound tasks are executed. */
+    executor?: 'custom' | 'dsh-agent' | 'none';
+    /** Whether the inbound endpoint is token-gated (never the token value). */
+    authConfigured?: boolean;
   }
 
   const refresh = async (): Promise<void> => {
@@ -191,7 +200,7 @@ const doDiscover = async (): Promise<void> => {
     const res = await fetch('/a2a/api', {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ action: 'discover-agent', agentCardUrl: u }),
+      body: JSON.stringify({ action: 'discover-agent', agentCardUrl: u, bearerToken: addToken.trim() || undefined }),
     });
     const body = (await res.json()) as ControlResultApi;
     if (!body.ok || !body.message) {
@@ -209,9 +218,10 @@ const doDiscover = async (): Promise<void> => {
 const doConnect = async (): Promise<void> => {
   if (!discovered) return;
   const n = discovered.name.trim() || 'remote';
-  await act('add-agent', n, { agentCardUrl: discovered.agentCardUrl });
+  await act('add-agent', n, { agentCardUrl: discovered.agentCardUrl, bearerToken: addToken.trim() || undefined });
   if (!busy) {
     setAddUrl('');
+    setAddToken('');
     setDiscovered(null);
   }
 };
@@ -284,6 +294,22 @@ const inputStyle = { padding: '4px 8px', fontSize: 13, borderRadius: 6, border:
               }),
               actionBtn('导入', false, () => void doDiscover(), discovering || !addUrl.trim()),
             ),
+            createElement(
+              'div',
+              { style: { display: 'flex', alignItems: 'center', gap: 8, flexWrap: 'wrap' } },
+              createElement('input', {
+                type: 'password',
+                placeholder: 'Bearer Token(可选,发送为 Authorization: Bearer …)',
+                value: addToken,
+                onChange: (e: { target: { value: string } }) => setAddToken(e.target.value),
+                style: { ...inputStyle, flex: 1, minWidth: 260 },
+              }),
+            ),
+            createElement(
+              'div',
+              { style: { fontSize: 11.5, color: 'var(--dsw-alias-label-tertiary, #999)' } },
+              '若远程 Agent 需要鉴权,填入 token;导入与后续调用都会带上。token 会明文存入 a2a.json。',
+            ),
             discovering
               ? createElement('div', { style: { fontSize: 13, color: 'var(--dsw-alias-label-tertiary, #999)' } }, '正在读取 Agent Card…')
               : discovered
@@ -318,7 +344,7 @@ const inputStyle = { padding: '4px 8px', fontSize: 13, borderRadius: 6, border:
                     createElement(
                       'div',
                       { style: { display: 'flex', gap: 8, marginTop: 2 } },
-                      actionBtn('连接', true, () => void doConnect(), busy === 'add-agent'),
+                      actionBtn('连接', true, () => void doConnect(), busy?.startsWith('add-agent:') ?? false),
                       actionBtn('取消', false, () => { setDiscovered(null); setAddUrl(''); }, false),
                     ),
                   )
@@ -349,8 +375,8 @@ const inputStyle = { padding: '4px 8px', fontSize: 13, borderRadius: 6, border:
               'span',
               { style: { marginLeft: 'auto' } },
               serve.enabled
-                ? actionBtn('下线', false, () => void act('server-disable', ''), busy === 'server-disable')
-                : actionBtn('上线', true, () => void act('server-enable', ''), busy === 'server-enable'),
+                ? actionBtn('下线', false, () => void act('server-disable', ''), busy === 'server-disable:')
+                : actionBtn('上线', true, () => void act('server-enable', ''), busy === 'server-enable:'),
             ),
           ),
           createElement(
@@ -384,13 +410,8 @@ const inputStyle = { padding: '4px 8px', fontSize: 13, borderRadius: 6, border:
                 )
               : null,
           ),
-          serve.enabled && !serve.customExecutor
-            ? createElement(
-                'div',
-                { style: { fontSize: 12, color: 'var(--dsw-warning, #b26a00)', background: 'rgba(178,106,0,.08)', borderRadius: 6, padding: '6px 10px' } },
-                '⚠ 默认 executor 会执行 shell 命令。生产环境请通过配置指定受限的 execute 实现。',
-              )
-            : null,
+          serve.enabled ? executorNote(serve) : null,
+          serve.enabled ? authControl(serve, busy, act, authInput, setAuthInput) : null,
         )
       : null,
     // ── inbound tab ────────────────────────────────────────
@@ -594,6 +615,84 @@ function actionBtn(label: string, primary: boolean, onClick: () => void, disable
   );
 }
 
+/**
+ * A semantically-correct note about how inbound tasks are executed. Dispatches
+ * on the `executor` field; falls back to the legacy `customExecutor` boolean
+ * for snapshots from an older host that didn't send `executor`.
+ */
+function executorNote(serve: {
+  executor?: 'custom' | 'dsh-agent' | 'none';
+  customExecutor?: boolean;
+}): ReactElement | null {
+  const kind = serve.executor ?? (serve.customExecutor ? 'custom' : undefined);
+  if (kind === 'custom') return null; // operator wired their own executor
+  if (kind === 'dsh-agent') {
+    return createElement(
+      'div',
+      { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary, #666)', background: 'rgba(74,125,255,.08)', borderRadius: 6, padding: '6px 10px' } },
+      'ℹ 入站任务由本 DSH 的 agent 会话执行,按 A2A contextId 一个对话一个会话。',
+    );
+  }
+  if (kind === 'none') {
+    return createElement(
+      'div',
+      { style: { fontSize: 12, color: 'var(--dsw-warning, #b26a00)', background: 'rgba(178,106,0,.08)', borderRadius: 6, padding: '6px 10px' } },
+      '⚠ 未配置 executor,且未检测到可用的 agent 循环:入站任务会被拒绝。通过配置注入 execute,或加载 agent-loop 插件。',
+    );
+  }
+  return null;
+}
+
+/**
+ * Inbound bearer-token control for the serve tab: shows whether the endpoint is
+ * token-gated, and lets the operator set or clear the shared token. The token
+ * value is never read back from the host — only whether one is configured.
+ */
+function authControl(
+  serve: { authConfigured?: boolean },
+  busy: string | null,
+  act: (a: string, t: string, p?: Record<string, unknown>) => Promise<void>,
+  authInput: string,
+  setAuthInput: (v: string) => void,
+): ReactElement {
+  const inputStyle = { padding: '4px 8px', fontSize: 13, borderRadius: 6, border: '1px solid var(--dsw-alias-border-l2, rgba(127,127,127,.3))', background: 'var(--dsw-alias-fill-l1, rgba(127,127,127,.06))', color: 'var(--dsw-alias-label-primary, #222)' };
+  return createElement(
+    'div',
+    { style: { display: 'flex', flexDirection: 'column', gap: 6, marginTop: 4 } },
+    createElement(
+      'div',
+      { style: { display: 'flex', alignItems: 'center', gap: 8 } },
+      createElement('span', { style: { fontSize: 12.5, fontWeight: 600, color: 'var(--dsw-alias-label-primary, #222)' } }, '入站鉴权'),
+      stateDot(serve.authConfigured ? 'connected' : 'disabled'),
+      createElement(
+        'span',
+        { style: { fontSize: 12, color: serve.authConfigured ? '#2e7d32' : '#9e9e9e' } },
+        serve.authConfigured ? '已启用 Bearer 鉴权' : '未鉴权(任何客户端可调用)',
+      ),
+    ),
+    createElement(
+      'div',
+      { style: { display: 'flex', alignItems: 'center', gap: 8, flexWrap: 'wrap' } },
+      createElement('input', {
+        type: 'password',
+        placeholder: serve.authConfigured ? '输入新 token 以替换' : '设置 Bearer Token 以开启鉴权',
+        value: authInput,
+        onChange: (e: { target: { value: string } }) => setAuthInput(e.target.value),
+        style: { ...inputStyle, flex: 1, minWidth: 220 },
+      }),
+      actionBtn('保存', true, () => { void act('set-server-auth', '', { authToken: authInput.trim() }); setAuthInput(''); }, busy === 'set-server-auth:' || !authInput.trim()),
+      serve.authConfigured
+        ? actionBtn('清除', false, () => { void act('set-server-auth', '', { authToken: '' }); setAuthInput(''); }, busy === 'set-server-auth:')
+        : null,
+    ),
+    createElement(
+      'div',
+      { style: { fontSize: 11.5, color: 'var(--dsw-alias-label-tertiary, #999)' } },
+      'token 会明文存入 a2a.json,重启后仍生效。设置后,入站 JSON-RPC 请求需带 Authorization: Bearer <token>。',
+    ),
+  );
+}
+
 function inboundRow(p: InboundPeerApi, busy: string | null, act: (a: string, t: string) => void): ReactElement {
   return createElement(
     'tr',

package/src/dashboard.ts

@@ -91,11 +91,13 @@ export interface DashboardControlHooks {
   /** Reconnect is not meaningful for an inbound peer — rejects unless overridden. */
   reconnectPeer?: (peerId: string) => Promise<ControlResult>;
   /** Runtime-add an outbound agent (visual config). Returns the new connection id. */
-  addAgent?: (name: string, agentCardUrl: string) => Promise<ControlResult>;
+  addAgent?: (name: string, agentCardUrl: string, opts?: { bearerToken?: string }) => Promise<ControlResult>;
   /** Discover an Agent Card without connecting (for the import preview). */
-  discoverAgent?: (agentCardUrl: string) => Promise<ControlResult>;
+  discoverAgent?: (agentCardUrl: string, opts?: { bearerToken?: string }) => Promise<ControlResult>;
   /** Enable/disable the inbound A2A server (serve routes) at runtime. */
   setServerEnabled?: (enabled: boolean) => Promise<ControlResult>;
+  /** Set or clear the inbound server's shared bearer token at runtime (persisted). */
+  setServerAuthToken?: (token?: string) => Promise<ControlResult>;
   /** Read current inbound server status (for the serve panel). */
   serverStatus?: () => ControlResult;
   /** Runtime-remove an outbound agent by its connection id. */
@@ -271,16 +273,18 @@ export class DashboardRegistry {
       case 'discover-agent': {
         const url = (payload?.agentCardUrl as string) ?? target;
         if (!url) return { ok: false, message: 'discover-agent requires agentCardUrl' };
+        const bearerToken = (payload?.bearerToken as string) || undefined;
         return this.hooks.discoverAgent
-          ? this.hooks.discoverAgent(url)
+          ? this.hooks.discoverAgent(url, { bearerToken })
           : { ok: false, message: 'discover-agent is not wired' };
       }
       case 'add-agent': {
         const name = (payload?.name as string) ?? target;
         const url = payload?.agentCardUrl as string | undefined;
         if (!url) return { ok: false, message: 'add-agent requires agentCardUrl' };
+        const bearerToken = (payload?.bearerToken as string) || undefined;
         return this.hooks.addAgent
-          ? this.hooks.addAgent(name, url)
+          ? this.hooks.addAgent(name, url, { bearerToken })
           : { ok: false, message: 'add-agent is not wired (client mode not mounted)' };
       }
       case 'remove-agent':
@@ -295,6 +299,14 @@ export class DashboardRegistry {
         return this.hooks.setServerEnabled
           ? this.hooks.setServerEnabled(false)
           : { ok: false, message: 'server control is not wired (server mode not mounted)' };
+      case 'set-server-auth': {
+        // Empty/missing token clears the gate. The token value is never echoed
+        // back in the result message.
+        const token = (payload?.authToken as string) || undefined;
+        return this.hooks.setServerAuthToken
+          ? this.hooks.setServerAuthToken(token)
+          : { ok: false, message: 'set-server-auth is not wired (server mode not mounted)' };
+      }
       case 'server-status':
         return this.hooks.serverStatus
           ? Promise.resolve(this.hooks.serverStatus())

package/src/index.ts

@@ -23,10 +23,14 @@
 
 import type { Context } from '@deepseek-ai/cordis';
 import type { IncomingMessage, ServerResponse } from 'node:http';
+import { mkdirSync } from 'node:fs';
+import { networkInterfaces } from 'node:os';
+import { dirname, join } from 'node:path';
 import { registerAgentTools } from './outbound.js';
 import { fetchAgentCard, pickInterface } from './card.js';
-import { A2AServer, type ServerOptions } from './server.js';
+import { A2AServer, type ServerOptions, createDshAgentExecutor, type AgentRegistryLike } from './server.js';
 import { TaskStore } from './server.js';
+import type { AgentPresetsLike } from './server.js';
 import { getSharedRegistry } from './dashboard.js';
 import {
   loadConfig as loadPersistedA2A,
@@ -54,6 +58,8 @@ export interface A2APluginConfig {
   skills?: ServerOptions['skills'];
   endpointPath?: string;
   execute?: ServerOptions['execute'];
+  /** Optional shared bearer token protecting the inbound /a2a endpoint. */
+  authToken?: string;
   // dashboard
   /** Serve the dashboard API on the webserver (default true). */
   dashboard?: boolean;
@@ -63,7 +69,8 @@ export { A2AClient } from './client.js';
 export * from './protocol.js';
 export * from './errors.js';
 export { fetchAgentCard } from './card.js';
-export { A2AServer, TaskStore, defaultExecutor, defaultSkills } from './server.js';
+export { A2AServer, TaskStore, defaultExecutor, notConfiguredExecutor, shellExecutor, defaultSkills, createDshAgentExecutor } from './server.js';
+export type { AgentRegistryLike, AgentPresetsLike, DshAgentExecutorOptions } from './server.js';
 export { registerAgentTools } from './outbound.js';
 export { DashboardRegistry, getSharedRegistry } from './dashboard.js';
 export type {
@@ -91,12 +98,46 @@ export interface WebServerService {
   }): () => void;
 }
 
+/**
+ * Structural slice of `ctx.agentDefaultModel` (owned by
+ * `@deepseek-ai/dsh-agent-default-model`). It holds the deployment's default
+ * `{ provider, model }` (layered with the user's Settings choice). Reading it
+ * to seed a newly-created agent's model is the creating entry point's job — a
+ * fresh session has no model selection, and DSH's persona system prompt fails
+ * assembly on an empty `{{model}}` variable otherwise.
+ */
+export interface AgentDefaultModelService {
+  currentSelection(): { provider?: string; model?: string; reasoningEffort?: string };
+}
+
+/**
+ * Structural slice of `ctx.sessionTitle` (owned by `@deepseek-ai/dsh-session-title`).
+ * `rename` accepts an explicit user title and pins it. We name inbound sessions
+ * ourselves because their prompts carry a `plugin` source, which the title
+ * service's automatic first-prompt naming deliberately ignores (human messages
+ * only) — so without this they fall back to the cwd basename.
+ */
+export interface SessionTitleService {
+  rename(session: unknown, title: string): unknown;
+}
+
 declare module '@deepseek-ai/cordis' {
   interface Context {
     /** Provided by @deepseek-ai/dsh-host-webserver. */
     webServer: WebServerService;
+    /** Provided by @deepseek-ai/dsh-agent-default-model (optional). */
+    agentDefaultModel?: AgentDefaultModelService;
+    /** Provided by @deepseek-ai/dsh-session-title (optional). */
+    sessionTitle?: SessionTitleService;
     /** Provided by @deepseek-ai/dsh-tools. */
     tools: { register(def: unknown): () => void };
+    /**
+     * Provided by @deepseek-ai/dsh-agent (the agent registry). Present whenever
+     * that layer is composed, but `create()` only succeeds once an agent-loop
+     * plugin has registered its factory — so server mode probes readiness
+     * before enabling {@link createDshAgentExecutor}, and never hard-injects it.
+     */
+    agents?: AgentRegistryLike;
   }
 }
 
@@ -365,19 +406,20 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
           dashboard.removeAgent(connectionId);
           return { ok: true, message: `connection ${connectionId} reconnected as ${newId}` };
         },
-        addAgent: async (name, agentCardUrl) => {
-          const cid = await connect(name, agentCardUrl, true);
+        addAgent: async (name, agentCardUrl, opts) => {
+          const bearerToken = opts?.bearerToken;
+          const cid = await connect(name, agentCardUrl, true, { bearerToken });
           if (!cid) return { ok: false, message: `failed to connect to ${agentCardUrl}` };
-          // Persist: add to a2a.json so it survives restart.
-          initialAgents.push({ name, agentCardUrl, configured: true, enabled: true });
+          // Persist: add to a2a.json so it survives restart (token included).
+          initialAgents.push({ name, agentCardUrl, configured: true, enabled: true, bearerToken });
           persistAgents();
           return { ok: true, message: `agent "${name}" connected as ${cid} (saved to ${configPath})` };
         },
-        discoverAgent: async (agentCardUrl) => {
+        discoverAgent: async (agentCardUrl, opts) => {
           try {
             const card = await fetchAgentCard(agentCardUrl, {
               timeoutMs: mergedConfig.timeoutMs ?? 8000,
-              bearerToken: mergedConfig.bearerToken,
+              bearerToken: opts?.bearerToken ?? mergedConfig.bearerToken,
             });
             const iface = pickInterface(card);
             return {
@@ -467,12 +509,64 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
       ctx.effect(() => {
         const webServer = ctx.webServer;
         // Derive the advertised base URL from the real listen address when the
-        // config doesn't pin one; avoids advertising a stale port.
-        const baseUrl =
-          mergedConfig.baseUrl ??
-          `http://${webServer.host === '0.0.0.0' ? '127.0.0.1' : webServer.host}:${webServer.port}`;
+        // config doesn't pin one; avoids advertising a stale port. When bound
+        // to 0.0.0.0, advertise a reachable LAN address, not loopback.
+        const baseUrl = mergedConfig.baseUrl ?? inferBaseUrl(webServer.host, webServer.port);
         const endpointPath = mergedConfig.endpointPath ?? DEFAULT_ENDPOINT;
 
+        // ── executor precedence ───────────────────────────────────────────────
+        //   1. explicit `execute` (config injection)          → use it
+        //   2. no explicit executor & the agent loop is ready → dshAgentExecutor:
+        //      inbound message → a fresh, workspace-bound DSH agent session →
+        //      reply. "Ready" means the agent-loop factory is registered, not
+        //      merely that `ctx.agents` exists — a bare dsh-base profile has the
+        //      registry but `create()` would reject. We probe via the reflection
+        //      layer (no inject requirement) so a composition without the agent
+        //      layer simply falls through.
+        //   3. otherwise                                       → A2AServer's
+        //      default notConfiguredExecutor (refuses + points at `execute`).
+        let execute = mergedConfig.execute;
+        let executorKind: 'custom' | 'dsh-agent' | 'none' = execute ? 'custom' : 'none';
+        let disposeExecutor: (() => Promise<void>) | undefined;
+        if (!execute) {
+          const agents = probeAgentRegistry(ctx);
+          if (agents) {
+            // Dedicated cwd for inbound sessions: a subdir of the profile dir,
+            // NOT the profile root — so per-context sessions don't pollute the
+            // profile-root session group with a burst of `.a2a`-named rows. DSH
+            // requires an absolute cwd and freezes it into the session header at
+            // creation. Inbound sessions land in the "Ungrouped" bucket of the
+            // session list; they are named `A2A: <summary>` so they're still
+            // identifiable there.
+            const inboundCwd = inboundSessionCwd(configPath);
+            // Seed the model per task from the deployment default selection
+            // (ctx.agentDefaultModel) — a fresh session has no model selection,
+            // and the persona system prompt fails assembly on an empty
+            // `{{model}}` without it. Resolving per task means a Settings model
+            // switch is picked up by the next inbound task.
+            const dshExec = createDshAgentExecutor(agents, {
+              cwd: inboundCwd,
+              plugin: 'a2a',
+              agentPresets: probeAgentPresets(ctx),
+              resolveAgentOptions: () => {
+                const sel = probeAgentDefaultModel(ctx)?.currentSelection();
+                if (!sel?.model && !sel?.provider) return undefined;
+                return { provider: sel.provider, model: sel.model };
+              },
+              onSessionOpened: ({ session, firstPrompt }) => {
+                // Name the session "A2A: <first-prompt summary>" — its prompts
+                // carry a plugin source, which DSH's automatic titling skips, so
+                // without this it would fall back to the cwd basename.
+                probeSessionTitle(ctx)?.rename(session, `A2A: ${summarize(firstPrompt)}`);
+              },
+            });
+            execute = dshExec;
+            disposeExecutor = () => dshExec.disposeAll();
+            executorKind = 'dsh-agent';
+            logger?.info?.(`[a2a] server executor: DSH agent session per A2A context (cwd ${inboundCwd})`);
+          }
+        }
+
         const server = new A2AServer(
           {
             baseUrl,
@@ -481,7 +575,8 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
             agentVersion: mergedConfig.agentVersion ?? '0.1.0',
             skills: mergedConfig.skills,
             endpointPath,
-            execute: mergedConfig.execute,
+            execute,
+            authToken: mergedConfig.authToken,
             onInbound: (facts) => {
               const peerId = dashboard.touchInbound(
                 { headers: facts.headers, source: facts.source },
@@ -544,17 +639,17 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
                 }
                 const body = await readBody(req);
                 if (isStream) {
-                  res.writeHead(200, {
-                    'content-type': 'text/event-stream',
-                    'cache-control': 'no-cache',
-                    connection: 'keep-alive',
-                  });
-                  await server.handleStream(toServerReq(req), body, (frame) => res.write(frame));
+                  const stream = await server.handleStream(toServerReq(req), body, (frame) => res.write(frame));
+                  if (stream.status !== 200) {
+                    res.writeHead(stream.status, { 'content-type': 'text/plain', ...(stream.headers ?? {}) });
+                    res.end('Unauthorized');
+                    return;
+                  }
                   res.end();
                   return;
                 }
                 const out = await server.handle(toServerReq(req), body);
-                res.writeHead(out.status, { 'content-type': out.contentType });
+                res.writeHead(out.status, { 'content-type': out.contentType, ...(out.headers ?? {}) });
                 res.end(out.body);
               },
             }),
@@ -580,6 +675,12 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
           agentCardUrl: `${baseUrl}/.well-known/agent-card.json`,
           skills: (server.card.skills ?? []).map((s) => ({ id: s.id, name: s.name, description: s.description })),
           customExecutor: Boolean(mergedConfig.execute),
+          // How inbound tasks are handled: a config-injected executor, this
+          // harness's own agent session, or none (refuses until configured).
+          executor: executorKind,
+          // Whether the inbound endpoint is token-gated. Never expose the token
+          // value itself — only whether one is set.
+          authConfigured: server.authConfigured,
         });
         dashboard.setHooks({
           setServerEnabled: async (enable) => {
@@ -595,6 +696,19 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
             logger?.info?.('[a2a] A2A server disabled');
             return { ok: true, message: 'A2A server disabled' };
           },
+          setServerAuthToken: async (token) => {
+            server.setAuthToken(token);
+            // Persist to a2a.json (server.authToken) so the gate survives restart.
+            const next: PersistedA2AConfig = loadPersistedA2A();
+            next.server = { ...(next.server ?? {}), authToken: token && token.length > 0 ? token : undefined };
+            const res = savePersistedA2A(next);
+            if (!res.ok) {
+              logger?.error?.(`[a2a] failed to persist authToken to ${res.path}: ${res.message}`);
+              return { ok: false, message: `applied in-memory but failed to save: ${res.message}` };
+            }
+            logger?.info?.(`[a2a] inbound authToken ${token ? 'set' : 'cleared'} (saved to ${res.path})`);
+            return { ok: true, message: token ? '已设置入站鉴权 token' : '已清除入站鉴权 token' };
+          },
           serverStatus: () => ({
             ok: true,
             message: JSON.stringify({ enabled, ...serverCard() }),
@@ -603,6 +717,8 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
 
         return () => {
           unregisterRoutes();
+          // Dispose every live per-context inbound session on unload/teardown.
+          void disposeExecutor?.().catch((err) => logger?.error?.(`[a2a] executor dispose failed: ${(err as Error).message}`));
         };
       }, 'a2a: server routes');
     });
@@ -612,6 +728,155 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
   // Wired per-instance inside the client-mode effect above.
 }
 
+/**
+ * Probe for a usable agent registry WITHOUT taking an inject dependency on it.
+ *
+ * `ctx.agents` (the registry) can be present while `create()` still rejects —
+ * that happens on a bare dsh-base profile that has the agent layer but no
+ * agent-loop plugin to register the creation factory. We can't cheaply tell
+ * "factory registered" apart from "registry present" without attempting a
+ * create, so this returns the registry when it's structurally usable and lets
+ * {@link createDshAgentExecutor} degrade to a readable error if a later
+ * `create()` rejects.
+ */
+function probeAgentRegistry(ctx: Context): AgentRegistryLike | undefined {
+  return probeService(ctx, 'agents', 'create') as AgentRegistryLike | undefined;
+}
+
+/**
+ * Probe for the agent-preset roster service (`ctx.agentPresets`, owned by
+ * `@deepseek-ai/dsh-agent-presets`) without an inject dependency. When the
+ * deployment composes presets (`dsh-web-app` mounts the roster with a
+ * `default: standard`), inbound sessions must be composed from the same
+ * preset or they publish against the empty global layer — tools, prompt
+ * sections, and skills all absent. Absent rosters keep legacy behavior.
+ */
+function probeAgentPresets(ctx: Context): AgentPresetsLike | undefined {
+  return probeService(ctx, 'agentPresets', 'resolve') as AgentPresetsLike | undefined;
+}
+
+/**
+ * Probe for the deployment default-model service without an inject dependency.
+ * Returns undefined when the service is absent, so the executor simply creates
+ * the agent without a seeded selection — fine for compositions that seed the
+ * model another way.
+ */
+function probeAgentDefaultModel(ctx: Context): AgentDefaultModelService | undefined {
+  const svc = probeService(ctx, 'agentDefaultModel', 'currentSelection');
+  return svc as AgentDefaultModelService | undefined;
+}
+
+/** Probe `ctx.sessionTitle` (optional). Used to name inbound sessions. */
+function probeSessionTitle(ctx: Context): SessionTitleService | undefined {
+  return probeService(ctx, 'sessionTitle', 'rename') as SessionTitleService | undefined;
+}
+
+/**
+ * Read a strict service off the reflection layer and confirm it exposes the
+ * named method, without taking an inject dependency. Returns undefined when the
+ * service is absent, its fiber inactive, or the method missing.
+ */
+function probeService(ctx: Context, name: string, method: string): unknown {
+  try {
+    const reflect = (ctx as unknown as { reflect?: { get(n: string, strict?: boolean): unknown } }).reflect;
+    const svc = reflect?.get(name, true);
+    if (svc && typeof (svc as Record<string, unknown>)[method] === 'function') return svc;
+  } catch {
+    // reflection unavailable or service resolution threw — treat as absent.
+  }
+  return undefined;
+}
+
+/**
+ * One-line title summary from a prompt: first line, whitespace-collapsed, cut
+ * to a display-friendly length on a word boundary when possible.
+ */
+function summarize(prompt: string, maxChars = 40): string {
+  const text = prompt.replace(/\s+/g, ' ').trim();
+  if (text.length <= maxChars) return text || '(empty)';
+  const cut = text.slice(0, maxChars);
+  const sp = cut.lastIndexOf(' ');
+  return `${(sp > maxChars * 0.6 ? cut.slice(0, sp) : cut).trimEnd()}…`;
+}
+
+/**
+ * Absolute cwd for inbound per-context sessions: a `.a2a-sessions` subdir of
+ * the profile directory (the dir holding `a2a.json`), kept separate from the
+ * profile root so inbound sessions don't crowd the user's interactive
+ * conversations there. They surface in the session list's "Ungrouped" bucket,
+ * named `A2A: <summary>`. Created if missing (persistence writes under it);
+ * falls back to cwd on any failure.
+ */
+function inboundSessionCwd(configPath: string): string {
+  try {
+    const dir = join(dirname(configPath), '.a2a-sessions');
+    mkdirSync(dir, { recursive: true });
+    return dir;
+  } catch {
+    return process.cwd();
+  }
+}
+
+/**
+ * Derive the public base URL advertised in the AgentCard from the real wire
+ * listen address, when the operator did not pin `baseUrl` in config.
+ *
+ * The A2A AgentCard must carry a URL a REMOTE caller can reach. When the web
+ * server binds only loopback (`127.0.0.1`), that address is correct. But when
+ * it binds every interface (`0.0.0.0`), advertising `127.0.0.1` is wrong for
+ * every non-local caller — it points at the caller's own loopback. In that
+ * case pick the machine's best-known LAN address (the primary non-loopback
+ * IPv4 of the interface that routes to the default gateway), and only fall
+ * back to loopback when no such address exists. IPv6 link-local is skipped
+ * (not reachable without a scope id).
+ *
+ * @param host - the web server's configured bind host ('127.0.0.1' | '0.0.0.0').
+ * @param port - the OS-assigned (or configured) listen port.
+ * @returns a scheme+host+port URL for Agents to call back into this DSH.
+ */
+export function inferBaseUrl(host: string, port: number): string {
+  const hostname =
+    host === '0.0.0.0'
+      ? primaryLanAddress() ?? '127.0.0.1'
+      : host || '127.0.0.1';
+  return `http://${hostname}:${port}`;
+}
+
+/**
+ * Best single LAN IPv4 for this machine: the address of the non-loopback
+ * interface whose route reaches the default gateway (the address a remote
+ * peer on the same subnet would use to reach us). Returns undefined when the
+ * machine has no non-loopback IPv4 (e.g. offline / containers).
+ *
+ * Prefers IPv4 (A2A URLs here are v4-style), skips link-local (169.254.0.0/16)
+ * and CGNAT (100.64.0.0/10) ranges, which are useless to advertise.
+ */
+function primaryLanAddress(): string | undefined {
+  try {
+    const ifaces = networkInterfaces();
+    let candidate: string | undefined;
+    for (const name of Object.keys(ifaces)) {
+      const addrs = ifaces[name] ?? [];
+      for (const a of addrs) {
+        if (a.family !== 'IPv4' || a.internal) continue;
+        const ip = a.address;
+        if (ip.startsWith('169.254.')) continue;
+        const first = Number(ip.split('.')[0]);
+        const second = Number(ip.split('.')[1]);
+        // CGNAT 100.64.0.0/10: first octet 100, second in [64..127]. The rest
+        // of 100.x.y.z is ordinary public space — keep it.
+        if (first === 100 && second >= 64 && second <= 127) continue;
+        if (!candidate) candidate = ip;
+        // Prefer addresses that match a default-route interface if visible.
+        if (name === 'en0' || name === 'eth0' || name === 'ens3' || name === 'ens5') return ip;
+      }
+    }
+    return candidate;
+  } catch {
+    return undefined;
+  }
+}
+
 /** Drain the request body from a Node IncomingMessage. */
 async function readBody(req: IncomingMessage): Promise<string> {
   return new Promise<string>((resolve, reject) => {