@ryubyte/dsh-a2a 0.3.1 → 0.3.2

package/README.en.md

@@ -9,6 +9,8 @@ It turns a DSH instance into a full A2A peer in both directions:
 - **Client mode (outbound)** — discover a remote agent via its **AgentCard**, map each **skill** to a DSH model tool (`a2a__<name>__<skill>`), and execute remote tasks through A2A **JSON-RPC**.
 - **Server mode (inbound)** — expose this DSH to other agents: `/.well-known/agent-card.json` plus a JSON-RPC endpoint (`SendMessage`, `GetTask`, `ListTasks`, `CancelTask`, `SendStreamingMessage` over SSE) on the DSH webserver.
 
+Supports DSH `0.1.7-rc.2`, `0.2.0-rc.1–2`, `0.2.1-alpha.1–5`, and `0.2.1-rc.1–5` (13 versions), checked individually in CI and before release. [Compatibility details](docs/dsh-compat.md).
+
 ## Installation
 
 Install into a profile with one command and restart:

package/README.md

@@ -9,6 +9,8 @@
 - **Client 模式（出站）**——通过远程 Agent 的 **AgentCard** 发现它，把每个 **skill** 映射为 DSH 模型工具（`a2a__<name>__<skill>`），通过 A2A **JSON-RPC** 执行远程任务。
 - **Server 模式（入站）**——把本 DSH 暴露给其他 Agent：在 DSH webserver 上提供 `/.well-known/agent-card.json` 与 JSON-RPC 端点（`SendMessage`、`GetTask`、`ListTasks`、`CancelTask`、基于 SSE 的 `SendStreamingMessage`）。
 
+兼容 DSH `0.1.7-rc.2`、`0.2.0-rc.1～2`、`0.2.1-alpha.1～5` 与 `0.2.1-rc.1～5`，共 13 个版本；CI 和发布流程逐版本验证。[兼容性说明](docs/dsh-compat.md)。
+
 ## 安装
 
 一行命令装进 profile，重启即生效：

package/lib/index.js

@@ -2174,7 +2174,7 @@ function apply(ctx, config = {}) {
 		ctx.inject(["webServer"], (ctx) => {
 			ctx.effect(() => {
 				const webServer = ctx.webServer;
-				const baseUrl = mergedConfig.baseUrl ?? inferBaseUrl(webServer.host, webServer.port);
+				const baseUrl = mergedConfig.baseUrl ?? webServerBaseUrl(webServer);
 				const endpointPath = mergedConfig.endpointPath ?? DEFAULT_ENDPOINT;
 				if (mergedConfig.baseUrl) try {
 					const pinnedPort = new URL(mergedConfig.baseUrl).port;
@@ -2382,7 +2382,7 @@ function apply(ctx, config = {}) {
 							baseUrl: void 0
 						} : patch;
 						const { endpointChanged } = server.updateCard(cardPatch);
-						if (clearBaseUrl) server.setBaseUrl(inferBaseUrl(webServer.host, webServer.port));
+						if (clearBaseUrl) server.setBaseUrl(webServerBaseUrl(webServer));
 						if (endpointChanged && enabled) {
 							unregisterRoutes();
 							registerRoutes();
@@ -2561,12 +2561,20 @@ function inboundSessionCwd(configPath) {
 * back to loopback when no such address exists. IPv6 link-local is skipped
 * (not reachable without a scope id).
 *
-* @param host - the web server's configured bind host ('127.0.0.1' | '0.0.0.0').
+* @param host - the web server's configured bind address.
 * @param port - the OS-assigned (or configured) listen port.
+* @param protocol - the host listener's protocol (older hosts default to HTTP).
 * @returns a scheme+host+port URL for Agents to call back into this DSH.
 */
-function inferBaseUrl(host, port) {
-	return `http://${host === "0.0.0.0" ? primaryLanAddress() ?? "127.0.0.1" : host || "127.0.0.1"}:${port}`;
+function inferBaseUrl(host, port, protocol = "http:") {
+	const hostname = host === "0.0.0.0" ? primaryLanAddress() ?? "127.0.0.1" : host || "127.0.0.1";
+	return `${protocol}//${hostname.includes(":") && !hostname.startsWith("[") ? `[${hostname}]` : hostname}:${port}`;
+}
+/** Prefer the host's authoritative origin; retain inference for older DSH. */
+function webServerBaseUrl(webServer) {
+	if (typeof webServer.getOrigin === "function") return webServer.getOrigin();
+	if (webServer.port === void 0) throw new Error("a2a: webServer has not bound a port");
+	return inferBaseUrl(webServer.host, webServer.port, webServer.protocol);
 }
 /**
 * Best single LAN IPv4 for this machine: the address of the non-loopback
@@ -2648,8 +2656,15 @@ function corsHeadersFor(reqOrigin, allowed) {
 function trustedLoopback(req) {
 	const host = req.headers.host;
 	if (!host) return false;
-	const hostname = host.split(":")[0];
-	if (hostname !== "127.0.0.1" && hostname !== "localhost" && hostname !== "::1") return false;
+	let hostname;
+	try {
+		const authority = new URL(`http://${host}`);
+		if (authority.username || authority.password || authority.pathname !== "/" || authority.search || authority.hash) return false;
+		hostname = authority.hostname;
+	} catch {
+		return false;
+	}
+	if (hostname !== "127.0.0.1" && hostname !== "localhost" && hostname !== "[::1]") return false;
 	if (req.headers["sec-fetch-site"] === "cross-site") return false;
 	const origin = req.headers.origin;
 	if (!origin) return true;
@@ -2675,4 +2690,4 @@ function toServerReq(req) {
 	};
 }
 //#endregion
-export { A2AClient, A2AError, A2AServer, A2A_ERROR_CODES, A2A_METHODS, DashboardRegistry, Role, TaskState, TaskStore, apply, createDshAgentExecutor, defaultExecutor, defaultSkills, fetchAgentCard, getSharedRegistry, inferBaseUrl, inject, isTerminal, name, notConfiguredExecutor, registerAgentTools, shellExecutor };
+export { A2AClient, A2AError, A2AServer, A2A_ERROR_CODES, A2A_METHODS, DashboardRegistry, Role, TaskState, TaskStore, apply, createDshAgentExecutor, defaultExecutor, defaultSkills, fetchAgentCard, getSharedRegistry, inferBaseUrl, inject, isTerminal, name, notConfiguredExecutor, registerAgentTools, shellExecutor, webServerBaseUrl };

package/lib/types/index.d.ts

@@ -77,9 +77,12 @@ export type { DashboardSnapshot, InboundPeer, OutboundAgent, ControlResult, } fr
  */
 export interface WebServerService {
     /** The OS-assigned (or configured) listen port. */
-    readonly port: number;
-    /** The configured bind host literal ('127.0.0.1' | '0.0.0.0'). */
+    readonly port: number | undefined;
+    /** The configured bind address. Older hosts also allow '0.0.0.0'. */
     readonly host: string;
+    /** Added by DSH 0.2.1: preserve TLS and canonical IPv6/mapped addresses. */
+    getOrigin?(): string;
+    readonly protocol?: 'http:' | 'https:';
     register(route: {
         kind: 'exact' | 'prefix';
         path: string;
@@ -154,9 +157,12 @@ export declare function apply(ctx: Context, config?: A2APluginConfig): void;
  * back to loopback when no such address exists. IPv6 link-local is skipped
  * (not reachable without a scope id).
  *
- * @param host - the web server's configured bind host ('127.0.0.1' | '0.0.0.0').
+ * @param host - the web server's configured bind address.
  * @param port - the OS-assigned (or configured) listen port.
+ * @param protocol - the host listener's protocol (older hosts default to HTTP).
  * @returns a scheme+host+port URL for Agents to call back into this DSH.
  */
-export declare function inferBaseUrl(host: string, port: number): string;
+export declare function inferBaseUrl(host: string, port: number, protocol?: 'http:' | 'https:'): string;
+/** Prefer the host's authoritative origin; retain inference for older DSH. */
+export declare function webServerBaseUrl(webServer: WebServerService): string;
 //# sourceMappingURL=index.d.ts.map

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMjE,OAAO,EAAa,KAAK,aAAa,EAA0B,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAY5G,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IAEpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACjJ,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,gBAAgB,CAAC;AAExB;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE;QACd,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9E,GAAG,MAAM,IAAI,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,IAAI;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAClD;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,mDAAmD;QACnD,SAAS,EAAE,gBAAgB,CAAC;QAC5B,mEAAmE;QACnE,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;QAC7C,6DAA6D;QAC7D,YAAY,CAAC,EAAE,mBAAmB,CAAC;QACnC,0CAA0C;QAC1C,KAAK,EAAE;YAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,IAAI,CAAA;SAAE,CAAC;QAC9C;;;;;WAKG;QACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;KAC5B;CACF;AAQD,eAAO,MAAM,IAAI,QAAQ,CAAC;AAE1B;;;;;GAKG;AACH,eAAO,MAAM,MAAM,iCAAkC,CAAC;AAEtD,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,eAAoB,QAovB/D;AA2FD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAM/D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMjE,OAAO,EAAa,KAAK,aAAa,EAA0B,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAY5G,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IAEpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACjJ,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,gBAAgB,CAAC;AAExB;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,SAAS,CAAC,IAAI,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE;QACd,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9E,GAAG,MAAM,IAAI,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,IAAI;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAClD;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,mDAAmD;QACnD,SAAS,EAAE,gBAAgB,CAAC;QAC5B,mEAAmE;QACnE,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;QAC7C,6DAA6D;QAC7D,YAAY,CAAC,EAAE,mBAAmB,CAAC;QACnC,0CAA0C;QAC1C,KAAK,EAAE;YAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,IAAI,CAAA;SAAE,CAAC;QAC9C;;;;;WAKG;QACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;KAC5B;CACF;AAQD,eAAO,MAAM,IAAI,QAAQ,CAAC;AAE1B;;;;;GAKG;AACH,eAAO,MAAM,MAAM,iCAAkC,CAAC;AAEtD,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,eAAoB,QAovB/D;AA2FD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,OAAO,GAAG,QAAkB,GAAG,MAAM,CAOvG;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,CAIpE"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ryubyte/dsh-a2a",
   "description": "Agent2Agent (A2A) protocol v1.0 plugin for DeepSeek Harness (DSH): outbound client (remote AgentCard skills as ctx.tools), inbound server (A2A JSON-RPC + AgentCard endpoint), and a settings dashboard of live A2A connections",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "keywords": [
     "a2a",
     "agent2agent",
@@ -50,24 +50,26 @@
   "license": "MIT",
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.4",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-tools": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2 || >=0.2.0-rc.1 <0.2.1-0 || >=0.2.1-alpha.1 <0.2.2-0",
+    "@deepseek-ai/dsh-tools": "^0.1.7-rc.2 || >=0.2.0-rc.1 <0.2.1-0 || >=0.2.1-alpha.1 <0.2.2-0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.4",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-tools": "0.2.0-rc.1",
+    "@deepseek-ai/cordis": "^4.0.5",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.5",
     "@types/node": "^22.0.0",
     "@types/react": "~18.3.1",
     "@types/react-dom": "^18.3.5",
+    "@types/semver": "^7.7.1",
     "esbuild": "^0.28.2",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
+    "semver": "^7.8.5",
     "tsdown": "^0.22.14",
     "tsx": "^4.19.0",
     "typescript": "^5.5.0"

package/src/index.ts

@@ -104,9 +104,12 @@ export type {
  */
 export interface WebServerService {
   /** The OS-assigned (or configured) listen port. */
-  readonly port: number;
-  /** The configured bind host literal ('127.0.0.1' | '0.0.0.0'). */
+  readonly port: number | undefined;
+  /** The configured bind address. Older hosts also allow '0.0.0.0'. */
   readonly host: string;
+  /** Added by DSH 0.2.1: preserve TLS and canonical IPv6/mapped addresses. */
+  getOrigin?(): string;
+  readonly protocol?: 'http:' | 'https:';
   register(route: {
     kind: 'exact' | 'prefix';
     path: string;
@@ -570,7 +573,7 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
         // Derive the advertised base URL from the real listen address when the
         // config doesn't pin one; avoids advertising a stale port. When bound
         // to 0.0.0.0, advertise a reachable LAN address, not loopback.
-        const baseUrl = mergedConfig.baseUrl ?? inferBaseUrl(webServer.host, webServer.port);
+        const baseUrl = mergedConfig.baseUrl ?? webServerBaseUrl(webServer);
         const endpointPath = mergedConfig.endpointPath ?? DEFAULT_ENDPOINT;
         // Surface a stale pinned baseUrl: if the config pins a port that does
         // not match the real listen port, the advertised AgentCard URL is
@@ -845,7 +848,7 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
             const { endpointChanged } = server.updateCard(cardPatch);
             if (clearBaseUrl) {
               // Re-derive from the actual listen address and re-advertise.
-              server.setBaseUrl(inferBaseUrl(webServer.host, webServer.port));
+              server.setBaseUrl(webServerBaseUrl(webServer));
             }
             // The JSON-RPC path moved: re-register on the new path, but only
             // while serving (disabled → routes get the new path on next enable).
@@ -1033,16 +1036,25 @@ function inboundSessionCwd(configPath: string): string {
  * back to loopback when no such address exists. IPv6 link-local is skipped
  * (not reachable without a scope id).
  *
- * @param host - the web server's configured bind host ('127.0.0.1' | '0.0.0.0').
+ * @param host - the web server's configured bind address.
  * @param port - the OS-assigned (or configured) listen port.
+ * @param protocol - the host listener's protocol (older hosts default to HTTP).
  * @returns a scheme+host+port URL for Agents to call back into this DSH.
  */
-export function inferBaseUrl(host: string, port: number): string {
+export function inferBaseUrl(host: string, port: number, protocol: 'http:' | 'https:' = 'http:'): string {
   const hostname =
     host === '0.0.0.0'
       ? primaryLanAddress() ?? '127.0.0.1'
       : host || '127.0.0.1';
-  return `http://${hostname}:${port}`;
+  const urlHost = hostname.includes(':') && !hostname.startsWith('[') ? `[${hostname}]` : hostname;
+  return `${protocol}//${urlHost}:${port}`;
+}
+
+/** Prefer the host's authoritative origin; retain inference for older DSH. */
+export function webServerBaseUrl(webServer: WebServerService): string {
+  if (typeof webServer.getOrigin === 'function') return webServer.getOrigin();
+  if (webServer.port === undefined) throw new Error('a2a: webServer has not bound a port');
+  return inferBaseUrl(webServer.host, webServer.port, webServer.protocol);
 }
 
 /**
@@ -1135,8 +1147,15 @@ function corsHeadersFor(reqOrigin: string | undefined, allowed: readonly string[
 function trustedLoopback(req: IncomingMessage): boolean {
   const host = req.headers.host;
   if (!host) return false;
-  const hostname = host.split(':')[0];
-  if (hostname !== '127.0.0.1' && hostname !== 'localhost' && hostname !== '::1') return false;
+  let hostname: string;
+  try {
+    const authority = new URL(`http://${host}`);
+    if (authority.username || authority.password || authority.pathname !== '/' || authority.search || authority.hash) return false;
+    hostname = authority.hostname;
+  } catch {
+    return false;
+  }
+  if (hostname !== '127.0.0.1' && hostname !== 'localhost' && hostname !== '[::1]') return false;
   if (req.headers['sec-fetch-site'] === 'cross-site') return false;
   const origin = req.headers.origin;
   if (!origin) return true;
@@ -1165,4 +1184,4 @@ function toServerReq(req: IncomingMessage): {
     headers,
     socket: req.socket ? { remoteAddress: req.socket.remoteAddress, remotePort: req.socket.remotePort } : undefined,
   };
-}
+}