nexus-agentd 0.2.5 → 0.3.0

package/dist/a2a/runtime.d.ts

@@ -10,6 +10,8 @@ export declare class A2AClientRuntime implements AgentSessionRuntime {
     private taskId;
     private contextId;
     private prompting;
+    private promptFinished?;
+    private queuedResponse;
     private disposed;
     private activeController?;
     private readonly artifactCache;
@@ -17,12 +19,16 @@ export declare class A2AClientRuntime implements AgentSessionRuntime {
     private sawTaskStatus;
     private sawAgentMessage;
     private completionProof?;
+    private readonly taskTimeoutMs;
+    private readonly streamIdleTimeoutMs;
+    private taskDeadlineAt?;
     constructor(config: AgentdA2AConfig, sink: AgentSessionSink, promptTimeoutMs: number);
     start(): Promise<void>;
-    prompt(message: string, attachments?: AgentdInputAttachment[]): Promise<void>;
+    prompt(message: string, attachments?: AgentdInputAttachment[], continuation?: boolean): Promise<void>;
     respondPending(response: AgentdPendingResponse | string, attachments?: AgentdInputAttachment[]): Promise<void>;
     cancel(): Promise<void>;
     dispose(): Promise<void>;
+    isAvailable(): boolean;
     private messageRequest;
     private processResponse;
     private processTask;

package/dist/a2a/runtime.js

@@ -44,6 +44,8 @@ export class A2AClientRuntime {
     taskId = '';
     contextId = '';
     prompting = false;
+    promptFinished;
+    queuedResponse = false;
     disposed = false;
     activeController;
     artifactCache = new Map();
@@ -51,12 +53,23 @@ export class A2AClientRuntime {
     sawTaskStatus = false;
     sawAgentMessage = false;
     completionProof;
+    taskTimeoutMs;
+    streamIdleTimeoutMs;
+    taskDeadlineAt;
     constructor(config, sink, promptTimeoutMs) {
         this.config = config;
         this.sink = sink;
         this.promptTimeoutMs = promptTimeoutMs;
+        // Keep inheritance at runtime so changing the gateway-wide prompt
+        // timeout continues to affect agents that did not opt into a local
+        // task deadline. The per-request timeout is deliberately excluded
+        // from this calculation: it only bounds connection/headers.
+        this.taskTimeoutMs = positiveTimeout(config.taskTimeoutMs ?? promptTimeoutMs, promptTimeoutMs);
+        this.streamIdleTimeoutMs = positiveTimeout(config.streamIdleTimeoutMs ?? config.timeoutMs, config.timeoutMs || 60_000);
     }
     async start() {
+        if (this.disposed)
+            throw new Error('A2A runtime is disposed');
         const resolver = createResolver(this.config);
         this.card = await resolveAgentCard(resolver, this.config);
         const fetchImpl = authenticatedFetch(this.config);
@@ -70,9 +83,11 @@ export class A2AClientRuntime {
             ]
         });
         this.client = await factory.createFromAgentCard(this.card);
+        if (this.disposed)
+            throw new Error('A2A runtime is disposed');
         this.sink.setState('created');
     }
-    async prompt(message, attachments = []) {
+    async prompt(message, attachments = [], continuation = false) {
         if (!this.client || !this.card)
             throw new Error('A2A runtime is not connected');
         if (this.prompting)
@@ -80,23 +95,36 @@ export class A2AClientRuntime {
         if (this.disposed)
             throw new Error('A2A runtime is disposed');
         this.prompting = true;
+        let finish;
+        this.promptFinished = new Promise((resolve) => { finish = resolve; });
         this.sawTaskStatus = false;
         this.sawAgentMessage = false;
         this.completionProof = undefined;
         this.sink.clearPending();
         this.sink.setState('running');
+        const taskDeadlineAt = continuation && this.taskDeadlineAt !== undefined
+            ? this.taskDeadlineAt
+            : Date.now() + this.taskTimeoutMs;
+        this.taskDeadlineAt = taskDeadlineAt;
         const controller = new AbortController();
         this.activeController = controller;
-        const timer = setTimeout(() => controller.abort(new Error('A2A message timed out')), Math.min(this.promptTimeoutMs, this.config.timeoutMs || this.promptTimeoutMs));
+        const remainingTaskMs = Math.max(1, taskDeadlineAt - Date.now());
+        const timer = setTimeout(() => controller.abort(new A2ATaskTimeoutError(this.taskTimeoutMs)), remainingTaskMs);
         timer.unref?.();
         try {
             const request = this.messageRequest(message, attachments);
             for await (const response of this.client.sendMessageStream(request, {
                 signal: controller.signal
             })) {
+                if (controller.signal.aborted || this.disposed)
+                    break;
+                // An accepted answer supersedes the old input-required stream.
+                // Its trailing status must not reopen the answered request.
+                if (this.queuedResponse)
+                    continue;
                 this.processResponse(response);
             }
-            if (this.sink.state === 'running') {
+            if (this.sink.state === 'running' && !this.queuedResponse) {
                 if (this.completionProof) {
                     this.sink.completeTurn(this.completionProof);
                 }
@@ -114,7 +142,7 @@ export class A2AClientRuntime {
             }
         }
         catch (error) {
-            if (this.sink.state !== 'canceled') {
+            if (this.sink.state !== 'canceled' && !this.queuedResponse) {
                 this.sink.setState('failed', abortMessage(error, controller.signal));
             }
         }
@@ -123,9 +151,16 @@ export class A2AClientRuntime {
             if (this.activeController === controller)
                 this.activeController = undefined;
             this.prompting = false;
+            if (this.sink.state !== 'input_required' && !this.queuedResponse) {
+                this.taskDeadlineAt = undefined;
+            }
+            finish();
+            this.promptFinished = undefined;
         }
     }
     async respondPending(response, attachments = []) {
+        if (!this.isAvailable())
+            throw new Error('A2A runtime is unavailable');
         if (this.sink.state !== 'input_required') {
             throw new Error('A2A session is not waiting for input');
         }
@@ -138,10 +173,27 @@ export class A2AClientRuntime {
                     : response.message ?? response.optionId ?? '';
         if (!message.trim())
             throw new Error('A2A pending response is empty');
+        const previous = this.promptFinished || Promise.resolve();
+        this.queuedResponse = true;
         this.sink.clearPending();
-        await this.prompt(message, attachments);
+        this.sink.setState('running');
+        void previous.then(async () => {
+            this.queuedResponse = false;
+            if (this.disposed ||
+                this.sink.state === 'canceled' ||
+                this.sink.state === 'failed' ||
+                (this.taskDeadlineAt !== undefined && this.taskDeadlineAt <= Date.now()))
+                return;
+            await this.prompt(message, attachments, true);
+        }).catch((error) => {
+            if (!this.disposed && this.sink.state !== 'canceled')
+                this.sink.setState('failed', errorMessage(error));
+        });
     }
     async cancel() {
+        this.taskDeadlineAt = undefined;
+        this.sink.clearPending();
+        this.sink.setState('canceled');
         this.activeController?.abort(new Error('A2A session canceled'));
         if (this.client && this.taskId) {
             try {
@@ -159,9 +211,13 @@ export class A2AClientRuntime {
     }
     async dispose() {
         this.disposed = true;
+        this.taskDeadlineAt = undefined;
         this.activeController?.abort(new Error('A2A runtime disposed'));
         this.activeController = undefined;
     }
+    isAvailable() {
+        return !this.disposed && Boolean(this.client && this.card);
+    }
     messageRequest(text, attachments) {
         return {
             tenant: '',
@@ -338,12 +394,43 @@ function createResolver(config) {
         legacyCompat: { enabled: true }
     });
 }
-function resolveAgentCard(resolver, config) {
-    if (config.agentCardUrl)
-        return resolver.resolve(config.agentCardUrl, '');
-    if (config.agentUrl)
-        return resolver.resolve(config.agentUrl);
-    throw new Error('A2A Agent Card URL is required');
+async function resolveAgentCard(resolver, config) {
+    const origin = configuredOrigin(config);
+    const card = config.agentCardUrl
+        ? await resolver.resolve(config.agentCardUrl, '')
+        : await resolver.resolve(config.agentUrl);
+    // The resolver normalizes v0.3 url/additionalInterfaces into this array.
+    // Validate every advertised endpoint before transport selection or probing.
+    if (!Array.isArray(card.supportedInterfaces) || !card.supportedInterfaces.length) {
+        throw new Error('A2A Agent Card must declare at least one interface URL');
+    }
+    for (const endpoint of card.supportedInterfaces)
+        assertSameOrigin(endpoint?.url, origin);
+    return card;
+}
+function a2aUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error('A2A URL is invalid');
+    }
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.hash) {
+        throw new Error('A2A URL must use http(s) without credentials or a fragment');
+    }
+    return url;
+}
+function configuredOrigin(config) {
+    const value = config.agentCardUrl || config.agentUrl;
+    if (!value)
+        throw new Error('A2A Agent Card URL is required');
+    return a2aUrl(value).origin;
+}
+function assertSameOrigin(value, origin) {
+    if (a2aUrl(value).origin !== origin) {
+        throw new Error('A2A URL must have the same origin as the configured Agent Card URL');
+    }
 }
 function preferredTransports(config) {
     if (config.preferredTransport === 'jsonrpc')
@@ -353,8 +440,12 @@ function preferredTransports(config) {
     return undefined;
 }
 function authenticatedFetch(config) {
+    const origin = configuredOrigin(config);
     return async (input, init = {}) => {
-        const headers = new Headers(init.headers);
+        // The final guard also covers SDK-derived paths and future card flows.
+        // Check before attaching credentials; never let fetch follow redirects.
+        assertSameOrigin(input instanceof Request ? input.url : String(input), origin);
+        const headers = new Headers(init.headers ?? (input instanceof Request ? input.headers : undefined));
         if (config.auth?.type === 'bearer' && config.auth.value) {
             headers.set('Authorization', `Bearer ${config.auth.value}`);
         }
@@ -363,13 +454,195 @@ function authenticatedFetch(config) {
             config.auth.value) {
             headers.set(config.auth.headerName, config.auth.value);
         }
-        return fetch(input, {
-            ...init,
-            headers,
-            signal: init.signal || AbortSignal.timeout(config.timeoutMs || 60_000)
-        });
+        const timeoutMs = config.timeoutMs || 60_000;
+        const timeoutController = new AbortController();
+        const signals = [timeoutController.signal];
+        if (init.signal)
+            signals.push(init.signal);
+        const signal = AbortSignal.any(signals);
+        const requestTimeout = new A2ARequestTimeoutError(timeoutMs);
+        let bodyAbort;
+        const timer = setTimeout(() => {
+            timeoutController.abort(requestTimeout);
+            bodyAbort?.();
+        }, timeoutMs);
+        timer.unref?.();
+        try {
+            const response = await fetch(input, {
+                ...init,
+                headers,
+                redirect: 'error',
+                signal
+            });
+            // Only an SSE response is an intentionally long-lived request.
+            // Card and ordinary JSON calls retain timeoutMs through the body;
+            // otherwise a slow/trickling Card could evade the request bound.
+            if (isEventStream(response)) {
+                clearTimeout(timer);
+                return withStreamIdleTimeout(response, config.streamIdleTimeoutMs || timeoutMs);
+            }
+            if (!response.body) {
+                clearTimeout(timer);
+                return response;
+            }
+            const deadline = responseDeadlineBody(response.body, requestTimeout, () => clearTimeout(timer));
+            bodyAbort = deadline.abort;
+            return new Response(deadline.stream, {
+                status: response.status,
+                statusText: response.statusText,
+                headers: response.headers
+            });
+        }
+        catch (error) {
+            clearTimeout(timer);
+            if (timeoutController.signal.aborted && !init.signal?.aborted) {
+                throw requestTimeout;
+            }
+            throw error;
+        }
     };
 }
+class A2ARequestTimeoutError extends Error {
+    constructor(timeoutMs) {
+        super(`A2A request timed out after ${timeoutMs}ms`);
+        this.name = 'A2ARequestTimeoutError';
+    }
+}
+class A2ATaskTimeoutError extends Error {
+    constructor(timeoutMs) {
+        super(`A2A task timed out after ${timeoutMs}ms`);
+        this.name = 'A2ATaskTimeoutError';
+    }
+}
+class A2AStreamIdleTimeoutError extends Error {
+    constructor(timeoutMs) {
+        super(`A2A stream made no progress for ${timeoutMs}ms`);
+        this.name = 'A2AStreamIdleTimeoutError';
+    }
+}
+function withStreamIdleTimeout(response, timeoutMs) {
+    if (!response.body || !Number.isFinite(timeoutMs) || timeoutMs <= 0)
+        return response;
+    const body = idleTimeoutBody(response.body, timeoutMs);
+    return new Response(body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+    });
+}
+function isEventStream(response) {
+    return response.headers.get('content-type')?.split(';', 1)[0].trim().toLowerCase() ===
+        'text/event-stream';
+}
+function responseDeadlineBody(body, timeoutError, cleanup) {
+    const reader = body.getReader();
+    let controllerRef;
+    let closed = false;
+    let timedOut = false;
+    const abort = () => {
+        if (closed || timedOut)
+            return;
+        timedOut = true;
+        void reader.cancel(timeoutError).catch(() => undefined);
+        controllerRef?.error(timeoutError);
+    };
+    const stream = new ReadableStream({
+        start(controller) {
+            controllerRef = controller;
+        },
+        async pull(controller) {
+            if (closed || timedOut)
+                return;
+            try {
+                const result = await reader.read();
+                if (timedOut)
+                    return;
+                if (result.done) {
+                    closed = true;
+                    cleanup();
+                    controller.close();
+                    return;
+                }
+                controller.enqueue(result.value);
+            }
+            catch (error) {
+                if (timedOut)
+                    return;
+                closed = true;
+                cleanup();
+                controller.error(error);
+            }
+        },
+        async cancel(reason) {
+            closed = true;
+            cleanup();
+            await reader.cancel(reason);
+        }
+    });
+    return { stream, abort };
+}
+function idleTimeoutBody(body, timeoutMs) {
+    const reader = body.getReader();
+    let controllerRef;
+    let timer;
+    let closed = false;
+    let timedOut = false;
+    const clearIdleTimer = () => {
+        if (timer)
+            clearTimeout(timer);
+        timer = undefined;
+    };
+    const armIdleTimer = () => {
+        clearIdleTimer();
+        timer = setTimeout(() => {
+            if (closed || timedOut)
+                return;
+            timedOut = true;
+            const error = new A2AStreamIdleTimeoutError(timeoutMs);
+            void reader.cancel(error).catch(() => undefined);
+            controllerRef?.error(error);
+        }, timeoutMs);
+        timer.unref?.();
+    };
+    return new ReadableStream({
+        start(controller) {
+            controllerRef = controller;
+            armIdleTimer();
+        },
+        async pull(controller) {
+            if (closed || timedOut)
+                return;
+            try {
+                const result = await reader.read();
+                if (timedOut)
+                    return;
+                if (result.done) {
+                    closed = true;
+                    clearIdleTimer();
+                    controller.close();
+                    return;
+                }
+                armIdleTimer();
+                controller.enqueue(result.value);
+            }
+            catch (error) {
+                if (timedOut)
+                    return;
+                closed = true;
+                clearIdleTimer();
+                controller.error(error);
+            }
+        },
+        async cancel(reason) {
+            closed = true;
+            clearIdleTimer();
+            await reader.cancel(reason);
+        }
+    });
+}
+function positiveTimeout(value, fallback) {
+    return Number.isFinite(value) && value > 0 ? Math.trunc(value) : fallback;
+}
 function artifactFromA2A(artifact) {
     const text = textParts(artifact.parts).join('') || undefined;
     const urlPart = artifact.parts.find((part) => part.content?.$case === 'url');

package/dist/acp/runtime.d.ts

@@ -4,6 +4,8 @@ import type { AgentdInputAttachment, AgentdPendingResponse } from '../types.js';
 export declare class AcpProcessRuntime {
     private readonly driver;
     private readonly sink;
+    private readonly allowedRoots;
+    private readonly startupTimeoutMs;
     private process?;
     private connection?;
     private pending?;
@@ -16,12 +18,14 @@ export declare class AcpProcessRuntime {
     private inputDirectory?;
     private workspace?;
     private promptOutput;
-    constructor(driver: AgentDriver, sink: AcpSessionSink, maxStderrChunkChars?: number, promptTimeoutMs?: number);
+    constructor(driver: AgentDriver, sink: AcpSessionSink, maxStderrChunkChars?: number, promptTimeoutMs?: number, allowedRoots?: readonly string[], startupTimeoutMs?: number);
     start(workspace: string): Promise<void>;
+    private connect;
     prompt(message: string, attachments?: AgentdInputAttachment[]): Promise<void>;
     respondPending(input: AgentdPendingResponse | string, _attachments?: AgentdInputAttachment[]): Promise<void>;
     cancel(): Promise<void>;
     dispose(): Promise<void>;
+    isAvailable(): boolean;
     private requestPermission;
     private finishPermission;
     private requestInput;