agentengine-sdk-python 0.8.5__py3-none-any.whl → 0.8.6__py3-none-any.whl

ksadk/a2a/protocol_errors.py

@@ -0,0 +1,116 @@
+"""A2A 1.0 error binding corrections for the pinned a2a-sdk 1.1 handler.
+
+Keep the upstream transport/authentication path, correct terminal-task errors,
+and persist confirmed Kernel cancellation after an upstream queue-close race.
+No global SDK patching.
+"""
+
+import json
+from functools import wraps
+
+from a2a.server.request_handlers import DefaultRequestHandler
+from a2a.server.request_handlers.request_handler import validate_request_params
+from a2a.types import TaskState
+from a2a.utils.errors import InvalidParamsError, TaskNotFoundError, UnsupportedOperationError
+from starlette.responses import JSONResponse
+from starlette.routing import Route
+
+_CONFIRMED_KERNEL_CANCEL = "ksadk.confirmed_kernel_cancel"
+
+_TERMINAL = {
+    TaskState.TASK_STATE_COMPLETED,
+    TaskState.TASK_STATE_FAILED,
+    TaskState.TASK_STATE_CANCELED,
+    TaskState.TASK_STATE_REJECTED,
+}
+
+
+class ProtocolRequestHandler(DefaultRequestHandler):
+    async def _reconcile_owned_task(self, task_id, context):
+        task = await self.task_store.get(task_id, context)
+        if task is None:
+            raise TaskNotFoundError()
+        reconcile = getattr(self, "terminal_task_reconciler", None)
+        if task.status.state not in _TERMINAL and reconcile is not None:
+            await reconcile(task, context, self.task_store)
+            task = await self.task_store.get(task_id, context)
+            if task is None:
+                raise TaskNotFoundError()
+        return task
+
+    @validate_request_params
+    async def on_get_task(self, params, context):
+        await self._reconcile_owned_task(params.id, context)
+        return await super().on_get_task(params, context)
+
+    @validate_request_params
+    async def on_cancel_task(self, params, context):
+        # ActiveTask may cache a Task; authorize this request against durable ownership.
+        if await self.task_store.get(params.id, context) is None:
+            raise TaskNotFoundError()
+        context.state.pop(_CONFIRMED_KERNEL_CANCEL, None)
+        try:
+            result = await super().on_cancel_task(params, context)
+            confirmed = context.state.get(_CONFIRMED_KERNEL_CANCEL)
+            if confirmed is not None and confirmed[0] == params.id:
+                # Upstream V2 cancels its producer before invoking executor.cancel.
+                # That can close the event queue before the Kernel acknowledgement.
+                # Wait for upstream cleanup, then persist only this confirmed fact.
+                current = await self.task_store.get(params.id, context)
+                if current is None:
+                    raise TaskNotFoundError()
+                if current.status.state not in _TERMINAL:
+                    repair = getattr(self.task_store, "save_confirmed_cancellation", None)
+                    if repair is not None:
+                        current = await repair(current, confirmed[1], context)
+                        if current is None:
+                            raise TaskNotFoundError()
+                    else:
+                        current.status.CopyFrom(confirmed[1])
+                        await self.task_store.save(current, context)
+                return current
+            return result
+        finally:
+            context.state.pop(_CONFIRMED_KERNEL_CANCEL, None)
+
+    async def on_subscribe_to_task(self, params, context):
+        task = await self._reconcile_owned_task(params.id, context)
+        if task.status.state in _TERMINAL:
+            raise UnsupportedOperationError("Task is already terminal")
+        try:
+            async for event in super().on_subscribe_to_task(params, context):
+                yield event
+        except InvalidParamsError:
+            # V2 ActiveTask reports a terminal subscription as invalid params.
+            # Confirm the same owned task before translating the error.
+            task = await self.task_store.get(params.id, context)
+            if task is not None and task.status.state in _TERMINAL:
+                raise UnsupportedOperationError("Task is already terminal") from None
+            raise
+
+
+def correct_cancel_rest_route(route):
+    if not isinstance(route, Route) or not route.path.endswith("/tasks/{id}:cancel"):
+        return route
+    original = route.endpoint
+
+    @wraps(original)
+    async def endpoint(request):
+        response = await original(request)
+        if response.status_code == 400 and isinstance(response, JSONResponse):
+            body = json.loads(response.body)
+            error = body.get("error", {})
+            if any(
+                detail.get("reason") == "TASK_NOT_CANCELABLE" for detail in error.get("details", [])
+            ):
+                error["code"] = 409
+                return JSONResponse(body, status_code=409)
+        return response
+
+    return Route(
+        route.path,
+        endpoint,
+        methods=route.methods,
+        name=route.name,
+        include_in_schema=route.include_in_schema,
+    )

ksadk/a2a/result_text.py

@@ -0,0 +1,49 @@
+"""Select the legacy single-string reply from canonical A2A outputs."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping, Sequence
+from typing import Any
+
+
+def select_terminal_reply(
+    output_refs: Sequence[Any],
+    snapshots: Mapping[tuple[str, str], Mapping[str, str]],
+    item_kinds: Mapping[tuple[str, str], str],
+) -> str:
+    """Return one authoritative text item without flattening conversation history.
+
+    Canonical output refs deliberately retain every terminal artifact/message for
+    replay and presentation.  The legacy tool envelope, however, has only one
+    ``reply`` string.  Prefer the last text artifact (the A2A task result), and
+    only fall back to the last agent message for peers that return no artifact.
+    Parts within that selected item retain their declared order.
+    """
+
+    selected: dict[tuple[str, str], list[str]] = {}
+    ordered: dict[str, list[tuple[str, str]]] = {"artifact": [], "message": []}
+    for ref in output_refs:
+        key = (str(ref.scope_id), str(ref.item_id))
+        kind = item_kinds.get(key)
+        parts = snapshots.get(key)
+        if kind not in ordered or not parts:
+            continue
+        if key not in selected:
+            selected[key] = []
+            ordered[kind].append(key)
+        if ref.part_id is None:
+            values = parts.values()
+        else:
+            value = parts.get(str(ref.part_id))
+            values = () if value is None else (value,)
+        for value in values:
+            if value:
+                selected[key].append(value)
+
+    candidates = ordered["artifact"] or ordered["message"]
+    if not candidates:
+        return ""
+    return "".join(selected[candidates[-1]])
+
+
+__all__ = ["select_terminal_reply"]

ksadk/a2a/resume_store.py

@@ -12,6 +12,9 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Literal, TypeAlias
 
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import AsyncEngine
+
 from ksadk.runtime.adapter import ResumePayload, ResumeTarget, RunHandle
 
 A2AResumePayloadKind: TypeAlias = Literal[
@@ -116,9 +119,7 @@ class SQLiteA2AResumeStateStore(A2AResumeStateStore):
             return A2AResumeState(
                 handle=RunHandle.model_validate(raw["handle"]),
                 target=ResumeTarget.model_validate(raw["target"]),
-                payload_kind=ResumePayload.model_validate(
-                    {"kind": raw["payload_kind"]}
-                ).kind,
+                payload_kind=ResumePayload.model_validate({"kind": raw["payload_kind"]}).kind,
                 call_id=str(raw["call_id"]) if raw.get("call_id") is not None else None,
             )
         except (KeyError, TypeError, ValueError, json.JSONDecodeError) as exc:
@@ -192,10 +193,99 @@ class SQLiteA2AResumeStateStore(A2AResumeStateStore):
             connection.close()
 
 
+def _serialize_state(state: A2AResumeState) -> str:
+    return json.dumps(
+        {
+            "handle": state.handle.model_dump(mode="json"),
+            "target": state.target.model_dump(mode="json"),
+            "payload_kind": state.payload_kind,
+            "call_id": state.call_id,
+        },
+        separators=(",", ":"),
+        sort_keys=True,
+    )
+
+
+def _deserialize_state(payload: str) -> A2AResumeState:
+    try:
+        raw = json.loads(payload)
+        return A2AResumeState(
+            handle=RunHandle.model_validate(raw["handle"]),
+            target=ResumeTarget.model_validate(raw["target"]),
+            payload_kind=ResumePayload.model_validate({"kind": raw["payload_kind"]}).kind,
+            call_id=str(raw["call_id"]) if raw.get("call_id") is not None else None,
+        )
+    except (KeyError, TypeError, ValueError, json.JSONDecodeError) as exc:
+        raise RuntimeError("A2A resume state is invalid") from exc
+
+
+class PostgresA2AResumeStateStore(A2AResumeStateStore):
+    """Shared opaque resume state for managed Runtime restart recovery."""
+
+    def __init__(self, engine: AsyncEngine) -> None:
+        self._engine = engine
+
+    @staticmethod
+    def _hash(key: str) -> str:
+        return hashlib.sha256(key.encode("utf-8")).hexdigest()
+
+    async def initialize(self) -> None:
+        async with self._engine.begin() as connection:
+            await connection.execute(
+                text(
+                    """
+                    CREATE TABLE IF NOT EXISTS ksadk_a2a_resume_states (
+                        resume_key_sha256 TEXT PRIMARY KEY,
+                        state_json TEXT NOT NULL,
+                        updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+                    )
+                    """
+                )
+            )
+
+    async def put(self, key: str, state: A2AResumeState) -> None:
+        async with self._engine.begin() as connection:
+            await connection.execute(
+                text(
+                    """
+                    INSERT INTO ksadk_a2a_resume_states(resume_key_sha256, state_json)
+                    VALUES (:key, :payload)
+                    ON CONFLICT(resume_key_sha256) DO UPDATE SET
+                        state_json = EXCLUDED.state_json,
+                        updated_at = CURRENT_TIMESTAMP
+                    """
+                ),
+                {"key": self._hash(key), "payload": _serialize_state(state)},
+            )
+
+    async def get(self, key: str) -> A2AResumeState | None:
+        async with self._engine.connect() as connection:
+            result = await connection.execute(
+                text(
+                    "SELECT state_json FROM ksadk_a2a_resume_states "
+                    "WHERE resume_key_sha256 = :key"
+                ),
+                {"key": self._hash(key)},
+            )
+            payload = result.scalar_one_or_none()
+        return _deserialize_state(str(payload)) if payload is not None else None
+
+    async def delete(self, key: str) -> None:
+        async with self._engine.begin() as connection:
+            await connection.execute(
+                text(
+                    "DELETE FROM ksadk_a2a_resume_states "
+                    "WHERE resume_key_sha256 = :key"
+                ),
+                {"key": self._hash(key)},
+            )
+
+
 __all__ = [
     "A2AResumeState",
     "A2AResumePayloadKind",
     "A2AResumeStateStore",
     "InMemoryA2AResumeStateStore",
+    "PostgresA2AResumeStateStore",
     "SQLiteA2AResumeStateStore",
 ]

ksadk/a2a/routes.py

@@ -31,6 +31,7 @@ from ksadk.a2a.card import build_agent_card
 from ksadk.a2a.server import A2AProtocolServer
 from ksadk.a2a.task_adapter import A2ARuntimeTaskAdapter
 from ksadk.a2a.task_store import A2A_TASK_TABLE, A2AOwnerContextBuilder, build_a2a_task_store
+from ksadk.a2a.tool_activity import PublicToolActivityPolicy
 
 
 @dataclass
@@ -48,6 +49,7 @@ class A2AConfig:
     # 本地调试可显式开放 reasoning artifact；托管 Runtime 默认关闭，避免把
     # 模型内部推理写入公开 A2A Task。
     include_reasoning: bool = False
+    public_tool_policy: PublicToolActivityPolicy = field(default_factory=PublicToolActivityPolicy)
     # durable task store:dsn(如 sqlite+aiosqlite:///.agentengine/a2a_tasks.db 或
     # postgresql+asyncpg://...)或外部传入 engine/task_store。
     task_store_dsn: Optional[str] = None
@@ -76,6 +78,7 @@ def add_a2a_protocol_routes(
         version=config.version,
         skills=config.skills,
         streaming=config.streaming,
+        public_tool_policy=config.public_tool_policy,
     )
     store = task_store or build_a2a_task_store(
         dsn=config.task_store_dsn,
@@ -89,6 +92,7 @@ def add_a2a_protocol_routes(
         task_adapter=task_adapter,
         context_builder=context_builder,
         include_reasoning=config.include_reasoning,
+        public_tool_policy=config.public_tool_policy,
     )
     rest = server.rest_routes()
     # a2a-sdk REST routes 附带贪婪 Mount('/{tenant}')(多租户 catch-all),
@@ -97,7 +101,8 @@ def add_a2a_protocol_routes(
     from starlette.routing import Mount as _Mount
 
     rest = [
-        route for route in rest
+        route
+        for route in rest
         if not (isinstance(route, _Mount) and getattr(route, "path", "") == "/{tenant}")
     ]
     add_a2a_routes_to_fastapi(

ksadk/a2a/runtime_approval.py

@@ -0,0 +1,198 @@
+"""Resolve managed invocation approval from the Kernel's single durable log."""
+
+import asyncio
+import hashlib
+import json
+import time
+from contextlib import aclosing
+
+from pydantic import PrivateAttr
+
+from ksadk.events.canonical import ApprovalRequest, InteractionRequested, SourceRef
+from ksadk.events.identity import stable_event_id
+
+
+async def invoke_with_approval(service, request, *, trigger_ref):
+    """Pause the original invocation, then recheck durable policy before send."""
+    from ksadk.a2a.invocation_policy import A2AApprovalRequired
+    from ksadk.a2a.invocation_types import A2AContinuationRequest
+
+    def operation():
+        if isinstance(request, A2AContinuationRequest):
+            return service.continue_task(request)
+        return service.invoke(request, trigger_ref=trigger_ref)
+
+    for attempt in range(2):
+        try:
+            async with aclosing(operation()) as events:
+                async for event in events:
+                    yield event
+            return
+        except A2AApprovalRequired:
+            if attempt:
+                raise RuntimeError("A2A_APPROVAL_NOT_COMMITTED") from None
+            waiter = ManagedA2AApprovalWaiter(request)
+            remaining = request.deadline_unix_seconds - time.time()
+            if remaining <= 0:
+                raise TimeoutError("A2A_OVERALL_TIMEOUT") from None
+            try:
+                yield waiter.event(timestamp=time.time())
+                outcome = await asyncio.wait_for(
+                    waiter.wait(), max(0, request.deadline_unix_seconds - time.time())
+                )
+            except TimeoutError:
+                raise TimeoutError("A2A_OVERALL_TIMEOUT") from None
+            finally:
+                waiter.close()
+            if outcome != "approved":
+                raise PermissionError("A2A_APPROVAL_DENIED")
+
+
+class ManagedA2AApprovalRequested(InteractionRequested):
+    """An in-process binding; wire metadata cannot select a Kernel provider."""
+
+    _invocation = PrivateAttr(default=None)
+    _waiter = PrivateAttr(default=None)
+
+
+class ManagedA2AApprovalWaiter:
+    """One live call; only a committed Kernel receipt may wake it."""
+
+    def __init__(self, request):
+        self.request = request
+        self._future = asyncio.get_running_loop().create_future()
+
+    def event(self, *, timestamp):
+        event = approval_event(self.request, timestamp=timestamp)
+        event._waiter = self
+        return event
+
+    def accepts(self, record):
+        return (not self._future.done()
+                and record.interaction_id == approval_id(self.request)
+                and record.native_target == approval_target(self.request)
+                and record.run_id == self.request.handle.run_id
+                and record.session_id == self.request.handle.session_id)
+
+    async def wait(self):
+        return await self._future
+
+    def close(self):
+        self._future.cancel()
+
+    def deliver(self, receipt, response=None):
+        if (receipt.interaction_id != approval_id(self.request)
+                or receipt.status != "resolved"
+                or receipt.outcome not in {"approved", "rejected"}):
+            raise ValueError("A2A_APPROVAL_RECEIPT_INVALID")
+        if not self._future.done():
+            self._future.set_result(receipt.outcome)
+
+
+def approval_event(request, *, timestamp):
+    interaction_id = approval_id(request)
+    event = ManagedA2AApprovalRequested(
+        schema_version=2, seq=0, timestamp=timestamp,
+        event_id=stable_event_id(
+            "a2a", request.handle.parent_scope_id, interaction_id,
+            "interaction.requested", "approval", interaction_id, 0,
+        ),
+        run_id=request.handle.run_id, scope_id=request.handle.parent_scope_id,
+        source=SourceRef(framework="a2a"), interaction_id=interaction_id,
+        interaction_kind="approval", request=ApprovalRequest(
+            kind="tool", call_id=request.handle.call_id,
+            detail={"tool_name": request.spec.local_name, "risk_level": "high",
+                    "name": request.spec.local_name, "risk": "high",
+                    "args": {
+                        "target_agent_id": request.spec.target_agent_id,
+                        "version_id": request.spec.expected_version_id,
+                        "text_parts": list(request.message.text_parts),
+                        "data_parts": list(request.message.data_parts),
+                    },
+                    "side_effects": ["a2a_remote_call"]},
+        ),
+    )
+    event._invocation = request
+    return event
+
+
+def bound_approval_request(event, *, run_id, session_id):
+    if not isinstance(event, ManagedA2AApprovalRequested):
+        return None
+    request = event._invocation
+    if (request is None or request.handle.run_id != run_id
+            or request.handle.session_id != session_id
+            or event.run_id != run_id
+            or event.scope_id != request.handle.parent_scope_id
+            or event.interaction_id != approval_id(request)
+            or event.request.call_id != request.handle.call_id):
+        raise ValueError("A2A_APPROVAL_BINDING_CONFLICT")
+    return request
+
+
+def approval_target(request):
+    """Bind every immutable invocation field without storing message plaintext."""
+    values = request.model_dump(mode="json")
+    values["message"] = {"message_id": request.message.message_id,
+                         "sha256": request.message_sha256}
+    # A public correlation hint is not part of the authorization identity.
+    values["context"].pop("approval_request_id", None)
+    digest = hashlib.sha256(json.dumps(
+        values, sort_keys=True, separators=(",", ":"), ensure_ascii=False
+    ).encode()).hexdigest()
+    return {"schema": "a2a.approval/v1", "invocation_sha256": digest}
+
+
+def approval_id(request):
+    return "a2a-approval-" + approval_target(request)["invocation_sha256"]
+
+
+class KernelA2AApprovalResolver:
+    """Read a fully scoped record and its matching first-wins terminal fact.
+
+    Tenant and agent-instance scope must come from the runtime composition
+    root, never from model arguments. No secondary approval cache is created.
+    """
+
+    def __init__(self, ledger, event_store, *, tenant_id, agent_instance_id):
+        if not tenant_id or not agent_instance_id:
+            raise ValueError("A2A_APPROVAL_SCOPE_REQUIRED")
+        self._ledger, self._events = ledger, event_store
+        self._tenant, self._agent = tenant_id, agent_instance_id
+
+    async def __call__(self, request):
+        record = await self._ledger.get(
+            approval_id(request), tenant_id=self._tenant,
+            agent_instance_id=self._agent, session_id=request.handle.session_id,
+            run_id=request.handle.run_id,
+        )
+        if record is None:
+            return None
+        if (record.kind != "approval" or record.provider_id != "managed-a2a"
+                or record.native_target != approval_target(request)):
+            raise ValueError("A2A_APPROVAL_BINDING_CONFLICT")
+        if record.status in {"pending", "resolving"}:
+            return None
+        if record.status in {"cancelled", "expired"}:
+            return "denied"
+        cursor = 0
+        while True:
+            events = await self._events.read(record.session_id, cursor, 256)
+            if not events:
+                raise RuntimeError("A2A_APPROVAL_TERMINAL_FACT_MISSING")
+            for event in events:
+                payload = event.payload
+                if (event.family == "interaction" and event.family_version == 1
+                        and event.event_type == "interaction.resolved"
+                        and event.run_id == record.run_id
+                        and payload.get("interaction_id") == record.interaction_id
+                        and payload.get("tenant_id") == self._tenant
+                        and payload.get("agent_instance_id") == self._agent
+                        and payload.get("session_id") == record.session_id
+                        and payload.get("run_id") == record.run_id
+                        and payload.get("revision") == record.revision):
+                    return "approved" if payload.get("outcome") == "approved" else "denied"
+            next_cursor = max(event.seq for event in events)
+            if next_cursor <= cursor:
+                raise RuntimeError("A2A_APPROVAL_CURSOR_INVALID")
+            cursor = next_cursor

ksadk/a2a/runtime_input.py

@@ -0,0 +1,151 @@
+"""Keep the original remote invocation alive across Kernel-owned input waits."""
+
+import asyncio
+import time
+from collections.abc import Mapping
+from contextlib import aclosing
+
+from pydantic import PrivateAttr
+
+from ksadk.a2a.invocation_types import A2AContinuationRequest, A2AInvocationMessage
+from ksadk.a2a.runtime_approval import ManagedA2AApprovalRequested, invoke_with_approval
+from ksadk.events.canonical import InteractionRequested
+from ksadk.events.identity import stable_item_id
+
+
+def _structured_input_value(event, response):
+    """Remove the UI result envelope only for non-object input schemas."""
+    schema = getattr(getattr(event, "request", None), "schema_", None)
+    normalized = dict(response) if isinstance(response, Mapping) else response
+    if (
+        isinstance(normalized, dict)
+        and set(normalized) == {"result"}
+        and isinstance(schema, dict)
+        and schema.get("type") != "object"
+    ):
+        return normalized["result"]
+    return normalized
+
+
+class ManagedA2AInputRequested(InteractionRequested):
+    _managed_input_waiter = PrivateAttr(default=None)
+
+
+class ManagedA2AInputWaiter:
+    def __init__(self, event, snapshot):
+        self.handle = snapshot.handle
+        self.interaction_id = event.interaction_id
+        self.target = {
+            "schema": ("a2a.remote-approval/v1" if event.interaction_kind == "approval"
+                       else "a2a.input/v1"),
+            "handle": self.handle.model_dump(mode="json"),
+            "continuation_id": snapshot.continuation_id,
+            "interaction_id": event.interaction_id,
+        }
+        self.event = ManagedA2AInputRequested.model_validate(event.model_dump(by_alias=True))
+        self.event._managed_input_waiter = self
+        self._future = asyncio.get_running_loop().create_future()
+
+    def accepts(self, record):
+        return (
+            not self._future.done()
+            and record.interaction_id == self.interaction_id
+            and record.native_target == self.target
+            and record.run_id == self.handle.run_id
+            and record.session_id == self.handle.session_id
+        )
+
+    def deliver(self, receipt, response=None):
+        outcomes = ({"approved", "rejected"} if self.event.interaction_kind == "approval"
+                    else {"submitted", "rejected"})
+        if (
+            receipt.interaction_id != self.interaction_id
+            or receipt.status != "resolved"
+            or receipt.outcome not in outcomes
+        ):
+            raise ValueError("A2A_INPUT_RECEIPT_INVALID")
+        if not self._future.done():
+            self._future.set_result((receipt.outcome, response))
+
+    async def wait(self):
+        return await self._future
+
+    def close(self):
+        self._future.cancel()
+
+
+def bound_input_waiter(event, *, run_id, session_id):
+    if not isinstance(event, ManagedA2AInputRequested):
+        return None
+    waiter = event._managed_input_waiter
+    if (
+        waiter is None
+        or event is not waiter.event
+        or event.run_id != run_id
+        or waiter.handle.run_id != run_id
+        or waiter.handle.session_id != session_id
+        or event.scope_id != waiter.handle.scope_id
+        or event.interaction_id != waiter.interaction_id
+    ):
+        raise ValueError("A2A_INPUT_BINDING_CONFLICT")
+    return waiter
+
+
+async def invoke_with_input(service, request, *, trigger_ref):
+    """Wait on the same task/scope; supplemental messages get their own approval."""
+    frozen = await service.pending_continuation(request.handle)
+    if frozen is not None:
+        request = frozen
+    while True:
+        pending = None
+        async with aclosing(
+            invoke_with_approval(service, request, trigger_ref=trigger_ref)
+        ) as events:
+            async for event in events:
+                if (
+                    isinstance(event, InteractionRequested)
+                    and event.interaction_kind in {"structured_input", "approval"}
+                    and not isinstance(event, ManagedA2AApprovalRequested)
+                ):
+                    pending = event
+                else:
+                    yield event
+        snapshot = service.snapshot(service.handle(request.scope_id))
+        if snapshot is None or snapshot.status not in {"input_required", "auth_required"}:
+            return
+        if pending is None:
+            pending = await service.pending_input_request(snapshot.handle)
+        if pending is None or snapshot.continuation_id is None:
+            raise ValueError("A2A_INPUT_CONTINUATION_REQUIRED")
+        waiter = ManagedA2AInputWaiter(pending, snapshot)
+        try:
+            yield waiter.event
+            outcome, response = await asyncio.wait_for(
+                waiter.wait(), max(0, request.deadline_unix_seconds - time.time())
+            )
+        except TimeoutError:
+            raise TimeoutError("A2A_OVERALL_TIMEOUT") from None
+        finally:
+            waiter.close()
+        is_approval = pending.interaction_kind == "approval"
+        if outcome != ("approved" if is_approval else "submitted"):
+            if is_approval:
+                # Rejection never sends a supplemental message. Retire the
+                # remote wait through the normal authorized cancellation path;
+                # that path records unknown outcomes without inventing success.
+                await service.cancel(snapshot.handle)
+            raise PermissionError("A2A_INPUT_REJECTED")
+        response_value = "approve" if is_approval else _structured_input_value(pending, response)
+        request = A2AContinuationRequest(
+            spec=request.spec,
+            handle=snapshot.handle,
+            message=A2AInvocationMessage(
+                message_id=stable_item_id("a2a", request.scope_id, pending.interaction_id, "input"),
+                data_parts=(response_value,),
+            ),
+            context=request.context,
+            deadline_unix_seconds=request.deadline_unix_seconds,
+            idempotency_token=stable_item_id(
+                "a2a", request.scope_id, pending.interaction_id, "continue"
+            ),
+        )