asap-protocol 2.4.0__tar.gz → 2.4.1__tar.gz

{asap_protocol-2.4.0 → asap_protocol-2.4.1}/CHANGELOG.md

@@ -7,23 +7,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Follow-up (not in this release)
+
+- `extra="forbid"` on ingress payload models (`TaskRequestConfig`, `CommonMetadata`)
+- Opt-in protection for operator APIs (`/usage`, `/sla`, `/audit`)
+- Redis-backed `JtiReplayCache` and distributed Next.js rate limits
+- Bump optional `pydantic-ai` extra (CVE-2026-46678)
+
+---
+
+## [2.4.1] - 2026-06-14
+
+**Security hardening patch** — OAuth2 `iss`/`aud` validation, fail-closed identity
+binding, web app SSRF/redirect fixes, and dependency bumps. Wire protocol and
+manifest schemas are unchanged from v2.4.0.
+
 ### Security
 
 - **OAuth2 middleware**: Validate JWT `iss` and `aud` when `ASAP_AUTH_ISSUER` / `ASAP_AUTH_AUDIENCE` (or `OAuth2Config.expected_issuer` / `expected_audience`) are set; refactored validation through `validate_jwt()` in `asap.auth.jwks`.
 - **Identity binding**: Fail-closed when `manifest_id` is configured but neither custom claim nor `ASAP_AUTH_SUBJECT_MAP` allowlist matches (403 instead of warn-and-pass).
-- **Web app (`apps/web`)**: Block open redirects on E2E fixture login routes via `resolveRedirectUrl`; harden SSRF on `/api/health-check` (127.0.0.0/8, DNS resolve4/6); Zod validation on API query params; rate-limit unit tests.
+- **Web app (`apps/web`)**: Block open redirects on E2E fixture login routes via `resolveRedirectUrl`; harden SSRF on `/api/health-check` (127.0.0.0/8, DNS resolve4/6); Zod strict validation on public API query params (unknown keys return 400); rate-limit unit tests.
 
 ### Fixed
 
 - **CI security (`pip-audit`)**: Bumped transitive pins (`langchain-core`, `langsmith`, `python-multipart`, `urllib3`, `pip`, `smolagents`) and adjusted documented `--ignore-vuln` flags (pygments + **smolagents** CVEs with no PyPI fix yet; pip ≥26.1 clears prior pip ignore). See [SECURITY.md](SECURITY.md).
 - **FastAPI / Starlette**: Raised `fastapi` floor to `>=0.136.1` so `starlette>=1.0.1` resolves **PYSEC-2026-161** (Host header path injection) without a `pip-audit` ignore.
 
-### Follow-up (not in this release)
+### Migration
 
-- `extra="forbid"` on ingress payload models (`TaskRequestConfig`, `CommonMetadata`)
-- Opt-in protection for operator APIs (`/usage`, `/sla`, `/audit`)
-- Redis-backed `JtiReplayCache` and distributed Next.js rate limits
-- Bump optional `pydantic-ai` extra (CVE-2026-46678)
+- **v2.4.0 → v2.4.1**: Security patch — bump dependencies; verify OAuth2 issuer/audience and identity binding if already configured. See
+  [migration guide](docs/migration.md#upgrading-from-v240-to-v241).
 
 ---
 

{asap_protocol-2.4.0 → asap_protocol-2.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: asap-protocol
-Version: 2.4.0
+Version: 2.4.1
 Summary: Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication
 Project-URL: Homepage, https://github.com/adriannoes/asap-protocol
 Project-URL: Documentation, https://adriannoes.github.io/asap-protocol
@@ -21,7 +21,7 @@ Classifier: Topic :: System :: Distributed Computing
 Classifier: Typing :: Typed
 Requires-Python: >=3.13
 Requires-Dist: aiosqlite>=0.20
-Requires-Dist: authlib<2,>=1.6.11
+Requires-Dist: authlib<2,>=1.6.12
 Requires-Dist: brotli>=1.2.0
 Requires-Dist: cryptography<47,>=46.0.7
 Requires-Dist: fastapi>=0.136.1
@@ -58,7 +58,7 @@ Requires-Dist: pytest>=9.0.3; extra == 'dev'
 Requires-Dist: ruff>=0.14.14; extra == 'dev'
 Requires-Dist: types-jsonschema>=4.0.0; extra == 'dev'
 Provides-Extra: dns-sd
-Requires-Dist: zeroconf>=0.80; extra == 'dns-sd'
+Requires-Dist: zeroconf>=0.149.5; extra == 'dns-sd'
 Provides-Extra: docs
 Requires-Dist: ghp-import>=2.1.0; extra == 'docs'
 Requires-Dist: mkdocs-material>=9.5; extra == 'docs'
@@ -75,7 +75,7 @@ Requires-Dist: openapi-pydantic>=0.5; extra == 'openapi'
 Provides-Extra: openclaw
 Requires-Dist: openclaw-sdk>=2.0; extra == 'openclaw'
 Provides-Extra: pydanticai
-Requires-Dist: pydantic-ai>=0.2; extra == 'pydanticai'
+Requires-Dist: pydantic-ai>=1.99.0; extra == 'pydanticai'
 Provides-Extra: redis
 Requires-Dist: redis>=5.0.0; extra == 'redis'
 Provides-Extra: smolagents
@@ -95,7 +95,7 @@ Description-Content-Type: text/markdown
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: `v2.4.0` (PyPI) · **npm TS [`2.4.0`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.4.0)** | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | **[PyPI `asap-protocol`](https://pypi.org/project/asap-protocol/)** | **[npm `@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client)** | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
+**Quick Info**: `v2.4.1` (PyPI) · **npm TS [`2.4.1`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.4.1)** | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | **[PyPI `asap-protocol`](https://pypi.org/project/asap-protocol/)** | **[npm `@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client)** | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
 
 > 📦 Install the ASAP **Python SDK / protocol** from **`https://pypi.org/project/asap-protocol/`** — package name **`asap-protocol`** on [PyPI](https://pypi.org/project/asap-protocol/).
 
@@ -123,7 +123,7 @@ For simple point-to-point communication, a basic HTTP API might suffice; ASAP sh
 - **Identity & capabilities (v2.2, WebAuthn real in v2.2.1)** — Per-runtime Host/Agent JWTs, capability grants with constraints (`max`, `min`, `in`, `not_in`), approval flows (device authorization / CIBA-style), real WebAuthn attestation/assertion for high-risk registration (opt-in via `asap-protocol[webauthn]`).
 - **Streaming & wire protocol (v2.2)** — `POST /asap/stream` (SSE / `TaskStream`), JSON-RPC 2.0 batch on `POST /asap`, `ASAP-Version` negotiation, tamper-evident audit logging, Compliance Harness v2.
 - **Adoption Multiplier (v2.3.0)** — OpenAPI → ASAP via `create_from_openapi` (`[openapi]` extra), official **`@asap-protocol/client`** on npm (Vercel AI / OpenAI / Anthropic adapters), optional **Auto-Registration** (`POST /registry/agents`), **capability escalation**, and **ASAP `WWW-Authenticate`** discovery challenges. All opt-in; wire protocol unchanged. See [docs/index.md](docs/index.md) and [docs/migration.md](docs/migration.md).
-- **Edge-AI discovery (v2.4.0)** — Optional `manifest.capabilities.hardware` + `inference`, Lite Registry mirror, marketplace browse filters, and `@asap-protocol/client@2.4.0` discovery types. Wire protocol unchanged. See [Migration (v2.3.x → v2.4.0)](docs/migration.md#upgrading-from-v23x-to-v240) and [ShellClaw registry guide](docs/guides/shellclaw-registry.md).
+- **Edge-AI discovery (v2.4.0)** — Optional `manifest.capabilities.hardware` + `inference`, Lite Registry mirror, marketplace browse filters, and `@asap-protocol/client@2.4.1` discovery types. Wire protocol unchanged. See [Migration (v2.3.x → v2.4.0)](docs/migration.md#upgrading-from-v23x-to-v240) and [ShellClaw registry guide](docs/guides/shellclaw-registry.md).
 - **Framework adapters (v2.3.1+, npm)** — **`@asap-protocol/mastra`** and **`@asap-protocol/openai-agents`** expose ASAP capabilities as Mastra tools and OpenAI Agents SDK `tool()` definitions. See [Migration (v2.3.0 → v2.3.1)](docs/migration.md#upgrading-from-v230-to-v231).
 - **Economics** — Usage metering, delegation tokens, SLA framework with breach alerts.
 
@@ -144,16 +144,16 @@ Or with pip:
 pip install asap-protocol
 ```
 
-**npm** (TypeScript / JavaScript — [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client), **`2.4.0`**). The `latest` dist-tag matches **`npm view @asap-protocol/client version`**.
+**npm** (TypeScript / JavaScript — [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client), **`2.4.1`**). The `latest` dist-tag matches **`npm view @asap-protocol/client version`**.
 
-**npm** Mastra [**`@asap-protocol/mastra@2.4.0`**](https://www.npmjs.com/package/@asap-protocol/mastra) bridges ASAP capabilities onto **`@mastra/core`** tools; docs: [`docs/integrations/mastra.md`](docs/integrations/mastra.md), demo: [`apps/example-mastra/README.md`](apps/example-mastra/README.md).
+**npm** Mastra [**`@asap-protocol/mastra@2.4.1`**](https://www.npmjs.com/package/@asap-protocol/mastra) bridges ASAP capabilities onto **`@mastra/core`** tools; docs: [`docs/integrations/mastra.md`](docs/integrations/mastra.md), demo: [`apps/example-mastra/README.md`](apps/example-mastra/README.md).
 
-**npm** OpenAI Agents SDK [**`@asap-protocol/openai-agents@2.4.0`**](https://www.npmjs.com/package/@asap-protocol/openai-agents) exposes ASAP capabilities as **`@openai/agents`** `tool()` definitions — **not** the Chat Completions helper [`adapters/openai`](packages/typescript/client/src/adapters/openai.ts); docs: [`docs/integrations/openai-agents.md`](docs/integrations/openai-agents.md), demo: [`apps/example-openai-agents/README.md`](apps/example-openai-agents/README.md).
+**npm** OpenAI Agents SDK [**`@asap-protocol/openai-agents@2.4.1`**](https://www.npmjs.com/package/@asap-protocol/openai-agents) exposes ASAP capabilities as **`@openai/agents`** `tool()` definitions — **not** the Chat Completions helper [`adapters/openai`](packages/typescript/client/src/adapters/openai.ts); docs: [`docs/integrations/openai-agents.md`](docs/integrations/openai-agents.md), demo: [`apps/example-openai-agents/README.md`](apps/example-openai-agents/README.md).
 
 ```bash
-npm install @asap-protocol/client@2.4.0
-npm install @asap-protocol/mastra@2.4.0 @asap-protocol/client @mastra/core zod
-npm install @asap-protocol/openai-agents@2.4.0 @asap-protocol/client @openai/agents zod
+npm install @asap-protocol/client@2.4.1
+npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
+npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
 
 📦 **Canonical listing:** **[https://pypi.org/project/asap-protocol/](https://pypi.org/project/asap-protocol/)** — package **`asap-protocol`** (`pip install asap-protocol`). Prefer `uv` for reproducible environments when possible.

{asap_protocol-2.4.0 → asap_protocol-2.4.1}/README.md

@@ -7,7 +7,7 @@
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: `v2.4.0` (PyPI) · **npm TS [`2.4.0`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.4.0)** | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | **[PyPI `asap-protocol`](https://pypi.org/project/asap-protocol/)** | **[npm `@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client)** | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
+**Quick Info**: `v2.4.1` (PyPI) · **npm TS [`2.4.1`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.4.1)** | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | **[PyPI `asap-protocol`](https://pypi.org/project/asap-protocol/)** | **[npm `@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client)** | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
 
 > 📦 Install the ASAP **Python SDK / protocol** from **`https://pypi.org/project/asap-protocol/`** — package name **`asap-protocol`** on [PyPI](https://pypi.org/project/asap-protocol/).
 
@@ -35,7 +35,7 @@ For simple point-to-point communication, a basic HTTP API might suffice; ASAP sh
 - **Identity & capabilities (v2.2, WebAuthn real in v2.2.1)** — Per-runtime Host/Agent JWTs, capability grants with constraints (`max`, `min`, `in`, `not_in`), approval flows (device authorization / CIBA-style), real WebAuthn attestation/assertion for high-risk registration (opt-in via `asap-protocol[webauthn]`).
 - **Streaming & wire protocol (v2.2)** — `POST /asap/stream` (SSE / `TaskStream`), JSON-RPC 2.0 batch on `POST /asap`, `ASAP-Version` negotiation, tamper-evident audit logging, Compliance Harness v2.
 - **Adoption Multiplier (v2.3.0)** — OpenAPI → ASAP via `create_from_openapi` (`[openapi]` extra), official **`@asap-protocol/client`** on npm (Vercel AI / OpenAI / Anthropic adapters), optional **Auto-Registration** (`POST /registry/agents`), **capability escalation**, and **ASAP `WWW-Authenticate`** discovery challenges. All opt-in; wire protocol unchanged. See [docs/index.md](docs/index.md) and [docs/migration.md](docs/migration.md).
-- **Edge-AI discovery (v2.4.0)** — Optional `manifest.capabilities.hardware` + `inference`, Lite Registry mirror, marketplace browse filters, and `@asap-protocol/client@2.4.0` discovery types. Wire protocol unchanged. See [Migration (v2.3.x → v2.4.0)](docs/migration.md#upgrading-from-v23x-to-v240) and [ShellClaw registry guide](docs/guides/shellclaw-registry.md).
+- **Edge-AI discovery (v2.4.0)** — Optional `manifest.capabilities.hardware` + `inference`, Lite Registry mirror, marketplace browse filters, and `@asap-protocol/client@2.4.1` discovery types. Wire protocol unchanged. See [Migration (v2.3.x → v2.4.0)](docs/migration.md#upgrading-from-v23x-to-v240) and [ShellClaw registry guide](docs/guides/shellclaw-registry.md).
 - **Framework adapters (v2.3.1+, npm)** — **`@asap-protocol/mastra`** and **`@asap-protocol/openai-agents`** expose ASAP capabilities as Mastra tools and OpenAI Agents SDK `tool()` definitions. See [Migration (v2.3.0 → v2.3.1)](docs/migration.md#upgrading-from-v230-to-v231).
 - **Economics** — Usage metering, delegation tokens, SLA framework with breach alerts.
 
@@ -56,16 +56,16 @@ Or with pip:
 pip install asap-protocol
 ```
 
-**npm** (TypeScript / JavaScript — [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client), **`2.4.0`**). The `latest` dist-tag matches **`npm view @asap-protocol/client version`**.
+**npm** (TypeScript / JavaScript — [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client), **`2.4.1`**). The `latest` dist-tag matches **`npm view @asap-protocol/client version`**.
 
-**npm** Mastra [**`@asap-protocol/mastra@2.4.0`**](https://www.npmjs.com/package/@asap-protocol/mastra) bridges ASAP capabilities onto **`@mastra/core`** tools; docs: [`docs/integrations/mastra.md`](docs/integrations/mastra.md), demo: [`apps/example-mastra/README.md`](apps/example-mastra/README.md).
+**npm** Mastra [**`@asap-protocol/mastra@2.4.1`**](https://www.npmjs.com/package/@asap-protocol/mastra) bridges ASAP capabilities onto **`@mastra/core`** tools; docs: [`docs/integrations/mastra.md`](docs/integrations/mastra.md), demo: [`apps/example-mastra/README.md`](apps/example-mastra/README.md).
 
-**npm** OpenAI Agents SDK [**`@asap-protocol/openai-agents@2.4.0`**](https://www.npmjs.com/package/@asap-protocol/openai-agents) exposes ASAP capabilities as **`@openai/agents`** `tool()` definitions — **not** the Chat Completions helper [`adapters/openai`](packages/typescript/client/src/adapters/openai.ts); docs: [`docs/integrations/openai-agents.md`](docs/integrations/openai-agents.md), demo: [`apps/example-openai-agents/README.md`](apps/example-openai-agents/README.md).
+**npm** OpenAI Agents SDK [**`@asap-protocol/openai-agents@2.4.1`**](https://www.npmjs.com/package/@asap-protocol/openai-agents) exposes ASAP capabilities as **`@openai/agents`** `tool()` definitions — **not** the Chat Completions helper [`adapters/openai`](packages/typescript/client/src/adapters/openai.ts); docs: [`docs/integrations/openai-agents.md`](docs/integrations/openai-agents.md), demo: [`apps/example-openai-agents/README.md`](apps/example-openai-agents/README.md).
 
 ```bash
-npm install @asap-protocol/client@2.4.0
-npm install @asap-protocol/mastra@2.4.0 @asap-protocol/client @mastra/core zod
-npm install @asap-protocol/openai-agents@2.4.0 @asap-protocol/client @openai/agents zod
+npm install @asap-protocol/client@2.4.1
+npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
+npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
 
 📦 **Canonical listing:** **[https://pypi.org/project/asap-protocol/](https://pypi.org/project/asap-protocol/)** — package **`asap-protocol`** (`pip install asap-protocol`). Prefer `uv` for reproducible environments when possible.

{asap_protocol-2.4.0 → asap_protocol-2.4.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "asap-protocol"
-version = "2.4.0"
+version = "2.4.1"
 description = "Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication"
 authors = [
     {name = "ASAP Protocol Contributors"}
@@ -29,7 +29,7 @@ dependencies = [
     "pydantic>=2.12.5,<3",
     "fastapi>=0.136.1",
     "httpx[http2]>=0.28.1",
-    "authlib>=1.6.11,<2",
+    "authlib>=1.6.12,<2",
     "joserfc>=1.6.3,<2",
     "uvicorn>=0.34",
     "python-ulid>=3.0",
@@ -68,7 +68,7 @@ docs = [
     "pymdown-extensions>=10.21.3",
 ]
 dns-sd = [
-    "zeroconf>=0.80",
+    "zeroconf>=0.149.5",
 ]
 # Redis: shared rate limit storage for multi-worker deployments (see rate_limit.py).
 redis = [
@@ -95,7 +95,7 @@ smolagents = [
     "smolagents>=1.24.0",
 ]
 pydanticai = [
-    "pydantic-ai>=0.2",
+    "pydantic-ai>=1.99.0",
 ]
 openclaw = [
     "openclaw-sdk>=2.0",
@@ -116,7 +116,9 @@ Issues = "https://github.com/adriannoes/asap-protocol/issues"
 "PyPI" = "https://pypi.org/project/asap-protocol/"
 
 # Override transitive dependencies for security fixes:
-# - pyjwt>=2.12.0 for CVE-2026-32597 (crit header validation)
+# - pyjwt>=2.13.0 for PYSEC-2026-175/177/178/179 (CVE-2026-32597 baseline at 2.12.0)
+# - aiohttp>=3.14.0,<4 for CVE-2026-34993 / CVE-2026-47265 (transitive, e.g. openclaw/mcp stacks)
+# - zeroconf>=0.149.5 for CVE-2026-47180/47183/47184 ([dns-sd] extra)
 # - pyasn1>=0.6.3 for CVE-2026-30922 (DoS via unbounded recursion)
 # - tinytag>=2.2.1 for CVE-2026-32889
 # - cryptography>=46.0.7 for CVE-2026-39892 / CVE-2026-34073 (name-constraint / peer identity)
@@ -128,14 +130,15 @@ Issues = "https://github.com/adriannoes/asap-protocol/issues"
 # - langsmith>=0.8.0 for CVE-2026-45134 (prior: GHSA-rr7j-v2q5-chgv)
 # - langchain-core>=1.3.3 for CVE-2026-44843
 # - urllib3>=2.7.0 for CVE-2026-44431 / CVE-2026-44432
-# - pip>=26.1 for CVE-2026-6357 (transitive via pip-api / venv)
+# - pip>=26.1.2 for PYSEC-2026-196 (CVE-2026-6357 baseline at 26.1)
 # - python-dotenv>=1.2.2 for CVE-2026-28684 (transitive, e.g. pydantic-settings / uvicorn stacks)
 # - idna>=3.15 for CVE-2026-45409 (DoS in idna.encode; transitive via httpx/requests)
 # - markdown>=3.10.2 for PYSEC-2026-89 (DoS in html.parser during Markdown parse; mkdocs stack)
 # - pymdown-extensions>=10.21.3 for CVE-2026-46338 (snippets base_path prefix bypass; mkdocs stack)
 [tool.uv]
 override-dependencies = [
-    "pyjwt>=2.12.0,<3",
+    "aiohttp>=3.14.0,<4",
+    "pyjwt>=2.13.0,<3",
     "pyasn1>=0.6.3",
     "tinytag>=2.2.1",
     "cryptography>=46.0.7,<47",
@@ -147,7 +150,8 @@ override-dependencies = [
     "langsmith>=0.8.0",
     "langchain-core>=1.3.3",
     "urllib3>=2.7.0",
-    "pip>=26.1",
+    "pip>=26.1.2",
+    "zeroconf>=0.149.5",
     "python-dotenv>=1.2.2",
     "idna>=3.15",
     "markdown>=3.10.2",
@@ -340,5 +344,5 @@ dev = [
     "memory-profiler>=0.61",
     "pytest-asyncio>=0.24",
     "pytest-cov>=6.0",
-    "pip>=26.0.1",
+    "pip>=26.1.2",
 ]

{asap_protocol-2.4.0 → asap_protocol-2.4.1}/src/asap/__init__.py

@@ -8,7 +8,7 @@ from __future__ import annotations
 
 from typing import Any
 
-__version__ = "2.4.0"
+__version__ = "2.4.1"
 
 __all__ = ["__version__", "create_from_openapi"]
 

{asap_protocol-2.4.0 → asap_protocol-2.4.1}/src/asap/discovery/wellknown.py

@@ -40,7 +40,7 @@ def get_manifest_json(manifest: Manifest) -> dict[str, object]:
     Returns:
         Dictionary suitable for JSON response (model_dump).
     """
-    return manifest.model_dump()
+    return manifest.model_dump(mode="json", by_alias=True)
 
 
 def compute_manifest_etag(manifest: Manifest) -> str:

{asap_protocol-2.4.0 → asap_protocol-2.4.1}/src/asap/integrations/pydanticai.py

@@ -64,20 +64,37 @@ def asap_tool_for_urn(
 
     client_instance = client or MarketClient()
     resolved: ResolvedAgent | None = None
-    try:
-        resolved = asyncio.run(client_instance.resolve(urn))
-    except Exception as e:
-        raise ValueError(f"Failed to resolve agent {urn}: {e}") from e
-
     skill_id = ""
-    if resolved.manifest.capabilities.skills:
-        skill_id = resolved.manifest.capabilities.skills[0].id
-    tool_name = name or resolved.manifest.name or urn
-    tool_description = description or resolved.manifest.description or f"Invoke ASAP agent {urn}."
-    parameters_schema = _parameters_schema_from_manifest(resolved.manifest)
-    agent = resolved
+    tool_name = name or urn
+    tool_description = description or f"Invoke ASAP agent {urn}."
+    parameters_schema = DEFAULT_PARAMETERS_JSON_SCHEMA
+
+    try:
+        asyncio.get_running_loop()
+    except RuntimeError:
+        try:
+            resolved = asyncio.run(client_instance.resolve(urn))
+            if resolved.manifest.capabilities.skills:
+                skill_id = resolved.manifest.capabilities.skills[0].id
+            tool_name = name or resolved.manifest.name or urn
+            tool_description = (
+                description or resolved.manifest.description or f"Invoke ASAP agent {urn}."
+            )
+            parameters_schema = _parameters_schema_from_manifest(resolved.manifest)
+        except Exception as e:
+            raise ValueError(f"Failed to resolve agent {urn}: {e}") from e
 
     async def _invoke(**kwargs: Any) -> str:
+        nonlocal resolved, skill_id
+        agent = resolved
+        if agent is None:
+            try:
+                agent = await client_instance.resolve(urn)
+                resolved = agent
+                if agent.manifest.capabilities.skills:
+                    skill_id = agent.manifest.capabilities.skills[0].id
+            except Exception as e:
+                return _to_str_result(f"Error: Failed to resolve agent {urn}: {e!s}")
         input_payload = kwargs.get("input", kwargs)
         if not isinstance(input_payload, dict):
             input_payload = {"value": input_payload}

{asap_protocol-2.4.0 → asap_protocol-2.4.1}/src/asap/integrations/smolagents.py

@@ -101,24 +101,27 @@ class SmolAgentsAsapTool(Tool if Tool is not None else object):  # type: ignore[
         self._skill_id = ""
 
         try:
-            resolved = asyncio.run(self._client.resolve(urn))
-            self._resolved = resolved
-            self._skill_id = (
-                resolved.manifest.capabilities.skills[0].id
-                if resolved.manifest.capabilities.skills
-                else ""
-            )
-            raw_name = name or resolved.manifest.name or urn
-            self.name = _sanitize_tool_name(raw_name)
-            self.description = (
-                description or resolved.manifest.description or f"Invoke ASAP agent {urn}."
-            )
-            self.inputs = _build_inputs_from_manifest(resolved.manifest)
-        except (OSError, ValueError, AgentRevokedException, SignatureVerificationError):
-            raw_name = name or urn or "asap_agent"
-            self.name = _sanitize_tool_name(raw_name)
-            self.description = description or f"Invoke ASAP agent {urn}."
-            self.inputs = _DEFAULT_INPUTS.copy()
+            asyncio.get_running_loop()
+        except RuntimeError:
+            try:
+                resolved = asyncio.run(self._client.resolve(urn))
+                self._resolved = resolved
+                self._skill_id = (
+                    resolved.manifest.capabilities.skills[0].id
+                    if resolved.manifest.capabilities.skills
+                    else ""
+                )
+                raw_name = name or resolved.manifest.name or urn
+                self.name = _sanitize_tool_name(raw_name)
+                self.description = (
+                    description or resolved.manifest.description or f"Invoke ASAP agent {urn}."
+                )
+                self.inputs = _build_inputs_from_manifest(resolved.manifest)
+            except (OSError, ValueError, AgentRevokedException, SignatureVerificationError):
+                raw_name = name or urn or "asap_agent"
+                self.name = _sanitize_tool_name(raw_name)
+                self.description = description or f"Invoke ASAP agent {urn}."
+                self.inputs = _DEFAULT_INPUTS.copy()
 
         super().__init__()
 

{asap_protocol-2.4.0 → asap_protocol-2.4.1}/src/asap/transport/client.py

@@ -1287,6 +1287,39 @@ class ASAPClient:
                         data = json.loads(json_str)
                         yield Envelope.model_validate(data)
 
+    async def _coerce_manifest_payload(
+        self,
+        manifest_data: dict[str, Any],
+        url: str,
+        *,
+        use_schema_validator: bool,
+    ) -> tuple[Manifest, str | None]:
+        """Parse plain or signed manifest JSON from an HTTP response body."""
+        try:
+            if "manifest" in manifest_data and "signature" in manifest_data:
+                signed = SignedManifest.model_validate(manifest_data)
+                if self._verify_signatures:
+                    trusted_b64 = self._trusted_manifest_keys.get(url)
+                    if not trusted_b64:
+                        raise SignatureVerificationError(
+                            f"Cannot verify signed manifest from {sanitize_url(url)}: "
+                            "no trusted public key provided. Pass trusted_manifest_keys "
+                            "to ASAPClient (or disable verify_signatures).",
+                            details={"url": sanitize_url(url)},
+                        )
+                    trusted_key = load_public_key_from_base64(trusted_b64)
+                    await asyncio.to_thread(verify_manifest, signed, trusted_key)
+                return signed.manifest, signed.signature.trust_level.value
+            if use_schema_validator:
+                return validate_manifest_schema(manifest_data), None
+            return Manifest.model_validate(manifest_data), None
+        except SignatureVerificationError:
+            raise
+        except ManifestValidationError:
+            raise
+        except Exception as e:
+            raise ValueError(f"Invalid manifest format: {e}") from e
+
     async def get_manifest(self, url: str | None = None) -> Manifest:
         """Get agent manifest from cache or HTTP endpoint.
 
@@ -1361,24 +1394,11 @@ class ASAPClient:
                     raise ValueError(f"Invalid JSON in manifest response: {e}") from e
 
                 try:
-                    if "manifest" in manifest_data and "signature" in manifest_data:
-                        signed = SignedManifest.model_validate(manifest_data)
-                        if self._verify_signatures:
-                            trusted_b64 = self._trusted_manifest_keys.get(url)
-                            if not trusted_b64:
-                                raise SignatureVerificationError(
-                                    f"Cannot verify signed manifest from {sanitize_url(url)}: "
-                                    "no trusted public key provided. Pass trusted_manifest_keys "
-                                    "to ASAPClient (or disable verify_signatures).",
-                                    details={"url": sanitize_url(url)},
-                                )
-                            trusted_key = load_public_key_from_base64(trusted_b64)
-                            await asyncio.to_thread(verify_manifest, signed, trusted_key)
-                        manifest = signed.manifest
-                        trust_level = signed.signature.trust_level.value
-                    else:
-                        manifest = Manifest.model_validate(manifest_data)
-                        trust_level = None
+                    manifest, trust_level = await self._coerce_manifest_payload(
+                        manifest_data,
+                        url,
+                        use_schema_validator=False,
+                    )
                 except SignatureVerificationError:
                     self._manifest_cache.invalidate(url)
                     raise
@@ -1605,7 +1625,14 @@ class ASAPClient:
                     raise ValueError(f"Invalid JSON in manifest response: {e}") from e
 
                 try:
-                    manifest = validate_manifest_schema(manifest_data)
+                    manifest, _trust_level = await self._coerce_manifest_payload(
+                        manifest_data,
+                        manifest_url,
+                        use_schema_validator=True,
+                    )
+                except SignatureVerificationError:
+                    self._manifest_cache.invalidate(manifest_url)
+                    raise
                 except ManifestValidationError:
                     self._manifest_cache.invalidate(manifest_url)
                     raise
@@ -1633,7 +1660,13 @@ class ASAPClient:
                     cause=e,
                     url=sanitize_url(manifest_url),
                 ) from e
-            except (ASAPConnectionError, ASAPTimeoutError, ValueError, ManifestValidationError):
+            except (
+                ASAPConnectionError,
+                ASAPTimeoutError,
+                ValueError,
+                ManifestValidationError,
+                SignatureVerificationError,
+            ):
                 raise
             except Exception as e:
                 self._manifest_cache.invalidate(manifest_url)