codex-a2a 1.3.2__tar.gz → 1.3.3__tar.gz

{codex_a2a-1.3.2 → codex_a2a-1.3.3}/.pre-commit-config.yaml

@@ -6,12 +6,21 @@ repos:
       - id: trailing-whitespace
       - id: end-of-file-fixer
       - id: check-yaml
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.14
+  - repo: local
     hooks:
       - id: ruff
+        name: ruff check (uv)
+        entry: uv run --locked --extra dev ruff check --force-exclude
+        language: system
+        types_or: [python, pyi, jupyter]
+        require_serial: true
         args: ["--fix"]
       - id: ruff-format
+        name: ruff format (uv)
+        entry: uv run --locked --extra dev ruff format --force-exclude
+        language: system
+        types_or: [python, pyi, jupyter]
+        require_serial: true
   - repo: https://github.com/Yelp/detect-secrets
     rev: v1.5.0
     hooks:

{codex_a2a-1.3.2 → codex_a2a-1.3.3}/CONTRIBUTING.md

@@ -72,6 +72,8 @@ bash -n scripts/smoke_test_built_cli.sh
 
 If `pre-commit` rewrites files, review the rewritten output and re-run the checks until the working tree is clean.
 
+Ruff's version is declared in the `dev` extra in `pyproject.toml` and resolved in `uv.lock`. The local pre-commit hooks run `uv run --locked --extra dev ruff`, so direct commands, hooks, and CI use the same project dependency. To upgrade Ruff, update that dependency and regenerate `uv.lock`; there is no separate Ruff hook revision to maintain.
+
 ## Compatibility Expectations
 
 - The repository targets Python 3.11 through 3.14. CI uses 3.13 for the full quality gate and exercises 3.11, 3.12, and 3.14 in the runtime matrix.

{codex_a2a-1.3.2 → codex_a2a-1.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-a2a
-Version: 1.3.2
+Version: 1.3.3
 Summary: Codex A2A runtime adapter
 Author: liujuanjuan1984@Intelligent-Internet
 License-Expression: Apache-2.0
@@ -23,14 +23,14 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: a2a-sdk==1.1.2
+Requires-Dist: a2a-sdk==1.1.5
 Requires-Dist: aiosqlite<1.0,>=0.20
 Requires-Dist: fastapi<0.142,>=0.121
 Requires-Dist: httpx<0.29,>=0.28.1
-Requires-Dist: protobuf<7.0,>=6.33.5
+Requires-Dist: protobuf<8.0,>=6.33.5
 Requires-Dist: pydantic<3.0,>=2.6
 Requires-Dist: pydantic-settings<3.0,>=2.2
-Requires-Dist: sqlalchemy<3.0,>=2.0
+Requires-Dist: sqlalchemy[asyncio]<3.0,>=2.0
 Requires-Dist: sse-starlette<4.0,>=2.1
 Requires-Dist: uvicorn<0.53,>=0.29
 Provides-Extra: dev
@@ -40,8 +40,8 @@ Requires-Dist: pygments<3.0,>=2.20.0; extra == "dev"
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
 Requires-Dist: pytest-cov<8.0,>=5.0; extra == "dev"
-Requires-Dist: diff-cover<10,>=9; extra == "dev"
-Requires-Dist: ruff>=0.5; extra == "dev"
+Requires-Dist: diff-cover<11,>=9; extra == "dev"
+Requires-Dist: ruff==0.16.9; extra == "dev"
 Requires-Dist: mypy<2.4,>=1.11; extra == "dev"
 Dynamic: license-file
 

{codex_a2a-1.3.2 → codex_a2a-1.3.3}/docs/compatibility.md

@@ -7,7 +7,9 @@ This document explains the compatibility promises this repository currently trie
 | Layer | Supported contract | Evidence and boundary |
 | --- | --- | --- |
 | Python | 3.11–3.14 | Package classifiers cover all four versions; CI runs 3.13 as the quality gate and 3.11, 3.12, and 3.14 in the runtime matrix. |
-| A2A Python SDK | Exactly `a2a-sdk==1.1.2` | Pinned in `pyproject.toml`; this is the [official A2A Python SDK](https://github.com/a2aproject/a2a-python), not a fork. |
+| A2A Python SDK | Exactly `a2a-sdk==1.1.5` | Pinned in `pyproject.toml`; this is the [official A2A Python SDK](https://github.com/a2aproject/a2a-python), not a fork. |
+| Protocol Buffers | `protobuf>=6.33.5,<8.0` | The lockfile selects 7.36.2. SDK 1.1.5 supports protobuf 7; Google API Core, common protos, and proto-plus must resolve within the same range. Task retrieval delegates validation and history trimming to the SDK. |
+| SQLAlchemy | `sqlalchemy[asyncio]>=2.0,<3.0` | The `asyncio` extra explicitly installs `greenlet` for the async persistence engine, including standalone wheel installations. The lockfile selects the development version. |
 | A2A protocol | `1.0` wire line | The released upstream A2A specification is normative for portable core semantics; the current compatible release is `v1.0.1`. SDK compatibility with other protocol versions does not extend this adapter's claim. |
 | Inbound A2A transports | JSON-RPC and HTTP+JSON | Both are repository-owned runtime surfaces. gRPC is not exposed by this adapter. |
 | Codex local runtime | Codex CLI/App Server | The local [Apache-2.0 Codex CLI](https://github.com/openai/codex) is the upstream process boundary. Scheduled smoke tests install the latest stable CLI and complete a real local App Server turn. |

{codex_a2a-1.3.2 → codex_a2a-1.3.3}/docs/conformance-triage.md

@@ -5,7 +5,7 @@ This document is the standing triage template for local `./scripts/conformance.s
 ## Authorities Used For Triage
 
 - The latest compatible released upstream A2A specification is authoritative; currently this is `v1.0.1` for the repository's advertised `1.0` wire line.
-- `a2a-sdk==1.1.2` as installed in this repository.
+- `a2a-sdk==1.1.5` as installed in this repository.
 - The default A2A protocol version advertised by this repository: `1.0`.
 - TCK assertions are non-normative observations and may lag the released specification.
 - Repository compatibility policy:

{codex_a2a-1.3.2 → codex_a2a-1.3.3}/docs/conformance.md

@@ -74,7 +74,7 @@ When a TCK run fails, inspect the raw report before changing the runtime:
 
 - Some failures may point to real runtime gaps.
 - Some failures may reflect an outdated embedded specification or a TCK-specific interpretation. Resolve those disagreements against the latest compatible released A2A specification.
-- Some failures may come from TCK assumptions that do not match `a2a-sdk==1.1.2`.
+- Some failures may come from TCK assumptions that do not match `a2a-sdk==1.1.5`.
 - Some failures may come from older A2A naming or schema expectations that no longer match the repository's `1.0` contract.
 - Some failures may be local experiment artifacts from the dummy-backed runtime.
 

{codex_a2a-1.3.2 → codex_a2a-1.3.3}/pyproject.toml

@@ -25,14 +25,14 @@ classifiers = [
     "Topic :: Internet :: WWW/HTTP",
 ]
 dependencies = [
-    "a2a-sdk==1.1.2",
+    "a2a-sdk==1.1.5",
     "aiosqlite>=0.20,<1.0",
     "fastapi>=0.121,<0.142",
     "httpx>=0.28.1,<0.29",
-    "protobuf>=6.33.5,<7.0",
+    "protobuf>=6.33.5,<8.0",
     "pydantic>=2.6,<3.0",
     "pydantic-settings>=2.2,<3.0",
-    "sqlalchemy>=2.0,<3.0",
+    "sqlalchemy[asyncio]>=2.0,<3.0",
     "sse-starlette>=2.1,<4.0",
     "uvicorn>=0.29,<0.53",
 ]
@@ -45,8 +45,8 @@ dev = [
     "pytest>=8.0",
     "pytest-asyncio>=0.23",
     "pytest-cov>=5.0,<8.0",
-    "diff-cover>=9,<10",
-    "ruff>=0.5",
+    "diff-cover>=9,<11",
+    "ruff==0.16.9",
     "mypy>=1.11,<2.4",
 ]
 

{codex_a2a-1.3.2 → codex_a2a-1.3.3}/scripts/README.md

@@ -38,6 +38,7 @@ The `Publish` workflow now separates build, PyPI publish, and GitHub Release syn
 - `validate_baseline.sh` now includes a conservative private dead-code check before type-checking and test execution.
 - `audit_low_call_sites.py` is intentionally advisory only. Use it to surface low-call-count candidates, then inspect the actual consumer chain before removing an abstraction.
 - `validate_baseline.sh` now blocks on runtime dependency vulnerability audit, while `dependency_health.sh` remains focused on broader dependency review (`outdated` + dev audit).
+- The baseline makes up to three runtime audit attempts (the initial attempt plus at most two retries), with a fresh cache per attempt. If every attempt fails, it returns the last audit exit code and stops before package build and wheel smoke testing. A successful retry allows validation to continue.
 - [`.github/dependabot.yml`](../.github/dependabot.yml) prefers a single weekly grouped Dependabot PR for `uv`, while the repository scripts remain the explicit audit and validation entrypoints.
 - End-user runtime startup does not use repository scripts. Prefer the published CLI command documented in [README.md](../README.md) and [docs/guide.md](../docs/guide.md).
 - Keep long-form documentation changes in `docs/` to avoid divergence.

{codex_a2a-1.3.2 → codex_a2a-1.3.3}/scripts/validate_baseline.sh

@@ -19,8 +19,9 @@ run_pip_audit() {
     if XDG_CACHE_HOME="${audit_cache_dir}" uv run pip-audit --requirement "${requirement_file}"; then
       rm -rf "${audit_cache_dir}"
       return 0
+    else
+      status=$?
     fi
-    status=$?
     rm -rf "${audit_cache_dir}"
     if [[ "${attempt}" -ge "${max_attempts}" ]]; then
       echo "pip-audit failed after ${attempt} attempts" >&2

{codex_a2a-1.3.2 → codex_a2a-1.3.3}/src/codex_a2a/server/request_handler.py

@@ -10,7 +10,6 @@ from a2a.server.events import EventConsumer
 from a2a.server.events.event_queue import EventQueueLegacy
 from a2a.server.events.queue_manager import QueueManager
 from a2a.server.request_handlers import DefaultRequestHandler
-from a2a.server.request_handlers.default_request_handler_v2 import validate_history_length
 from a2a.server.tasks import TaskManager
 from a2a.types import (
     Artifact,
@@ -119,17 +118,10 @@ class CodexRequestHandler(DefaultRequestHandler):
     ):
         store_context = self._task_store_context(context)
         try:
-            # The A2A SDK currently validates GetTaskRequest through a protobuf
-            # field API that is incompatible with protobuf 7.x. Mirror the small
-            # upstream get-task flow here so the server remains usable on current deps.
-            validate_history_length(params)
-            task = await self.task_store.get(params.id, store_context)
-            if task is None:
-                raise TaskNotFoundError()
+            task = await super().on_get_task(params, store_context)
             accepted_output_modes = self._accepted_output_modes_for_task(
                 task_id=params.id, task=task
             )
-            task = apply_history_length(task, params)
             return apply_accepted_output_modes(task, accepted_output_modes)
         except TaskStoreOperationError as exc:
             raise self._task_store_server_error(exc) from exc

{codex_a2a-1.3.2 → codex_a2a-1.3.3}/src/codex_a2a.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-a2a
-Version: 1.3.2
+Version: 1.3.3
 Summary: Codex A2A runtime adapter
 Author: liujuanjuan1984@Intelligent-Internet
 License-Expression: Apache-2.0
@@ -23,14 +23,14 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: a2a-sdk==1.1.2
+Requires-Dist: a2a-sdk==1.1.5
 Requires-Dist: aiosqlite<1.0,>=0.20
 Requires-Dist: fastapi<0.142,>=0.121
 Requires-Dist: httpx<0.29,>=0.28.1
-Requires-Dist: protobuf<7.0,>=6.33.5
+Requires-Dist: protobuf<8.0,>=6.33.5
 Requires-Dist: pydantic<3.0,>=2.6
 Requires-Dist: pydantic-settings<3.0,>=2.2
-Requires-Dist: sqlalchemy<3.0,>=2.0
+Requires-Dist: sqlalchemy[asyncio]<3.0,>=2.0
 Requires-Dist: sse-starlette<4.0,>=2.1
 Requires-Dist: uvicorn<0.53,>=0.29
 Provides-Extra: dev
@@ -40,8 +40,8 @@ Requires-Dist: pygments<3.0,>=2.20.0; extra == "dev"
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
 Requires-Dist: pytest-cov<8.0,>=5.0; extra == "dev"
-Requires-Dist: diff-cover<10,>=9; extra == "dev"
-Requires-Dist: ruff>=0.5; extra == "dev"
+Requires-Dist: diff-cover<11,>=9; extra == "dev"
+Requires-Dist: ruff==0.16.9; extra == "dev"
 Requires-Dist: mypy<2.4,>=1.11; extra == "dev"
 Dynamic: license-file
 

{codex_a2a-1.3.2 → codex_a2a-1.3.3}/src/codex_a2a.egg-info/SOURCES.txt

@@ -222,6 +222,7 @@ tests/scripts/test_audit_low_call_sites.py
 tests/scripts/test_check_codex_app_server_schema.py
 tests/scripts/test_script_health_contract.py
 tests/scripts/test_tck_auth_plugin.py
+tests/scripts/test_validate_baseline_script.py
 tests/server/__init__.py
 tests/server/test_agent_card.py
 tests/server/test_auth.py

{codex_a2a-1.3.2 → codex_a2a-1.3.3}/src/codex_a2a.egg-info/requires.txt

@@ -1,11 +1,11 @@
-a2a-sdk==1.1.2
+a2a-sdk==1.1.5
 aiosqlite<1.0,>=0.20
 fastapi<0.142,>=0.121
 httpx<0.29,>=0.28.1
-protobuf<7.0,>=6.33.5
+protobuf<8.0,>=6.33.5
 pydantic<3.0,>=2.6
 pydantic-settings<3.0,>=2.2
-sqlalchemy<3.0,>=2.0
+sqlalchemy[asyncio]<3.0,>=2.0
 sse-starlette<4.0,>=2.1
 uvicorn<0.53,>=0.29
 
@@ -16,6 +16,6 @@ pygments<3.0,>=2.20.0
 pytest>=8.0
 pytest-asyncio>=0.23
 pytest-cov<8.0,>=5.0
-diff-cover<10,>=9
-ruff>=0.5
+diff-cover<11,>=9
+ruff==0.16.9
 mypy<2.4,>=1.11

codex_a2a-1.3.3/tests/scripts/test_validate_baseline_script.py

@@ -0,0 +1,89 @@
+import json
+import os
+import subprocess
+import textwrap
+from pathlib import Path
+
+import pytest
+
+BASELINE_SCRIPT = Path(__file__).resolve().parents[2] / "scripts" / "validate_baseline.sh"
+
+
+@pytest.mark.parametrize(
+    ("audit_statuses", "expected_status"),
+    [([0], 0), ([7, 0], 0), ([7, 8, 0], 0), ([1, 1, 1], 1), ([2, 2, 2], 2), ([7, 8, 9], 9)],
+)
+def test_baseline_audit_gates_build_and_preserves_failure_status(
+    tmp_path: Path, audit_statuses: list[int], expected_status: int
+) -> None:
+    subprocess.run(["git", "init", "--quiet", str(tmp_path)], check=True)
+    bin_dir = tmp_path / "bin"
+    bin_dir.mkdir()
+    fake_uv = bin_dir / "uv"
+    fake_uv.write_text(
+        textwrap.dedent(
+            """\
+            #!/usr/bin/env python3
+            import json
+            import os
+            import sys
+            from pathlib import Path
+
+            args = sys.argv[1:]
+            log = Path("commands.jsonl")
+            calls = []
+            if log.exists():
+                calls = [json.loads(line) for line in log.read_text().splitlines()]
+            entry = {"args": args}
+            status = 0
+            if args[:2] == ["run", "pip-audit"]:
+                attempt = sum(call["args"][:2] == ["run", "pip-audit"] for call in calls)
+                status = json.loads(os.environ["AUDIT_STATUSES"])[attempt]
+                entry["cache"] = os.environ["XDG_CACHE_HOME"]
+                assert Path(entry["cache"]).is_dir()
+                assert Path(args[args.index("--requirement") + 1]).is_file()
+            elif args[0] == "export":
+                Path(args[args.index("--output-file") + 1]).write_text("example==1.0\\n")
+            elif args[0] == "build":
+                Path("dist").mkdir()
+                Path("dist/codex_a2a-0.0.0-py3-none-any.whl").touch()
+            with log.open("a") as handle:
+                handle.write(json.dumps(entry) + "\\n")
+            sys.exit(status)
+            """
+        )
+    )
+    fake_uv.chmod(0o755)
+    fake_sleep = bin_dir / "sleep"
+    fake_sleep.write_text("#!/usr/bin/env bash\nexit 0\n")
+    fake_sleep.chmod(0o755)
+    scripts_dir = tmp_path / "scripts"
+    scripts_dir.mkdir()
+    (scripts_dir / "smoke_test_built_cli.sh").write_text("touch smoke-ran\n")
+
+    result = subprocess.run(
+        ["bash", str(BASELINE_SCRIPT)],
+        cwd=tmp_path,
+        env={
+            **os.environ,
+            "PATH": f"{bin_dir}{os.pathsep}{os.environ['PATH']}",
+            "AUDIT_STATUSES": json.dumps(audit_statuses),
+        },
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=15,
+    )
+
+    assert result.returncode == expected_status, result.stdout + result.stderr
+    calls = [json.loads(line) for line in (tmp_path / "commands.jsonl").read_text().splitlines()]
+    audits = [call for call in calls if call["args"][:2] == ["run", "pip-audit"]]
+    assert len(audits) == len(audit_statuses)
+    assert len({call["cache"] for call in audits}) == len(audits)
+    assert all(not Path(call["cache"]).exists() for call in audits)
+    requirements = audits[0]["args"][-1]
+    assert not Path(requirements).exists()
+    assert any(call["args"][0] == "build" for call in calls) == (expected_status == 0)
+    assert (tmp_path / "smoke-ran").exists() == (expected_status == 0)
+    if expected_status:
+        assert "pip-audit failed after 3 attempts" in result.stderr

{codex_a2a-1.3.2 → codex_a2a-1.3.3}/tests/server/test_request_handler.py

@@ -27,7 +27,12 @@ from a2a.types import (
     TaskStatus,
     TaskStatusUpdateEvent,
 )
-from a2a.utils.errors import InternalError, UnsupportedOperationError
+from a2a.utils.errors import (
+    InternalError,
+    InvalidParamsError,
+    TaskNotFoundError,
+    UnsupportedOperationError,
+)
 
 from codex_a2a.a2a_proto import (
     new_data_part,
@@ -542,7 +547,13 @@ async def test_message_send_stream_filters_unaccepted_output_parts_to_text() ->
 
 
 @pytest.mark.asyncio
-async def test_get_task_applies_stored_output_negotiation() -> None:
+@pytest.mark.parametrize(
+    ("history_length", "expected_ids"),
+    [(None, ["m-1", "m-2"]), (0, []), (1, ["m-2"]), (10, ["m-1", "m-2"])],
+)
+async def test_get_task_applies_stored_output_negotiation(
+    history_length: int | None, expected_ids: list[str]
+) -> None:
     task_store = InMemoryTaskStore()
     task = Task(
         id="task-1",
@@ -561,15 +572,61 @@ async def test_get_task_applies_stored_output_negotiation() -> None:
                 parts=[new_data_part({"kind": "state", "tool": "bash"})],
             )
         ],
+        history=[
+            Message(
+                message_id=message_id,
+                role=Role.ROLE_AGENT,
+                parts=[new_data_part({"kind": "state", "tool": "bash"})],
+            )
+            for message_id in ("m-1", "m-2")
+        ],
         metadata=merge_output_negotiation_metadata(None, ["text/plain"]),
     )
     await task_store.save(task, _server_context())
     handler = _make_handler(task_store=task_store)
 
-    result = await handler.on_get_task(GetTaskRequest(id="task-1"))
+    params = GetTaskRequest(id="task-1")
+    if history_length is not None:
+        params.history_length = history_length
+    result = await handler.on_get_task(params)
 
     assert part_text(result.status.message.parts[0]) == '{"kind":"state","tool":"bash"}'
     assert part_text(result.artifacts[0].parts[0]) == '{"kind":"state","tool":"bash"}'
+    assert [message.message_id for message in result.history] == expected_ids
+    assert all(
+        part_text(message.parts[0]) == '{"kind":"state","tool":"bash"}'
+        for message in result.history
+    )
+    stored_task = await task_store.get("task-1", _server_context())
+    assert stored_task is not None
+    assert [message.message_id for message in stored_task.history] == ["m-1", "m-2"]
+    assert stored_task.artifacts[0].parts[0].WhichOneof("content") == "data"
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "params", [GetTaskRequest(), GetTaskRequest(id="task-1", history_length=-1)]
+)
+async def test_get_task_validates_request_before_accessing_store(params: GetTaskRequest) -> None:
+    task_store = _mock_task_store()
+    handler = _make_handler(task_store=task_store)
+
+    with pytest.raises(InvalidParamsError):
+        await handler.on_get_task(params)
+
+    task_store.get.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+async def test_get_task_preserves_context_and_missing_task_error() -> None:
+    task_store = _mock_task_store()
+    handler = _make_handler(task_store=task_store)
+    context = _server_context()
+
+    with pytest.raises(TaskNotFoundError):
+        await handler.on_get_task(GetTaskRequest(id="missing"), context)
+
+    task_store.get.assert_awaited_once_with("missing", context)
 
 
 @pytest.mark.asyncio