iac-code 0.10.0__tar.gz → 0.11.1__tar.gz

{iac_code-0.10.0 → iac_code-0.11.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: iac_code
-Version: 0.10.0
+Version: 0.11.1
 Summary: Your AI-powered Infrastructure as Code assistant
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
@@ -75,6 +75,17 @@ Reading from stdin is also supported:
 echo "Create an OSS Bucket" | iac-code --prompt -
 ```
 
+### Web App
+
+Prefer a graphical interface? Launch the local web app, which runs the same engine as the CLI and shares the same sessions. The web app needs the `http` extra, so install it first:
+
+```bash
+pip install 'iac-code[http]'
+iac-code web
+```
+
+By default it opens `http://127.0.0.1:8766` in your browser (loopback only). See the [Web App guide](https://aliyun.github.io/iac-code/web-app) for details.
+
 ## Contributing
 
 Install [uv](https://docs.astral.sh/uv/getting-started/installation/), then:

{iac_code-0.10.0 → iac_code-0.11.1}/README.md

@@ -55,6 +55,17 @@ Reading from stdin is also supported:
 echo "Create an OSS Bucket" | iac-code --prompt -
 ```
 
+### Web App
+
+Prefer a graphical interface? Launch the local web app, which runs the same engine as the CLI and shares the same sessions. The web app needs the `http` extra, so install it first:
+
+```bash
+pip install 'iac-code[http]'
+iac-code web
+```
+
+By default it opens `http://127.0.0.1:8766` in your browser (loopback only). See the [Web App guide](https://aliyun.github.io/iac-code/web-app) for details.
+
 ## Contributing
 
 Install [uv](https://docs.astral.sh/uv/getting-started/installation/), then:

{iac_code-0.10.0 → iac_code-0.11.1}/pyproject.toml

@@ -46,10 +46,12 @@ dependencies = [
     "alibabacloud-gateway-oss>=0.0.25,<1",
     "alibabacloud-gateway-pop>=0.1.3,<1",
     "aliyun-python-sdk-core>=2.16,<3",
+    "python-dateutil==2.8.2",
 ]
 
 [project.optional-dependencies]
 http = [
+    "a2a-sdk[http-server,signing]>=1.0.2,<2",
     "starlette>=0.39.0",
     "uvicorn[standard]>=0.30.0",
 ]
@@ -104,6 +106,11 @@ version = {attr = "iac_code.__version__"}
     "**/*.yaml",
     "**/*.json",
     "**/*.md",
+    "**/*.html",
+    "**/*.css",
+    "**/*.js",
+    "**/*.svg",
+    "**/*.LICENSE",
     "**/*.rego",
     "**/*.mo",
     "**/*.po",

{iac_code-0.10.0 → iac_code-0.11.1}/setup.py

@@ -47,6 +47,7 @@ INSTALL_REQUIRES = [
 ]
 EXTRAS_REQUIRE = {
     "http": [
+        "a2a-sdk[http-server,signing]>=1.0.2,<2",
         "starlette>=0.39.0",
         "uvicorn[standard]>=0.30.0",
     ],
@@ -77,6 +78,11 @@ PACKAGE_DATA = {
         "**/*.json",
         "**/*.md",
         "**/*.rego",
+        "**/*.html",
+        "**/*.css",
+        "**/*.js",
+        "**/*.svg",
+        "**/*.LICENSE",
         "**/*.mo",
         "**/*.po",
     ],
@@ -194,7 +200,7 @@ def _compile_translations():
 
 
 def _replace_release_date():
-    if platform.system() == 'Darwin':
+    if platform.system() == "Darwin":
         return
     content = INIT_PATH.read_text(encoding="utf-8")
     today = date.today().isoformat()
@@ -325,5 +331,5 @@ setup(
     cmdclass={
         "build_py": InjectReleaseDateBuildPy,
         "sdist": CompileTranslationsSdist,
-    }
+    },
 )

iac_code-0.11.1/src/iac_code/__init__.py

@@ -0,0 +1,2 @@
+__version__ = "0.11.1"
+__release_date__ = "2026-07-31"

{iac_code-0.10.0 → iac_code-0.11.1}/src/iac_code/a2a/app.py

@@ -12,7 +12,7 @@ from contextlib import asynccontextmanager, suppress
 from email.utils import formatdate
 from pathlib import Path
 from time import time
-from typing import Awaitable, Callable
+from typing import Any, AsyncIterator, Awaitable, Callable, cast
 
 from a2a.auth.user import User
 from a2a.server.context import ServerCallContext
@@ -30,6 +30,12 @@ from iac_code.a2a.jsonrpc_passthrough import (
     install_jsonrpc_error_data_passthrough,
     install_v03_jsonrpc_error_data_passthrough,
 )
+from iac_code.a2a.projection import (
+    project_a2a_data,
+    project_a2a_text,
+    resolve_a2a_public_path_roots,
+    resolve_a2a_public_path_roots_for_data,
+)
 from iac_code.i18n import _
 
 logger = logging.getLogger(__name__)
@@ -144,6 +150,146 @@ class A2AAuthMiddleware(BaseHTTPMiddleware):
         )
 
 
+class A2AProjectionMiddleware(BaseHTTPMiddleware):
+    """Apply the current A2A delivery policy at the HTTP wire boundary."""
+
+    def __init__(self, app: Any, *, task_store: Any) -> None:
+        super().__init__(app)
+        self._task_store = task_store
+
+    async def dispatch(self, request: Request, call_next: Callable[[Request], Awaitable[Response]]) -> Response:
+        request_data = await _a2a_request_data(request)
+        response = await call_next(request)
+        request_data = _with_a2a_path_parameters(request, request_data)
+        if request.url.path in {"/health", AGENT_CARD_WELL_KNOWN_PATH}:
+            return response
+
+        content_type = response.headers.get("content-type", "").lower()
+        streaming_response = cast(Any, response)
+        if content_type.startswith("text/event-stream"):
+            streaming_response.body_iterator = self._project_sse(
+                streaming_response.body_iterator,
+                request_data=request_data,
+            )
+            return response
+        if "json" not in content_type:
+            return response
+
+        body = b"".join([_response_chunk_bytes(chunk) async for chunk in streaming_response.body_iterator])
+        try:
+            data = json.loads(body)
+        except (UnicodeDecodeError, json.JSONDecodeError):
+            return Response(
+                body,
+                status_code=response.status_code,
+                headers=_response_headers_without_length(response),
+                background=response.background,
+            )
+        roots = await self._resolve_roots(data, request_data)
+        projected = project_a2a_data(data, public_path_roots=roots)
+        return Response(
+            json.dumps(projected, ensure_ascii=False, separators=(",", ":")).encode("utf-8"),
+            status_code=response.status_code,
+            headers=_response_headers_without_length(response),
+            background=response.background,
+        )
+
+    async def _project_sse(self, body_iterator: Any, *, request_data: Any) -> AsyncIterator[bytes]:
+        pending = b""
+        async for chunk in body_iterator:
+            pending += _response_chunk_bytes(chunk)
+            while True:
+                frame, separator, pending = _take_sse_frame(pending)
+                if separator is None:
+                    pending = frame
+                    break
+                yield await self._project_sse_frame(frame, request_data=request_data) + separator
+        if pending:
+            yield await self._project_sse_frame(pending, request_data=request_data)
+
+    async def _project_sse_frame(self, frame: bytes, *, request_data: Any) -> bytes:
+        output: list[bytes] = []
+        for line in frame.splitlines(keepends=True):
+            stripped = line.lstrip()
+            if not stripped.startswith(b"data:"):
+                output.append(line)
+                continue
+            prefix_length = len(line) - len(stripped)
+            payload_with_ending = stripped.removeprefix(b"data:")
+            ending = b""
+            if payload_with_ending.endswith(b"\r\n"):
+                payload_with_ending, ending = payload_with_ending[:-2], b"\r\n"
+            elif payload_with_ending.endswith(b"\n"):
+                payload_with_ending, ending = payload_with_ending[:-1], b"\n"
+            try:
+                data = json.loads(payload_with_ending.strip())
+            except (UnicodeDecodeError, json.JSONDecodeError):
+                output.append(line)
+                continue
+            roots = await self._resolve_roots(data, request_data)
+            projected = project_a2a_data(data, public_path_roots=roots)
+            encoded = json.dumps(projected, ensure_ascii=False, separators=(",", ":")).encode("utf-8")
+            output.append(line[:prefix_length] + b"data: " + encoded + ending)
+        return b"".join(output)
+
+    async def _resolve_roots(self, response_data: Any, request_data: Any) -> list[dict[str, str]]:
+        return await resolve_a2a_public_path_roots_for_data(
+            self._task_store,
+            response_data=response_data,
+            request_data=request_data,
+        )
+
+
+async def _a2a_request_data(request: Request) -> Any:
+    data: dict[str, Any] = dict(request.query_params)
+    if request.method in {"POST", "PUT", "PATCH"}:
+        try:
+            body = await request.json()
+        except Exception:
+            body = None
+        if isinstance(body, dict):
+            data.update(body)
+        elif body is not None:
+            data["body"] = body
+    return data
+
+
+def _with_a2a_path_parameters(request: Request, request_data: Any) -> dict[str, Any]:
+    """Add REST route identity after routing has populated ``path_params``."""
+
+    data = dict(request_data) if isinstance(request_data, dict) else {"body": request_data}
+    path_params = request.scope.get("path_params")
+    if not isinstance(path_params, dict):
+        return data
+    task_id = path_params.get("id")
+    if isinstance(task_id, str) and task_id and "/tasks/" in request.url.path:
+        data.setdefault("taskId", task_id)
+    context_id = path_params.get("context_id") or path_params.get("contextId")
+    if isinstance(context_id, str) and context_id:
+        data.setdefault("contextId", context_id)
+    return data
+
+
+def _response_chunk_bytes(chunk: Any) -> bytes:
+    if isinstance(chunk, bytes):
+        return chunk
+    if isinstance(chunk, memoryview):
+        return chunk.tobytes()
+    return str(chunk).encode("utf-8")
+
+
+def _response_headers_without_length(response: Response) -> dict[str, str]:
+    return {key: value for key, value in response.headers.items() if key.lower() != "content-length"}
+
+
+def _take_sse_frame(data: bytes) -> tuple[bytes, bytes | None, bytes]:
+    candidates = [(index, separator) for separator in (b"\r\n\r\n", b"\n\n") if (index := data.find(separator)) >= 0]
+    if not candidates:
+        return data, None, b""
+    index, separator = min(candidates, key=lambda item: item[0])
+    return data[:index], separator, data[index + len(separator) :]
+
+
 async def health(request: Request) -> JSONResponse:
     return JSONResponse({"status": "healthy"})
 
@@ -253,6 +399,13 @@ def create_app(
 
     recovery_service = A2APipelineRecoveryService(task_store=components.task_store)
 
+    async def recovery_path_roots(*, context_id: str | None, task_id: str | None) -> list[dict[str, str]]:
+        return await resolve_a2a_public_path_roots(
+            components.task_store,
+            task_id=task_id,
+            context_id=context_id,
+        )
+
     async def get_pipeline_state(request: Request) -> JSONResponse:
         context_id = request.query_params.get("contextId") or None
         task_id = request.query_params.get("taskId") or None
@@ -263,16 +416,28 @@ def create_app(
         if parse_error is not None:
             return JSONResponse({"error": parse_error}, status_code=400)
 
+        call_context = _call_context_from_request(request)
         try:
             state = await recovery_service.get_state(
                 context_id=context_id,
                 task_id=task_id,
                 after_sequence=after_sequence,
-                call_context=_call_context_from_request(request),
+                call_context=call_context,
             )
         except ValueError as exc:
-            return JSONResponse({"error": str(exc)}, status_code=404)
-        return JSONResponse(state)
+            roots = await recovery_path_roots(
+                context_id=context_id,
+                task_id=task_id,
+            )
+            return JSONResponse(
+                {"error": project_a2a_text(str(exc), public_path_roots=roots)},
+                status_code=404,
+            )
+        roots = await recovery_path_roots(
+            context_id=context_id,
+            task_id=task_id,
+        )
+        return JSONResponse(project_a2a_data(state, public_path_roots=roots))
 
     routes: list[BaseRoute] = [
         Route("/health", health, methods=["GET"]),
@@ -290,6 +455,7 @@ def create_app(
     routes.append(Route("/", handle_jsonrpc, methods=["POST"]))
     routes.extend(create_rest_routes(components.handler, enable_v0_3_compat=True))
     app = Starlette(routes=routes, lifespan=lifespan)
+    app.add_middleware(A2AProjectionMiddleware, task_store=components.task_store)
     app.add_middleware(
         A2AAuthMiddleware,
         token=token,

{iac_code-0.10.0 → iac_code-0.11.1}/src/iac_code/a2a/artifacts.py

@@ -20,7 +20,7 @@ from iac_code.services.session_layout import (
     ensure_session_owned_dir,
     require_supported_session_layout,
 )
-from iac_code.utils.public_errors import sanitize_public_text
+from iac_code.utils.public_errors import all_redaction_suppressed, sanitize_public_text
 from iac_code.utils.public_paths import relativize_public_file_uri
 from iac_code.utils.state_io import atomic_write_bytes
 from iac_code.utils.tool_result_redaction import (
@@ -124,6 +124,10 @@ def sanitize_public_artifact_data(
     *,
     public_path_roots: Iterable[Mapping[str, str]] | None = None,
 ) -> Any:
+    if all_redaction_suppressed():
+        # 环回 web 上下文：结构化数据整体原样（含敏感键 → 不再打 [REDACTED]、不再删文件内容），
+        # 使 journal 与快照保留完整模板/结论，重载可正常出图。
+        return value
     if isinstance(value, list):
         return [sanitize_public_artifact_data(item, public_path_roots=public_path_roots) for item in value]
     if isinstance(value, tuple):
@@ -166,6 +170,10 @@ def sanitize_public_tool_output_data(
     *,
     public_path_roots: Iterable[Mapping[str, str]] | None = None,
 ) -> Any:
+    if all_redaction_suppressed():
+        # 环回 web 上下文：工具输出整体原样（敏感键也不打 [REDACTED]、不再删文件内容），
+        # 与 sanitize_public_artifact_data 一致，使 journal/快照保留完整结果供重载。
+        return value
     if isinstance(value, str):
         value = redact_file_content_from_json_string(value)
         return sanitize_public_artifact_text(value, fallback_summary="", public_path_roots=public_path_roots)
@@ -229,6 +237,8 @@ def _sanitize_artifact_string(
             except UnsafeArtifactNameError:
                 pass
     if value.lower().startswith("file://"):
+        if all_redaction_suppressed():
+            return value
         return relativize_public_file_uri(value, public_path_roots) or "[PATH]"
     return _sanitize_artifact_scalar_string(value, public_path_roots=public_path_roots)
 
@@ -239,10 +249,14 @@ def _sanitize_artifact_scalar_string(
     public_path_roots: Iterable[Mapping[str, str]] | None = None,
 ) -> str:
     if value.lower().startswith("file://"):
+        if all_redaction_suppressed():
+            return value
         return relativize_public_file_uri(value, public_path_roots) or "[PATH]"
     decoded = unquote(value)
     if decoded != value:
         if decoded.lower().startswith("file://"):
+            if all_redaction_suppressed():
+                return value
             return relativize_public_file_uri(decoded, public_path_roots) or "[PATH]"
         decoded_sanitized = sanitize_public_artifact_text(
             decoded,
@@ -287,6 +301,9 @@ def _replace_file_uri_tokens(
     *,
     public_path_roots: Iterable[Mapping[str, str]] | None = None,
 ) -> str:
+    if all_redaction_suppressed():
+        return value
+
     def replace_file_uri(match: re.Match[str]) -> str:
         uri = match.group(0)
         trailing = ""
@@ -330,7 +347,7 @@ def _replace_public_artifact_uri_tokens(
             trailing = uri[-1] + trailing
             uri = uri[:-1]
         if not is_valid_public_artifact_uri(uri):
-            return "[PATH]"
+            return match.group(0) if all_redaction_suppressed() else "[PATH]"
         placeholder = f"{prefix}{len(placeholders)}__"
         placeholders[placeholder] = uri
         return f"{placeholder}{trailing}"

{iac_code-0.10.0 → iac_code-0.11.1}/src/iac_code/a2a/events.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import copy
 import inspect
 import logging
 from collections.abc import Awaitable, Callable
@@ -18,15 +19,10 @@ from a2a.types import (
 )
 from google.protobuf.json_format import ParseDict
 
-from iac_code.a2a.artifacts import (
-    sanitize_public_artifact_text,
-    sanitize_public_tool_output_data,
-)
+from iac_code.a2a.artifacts import sanitize_public_artifact_text
 from iac_code.a2a.exposure import A2AExposureType, normalize_a2a_exposure_types
-from iac_code.a2a.metadata_redaction import A2AMetadataEchoRedactor
 from iac_code.i18n import _
 from iac_code.mcp.progress import mcp_progress_metadata, mcp_progress_public_name
-from iac_code.mcp.redaction import sanitize_mcp_public_data
 from iac_code.services.permissions.audit import (
     build_input_summary,
     build_redacted_tool_input,
@@ -51,10 +47,11 @@ from iac_code.types.stream_events import (
 _METADATA_MAX_CHARS = 4000
 _ERROR_TEXT_MAX_CHARS = 1000
 _METADATA_MAX_DEPTH = 32
+_ARTIFACT_CONTAINER_KEYS = {"artifact", "artifacts"}
+_ARTIFACT_PAYLOAD_KEYS = {"content", "bytes", "base64", "raw", "path"}
 logger = logging.getLogger(__name__)
 A2APermissionResolver: TypeAlias = Callable[[PermissionRequestEvent], "bool | Awaitable[bool]"]
 IAC_CODE_SESSION_ID_METADATA_KEY = "iacCodeSessionId"
-_METADATA_REDACTOR = A2AMetadataEchoRedactor()
 
 
 def iac_code_session_metadata(session_id: str) -> dict[str, Any]:
@@ -75,7 +72,7 @@ def _truncate(value: Any, *, _depth: int = 0) -> Any:
     if _depth >= _METADATA_MAX_DEPTH:
         return "[truncated-depth]"
     if isinstance(value, str):
-        return sanitize_public_artifact_text(value)[:_METADATA_MAX_CHARS]
+        return value[:_METADATA_MAX_CHARS]
     if isinstance(value, dict):
         return {str(k): _truncate(v, _depth=_depth + 1) for k, v in value.items()}
     if isinstance(value, list):
@@ -83,10 +80,6 @@ def _truncate(value: Any, *, _depth: int = 0) -> Any:
     return value
 
 
-def _sanitize_trace_input(value: Any) -> Any:
-    return _METADATA_REDACTOR.redact(_truncate(value))
-
-
 def _public_tool_input_metadata(tool_name: str, tool_input: dict[str, Any]) -> dict[str, Any]:
     return {"inputSummary": build_input_summary(tool_name, tool_input)}
 
@@ -183,10 +176,40 @@ def _tool_result_metadata(
     is_error: bool = False,
     public_path_roots: list[dict[str, str]] | None = None,
 ) -> Any:
-    sanitized = sanitize_public_tool_output_data(result, public_path_roots=public_path_roots)
-    if is_error and isinstance(sanitized, str):
-        return sanitize_public_artifact_text(sanitized, public_path_roots=public_path_roots)
-    return _truncate(sanitized)
+    del is_error, public_path_roots
+    return _tool_result_metadata_value(copy.deepcopy(result))
+
+
+def _tool_result_metadata_value(value: Any, *, _depth: int = 0, _artifact_scope: bool = False) -> Any:
+    """Build protobuf-safe trace metadata without applying redaction.
+
+    Artifact payload bodies remain outside the trace metadata, matching the
+    existing artifact externalization contract. All other already-exposed
+    values are preserved, subject only to the existing depth/string bounds.
+    """
+
+    if _depth >= _METADATA_MAX_DEPTH:
+        return "[truncated-depth]"
+    if isinstance(value, str):
+        return value[:_METADATA_MAX_CHARS]
+    if isinstance(value, dict):
+        output: dict[str, Any] = {}
+        for key, item in value.items():
+            key_text = str(key)
+            key_lower = key_text.lower()
+            if _artifact_scope and key_lower in _ARTIFACT_PAYLOAD_KEYS:
+                continue
+            output[key_text] = _tool_result_metadata_value(
+                item,
+                _depth=_depth + 1,
+                _artifact_scope=_artifact_scope or key_lower in _ARTIFACT_CONTAINER_KEYS,
+            )
+        return output
+    if isinstance(value, list | tuple):
+        return [_tool_result_metadata_value(item, _depth=_depth + 1, _artifact_scope=_artifact_scope) for item in value]
+    if value is None or isinstance(value, bool | int | float):
+        return value
+    return str(value)[:_METADATA_MAX_CHARS]
 
 
 def _artifact_update_event(*, task_id: str, context_id: str, metadata: dict[str, Any]) -> TaskArtifactUpdateEvent:
@@ -355,13 +378,7 @@ async def publish_stream_event(
                     _artifact_update_event(task_id=task_id, context_id=context_id, metadata=artifact_metadata)
                 )
             return None
-        result_metadata = _tool_result_metadata(
-            event.result,
-            is_error=event.is_error,
-            public_path_roots=event.public_path_roots,
-        )
-        if event.tool_name.startswith("mcp__"):
-            result_metadata = sanitize_mcp_public_data(result_metadata, fallback_summary="")
+        result_metadata = _tool_result_metadata(event.result, is_error=event.is_error)
         tool_metadata = {
             "status": "failed" if event.is_error else "completed",
             "toolUseId": event.tool_use_id,
@@ -476,6 +493,8 @@ async def publish_stream_event(
             state = TaskState.TASK_STATE_INPUT_REQUIRED
         else:
             raw = event.error or "Unknown error"
+            # Provider ErrorEvent is an explicitly retained compatibility
+            # exception; ordinary A2A payloads are projected at the wire edge.
             text = sanitize_public_artifact_text(raw)[:_ERROR_TEXT_MAX_CHARS]
             state = TaskState.TASK_STATE_FAILED
         await _enqueue_status(

{iac_code-0.10.0 → iac_code-0.11.1}/src/iac_code/a2a/executor.py

@@ -45,6 +45,7 @@ from iac_code.a2a.pipeline_snapshot import (
     snapshot_needs_backup_commit_repair,
 )
 from iac_code.a2a.pipeline_stream import BACKUP_COMMITTED_EVENT_TYPE, PipelineA2AEventPublisher
+from iac_code.a2a.projection import a2a_safe_mode_enabled
 from iac_code.a2a.runtime_overrides import (
     a2a_request_context,
     configure_runtime_model,
@@ -101,7 +102,7 @@ from iac_code.services.session_backup_state import (
 from iac_code.services.session_storage import SessionStorage
 from iac_code.types.stream_events import TextDeltaEvent
 from iac_code.utils.file_security import atomic_write_text, ensure_private_dir, ensure_private_file
-from iac_code.utils.public_errors import public_exception_summary, sanitize_public_text
+from iac_code.utils.public_errors import sanitize_strict_text
 from iac_code.utils.public_paths import build_public_path_roots
 
 logger = logging.getLogger(__name__)
@@ -109,16 +110,16 @@ _CONTEXT_LOCK_ACQUIRE_TIMEOUT_SECONDS = 1
 _CANCEL_ACTIVE_TASK_DRAIN_TIMEOUT_SECONDS = 30
 _ERROR_TEXT_MAX_CHARS = 1000
 _DEFERRED_CLEANUP_PROMPTS_FILENAME = "cleanup-deferred-prompts.json"
-_A2A_SAFE_MODE_ENV = "IAC_CODE_A2A_SAFE_MODE"
-_TRUTHY_ENV_VALUES = {"1", "true", "yes", "on"}
 
 
 def _format_exception(exc: BaseException) -> str:
-    return public_exception_summary(exc, max_chars=_ERROR_TEXT_MAX_CHARS)
+    message = str(exc)
+    raw = type(exc).__name__ if not message else f"{type(exc).__name__}: {message}"
+    return raw[:_ERROR_TEXT_MAX_CHARS]
 
 
 def _a2a_safe_mode_enabled() -> bool:
-    return os.environ.get(_A2A_SAFE_MODE_ENV, "").strip().lower() in _TRUTHY_ENV_VALUES
+    return a2a_safe_mode_enabled()
 
 
 A2APermissionResolver: TypeAlias = Callable[[Any], "bool | Awaitable[bool]"]
@@ -741,7 +742,7 @@ def _cleanup_resource_event_data(resource: Any, *, resource_count: int) -> dict[
 def _public_cleanup_error(value: Any) -> str | None:
     if not value:
         return None
-    text = sanitize_public_text(str(value))
+    text = str(value)
     return text[:_ERROR_TEXT_MAX_CHARS] + "..." if len(text) > _ERROR_TEXT_MAX_CHARS else text
 
 
@@ -1020,13 +1021,13 @@ class IacCodeA2AExecutor(AgentExecutor):
                 try:
                     pipeline_input = self._pipeline_input_from_context(context, cwd=cwd)
                 except ValueError as exc:
-                    raise InvalidParamsError(sanitize_public_text(str(exc))) from exc
+                    raise InvalidParamsError(str(exc)) from exc
                 self._validate_pipeline_request_input(pipeline_input, model=model)
             else:
                 try:
                     normal_input = self._normal_input_from_context(context, cwd=cwd)
                 except ValueError as exc:
-                    raise InvalidParamsError(sanitize_public_text(str(exc))) from exc
+                    raise InvalidParamsError(str(exc)) from exc
                 if normal_input.has_images:
                     self._validate_pipeline_request_input(normal_input, model=model)
             if pipeline_mode and requested_task_id is None:
@@ -1068,7 +1069,7 @@ class IacCodeA2AExecutor(AgentExecutor):
                 task_id=task_id,
                 context_id=context_id,
                 state=TaskState.TASK_STATE_FAILED,
-                text=sanitize_public_text(str(exc)),
+                text=str(exc),
             )
             if task is not None:
                 task.state = TASK_STATE_FAILED
@@ -1672,7 +1673,7 @@ class IacCodeA2AExecutor(AgentExecutor):
             cwd = self._resolve_cwd(metadata)
             pipeline_input = parts_to_user_input(message.parts, cwd=cwd)
         except ValueError as exc:
-            raise InvalidParamsError(sanitize_public_text(str(exc))) from exc
+            raise InvalidParamsError(str(exc)) from exc
         model = self._resolve_model(metadata) or self._model
         self._validate_pipeline_request_input(pipeline_input, model=model)
 
@@ -1736,7 +1737,7 @@ class IacCodeA2AExecutor(AgentExecutor):
                 "A2A terminal session backup blocked task publication reason=%s retry_count=%s error=%s",
                 reason.value,
                 getattr(exc, "retry_count", 0),
-                public_exception_summary(exc, max_chars=_ERROR_TEXT_MAX_CHARS),
+                sanitize_strict_text(str(exc))[:_ERROR_TEXT_MAX_CHARS],
             )
             record_backup_blocked = getattr(self._metrics, "record_backup_blocked", None)
             if callable(record_backup_blocked):
@@ -1761,7 +1762,7 @@ class IacCodeA2AExecutor(AgentExecutor):
                         "backupBlocked": {
                             "reason": reason.value,
                             "blockedTerminalState": blocked_terminal_state,
-                            "error": public_exception_summary(exc, max_chars=_ERROR_TEXT_MAX_CHARS),
+                            "error": _format_exception(exc),
                             "recoverable": True,
                         }
                     }
@@ -1993,7 +1994,7 @@ class IacCodeA2AExecutor(AgentExecutor):
             return None
 
     def _log_executor_exception(self, stage: str, *, task_id: str, context_id: str) -> None:
-        logger.exception("A2A executor %s failed (task_id=%s, context_id=%s)", stage, task_id, context_id)
+        logger.error("A2A executor %s failed (task_id=%s, context_id=%s)", stage, task_id, context_id)
 
     async def _publish_mcp_status(
         self,
@@ -2121,8 +2122,8 @@ class IacCodeA2AExecutor(AgentExecutor):
             return
         try:
             await self._push_notifier.notify_task_state(task_id=task_id, context_id=context_id, state=state)
-        except Exception:
-            logger.warning("A2A push notification failed", exc_info=True)
+        except Exception as exc:
+            logger.warning("A2A push notification failed: %s", sanitize_strict_text(str(exc)))
 
 
 def _normal_handoff_has_backup_ack(handoff: dict[str, Any], journal_events: list[dict[str, Any]]) -> bool:

{iac_code-0.10.0 → iac_code-0.11.1}/src/iac_code/a2a/jsonrpc_passthrough.py

@@ -10,6 +10,8 @@ from jsonrpc.jsonrpc2 import JSONRPC20Response
 from sse_starlette.sse import EventSourceResponse
 from starlette.responses import Response
 
+from iac_code.utils.public_errors import sanitize_strict_text
+
 logger = logging.getLogger(__name__)
 
 
@@ -72,7 +74,10 @@ def install_v03_jsonrpc_error_data_passthrough(jsonrpc_endpoint: Callable[..., A
                 async for item in stream:
                     yield {"data": item.model_dump_json(by_alias=True, exclude_none=True)}
             except Exception as exc:
-                logger.exception("Error during stream generation in v0.3 JSONRPCAdapter")
+                logger.error(
+                    "Error during stream generation in v0.3 JSONRPCAdapter: %s",
+                    sanitize_strict_text(str(exc)),
+                )
                 if getattr(exc, "jsonrpc_error_data_passthrough", False):
                     error = types_v03.InvalidParamsError(message=str(exc), data=getattr(exc, "data", None))
                 else: