opencode-a2a 0.4.1__tar.gz → 0.5.1__tar.gz

{opencode_a2a-0.4.1 → opencode_a2a-0.5.1}/.github/workflows/ci.yml

@@ -8,8 +8,6 @@ on:
 
 permissions:
   contents: read
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 jobs:
   quality-gate:
@@ -17,15 +15,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: false
 
@@ -41,8 +39,13 @@ jobs:
       - name: Enforce coverage policy
         run: uv run python ./scripts/check_coverage.py
 
-      - name: Run dependency vulnerability audit
-        run: uv run pip-audit
+      - name: Export runtime requirements for vulnerability audit
+        run: >
+          uv export --format requirements.txt --no-dev --locked --no-emit-project
+          --output-file /tmp/runtime-requirements.txt >/dev/null
+
+      - name: Run runtime dependency vulnerability audit
+        run: uv run pip-audit --requirement /tmp/runtime-requirements.txt
 
       - name: Clean previous build artifacts
         run: rm -rf build dist
@@ -65,15 +68,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: false
 

{opencode_a2a-0.4.1 → opencode_a2a-0.5.1}/.github/workflows/dependency-health.yml

@@ -8,8 +8,6 @@ on:
 
 permissions:
   contents: read
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 jobs:
   dependency-health:
@@ -17,15 +15,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: false
 

{opencode_a2a-0.4.1 → opencode_a2a-0.5.1}/.github/workflows/publish.yml

@@ -9,8 +9,6 @@ on:
 permissions:
   contents: write
   id-token: write
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 jobs:
   publish:
@@ -18,25 +16,30 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: false
 
       - name: Run regression baseline
         run: bash ./scripts/doctor.sh
 
-      - name: Run dependency vulnerability audit
-        run: uv run pip-audit
+      - name: Export runtime requirements for vulnerability audit
+        run: >
+          uv export --format requirements.txt --no-dev --locked --no-emit-project
+          --output-file /tmp/runtime-requirements.txt >/dev/null
+
+      - name: Run runtime dependency vulnerability audit
+        run: uv run pip-audit --requirement /tmp/runtime-requirements.txt
 
       - name: Clean previous build artifacts
         run: rm -rf build dist

{opencode_a2a-0.4.1/src/opencode_a2a.egg-info → opencode_a2a-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: opencode-a2a
-Version: 0.4.1
+Version: 0.5.1
 Summary: OpenCode A2A runtime
 Author: liujuanjuan1984@Intelligent-Internet
 License-Expression: Apache-2.0
@@ -20,10 +20,13 @@ Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: a2a-sdk==0.3.25
+Requires-Dist: aiosqlite<1.0,>=0.20
 Requires-Dist: fastapi<1.0,>=0.110
 Requires-Dist: httpx<1.0,>=0.27
 Requires-Dist: pydantic<3.0,>=2.6
 Requires-Dist: pydantic-settings<3.0,>=2.2
+Requires-Dist: requests<3.0,>=2.33.0
+Requires-Dist: sqlalchemy<3.0,>=2.0
 Requires-Dist: sse-starlette<4.0,>=2.1
 Requires-Dist: uvicorn<1.0,>=0.29
 Provides-Extra: dev
@@ -144,19 +147,30 @@ curl http://127.0.0.1:8000/.well-known/agent-card.json
 Interact with other A2A agents directly from the command line:
 
 ```bash
-opencode-a2a call http://other-agent:8000 "How are you?" --token your-outbound-token
+# Using the target peer agent's Bearer token via environment injection
+A2A_CLIENT_BEARER_TOKEN=your-outbound-token \
+opencode-a2a call http://other-agent:8000 "How are you?"
+
+# Using the target peer agent's Basic auth via environment injection
+# Accepts raw user:pass or its base64-encoded value
+A2A_CLIENT_BASIC_AUTH="user:pass" \
+opencode-a2a call http://other-agent:8000 "How are you?"
 ```
 
 ### Outbound Agent Calls (Tools)
 The server can autonomously execute `a2a_call(url, message)` tool calls emitted by the OpenCode runtime. Results are fetched via A2A and returned to the model as tool results, enabling multi-agent orchestration.
 
-When the target peer requires bearer auth, configure `A2A_CLIENT_BEARER_TOKEN`
-for server-side outbound calls. CLI calls can continue using `--token` or
-`A2A_CLIENT_BEARER_TOKEN`.
+When the target peer agent requires bearer auth, configure
+`A2A_CLIENT_BEARER_TOKEN` for server-side outbound calls. When the target peer
+agent requires Basic auth, use `A2A_CLIENT_BASIC_AUTH`.
+These outbound credentials apply to the peer specified by `opencode-a2a call`
+or `a2a_call(url, message)`, not to this service's inbound `A2A_BEARER_TOKEN`.
+The CLI intentionally reads outbound credentials from environment variables only,
+so secrets do not appear in shell history or process arguments.
 
 Server-side outbound client settings are fully wired through runtime config:
 `A2A_CLIENT_TIMEOUT_SECONDS`, `A2A_CLIENT_CARD_FETCH_TIMEOUT_SECONDS`,
-`A2A_CLIENT_USE_CLIENT_PREFERENCE`, `A2A_CLIENT_BEARER_TOKEN`, and
+`A2A_CLIENT_USE_CLIENT_PREFERENCE`, `A2A_CLIENT_BEARER_TOKEN`, `A2A_CLIENT_BASIC_AUTH`, and
 `A2A_CLIENT_SUPPORTED_TRANSPORTS`.
 
 Detailed protocol contracts, examples, and extension docs live in

{opencode_a2a-0.4.1 → opencode_a2a-0.5.1}/README.md

@@ -106,19 +106,30 @@ curl http://127.0.0.1:8000/.well-known/agent-card.json
 Interact with other A2A agents directly from the command line:
 
 ```bash
-opencode-a2a call http://other-agent:8000 "How are you?" --token your-outbound-token
+# Using the target peer agent's Bearer token via environment injection
+A2A_CLIENT_BEARER_TOKEN=your-outbound-token \
+opencode-a2a call http://other-agent:8000 "How are you?"
+
+# Using the target peer agent's Basic auth via environment injection
+# Accepts raw user:pass or its base64-encoded value
+A2A_CLIENT_BASIC_AUTH="user:pass" \
+opencode-a2a call http://other-agent:8000 "How are you?"
 ```
 
 ### Outbound Agent Calls (Tools)
 The server can autonomously execute `a2a_call(url, message)` tool calls emitted by the OpenCode runtime. Results are fetched via A2A and returned to the model as tool results, enabling multi-agent orchestration.
 
-When the target peer requires bearer auth, configure `A2A_CLIENT_BEARER_TOKEN`
-for server-side outbound calls. CLI calls can continue using `--token` or
-`A2A_CLIENT_BEARER_TOKEN`.
+When the target peer agent requires bearer auth, configure
+`A2A_CLIENT_BEARER_TOKEN` for server-side outbound calls. When the target peer
+agent requires Basic auth, use `A2A_CLIENT_BASIC_AUTH`.
+These outbound credentials apply to the peer specified by `opencode-a2a call`
+or `a2a_call(url, message)`, not to this service's inbound `A2A_BEARER_TOKEN`.
+The CLI intentionally reads outbound credentials from environment variables only,
+so secrets do not appear in shell history or process arguments.
 
 Server-side outbound client settings are fully wired through runtime config:
 `A2A_CLIENT_TIMEOUT_SECONDS`, `A2A_CLIENT_CARD_FETCH_TIMEOUT_SECONDS`,
-`A2A_CLIENT_USE_CLIENT_PREFERENCE`, `A2A_CLIENT_BEARER_TOKEN`, and
+`A2A_CLIENT_USE_CLIENT_PREFERENCE`, `A2A_CLIENT_BEARER_TOKEN`, `A2A_CLIENT_BASIC_AUTH`, and
 `A2A_CLIENT_SUPPORTED_TRANSPORTS`.
 
 Detailed protocol contracts, examples, and extension docs live in

{opencode_a2a-0.4.1 → opencode_a2a-0.5.1}/docs/guide.md

@@ -55,10 +55,10 @@ Key variables to understand protocol behavior:
   also logged with preview truncation controlled by `A2A_LOG_BODY_LIMIT`.
 - `A2A_MAX_REQUEST_BODY_BYTES`: runtime request-body limit. Oversized requests
   return HTTP `413`.
-- `A2A_SESSION_CACHE_TTL_SECONDS` / `A2A_SESSION_CACHE_MAXSIZE`: session cache
-  behavior for `(identity, contextId) -> session_id`.
+- `A2A_PENDING_SESSION_CLAIM_TTL_SECONDS`: lease duration for pending preferred
+  session claims before they expire and stop blocking other identities.
 - `A2A_INTERRUPT_REQUEST_TTL_SECONDS`: active retention window for the
-  in-memory interrupt request binding cache used by `a2a.interrupt.*`
+  interrupt request binding registry used by `a2a.interrupt.*`
   callback methods. Default: `10800` seconds (`180` minutes).
 - `A2A_INTERRUPT_REQUEST_TOMBSTONE_TTL_SECONDS`: retention window for expired
   interrupt tombstones after active TTL has elapsed. During this window,
@@ -76,6 +76,10 @@ Key variables to understand protocol behavior:
 - `A2A_CLIENT_BEARER_TOKEN`: optional bearer token attached to outbound peer
   calls made by the embedded A2A client and `a2a_call` tool path.
 - `A2A_CLIENT_SUPPORTED_TRANSPORTS`: ordered outbound transport preference list.
+- `A2A_TASK_STORE_BACKEND`: runtime state backend. Supported values: `database`,
+  `memory`. Default: `database`.
+- `A2A_TASK_STORE_DATABASE_URL`: database URL used by the default durable
+  backend. Default: `sqlite+aiosqlite:///./opencode-a2a.db`.
 - Runtime authentication is bearer-token only via `A2A_BEARER_TOKEN`.
 - The same outbound client flags are also honored by the server-side embedded
   A2A client used for peer calls and `a2a_call` tool execution:
@@ -157,6 +161,30 @@ OPENCODE_WORKSPACE_ROOT=/abs/path/to/workspace \
 opencode-a2a
 ```
 
+By default, the service uses a SQLite-backed durable state store:
+
+```bash
+OPENCODE_BASE_URL=http://127.0.0.1:4096 \
+A2A_BEARER_TOKEN=dev-token \
+A2A_TASK_STORE_DATABASE_URL=sqlite+aiosqlite:///./opencode-a2a.db \
+opencode-a2a
+```
+
+With the default `database` backend, the service persists:
+
+- task records
+- session binding / ownership state
+- interrupt request bindings and tombstones
+
+In-flight asyncio locks, outbound A2A client caches, and stream-local
+aggregation buffers remain process-local runtime state.
+
+To opt into an ephemeral development profile, set:
+
+```bash
+A2A_TASK_STORE_BACKEND=memory
+```
+
 ## Troubleshooting Provider Auth State
 
 If one deployment works while another fails against the same upstream provider,
@@ -825,8 +853,8 @@ Notes:
 
 - `request_id` must be a live interrupt request observed from stream metadata
   (`metadata.shared.interrupt.request_id`).
-- The server keeps an in-memory interrupt binding cache; callbacks with unknown
-  or expired `request_id` are rejected.
+- The server keeps an interrupt binding registry; callbacks with unknown or
+  expired `request_id` are rejected.
 - The cache retention windows are controlled by
   `A2A_INTERRUPT_REQUEST_TTL_SECONDS` (default: `10800` seconds / `180`
   minutes) and `A2A_INTERRUPT_REQUEST_TOMBSTONE_TTL_SECONDS` (default: `600`

{opencode_a2a-0.4.1 → opencode_a2a-0.5.1}/pyproject.toml

@@ -25,10 +25,13 @@ classifiers = [
 ]
 dependencies = [
     "a2a-sdk==0.3.25",
+    "aiosqlite>=0.20,<1.0",
     "fastapi>=0.110,<1.0",
     "httpx>=0.27,<1.0",
     "pydantic>=2.6,<3.0",
     "pydantic-settings>=2.2,<3.0",
+    "requests>=2.33.0,<3.0",
+    "sqlalchemy>=2.0,<3.0",
     "sse-starlette>=2.1,<4.0",
     "uvicorn>=0.29,<1.0",
 ]

{opencode_a2a-0.4.1 → opencode_a2a-0.5.1}/scripts/README.md

@@ -13,7 +13,7 @@ remaining repository-maintenance helpers.
 ## Other Scripts
 
 - [`doctor.sh`](./doctor.sh): primary local development regression entrypoint (uv sync + lint + tests + coverage)
-- [`dependency_health.sh`](./dependency_health.sh): dependency review entrypoint (`sync`/`pip check` + outdated + audit)
+- [`dependency_health.sh`](./dependency_health.sh): development dependency review entrypoint (`sync`/`pip check` + outdated + dev audit), while blocking CI/publish audits focus on runtime dependencies
 - [`check_coverage.py`](./check_coverage.py): enforces the overall coverage floor and per-file minimums for critical modules
 - [`lint.sh`](./lint.sh): lint helper
 - [`smoke_test_built_cli.sh`](./smoke_test_built_cli.sh): built-artifact smoke test for the released CLI runtime; defaults to the only local wheel, supports explicit wheel/sdist paths, and rejects ambiguous local artifact selection

opencode_a2a-0.5.1/scripts/dependency_health.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# shellcheck source=./health_common.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/health_common.sh"
+
+run_shared_repo_health_prerequisites "dependency-health"
+
+echo "[dependency-health] list outdated packages"
+uv pip list --outdated
+
+dev_requirements="$(mktemp)"
+trap 'rm -f "${dev_requirements}"' EXIT
+
+echo "[dependency-health] export dev extra requirements"
+uv export --format requirements.txt --extra dev --no-dev --locked --no-emit-project --output-file "${dev_requirements}" >/dev/null
+
+echo "[dependency-health] run dev dependency vulnerability audit"
+uv run pip-audit --requirement "${dev_requirements}"

{opencode_a2a-0.4.1 → opencode_a2a-0.5.1}/src/opencode_a2a/cli.py

@@ -6,23 +6,19 @@ import os
 import sys
 from collections.abc import Sequence
 
+from a2a.types import Message, TaskArtifactUpdateEvent, TaskStatusUpdateEvent
+
 from . import __version__
+from .client import A2AClient, load_settings
 from .server.application import main as serve_main
 
 
-async def run_call(agent_url: str, text: str, token: str | None = None) -> int:
-    from a2a.types import Message, TaskArtifactUpdateEvent, TaskStatusUpdateEvent
-
-    from .client import A2AClient
-
-    client = A2AClient(agent_url)
-    metadata = {}
-    if token:
-        # Use Authorization header for bearer auth.
-        metadata["authorization"] = f"Bearer {token}"
+async def run_call(agent_url: str, text: str) -> int:
+    settings = load_settings(os.environ)
+    client = A2AClient(agent_url, settings=settings)
 
     try:
-        async for event in client.send_message(text, metadata=metadata):
+        async for event in client.send_message(text):
             if isinstance(event, tuple):
                 _, update = event
                 if isinstance(update, TaskArtifactUpdateEvent):
@@ -73,11 +69,6 @@ def build_parser() -> argparse.ArgumentParser:
     )
     call_parser.add_argument("agent_url", help="URL of the agent to call.")
     call_parser.add_argument("text", help="Text message to send.")
-    call_parser.add_argument(
-        "--token",
-        help="Bearer token for authentication (can also use A2A_CLIENT_BEARER_TOKEN env).",
-        default=os.environ.get("A2A_CLIENT_BEARER_TOKEN"),
-    )
 
     return parser
 
@@ -92,7 +83,7 @@ def main(argv: Sequence[str] | None = None) -> int:
 
     namespace = parser.parse_args(args)
     if namespace.command == "call":
-        return asyncio.run(run_call(namespace.agent_url, namespace.text, namespace.token))
+        return asyncio.run(run_call(namespace.agent_url, namespace.text))
 
     if namespace.command is None:
         serve_main()

{opencode_a2a-0.4.1 → opencode_a2a-0.5.1}/src/opencode_a2a/client/agent_card.py

@@ -66,9 +66,10 @@ def build_resolver_http_kwargs(
     *,
     bearer_token: str | None,
     timeout: float,
+    basic_auth: str | None = None,
 ) -> dict[str, Any]:
     http_kwargs: dict[str, Any] = {"timeout": timeout}
-    default_headers = build_default_headers(bearer_token)
+    default_headers = build_default_headers(bearer_token, basic_auth)
     if default_headers:
         http_kwargs["headers"] = default_headers
     return http_kwargs

opencode_a2a-0.5.1/src/opencode_a2a/client/auth.py

@@ -0,0 +1,38 @@
+"""Authentication helpers for outbound A2A client configuration."""
+
+from __future__ import annotations
+
+from base64 import b64decode, b64encode
+from binascii import Error as BinasciiError
+
+BASIC_AUTH_FORMAT_ERROR = (
+    "A2A_CLIENT_BASIC_AUTH must be 'username:password' or a base64-encoded "
+    "'username:password' value"
+)
+
+
+def validate_basic_auth(value: str) -> None:
+    """Validate a raw or pre-encoded Basic Auth credential value."""
+    if ":" in value:
+        return
+    decoded = _decode_basic_auth(value)
+    if b":" not in decoded:
+        raise ValueError(BASIC_AUTH_FORMAT_ERROR)
+
+
+def encode_basic_auth(value: str) -> str:
+    """Normalize a raw or pre-encoded Basic Auth value to base64 credentials."""
+    if ":" in value:
+        return b64encode(value.encode()).decode()
+    decoded = _decode_basic_auth(value)
+    if b":" not in decoded:
+        raise ValueError(BASIC_AUTH_FORMAT_ERROR)
+    return b64encode(decoded).decode()
+
+
+def _decode_basic_auth(value: str) -> bytes:
+    padded_value = value + ("=" * (-len(value) % 4))
+    try:
+        return b64decode(padded_value, validate=True)
+    except (BinasciiError, ValueError) as exc:
+        raise ValueError(BASIC_AUTH_FORMAT_ERROR) from exc

{opencode_a2a-0.4.1 → opencode_a2a-0.5.1}/src/opencode_a2a/client/client.py

@@ -83,6 +83,7 @@ class A2AClient:
                 http_kwargs=build_resolver_http_kwargs(
                     bearer_token=self._settings.bearer_token,
                     timeout=self._settings.card_fetch_timeout,
+                    basic_auth=self._settings.basic_auth,
                 )
             )
         except (
@@ -121,7 +122,9 @@ class A2AClient:
             try:
                 async for event in client.send_message(
                     request,
-                    context=build_call_context(self._settings.bearer_token, extra_headers),
+                    context=build_call_context(
+                        self._settings.bearer_token, extra_headers, self._settings.basic_auth
+                    ),
                     request_metadata=request_metadata,
                     extensions=extensions,
                 ):
@@ -180,7 +183,9 @@ class A2AClient:
                         history_length=history_length,
                         metadata=request_metadata or {},
                     ),
-                    context=build_call_context(self._settings.bearer_token, extra_headers),
+                    context=build_call_context(
+                        self._settings.bearer_token, extra_headers, self._settings.basic_auth
+                    ),
                 )
             except (
                 A2AClientHTTPError,
@@ -206,7 +211,9 @@ class A2AClient:
             try:
                 return await client.cancel_task(
                     TaskIdParams(id=task_id, metadata=request_metadata or {}),
-                    context=build_call_context(self._settings.bearer_token, extra_headers),
+                    context=build_call_context(
+                        self._settings.bearer_token, extra_headers, self._settings.basic_auth
+                    ),
                 )
             except (
                 A2AClientHTTPError,
@@ -232,7 +239,9 @@ class A2AClient:
             try:
                 async for event in client.resubscribe(
                     TaskIdParams(id=task_id, metadata=request_metadata or {}),
-                    context=build_call_context(self._settings.bearer_token, extra_headers),
+                    context=build_call_context(
+                        self._settings.bearer_token, extra_headers, self._settings.basic_auth
+                    ),
                 ):
                     yield event
             except (
@@ -264,7 +273,9 @@ class A2AClient:
             factory = ClientFactory(config, consumers=None)
             client = factory.create(
                 card,
-                interceptors=build_client_interceptors(self._settings.bearer_token),
+                interceptors=build_client_interceptors(
+                    self._settings.bearer_token, self._settings.basic_auth
+                ),
             )
         except ValueError as exc:
             raise A2AUnsupportedBindingError(

{opencode_a2a-0.4.1 → opencode_a2a-0.5.1}/src/opencode_a2a/client/config.py

@@ -6,6 +6,8 @@ from collections.abc import Iterable, Mapping
 from dataclasses import dataclass
 from typing import Any
 
+from .auth import validate_basic_auth
+
 
 def _read_setting(
     source: Any,
@@ -106,6 +108,7 @@ class A2AClientSettings:
     use_client_preference: bool = False
     card_fetch_timeout: float = 5.0
     bearer_token: str | None = None
+    basic_auth: str | None = None
     supported_transports: tuple[str, ...] = (
         "JSONRPC",
         "HTTP+JSON",
@@ -153,6 +156,16 @@ def load_settings(raw_settings: Any) -> A2AClientSettings:
             default=None,
         ),
     )
+    basic_auth = _coerce_optional_str(
+        "A2A_CLIENT_BASIC_AUTH",
+        _read_setting(
+            raw_settings,
+            keys=("A2A_CLIENT_BASIC_AUTH", "a2a_client_basic_auth"),
+            default=None,
+        ),
+    )
+    if basic_auth is not None:
+        validate_basic_auth(basic_auth)
     supported_transports = _parse_transports(
         _read_setting(
             raw_settings,
@@ -170,6 +183,7 @@ def load_settings(raw_settings: Any) -> A2AClientSettings:
         use_client_preference=use_client_preference,
         card_fetch_timeout=card_fetch_timeout,
         bearer_token=bearer_token,
+        basic_auth=basic_auth,
         supported_transports=supported_transports,
     )
 

{opencode_a2a-0.4.1 → opencode_a2a-0.5.1}/src/opencode_a2a/client/request_context.py

@@ -7,6 +7,8 @@ from typing import Any
 
 from a2a.client.middleware import ClientCallContext, ClientCallInterceptor
 
+from .auth import encode_basic_auth
+
 
 class HeaderInterceptor(ClientCallInterceptor):
     def __init__(self, default_headers: Mapping[str, str] | None = None) -> None:
@@ -36,10 +38,15 @@ class HeaderInterceptor(ClientCallInterceptor):
         return request_payload, http_kwargs
 
 
-def build_default_headers(bearer_token: str | None) -> dict[str, str]:
-    if not bearer_token:
-        return {}
-    return {"Authorization": f"Bearer {bearer_token}"}
+def build_default_headers(
+    bearer_token: str | None,
+    basic_auth: str | None = None,
+) -> dict[str, str]:
+    if bearer_token:
+        return {"Authorization": f"Bearer {bearer_token}"}
+    if basic_auth:
+        return {"Authorization": f"Basic {encode_basic_auth(basic_auth)}"}
+    return {}
 
 
 def split_request_metadata(
@@ -59,8 +66,9 @@ def split_request_metadata(
 def build_call_context(
     bearer_token: str | None,
     extra_headers: Mapping[str, str] | None,
+    basic_auth: str | None = None,
 ) -> ClientCallContext | None:
-    merged_headers = build_default_headers(bearer_token)
+    merged_headers = build_default_headers(bearer_token, basic_auth)
     if extra_headers:
         merged_headers.update(extra_headers)
     if not merged_headers:
@@ -73,8 +81,11 @@ def build_call_context(
     )
 
 
-def build_client_interceptors(bearer_token: str | None) -> list[ClientCallInterceptor]:
-    return [HeaderInterceptor(build_default_headers(bearer_token))]
+def build_client_interceptors(
+    bearer_token: str | None,
+    basic_auth: str | None = None,
+) -> list[ClientCallInterceptor]:
+    return [HeaderInterceptor(build_default_headers(bearer_token, basic_auth))]
 
 
 __all__ = [

{opencode_a2a-0.4.1 → opencode_a2a-0.5.1}/src/opencode_a2a/config.py

@@ -35,6 +35,7 @@ WriteAccessScope = Literal[
     "custom",
 ]
 OutsideWorkspaceAccess = Literal["unknown", "allowed", "disallowed", "custom"]
+TaskStoreBackend = Literal["memory", "database"]
 
 
 def _parse_declared_list(value: Any) -> tuple[str, ...]:
@@ -132,9 +133,11 @@ class Settings(BaseSettings):
     a2a_port: int = Field(default=8000, alias="A2A_PORT")
     a2a_bearer_token: str = Field(..., min_length=1, alias="A2A_BEARER_TOKEN")
 
-    # Session cache settings
-    a2a_session_cache_ttl_seconds: int = Field(default=3600, alias="A2A_SESSION_CACHE_TTL_SECONDS")
-    a2a_session_cache_maxsize: int = Field(default=10_000, alias="A2A_SESSION_CACHE_MAXSIZE")
+    a2a_pending_session_claim_ttl_seconds: float = Field(
+        default=30.0,
+        gt=0.0,
+        alias="A2A_PENDING_SESSION_CLAIM_TTL_SECONDS",
+    )
     a2a_interrupt_request_ttl_seconds: float = Field(
         default=10_800.0,
         ge=0.0,
@@ -176,7 +179,21 @@ class Settings(BaseSettings):
         alias="A2A_CLIENT_SUPPORTED_TRANSPORTS",
     )
 
+    # Task store settings
+    a2a_task_store_backend: TaskStoreBackend = Field(
+        default="database",
+        alias="A2A_TASK_STORE_BACKEND",
+    )
+    a2a_task_store_database_url: str | None = Field(
+        default="sqlite+aiosqlite:///./opencode-a2a.db",
+        alias="A2A_TASK_STORE_DATABASE_URL",
+    )
+
     @model_validator(mode="after")
     def _validate_sandbox_policy(self) -> Settings:
         SandboxPolicy.from_settings(self).validate_configuration()
+        if self.a2a_task_store_backend == "database" and not self.a2a_task_store_database_url:
+            raise ValueError(
+                "A2A_TASK_STORE_DATABASE_URL is required when A2A_TASK_STORE_BACKEND=database"
+            )
         return self

{opencode_a2a-0.4.1 → opencode_a2a-0.5.1}/src/opencode_a2a/contracts/extensions.py

@@ -450,8 +450,9 @@ def build_session_binding_extension_params(
                 "message to that upstream session."
             ),
             (
-                "Otherwise, the server will create a new upstream session and cache "
-                "the (identity, contextId)->session_id mapping in memory with TTL."
+                "Otherwise, the server will create a new upstream session and retain "
+                "the (identity, contextId)->session_id mapping according to the "
+                "configured task/state store backend and TTL policy."
             ),
         ],
     }