opencode-a2a 0.5.0__tar.gz → 0.6.0__tar.gz

{opencode_a2a-0.5.0 → opencode_a2a-0.6.0}/.github/workflows/ci.yml

@@ -8,8 +8,6 @@ on:
 
 permissions:
   contents: read
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 jobs:
   quality-gate:
@@ -17,15 +15,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: false
 
@@ -41,8 +39,13 @@ jobs:
       - name: Enforce coverage policy
         run: uv run python ./scripts/check_coverage.py
 
-      - name: Run dependency vulnerability audit
-        run: uv run pip-audit
+      - name: Export runtime requirements for vulnerability audit
+        run: >
+          uv export --format requirements.txt --no-dev --locked --no-emit-project
+          --output-file /tmp/runtime-requirements.txt >/dev/null
+
+      - name: Run runtime dependency vulnerability audit
+        run: uv run pip-audit --requirement /tmp/runtime-requirements.txt
 
       - name: Clean previous build artifacts
         run: rm -rf build dist
@@ -65,15 +68,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: false
 

{opencode_a2a-0.5.0 → opencode_a2a-0.6.0}/.github/workflows/dependency-health.yml

@@ -8,8 +8,6 @@ on:
 
 permissions:
   contents: read
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 jobs:
   dependency-health:
@@ -17,15 +15,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: false
 

{opencode_a2a-0.5.0 → opencode_a2a-0.6.0}/.github/workflows/publish.yml

@@ -9,8 +9,6 @@ on:
 permissions:
   contents: write
   id-token: write
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 jobs:
   publish:
@@ -18,25 +16,30 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: false
 
       - name: Run regression baseline
         run: bash ./scripts/doctor.sh
 
-      - name: Run dependency vulnerability audit
-        run: uv run pip-audit
+      - name: Export runtime requirements for vulnerability audit
+        run: >
+          uv export --format requirements.txt --no-dev --locked --no-emit-project
+          --output-file /tmp/runtime-requirements.txt >/dev/null
+
+      - name: Run runtime dependency vulnerability audit
+        run: uv run pip-audit --requirement /tmp/runtime-requirements.txt
 
       - name: Clean previous build artifacts
         run: rm -rf build dist

{opencode_a2a-0.5.0 → opencode_a2a-0.6.0}/.gitignore

@@ -224,3 +224,4 @@ temp_*.*
 # Local OpenCode OpenAPI snapshots (high-churn, local reference only)
 docs/operations/opencode/
 .swival/
+*.db

opencode_a2a-0.6.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,29 @@
+# Code of Conduct
+
+This project expects respectful, technically focused collaboration.
+
+## Expected Behavior
+
+- Assume good intent and communicate directly.
+- Keep discussions specific, evidence-based, and relevant to the repository.
+- Use welcoming language in public issues, pull requests, and review comments.
+- Respect maintainers' time by providing reproducible reports and clear context.
+
+## Unacceptable Behavior
+
+- Harassment, discrimination, or personal attacks.
+- Doxxing, threats, or sustained hostile behavior.
+- Repeated spam, bad-faith disruption, or intentionally misleading reports.
+- Sharing secrets, tokens, or private data in public threads.
+
+## Reporting
+
+For normal collaboration problems, open an issue or discussion with enough
+context to review the situation. For security-sensitive or private concerns,
+follow the disclosure path in [SECURITY.md](SECURITY.md).
+
+## Enforcement
+
+Repository maintainers may edit, hide, lock, or remove content that violates
+this policy, and may restrict participation when needed to keep collaboration
+safe and productive.

{opencode_a2a-0.5.0/src/opencode_a2a.egg-info → opencode_a2a-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: opencode-a2a
-Version: 0.5.0
+Version: 0.6.0
 Summary: OpenCode A2A runtime
 Author: liujuanjuan1984@Intelligent-Internet
 License-Expression: Apache-2.0
@@ -25,6 +25,7 @@ Requires-Dist: fastapi<1.0,>=0.110
 Requires-Dist: httpx<1.0,>=0.27
 Requires-Dist: pydantic<3.0,>=2.6
 Requires-Dist: pydantic-settings<3.0,>=2.2
+Requires-Dist: requests<3.0,>=2.33.0
 Requires-Dist: sqlalchemy<3.0,>=2.0
 Requires-Dist: sse-starlette<4.0,>=2.1
 Requires-Dist: uvicorn<1.0,>=0.29
@@ -113,6 +114,7 @@ Then start `opencode-a2a` against that upstream:
 ```bash
 A2A_BEARER_TOKEN=dev-token \
 OPENCODE_BASE_URL=http://127.0.0.1:4096 \
+A2A_TASK_STORE_DATABASE_URL=sqlite+aiosqlite:///./opencode-a2a.db \
 A2A_HOST=127.0.0.1 \
 A2A_PORT=8000 \
 A2A_PUBLIC_URL=http://127.0.0.1:8000 \
@@ -131,6 +133,8 @@ curl http://127.0.0.1:8000/.well-known/agent-card.json
 - A2A HTTP+JSON endpoints such as `/v1/message:send` and
   `/v1/message:stream`
 - A2A JSON-RPC support on `POST /`
+- SDK-owned A2A task surfaces such as `GET /v1/tasks`, task push notification
+  config routes, and JSON-RPC `agent/getAuthenticatedExtendedCard`
 - Peering capabilities: can act as a client via `opencode-a2a call`
 - Autonomous tool execution: supports `a2a_call` tool for outbound agent-to-agent communication
 - SSE streaming with normalized `text`, `reasoning`, and `tool_call` blocks
@@ -146,19 +150,30 @@ curl http://127.0.0.1:8000/.well-known/agent-card.json
 Interact with other A2A agents directly from the command line:
 
 ```bash
-opencode-a2a call http://other-agent:8000 "How are you?" --token your-outbound-token
+# Using the target peer agent's Bearer token via environment injection
+A2A_CLIENT_BEARER_TOKEN=your-outbound-token \
+opencode-a2a call http://other-agent:8000 "How are you?"
+
+# Using the target peer agent's Basic auth via environment injection
+# Accepts raw user:pass or its base64-encoded value
+A2A_CLIENT_BASIC_AUTH="user:pass" \
+opencode-a2a call http://other-agent:8000 "How are you?"
 ```
 
 ### Outbound Agent Calls (Tools)
 The server can autonomously execute `a2a_call(url, message)` tool calls emitted by the OpenCode runtime. Results are fetched via A2A and returned to the model as tool results, enabling multi-agent orchestration.
 
-When the target peer requires bearer auth, configure `A2A_CLIENT_BEARER_TOKEN`
-for server-side outbound calls. CLI calls can continue using `--token` or
-`A2A_CLIENT_BEARER_TOKEN`.
+When the target peer agent requires bearer auth, configure
+`A2A_CLIENT_BEARER_TOKEN` for server-side outbound calls. When the target peer
+agent requires Basic auth, use `A2A_CLIENT_BASIC_AUTH`.
+These outbound credentials apply to the peer specified by `opencode-a2a call`
+or `a2a_call(url, message)`, not to this service's inbound `A2A_BEARER_TOKEN`.
+The CLI intentionally reads outbound credentials from environment variables only,
+so secrets do not appear in shell history or process arguments.
 
 Server-side outbound client settings are fully wired through runtime config:
 `A2A_CLIENT_TIMEOUT_SECONDS`, `A2A_CLIENT_CARD_FETCH_TIMEOUT_SECONDS`,
-`A2A_CLIENT_USE_CLIENT_PREFERENCE`, `A2A_CLIENT_BEARER_TOKEN`, and
+`A2A_CLIENT_USE_CLIENT_PREFERENCE`, `A2A_CLIENT_BEARER_TOKEN`, `A2A_CLIENT_BASIC_AUTH`, and
 `A2A_CLIENT_SUPPORTED_TRANSPORTS`.
 
 Detailed protocol contracts, examples, and extension docs live in
@@ -201,6 +216,8 @@ Read before deployment:
 
 - [SECURITY.md](SECURITY.md)
 - [docs/guide.md](docs/guide.md)
+- [SUPPORT.md](SUPPORT.md)
+- [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)
 
 ## Further Reading
 

{opencode_a2a-0.5.0 → opencode_a2a-0.6.0}/README.md

@@ -73,6 +73,7 @@ Then start `opencode-a2a` against that upstream:
 ```bash
 A2A_BEARER_TOKEN=dev-token \
 OPENCODE_BASE_URL=http://127.0.0.1:4096 \
+A2A_TASK_STORE_DATABASE_URL=sqlite+aiosqlite:///./opencode-a2a.db \
 A2A_HOST=127.0.0.1 \
 A2A_PORT=8000 \
 A2A_PUBLIC_URL=http://127.0.0.1:8000 \
@@ -91,6 +92,8 @@ curl http://127.0.0.1:8000/.well-known/agent-card.json
 - A2A HTTP+JSON endpoints such as `/v1/message:send` and
   `/v1/message:stream`
 - A2A JSON-RPC support on `POST /`
+- SDK-owned A2A task surfaces such as `GET /v1/tasks`, task push notification
+  config routes, and JSON-RPC `agent/getAuthenticatedExtendedCard`
 - Peering capabilities: can act as a client via `opencode-a2a call`
 - Autonomous tool execution: supports `a2a_call` tool for outbound agent-to-agent communication
 - SSE streaming with normalized `text`, `reasoning`, and `tool_call` blocks
@@ -106,19 +109,30 @@ curl http://127.0.0.1:8000/.well-known/agent-card.json
 Interact with other A2A agents directly from the command line:
 
 ```bash
-opencode-a2a call http://other-agent:8000 "How are you?" --token your-outbound-token
+# Using the target peer agent's Bearer token via environment injection
+A2A_CLIENT_BEARER_TOKEN=your-outbound-token \
+opencode-a2a call http://other-agent:8000 "How are you?"
+
+# Using the target peer agent's Basic auth via environment injection
+# Accepts raw user:pass or its base64-encoded value
+A2A_CLIENT_BASIC_AUTH="user:pass" \
+opencode-a2a call http://other-agent:8000 "How are you?"
 ```
 
 ### Outbound Agent Calls (Tools)
 The server can autonomously execute `a2a_call(url, message)` tool calls emitted by the OpenCode runtime. Results are fetched via A2A and returned to the model as tool results, enabling multi-agent orchestration.
 
-When the target peer requires bearer auth, configure `A2A_CLIENT_BEARER_TOKEN`
-for server-side outbound calls. CLI calls can continue using `--token` or
-`A2A_CLIENT_BEARER_TOKEN`.
+When the target peer agent requires bearer auth, configure
+`A2A_CLIENT_BEARER_TOKEN` for server-side outbound calls. When the target peer
+agent requires Basic auth, use `A2A_CLIENT_BASIC_AUTH`.
+These outbound credentials apply to the peer specified by `opencode-a2a call`
+or `a2a_call(url, message)`, not to this service's inbound `A2A_BEARER_TOKEN`.
+The CLI intentionally reads outbound credentials from environment variables only,
+so secrets do not appear in shell history or process arguments.
 
 Server-side outbound client settings are fully wired through runtime config:
 `A2A_CLIENT_TIMEOUT_SECONDS`, `A2A_CLIENT_CARD_FETCH_TIMEOUT_SECONDS`,
-`A2A_CLIENT_USE_CLIENT_PREFERENCE`, `A2A_CLIENT_BEARER_TOKEN`, and
+`A2A_CLIENT_USE_CLIENT_PREFERENCE`, `A2A_CLIENT_BEARER_TOKEN`, `A2A_CLIENT_BASIC_AUTH`, and
 `A2A_CLIENT_SUPPORTED_TRANSPORTS`.
 
 Detailed protocol contracts, examples, and extension docs live in
@@ -161,6 +175,8 @@ Read before deployment:
 
 - [SECURITY.md](SECURITY.md)
 - [docs/guide.md](docs/guide.md)
+- [SUPPORT.md](SUPPORT.md)
+- [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)
 
 ## Further Reading
 

opencode_a2a-0.6.0/SUPPORT.md

@@ -0,0 +1,26 @@
+# Support
+
+## When To Open An Issue
+
+Open a GitHub issue when you can provide:
+
+- a clear problem statement
+- the command, request, or configuration involved
+- expected behavior versus actual behavior
+- relevant logs or payload snippets with secrets removed
+
+## Before You Ask
+
+- Read [README.md](README.md) for scope and deployment expectations.
+- Read [docs/guide.md](docs/guide.md) for protocol contracts and examples.
+- Read [SECURITY.md](SECURITY.md) before reporting auth, deployment, or secret-related concerns.
+
+## Security Concerns
+
+Do not post active secrets, bearer tokens, or sensitive workspace data in a
+public issue. Use the disclosure guidance in [SECURITY.md](SECURITY.md).
+
+## Commercial Or SLA Support
+
+This repository does not currently advertise a separate SLA or managed support
+channel. GitHub issues are the default public support path.

opencode_a2a-0.6.0/docs/extension-specifications.md

@@ -0,0 +1,122 @@
+# Extension Specifications
+
+This document is the stable specification surface referenced by the extension
+URIs published in the Agent Card.
+It is intentionally a compact URI/spec index, not the main consumer guide. For
+runtime behavior, request/response examples, and client integration guidance,
+see [`guide.md`](./guide.md).
+
+## SDK Compatibility Note
+
+The current A2A prose specification references an extended-card availability
+flag as `AgentCard.capabilities.extendedAgentCard` in some sections.
+
+The current official JSON schema and SDK types expose the supported field as
+top-level `supportsAuthenticatedExtendedCard`.
+
+`opencode-a2a` follows the shipped JSON schema and SDK surface, so Agent Card
+payloads emitted by this project use `supportsAuthenticatedExtendedCard`.
+
+## Shared Session Binding v1
+
+URI:
+`https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#shared-session-binding-v1`
+
+- Scope: shared A2A request metadata for rebinding to an existing upstream session
+- Public Agent Card: capability declaration plus minimal routing metadata
+- Authenticated extended card: full profile, notes, and detailed contract metadata
+- Runtime field: `metadata.shared.session.id`
+
+## Shared Model Selection v1
+
+URI:
+`https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#shared-model-selection-v1`
+
+- Scope: shared request-scoped model override on the main chat path
+- Public Agent Card: capability declaration plus required metadata fields
+- Authenticated extended card: full profile, notes, and detailed contract metadata
+- Runtime field: `metadata.shared.model`
+
+## Shared Stream Hints v1
+
+URI:
+`https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#shared-stream-hints-v1`
+
+- Scope: shared canonical metadata for block, usage, interrupt, and session hints
+- Public Agent Card: metadata roots plus the minimum discoverability fields for
+  block identity, progress status, interrupt lifecycle, session identity, and
+  basic token usage
+- Authenticated extended card: full shared stream contract including detailed
+  block payload mappings and extended usage metadata
+- Runtime fields: `metadata.shared.stream`, `metadata.shared.usage`,
+  `metadata.shared.interrupt`, `metadata.shared.session`
+
+## OpenCode Session Query v1
+
+URI:
+`https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#opencode-session-query-v1`
+
+- Scope: provider-private OpenCode session lifecycle, history, and low-risk control methods
+- Public Agent Card: capability declaration only
+- Authenticated extended card: full method matrix, pagination rules, errors, and context semantics
+- Transport: A2A JSON-RPC extension methods
+
+## OpenCode Provider Discovery v1
+
+URI:
+`https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#opencode-provider-discovery-v1`
+
+- Scope: provider-private provider and model discovery methods
+- Public Agent Card: capability declaration only
+- Authenticated extended card: full method contracts, error surface, and routing metadata
+- Transport: A2A JSON-RPC extension methods
+
+## Shared Interactive Interrupt v1
+
+URI:
+`https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#shared-interactive-interrupt-v1`
+
+- Scope: shared interrupt callback reply methods
+- Public Agent Card: capability declaration, supported interrupt events, and request ID field
+- Authenticated extended card: full callback contract, errors, and routing metadata
+- Transport: A2A JSON-RPC extension methods
+
+## OpenCode Interrupt Recovery v1
+
+URI:
+`https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#opencode-interrupt-recovery-v1`
+
+- Scope: provider-private recovery methods for pending local interrupt bindings
+- Public Agent Card: capability declaration only
+- Authenticated extended card: full method contracts, error surface, and local-registry notes
+- Transport: A2A JSON-RPC extension methods
+
+## OpenCode Workspace Control v1
+
+URI:
+`https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#opencode-workspace-control-v1`
+
+- Scope: provider-private project, workspace, and worktree control-plane methods
+- Public Agent Card: capability declaration only
+- Authenticated extended card: full method contracts, error surface, and routing notes
+- Transport: A2A JSON-RPC extension methods
+
+## A2A Compatibility Profile v1
+
+URI:
+`https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#a2a-compatibility-profile-v1`
+
+- Scope: compatibility profile describing core baselines, extension retention, and service behaviors
+- Public Agent Card: capability declaration only
+- Authenticated extended card: full compatibility profile payload
+- Transport: Agent Card extension params
+
+## A2A Wire Contract v1
+
+URI:
+`https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#a2a-wire-contract-v1`
+
+- Scope: wire-level contract for supported methods, endpoints, and error semantics
+- Public Agent Card: capability declaration only
+- Authenticated extended card: full wire contract payload
+- Transport: Agent Card extension params