opencode-a2a 1.1.2__tar.gz → 1.2.0__tar.gz

{opencode_a2a-1.1.2 → opencode_a2a-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: opencode-a2a
-Version: 1.1.2
+Version: 1.2.0
 Summary: OpenCode A2A runtime
 Author: liujuanjuan1984@Intelligent-Internet
 License-Expression: Apache-2.0
@@ -8,7 +8,7 @@ Project-URL: Homepage, https://github.com/Intelligent-Internet/opencode-a2a
 Project-URL: Repository, https://github.com/Intelligent-Internet/opencode-a2a
 Project-URL: Issues, https://github.com/Intelligent-Internet/opencode-a2a/issues
 Keywords: a2a,opencode,fastapi,json-rpc,sse
-Classifier: Development Status :: 3 - Alpha
+Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
@@ -19,7 +19,7 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: a2a-sdk==1.0.2
+Requires-Dist: a2a-sdk==1.1.2
 Requires-Dist: aiosqlite<1.0,>=0.20
 Requires-Dist: fastapi<1.0,>=0.139
 Requires-Dist: httpx<1.0,>=0.27
@@ -133,9 +133,9 @@ curl http://127.0.0.1:8000/.well-known/agent-card.json
 
 ## Capabilities
 
-- A2A HTTP+JSON endpoints such as `/v1/message:send` and `/v1/message:stream`
+- A2A HTTP+JSON endpoints such as `/message:send` and `/message:stream`
 - A2A JSON-RPC support on `POST /`
-- SDK-owned A2A task surfaces such as `GET /v1/tasks`, task push notification config routes, JSON-RPC `GetExtendedAgentCard`, and HTTP `GET /extendedAgentCard`
+- SDK-owned A2A task surfaces such as `GET /tasks`, task push notification config routes, JSON-RPC `GetExtendedAgentCard`, and HTTP `GET /extendedAgentCard`
 - Peering capabilities: can act as a client via `opencode-a2a call`
 - Autonomous tool execution: supports `a2a_call` tool for outbound agent-to-agent communication
 - SSE streaming with normalized `text`, `reasoning`, and `tool_call` blocks
@@ -201,6 +201,8 @@ This repository improves the service boundary around OpenCode, but it does not t
 - Provider auth and default model configuration remain on the OpenCode side; deployment-time precedence details and HOME/XDG state impact are documented in [docs/guide.md](docs/guide.md#troubleshooting-provider-auth-state).
 - Use `A2A_CLIENT_BEARER_TOKEN` for server-side outbound peer calls initiated by `a2a_call`.
 - Deployment supervision is intentionally BYO. Use `systemd`, Docker, Kubernetes, or another supervisor if you need long-running operation.
+- The supported persistence profile runs one `opencode-a2a` application process against its own local SQLite database. Do not run multiple Uvicorn workers or replicas against the same database file.
+- PostgreSQL and other SQLAlchemy dialects are not part of the supported deployment matrix.
 - For mutually untrusted tenants, run separate instance pairs with isolated users, containers, workspaces, credentials, and ports.
 
 Read before deployment:

{opencode_a2a-1.1.2 → opencode_a2a-1.2.0}/README.md

@@ -91,9 +91,9 @@ curl http://127.0.0.1:8000/.well-known/agent-card.json
 
 ## Capabilities
 
-- A2A HTTP+JSON endpoints such as `/v1/message:send` and `/v1/message:stream`
+- A2A HTTP+JSON endpoints such as `/message:send` and `/message:stream`
 - A2A JSON-RPC support on `POST /`
-- SDK-owned A2A task surfaces such as `GET /v1/tasks`, task push notification config routes, JSON-RPC `GetExtendedAgentCard`, and HTTP `GET /extendedAgentCard`
+- SDK-owned A2A task surfaces such as `GET /tasks`, task push notification config routes, JSON-RPC `GetExtendedAgentCard`, and HTTP `GET /extendedAgentCard`
 - Peering capabilities: can act as a client via `opencode-a2a call`
 - Autonomous tool execution: supports `a2a_call` tool for outbound agent-to-agent communication
 - SSE streaming with normalized `text`, `reasoning`, and `tool_call` blocks
@@ -159,6 +159,8 @@ This repository improves the service boundary around OpenCode, but it does not t
 - Provider auth and default model configuration remain on the OpenCode side; deployment-time precedence details and HOME/XDG state impact are documented in [docs/guide.md](docs/guide.md#troubleshooting-provider-auth-state).
 - Use `A2A_CLIENT_BEARER_TOKEN` for server-side outbound peer calls initiated by `a2a_call`.
 - Deployment supervision is intentionally BYO. Use `systemd`, Docker, Kubernetes, or another supervisor if you need long-running operation.
+- The supported persistence profile runs one `opencode-a2a` application process against its own local SQLite database. Do not run multiple Uvicorn workers or replicas against the same database file.
+- PostgreSQL and other SQLAlchemy dialects are not part of the supported deployment matrix.
 - For mutually untrusted tenants, run separate instance pairs with isolated users, containers, workspaces, credentials, and ports.
 
 Read before deployment:

{opencode_a2a-1.1.2 → opencode_a2a-1.2.0}/docs/compatibility.md

@@ -7,6 +7,9 @@ This document defines the compatibility promises `opencode-a2a` currently uphold
 - Python versions: 3.11, 3.12, 3.13
 - A2A SDK line: `1.x.y`
 - Supported A2A protocol line: `1.0`
+- OpenCode runtime line: `1.18.x` (verified with `1.18.19`)
+
+This is the single canonical place where the supported upstream OpenCode version line is declared. Keep it updated together with the live integration smoke check (`./scripts/live_opencode_smoke.sh`) and do not duplicate the version line elsewhere.
 
 The repository currently pins one concrete SDK release in `pyproject.toml` within that v1 line. Upgrade the SDK deliberately rather than relying on floating dependency resolution. The SDK-owned core JSON-RPC method set follows that pinned release and is locked by repository tests so SDK upgrades trigger an explicit compatibility review.
 
@@ -41,7 +44,7 @@ External TCK runs and local conformance experiments are investigation inputs. Th
 
 ## Compatibility-Sensitive Surface
 
-This repository still ships as an alpha project. Within that alpha line, these declared surfaces should not drift silently:
+This repository ships as a beta project. Its documented public contracts are intended to remain stable, while implementation details and explicitly provider-private surfaces may continue to evolve. These declared surfaces should not drift silently:
 
 - core A2A send / stream / task methods
 - v1-only request/response payloads and enum values
@@ -88,7 +91,7 @@ Task-store behavior that should remain stable for clients:
 - accepted output-mode negotiation for a task is persisted with the task so later reads keep the same filtered output contract
 - adapter-managed migrations only own adapter state tables; SDK-managed task schema remains SDK-owned
 
-The default SQLite-first profile is intended for local or controlled single-instance deployments. Wider SQLAlchemy dialect compatibility should be treated as implementation latitude rather than a strong public promise unless explicitly documented later.
+The supported persistence profile is one application process using its own local SQLite database. Multiple Uvicorn workers or application replicas must not share that SQLite file. PostgreSQL and other SQLAlchemy dialects are not supported deployment targets; any apparent dialect compatibility is implementation latitude rather than a public promise.
 
 ## Extension Stability
 

{opencode_a2a-1.1.2 → opencode_a2a-1.2.0}/docs/guide.md

@@ -5,9 +5,11 @@ This guide covers configuration, authentication, API behavior, streaming re-subs
 ## Transport Contracts
 
 - The service supports both transports:
-  - HTTP+JSON (REST endpoints such as `/v1/message:send`)
+  - HTTP+JSON (REST endpoints such as `/message:send`)
   - JSON-RPC (`POST /`)
 - Agent Card exposes both HTTP+JSON and JSON-RPC through `supportedInterfaces`.
+- HTTP+JSON REST endpoints are served at the root path (e.g. `/message:send`, `/tasks`). A2A 1.0 negotiates protocol version via the `A2A-Version` header, not a URL prefix, so the URL path carries no version segment.
+- Breaking change for earlier releases: versions through v1.1.2 served the HTTP+JSON surface under a `/v1` prefix. Deployments upgrading from those releases must repoint clients, reverse proxies, and any `/v1`-prefixed routes to the root paths.
 - The public Agent Card is intentionally slimmed to the minimum discovery surface; per-extension disclosure policy is defined in [`extension-specifications.md`](./extension-specifications.md).
 - Detailed provider-private contracts are served through the authenticated extended card endpoint `/extendedAgentCard`.
 - Agent Card responses emit weak `ETag` and `Cache-Control`; clients should revalidate cached cards instead of repeatedly fetching full payloads.
@@ -47,9 +49,10 @@ Key variables to understand protocol behavior:
 - `A2A_INTERRUPT_REQUEST_TTL_SECONDS`: active retention window for the interrupt request binding registry used by `a2a.interrupt.*` callback methods. Default: `10800` seconds (`180` minutes).
 - `A2A_INTERRUPT_REQUEST_TOMBSTONE_TTL_SECONDS`: retention window for expired interrupt tombstones after active TTL has elapsed. During this window, repeated replies keep returning `INTERRUPT_REQUEST_EXPIRED` instead of falling through to `INTERRUPT_REQUEST_NOT_FOUND`. Default: `600` seconds (`10` minutes).
 - `A2A_CANCEL_ABORT_TIMEOUT_SECONDS`: best-effort timeout for upstream `session.abort` in cancel flow.
-- `OPENCODE_TIMEOUT` / `OPENCODE_TIMEOUT_STREAM`: upstream request timeout and optional stream timeout override.
-- `OPENCODE_MAX_CONCURRENT_REQUESTS`: optional fast-fail concurrency limit for unary/control upstream calls. `0` disables the limit.
-- `OPENCODE_MAX_CONCURRENT_STREAMS`: optional fast-fail concurrency limit for long-lived upstream `/event` streams. `0` disables the limit.
+- `OPENCODE_TIMEOUT` / `OPENCODE_TIMEOUT_STREAM`: upstream request timeout and stream timeout. Defaults: `120` and `900` seconds.
+- `OPENCODE_MAX_CONCURRENT_REQUESTS`: fast-fail concurrency limit for unary/control upstream calls. Default: `32`; `0` disables the limit explicitly.
+- `OPENCODE_MAX_CONCURRENT_STREAMS`: fast-fail concurrency limit for long-lived upstream `/event` streams. Default: `8`; `0` disables the limit explicitly.
+- `OPENCODE_AUTH_USERNAME` / `OPENCODE_AUTH_PASSWORD`: optional HTTP Basic credentials sent on every upstream OpenCode call. Set both when the upstream `opencode serve` is hardened with `OPENCODE_SERVER_PASSWORD`; the username defaults to `opencode` and must match `OPENCODE_SERVER_USERNAME` when that is overridden upstream. When unset, no `Authorization` header is sent.
 - `A2A_CLIENT_TIMEOUT_SECONDS`: outbound client timeout. Default: `30` seconds.
 - `A2A_CLIENT_CARD_FETCH_TIMEOUT_SECONDS`: outbound Agent Card fetch timeout. Default: `5` seconds.
 - `A2A_CLIENT_USE_CLIENT_PREFERENCE`: whether the outbound client prefers its own transport choices.
@@ -174,11 +177,13 @@ With the default `database` backend, the unified lightweight persistence layer p
 - pending preferred-session claims
 - interrupt request bindings and tombstones
 
-This project is SQLite-first for local single-instance deployments. The runtime configures local durability-oriented SQLite connection settings (`WAL`, `busy_timeout`, `synchronous=NORMAL`) and creates missing parent directories for file-backed database paths.
+The supported persistence profile is one `opencode-a2a` application process using its own local SQLite database. Run Uvicorn with one worker and do not share the SQLite file between processes, containers, or replicas. Horizontal application scaling and PostgreSQL deployments are outside the supported deployment matrix. SQLAlchemy remains an internal implementation detail rather than a promise of dialect portability.
+
+The runtime configures local durability-oriented SQLite connection settings (`WAL`, `busy_timeout`, `synchronous=NORMAL`) and creates missing parent directories for file-backed database paths.
 
 The runtime automatically applies lightweight schema migrations for its custom state tables and records the applied version in `a2a_schema_version`. Schema-version writes are idempotent across concurrent first-start races, pending preferred-session claims now persist absolute `expires_at` timestamps, legacy rows without `expires_at` are pruned during migration instead of being reconstructed from historical TTL assumptions, and the built-in path currently targets the local SQLite deployment profile without requiring Alembic.
 
-Database-backed task persistence also keeps the existing first-terminal-state-wins contract while tightening the SQLite path with an atomic terminal-write guard instead of relying only on process-local read-before-write checks. Any wider SQLAlchemy dialect compatibility should be treated as incidental implementation latitude rather than a documented deployment target.
+Database-backed task persistence also keeps the existing first-terminal-state-wins contract while tightening the SQLite path with an atomic terminal-write guard instead of relying only on process-local read-before-write checks.
 
 At startup, the runtime logs a concise persistence summary covering the active backend, the redacted database URL when applicable, the shared persistence scope, and whether the SQLite local durability profile is active.
 
@@ -223,7 +228,7 @@ If one deployment works while another fails against the same upstream provider,
 ## Streaming Contract
 
 - Streaming is always enabled in this server profile; `message:stream` is part of the stable runtime baseline.
-- Streaming (`/v1/message:stream`) emits an initial working `Task`, then incremental `TaskArtifactUpdateEvent` / `TaskStatusUpdateEvent` updates, and finally a terminal `TaskStatusUpdateEvent(final=true)`.
+- Streaming (`/message:stream`) emits an initial working `Task`, then incremental `TaskArtifactUpdateEvent` / `TaskStatusUpdateEvent` updates, and finally a terminal `TaskStatusUpdateEvent(final=true)`.
 - Stream artifacts carry `artifact.metadata.shared.stream.block_type` with values `text` / `reasoning` / `tool_call`.
 - Stream artifacts are scoped to logical output lanes rather than one shared catch-all artifact:
   - text chunks use a stable text artifact ID
@@ -285,7 +290,7 @@ Current behavior:
 - Shared metadata extension URIs such as session binding and streaming are listed under `extensions.extension_uris`.
 - `all_jsonrpc_methods` is the runtime truth for the current deployment.
 - The current SDK-owned core JSON-RPC surface includes `GetExtendedAgentCard` and `tasks/pushNotificationConfig/*`.
-- The current SDK-owned REST surface also includes `GET /v1/tasks` and the task push notification config routes.
+- The current SDK-owned REST surface also includes `GET /tasks` and the task push notification config routes.
 - The SDK-owned core JSON-RPC method set follows the pinned `a2a-sdk` release and is locked by repository tests; review that surface deliberately when upgrading the SDK.
 - Push notification config routes/methods are currently exposed only because they are part of the SDK-owned core surface. This runtime does not configure a push config store or push sender, so push notification operations remain unsupported. REST routes currently return HTTP `501`, while JSON-RPC methods surface SDK-owned unsupported error envelopes.
 
@@ -483,7 +488,7 @@ Consumer guidance:
 Minimal example:
 
 ```bash
-curl -sS http://127.0.0.1:8000/v1/message:send \
+curl -sS http://127.0.0.1:8000/message:send \
   -H 'content-type: application/json' \
   -H 'Authorization: Bearer <your-token>' \
   -d '{
@@ -535,7 +540,7 @@ Consumer guidance:
 Minimal example:
 
 ```bash
-curl -sS http://127.0.0.1:8000/v1/message:send \
+curl -sS http://127.0.0.1:8000/message:send \
   -H 'content-type: application/json' \
   -H 'Authorization: Bearer <your-token>' \
   -d '{
@@ -1222,7 +1227,7 @@ curl -sS http://127.0.0.1:8000/ \
 ## Authentication Example (curl)
 
 ```bash
-curl -sS http://127.0.0.1:8000/v1/message:send \
+curl -sS http://127.0.0.1:8000/message:send \
   -H 'content-type: application/json' \
   -H 'Authorization: Bearer <your-token>' \
   -d '{
@@ -1256,7 +1261,7 @@ curl -sS http://127.0.0.1:8000/ \
 
 ## Streaming Re-Subscription (`SubscribeToTask`)
 
-If an SSE connection drops, use `GET /v1/tasks/{task_id}:subscribe` to re-subscribe while the task is still non-terminal.
+If an SSE connection drops, use `GET /tasks/{task_id}:subscribe` to re-subscribe while the task is still non-terminal.
 
 ## Cancellation Semantics (`CancelTask`)
 
@@ -1264,7 +1269,7 @@ If an SSE connection drops, use `GET /v1/tasks/{task_id}:subscribe` to re-subscr
 - For running tasks, the service attempts upstream OpenCode `POST /session/{sessionID}/abort` to stop generation.
 - Upstream interruption is best-effort: if upstream returns 404, network errors, or other HTTP errors, A2A cancellation still completes with `TaskState.TASK_STATE_CANCELED`.
 - Idempotency contract: repeated `CancelTask` on an already `canceled` task returns the current terminal task state without error.
-- Terminal subscribe contract: calling `SubscribeToTask` or `GET /v1/tasks/{task_id}:subscribe` on a terminal task replays one terminal `Task` snapshot and then closes the stream.
+- Terminal subscribe contract: calling `SubscribeToTask` or `GET /tasks/{task_id}:subscribe` on a terminal task replays one terminal `Task` snapshot and then closes the stream.
 - Terminal persistence contract: once a terminal task snapshot is persisted, this service treats it as immutable. Producers must emit final text and artifact updates before the terminal event, and any final usage or stream metadata must be attached to that terminal event itself. Late terminal-state mutations are rejected by the task-store write policy.
 - These two semantics are also declared as machine-readable `service_behaviors` in the compatibility profile and wire contract extensions.
 - At `A2A_LOG_LEVEL=DEBUG`, the service emits lightweight metric log records (`logger=opencode_a2a.execution.executor`):

{opencode_a2a-1.1.2 → opencode_a2a-1.2.0}/docs/maintainer-architecture.md

@@ -21,12 +21,11 @@ flowchart TD
 
     subgraph Upstream["OpenCode Upstream Layer"]
         UpstreamClient["opencode_upstream_client.py"]
-        Invocation["invocation.py"]
     end
 
     subgraph Extensions["Extension / Contract Layer"]
         Jsonrpc["jsonrpc/"]
-        Contracts["contracts/extensions.py"]
+        Contracts["contracts/extensions/"]
         Profile["profile/runtime.py"]
     end
 
@@ -61,7 +60,7 @@ flowchart TD
 
 1. `jsonrpc/application.py` owns the adapter-specific JSON-RPC application boundary.
 2. `jsonrpc/dispatch.py` and handler modules under `jsonrpc/handlers/` route provider-private methods.
-3. `contracts/extensions.py` remains the SSOT for extension metadata exposed through Agent Card and OpenAPI.
+3. `contracts/extensions/` remains the SSOT for extension metadata exposed through Agent Card and OpenAPI.
 4. Tests under `tests/contracts/` and `tests/jsonrpc/` guard contract drift.
 
 ### Outbound Peer Call Path
@@ -89,7 +88,7 @@ flowchart TD
 
 ### Extension and Contract Layer
 
-- `contracts/extensions.py`: SSOT for extension metadata, compatibility profile, and wire-contract payloads
+- `contracts/extensions/`: SSOT for extension metadata, compatibility profile, and wire-contract payloads
 - `jsonrpc/`: provider-private JSON-RPC extension surface
 - `profile/runtime.py`: runtime profile that feeds Agent Card, OpenAPI, and compatibility metadata
 - `protocol_versions.py`: protocol normalization and negotiation helpers
@@ -128,5 +127,5 @@ For maintainers new to the codebase, this order usually gives the fastest payoff
 2. `docs/architecture.md`
 3. `src/opencode_a2a/server/application.py`
 4. `src/opencode_a2a/execution/executor.py`
-5. `src/opencode_a2a/contracts/extensions.py`
+5. `src/opencode_a2a/contracts/extensions/`
 6. `docs/guide.md`

{opencode_a2a-1.1.2 → opencode_a2a-1.2.0}/pyproject.toml

@@ -14,7 +14,7 @@ authors = [
 ]
 keywords = ["a2a", "opencode", "fastapi", "json-rpc", "sse"]
 classifiers = [
-    "Development Status :: 3 - Alpha",
+    "Development Status :: 4 - Beta",
     "Intended Audience :: Developers",
     "Programming Language :: Python :: 3",
     "Programming Language :: Python :: 3.11",
@@ -24,7 +24,7 @@ classifiers = [
     "Topic :: Internet :: WWW/HTTP",
 ]
 dependencies = [
-    "a2a-sdk==1.0.2",
+    "a2a-sdk==1.1.2",
     "aiosqlite>=0.20,<1.0",
     "fastapi>=0.139,<1.0",
     "httpx>=0.27,<1.0",
@@ -68,6 +68,13 @@ quote-style = "double"
 
 [tool.uv]
 package = true
+# Keep transitive dependency floors above versions with known vulnerabilities:
+# - click < 8.3.3: PYSEC-2026-2132 (pulled in via uvicorn)
+# - pyasn1 < 0.6.4: PYSEC-2026-3455/3456/3457 (pulled in via google-auth <- a2a-sdk)
+constraint-dependencies = [
+    "click>=8.3.3",
+    "pyasn1>=0.6.4",
+]
 
 [tool.setuptools_scm]
 fallback_version = "0+unknown"

{opencode_a2a-1.1.2 → opencode_a2a-1.2.0}/scripts/README.md

@@ -13,6 +13,7 @@ Executable scripts live in this directory. This file is the entry index for the
 
 - [`doctor.sh`](./doctor.sh): primary local development regression entrypoint with explicit fix/verify/package phases (uv sync + dependency compatibility + lint + mypy + tests + coverage + built-wheel smoke test)
 - [`conformance.sh`](./conformance.sh): local/manual external A2A conformance experiment entrypoint; caches the official TCK, can launch a dummy-backed local SUT, and preserves raw artifacts under `run/conformance/`
+- [`live_opencode_smoke.sh`](./live_opencode_smoke.sh): local/manual live integration smoke against a real OpenCode runtime; boots an isolated password-hardened `opencode serve` plus the opencode-a2a runtime in throwaway directories and verifies upstream auth, JSON-RPC extension reads, and a streaming prompt round-trip
 - [`dependency_health.sh`](./dependency_health.sh): development dependency review entrypoint (`sync`/`pip check` + outdated + dev audit), while blocking CI/publish audits focus on runtime dependencies
 - [`check_coverage.py`](./check_coverage.py): enforces the overall coverage floor and per-file minimums for critical modules
 - [`find_thin_wrappers.py`](./find_thin_wrappers.py): static analysis helper that reports local functions with low caller counts and flags likely thin forwarding wrappers for manual abstraction review

opencode_a2a-1.2.0/scripts/live_opencode_smoke.sh

@@ -0,0 +1,286 @@
+#!/usr/bin/env bash
+# Run a live opencode-a2a integration smoke against a real OpenCode runtime.
+# Everything runs inside a temporary, isolated environment: a throwaway HOME/XDG
+# for the upstream OpenCode process, a throwaway workspace directory, and
+# ephemeral ports. No repository data directory or user OpenCode state is read
+# or written, and all artifacts are removed on exit.
+set -euo pipefail
+
+# shellcheck source=./health_common.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/health_common.sh"
+
+usage() {
+  cat <<'EOF'
+Usage:
+  bash ./scripts/live_opencode_smoke.sh
+
+Purpose:
+  Boot a real `opencode serve` (hardened with a server password), start the
+  opencode-a2a runtime against it, and verify the adapter's upstream
+  adaptation end-to-end: authenticated upstream connectivity, JSON-RPC
+  extension read methods, a streaming prompt round-trip, and that upstream
+  auth is actually enforced.
+
+Isolation:
+  The script creates a fresh temporary root (mktemp -d) used for the OpenCode
+  process HOME/XDG directories, the OpenCode workspace, and the adapter's
+  working directory (SQLite state). Everything is removed on exit; no valid
+  data directory is touched.
+
+Requirements:
+  - opencode CLI on PATH (or OPENCODE_BIN), any 1.18.x build
+  - uv, git, curl, python3
+
+Selected environment variables:
+  OPENCODE_BIN                         Override the opencode binary path (default: opencode from PATH)
+  LIVE_SMOKE_UPSTREAM_PORT             Fixed upstream port (default: ephemeral)
+  LIVE_SMOKE_A2A_PORT                  Fixed adapter port (default: ephemeral)
+  LIVE_SMOKE_SKIP_PROMPT=1             Skip the streaming prompt round-trip (network/model dependent)
+  LIVE_SMOKE_SKIP_SYNC=1               Skip uv sync for this repository
+  LIVE_SMOKE_KEEP_ARTIFACTS=1          Keep the temporary root and print its path
+EOF
+}
+
+if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
+  usage
+  exit 0
+fi
+
+if [[ "$#" -gt 0 ]]; then
+  echo "Expected no positional arguments" >&2
+  exit 1
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+
+if ! command -v uv >/dev/null 2>&1; then
+  echo "uv not found in PATH" >&2
+  exit 1
+fi
+
+if ! command -v curl >/dev/null 2>&1; then
+  echo "curl not found in PATH" >&2
+  exit 1
+fi
+
+if ! command -v git >/dev/null 2>&1; then
+  echo "git not found in PATH" >&2
+  exit 1
+fi
+
+if ! command -v python3 >/dev/null 2>&1; then
+  echo "python3 not found in PATH" >&2
+  exit 1
+fi
+
+opencode_bin="${OPENCODE_BIN:-}"
+if [[ -z "${opencode_bin}" ]]; then
+  if command -v opencode >/dev/null 2>&1; then
+    opencode_bin="$(command -v opencode)"
+  else
+    echo "opencode CLI not found in PATH; install the 1.18.x line or set OPENCODE_BIN." >&2
+    exit 1
+  fi
+fi
+
+opencode_version="$("${opencode_bin}" --version 2>/dev/null | tr -d '[:space:]')"
+if [[ -z "${opencode_version}" ]]; then
+  echo "Failed to read opencode version from ${opencode_bin}" >&2
+  exit 1
+fi
+echo "[live-smoke] opencode binary: ${opencode_bin} (${opencode_version})"
+
+if [[ "${LIVE_SMOKE_SKIP_SYNC:-0}" != "1" ]]; then
+  run_shared_repo_health_prerequisites "live-smoke"
+fi
+
+free_port() {
+  python3 - <<'PY'
+import socket
+
+with socket.socket() as sock:
+    sock.bind(("127.0.0.1", 0))
+    print(sock.getsockname()[1])
+PY
+}
+
+upstream_port="${LIVE_SMOKE_UPSTREAM_PORT:-$(free_port)}"
+a2a_port="${LIVE_SMOKE_A2A_PORT:-$(free_port)}"
+upstream_url="http://127.0.0.1:${upstream_port}"
+a2a_url="http://127.0.0.1:${a2a_port}"
+upstream_username="opencode"
+# Non-secret throwaway credential for the isolated smoke instance only.
+upstream_password="live-smoke-password"  # pragma: allowlist secret
+a2a_bearer_token="live-smoke-token"  # pragma: allowlist secret
+
+run_dir="$(mktemp -d)"
+opencode_home="${run_dir}/opencode-home"
+workspace_dir="${run_dir}/workspace"
+adapter_dir="${run_dir}/adapter"
+upstream_log="${run_dir}/opencode.log"
+adapter_log="${run_dir}/adapter.log"
+stream_result="${run_dir}/stream-result.jsonl"
+mkdir -p "${opencode_home}" "${workspace_dir}" "${adapter_dir}"
+
+cleanup() {
+  local exit_code="$1"
+  if [[ -n "${adapter_pid:-}" ]] && kill -0 "${adapter_pid}" >/dev/null 2>&1; then
+    kill "${adapter_pid}" >/dev/null 2>&1 || true
+    wait "${adapter_pid}" >/dev/null 2>&1 || true
+  fi
+  if [[ -n "${upstream_pid:-}" ]] && kill -0 "${upstream_pid}" >/dev/null 2>&1; then
+    kill "${upstream_pid}" >/dev/null 2>&1 || true
+    wait "${upstream_pid}" >/dev/null 2>&1 || true
+  fi
+  if [[ "${LIVE_SMOKE_KEEP_ARTIFACTS:-0}" == "1" ]]; then
+    echo "[live-smoke] artifacts kept at ${run_dir}"
+  else
+    rm -rf "${run_dir}"
+  fi
+  exit "${exit_code}"
+}
+
+trap 'cleanup $?' EXIT
+
+(
+  cd "${workspace_dir}"
+  git init -q
+  printf 'live smoke workspace\n' > README.md
+  git add README.md
+  git -c user.name="live-smoke" -c user.email="live-smoke@localhost" commit -qm init
+)
+
+echo "[live-smoke] starting upstream opencode on ${upstream_url}"
+HOME="${opencode_home}" \
+XDG_CONFIG_HOME="${opencode_home}/.config" \
+XDG_DATA_HOME="${opencode_home}/.local/share" \
+XDG_CACHE_HOME="${opencode_home}/.cache" \
+OPENCODE_SERVER_PASSWORD="${upstream_password}" \
+"${opencode_bin}" serve --hostname 127.0.0.1 --port "${upstream_port}" \
+  >"${upstream_log}" 2>&1 &
+upstream_pid="$!"
+
+upstream_ready=""
+for _ in $(seq 1 60); do
+  if ! kill -0 "${upstream_pid}" >/dev/null 2>&1; then
+    echo "[live-smoke] upstream opencode exited before becoming ready" >&2
+    cat "${upstream_log}" >&2
+    exit 1
+  fi
+  if curl -fsS --max-time 5 -u "${upstream_username}:${upstream_password}" \
+    "${upstream_url}/doc" >/dev/null 2>&1; then
+    upstream_ready="1"
+    break
+  fi
+  sleep 0.5
+done
+if [[ -z "${upstream_ready}" ]]; then
+  echo "[live-smoke] upstream opencode did not become ready at ${upstream_url}" >&2
+  cat "${upstream_log}" >&2
+  exit 1
+fi
+echo "[live-smoke] upstream opencode ready (${opencode_version})"
+
+echo "[live-smoke] starting opencode-a2a on ${a2a_url}"
+adapter_bin="${ROOT_DIR}/.venv/bin/opencode-a2a"
+if [[ ! -x "${adapter_bin}" ]]; then
+  echo "[live-smoke] ${adapter_bin} not found; run without LIVE_SMOKE_SKIP_SYNC=1 (or sync the repository first)." >&2
+  exit 1
+fi
+
+OPENCODE_BASE_URL="${upstream_url}" \
+OPENCODE_WORKSPACE_ROOT="${workspace_dir}" \
+OPENCODE_AUTH_USERNAME="${upstream_username}" \
+OPENCODE_AUTH_PASSWORD="${upstream_password}" \
+A2A_STATIC_AUTH_CREDENTIALS="[{\"scheme\":\"bearer\",\"token\":\"${a2a_bearer_token}\",\"principal\":\"automation\"}]" \
+A2A_HOST="127.0.0.1" \
+A2A_PORT="${a2a_port}" \
+A2A_PUBLIC_URL="${a2a_url}" \
+A2A_TASK_STORE_DATABASE_URL="sqlite+aiosqlite:///${run_dir}/adapter/opencode-a2a.db" \
+"${adapter_bin}" serve >"${adapter_log}" 2>&1 &
+adapter_pid="$!"
+
+a2a_ready=""
+for _ in $(seq 1 60); do
+  if ! kill -0 "${adapter_pid}" >/dev/null 2>&1; then
+    echo "[live-smoke] adapter exited before becoming ready" >&2
+    cat "${adapter_log}" >&2
+    exit 1
+  fi
+  if curl -fsS --max-time 5 -H "Authorization: Bearer ${a2a_bearer_token}" \
+    "${a2a_url}/health" >/dev/null 2>&1; then
+    a2a_ready="1"
+    break
+  fi
+  sleep 0.5
+done
+if [[ -z "${a2a_ready}" ]]; then
+  echo "[live-smoke] adapter did not become ready at ${a2a_url}" >&2
+  cat "${adapter_log}" >&2
+  exit 1
+fi
+echo "[live-smoke] adapter ready"
+
+auth_header="Authorization: Bearer ${a2a_bearer_token}"
+extension_header="A2A-Extensions: urn:opencode-a2a:extension:session-management:v1, urn:opencode-a2a:extension:workspace-control:v1, urn:opencode-a2a:extension:provider-discovery:v1"
+
+jsonrpc_probe() {
+  local payload="$1"
+  curl -sS --max-time 30 -H "${auth_header}" -H "${extension_header}" \
+    -H "Content-Type: application/json" \
+    -d "${payload}" "${a2a_url}/"
+}
+
+echo "[live-smoke] probe: upstream auth is enforced"
+unauth_status="$(
+  curl -sS --max-time 10 -o /dev/null -w '%{http_code}' \
+    "${upstream_url}/session/status?directory=${workspace_dir}"
+)"
+if [[ "${unauth_status}" != "401" ]]; then
+  echo "[live-smoke] FAIL: upstream /session/status without credentials returned ${unauth_status}, expected 401" >&2
+  exit 1
+fi
+echo "[live-smoke] PASS: upstream auth enforced (401 without credentials)"
+
+echo "[live-smoke] probe: opencode.projects.current"
+projects_result="$(jsonrpc_probe '{"jsonrpc":"2.0","id":1,"method":"opencode.projects.current","params":{}}')"
+if ! python3 -c 'import json,sys; d=json.load(sys.stdin); sys.exit(0 if isinstance(d.get("result", {}).get("item", {}).get("id"), str) else 1)' \
+  <<<"${projects_result}"; then
+  echo "[live-smoke] FAIL: opencode.projects.current returned unexpected result: ${projects_result}" >&2
+  exit 1
+fi
+echo "[live-smoke] PASS: opencode.projects.current"
+
+echo "[live-smoke] probe: opencode.sessions.status"
+sessions_result="$(jsonrpc_probe '{"jsonrpc":"2.0","id":2,"method":"opencode.sessions.status","params":{}}')"
+if ! python3 -c 'import json,sys; d=json.load(sys.stdin); sys.exit(0 if "items" in d.get("result", {}) else 1)' \
+  <<<"${sessions_result}"; then
+  echo "[live-smoke] FAIL: opencode.sessions.status returned unexpected result: ${sessions_result}" >&2
+  exit 1
+fi
+echo "[live-smoke] PASS: opencode.sessions.status"
+
+if [[ "${LIVE_SMOKE_SKIP_PROMPT:-0}" != "1" ]]; then
+  echo "[live-smoke] probe: streaming prompt round-trip"
+  curl -sS -N \
+    -H "${auth_header}" \
+    -H "Content-Type: application/json" \
+    -d '{"jsonrpc":"2.0","id":10,"method":"SendStreamingMessage","params":{"message":{"messageId":"live-smoke-msg","role":"ROLE_USER","parts":[{"text":"Reply with exactly: smoke-ok"}]}}}' \
+    "${a2a_url}/" --max-time 180 >"${stream_result}"
+  if ! grep -q '"TASK_STATE_COMPLETED"' "${stream_result}"; then
+    echo "[live-smoke] FAIL: streaming prompt did not reach TASK_STATE_COMPLETED" >&2
+    tail -c 2000 "${stream_result}" >&2
+    exit 1
+  fi
+  if ! grep -q 'smoke-ok' "${stream_result}"; then
+    echo "[live-smoke] FAIL: streaming prompt reply did not contain the expected text" >&2
+    tail -c 2000 "${stream_result}" >&2
+    exit 1
+  fi
+  echo "[live-smoke] PASS: streaming prompt round-trip"
+else
+  echo "[live-smoke] skip: streaming prompt round-trip (LIVE_SMOKE_SKIP_PROMPT=1)"
+fi
+
+echo "[live-smoke] ALL CHECKS PASSED (opencode ${opencode_version})"

{opencode_a2a-1.1.2 → opencode_a2a-1.2.0}/src/opencode_a2a/auth.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import base64
 import binascii
+import secrets
 from dataclasses import dataclass
 
 from starlette.requests import Request
@@ -83,7 +84,7 @@ def authenticate_static_credential(
         for credential in credentials:
             if credential.auth_scheme != "bearer" or credential.token is None:
                 continue
-            if auth_value == credential.token:
+            if secrets.compare_digest(auth_value, credential.token):
                 return AuthenticatedPrincipal(
                     identity=credential.principal,
                     auth_scheme="bearer",
@@ -102,7 +103,11 @@ def authenticate_static_credential(
     for credential in credentials:
         if credential.auth_scheme != "basic":
             continue
-        if credential.username == username and credential.password == password:
+        if credential.username is None or credential.password is None:
+            continue
+        username_matches = secrets.compare_digest(username, credential.username)
+        password_matches = secrets.compare_digest(password, credential.password)
+        if username_matches and password_matches:
             return AuthenticatedPrincipal(
                 identity=credential.principal,
                 auth_scheme="basic",

{opencode_a2a-1.1.2 → opencode_a2a-1.2.0}/src/opencode_a2a/config.py

@@ -154,17 +154,23 @@ class Settings(BaseSettings):
     opencode_system: str | None = Field(default=None, alias="OPENCODE_SYSTEM")
     opencode_variant: str | None = Field(default=None, alias="OPENCODE_VARIANT")
     opencode_timeout: float = Field(default=120.0, alias="OPENCODE_TIMEOUT")
-    opencode_timeout_stream: float | None = Field(default=None, alias="OPENCODE_TIMEOUT_STREAM")
+    opencode_timeout_stream: float | None = Field(default=900.0, alias="OPENCODE_TIMEOUT_STREAM")
     opencode_max_concurrent_requests: int = Field(
-        default=0,
+        default=32,
         ge=0,
         alias="OPENCODE_MAX_CONCURRENT_REQUESTS",
     )
     opencode_max_concurrent_streams: int = Field(
-        default=0,
+        default=8,
         ge=0,
         alias="OPENCODE_MAX_CONCURRENT_STREAMS",
     )
+    opencode_auth_username: str = Field(default="opencode", alias="OPENCODE_AUTH_USERNAME")
+    opencode_auth_password: str | None = Field(
+        default=None,
+        alias="OPENCODE_AUTH_PASSWORD",
+        repr=False,
+    )
 
     # A2A settings
     a2a_public_url: str = Field(default="http://127.0.0.1:8000", alias="A2A_PUBLIC_URL")
@@ -292,6 +298,12 @@ class Settings(BaseSettings):
             raise ValueError(
                 "A2A_TASK_STORE_DATABASE_URL is required when A2A_TASK_STORE_BACKEND=database"
             )
+        if (
+            self.a2a_task_store_backend == "database"
+            and self.a2a_task_store_database_url
+            and not self.a2a_task_store_database_url.startswith("sqlite+aiosqlite:")
+        ):
+            raise ValueError("A2A_TASK_STORE_DATABASE_URL must use the sqlite+aiosqlite scheme")
         if self.a2a_static_auth_credentials:
             if not any(credential.enabled for credential in self.a2a_static_auth_credentials):
                 raise ValueError(