superqode 2.2.3__tar.gz → 2.2.4__tar.gz

{superqode-2.2.3 → superqode-2.2.4}/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.2.4] - 2026-09-13
+
+Hosting a UHP harness gets its own install extra, so `serve uhp` no longer
+asks for the A2A stack. `scripts/run_uhp_conformance.sh` runs the HarnessRouter
+conformance suite against a local bind.
+
+### 🧩 Unified Harness Protocol
+
+- New `superqode[uhp]` extra: FastAPI and uvicorn, the two packages
+  `serve uhp` needs. Hosting a UHP harness no longer means installing
+  `superqode[a2a]` and its unrelated A2A stack. The client needs neither,
+  because httpx and httpx-sse are core dependencies.
+- `serve uhp` without those packages now names the extra to install. It exited
+  with a raw `ModuleNotFoundError` traceback.
+- `Dockerfile.uhp` installs `.[uhp]` instead of `.[a2a]`.
+- `scripts/run_uhp_conformance.sh` stands up a local bind and runs the
+  HarnessRouter conformance suite against it, in a scratch directory. The
+  suite is a stock UHP client and does not send `X-Provider-Api-Key`, so a
+  BYOK bind cannot be measured directly.
+
 ## [2.2.3] - 2026-09-13
 
 Security fixes for the UHP client and the BYOK server bind shipped in 2.2.2.

{superqode-2.2.3 → superqode-2.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: superqode
-Version: 2.2.3
+Version: 2.2.4
 Summary: The harness layer for coding agents
 Author-email: Shashi Jagtap <info@super-agentic.ai>
 Maintainer-email: Shashi Jagtap <info@super-agentic.ai>
@@ -66,6 +66,9 @@ Provides-Extra: a2a
 Requires-Dist: a2a-sdk[fastapi,sqlite]<2.0.0,>=1.1.2; extra == "a2a"
 Requires-Dist: fastapi>=0.115.0; extra == "a2a"
 Requires-Dist: uvicorn>=0.32.0; extra == "a2a"
+Provides-Extra: uhp
+Requires-Dist: fastapi>=0.115.0; extra == "uhp"
+Requires-Dist: uvicorn>=0.32.0; extra == "uhp"
 Provides-Extra: adk
 Requires-Dist: google-adk<3.0,>=2.1.0; extra == "adk"
 Provides-Extra: openai-agents

{superqode-2.2.3 → superqode-2.2.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superqode"
-version = "2.2.3"
+version = "2.2.4"
 description = "The harness layer for coding agents"
 readme = "README.md"
 license = "Apache-2.0"
@@ -113,6 +113,13 @@ a2a = [
     "fastapi>=0.115.0",
     "uvicorn>=0.32.0",
 ]
+uhp = [
+    # `serve uhp` only. The UHP client needs nothing extra: httpx and
+    # httpx-sse are core. Deliberately no a2a-sdk, so hosting a UHP harness
+    # does not drag in an unrelated protocol stack.
+    "fastapi>=0.115.0",
+    "uvicorn>=0.32.0",
+]
 adk = [
     "google-adk>=2.1.0,<3.0",
 ]

{superqode-2.2.3 → superqode-2.2.4}/src/superqode/__init__.py

@@ -38,7 +38,7 @@ __all__ = [
     "sidebar",
 ]
 
-__version__ = "2.2.3"
+__version__ = "2.2.4"
 
 # Stable, lightweight public extension surface.  Importing this package does
 # not discover or execute third-party extensions; discovery happens only when

{superqode-2.2.3 → superqode-2.2.4}/src/superqode/commands/serve.py

@@ -375,7 +375,7 @@ def serve_uhp(
     This is SuperQode's own harness speaking UHP — complementary to
     HarnessRouter, not a multi-backend runner replacement.
     """
-    from superqode.harness.uhp_server import create_uhp_server
+    from superqode.harness.uhp_server import MissingUHPServerDependency, create_uhp_server
 
     is_loopback = host in {"127.0.0.1", "localhost", "::1"}
     if not is_loopback and not allow_remote:
@@ -387,16 +387,19 @@ def serve_uhp(
             "the caller's X-Provider-Api-Key."
         )
 
-    server = create_uhp_server(
-        spec=spec_path,
-        provider=provider,
-        model=model_name,
-        working_directory=working_dir.resolve(),
-        api_key=api_key,
-        harness_id=harness_id,
-        public_catalog=allow_remote,
-        require_caller_provider_key=allow_remote,
-    )
+    try:
+        server = create_uhp_server(
+            spec=spec_path,
+            provider=provider,
+            model=model_name,
+            working_directory=working_dir.resolve(),
+            api_key=api_key,
+            harness_id=harness_id,
+            public_catalog=allow_remote,
+            require_caller_provider_key=allow_remote,
+        )
+    except MissingUHPServerDependency as exc:
+        raise click.ClickException(str(exc)) from exc
     console.print(
         f"[cyan]Serving SuperQode UHP {server.discovery_document()['default_version']} "
         f"on http://{host}:{port}[/cyan]"

{superqode-2.2.3 → superqode-2.2.4}/src/superqode/harness/uhp_server.py

@@ -61,6 +61,10 @@ _PROVIDER_ENV_LOCK = asyncio.Lock()
 HarnessRunner = Callable[["UHPRunRequest"], Awaitable["UHPRunResult"]]
 
 
+class MissingUHPServerDependency(RuntimeError):
+    """Serving UHP needs the `uhp` extra; the client does not."""
+
+
 @dataclass(frozen=True)
 class UHPRunRequest:
     """Inputs handed to the bound harness runner."""
@@ -431,8 +435,15 @@ class UHPServer:
     # -- FastAPI app ------------------------------------------------------------
 
     def _build_app(self) -> Any:
-        from fastapi import FastAPI
-        from fastapi.responses import JSONResponse, StreamingResponse
+        try:
+            from fastapi import FastAPI
+            from fastapi.responses import JSONResponse, StreamingResponse
+        except ModuleNotFoundError as exc:  # pragma: no cover - install-shape error
+            raise MissingUHPServerDependency(
+                "Serving UHP needs FastAPI and uvicorn, which are not installed.\n"
+                "  pip install 'superqode[uhp]'\n"
+                "The UHP client works without them."
+            ) from exc
 
         app = FastAPI(
             title="SuperQode UHP Server",

{superqode-2.2.3 → superqode-2.2.4}/src/superqode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: superqode
-Version: 2.2.3
+Version: 2.2.4
 Summary: The harness layer for coding agents
 Author-email: Shashi Jagtap <info@super-agentic.ai>
 Maintainer-email: Shashi Jagtap <info@super-agentic.ai>
@@ -66,6 +66,9 @@ Provides-Extra: a2a
 Requires-Dist: a2a-sdk[fastapi,sqlite]<2.0.0,>=1.1.2; extra == "a2a"
 Requires-Dist: fastapi>=0.115.0; extra == "a2a"
 Requires-Dist: uvicorn>=0.32.0; extra == "a2a"
+Provides-Extra: uhp
+Requires-Dist: fastapi>=0.115.0; extra == "uhp"
+Requires-Dist: uvicorn>=0.32.0; extra == "uhp"
 Provides-Extra: adk
 Requires-Dist: google-adk<3.0,>=2.1.0; extra == "adk"
 Provides-Extra: openai-agents

{superqode-2.2.3 → superqode-2.2.4}/src/superqode.egg-info/requires.txt

@@ -151,6 +151,10 @@ coverage>=7.0.0
 bandit>=1.8.0
 httpx>=0.28.1
 
+[uhp]
+fastapi>=0.115.0
+uvicorn>=0.32.0
+
 [ui-testing]
 selenium>=4.27.0
 playwright>=1.49.0

{superqode-2.2.3 → superqode-2.2.4}/tests/test_uhp_server.py

@@ -596,3 +596,24 @@ def test_non_ascii_bearer_is_rejected_not_crashed():
     assert envelope is not None
     assert envelope["error"]["type"] == "authentication_error"
     assert envelope["error"]["code"] == "invalid_credential"
+
+
+def test_missing_server_extra_names_the_uhp_extra(monkeypatch):
+    """A bare install must say what to install, not raise ModuleNotFoundError."""
+    import builtins
+
+    from superqode.harness.uhp_server import MissingUHPServerDependency
+
+    real_import = builtins.__import__
+
+    def no_fastapi(name, *args, **kwargs):
+        if name == "fastapi" or name.startswith("fastapi."):
+            raise ModuleNotFoundError("No module named 'fastapi'")
+        return real_import(name, *args, **kwargs)
+
+    monkeypatch.setattr(builtins, "__import__", no_fastapi)
+
+    with pytest.raises(MissingUHPServerDependency) as excinfo:
+        _server()
+
+    assert "superqode[uhp]" in str(excinfo.value)