Repository navigation
feat: add --unix-socket and credential helpers - #105
Open
yarolegovich wants to merge 9 commits into
Open
yarolegovich wants to merge 9 commits into
yarolegovich wants to merge 9 commits into
Conversation
Agent servers reach their harnesses over a Unix socket and hand out per-agent tokens. --unix-socket routes HTTP requests through a socket, for every host or one. --credential-helper runs Bazel credential helpers to get the headers for an agent, and `a2a auth get` shows what a helper returns.
Helpers ran in the root pre-run for every command, so unrelated commands failed when a helper did, and their headers went to whatever interface host the card advertised, outside the helper's scope. Helpers now run lazily: the card request uses the helper for the card URL and an a2a client interceptor picks one per interface URL, caching headers per URL until they expire. --timeout bounds each run. Also keeps credential-helper env values unsplit on commas, rejects ports in helper and --unix-socket scopes, lets --unix-socket paths contain '=', and warns in the README that a local .env can set a helper.
A .env in a cloned repository could set A2ACLI_CREDENTIAL_HELPER and run a command, or set A2ACLI_UNIX_SOCKET and redirect requests. Both flags now fail with a usage error when they come from a .env found by walking up from the working directory; --config, the environment, and the user config still work. Flag-specific config behavior moves from hard-coded names in clicfg to pflag annotations. Test helper scripts run through sh, since executing a file written while parallel tests fork can fail with ETXTBSY. The docs now say helpers receive the card reference or interface URL rather than the full request URL.
…files Failing every command when a cloned repository's .env sets them was more disruptive than needed; ignoring the value with a warning is equally safe.
…al-helper # Conflicts: # internal/cli/client.go
yarolegovich
marked this pull request as ready for review
October 29, 2026 11:51
More auth commands are planned (#98), so credential helper details belong on auth get.
…rings
Shell-split command strings were cryptic and pulled in shlex. Config files now list {scope, command} entries, and the flag and env var take a Bazel-style [scope=]path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Agent servers reach their harnesses over a Unix socket and hand out per-agent tokens. --unix-socket routes every HTTP request through a socket. --credential-helper runs Bazel credential helpers to get the headers for an agent, and
a2a auth getshows what a helper returns.