fix(a2a): preserve protocol on card refresh, add custom headers and configurable timeout#3247
Draft
Copilot wants to merge 4 commits into
Draft
fix(a2a): preserve protocol on card refresh, add custom headers and configurable timeout#3247Copilot wants to merge 4 commits into
Copilot wants to merge 4 commits into
Conversation
Copilot
AI
changed the title
[WIP] Fix bugs in A2A configuration and improve stability
fix(a2a): preserve protocol on card refresh, add custom headers and configurable timeout
Jun 17, 2026
YehongPan
reviewed
Jun 24, 2026
| status_code=HTTPStatus.BAD_REQUEST, | ||
| detail=str(e) | ||
| ) | ||
| except Exception as e: |
Contributor
There was a problem hiding this comment.
[代码规范] except Exception: 过于宽泛，建议捕获更具体的异常类型，避免掩盖潜在错误。
JasonW404
reviewed
Jun 24, 2026
|
|
||
| class UpdateAgentSettingsRequest(BaseModel): | ||
| """Request to update user-configurable settings for an external A2A agent.""" | ||
| custom_headers: Optional[dict] = Field( |
Member
There was a problem hiding this comment.
custom_headers 允许用户设置任意 HTTP headers 发送给 A2A agent，但没有验证 header 内容。恶意或有误的用户可能设置 Authorization、Host 等敏感 header，覆盖系统默认行为或造成安全风险。建议添加 header 名称黑名单（如 Authorization, Host, Content-Type）或白名单验证。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three A2A client configuration bugs: protocol selection silently reset on card refresh, no way to set custom HTTP headers per agent, and multi-agent call timeout was hardcoded at 300s with no way to override it.
Protocol preservation on refresh
refresh_agent_card()was re-extracting the protocol from the remote card and overwriting the user's choice. Removed theupdate_protocol_typebranch entirely — protocol is now exclusively mutated via explicitupdate_agent_protocol().Custom headers support
custom_headers JSONcolumn onA2AExternalAgentbuild_a2a_headers(api_key, custom_headers)merges user-supplied headers after base headers, allowing overridesa2a_agent_db→a2a_client_service→ExternalA2AAgentConfig→A2AAgentInfo→_build_headers()PUT /agents/{id}/settingsendpoint acceptingcustom_headersandtimeoutConfigurable timeout
timeout Floatcolumn onA2AExternalAgent(default 300.0)_build_external_agent_config()readsagent.get("timeout") or 300.0instead of the hardcoded literalv2.2.1_add_custom_headers_timeout_to_external_agent.sqlFrontend
Replaced the narrow
AgentProtocolSettingpopover with a unifiedAgentSettingscomponent covering protocol selection, timeout (InputNumber, 1–3600 s), and custom header key-value pairs. i18n keys added for bothenandzhlocales.Tests
test_a2a_http_client.py: 5 new cases forbuild_a2a_headerswithcustom_headerstest_a2a_agent_db.py: mock ORM class updated withcustom_headers/timeoutcolumnstest_a2a_client_service.py: assertion updated to match newbuild_a2a_headerssignature