fix(a2a): preserve serialized structured results

.changeset/a2a-serialized-results.md

@@ -0,0 +1,6 @@
+---
+'@openai/agents': patch
+'@openai/agents-codex': patch
+---
+
+fix: preserve the JSON representation of structured A2A results when saving and publishing a task.

.changeset/limit-a2a-response-encoding.md

@@ -0,0 +1,6 @@
+---
+'@openai/agents': patch
+'@openai/agents-codex': patch
+---
+
+Reject compressed A2A discovery and RPC responses before reading their bodies, and request identity encoding so the adapter's response-byte bound does not depend on automatic decompression.

.changeset/owned-child-tracing-context.md

@@ -0,0 +1,6 @@
+---
+'@openai/agents': patch
+'@openai/agents-codex': patch
+---
+
+fix: preserve each queued native submission's trace and privacy settings when another workflow is active

examples/realtime-react-native/test/token-server.test.ts

@@ -1,5 +1,6 @@
 import assert from 'node:assert/strict';
 import { spawn } from 'node:child_process';
+import { once } from 'node:events';
 import { request as httpRequest } from 'node:http';
 import { createServer } from 'node:net';
 import type { AddressInfo } from 'node:net';
@@ -28,8 +29,10 @@ async function startServer(host: string, configuredPort?: number) {
       return listen.call(this, ${port}, ...args);
     };`
     }
+    let upstreamRequests = 0;
+    process.on('message', () => process.send(upstreamRequests));
     globalThis.fetch = async () => {
-      console.log('UPSTREAM_REQUEST');
+      upstreamRequests++;
       return new Response(JSON.stringify({ value: 'test-client-secret', expires_at: 123 }), { status: 200 });
     };
     await import(${JSON.stringify(serverUrl)});
@@ -41,7 +44,7 @@ async function startServer(host: string, configuredPort?: number) {
       PORT: String(configuredPort ?? port),
       OPENAI_API_KEY: 'test-api-key',
     },
-    stdio: ['ignore', 'pipe', 'pipe'],
+    stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
   });
   let output = '';
   await new Promise((resolve, reject) => {
@@ -63,8 +66,11 @@ async function startServer(host: string, configuredPort?: number) {
   });
   return {
     port,
-    get output() {
-      return output;
+    async upstreamRequests() {
+      const reply = once(child, 'message');
+      child.send('upstreamRequests');
+      const [count] = await reply;
+      return count as number;
     },
     pairingToken: output.match(/Pairing token: ([A-Za-z0-9_-]+)/)?.[1],
     request: (headers?: Record<string, string>) =>
@@ -95,7 +101,7 @@ test('LAN token issuance requires pairing and limits each client', async () => {
       (await server.request({ Authorization: 'Bearer wrong' })).status,
       401,
     );
-    assert.equal(server.output.includes('UPSTREAM_REQUEST'), false);
+    assert.equal(await server.upstreamRequests(), 0);
 
     assert.ok(server.pairingToken);
     const headers = { Authorization: `Bearer ${server.pairingToken}` };
@@ -105,7 +111,7 @@ test('LAN token issuance requires pairing and limits each client', async () => {
       assert.equal((await response.json()).value, 'test-client-secret');
     }
     assert.equal((await server.request(headers)).status, 429);
-    assert.equal(server.output.match(/UPSTREAM_REQUEST/g)?.length, 6);
+    assert.equal(await server.upstreamRequests(), 6);
   } finally {
     server.stop();
   }
@@ -137,7 +143,7 @@ test('loopback token issuance requires pairing and an expected origin', async ()
   try {
     assert.ok(server.pairingToken);
     assert.equal((await server.request()).status, 401);
-    assert.equal(server.output.includes('UPSTREAM_REQUEST'), false);
+    assert.equal(await server.upstreamRequests(), 0);
 
     const headers = { Authorization: `Bearer ${server.pairingToken}` };
     assert.equal(
@@ -162,15 +168,15 @@ test('loopback token issuance requires pairing and an expected origin', async ()
       ).status,
       403,
     );
-    assert.equal(server.output.includes('UPSTREAM_REQUEST'), false);
+    assert.equal(await server.upstreamRequests(), 0);
 
     assert.equal((await server.request(headers)).status, 200);
     assert.equal(
       (await server.request({ ...headers, Host: `10.0.2.2:${server.port}` }))
         .status,
       200,
     );
-    assert.equal(server.output.match(/UPSTREAM_REQUEST/g)?.length, 2);
+    assert.equal(await server.upstreamRequests(), 2);
   } finally {
     server.stop();
   }
@@ -204,7 +210,7 @@ test('HTTP port 80 accepts exact portless aliases and serialized origins while r
       ).status,
       403,
     );
-    assert.equal(server.output.includes('UPSTREAM_REQUEST'), false);
+    assert.equal(await server.upstreamRequests(), 0);
 
     for (const alias of ['127.0.0.1', 'localhost', '10.0.2.2']) {
       for (const Host of [alias, `${alias}:80`]) {
@@ -221,7 +227,7 @@ test('HTTP port 80 accepts exact portless aliases and serialized origins while r
       (await server.request({ ...headers, Host: 'localhost' })).status,
       429,
     );
-    assert.equal(server.output.match(/UPSTREAM_REQUEST/g)?.length, 6);
+    assert.equal(await server.upstreamRequests(), 6);
   } finally {
     server.stop();
   }

packages/agents-codex/A2A.md

@@ -27,15 +27,15 @@ Discovery sends no credentials. After the card passes admission, the adapter res
 
 The returned client is the official A2A `Client`. Direct callers must treat an uncertain mutation acknowledgment as an unknown outcome; message IDs do not make creation idempotent. This profile supports `sendMessage`, `getTask`, and `cancelTask`. It uses polling rather than streaming, push notifications, extended cards, or remote callback execution. Native input supports text and inline PNG, JPEG, GIF, and WebP images. File URLs, arbitrary URIs, and other file types fail before native admission. Result validation remains the application's responsibility.
 
-`A2ALimits` sets `bodyBytes`, `inputBytes`, `checkpointBytes`, and `timeoutMs`. Defaults are 2 MiB, 1 MiB, 8 MiB, and 30 seconds. The HTTP reader stops before buffering more than `bodyBytes`. These bounds are adapter defaults, not service quotas. The host should also bound incoming HTTP bodies before protocol parsing.
+`A2ALimits` sets `bodyBytes`, `inputBytes`, `checkpointBytes`, and `timeoutMs`. Defaults are 2 MiB, 1 MiB, 8 MiB, and 30 seconds. The adapter requests identity HTTP encoding and cancels responses that declare another encoding before reading their bodies. `bodyBytes` limits the chunks the adapter retains. A custom `fetch` must preserve response encoding headers and body cancellation. The transport controls its own internal buffers. These bounds are adapter defaults, not service quotas. The host should also bound incoming HTTP bodies before protocol parsing.
 
 ## Deferred remote work
 
 `A2AJobProvider` implements the existing `JobProvider` contract. Register it with `DeferredTools`, a host `JobJournal`, and a current result projection. Set `requireReconciliation: false` only for work whose uncertain outcome the host can handle. Generic A2A cannot prove whether a lost create was accepted.
 
 The provider requires separate callbacks for current authorization, credential resolution, durable mutation reservation, input encoding, and result validation. Authorization checks the current principal, immutable native invocation binding, and claim generation. After discovery and local validation, the provider resolves credentials, checks authorization again, spends one mutation reservation, and sends once. A timeout or lost create, input-reply, or cancel acknowledgment returns `unknown`. It never resends that mutation. A known receipt binds the endpoint and original native invocation. A fresh worker observes that same remote task with `getTask`; it does not create another task.
 
-`inputRequired` exposes a remote challenge. `A2AInputReply` supplies its task ID, context ID, challenge, generation, and JSON `result`. The provider reads the current remote task before reserving a reply. Python and TypeScript share one wire profile: the status message contains one data part `{challenge, generation, tool, arguments}`; a reply contains exactly `{challenge, generation, result}`. Task and context IDs belong in the A2A message envelope. Structured completion artifacts contain `{result: output}`; string results remain text parts. `authRequired` remains a host credential flow and never becomes a generic approval answer. A host must not accept untrusted remote approval text as authority to perform local actions.
+`inputRequired` exposes a remote challenge. `A2AInputReply` supplies its task ID, context ID, challenge, generation, and JSON `result`. The provider reads the current remote task before reserving a reply. Python and TypeScript share one wire profile: the status message contains one data part `{challenge, generation, tool, arguments}`; a reply contains exactly `{challenge, generation, result}`. Task and context IDs belong in the A2A message envelope. The executor publishes string results as text parts. For structured results, it saves and sends `{result: output}` using the JSON representation that passed the byte limit. `authRequired` remains a host credential flow and never becomes a generic approval answer. A host must not accept untrusted remote approval text as authority to perform local actions.
 
 ## Serve a native agent