Use latest amber (v0.3.0)

nhynes · nhynes · commit 1d3dffb5357f · 2026-03-10T13:15:38.000+08:00
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -0,0 +1,32 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "3.13"
+          enable-cache: true
+
+      - name: Run unit tests
+        run: uv run --locked python -m unittest discover -s tests
+
+      - name: Verify source compiles
+        run: uv run --locked python -m compileall src
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -16,10 +16,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -37,7 +37,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: Dockerfile
diff --git a/README.md b/README.md
@@ -2,9 +2,13 @@
 
 Orchestrator and reverse proxy for AgentBeats assessments in Amber:
 - initiates an assessment by sending participants and assessment configuration to the Green agent via A2A
-- rewrites participant URLs to route through itself
+- routes participant URLs through itself
 - parses the Green agent's response and serves results as JSON
 
+The gateway now assumes Amber's current A2A routing model. It builds participant URLs from its own
+proxy address and rewrites loopback agent-card URLs so follow-up requests continue to flow through
+the gateway instead of leaking internal container addresses.
+
 The endpoint at `/` returns JSON with a `status` field set to `running` while the assessment is in progress. Once the session finishes, the endpoint returns `status` set to the final A2A task state (e.g. `completed`, `failed`) and `results` containing the parsed artifact data.
 
 ## Configuration
@@ -13,7 +17,6 @@ The endpoint at `/` returns JSON with a `status` field set to `running` while th
 |---|---|---|
 | Env | `SERVICE_URLS` | JSON object mapping slot names to participant endpoint URLs (required) |
 | Env | `PARTICIPANT_ROLES` | JSON object mapping slot names to semantic role names (required) |
-| Env | `CALLBACK_URLS` | JSON object mapping slot names to the URL each participant uses to reach the gateway (required) |
 | Env | `ASSESSMENT_CONFIG` | Assessment parameters |
 | Arg | `--proxy-port` | Proxy server port (default: 8080) |
-| Arg | `--results-port` | Results server port (default: 8081) |
+| Arg | `--results-port` | Results server port (default: 8081) |
diff --git a/amber-manifest.json5 b/amber-manifest.json5
@@ -5,7 +5,6 @@
     entrypoint: "uv run python src/main.py --proxy-port 8080 --results-port 8081",
     env: {
       SERVICE_URLS:      "${slots}",
-      CALLBACK_URLS:     "${config.callback_urls}",
       PARTICIPANT_ROLES: "${config.participant_roles}",
       ASSESSMENT_CONFIG: "${config.assessment_config}",
     },
@@ -21,13 +20,11 @@
     properties: {
       assessment_config: { type: "object" },
       participant_roles: { type: "object" },
-      callback_urls: { type: "object" },
     },
-    required: ["assessment_config", "participant_roles", "callback_urls"],
+    required: ["assessment_config", "participant_roles"],
   },
   slots: {
     green:      { kind: "a2a" },
-    green_mcp:  { kind: "mcp",  optional: true },
     purple1:    { kind: "a2a" },
     purple2:    { kind: "a2a", optional: true },
     purple3:    { kind: "a2a", optional: true },
@@ -39,4 +36,4 @@
     results: { kind: "http", endpoint: "results" },
   },
   exports: { proxy: "proxy", results: "results" },
-}
+}
diff --git a/examples/debate/scenario.json5 b/examples/debate/scenario.json5
@@ -22,9 +22,6 @@
           purple1: "pro_debater",
           purple2: "con_debater",
         },
-        callback_urls: {
-          green:   "${bindings.green-proxy.url}",
-        },
       },
     },
     green: {
@@ -50,7 +47,7 @@
     { to: "#gateway.green",   from: "#green.a2a" },
     { to: "#gateway.purple1", from: "#pro_debater.a2a" },
     { to: "#gateway.purple2", from: "#con_debater.a2a" },
-    { to: "#green.proxy",  from: "#gateway.proxy", weak: true, name: "green-proxy" },
+    { to: "#green.proxy",  from: "#gateway.proxy", weak: true },
   ],
   exports: { results: "#gateway.results" },
   metadata: {
diff --git a/src/config.py b/src/config.py
@@ -10,7 +10,6 @@ class Config:
     results_port: int
     service_urls: dict[str, str]        # slot name -> participant URL
     participant_roles: dict[str, str]   # slot name -> agent role name
-    callback_urls: dict[str, str]       # slot name -> gateway URL (reverse bindings)
     assessment_config: dict
 
 
@@ -33,11 +32,6 @@ def load_config() -> Config:
         raise ValueError("PARTICIPANT_ROLES is required")
     participant_roles = json.loads(participant_roles_raw)
 
-    callback_urls_raw = os.environ.get("CALLBACK_URLS")
-    if not callback_urls_raw:
-        raise ValueError("CALLBACK_URLS is required")
-    callback_urls = json.loads(callback_urls_raw)
-
     assessment_config_raw = os.environ.get("ASSESSMENT_CONFIG", "{}")
     assessment_config = json.loads(assessment_config_raw)
 
@@ -46,6 +40,5 @@ def load_config() -> Config:
         results_port=args.results_port,
         service_urls=service_urls,
         participant_roles=participant_roles,
-        callback_urls=callback_urls,
         assessment_config=assessment_config,
     )
diff --git a/src/main.py b/src/main.py
@@ -24,7 +24,7 @@ async def check_endpoint(endpoint: str) -> bool:
                 resolver = A2ACardResolver(httpx_client=client, base_url=endpoint)
                 await resolver.get_agent_card()
                 return True
-        except Exception as e:
+        except Exception:
             # Any exception means the agent is not ready
             return False
 
@@ -60,16 +60,15 @@ async def run_assessment_task(config):
     global result_data
 
     print("Waiting for agents to be ready...")
-    a2a_urls = [url for key, url in config.service_urls.items() if not key.endswith(("_http", "_mcp"))]
-    ready = await wait_for_agents(a2a_urls)
+    ready = await wait_for_agents(list(config.service_urls.values()))
     if not ready:
         result_data = {"status": "failed", "error": "Timeout: agents not ready"}
         return
 
     print("Starting assessment.")
 
     green_url = config.service_urls["green"]
-    gateway_url = config.callback_urls["green"]
+    gateway_url = f"http://127.0.0.1:{config.proxy_port}"
     participants = {
         role: f"{gateway_url}/{role}"
         for slot, role in config.participant_roles.items()
@@ -88,19 +87,8 @@ async def main():
     agent_routes = {
         role: config.service_urls[slot]
         for slot, role in config.participant_roles.items()
-        if slot in config.service_urls
     }
-    for slot, url in config.service_urls.items():
-        if slot.endswith(("_http", "_mcp")):
-            agent_routes[slot] = url
-
-    role_to_slot = {role: slot for slot, role in config.participant_roles.items()}
-
-    proxy = Proxy(
-        agent_routes=agent_routes,
-        callback_urls=config.callback_urls,
-        role_to_slot=role_to_slot,
-    )
+    proxy = Proxy(agent_routes=agent_routes)
 
     proxy_server = uvicorn.Server(
         uvicorn.Config(proxy.app, host="0.0.0.0", port=config.proxy_port, log_level="info")
@@ -117,4 +105,4 @@ async def main():
 
 
 if __name__ == "__main__":
-    asyncio.run(main())
+    asyncio.run(main())
diff --git a/src/proxy.py b/src/proxy.py
@@ -1,6 +1,6 @@
-import re
 import json
 from contextlib import asynccontextmanager
+from urllib.parse import urlparse, urlunparse
 
 import httpx
 from starlette.applications import Starlette
@@ -9,35 +9,69 @@
 from starlette.routing import Route
 
 
-_LOCALHOST_RE = re.compile(r'https?://(?:localhost|127\.0\.0\.1)(:\d+)?')
+def _rewrite_local_url(url: str, route: str, gateway_base_url: str) -> str | None:
+    parsed = urlparse(url)
+    if parsed.scheme not in {"http", "https"} or parsed.hostname not in {
+        "localhost",
+        "127.0.0.1",
+        "0.0.0.0",
+        "::1",
+    }:
+        return None
+
+    gateway_base = gateway_base_url.rstrip("/")
+    rewritten_path = f"/{route}{parsed.path}" if parsed.path else f"/{route}"
+    rewritten = urlparse(f"{gateway_base}{rewritten_path}")
+    return urlunparse(
+        (
+            rewritten.scheme,
+            rewritten.netloc,
+            rewritten.path,
+            parsed.params,
+            parsed.query,
+            parsed.fragment,
+        )
+    )
 
 
-def _rewrite_agent_card(body: bytes, route: str, green_callback_url: str) -> bytes:
-    """Rewrite the agent card's url field to point back through the gateway (green's perspective)."""
+def _rewrite_agent_card(body: bytes, route: str, gateway_base_url: str) -> bytes:
+    """Rewrite loopback agent-card URLs so follow-up calls come back through the gateway."""
     try:
         card = json.loads(body)
     except json.JSONDecodeError:
         return body
-    if "url" in card:
-        card["url"] = f"{green_callback_url}/{route}"
-    return json.dumps(card).encode()
 
+    rewritten = False
+
+    if isinstance(card.get("supportedInterfaces"), list):
+        for interface in card["supportedInterfaces"]:
+            if not isinstance(interface, dict):
+                continue
+            raw_url = interface.get("url")
+            if not isinstance(raw_url, str):
+                continue
+            updated_url = _rewrite_local_url(raw_url, route, gateway_base_url)
+            if updated_url and updated_url != raw_url:
+                interface["url"] = updated_url
+                rewritten = True
+
+    raw_url = card.get("url")
+    if isinstance(raw_url, str):
+        updated_url = _rewrite_local_url(raw_url, route, gateway_base_url)
+        if updated_url and updated_url != raw_url:
+            card["url"] = updated_url
+            rewritten = True
+
+    if not rewritten:
+        return body
 
-def _rewrite_localhost_urls(body: bytes, target_callback_url: str) -> bytes:
-    """Replace localhost URL bases in the request body with the target's callback URL."""
-    return _LOCALHOST_RE.sub(target_callback_url.rstrip("/"), body.decode()).encode()
+    card.pop("signatures", None)
+    return json.dumps(card).encode()
 
 
 class Proxy:
-    def __init__(
-        self,
-        agent_routes: dict[str, str],   # route key -> upstream URL
-        callback_urls: dict[str, str],  # slot -> callback URL (includes "green")
-        role_to_slot: dict[str, str],   # role name -> slot name
-    ):
+    def __init__(self, agent_routes: dict[str, str]):  # route key -> upstream URL
         self.agent_routes = agent_routes
-        self.callback_urls = callback_urls
-        self.role_to_slot = role_to_slot
 
         @asynccontextmanager
         async def lifespan(app):
@@ -70,13 +104,6 @@ async def handle_request(self, request: Request) -> Response:
 
         body = await request.body()
 
-        slot = self.role_to_slot.get(name, name)
-        base_callback = self.callback_urls.get(slot)
-        if base_callback:
-            body = _rewrite_localhost_urls(body, f"{base_callback}/green_mcp")
-        elif body and _LOCALHOST_RE.search(body.decode()):
-            print(f"Warning: no callback URL for {slot}, skipping localhost URL rewrite")
-
         req = self.client.build_request(
             method=request.method,
             url=target_url,
@@ -87,9 +114,17 @@ async def handle_request(self, request: Request) -> Response:
         try:
             if path == ".well-known/agent-card.json":
                 resp = await self.client.send(req)
-                green_callback = self.callback_urls.get("green", "")
-                response_body = _rewrite_agent_card(resp.content, name, green_callback)
-                headers = {k: v for k, v in resp.headers.items() if k.lower() != "content-length"}
+                gateway_base_url = str(request.base_url).rstrip("/")
+                response_body = _rewrite_agent_card(
+                    resp.content,
+                    name,
+                    gateway_base_url,
+                )
+                headers = {
+                    k: v
+                    for k, v in resp.headers.items()
+                    if k.lower() not in {"content-length", "content-encoding"}
+                }
                 return Response(
                     content=response_body,
                     status_code=resp.status_code,
@@ -106,7 +141,11 @@ async def stream_body():
             return StreamingResponse(
                 content=stream_body(),
                 status_code=resp.status_code,
-                headers=dict(resp.headers),
+                headers={
+                    k: v
+                    for k, v in resp.headers.items()
+                    if k.lower() not in {"content-length", "content-encoding"}
+                },
             )
         except httpx.ConnectError:
             return Response(f"Failed to connect to upstream: {name}", status_code=502)
diff --git a/tests/test_config.py b/tests/test_config.py
@@ -0,0 +1,38 @@
+import os
+import sys
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+from config import load_config
+
+
+class LoadConfigTests(unittest.TestCase):
+    def test_load_config_reads_required_fields(self):
+        with patch.dict(
+            os.environ,
+            {
+                "SERVICE_URLS": '{"green":{"url":"http://green"},"purple1":{"url":"http://purple"}}',
+                "PARTICIPANT_ROLES": '{"green":"judge","purple1":"debater"}',
+                "ASSESSMENT_CONFIG": '{"topic":"test"}',
+            },
+            clear=True,
+        ), patch.object(sys, "argv", ["gateway"]):
+            config = load_config()
+
+        self.assertEqual(
+            config.service_urls,
+            {"green": "http://green", "purple1": "http://purple"},
+        )
+        self.assertEqual(
+            config.participant_roles,
+            {"green": "judge", "purple1": "debater"},
+        )
+        self.assertEqual(config.assessment_config, {"topic": "test"})
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_proxy.py b/tests/test_proxy.py
