feat(a2a): enable A2A server in agent-zero compose + gitlink rewind - #1616
Conversation
📝 WalkthroughWalkthroughThis PR enables A2A (Agent-to-Agent) server support for Agent Zero by configuring environment variables across Docker Compose files, updating the damage-control allowlist, and advancing a submodule reference. ChangesA2A Server Activation
Estimated Code Review Effort🎯 1 (Trivial) | ⏱️ ~5 minutes Possibly Related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
⚔️ Resolve merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3ccf203205
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@PMOVES-transcribe-and-fetch`:
- Line 1: The repository PMOVES-transcribe-and-fetch contains a submodule
gitlink pointing to commit aef3a86e817bc2d266b8b0845b6b118062e8dc7a which isn’t
reachable from the configured remote; update the submodule pointer to a commit
that exists on the submodule’s fetchable remote (or fix the submodule’s remote
URL/credentials) by updating the submodule entry and committing the new gitlink,
then verify by running git fetch on the submodule and confirming git cat-file -e
<new-commit> succeeds and git submodule update --init --recursive completes
without error.
In `@pmoves/docker-compose.agents.yml`:
- Around line 66-67: When A0_SET_a2a_server_enabled=true the env var
A0_SET_mcp_server_token must not default to empty; replace the permissive
expansion A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:-} with a required
expansion that fails if unset (e.g.
A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:?MCP_SERVER_TOKEN is required when
A0_SET_a2a_server_enabled=true}) so compose will error on missing token; update
any overlay documentation or .env examples to ensure MCP_SERVER_TOKEN is
provided when A2A is enabled.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 20d9affc-2c01-4f77-93da-b0d812cba8aa
📒 Files selected for processing (4)
.claude/hooks/damage-control/patterns.yamlPMOVES-transcribe-and-fetchpmoves/docker-compose.agents.ymlpmoves/docker-compose.yml
| @@ -1 +1 @@ | |||
| Subproject commit 322f05f7a28376e77ba11b6fad26270dabd4bd86 | |||
| Subproject commit aef3a86e817bc2d266b8b0845b6b118062e8dc7a | |||
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify PMOVES-transcribe-and-fetch submodule commit is reachable and initializes
# Check if the new commit exists in the submodule
cd PMOVES-transcribe-and-fetch
git fetch origin
if git cat-file -e aef3a86e817bc2d266b8b0845b6b118062e8dc7a 2>/dev/null; then
echo "✓ Commit aef3a86e817bc2d266b8b0845b6b118062e8dc7a is reachable"
else
echo "✗ Commit aef3a86e817bc2d266b8b0845b6b118062e8dc7a is NOT reachable"
exit 1
fi
# Verify submodule update succeeds
cd ..
git submodule update --init --recursive PMOVES-transcribe-and-fetch
if [ $? -eq 0 ]; then
echo "✓ Submodule initialized successfully"
else
echo "✗ Submodule initialization failed"
exit 1
fi
# Show the commit message for context
cd PMOVES-transcribe-and-fetch
git log -1 --oneline aef3a86e817bc2d266b8b0845b6b118062e8dc7aRepository: POWERFULMOVES/PMOVES.AI
Length of output: 134
Fix submodule pointer: target commit aef3a86e817bc2d266b8b0845b6b118062e8dc7a isn’t reachable
- In
PMOVES-transcribe-and-fetch, fetchingorigindoesn’t make commitaef3a86e817bc2d266b8b0845b6b118062e8dc7aavailable (git cat-file -efails), so submodule checkout/update should fail in CI. - Update the submodule gitlink to a commit that exists on the submodule’s fetchable remote (or correct the submodule remote/credentials), then confirm
git submodule update --init --recursivesucceeds.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@PMOVES-transcribe-and-fetch` at line 1, The repository
PMOVES-transcribe-and-fetch contains a submodule gitlink pointing to commit
aef3a86e817bc2d266b8b0845b6b118062e8dc7a which isn’t reachable from the
configured remote; update the submodule pointer to a commit that exists on the
submodule’s fetchable remote (or fix the submodule’s remote URL/credentials) by
updating the submodule entry and committing the new gitlink, then verify by
running git fetch on the submodule and confirming git cat-file -e <new-commit>
succeeds and git submodule update --init --recursive completes without error.
| - A0_SET_a2a_server_enabled=true | ||
| - A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:-} |
There was a problem hiding this comment.
Require MCP_SERVER_TOKEN in overlays when A2A is enabled.
With A0_SET_a2a_server_enabled=true, using ${MCP_SERVER_TOKEN:-} permits empty auth token in the agents overlay, which drifts from pmoves/docker-compose.yml and weakens the A2A auth contract.
Suggested fix
- - A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:-}
+ - A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:?MCP_SERVER_TOKEN must be set when a2a_server_enabled=true}As per coding guidelines: “Validate runtime security and operability … Flag hardcoded credentials/default secrets in environment blocks.”
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - A0_SET_a2a_server_enabled=true | |
| - A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:-} | |
| - A0_SET_a2a_server_enabled=true | |
| - A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:?MCP_SERVER_TOKEN must be set when a2a_server_enabled=true} |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pmoves/docker-compose.agents.yml` around lines 66 - 67, When
A0_SET_a2a_server_enabled=true the env var A0_SET_mcp_server_token must not
default to empty; replace the permissive expansion
A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:-} with a required expansion that
fails if unset (e.g.
A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:?MCP_SERVER_TOKEN is required when
A0_SET_a2a_server_enabled=true}) so compose will error on missing token; update
any overlay documentation or .env examples to ensure MCP_SERVER_TOKEN is
provided when A2A is enabled.
…able HEAD 322f05f7a was unreachable (force-pushed). Rewinding to aef3a86. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
${MCP_SERVER_TOKEN:-} silently passes empty string, letting A2A start
with no auth enforcement. Use :? to fail fast if the token is unset.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ffe3f1e to
8afc81c
Compare
Docker Hardening ValidationHardening Validation ReportValidated: Wed May 27 02:27:00 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
The :? guard in docker-compose.yml (added in PR #1616 for a2a mode) requires MCP_SERVER_TOKEN to be set. Add a ci-validation-placeholder so compose syntax validation passes without operator credentials. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 participant
Summary
PMOVES-transcribe-and-fetchgitlink to a reachable HEADNote on atomicity
This PR bundles two small changes. The gitlink rewind was a prerequisite/companion to the A2A activation (transcribe service is wired into A2A flows). They were developed together; a future split can be done if reviewers prefer.
Test plan
docker compose upPMOVES-transcribe-and-fetchgitlink resolves withoutfatal: reference is not a tree🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes
New Features
Chores