UAT: agents server serve command missing --cors-origins parameter — CORS configuration not exposed via CLI #3964

Open
opened 2026-04-06 07:57:01 +00:00 by freemo · 0 comments
Owner

Metadata

  • Branch: fix/m9-server-serve-cors-origins
  • Commit Message: fix(cli): add --cors-origins parameter to agents server serve command
  • Milestone: v3.8.0 (M9: Server Implementation)
  • Parent Epic: #399

Bug Report

What Was Tested

The agents server serve CLI command and the ASGI server configuration in src/cleveragents/cli/commands/server.py.

Expected Behavior (from spec)

Per docs/specification.md §Server and Client Architecture:

CORS Configuration: Cross-Origin Resource Sharing (CORS) is configured to allow web-based clients to interact with the server from different origins. The server's CORS policy is configurable to allow for flexible and secure cross-origin communication.

The spec also states:

server.cors.origins: A list of allowed CORS origins.

The agents server serve command should expose a --cors-origins parameter (or equivalent) to configure CORS allowed origins when starting the ASGI server.

Actual Behavior (from test)

The agents server serve command (src/cleveragents/cli/commands/server.py) has the following parameters:

  • --host (bind address)
  • --port (bind port)
  • --workers (uvicorn workers)
  • --log-level (log level)
  • --app (ASGI app import path)

There is no --cors-origins parameter. The ASGI app (cleveragents.a2a.asgi:app) also does not include any CORS middleware. There is no way to configure CORS origins when starting the server via the CLI.

Code Location

  • src/cleveragents/cli/commands/server.pyserver_serve() function (lines ~180-230)
  • src/cleveragents/a2a/asgi.py — ASGI app (no CORS middleware)

Steps to Reproduce

  1. Run agents server serve --help
  2. Observe: no --cors-origins option is present
  3. Compare with spec requirement for configurable CORS origins

Impact

Web-based clients (browser-based UIs, IDE plugins) cannot connect to the server from different origins without CORS headers. The spec explicitly requires CORS to be configurable.

Suggested Fix

Add --cors-origins parameter to server_serve() and wire it into CORS middleware (e.g., Starlette's CORSMiddleware) when the server is started.

Subtasks

  • Add --cors-origins CLI option to server_serve() in src/cleveragents/cli/commands/server.py
  • Wire --cors-origins value into Starlette CORSMiddleware in src/cleveragents/a2a/asgi.py
  • Support comma-separated list of origins (e.g., --cors-origins "http://localhost:3000,https://app.example.com")
  • Add unit tests for the new --cors-origins parameter
  • Add integration test verifying CORS headers are present in server responses when origins are configured
  • Update CLI help text and any relevant documentation

Definition of Done

  • agents server serve --cors-origins <origins> is accepted without error
  • CORS headers are present in server responses for configured origins
  • agents server serve --help shows --cors-origins option with description
  • Unit and integration tests pass for CORS configuration
  • All nox stages pass
  • Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/m9-server-serve-cors-origins` - **Commit Message**: `fix(cli): add --cors-origins parameter to agents server serve command` - **Milestone**: v3.8.0 (M9: Server Implementation) - **Parent Epic**: #399 ## Bug Report ### What Was Tested The `agents server serve` CLI command and the ASGI server configuration in `src/cleveragents/cli/commands/server.py`. ### Expected Behavior (from spec) Per `docs/specification.md` §Server and Client Architecture: > CORS Configuration: Cross-Origin Resource Sharing (CORS) is configured to allow web-based clients to interact with the server from different origins. The server's CORS policy is configurable to allow for flexible and secure cross-origin communication. The spec also states: > `server.cors.origins`: A list of allowed CORS origins. The `agents server serve` command should expose a `--cors-origins` parameter (or equivalent) to configure CORS allowed origins when starting the ASGI server. ### Actual Behavior (from test) The `agents server serve` command (`src/cleveragents/cli/commands/server.py`) has the following parameters: - `--host` (bind address) - `--port` (bind port) - `--workers` (uvicorn workers) - `--log-level` (log level) - `--app` (ASGI app import path) There is **no** `--cors-origins` parameter. The ASGI app (`cleveragents.a2a.asgi:app`) also does not include any CORS middleware. There is no way to configure CORS origins when starting the server via the CLI. ### Code Location - `src/cleveragents/cli/commands/server.py` — `server_serve()` function (lines ~180-230) - `src/cleveragents/a2a/asgi.py` — ASGI app (no CORS middleware) ### Steps to Reproduce 1. Run `agents server serve --help` 2. Observe: no `--cors-origins` option is present 3. Compare with spec requirement for configurable CORS origins ### Impact Web-based clients (browser-based UIs, IDE plugins) cannot connect to the server from different origins without CORS headers. The spec explicitly requires CORS to be configurable. ### Suggested Fix Add `--cors-origins` parameter to `server_serve()` and wire it into CORS middleware (e.g., Starlette's `CORSMiddleware`) when the server is started. ## Subtasks - [ ] Add `--cors-origins` CLI option to `server_serve()` in `src/cleveragents/cli/commands/server.py` - [ ] Wire `--cors-origins` value into Starlette `CORSMiddleware` in `src/cleveragents/a2a/asgi.py` - [ ] Support comma-separated list of origins (e.g., `--cors-origins "http://localhost:3000,https://app.example.com"`) - [ ] Add unit tests for the new `--cors-origins` parameter - [ ] Add integration test verifying CORS headers are present in server responses when origins are configured - [ ] Update CLI help text and any relevant documentation ## Definition of Done - [ ] `agents server serve --cors-origins <origins>` is accepted without error - [ ] CORS headers are present in server responses for configured origins - [ ] `agents server serve --help` shows `--cors-origins` option with description - [ ] Unit and integration tests pass for CORS configuration - [ ] All nox stages pass - [ ] Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: ca-new-issue-creator
freemo added this to the v3.8.0 milestone 2026-04-06 07:57:06 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#399 Epic: Post-MVP Server & Clients
cleveragents/cleveragents-core
Reference
cleveragents/cleveragents-core#3964
No description provided.