diff --git a/frontend/src/a2a.js b/frontend/src/a2a.js
index 498212a..63c5727 100644
--- a/frontend/src/a2a.js
+++ b/frontend/src/a2a.js
@@ -1,11 +1,22 @@
 export const CONFIG_URL = import.meta.env.DEV ? "/config.json" : "./config.json";
+const MAX_CSV_BYTES = 64 * 1024;
 
 export async function requestJson(url, init = {}) {
   const response = await fetch(url, { credentials: "same-origin", ...init });
   const text = await response.text();
-  const data = text ? JSON.parse(text) : null;
+  let data = null;
+  try {
+    data = text ? JSON.parse(text) : null;
+  } catch {
+    throw new Error("The agent returned a non-JSON response.");
+  }
   if (!response.ok) {
-    const detail = data && (data.detail || data.message);
+    if (response.status === 401) {
+      const err = new Error("session_expired");
+      err.status = 401;
+      throw err;
+    }
+    const detail = data && (data.detail || data.message || data.error);
     throw new Error(detail || `request failed: ${response.status}`);
   }
   return data;
@@ -20,66 +31,52 @@ export async function loadSession(config) {
 }
 
 export function signInUrl(config) {
-  // Always prefer authorizeUrl. The dashboard's login cookie is host-locked to
-  // the dashboard's own origin, so sending the browser straight to loginUrl
-  // signs the user in *there* and bounces back here still signed out.
-  // authorizeUrl hands this origin a code it trades for its own session.
   const target = config.auth?.authorizeUrl || config.auth?.loginUrl;
   if (!target) return null;
-  const next = encodeURIComponent(
-    window.location.pathname + window.location.search + window.location.hash,
-  );
+  const next = encodeURIComponent(window.location.pathname + window.location.search + window.location.hash);
   return `${target}${target.includes("?") ? "&" : "?"}next=${next}`;
 }
 
-export async function requireSession(config) {
-  const session = await loadSession(config);
-  if (!session?.authenticated) {
-    const target = signInUrl(config);
-    if (target) window.location.assign(target);
-    throw new Error("sign in required");
-  }
-  return session;
-}
-
 export async function callSkill(config, skillName, args) {
-  if (config.auth?.invokeRequiresSession) {
-    await requireSession(config);
-  }
-  return requestJson(
-    `${config.endpoints.invoke}/${encodeURIComponent(skillName)}`,
-    {
+  try {
+    return await requestJson(`${config.endpoints.invoke}/${encodeURIComponent(skillName)}`, {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ arguments: args }),
-    },
-  );
-}
-
-export function sampleValue(schema) {
-  if (!schema || typeof schema !== "object") return null;
-  if ("default" in schema) return schema.default;
-  if ("const" in schema) return schema.const;
-  if (Array.isArray(schema.enum) && schema.enum.length) return schema.enum[0];
-  const type = Array.isArray(schema.type)
-    ? schema.type.find((item) => item !== "null") || schema.type[0]
-    : schema.type;
-  if (type === "array") return [];
-  if (type === "boolean") return false;
-  if (type === "integer" || type === "number") return 0;
-  if (type === "string") return "";
-  const props = schema.properties || {};
-  if (type === "object" || Object.keys(props).length) {
-    const required = Array.isArray(schema.required) ? schema.required : Object.keys(props);
-    return Object.fromEntries(
-      required.map((key) => [key, sampleValue(props[key])]),
-    );
+    });
+  } catch (err) {
+    if (err.status === 401) {
+      const target = signInUrl(config);
+      if (target) window.location.assign(target);
+      throw new Error("Your session expired. Sign in again to run CSVAnswers.");
+    }
+    throw err;
   }
-  return null;
 }
 
-export function sampleArgs(skill) {
-  const schema = skill?.input_schema || skill?.inputSchema || {};
-  const value = sampleValue(schema);
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+export function unwrapA2AResult(response) {
+  if (!response || typeof response !== "object") return response;
+  if ("result" in response) return response.result;
+  if ("output" in response) return response.output;
+  return response;
 }
+
+export async function fileToBrowserUpload(file) {
+  if (!file) return null;
+  if (file.size > MAX_CSV_BYTES) {
+    throw new Error(`CSV upload must be at most ${Math.round(MAX_CSV_BYTES / 1024)} KB.`);
+  }
+  const buffer = await file.arrayBuffer();
+  let binary = "";
+  const bytes = new Uint8Array(buffer);
+  for (let i = 0; i < bytes.length; i += 1) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return {
+    filename: file.name || "upload.csv",
+    media_type: file.type || "text/csv",
+    data_base64: btoa(binary),
+  };
+}
+
+export { MAX_CSV_BYTES };