release: 0.1.4 — forward cp_jwt + bucket via params._meta

On login the gateway now captures user.id from /v1/auth/login, derives
the user's MinIO bucket (user-<id>-files), and persists both in
~/.a2a/credentials.json. UpstreamAgent.callTool injects
``params._meta = { cp_jwt, cp_url, bucket }`` on every tools/call so
upstream agents see the same caller context the platform orchestrator
provides. Unauthenticated clients omit _meta — back-compat preserved.

Requires a2a-pack with the matching _meta handler in
``a2a_pack/mcp/server.py`` (companion change in apps/a2a).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/upstream.ts

@@ -12,6 +12,18 @@ export interface UpstreamConfig {
   name: string;
   url: string;
   token: string | null;
+  /** Forwarded to the upstream as ``params._meta.cp_jwt`` on tools/call.
+   *  Lets the upstream agent act on the caller's behalf (file/agent CRUD
+   *  on /v1/me/*) — same path the platform orchestrator uses. */
+  cpJwt?: string | null;
+  /** Paired with ``cpJwt``. The upstream agent uses this as the base URL
+   *  when calling back into /v1/me/*. */
+  cpUrl?: string | null;
+  /** User's MinIO bucket (``user-<id>-files``). Forwarded as
+   *  ``params._meta.bucket`` so agents that touch the workspace
+   *  (agent-builder, file tools) get a context whose
+   *  ``ctx.workspace.bucket`` resolves to the right bucket. */
+  bucket?: string | null;
 }
 
 export interface UpstreamTool {
@@ -88,9 +100,12 @@ export class UpstreamAgent {
     name: string,
     arguments_: Record<string, unknown>,
   ): Promise<UpstreamCallResult> {
-    return this.rpc<UpstreamCallResult>("tools/call", {
-      name,
-      arguments: arguments_,
-    });
+    const meta: Record<string, unknown> = {};
+    if (this.cfg.cpJwt) meta.cp_jwt = this.cfg.cpJwt;
+    if (this.cfg.cpUrl) meta.cp_url = this.cfg.cpUrl;
+    if (this.cfg.bucket) meta.bucket = this.cfg.bucket;
+    const params: Record<string, unknown> = { name, arguments: arguments_ };
+    if (Object.keys(meta).length > 0) params._meta = meta;
+    return this.rpc<UpstreamCallResult>("tools/call", params);
   }
 }