e92bbeb3f7
ctx.workspace is a property that raises PermissionError when the runtime didn't provision a workspace. The original `getattr(ctx.workspace, …)` guard didn't catch that — the property call happens before getattr can fall back. When the agent is invoked over the local MCP gateway (a2amcp), which has no grant flow, this surfaced as a 500 instead of the intended "run me through the orchestrator" message. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
agent-builder
The platform's own meta-agent. Generates, tests, and deploys new a2a-pack agents from a natural-language description.
What it does
The single build(name, prompt) skill:
- Builds an inner
deepagentsLangGraph configured with five tools:list_agent_files(name)/write_agent_file(name, path, content)/read_agent_file(name, path)— boto3 → MinIO, scoped toagents/<name>/in the caller's workspacetest_agent_in_sandbox(name)— tarballs the workspace project, spins a microVM with the publica2a-packwheel installed, runsa2a cardto verify the scaffold is validcp_deploy_tarball(name, version, public)— POSTs the tarball to/v1/agents/from-tarballon the user's behalf using their forwarded CP JWT
- Streams the graph's tool calls back to the dashboard as
agent_progressevents (so the user watches the build happen in real time, not in silence). - Returns the live URL when the new agent finishes deploying.
What it needs forwarded
Three platform-managed bits land on the inner skill via RunContext:
| Field | Source | Required? |
|---|---|---|
ctx.workspace.bucket |
grant minted by the orchestrator | yes |
ctx.llm |
caller's LLM creds (Card declares llm_provisioning=caller_provided) |
yes — the LLM bill goes to the caller |
ctx.cp_jwt |
caller's CP JWT (Card declares wants_cp_jwt=True) |
yes — used by cp_deploy_tarball |
The user opts into all three when they pick agent-builder from the
marketplace — the dashboard already surfaces these on the agent card.
Pricing
$0.10 / call, plus your LLM cost via your own provider. The deployed
agent is yours forever; subsequent invocations of YOUR agent run on
their own pricing (whatever you set when generating it).
How to call it
In the dashboard chat (Workspace tab):
use agent-builder.build to make a new agent named "csv-sanitizer" that takes a CSV path, strips whitespace from every column, deduplicates rows, and writes the cleaned file back next to the original
The orchestrator will discover agent-builder, hand off with the required forwards, you'll watch the inner deepagents scaffold + test + deploy in real time, then get a live URL.
Local dev
cd apps/agent-builder
python3 -m venv .venv
.venv/bin/pip install -e ../a2a -r requirements.txt
.venv/bin/a2a card # see what the Card looks like
.venv/bin/a2a validate
You can't run the full skill locally without a workspace bucket + CP JWT — those come from the platform at invoke time.