@zhin.js/a2a 2.0.4 → 2.0.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -0
- package/lib/runtime.js +8 -2
- package/lib/runtime.js.map +1 -1
- package/package.json +6 -6
- package/src/runtime.ts +8 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,25 @@
|
|
|
1
1
|
# @zhin.js/a2a
|
|
2
2
|
|
|
3
|
+
## 2.0.5
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- d8bf702: fix: resolve GitHub security alerts (XSS, ReDoS, vulnerable dependencies)
|
|
8
|
+
|
|
9
|
+
- Sanitize URL schemes in `resolveMediaSrc` to reject `javascript:` and other dangerous protocols
|
|
10
|
+
- Replace polynomial regex patterns with loop-based `trimTrailingSlashes` to prevent ReDoS
|
|
11
|
+
- Use `String.trimEnd()` instead of `/\s*$/` regex in env text merging
|
|
12
|
+
- Fix incomplete URL substring sanitization in tests
|
|
13
|
+
- Upgrade `adm-zip` to ^0.6.0 (fixes GHSA-xcpc-8h2w-3j85)
|
|
14
|
+
- Add pnpm override to force `axios ^1.19.0` for `qq-official-bot`
|
|
15
|
+
- Update transitive dependencies via `pnpm update`
|
|
16
|
+
|
|
17
|
+
- Updated dependencies [d8bf702]
|
|
18
|
+
- @zhin.js/host-http@1.0.4
|
|
19
|
+
- @zhin.js/agent@1.0.10
|
|
20
|
+
- @zhin.js/core@1.4.3
|
|
21
|
+
- zhin.js@5.0.3
|
|
22
|
+
|
|
3
23
|
## 2.0.4
|
|
4
24
|
|
|
5
25
|
### Patch Changes
|
package/lib/runtime.js
CHANGED
|
@@ -9,7 +9,7 @@ export function installRuntimeA2a(options) {
|
|
|
9
9
|
if (options.config?.enabled === false)
|
|
10
10
|
return () => undefined;
|
|
11
11
|
const basePath = normalizePath(options.config?.path ?? '/a2a');
|
|
12
|
-
const publicBaseUrl = (options.config?.publicUrl ?? options.fallbackPublicUrl)
|
|
12
|
+
const publicBaseUrl = trimTrailingSlashes(options.config?.publicUrl ?? options.fallbackPublicUrl);
|
|
13
13
|
const token = options.config?.token ?? options.fallbackToken ?? '';
|
|
14
14
|
if (options.production === true && !token) {
|
|
15
15
|
throw new Error('A2A requires a2a.token or http.token in production');
|
|
@@ -102,8 +102,14 @@ function writeJson(response, status, body) {
|
|
|
102
102
|
});
|
|
103
103
|
response.end(payload);
|
|
104
104
|
}
|
|
105
|
+
function trimTrailingSlashes(s) {
|
|
106
|
+
let i = s.length;
|
|
107
|
+
while (i > 0 && s[i - 1] === '/')
|
|
108
|
+
i--;
|
|
109
|
+
return s.slice(0, i);
|
|
110
|
+
}
|
|
105
111
|
function normalizePath(path) {
|
|
106
112
|
const leading = path.startsWith('/') ? path : `/${path}`;
|
|
107
|
-
return leading
|
|
113
|
+
return trimTrailingSlashes(leading) || '/a2a';
|
|
108
114
|
}
|
|
109
115
|
//# sourceMappingURL=runtime.js.map
|
package/lib/runtime.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,iBAAiB,GAElB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAK9D,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAuB5C,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC
|
|
1
|
+
{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,iBAAiB,GAElB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAK9D,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAuB5C,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IACnE,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAEjC,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,KAAkB,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE7C,KAAK,MAAM,SAAS,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;YACnC,SAAS;YACT,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;YACrB,cAAc,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;SACrD,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;YACpB,IAAI;YACJ,OAAO,EAAE,IAAI,qBAAqB,CAAC,IAAI,EAAE,IAAI,iBAAiB,EAAE,EAAE,QAAQ,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,QAAQ,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;QAC7F,IAAI,KAAK,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YAC9C,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,KAAK,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE1D,OAAO,GAAG,EAAE;QACV,UAAU,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAOD,SAAS,UAAU,CAAC,QAAgB,EAAE,QAAgB;IACpD,MAAM,MAAM,GAAG,GAAG,QAAQ,GAAG,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,eAAe,eAAe,EAAE,IAAI,IAAI,KAAK,6BAA6B,EAAE,CAAC;QACxF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,SAAS;YACT,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,QAA4C,EAAE,MAAc,EAAE,IAAa;IAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE;QACzB,cAAc,EAAE,iCAAiC;QACjD,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;KACrD,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,CAAC,EAAE,CAAC;IACtC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACzD,OAAO,mBAAmB,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC;AAChD,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@zhin.js/a2a",
|
|
3
|
-
"version": "2.0.
|
|
3
|
+
"version": "2.0.5",
|
|
4
4
|
"description": "A2A Protocol server for Zhin.js — multi-agent Agent Cards and task delegation",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./lib/index.js",
|
|
@@ -37,18 +37,18 @@
|
|
|
37
37
|
"dependencies": {
|
|
38
38
|
"@a2a-js/sdk": "1.0.0-beta.0",
|
|
39
39
|
"@zhin.js/core": "1.4.3",
|
|
40
|
-
"@zhin.js/host-http": "1.0.
|
|
40
|
+
"@zhin.js/host-http": "1.0.4",
|
|
41
41
|
"@zhin.js/logger": "1.0.75"
|
|
42
42
|
},
|
|
43
43
|
"peerDependencies": {
|
|
44
|
-
"@zhin.js/agent": "1.0.
|
|
44
|
+
"@zhin.js/agent": "1.0.10",
|
|
45
45
|
"zhin.js": "5.0.3"
|
|
46
46
|
},
|
|
47
47
|
"devDependencies": {
|
|
48
|
-
"@types/node": "^26.1.
|
|
49
|
-
"rimraf": "^6.
|
|
48
|
+
"@types/node": "^26.1.2",
|
|
49
|
+
"rimraf": "^6.1.3",
|
|
50
50
|
"typescript": "^6.0.3",
|
|
51
|
-
"@zhin.js/agent": "1.0.
|
|
51
|
+
"@zhin.js/agent": "1.0.10",
|
|
52
52
|
"zhin.js": "5.0.3"
|
|
53
53
|
},
|
|
54
54
|
"files": [
|
package/src/runtime.ts
CHANGED
|
@@ -38,7 +38,7 @@ interface AgentStack {
|
|
|
38
38
|
export function installRuntimeA2a(options: InstallRuntimeA2aOptions): () => void {
|
|
39
39
|
if (options.config?.enabled === false) return () => undefined;
|
|
40
40
|
const basePath = normalizePath(options.config?.path ?? '/a2a');
|
|
41
|
-
const publicBaseUrl = (options.config?.publicUrl ?? options.fallbackPublicUrl)
|
|
41
|
+
const publicBaseUrl = trimTrailingSlashes(options.config?.publicUrl ?? options.fallbackPublicUrl);
|
|
42
42
|
const token = options.config?.token ?? options.fallbackToken ?? '';
|
|
43
43
|
if (options.production === true && !token) {
|
|
44
44
|
throw new Error('A2A requires a2a.token or http.token in production');
|
|
@@ -137,7 +137,13 @@ function writeJson(response: import('node:http').ServerResponse, status: number,
|
|
|
137
137
|
response.end(payload);
|
|
138
138
|
}
|
|
139
139
|
|
|
140
|
+
function trimTrailingSlashes(s: string): string {
|
|
141
|
+
let i = s.length;
|
|
142
|
+
while (i > 0 && s[i - 1] === '/') i--;
|
|
143
|
+
return s.slice(0, i);
|
|
144
|
+
}
|
|
145
|
+
|
|
140
146
|
function normalizePath(path: string): string {
|
|
141
147
|
const leading = path.startsWith('/') ? path : `/${path}`;
|
|
142
|
-
return leading
|
|
148
|
+
return trimTrailingSlashes(leading) || '/a2a';
|
|
143
149
|
}
|