agent-tool-forge 0.4.9 → 0.4.10

package/lib/auth.d.ts

@@ -7,7 +7,7 @@ export interface AuthResult {
 
 export interface AuthConfig {
   mode?: 'trust' | 'verify' | 'none';
-  signingKey?: string;
+  signingKey?: string | null;
   claimsPath?: string;
   adminToken?: string | null;
   metricsToken?: string | null;

package/lib/config-schema.js

@@ -96,11 +96,6 @@ export function validateConfig(raw = {}) {
   }
 
   // auth.mode = 'verify' requires signingKey
-  if (raw.auth?.mode === 'verify' && !raw.auth?.signingKey) {
-    errors.push('auth.signingKey is required when auth.mode is "verify"');
-  }
-
-  // verify mode always requires a signingKey
   if (raw.auth?.mode === 'verify' && !raw.auth?.signingKey) {
     errors.push('auth.signingKey is required when auth.mode is "verify". Set it in forge.config.json or via a ${ENV_VAR} reference.');
   }

package/lib/forge-service.js

@@ -328,10 +328,10 @@ export function createSidecarRouter(ctx, options = {}) {
     if (sidecarPath === '/agent-api/tools' && req.method === 'GET') {
       return handleToolsList(req, res, ctx);
     }
-    if (url.pathname.startsWith('/forge-admin/agents')) {
+    if (sidecarPath.startsWith('/forge-admin/agents')) {
       return handleAgents(req, res, ctx);
     }
-    if (url.pathname.startsWith('/forge-admin/config')) {
+    if (sidecarPath.startsWith('/forge-admin/config')) {
       return handleAdminConfig(req, res, ctx);
     }
 
@@ -341,7 +341,7 @@ export function createSidecarRouter(ctx, options = {}) {
         try {
           sendJson(res, 200, await ctx.evalStore.getEvalSummary());
         } catch (err) {
-          sendJson(res, 500, { error: 'Failed to fetch eval summary' });
+          if (!res.headersSent) sendJson(res, 500, { error: 'Failed to fetch eval summary' });
         }
       } else if (ctx.db) {
         try {
@@ -367,7 +367,7 @@ export function createSidecarRouter(ctx, options = {}) {
         try {
           sendJson(res, 200, await ctx.evalStore.listRuns(limit, offset));
         } catch (err) {
-          sendJson(res, 500, { error: 'Failed to fetch eval runs' });
+          if (!res.headersSent) sendJson(res, 500, { error: 'Failed to fetch eval runs' });
         }
       } else if (ctx.db) {
         try {
@@ -383,7 +383,7 @@ export function createSidecarRouter(ctx, options = {}) {
     }
 
     // ── Widget static file serving ─────────────────────────────────────────
-    if (url.pathname.startsWith('/widget/')) {
+    if (sidecarPath.startsWith('/widget/')) {
       serveWidgetFile(req, res, widgetDir, sendJson);
       return;
     }
@@ -661,10 +661,22 @@ function createDirectServer() {
       if (sidecarPath === '/agent-api/tools' && req.method === 'GET') {
         return handleToolsList(req, res, sidecarCtx);
       }
-      if (url.pathname.startsWith('/forge-admin/agents')) {
+      if (sidecarPath.startsWith('/forge-admin/agents')) {
+        const authCheck = applyRouteAuth(req, sidecarCtx, 2);
+        if (!authCheck.ok) {
+          if (authCheck.status === 401) res.setHeader('WWW-Authenticate', 'Bearer');
+          json(res, authCheck.status, { error: authCheck.error });
+          return;
+        }
         return handleAgents(req, res, sidecarCtx);
       }
-      if (url.pathname.startsWith('/forge-admin/config')) {
+      if (sidecarPath.startsWith('/forge-admin/config')) {
+        const authCheck = applyRouteAuth(req, sidecarCtx, 2);
+        if (!authCheck.ok) {
+          if (authCheck.status === 401) res.setHeader('WWW-Authenticate', 'Bearer');
+          json(res, authCheck.status, { error: authCheck.error });
+          return;
+        }
         return handleAdminConfig(req, res, sidecarCtx);
       }
     }

package/lib/sidecar.js

@@ -155,7 +155,7 @@ export async function createSidecar(config = {}, options = {}) {
 
 // Re-exports for advanced consumers
 export { buildSidecarContext, createSidecarRouter } from './forge-service.js';
-export { createAuth } from './auth.js';
+export { createAuth, resolveSecret, authenticateAdmin } from './auth.js';
 export { reactLoop } from './react-engine.js';
 export { mergeDefaults, validateConfig, CONFIG_DEFAULTS } from './config-schema.js';
 export { getDb } from './db.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-tool-forge",
-  "version": "0.4.9",
+  "version": "0.4.10",
   "description": "Production LLM agent sidecar + Claude Code skill library for building, testing, and running tool-calling agents.",
   "keywords": [
     "llm",