agentstudio 0.1.18 → 0.1.21

package/middleware/a2aAuth.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * A2A Authentication Middleware
+ *
+ * Validates API keys for all A2A protocol endpoints.
+ * Extracts API key from Authorization header, resolves a2aAgentId to projectId,
+ * and validates the key against project's API key registry.
+ *
+ * Usage: Apply to all routes under /a2a/:a2aAgentId/*
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.a2aAuth = a2aAuth;
+exports.optionalA2AAuth = optionalA2AAuth;
+const agentMappingService_js_1 = require("../services/a2a/agentMappingService.js");
+const apiKeyService_js_1 = require("../services/a2a/apiKeyService.js");
+/**
+ * A2A Authentication Middleware
+ *
+ * Steps:
+ * 1. Extract API key from Authorization header
+ * 2. Resolve a2aAgentId from URL params to projectId/agentType
+ * 3. Validate API key against project's API key registry
+ * 4. Attach A2A context to request object
+ */
+async function a2aAuth(req, res, next) {
+    try {
+        // Step 1: Extract API key from Authorization header
+        const authHeader = req.headers.authorization;
+        if (!authHeader) {
+            res.status(401).json({
+                error: 'Missing Authorization header',
+                code: 'MISSING_AUTH_HEADER',
+                message: 'A2A endpoints require API key authentication. Include: Authorization: Bearer <api-key>',
+            });
+            return;
+        }
+        if (!authHeader.startsWith('Bearer ')) {
+            res.status(401).json({
+                error: 'Invalid Authorization header format',
+                code: 'INVALID_AUTH_FORMAT',
+                message: 'Authorization header must use Bearer scheme: Authorization: Bearer <api-key>',
+            });
+            return;
+        }
+        const apiKey = authHeader.substring(7); // Remove 'Bearer ' prefix
+        if (!apiKey) {
+            res.status(401).json({
+                error: 'Empty API key',
+                code: 'EMPTY_API_KEY',
+                message: 'API key cannot be empty',
+            });
+            return;
+        }
+        // Step 2: Resolve a2aAgentId to projectId/agentType
+        const a2aAgentId = req.params.a2aAgentId;
+        if (!a2aAgentId) {
+            res.status(400).json({
+                error: 'Missing a2aAgentId in URL',
+                code: 'MISSING_AGENT_ID',
+                message: 'A2A agent ID must be specified in URL path: /a2a/:a2aAgentId/...',
+            });
+            return;
+        }
+        const agentMapping = await (0, agentMappingService_js_1.resolveA2AId)(a2aAgentId);
+        if (!agentMapping) {
+            res.status(404).json({
+                error: 'Agent not found',
+                code: 'AGENT_NOT_FOUND',
+                message: `No agent found with A2A ID: ${a2aAgentId}`,
+            });
+            return;
+        }
+        // Step 3: Validate API key against project's API key registry
+        // Use workingDirectory as the path for API key storage, not projectId
+        const { projectId, workingDirectory } = agentMapping;
+        const validation = await (0, apiKeyService_js_1.validateApiKey)(workingDirectory, apiKey);
+        if (!validation.valid) {
+            // Log failed authentication attempt (for security monitoring)
+            console.warn('[A2A Auth] Failed authentication attempt:', {
+                a2aAgentId,
+                projectId,
+                workingDirectory,
+                timestamp: new Date().toISOString(),
+                ip: req.ip,
+            });
+            res.status(401).json({
+                error: 'Invalid API key',
+                code: 'INVALID_API_KEY',
+                message: 'The provided API key is invalid or has been revoked',
+            });
+            return;
+        }
+        // Step 4: Attach A2A context to request
+        req.a2aContext = {
+            a2aAgentId,
+            projectId: agentMapping.projectId,
+            agentType: agentMapping.agentType,
+            workingDirectory: agentMapping.workingDirectory,
+            apiKeyId: validation.keyId,
+        };
+        // Log successful authentication (for monitoring)
+        console.info('[A2A Auth] Successful authentication:', {
+            a2aAgentId,
+            projectId: agentMapping.projectId,
+            agentType: agentMapping.agentType,
+            keyId: validation.keyId,
+            timestamp: new Date().toISOString(),
+        });
+        next();
+    }
+    catch (error) {
+        console.error('[A2A Auth] Authentication error:', error);
+        res.status(500).json({
+            error: 'Authentication error',
+            code: 'AUTH_ERROR',
+            message: 'An error occurred during authentication',
+        });
+    }
+}
+/**
+ * Optional middleware to allow unauthenticated access (for public endpoints like health checks)
+ * This should be used sparingly - most A2A endpoints should require authentication
+ */
+function optionalA2AAuth(req, res, next) {
+    // If Authorization header is present, validate it
+    if (req.headers.authorization) {
+        a2aAuth(req, res, next);
+    }
+    else {
+        // Otherwise, continue without authentication
+        next();
+    }
+}
+//# sourceMappingURL=a2aAuth.js.map

package/middleware/a2aAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"a2aAuth.js","sourceRoot":"","sources":["../../src/middleware/a2aAuth.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AA4BH,0BA4GC;AAMD,0CAQC;AAnJD,mFAAsE;AACtE,uEAAkE;AAelE;;;;;;;;GAQG;AACI,KAAK,UAAU,OAAO,CAAC,GAAe,EAAE,GAAa,EAAE,IAAkB;IAC9E,IAAI,CAAC;QACH,oDAAoD;QACpD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAE7C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,8BAA8B;gBACrC,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,wFAAwF;aAClG,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,qCAAqC;gBAC5C,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,8EAA8E;aACxF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;QAElE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,yBAAyB;aACnC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oDAAoD;QACpD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC;QAEzC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,2BAA2B;gBAClC,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,kEAAkE;aAC5E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAA,qCAAY,EAAC,UAAU,CAAC,CAAC;QAEpD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,+BAA+B,UAAU,EAAE;aACrD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,8DAA8D;QAC9D,sEAAsE;QACtE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,IAAA,iCAAc,EAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAElE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,8DAA8D;YAC9D,OAAO,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACxD,UAAU;gBACV,SAAS;gBACT,gBAAgB;gBAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,EAAE,EAAE,GAAG,CAAC,EAAE;aACX,CAAC,CAAC;YAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,wCAAwC;QACxC,GAAG,CAAC,UAAU,GAAG;YACf,UAAU;YACV,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,QAAQ,EAAE,UAAU,CAAC,KAAM;SAC5B,CAAC;QAEF,iDAAiD;QACjD,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE;YACpD,UAAU;YACV,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QAEH,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAEzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,sBAAsB;YAC7B,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,GAAe,EAAE,GAAa,EAAE,IAAkB;IAChF,kDAAkD;IAClD,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,6CAA6C;QAC7C,IAAI,EAAE,CAAC;IACT,CAAC;AACH,CAAC"}

package/{backend/dist/middleware → middleware}/auth.d.ts

@@ -1,7 +1,9 @@
 import { Request, Response, NextFunction } from 'express';
 /**
  * Middleware to authenticate requests using JWT token
- * Expects token in Authorization header as "Bearer <token>"
+ * Supports:
+ * 1. Authorization header as "Bearer <token>"
+ * 2. Query parameter "token=<token>" (for EventSource/SSE connections)
  */
 export declare function authMiddleware(req: Request, res: Response, next: NextFunction): void;
 //# sourceMappingURL=auth.d.ts.map

package/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG1D;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CA6BpF"}

package/middleware/auth.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authMiddleware = authMiddleware;
+const jwt_1 = require("../utils/jwt");
+/**
+ * Middleware to authenticate requests using JWT token
+ * Supports:
+ * 1. Authorization header as "Bearer <token>"
+ * 2. Query parameter "token=<token>" (for EventSource/SSE connections)
+ */
+function authMiddleware(req, res, next) {
+    const authHeader = req.headers.authorization;
+    const queryToken = req.query.token;
+    let token;
+    // Check Authorization header first
+    if (authHeader && authHeader.startsWith('Bearer ')) {
+        token = authHeader.substring(7); // Remove "Bearer " prefix
+    }
+    // Fall back to query parameter (for EventSource/SSE)
+    else if (queryToken) {
+        token = queryToken;
+    }
+    if (!token) {
+        res.status(401).json({ error: 'Unauthorized: No token provided' });
+        return;
+    }
+    const payload = (0, jwt_1.verifyToken)(token);
+    if (!payload) {
+        res.status(401).json({ error: 'Unauthorized: Invalid or expired token' });
+        return;
+    }
+    // Token is valid, proceed to next middleware
+    next();
+}
+//# sourceMappingURL=auth.js.map

package/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":";;AASA,wCA6BC;AArCD,sCAA2C;AAE3C;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC5E,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,KAA2B,CAAC;IAEzD,IAAI,KAAyB,CAAC;IAE9B,mCAAmC;IACnC,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;IAC7D,CAAC;IACD,qDAAqD;SAChD,IAAI,UAAU,EAAE,CAAC;QACpB,KAAK,GAAG,UAAU,CAAC;IACrB,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,iBAAW,EAAC,KAAK,CAAC,CAAC;IAEnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,6CAA6C;IAC7C,IAAI,EAAE,CAAC;AACT,CAAC"}

package/middleware/httpsOnly.d.ts

@@ -0,0 +1,38 @@
+/**
+ * HTTPS Enforcement Middleware
+ *
+ * Ensures that A2A endpoints are only accessible over HTTPS in production.
+ * This prevents man-in-the-middle attacks and protects API keys in transit.
+ *
+ * Phase 10 (Polish): T089 - HTTPS enforcement middleware for production
+ *
+ * Note: IP address access is exempt from HTTPS requirement, as these are typically
+ * internal/development access patterns or behind reverse proxies like Nginx.
+ */
+import type { Request, Response, NextFunction } from 'express';
+/**
+ * Check if a hostname is an IP address (IPv4 or IPv6)
+ *
+ * @param hostname - The hostname to check
+ * @returns true if the hostname is an IP address
+ */
+export declare function isIPAddress(hostname: string): boolean;
+/**
+ * Middleware to enforce HTTPS for specific routes in production
+ * Exempt: IP address access (internal/development patterns)
+ *
+ * @param req - Express request object
+ * @param res - Express response object
+ * @param next - Express next function
+ */
+export declare function httpsOnly(req: Request, res: Response, next: NextFunction): any;
+/**
+ * Middleware to enforce HTTPS and redirect HTTP to HTTPS
+ * Use this for user-facing pages that should redirect
+ *
+ * @param req - Express request object
+ * @param res - Express response object
+ * @param next - Express next function
+ */
+export declare function httpsRedirect(req: Request, res: Response, next: NextFunction): any;
+//# sourceMappingURL=httpsOnly.d.ts.map

package/middleware/httpsOnly.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpsOnly.d.ts","sourceRoot":"","sources":["../../src/middleware/httpsOnly.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CA6BrD;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,GAAG,CA6B9E;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,GAAG,CAmBlF"}

package/middleware/httpsOnly.js

@@ -0,0 +1,105 @@
+"use strict";
+/**
+ * HTTPS Enforcement Middleware
+ *
+ * Ensures that A2A endpoints are only accessible over HTTPS in production.
+ * This prevents man-in-the-middle attacks and protects API keys in transit.
+ *
+ * Phase 10 (Polish): T089 - HTTPS enforcement middleware for production
+ *
+ * Note: IP address access is exempt from HTTPS requirement, as these are typically
+ * internal/development access patterns or behind reverse proxies like Nginx.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isIPAddress = isIPAddress;
+exports.httpsOnly = httpsOnly;
+exports.httpsRedirect = httpsRedirect;
+/**
+ * Check if a hostname is an IP address (IPv4 or IPv6)
+ *
+ * @param hostname - The hostname to check
+ * @returns true if the hostname is an IP address
+ */
+function isIPAddress(hostname) {
+    if (!hostname)
+        return false;
+    // Remove port if present
+    const hostWithoutPort = hostname.split(':')[0];
+    // IPv4 pattern: xxx.xxx.xxx.xxx
+    const ipv4Pattern = /^(\d{1,3}\.){3}\d{1,3}$/;
+    if (ipv4Pattern.test(hostWithoutPort)) {
+        // Validate each octet is 0-255
+        const octets = hostWithoutPort.split('.');
+        return octets.every((octet) => {
+            const num = parseInt(octet, 10);
+            return num >= 0 && num <= 255;
+        });
+    }
+    // IPv6 patterns (simplified check for common formats)
+    // Full IPv6: xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx
+    // Compressed IPv6: ::1, ::ffff:192.0.2.1, etc.
+    const ipv6Pattern = /^([0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}$/;
+    const ipv6LoopbackPattern = /^::1$/;
+    const ipv6MappedPattern = /^::ffff:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/i;
+    return (ipv6Pattern.test(hostWithoutPort) ||
+        ipv6LoopbackPattern.test(hostWithoutPort) ||
+        ipv6MappedPattern.test(hostWithoutPort));
+}
+/**
+ * Middleware to enforce HTTPS for specific routes in production
+ * Exempt: IP address access (internal/development patterns)
+ *
+ * @param req - Express request object
+ * @param res - Express response object
+ * @param next - Express next function
+ */
+function httpsOnly(req, res, next) {
+    // Only enforce HTTPS in production
+    if (process.env.NODE_ENV !== 'production') {
+        return next();
+    }
+    // Allow IP address access without HTTPS (internal/proxy scenarios)
+    const host = req.get('host') || '';
+    if (isIPAddress(host)) {
+        return next();
+    }
+    // Check if request is secure (HTTPS)
+    // req.secure checks for req.protocol === 'https'
+    // Also check X-Forwarded-Proto header for proxy/load balancer scenarios
+    const isSecure = req.secure ||
+        req.headers['x-forwarded-proto'] === 'https' ||
+        req.headers['x-forwarded-proto']?.includes('https');
+    if (!isSecure) {
+        return res.status(403).json({
+            error: 'HTTPS required',
+            code: 'HTTPS_REQUIRED',
+            message: 'This endpoint requires HTTPS connection in production environment',
+        });
+    }
+    next();
+}
+/**
+ * Middleware to enforce HTTPS and redirect HTTP to HTTPS
+ * Use this for user-facing pages that should redirect
+ *
+ * @param req - Express request object
+ * @param res - Express response object
+ * @param next - Express next function
+ */
+function httpsRedirect(req, res, next) {
+    // Only enforce HTTPS in production
+    if (process.env.NODE_ENV !== 'production') {
+        return next();
+    }
+    // Check if request is secure
+    const isSecure = req.secure ||
+        req.headers['x-forwarded-proto'] === 'https' ||
+        req.headers['x-forwarded-proto']?.includes('https');
+    if (!isSecure) {
+        // Redirect to HTTPS
+        const httpsUrl = `https://${req.get('host')}${req.originalUrl}`;
+        return res.redirect(301, httpsUrl);
+    }
+    next();
+}
+//# sourceMappingURL=httpsOnly.js.map

package/middleware/httpsOnly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpsOnly.js","sourceRoot":"","sources":["../../src/middleware/httpsOnly.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAUH,kCA6BC;AAUD,8BA6BC;AAUD,sCAmBC;AAvGD;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,QAAgB;IAC1C,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,yBAAyB;IACzB,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,gCAAgC;IAChC,MAAM,WAAW,GAAG,yBAAyB,CAAC;IAC9C,IAAI,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,+BAA+B;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAChC,OAAO,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,sDAAsD;IACtD,qDAAqD;IACrD,+CAA+C;IAC/C,MAAM,WAAW,GAAG,4CAA4C,CAAC;IACjE,MAAM,mBAAmB,GAAG,OAAO,CAAC;IACpC,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;IAEzE,OAAO,CACL,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;QACjC,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC;QACzC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,SAAS,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACvE,mCAAmC;IACnC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,mEAAmE;IACnE,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,qCAAqC;IACrC,iDAAiD;IACjD,wEAAwE;IACxE,MAAM,QAAQ,GACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO;QAC5C,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,KAAK,EAAE,gBAAgB;YACvB,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,mEAAmE;SAC7E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,aAAa,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC3E,mCAAmC;IACnC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,6BAA6B;IAC7B,MAAM,QAAQ,GACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO;QAC5C,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,oBAAoB;QACpB,MAAM,QAAQ,GAAG,WAAW,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC"}

package/middleware/rateLimiting.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Rate Limiting Middleware for A2A Endpoints
+ *
+ * Limits requests to 100 per hour per API key to prevent abuse.
+ * Returns 429 Too Many Requests with retryAfter header when limit exceeded.
+ *
+ * Uses in-memory storage (resets on server restart).
+ */
+import rateLimit from 'express-rate-limit';
+/**
+ * Rate limiter configuration for A2A endpoints
+ *
+ * - Window: 1 hour (60 minutes)
+ * - Max requests: 100 per window
+ * - Key generator: Uses API key from a2aContext (set by a2aAuth middleware)
+ * - Response: 429 with retryAfter header
+ */
+export declare const a2aRateLimiter: import("express-rate-limit").RateLimitRequestHandler;
+/**
+ * Stricter rate limiter for sensitive operations (e.g., task creation)
+ *
+ * - Window: 1 hour
+ * - Max requests: 50 per window
+ */
+export declare const a2aStrictRateLimiter: import("express-rate-limit").RateLimitRequestHandler;
+/**
+ * Custom rate limiter factory for flexible configuration
+ *
+ * @param options - Rate limiter options
+ * @returns Configured rate limiter middleware
+ */
+export declare function createA2ARateLimiter(options: {
+    windowMs?: number;
+    max?: number;
+    message?: string;
+}): ReturnType<typeof rateLimit>;
+//# sourceMappingURL=rateLimiting.d.ts.map

package/middleware/rateLimiting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimiting.d.ts","sourceRoot":"","sources":["../../src/middleware/rateLimiting.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,SAAS,MAAM,oBAAoB,CAAC;AAI3C;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,sDAkDzB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,sDAiB/B,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAqB/B"}

package/middleware/rateLimiting.js

@@ -0,0 +1,118 @@
+"use strict";
+/**
+ * Rate Limiting Middleware for A2A Endpoints
+ *
+ * Limits requests to 100 per hour per API key to prevent abuse.
+ * Returns 429 Too Many Requests with retryAfter header when limit exceeded.
+ *
+ * Uses in-memory storage (resets on server restart).
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.a2aStrictRateLimiter = exports.a2aRateLimiter = void 0;
+exports.createA2ARateLimiter = createA2ARateLimiter;
+const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
+/**
+ * Rate limiter configuration for A2A endpoints
+ *
+ * - Window: 1 hour (60 minutes)
+ * - Max requests: 100 per window
+ * - Key generator: Uses API key from a2aContext (set by a2aAuth middleware)
+ * - Response: 429 with retryAfter header
+ */
+exports.a2aRateLimiter = (0, express_rate_limit_1.default)({
+    // Rate limit window (1 hour)
+    windowMs: 60 * 60 * 1000, // 60 minutes
+    // Maximum requests per window
+    max: 100,
+    // Use API key as identifier (from a2aContext set by auth middleware)
+    keyGenerator: (req) => {
+        const a2aReq = req;
+        // If a2aContext is available, use API key ID
+        if (a2aReq.a2aContext?.apiKeyId) {
+            return a2aReq.a2aContext.apiKeyId;
+        }
+        // Fallback to IP address if no API key (shouldn't happen with auth middleware)
+        return req.ip || 'unknown';
+    },
+    // Standardized error response
+    handler: (req, res) => {
+        const a2aReq = req;
+        const keyId = a2aReq.a2aContext?.apiKeyId || 'unknown';
+        console.warn('[A2A Rate Limit] Rate limit exceeded:', {
+            keyId,
+            projectId: a2aReq.a2aContext?.projectId,
+            a2aAgentId: a2aReq.a2aContext?.a2aAgentId,
+            ip: req.ip,
+            timestamp: new Date().toISOString(),
+        });
+        res.status(429).json({
+            error: 'Rate limit exceeded',
+            code: 'RATE_LIMIT_EXCEEDED',
+            message: 'Too many requests. Maximum 100 requests per hour per API key.',
+            retryAfter: 3600, // 1 hour in seconds
+        });
+    },
+    // Skip successful requests from rate limit counting (only count actual processing)
+    skip: (req) => {
+        // Don't skip any requests - count all attempts
+        return false;
+    },
+    // Include rate limit info in response headers
+    standardHeaders: true, // Return rate limit info in `RateLimit-*` headers
+    legacyHeaders: false, // Disable `X-RateLimit-*` headers
+});
+/**
+ * Stricter rate limiter for sensitive operations (e.g., task creation)
+ *
+ * - Window: 1 hour
+ * - Max requests: 50 per window
+ */
+exports.a2aStrictRateLimiter = (0, express_rate_limit_1.default)({
+    windowMs: 60 * 60 * 1000, // 1 hour
+    max: 50, // Stricter limit
+    keyGenerator: (req) => {
+        const a2aReq = req;
+        return a2aReq.a2aContext?.apiKeyId || req.ip || 'unknown';
+    },
+    handler: (req, res) => {
+        res.status(429).json({
+            error: 'Rate limit exceeded',
+            code: 'RATE_LIMIT_EXCEEDED',
+            message: 'Too many task creation requests. Maximum 50 per hour per API key.',
+            retryAfter: 3600,
+        });
+    },
+    standardHeaders: true,
+    legacyHeaders: false,
+});
+/**
+ * Custom rate limiter factory for flexible configuration
+ *
+ * @param options - Rate limiter options
+ * @returns Configured rate limiter middleware
+ */
+function createA2ARateLimiter(options) {
+    const { windowMs = 60 * 60 * 1000, max = 100, message = 'Rate limit exceeded' } = options;
+    return (0, express_rate_limit_1.default)({
+        windowMs,
+        max,
+        keyGenerator: (req) => {
+            const a2aReq = req;
+            return a2aReq.a2aContext?.apiKeyId || req.ip || 'unknown';
+        },
+        handler: (req, res) => {
+            res.status(429).json({
+                error: 'Rate limit exceeded',
+                code: 'RATE_LIMIT_EXCEEDED',
+                message,
+                retryAfter: Math.ceil(windowMs / 1000),
+            });
+        },
+        standardHeaders: true,
+        legacyHeaders: false,
+    });
+}
+//# sourceMappingURL=rateLimiting.js.map

package/middleware/rateLimiting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimiting.js","sourceRoot":"","sources":["../../src/middleware/rateLimiting.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;AAiGH,oDAyBC;AAxHD,4EAA2C;AAI3C;;;;;;;GAOG;AACU,QAAA,cAAc,GAAG,IAAA,4BAAS,EAAC;IACtC,6BAA6B;IAC7B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IAEvC,8BAA8B;IAC9B,GAAG,EAAE,GAAG;IAER,qEAAqE;IACrE,YAAY,EAAE,CAAC,GAAY,EAAU,EAAE;QACrC,MAAM,MAAM,GAAG,GAAiB,CAAC;QAEjC,6CAA6C;QAC7C,IAAI,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QACpC,CAAC;QAED,+EAA+E;QAC/E,OAAO,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;IAC7B,CAAC;IAED,8BAA8B;IAC9B,OAAO,EAAE,CAAC,GAAY,EAAE,GAAa,EAAQ,EAAE;QAC7C,MAAM,MAAM,GAAG,GAAiB,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,QAAQ,IAAI,SAAS,CAAC;QAEvD,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE;YACpD,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS;YACvC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU;YACzC,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,qBAAqB;YAC5B,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,+DAA+D;YACxE,UAAU,EAAE,IAAI,EAAE,oBAAoB;SACvC,CAAC,CAAC;IACL,CAAC;IAED,mFAAmF;IACnF,IAAI,EAAE,CAAC,GAAY,EAAW,EAAE;QAC9B,+CAA+C;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8CAA8C;IAC9C,eAAe,EAAE,IAAI,EAAE,kDAAkD;IACzE,aAAa,EAAE,KAAK,EAAE,kCAAkC;CACzD,CAAC,CAAC;AAEH;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG,IAAA,4BAAS,EAAC;IAC5C,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS;IACnC,GAAG,EAAE,EAAE,EAAE,iBAAiB;IAC1B,YAAY,EAAE,CAAC,GAAY,EAAU,EAAE;QACrC,MAAM,MAAM,GAAG,GAAiB,CAAC;QACjC,OAAO,MAAM,CAAC,UAAU,EAAE,QAAQ,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,CAAC,GAAY,EAAE,GAAa,EAAQ,EAAE;QAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,qBAAqB;YAC5B,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,mEAAmE;YAC5E,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IACD,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;CACrB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAgB,oBAAoB,CAAC,OAIpC;IACC,MAAM,EAAE,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,GAAG,EAAE,OAAO,GAAG,qBAAqB,EAAE,GAAG,OAAO,CAAC;IAE1F,OAAO,IAAA,4BAAS,EAAC;QACf,QAAQ;QACR,GAAG;QACH,YAAY,EAAE,CAAC,GAAY,EAAU,EAAE;YACrC,MAAM,MAAM,GAAG,GAAiB,CAAC;YACjC,OAAO,MAAM,CAAC,UAAU,EAAE,QAAQ,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC5D,CAAC;QACD,OAAO,EAAE,CAAC,GAAY,EAAE,GAAa,EAAQ,EAAE;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,qBAAqB;gBAC5B,IAAI,EAAE,qBAAqB;gBAC3B,OAAO;gBACP,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;QACD,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,KAAK;KACrB,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,59 +1,64 @@
 {
   "name": "agentstudio",
-  "version": "0.1.18",
-  "description": "Claude-powered AgentStudio with React frontend and Node.js backend, built on top of Claude Code SDK",
-  "type": "module",
-  "private": false,
-  "main": "./backend/dist/index.js",
+  "version": "0.1.21",
+  "description": "AgentStudio - AI-powered agent workspace with Claude integration. One command to start your AI agent studio.",
+  "main": "index.js",
   "bin": {
-    "agentstudio": "./backend/dist/bin/agentstudio.js"
+    "agentstudio": "bin/agentstudio.js"
   },
-  "files": [
-    "backend/dist/**/*"
-  ],
   "scripts": {
-    "start": "node backend/dist/index.js",
-    "build": "node scripts/build-complete.js",
-    "build:backend": "cd backend && npm install && npm run build",
-    "build:complete": "node scripts/build-complete.js"
-  },
-  "keywords": [
-    "ai",
-    "agent",
-    "studio",
-    "editor",
-    "react",
-    "typescript"
-  ],
-  "author": "jeffkit <bbmyth@gmail.com>",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/git-men/agentstudio.git"
-  },
-  "homepage": "https://github.com/git-men/agentstudio#readme",
-  "bugs": {
-    "url": "https://github.com/git-men/agentstudio/issues"
-  },
-  "devDependencies": {
-    "concurrently": "^8.2.2",
-    "typescript": "^5.9.2"
+    "start": "node index.js",
+    "postinstall": "node scripts/postinstall.js || true"
   },
   "dependencies": {
-    "agentstudio-shared": "^0.1.0",
+    "@a2a-js/sdk": "^0.2.5",
     "@ai-sdk/anthropic": "^1.0.5",
     "@ai-sdk/openai": "^1.0.7",
-    "@anthropic-ai/claude-code": "^2.0.10",
+    "@anthropic-ai/claude-agent-sdk": "^0.1.62",
+    "@types/js-yaml": "^4.0.9",
     "ai": "^5.0.22",
+    "bcryptjs": "^2.4.3",
     "commander": "^11.1.0",
     "cors": "^2.8.5",
     "dotenv": "^16.3.1",
     "eventsource": "^4.0.0",
     "express": "^4.18.2",
+    "express-rate-limit": "^6.11.2",
     "fs-extra": "^11.1.1",
     "gray-matter": "^4.0.3",
     "helmet": "^7.0.0",
+    "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.2",
+    "node-cron": "^4.2.1",
+    "proper-lockfile": "^4.1.2",
+    "undici": "^7.16.0",
     "zod": "^3.22.2"
+  },
+  "author": "okguitar <okguitar@gmail.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/okguitar/agentstudio.git"
+  },
+  "homepage": "https://github.com/okguitar/agentstudio#readme",
+  "bugs": {
+    "url": "https://github.com/okguitar/agentstudio/issues"
+  },
+  "keywords": [
+    "ai",
+    "agent",
+    "studio",
+    "claude",
+    "anthropic",
+    "mcp",
+    "ai-assistant",
+    "workspace",
+    "cli"
+  ],
+  "files": [
+    "**/*"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
   }
-}
+}