codex-a2a 1.2.0__tar.gz → 1.3.0__tar.gz

{codex_a2a-1.2.0 → codex_a2a-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-a2a
-Version: 1.2.0
+Version: 1.3.0
 Summary: Codex A2A runtime adapter
 Author: liujuanjuan1984@Intelligent-Internet
 License-Expression: Apache-2.0
@@ -164,7 +164,7 @@ Authenticated extended card:
 - JSON-RPC: `agent/getAuthenticatedExtendedCard`
 - HTTP: `GET /extendedAgentCard`
 
-Outbound peer auth is configured with `A2A_CLIENT_BEARER_TOKEN` or `A2A_CLIENT_BASIC_AUTH`; see the Usage Guide for the complete client-side matrix.
+Outbound peer auth is configured with `A2A_CLIENT_BEARER_TOKEN` or `A2A_CLIENT_BASIC_AUTH`; credentials are only sent to hosts listed in `A2A_CLIENT_ALLOWED_HOSTS`. The embedded `a2a_call(...)` tool also rejects private/loopback targets unless `A2A_CLIENT_ALLOW_PRIVATE_HOSTS=true`; see the Usage Guide for the complete client-side matrix.
 
 ## When To Use It
 

{codex_a2a-1.2.0 → codex_a2a-1.3.0}/README.md

@@ -117,7 +117,7 @@ Authenticated extended card:
 - JSON-RPC: `agent/getAuthenticatedExtendedCard`
 - HTTP: `GET /extendedAgentCard`
 
-Outbound peer auth is configured with `A2A_CLIENT_BEARER_TOKEN` or `A2A_CLIENT_BASIC_AUTH`; see the Usage Guide for the complete client-side matrix.
+Outbound peer auth is configured with `A2A_CLIENT_BEARER_TOKEN` or `A2A_CLIENT_BASIC_AUTH`; credentials are only sent to hosts listed in `A2A_CLIENT_ALLOWED_HOSTS`. The embedded `a2a_call(...)` tool also rejects private/loopback targets unless `A2A_CLIENT_ALLOW_PRIVATE_HOSTS=true`; see the Usage Guide for the complete client-side matrix.
 
 ## When To Use It
 

{codex_a2a-1.2.0 → codex_a2a-1.3.0}/docs/compatibility.md

@@ -101,7 +101,7 @@ Execution-environment boundary fields are also published through the runtime pro
 - Deployment-conditional methods must be declared as conditional rather than silently disappearing.
 - Rich input mapping is compatibility-sensitive across the core A2A message surface and `codex.turns.steer`. Changes to supported part types, `Part(url|raw)` image handling, or `Part(data)` mention/skill mapping should be treated as wire-level behavior changes.
 - `codex.exec.*` is compatibility-sensitive as the standalone interactive exec contract. Changes to handle shapes, task-stream delivery, or lifecycle method names should be treated as wire-level changes.
-- `codex.discovery.*` is compatibility-sensitive as the stable discovery contract for `skill.path` and `mention_path` identifiers. Changes to normalized item fields, plugin marketplace mapping, or discovery watch task payload kinds should be treated as wire-level changes.
+- `codex.discovery.*` is compatibility-sensitive as the stable discovery contract for normalized skill/app/plugin summaries and `mention_path` identifiers. Local paths (`skill.path`, marketplace paths) and raw upstream records are intentionally excluded from discovery responses; changes to normalized item fields, plugin marketplace mapping, or discovery watch task payload kinds should be treated as wire-level changes.
 - `codex.threads.*` is compatibility-sensitive as the provider-private thread lifecycle contract. Changes to lifecycle method names, watch payload kinds, or watch-task bridge event names should be treated as wire-level changes.
 - `codex.turns.*` is compatibility-sensitive as the active-turn control contract. Changes to `expected_turn_id` semantics, same-turn rich-input handling, or rejected override fields should be treated as wire-level changes.
 - `codex.review.*` is compatibility-sensitive as the review control and watch contract. Changes to supported target types, `delivery` semantics, review watch payload kinds, or review watch event names should be treated as wire-level changes.

{codex_a2a-1.2.0 → codex_a2a-1.3.0}/docs/guide.md

@@ -189,15 +189,49 @@ Use the grouped sections below as the deployment-first reading order:
 - `A2A_HOST`: bind host, default `127.0.0.1`
 - `A2A_PORT`: bind port, default `8000`
 - `A2A_PUBLIC_URL`: externally reachable A2A URL prefix, default `http://127.0.0.1:8000`
+- `A2A_ALLOWED_ORIGINS`: comma-separated extra browser-origin allowlist for inbound requests. Requests carrying an `Origin` header must match the origin of `A2A_PUBLIC_URL` or an entry here; mismatches are rejected with `403` (CSRF guard). Requests without an `Origin` header (CLI/SDK clients) are unaffected.
+- `A2A_ALLOWED_HOSTS`: comma-separated `Host` header allowlist (exact names or `*.example.com` wildcards). When configured, every inbound request must present a matching `Host` header. Binding to a non-loopback address without this allowlist logs a startup warning (DNS rebinding risk).
 - `A2A_DATABASE_URL`: SQLAlchemy async database URL. Defaults to SQLite under `${CODEX_WORKSPACE_ROOT}/.codex-a2a/codex-a2a.db`.
 - `A2A_DATABASE_URL` also owns the adapter-managed runtime-state schema lifecycle. On startup, `codex-a2a` auto-creates the runtime-state tables, records a schema version for the `runtime_state` scope, and applies in-place migrations for those tables only.
 - The adapter-managed runtime-state schema is limited to `a2a_session_bindings`, `a2a_session_owners`, `a2a_pending_session_claims`, `a2a_pending_interrupt_requests`, and `a2a_schema_version`. It does not own the A2A SDK task-store tables or any upstream Codex/provider-local state.
 - For deployment-specific durability constraints and migration-scope boundaries, see [compatibility.md](./compatibility.md).
+
+### SQLite Persistence Hardening
+
+File-backed SQLite databases are hardened at startup and on every new connection on POSIX systems:
+
+- the database file must be a regular file; symlinks are rejected and fail startup;
+- the file must be owned by the user running `codex-a2a`; a database owned by another user fails startup;
+- the database file is forced to mode `0600`, and existing SQLite sidecar files (`-wal`/`-shm`/`-journal`) are converged to the same mode;
+- the parent directory is created with mode `0700` when it does not exist; keep the `.codex-a2a` directory private (no group/world access);
+- if the database is replaced by a symlink, a special file, or a foreign-owned file while the service is running, the next connection fails closed.
+
+`A2A_DATABASE_URL` values that do not map to a plain file path are exempt: `:memory:` and `file:` URI-style database components (including in-memory shared-cache databases) are not hardened. Prefer a plain absolute file path for deployments that need the startup guarantees. Non-POSIX platforms rely on the user account ACLs of the hosting directory; the same private-directory requirement applies there.
+
+Deployment requirements:
+
+- run `codex-a2a` as a dedicated user and keep the database directory outside world-readable workspace trees;
+- do not place the SQLite file on network-mounted or sync-managed directories;
+- when migrating an existing database, fix ownership and mode before startup: `chown <service-user> <db>` and `chmod 600 <db>`, and ensure the parent directory is not group/world accessible.
+
+### Inbound Origin and Host Boundary
+
+Browsers store and automatically attach Basic credentials, and they send an `Origin` header with every request. Without an origin boundary, a malicious web page could cross-site trigger `SendMessage`, `CancelTask`, or task subscription against a Basic-protected service. The service therefore enforces:
+
+- every request carrying an `Origin` header must match the origin of `A2A_PUBLIC_URL` (scheme, host, and non-default port) or an entry in `A2A_ALLOWED_ORIGINS`; mismatches return `403` before authentication. `Origin: null` (sandboxed iframes) is rejected unless explicitly allowlisted;
+- requests without an `Origin` header — normal CLI/SDK peers — are not subject to origin checks;
+- when `A2A_ALLOWED_HOSTS` is configured, every request must present a matching `Host` header (exact names, optional `host:port`, or `*.example.com` wildcards); mismatches return `403`. This also blocks DNS rebinding, where an attacker-controlled hostname resolves to the service address and the browser sends that hostname as `Host`;
+- binding to a non-loopback address (`0.0.0.0`, `::`, or a LAN/interface address) without `A2A_ALLOWED_HOSTS` logs a startup warning: the service is then exposed to DNS rebinding and should only run behind a trusted network boundary or a reverse proxy that validates `Host`.
+
+For browser-based clients, prefer the same origin as `A2A_PUBLIC_URL`, or explicitly allow the dashboard origin via `A2A_ALLOWED_ORIGINS` and treat `A2A_ALLOWED_HOSTS` as part of the deployment contract. Basic authentication should not be relied on as the sole browser-facing boundary: combine it with the origin/host checks above, short-lived credentials, and TLS at the public URL.
+
 - `A2A_LOG_LEVEL`: `DEBUG/INFO/WARNING/ERROR`, default `WARNING`
 - `A2A_LOG_PAYLOADS`: log A2A/Codex payload bodies, default `false`
 - `A2A_LOG_BODY_LIMIT`: payload log body size limit, default `0` (no truncation)
 - `A2A_REQUEST_BODY_MAX_BYTES`: hard HTTP request body limit, default `4194304` (4 MiB); set `0` to disable
 - `A2A_MAX_CONCURRENT_OPERATIONS`: process-local active POST and task-subscription limit, default `32`; set `0` to disable
+- `A2A_RATE_LIMIT_ENABLED` / `A2A_RATE_LIMIT_WINDOW_SECONDS` / `A2A_RATE_LIMIT_MAX_REQUESTS`: per-credential sliding-window rate limiting (per-peer-IP for the unauthenticated Agent Card surface). Defaults: `true` / `60` seconds / `120` requests. Exceeding the window returns HTTP `429` with a `Retry-After` header; `A2A_RATE_LIMIT_ENABLED=false` disables the limiter. The limiter is process-local; multi-process deployments should place a shared gateway in front or rely on per-instance limits.
+- `A2A_STREAM_MAX_BYTES` / `A2A_STREAM_MAX_DURATION_SECONDS` / `A2A_STREAM_IDLE_TIMEOUT_SECONDS`: streaming (SSE) response budgets for total serialized bytes, total duration, and idle gap. Defaults: `67108864` bytes / `3600` seconds / `120` seconds; `0` disables the respective budget. When a budget is exceeded the server ends the stream with an SSE `event: error` frame; if the very first event already exceeds the budget, REST requests are rejected with HTTP `429` `RESOURCE_EXHAUSTED` before the SSE stream starts.
 - `A2A_ENABLE_METRICS_ENDPOINT`: enable the authenticated Prometheus `/metrics` endpoint, default `true`
 - `A2A_TITLE`: agent name, default `Codex A2A`
 - `A2A_DESCRIPTION`: agent description exposed on Agent Card and docs surfaces
@@ -217,6 +251,18 @@ These settings affect peer calls made through `codex-a2a call` or the embedded `
 - `A2A_CLIENT_SUPPORTED_TRANSPORTS`: comma-separated outbound transport preference list, default `JSONRPC,HTTP+JSON`
 - `A2A_CLIENT_BEARER_TOKEN`: optional bearer token for the target peer service
 - `A2A_CLIENT_BASIC_AUTH`: optional Basic auth credential for the target peer service when bearer auth is not configured
+- `A2A_CLIENT_ALLOWED_HOSTS`: comma-separated allowlist of outbound target hosts for `a2a_call(...)` (exact names or `*.example.com` wildcards). When configured, outbound calls are restricted to matching hosts, and outbound credentials (`A2A_CLIENT_BEARER_TOKEN` / `A2A_CLIENT_BASIC_AUTH`) are only sent to allowlisted hosts.
+- `A2A_CLIENT_ALLOW_PRIVATE_HOSTS`: default `false`. When `false`, outbound `a2a_call(...)` targets that resolve to private, loopback, link-local, reserved, or multicast addresses are rejected (SSRF / DNS-rebinding guard). Set to `true` only when the deployment intentionally targets A2A peers on the local network.
+
+### Outbound Network Policy
+
+The embedded `a2a_call(...)` tool lets the upstream model choose the target URL, so the adapter applies a fail-closed network policy before opening any connection:
+
+- only `http`/`https` schemes are accepted, and URLs carrying userinfo credentials are rejected;
+- when `A2A_CLIENT_ALLOWED_HOSTS` is set, the target host must match the allowlist (exact or `*.example.com` wildcard);
+- unless `A2A_CLIENT_ALLOW_PRIVATE_HOSTS=true`, the resolved addresses must be public; private/loopback/link-local/reserved addresses are rejected even when the hostname matches the allowlist (DNS rebinding defense);
+- outbound credentials are only attached to allowlisted hosts. If credentials are configured without an allowlist, they are never sent and a warning is logged;
+- the `codex-a2a call` CLI remains a manual operator action and is not subject to the allowlist, but still rejects non-http(s) schemes through the shared client URL handling.
 
 ### Upstream Codex Configuration
 
@@ -237,6 +283,7 @@ These variables are forwarded to the local `codex app-server` subprocess.
 - `A2A_ENABLE_TURN_CONTROL`: expose `codex.turns.steer` on JSON-RPC extensions, default `true`
 - `A2A_ENABLE_REVIEW_CONTROL`: expose `codex.review.start` and `codex.review.watch` on JSON-RPC extensions, default `false`
 - `A2A_ENABLE_EXEC_CONTROL`: expose `codex.exec.*` on JSON-RPC extensions, default `false`
+- `A2A_EXPOSE_WORKSPACE_ROOT_IN_CARD`: default `false`; controls whether the authenticated extended Agent Card includes the local `CODEX_WORKSPACE_ROOT` in the structured profile `runtime_context`. Keep disabled unless trusted callers explicitly need the host path.
 - `A2A_ALLOW_DIRECTORY_OVERRIDE`: allow `metadata.codex.directory` overrides within the configured workspace boundary, default `true`
 - `A2A_SESSION_CACHE_TTL_SECONDS`: in-memory TTL for session mapping, default `3600`
 - `A2A_SESSION_CACHE_MAXSIZE`: max local process session-cache entries, default `10000`
@@ -274,12 +321,20 @@ These variables are forwarded to the local `codex app-server` subprocess.
 | `A2A_HOST` | Bind host |
 | `A2A_PORT` | Bind port |
 | `A2A_PUBLIC_URL` | Public URL prefix |
+| `A2A_ALLOWED_ORIGINS` | Inbound browser-origin allowlist (CSRF guard) |
+| `A2A_ALLOWED_HOSTS` | Inbound Host allowlist (DNS rebinding guard) |
 | `A2A_DATABASE_URL` | Persistence DB URL |
 | `A2A_LOG_LEVEL` | Log level |
 | `A2A_LOG_PAYLOADS` | Log bodies |
 | `A2A_LOG_BODY_LIMIT` | Body log limit |
 | `A2A_REQUEST_BODY_MAX_BYTES` | HTTP request body limit |
 | `A2A_MAX_CONCURRENT_OPERATIONS` | Active operation capacity |
+| `A2A_RATE_LIMIT_ENABLED` | Sliding-window rate limiter toggle |
+| `A2A_RATE_LIMIT_WINDOW_SECONDS` | Rate-limit window length |
+| `A2A_RATE_LIMIT_MAX_REQUESTS` | Max requests per window per key |
+| `A2A_STREAM_MAX_BYTES` | Streaming byte budget |
+| `A2A_STREAM_MAX_DURATION_SECONDS` | Streaming duration budget |
+| `A2A_STREAM_IDLE_TIMEOUT_SECONDS` | Streaming idle timeout |
 | `A2A_TITLE` | Agent title |
 | `A2A_DESCRIPTION` | Agent description |
 | `A2A_VERSION` | Agent version |
@@ -302,6 +357,8 @@ These variables are forwarded to the local `codex app-server` subprocess.
 | `A2A_CLIENT_CARD_FETCH_TIMEOUT_SECONDS` | Card fetch timeout |
 | `A2A_CLIENT_USE_CLIENT_PREFERENCE` | Transport preference |
 | `A2A_CLIENT_SUPPORTED_TRANSPORTS` | Supported transports |
+| `A2A_CLIENT_ALLOWED_HOSTS` | Outbound host allowlist (SSRF / credential binding) |
+| `A2A_CLIENT_ALLOW_PRIVATE_HOSTS` | Allow private/loopback outbound targets |
 | `A2A_INTERRUPT_REQUEST_TTL_SECONDS` | Interrupt TTL |
 | `A2A_EXECUTION_SANDBOX_MODE` | Discovery sandbox mode |
 | `A2A_EXECUTION_SANDBOX_FILESYSTEM_SCOPE` | Discovery FS scope |
@@ -473,6 +530,7 @@ On the current npm global install layout for Linux x64, the command above resolv
 - On the core chat surface, the `application/json` input mode is intentionally narrower than arbitrary JSON: only `Part(data={"type":"mention"|"skill", ...})` is part of the declared stable contract.
 - Image input maps to upstream `turn/start.input[].type=input_image`.
 - `mention.path` and `skill.path` are forwarded verbatim. The service does not guess app or plugin identifiers from display names.
+- Discovery responses no longer expose local `skill.path` values; callers that need rich-input skill items must supply the path from their own context.
 - `local_image` is not part of the current declared stable rich-input contract.
 - Session query projections currently use the upstream Codex `session_id` as the A2A `contextId`. In that projection surface, `contextId` is the canonical session identity and the adapter does not duplicate the same value under `metadata.shared.session.id`.
 - Completed chat turns are persisted as `completed`; `input-required` is reserved for active interrupt asks that still need a reply.
@@ -654,15 +712,15 @@ This service exposes read-only Codex discovery methods through JSON-RPC:
 
 Use these methods before constructing rich input:
 
-- `skills.list` returns stable `skill.path` values
+- `skills.list` returns stable skill `name`/`scope` values; local skill paths are intentionally not exposed
 - `apps.list` returns stable `mention_path=app://<id>` values
 - `plugins.list` and `plugins.read` return stable `mention_path=plugin://<plugin>@<marketplace>` values
 
 Result-shape guidance:
 
 - use the normalized stable fields declared in Agent Card / OpenAPI first
-- inspect `codex.raw` only when you need upstream-specific fields outside the declared minimum contract
-- `plugin/list` and `plugin/read` remain upstream experimental; this service exposes a stable minimum subset plus passthrough raw payloads
+- discovery responses are whitelisted summaries; raw upstream records and local paths are intentionally excluded
+- `plugin/list` and `plugin/read` remain upstream experimental; this service exposes a stable minimum subset without raw passthrough
 
 ### Skills List (`codex.discovery.skills.list`)
 

codex_a2a-1.3.0/docs/inspection/README.md

@@ -0,0 +1,17 @@
+# Inspection Deliverables
+
+This directory records security-audit decisions and deliverables produced by
+the tracked sub-items of the system security audit ([#331]).
+
+Current contents:
+
+- [Error redaction policy](./error_redaction_policy.md) — client-facing error
+  text masking of absolute local paths (#346).
+- [Release integrity policy](./release_integrity_policy.md) — SHA256 checksum
+  manifest for published GitHub release assets (#346).
+
+Remaining audit deliverables (full security report, network surface map,
+capability graph, test plan, and architecture invariants) will be added as the
+remaining sub-items are merged.
+
+[#331]: https://github.com/liujuanjuan1984/codex-a2a/issues/331

codex_a2a-1.3.0/docs/inspection/error_redaction_policy.md

@@ -0,0 +1,56 @@
+# Error Redaction Policy
+
+## Decision
+
+Client-visible error text must never expose absolute local filesystem paths.
+All error responses that can leave the process are passed through a single
+deterministic masker (`codex_a2a.redact.redact_absolute_paths`) before
+serialization.
+
+Masked output uses the fixed placeholder `<redacted-path>`.
+
+## Boundaries covered
+
+- JSON-RPC error responses — `codex_a2a.jsonrpc.errors.adapt_jsonrpc_error`
+  (message and error metadata, including nested values).
+- REST/HTTP error bodies — `codex_a2a.jsonrpc.errors.build_http_error_body`.
+- Raw exception fallback in
+  `codex_a2a.jsonrpc.application._generate_error_response`.
+- Streaming task error messages — `codex_a2a.execution.executor._emit_error`.
+- Interactive exec session failure messages and metadata —
+  `codex_a2a.execution.exec_runtime._run_exec_session`.
+- A2A tool-call error results —
+  `codex_a2a.execution.executor._handle_a2a_call_tool`; the error text is
+  embedded in follow-up turns within the same upstream session, which session
+  queries can later expose.
+
+## Masking rules
+
+Masked:
+
+- POSIX absolute paths (`/a/b/c`).
+- Windows drive paths (`C:\a\b`, `C:/a/b`) and UNC paths (`\\server\share`).
+- `file://` URIs that embed a local path (`file:///tmp/x`, `file://C:/tmp/x`).
+- Any other slash-prefixed token (for example API route strings such as
+  `/tasks/123`) — masking is deliberately conservative; a slash-prefixed
+  token is treated as a potential path rather than risk leaking a real one.
+
+Preserved:
+
+- Remote URLs (`https://host/path`).
+- Relative paths (`a/b`, `./x`, `../y`).
+- Ordinary prose without absolute paths.
+
+## Logging policy
+
+Server-side logs intentionally retain full exception context (including
+absolute paths) for diagnosability. Logs are produced on the host that owns
+the filesystem and are not sent to clients. Any pipeline that ships logs off
+the host must apply the same redaction or restrict access before export.
+
+## Verification
+
+Unit coverage lives in `tests/test_redact.py`, with boundary tests in
+`tests/execution/test_error_redaction.py` and
+`tests/jsonrpc/test_error_redaction.py`. The masker is deterministic and
+idempotent.

codex_a2a-1.3.0/docs/inspection/release_integrity_policy.md

@@ -0,0 +1,33 @@
+# Release Integrity Policy
+
+## Decision
+
+Every GitHub Release must ship a `SHA256SUMS` checksum manifest alongside the
+wheel and sdist artifacts so consumers can verify artifact integrity
+independently of the registry.
+
+## Generation
+
+`scripts/publish_github_release.sh` regenerates `dist/SHA256SUMS` from the
+release assets at publish time, before upload:
+
+- One line per asset in `sha256sum` format: `<sha256-hex>  <basename>`.
+- Lines are sorted by basename so the manifest is deterministic.
+- The manifest itself is uploaded as a release asset and is skipped
+  idempotently when it is already present on the release.
+
+## Verification
+
+Consumers verify a downloaded release with:
+
+```bash
+sha256sum -c SHA256SUMS
+```
+
+## Scope notes
+
+Supply-chain dependency auditing is already covered separately by Dependabot
+and `pip-audit` (part of the baseline validation); this policy covers only the
+published artifact integrity gap from [#346].
+
+[#346]: https://github.com/liujuanjuan1984/codex-a2a/issues/346

{codex_a2a-1.2.0 → codex_a2a-1.3.0}/scripts/publish_github_release.sh

@@ -43,6 +43,29 @@ if [[ "${#release_assets[@]}" -eq 0 ]]; then
   exit 1
 fi
 
+checksum_manifest_name="SHA256SUMS"
+checksum_path="${dist_dir}/${checksum_manifest_name}"
+
+# Regenerate the checksum manifest for the current release assets so every
+# published artifact can be verified against the release (sha256sum -c).
+"${python_bin}" - "${checksum_path}" "${release_assets[@]}" <<'PY'
+from __future__ import annotations
+
+import hashlib
+import sys
+from pathlib import Path
+
+manifest_path = Path(sys.argv[1])
+assets = [Path(arg) for arg in sys.argv[2:]]
+lines = []
+for asset in sorted(assets, key=lambda item: item.name):
+    digest = hashlib.sha256(asset.read_bytes()).hexdigest()
+    lines.append(f"{digest}  {asset.name}")
+manifest_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+PY
+
+release_assets+=("${checksum_path}")
+
 retry() {
   local attempt=1
   local exit_code=0

{codex_a2a-1.2.0 → codex_a2a-1.3.0}/src/codex_a2a/client/manager.py

@@ -3,14 +3,18 @@
 from __future__ import annotations
 
 import asyncio
+import logging
 
 from codex_a2a.config import Settings
 from codex_a2a.contracts import extensions as extension_contracts
 
 from .client import A2AClient
 from .config import A2AClientConfig
+from .network_policy import validate_agent_url
 from .request_context import build_default_headers
 
+logger = logging.getLogger(__name__)
+
 
 class A2AClientManager:
     """Cache `A2AClient` instances by normalized agent URL."""
@@ -30,6 +34,23 @@ class A2AClientManager:
         normalized = agent_url.rstrip("/")
         if not normalized:
             raise ValueError("agent_url is required")
+        policy = await validate_agent_url(
+            normalized,
+            allowed_hosts=self._settings.a2a_client_allowed_hosts,
+            allow_private_hosts=self._settings.a2a_client_allow_private_hosts,
+        )
+        default_headers: dict[str, str] = {}
+        if policy.credentials_allowed:
+            default_headers = build_default_headers(
+                self._settings.a2a_client_bearer_token,
+                self._settings.a2a_client_basic_auth,
+            )
+        elif self._settings.a2a_client_bearer_token or self._settings.a2a_client_basic_auth:
+            logger.warning(
+                "Outbound A2A credentials are configured but host=%s is not in "
+                "A2A_CLIENT_ALLOWED_HOSTS; credentials will not be sent",
+                policy.host,
+            )
         async with self._lock:
             client = self._clients.get(normalized)
             if client is not None:
@@ -40,10 +61,7 @@ class A2AClientManager:
                     request_timeout_seconds=self._settings.a2a_client_timeout_seconds,
                     card_fetch_timeout_seconds=self._settings.a2a_client_card_fetch_timeout_seconds,
                     use_client_preference=self._settings.a2a_client_use_client_preference,
-                    default_headers=build_default_headers(
-                        self._settings.a2a_client_bearer_token,
-                        self._settings.a2a_client_basic_auth,
-                    ),
+                    default_headers=default_headers,
                     supported_transports=list(self._settings.a2a_client_supported_transports),
                     accepted_output_modes=["text/plain"],
                     extensions=[

codex_a2a-1.3.0/src/codex_a2a/client/network_policy.py

@@ -0,0 +1,156 @@
+"""Outbound A2A client network policy (SSRF guard and credential binding).
+
+The A2A client is used by the ``a2a_call`` tool, where the target URL is
+produced by the upstream model.  Without an explicit policy this creates a
+server-side request forgery surface: the adapter would happily connect to
+private/loopback/link-local addresses (cloud metadata, internal services) and
+would attach globally configured outbound credentials to any endpoint.
+
+This module centralizes the checks:
+
+- only ``http``/``https`` schemes are accepted;
+- userinfo credentials in the URL are rejected;
+- when ``A2A_CLIENT_ALLOWED_HOSTS`` is configured, the host must match the
+  allowlist (exact or ``*.example.com`` wildcard);
+- unless ``A2A_CLIENT_ALLOW_PRIVATE_HOSTS`` is set, DNS resolution results are
+  validated and private/loopback/link-local/reserved addresses are rejected
+  (this also defends against DNS rebinding at connect time);
+- outbound credentials may only be attached to hosts that match the allowlist.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import ipaddress
+import logging
+import socket
+from collections.abc import Sequence
+from dataclasses import dataclass
+from urllib.parse import urlsplit
+
+logger = logging.getLogger(__name__)
+
+_ALLOWED_SCHEMES = frozenset({"http", "https"})
+
+_Address = ipaddress.IPv4Address | ipaddress.IPv6Address
+
+
+class A2ANetworkPolicyError(ValueError):
+    """Raised when an outbound agent URL violates the network policy."""
+
+
+@dataclass(frozen=True)
+class NetworkPolicyDecision:
+    """Outcome of validating an outbound agent URL."""
+
+    host: str
+    allowed_host: bool
+    credentials_allowed: bool
+
+
+def matches_allowed_host(host: str, allowed_hosts: Sequence[str]) -> bool:
+    """Return whether ``host`` matches an allowlist entry.
+
+    Entries may be exact hostnames or ``*.example.com`` wildcards.  A wildcard
+    matches any number of subdomain labels but never the bare apex domain.
+    """
+
+    normalized = (host or "").strip().lower().rstrip(".")
+    if not normalized:
+        return False
+    for raw_entry in allowed_hosts or ():
+        entry = (raw_entry or "").strip().lower().rstrip(".")
+        if not entry:
+            continue
+        if entry.startswith("*."):
+            suffix = entry[1:]  # ".example.com"
+            apex = suffix[1:]  # "example.com"
+            if normalized != apex and normalized.endswith(suffix):
+                return True
+        elif normalized == entry:
+            return True
+    return False
+
+
+def _is_private_address(address: _Address) -> bool:
+    return bool(
+        address.is_private
+        or address.is_loopback
+        or address.is_link_local
+        or address.is_reserved
+        or address.is_multicast
+        or address.is_unspecified
+    )
+
+
+async def resolve_host_addresses(host: str) -> tuple[str, ...]:
+    """Resolve ``host`` to a de-duplicated tuple of IP address strings."""
+
+    loop = asyncio.get_running_loop()
+    try:
+        infos = await loop.getaddrinfo(host, None, type=socket.SOCK_STREAM)
+    except socket.gaierror as exc:
+        raise A2ANetworkPolicyError(f"Agent URL host could not be resolved: {host!r}") from exc
+    addresses: list[str] = []
+    for info in infos:
+        ip = str(info[4][0])
+        if ip not in addresses:
+            addresses.append(ip)
+    return tuple(addresses)
+
+
+async def validate_agent_url(
+    agent_url: str,
+    *,
+    allowed_hosts: Sequence[str] | None = None,
+    allow_private_hosts: bool = False,
+) -> NetworkPolicyDecision:
+    """Validate an outbound agent URL against the configured network policy."""
+
+    normalized = (agent_url or "").strip()
+    if not normalized:
+        raise A2ANetworkPolicyError("agent_url is required")
+
+    parsed = urlsplit(normalized)
+    scheme = (parsed.scheme or "").lower()
+    if scheme not in _ALLOWED_SCHEMES:
+        raise A2ANetworkPolicyError(
+            f"Agent URL scheme must be http or https, got {scheme or 'empty'}"
+        )
+    host = (parsed.hostname or "").strip().lower()
+    if not host:
+        raise A2ANetworkPolicyError("Agent URL must include a host")
+    if parsed.username or parsed.password:
+        raise A2ANetworkPolicyError("Agent URL must not include userinfo credentials")
+
+    allowlist = tuple(
+        (item or "").strip().lower().rstrip(".")
+        for item in allowed_hosts or ()
+        if (item or "").strip()
+    )
+    matched = matches_allowed_host(host, allowlist)
+    if allowlist and not matched:
+        raise A2ANetworkPolicyError(
+            f"Agent URL host {host!r} is not allowed by A2A_CLIENT_ALLOWED_HOSTS"
+        )
+
+    if not allow_private_hosts:
+        try:
+            addresses = await resolve_host_addresses(host)
+        except A2ANetworkPolicyError:
+            raise
+        except OSError as exc:
+            raise A2ANetworkPolicyError(f"Agent URL host could not be resolved: {host!r}") from exc
+        private = [
+            address for address in addresses if _is_private_address(ipaddress.ip_address(address))
+        ]
+        if private:
+            raise A2ANetworkPolicyError(
+                f"Agent URL host {host!r} resolves to a private/loopback address: {private[0]}"
+            )
+
+    return NetworkPolicyDecision(
+        host=host,
+        allowed_host=matched,
+        credentials_allowed=bool(allowlist) and matched,
+    )

{codex_a2a-1.2.0 → codex_a2a-1.3.0}/src/codex_a2a/config.py

@@ -320,6 +320,14 @@ class Settings(BaseSettings):
 
     # A2A settings
     a2a_public_url: str = Field(default="http://127.0.0.1:8000", alias="A2A_PUBLIC_URL")
+    a2a_allowed_origins: Annotated[list[str], NoDecode] = Field(
+        default_factory=list,
+        alias="A2A_ALLOWED_ORIGINS",
+    )
+    a2a_allowed_hosts: Annotated[list[str], NoDecode] = Field(
+        default_factory=list,
+        alias="A2A_ALLOWED_HOSTS",
+    )
     a2a_project: str | None = Field(default=None, alias="A2A_PROJECT")
     a2a_title: str = Field(default="Codex A2A", alias="A2A_TITLE")
     a2a_description: str = Field(default="A2A wrapper service for Codex", alias="A2A_DESCRIPTION")
@@ -330,6 +338,10 @@ class Settings(BaseSettings):
     a2a_enable_turn_control: bool = Field(default=True, alias="A2A_ENABLE_TURN_CONTROL")
     a2a_enable_review_control: bool = Field(default=False, alias="A2A_ENABLE_REVIEW_CONTROL")
     a2a_enable_exec_control: bool = Field(default=False, alias="A2A_ENABLE_EXEC_CONTROL")
+    a2a_expose_workspace_root_in_card: bool = Field(
+        default=False,
+        alias="A2A_EXPOSE_WORKSPACE_ROOT_IN_CARD",
+    )
     a2a_log_level: str = Field(default="WARNING", alias="A2A_LOG_LEVEL")
     a2a_log_payloads: bool = Field(default=False, alias="A2A_LOG_PAYLOADS")
     a2a_log_body_limit: int = Field(default=0, alias="A2A_LOG_BODY_LIMIT")
@@ -341,6 +353,27 @@ class Settings(BaseSettings):
         default=32,
         alias="A2A_MAX_CONCURRENT_OPERATIONS",
     )
+    a2a_rate_limit_enabled: bool = Field(default=True, alias="A2A_RATE_LIMIT_ENABLED")
+    a2a_rate_limit_window_seconds: float = Field(
+        default=60.0,
+        alias="A2A_RATE_LIMIT_WINDOW_SECONDS",
+    )
+    a2a_rate_limit_max_requests: int = Field(
+        default=120,
+        alias="A2A_RATE_LIMIT_MAX_REQUESTS",
+    )
+    a2a_stream_max_bytes: int = Field(
+        default=64 * 1024 * 1024,
+        alias="A2A_STREAM_MAX_BYTES",
+    )
+    a2a_stream_max_duration_seconds: float = Field(
+        default=3600.0,
+        alias="A2A_STREAM_MAX_DURATION_SECONDS",
+    )
+    a2a_stream_idle_timeout_seconds: float = Field(
+        default=120.0,
+        alias="A2A_STREAM_IDLE_TIMEOUT_SECONDS",
+    )
     a2a_documentation_url: str | None = Field(default=None, alias="A2A_DOCUMENTATION_URL")
     a2a_allow_directory_override: bool = Field(default=True, alias="A2A_ALLOW_DIRECTORY_OVERRIDE")
     a2a_host: str = Field(default="127.0.0.1", alias="A2A_HOST")
@@ -386,6 +419,14 @@ class Settings(BaseSettings):
         default_factory=lambda: ["JSONRPC", "HTTP+JSON"],
         alias="A2A_CLIENT_SUPPORTED_TRANSPORTS",
     )
+    a2a_client_allowed_hosts: Annotated[list[str], NoDecode] = Field(
+        default_factory=list,
+        alias="A2A_CLIENT_ALLOWED_HOSTS",
+    )
+    a2a_client_allow_private_hosts: bool = Field(
+        default=False,
+        alias="A2A_CLIENT_ALLOW_PRIVATE_HOSTS",
+    )
     a2a_interrupt_request_ttl_seconds: int = Field(
         default=3600,
         alias="A2A_INTERRUPT_REQUEST_TTL_SECONDS",
@@ -448,6 +489,31 @@ class Settings(BaseSettings):
             raise ValueError("A2A_STREAM_IDLE_DIAGNOSTIC_SECONDS must be > 0")
         return value
 
+    @field_validator("a2a_rate_limit_window_seconds")
+    @classmethod
+    def validate_rate_limit_window_seconds(cls, value: float) -> float:
+        if value <= 0:
+            raise ValueError("A2A_RATE_LIMIT_WINDOW_SECONDS must be > 0")
+        return value
+
+    @field_validator("a2a_rate_limit_max_requests")
+    @classmethod
+    def validate_rate_limit_max_requests(cls, value: int) -> int:
+        if value <= 0:
+            raise ValueError("A2A_RATE_LIMIT_MAX_REQUESTS must be > 0")
+        return value
+
+    @field_validator(
+        "a2a_stream_max_bytes",
+        "a2a_stream_max_duration_seconds",
+        "a2a_stream_idle_timeout_seconds",
+    )
+    @classmethod
+    def validate_stream_budget_values(cls, value: int | float) -> int | float:
+        if value < 0:
+            raise ValueError("A2A stream budgets must be >= 0")
+        return value
+
     @field_validator("a2a_interrupt_request_ttl_seconds")
     @classmethod
     def validate_interrupt_request_ttl_seconds(cls, value: int) -> int:
@@ -459,6 +525,9 @@ class Settings(BaseSettings):
         "codex_sandbox_workspace_write_writable_roots",
         "a2a_execution_sandbox_writable_roots",
         "a2a_execution_network_allowed_domains",
+        "a2a_client_allowed_hosts",
+        "a2a_allowed_origins",
+        "a2a_allowed_hosts",
         mode="before",
     )
     @classmethod