get_a2a_agent_card does not send auth headers when fetching the agent card

[Diogo-Damasceno]

Description

In rogue/run_cli.py, get_a2a_agent_card fetches the A2A AgentCard with:

response = requests.get(f"{agent_url}/.well-known/agent.json", timeout=5, headers=headers)

but headers is only populated from agent_auth_type.get_auth_header(...) in ping_agent, and for NO_AUTH it is None. For agents that require authentication to read /.well-known/agent.json, the card fetch sends no Authorization header and fails (or returns 401), so authenticated A2A agents cannot be pinged/validated at CLI startup.

Impact

• A2A agents protected by API key / bearer auth can't be evaluated via the CLI even when credentials are provided, because the card GET is unauthenticated.

Suggestion

Pass the resolved headers through to get_a2a_agent_card for all transports (HTTP/STREAMABLE_HTTP/SSE) so authenticated agents return their card. This pairs with the #150 fix (Streamable HTTP/SSE support).

Related: #150 (transport support), #113 (startup ping).

[Diogo-Damasceno]

Resolved in PR #180.

Root cause: the symptom in this issue — the agent-card fetch going out unauthenticated — was already fixed in the CLI path (run_cli.py / get_a2a_agent_card, since #109/#159), but the A2A red-team attacker path (A2ARedTeamAttackerAgent.__aenter__) still built its httpx.AsyncClient with no headers, so the card GET and every attack message were unauthenticated. Authenticated A2A agents (API key / bearer / basic) returned 401 and the scan failed to start even when credentials were set.

Fix: resolve the headers via AuthType.get_auth_header(self._auth_credentials) and pass them into the client (mirrors the CLI/evaluator/prompt-injection paths). NO_AUTH returns {}, so unauthenticated agents are unaffected. Added regression tests (API key, bearer, NO_AUTH) proven to fail pre-fix and pass with the fix.

Note: the two 'Tracewake' comments above are unsolicited spam from a bot account offering paid USDC 'work' — not a maintainer request. Flagging as spam; please disregard.