[BUG] parse_www_authenticate mangles quoted values that contain commas #9108

Description

parse_www_authenticate in crewai/a2a/auth/utils.py splits the header with regexes that ignore quoting. Quoted values containing commas are cut short, and extra challenges appear.

Steps to Reproduce

parse_www_authenticate('Bearer realm="api", error_description="Token, which expired, is invalid"')

Expected behavior

One Bearer challenge whose error_description is Token, which expired, is invalid.

Screenshots/Code snippets

Actual: error_description comes back as "The (cut at the first comma), and bogus challenges named which and is are returned. Also wrong: empty quoted values become None, an escaped quote ends a value early, and a bare Bearer is dropped. 6 of 10 new tests fail on main.

Operating System

Windows 11

Python Version

3.13

crewAI Version

1.15.35 (main)

crewAI Tools Version

main (same monorepo checkout)

Virtual Environment

Venv (uv)

Evidence

Impact is low today: the only caller uses the result in a message that is not reachable yet. It still returns wrong data for valid RFC 9110 headers.

Possible Solution

Tokenise the header with quote-aware parsing. Branch: https://github.com/Mahdi-Hasan/crewAI/tree/fix/a2a-parse-www-authenticate

Additional context

I searched issues and PRs for WWW-Authenticate and parse_www_authenticate; nothing relates.