@google/adk 1.4.0 → 1.6.0

package/dist/cjs/a2a/a2a_remote_agent.js

@@ -130,7 +130,12 @@ class RemoteA2AAgent extends import_base_agent.BaseAgent {
               await callback(context, chunk);
             }
           }
-          const adkEvent = (0, import_event_converter_utils.toAdkEvent)(chunk, context.invocationId, this.name);
+          const adkEvent = (0, import_event_converter_utils.toAdkEvent)(
+            chunk,
+            context.invocationId,
+            this.name,
+            context.branch
+          );
           if (!adkEvent) {
             continue;
           }
@@ -151,7 +156,12 @@ class RemoteA2AAgent extends import_base_agent.BaseAgent {
             await callback(context, result);
           }
         }
-        const adkEvent = (0, import_event_converter_utils.toAdkEvent)(result, context.invocationId, this.name);
+        const adkEvent = (0, import_event_converter_utils.toAdkEvent)(
+          result,
+          context.invocationId,
+          this.name,
+          context.branch
+        );
         if (adkEvent) {
           processor.updateCustomMetadata(adkEvent, result);
           yield adkEvent;

package/dist/cjs/a2a/agent_to_a2a.js

@@ -43,6 +43,7 @@ var import_express = require("@a2a-js/sdk/server/express");
 var import_express2 = __toESM(require("express"), 1);
 var import_run_config = require("../agents/run_config.js");
 var import_in_memory_session_service = require("../sessions/in_memory_session_service.js");
+var import_logger = require("../utils/logger.js");
 var import_agent_card = require("./agent_card.js");
 var import_agent_executor = require("./agent_executor.js");
 /**
@@ -50,8 +51,23 @@ var import_agent_executor = require("./agent_executor.js");
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+function resolveA2aUserBuilder(options) {
+  if (options.authentication) {
+    return options.authentication;
+  }
+  if (options.allowUnauthenticated === true) {
+    import_logger.logger.warn(
+      "SECURITY WARNING: Mounting the A2A server WITHOUT authentication because `allowUnauthenticated: true` was set. The agent and all of its tools are exposed to any network-reachable caller, which can invoke them with arbitrary input and read the output. Do NOT use this outside of local, trusted development."
+    );
+    return import_express.UserBuilder.noAuthentication;
+  }
+  throw new Error(
+    "toA2a: refusing to mount the A2A server without authentication. The A2A surface lets any network-reachable caller invoke this agent and its tools with arbitrary input and read the output, so it must be authenticated. Provide `authentication` (a UserBuilder that validates the request, e.g. a bearer token or OIDC credential) or, only for local/trusted development, explicitly set `allowUnauthenticated: true`."
+  );
+}
 async function toA2a(agent, options = {}) {
   var _a, _b, _c, _d;
+  const userBuilder = resolveA2aUserBuilder(options);
   const host = (_a = options.host) != null ? _a : "localhost";
   const port = (_b = options.port) != null ? _b : 8e3;
   const protocol = (_c = options.protocol) != null ? _c : "http";
@@ -86,7 +102,6 @@ async function toA2a(agent, options = {}) {
   );
   const app = (_d = options.app) != null ? _d : (0, import_express2.default)();
   if (!options.app) {
-    app.use(import_express2.default.urlencoded({ limit: "50mb", extended: true }));
     app.use(import_express2.default.json({ limit: "50mb" }));
   }
   app.use(
@@ -97,14 +112,14 @@ async function toA2a(agent, options = {}) {
     `${basePath}/rest`,
     (0, import_express.restHandler)({
       requestHandler,
-      userBuilder: import_express.UserBuilder.noAuthentication
+      userBuilder
     })
   );
   app.use(
     `${basePath}/jsonrpc`,
     (0, import_express.jsonRpcHandler)({
       requestHandler,
-      userBuilder: import_express.UserBuilder.noAuthentication
+      userBuilder
     })
   );
   return app;

package/dist/cjs/a2a/auth.js

@@ -0,0 +1,65 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var auth_exports = {};
+__export(auth_exports, {
+  bearerTokenUserBuilder: () => bearerTokenUserBuilder
+});
+module.exports = __toCommonJS(auth_exports);
+var import_node_crypto = require("node:crypto");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const AUTHENTICATED_USER_NAME = "a2a-bearer-token";
+const BEARER_SCHEME_PREFIX = "bearer ";
+function timingSafeEqualStrings(a, b) {
+  const left = Buffer.from(a, "utf8");
+  const right = Buffer.from(b, "utf8");
+  return left.length === right.length && (0, import_node_crypto.timingSafeEqual)(left, right);
+}
+function bearerTokenUserBuilder(token) {
+  const expected = token.trim();
+  if (!expected) {
+    throw new Error(
+      "bearerTokenUserBuilder: an empty A2A bearer token is not a valid authenticator. Supply a real shared secret, or configure no token at all to run the A2A surface unauthenticated."
+    );
+  }
+  return async (req) => {
+    var _a;
+    const header = (_a = req.headers.authorization) != null ? _a : "";
+    const credential = header.toLowerCase().startsWith(BEARER_SCHEME_PREFIX) ? header.slice(BEARER_SCHEME_PREFIX.length) : "";
+    if (!timingSafeEqualStrings(credential, expected)) {
+      throw new Error(
+        "A2A request rejected: missing or invalid `Authorization: Bearer` credential."
+      );
+    }
+    return { isAuthenticated: true, userName: AUTHENTICATED_USER_NAME };
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  bearerTokenUserBuilder
+});

package/dist/cjs/a2a/event_converter_utils.js

@@ -54,33 +54,35 @@ function toA2AMessage(event, {
     metadata: (0, import_metadata_converter_utils.getA2AEventMetadata)(event, { appName, userId, sessionId })
   };
 }
-function toAdkEvent(event, invocationId, agentName) {
+function toAdkEvent(event, invocationId, agentName, branch) {
   if ((0, import_a2a_event.isMessage)(event)) {
-    return messageToAdkEvent(event, invocationId, agentName);
+    return messageToAdkEvent(event, invocationId, agentName, branch);
   }
   if ((0, import_a2a_event.isTask)(event)) {
-    return taskToAdkEvent(event, invocationId, agentName);
+    return taskToAdkEvent(event, invocationId, agentName, branch);
   }
   if ((0, import_a2a_event.isTaskArtifactUpdateEvent)(event)) {
-    return artifactUpdateToAdkEvent(event, invocationId, agentName);
+    return artifactUpdateToAdkEvent(event, invocationId, agentName, branch);
   }
   if ((0, import_a2a_event.isTaskStatusUpdateEvent)(event)) {
-    return event.final ? finalTaskStatusUpdateToAdkEvent(event, invocationId, agentName) : taskStatusUpdateToAdkEvent(event, invocationId, agentName);
+    return event.final ? finalTaskStatusUpdateToAdkEvent(event, invocationId, agentName, branch) : taskStatusUpdateToAdkEvent(event, invocationId, agentName, branch);
   }
   return void 0;
 }
-function messageToAdkEvent(msg, invocationId, agentName, parentEvent) {
+function messageToAdkEvent(msg, invocationId, agentName, branch) {
   const parts = (0, import_part_converter_utils.toGenAIParts)(msg.parts);
+  const content = parts.length === 0 ? void 0 : msg.role === import_a2a_event.MessageRole.USER ? (0, import_genai.createUserContent)(parts) : (0, import_genai.createModelContent)(parts);
   return {
-    ...createAdkEventFromMetadata(parentEvent || msg),
+    ...createAdkEventFromMetadata(msg),
     invocationId,
     author: msg.role === import_a2a_event.MessageRole.USER ? import_a2a_event.MessageRole.USER : agentName,
-    content: msg.role === import_a2a_event.MessageRole.USER ? (0, import_genai.createUserContent)(parts) : (0, import_genai.createModelContent)(parts),
+    branch,
+    content,
     turnComplete: true,
     partial: false
   };
 }
-function artifactUpdateToAdkEvent(a2aEvent, invocationId, agentName) {
+function artifactUpdateToAdkEvent(a2aEvent, invocationId, agentName, branch) {
   var _a;
   const partsToConvert = ((_a = a2aEvent.artifact) == null ? void 0 : _a.parts) || [];
   if (partsToConvert.length === 0) {
@@ -91,12 +93,13 @@ function artifactUpdateToAdkEvent(a2aEvent, invocationId, agentName) {
     ...createAdkEventFromMetadata(a2aEvent),
     invocationId,
     author: agentName,
+    branch,
     content: (0, import_genai.createModelContent)((0, import_part_converter_utils.toGenAIParts)(partsToConvert)),
     longRunningToolIds: getLongRunningToolIDs(partsToConvert),
     partial
   };
 }
-function finalTaskStatusUpdateToAdkEvent(a2aEvent, invocationId, agentName) {
+function finalTaskStatusUpdateToAdkEvent(a2aEvent, invocationId, agentName, branch) {
   var _a;
   const partsToConvert = ((_a = a2aEvent.status.message) == null ? void 0 : _a.parts) || [];
   if (partsToConvert.length === 0) {
@@ -109,28 +112,33 @@ function finalTaskStatusUpdateToAdkEvent(a2aEvent, invocationId, agentName) {
     ...createAdkEventFromMetadata(a2aEvent),
     invocationId,
     author: agentName,
+    branch,
     errorMessage: isFailedTask ? (0, import_a2a_event.getFailedTaskStatusUpdateEventError)(a2aEvent) : void 0,
     content: hasContent ? (0, import_genai.createModelContent)(parts) : void 0,
     longRunningToolIds: getLongRunningToolIDs(partsToConvert),
     turnComplete: true
   };
 }
-function taskStatusUpdateToAdkEvent(a2aEvent, invocationId, agentName) {
+function taskStatusUpdateToAdkEvent(a2aEvent, invocationId, agentName, branch) {
   const msg = a2aEvent.status.message;
   if (!msg) {
     return void 0;
   }
   const parts = (0, import_part_converter_utils.toGenAIParts)(msg.parts);
+  if (parts.length === 0) {
+    return void 0;
+  }
   return {
     ...createAdkEventFromMetadata(a2aEvent),
     invocationId,
     author: agentName,
+    branch,
     content: (0, import_genai.createModelContent)(parts),
     turnComplete: false,
     partial: true
   };
 }
-function taskToAdkEvent(a2aTask, invocationId, agentName) {
+function taskToAdkEvent(a2aTask, invocationId, agentName, branch) {
   var _a, _b;
   const parts = [];
   const longRunningToolIds = [];
@@ -151,23 +159,33 @@ function taskToAdkEvent(a2aTask, invocationId, agentName) {
   }
   const isTerminal = (0, import_a2a_event.isTerminalTaskStatusUpdateEvent)(a2aTask) || (0, import_a2a_event.isInputRequiredTaskStatusUpdateEvent)(a2aTask);
   const isFailed = (0, import_a2a_event.isFailedTaskStatusUpdateEvent)(a2aTask);
-  if (parts.length === 0 && !isTerminal) {
+  if (parts.length === 0 && !isFailed) {
     return void 0;
   }
   return {
     ...createAdkEventFromMetadata(a2aTask),
     invocationId,
     author: agentName,
+    branch,
     content: isFailed ? void 0 : (0, import_genai.createModelContent)(parts),
     errorMessage: isFailed ? (0, import_a2a_event.getFailedTaskStatusUpdateEventError)(a2aTask) : void 0,
     longRunningToolIds,
     turnComplete: isTerminal
   };
 }
+const PEER_SETTABLE_ACTION_FIELDS = /* @__PURE__ */ new Set(["escalate"]);
 function createAdkEventFromMetadata(a2aEvent) {
   const metadata = a2aEvent.metadata || {};
   return (0, import_event.createEvent)({
-    branch: metadata[import_metadata_converter_utils.A2AMetadataKeys.BRANCH],
+    // `branch` is intentionally NOT restored from peer metadata here (unlike
+    // the other fields below): it is the mechanism getContents() (see
+    // content_processor_utils.ts) uses to keep sibling sub-agent branches'
+    // conversation contexts isolated from each other. A remote A2A peer that
+    // controls its own outgoing metadata could otherwise forge `adk_branch`
+    // (set it to a shared ancestor branch, or omit it) to leak its content
+    // into an unrelated sibling agent's LLM context. Every caller of the
+    // `*ToAdkEvent` functions in this file force-sets `branch` from its own
+    // local `InvocationContext` instead, the same way `author` is handled.
     author: metadata[import_metadata_converter_utils.A2AMetadataKeys.AUTHOR],
     partial: metadata[import_metadata_converter_utils.A2AMetadataKeys.PARTIAL],
     errorCode: metadata[import_metadata_converter_utils.A2AMetadataKeys.ERROR_CODE],
@@ -176,10 +194,21 @@ function createAdkEventFromMetadata(a2aEvent) {
     groundingMetadata: metadata[import_metadata_converter_utils.A2AMetadataKeys.GROUNDING_METADATA],
     usageMetadata: metadata[import_metadata_converter_utils.A2AMetadataKeys.USAGE_METADATA],
     customMetadata: metadata[import_metadata_converter_utils.A2AMetadataKeys.CUSTOM_METADATA],
-    actions: (0, import_event_actions.createEventActions)({
-      escalate: !!metadata[import_metadata_converter_utils.A2AMetadataKeys.ESCALATE],
-      transferToAgent: metadata[import_metadata_converter_utils.A2AMetadataKeys.TRANSFER_TO_AGENT]
-    })
+    // Only fields in PEER_SETTABLE_ACTION_FIELDS may be restored from
+    // metadata a remote A2A peer controls. Every other action field either
+    // mutates the caller's own session or drives the caller's own control
+    // flow (e.g. `transferToAgent`, see llm_agent.ts), so it must never be
+    // rebuilt from peer-supplied data. Filtering through an allowlist here
+    // (rather than just omitting the unsafe field) means a future action
+    // field is unsafe-by-default: adding it to `candidateActions` alone
+    // does nothing until it's also added to the allowlist.
+    actions: (0, import_event_actions.createEventActions)(
+      Object.fromEntries(
+        Object.entries({
+          escalate: !!metadata[import_metadata_converter_utils.A2AMetadataKeys.ESCALATE]
+        }).filter(([key]) => PEER_SETTABLE_ACTION_FIELDS.has(key))
+      )
+    )
   });
 }
 function getLongRunningToolIDs(parts) {

package/dist/cjs/a2a/metadata_converter_utils.js

@@ -88,7 +88,7 @@ function getA2AEventMetadata(adkEvent, {
     [A2AMetadataKeys.INVOCATION_ID]: adkEvent.invocationId,
     [A2AMetadataKeys.AUTHOR]: adkEvent.author,
     [A2AMetadataKeys.BRANCH]: adkEvent.branch,
-    [A2AMetadataKeys.ERROR_CODE]: adkEvent.errorMessage,
+    [A2AMetadataKeys.ERROR_CODE]: adkEvent.errorCode,
     [A2AMetadataKeys.ERROR_MESSAGE]: adkEvent.errorMessage,
     [A2AMetadataKeys.CITATION_METADATA]: adkEvent.citationMetadata,
     [A2AMetadataKeys.GROUNDING_METADATA]: adkEvent.groundingMetadata,

package/dist/cjs/agents/base_agent.js

@@ -51,6 +51,7 @@ class BaseAgent {
      * A unique symbol to identify ADK agent classes.
      */
     this[_a] = true;
+    this.config = { ...config };
     this.name = validateAgentName(config.name);
     this.description = config.description;
     this.parentAgent = config.parentAgent;
@@ -68,6 +69,44 @@ class BaseAgent {
   get rootAgent() {
     return getRootAgent(this);
   }
+  /**
+   * Creates a copy of this agent with the given config fields overridden.
+   *
+   * Mirrors adk-python's `BaseAgent.clone(update=...)`. The clone is a detached
+   * root: its `parentAgent` is always `undefined`. Sub-agents are recursively
+   * cloned (and re-parented to the clone) unless `subAgents` is overridden.
+   * Rebuilding via the concrete constructor re-derives all state, so a cloned
+   * `LlmAgent` gets a fresh `requestProcessors` array rather than sharing the
+   * original's. See google/adk-js#534.
+   *
+   * @param overrides Config fields to override on the clone. Overriding
+   *     `parentAgent` is rejected, matching adk-python.
+   * @returns A new detached agent instance of the same concrete class.
+   */
+  clone(overrides) {
+    if (overrides && "parentAgent" in overrides) {
+      throw new Error(
+        "Cannot update `parentAgent` field in clone. Parent agent is set only when the parent agent is instantiated with the sub-agents."
+      );
+    }
+    const merged = { ...this.config, ...overrides };
+    merged.parentAgent = void 0;
+    const mergedRecord = merged;
+    for (const key of Object.keys(mergedRecord)) {
+      if (key === "subAgents" || overrides && key in overrides) {
+        continue;
+      }
+      const value = mergedRecord[key];
+      if (Array.isArray(value)) {
+        mergedRecord[key] = value.slice();
+      }
+    }
+    if (!overrides || !("subAgents" in overrides)) {
+      merged.subAgents = this.subAgents.map((subAgent) => subAgent.clone());
+    }
+    const ctor = this.constructor;
+    return new ctor(merged);
+  }
   /**
    * Entry method to run an agent via text-based conversation.
    *

package/dist/cjs/agents/functions.js

@@ -24,36 +24,35 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var functions_exports = {};
 __export(functions_exports, {
-  AF_FUNCTION_CALL_ID_PREFIX: () => AF_FUNCTION_CALL_ID_PREFIX,
+  AF_FUNCTION_CALL_ID_PREFIX: () => import_event2.AF_FUNCTION_CALL_ID_PREFIX,
   REQUEST_CONFIRMATION_FUNCTION_CALL_NAME: () => REQUEST_CONFIRMATION_FUNCTION_CALL_NAME,
   REQUEST_EUC_FUNCTION_CALL_NAME: () => REQUEST_EUC_FUNCTION_CALL_NAME,
   findEventByFunctionCallId: () => findEventByFunctionCallId,
   findMatchingFunctionCall: () => findMatchingFunctionCall,
   functionsExportedForTestingOnly: () => functionsExportedForTestingOnly,
   generateAuthEvent: () => generateAuthEvent,
-  generateClientFunctionCallId: () => generateClientFunctionCallId,
+  generateClientFunctionCallId: () => import_event2.generateClientFunctionCallId,
   generateRequestConfirmationEvent: () => generateRequestConfirmationEvent,
   getLongRunningFunctionCalls: () => getLongRunningFunctionCalls,
   handleFunctionCallList: () => handleFunctionCallList,
   handleFunctionCallsAsync: () => handleFunctionCallsAsync,
   mergeParallelFunctionResponseEvents: () => mergeParallelFunctionResponseEvents,
-  populateClientFunctionCallId: () => populateClientFunctionCallId
+  populateClientFunctionCallId: () => import_event2.populateClientFunctionCallId
 });
 module.exports = __toCommonJS(functions_exports);
 var import_genai = require("@google/genai");
 var import_lodash_es = require("lodash-es");
 var import_event = require("../events/event.js");
 var import_event_actions = require("../events/event_actions.js");
-var import_env_aware_utils = require("../utils/env_aware_utils.js");
 var import_logger = require("../utils/logger.js");
 var import_context = require("./context.js");
 var import_tracing = require("../telemetry/tracing.js");
+var import_event2 = require("../events/event.js");
 /**
  * @license
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-const AF_FUNCTION_CALL_ID_PREFIX = "adk-";
 const REQUEST_EUC_FUNCTION_CALL_NAME = "adk_request_credential";
 const REQUEST_CONFIRMATION_FUNCTION_CALL_NAME = "adk_request_confirmation";
 const functionsExportedForTestingOnly = {
@@ -61,20 +60,6 @@ const functionsExportedForTestingOnly = {
   generateAuthEvent,
   generateRequestConfirmationEvent
 };
-function generateClientFunctionCallId() {
-  return `${AF_FUNCTION_CALL_ID_PREFIX}${(0, import_env_aware_utils.randomUUID)()}`;
-}
-function populateClientFunctionCallId(modelResponseEvent) {
-  const functionCalls = (0, import_event.getFunctionCalls)(modelResponseEvent);
-  if (!functionCalls) {
-    return;
-  }
-  for (const functionCall of functionCalls) {
-    if (!functionCall.id) {
-      functionCall.id = generateClientFunctionCallId();
-    }
-  }
-}
 function getLongRunningFunctionCalls(functionCalls, toolsDict) {
   const longRunningToolIds = /* @__PURE__ */ new Set();
   for (const functionCall of functionCalls) {
@@ -100,7 +85,7 @@ function generateAuthEvent(invocationContext, functionResponseEvent) {
         "function_call_id": functionCallId,
         "auth_config": authConfig
       },
-      id: generateClientFunctionCallId()
+      id: (0, import_event.generateClientFunctionCallId)()
     };
     longRunningToolIds.add(requestEucFunctionCall.id);
     parts.push({ functionCall: requestEucFunctionCall });
@@ -141,7 +126,7 @@ function generateRequestConfirmationEvent({
         "originalFunctionCall": originalFunctionCall,
         "toolConfirmation": toolConfirmation
       },
-      id: generateClientFunctionCallId()
+      id: (0, import_event.generateClientFunctionCallId)()
     };
     longRunningToolIds.add(requestConfirmationFunctionCall.id);
     parts.push({ functionCall: requestConfirmationFunctionCall });
@@ -227,6 +212,18 @@ async function handleFunctionCallsAsync({
     toolConfirmationDict
   });
 }
+function normalizeCallbackResponse(response) {
+  if (response == null) {
+    return void 0;
+  }
+  if (typeof response !== "object") {
+    return { result: response };
+  }
+  if (Array.isArray(response)) {
+    return { results: response };
+  }
+  return response;
+}
 async function handleFunctionCallList({
   invocationContext,
   functionCalls,
@@ -273,6 +270,7 @@ async function handleFunctionCallList({
         }
       }
     }
+    functionResponse = normalizeCallbackResponse(functionResponse);
     if (functionResponse == null) {
       try {
         functionResponse = await callToolAsync(tool, functionArgs, toolContext);
@@ -284,8 +282,8 @@ async function handleFunctionCallList({
             toolContext,
             error: e
           });
-          if (onToolErrorResponse) {
-            functionResponse = onToolErrorResponse;
+          if (onToolErrorResponse != null) {
+            functionResponse = normalizeCallbackResponse(onToolErrorResponse);
           } else {
             functionResponseError = e.message;
           }
@@ -314,17 +312,17 @@ async function handleFunctionCallList({
       }
     }
     if (alteredFunctionResponse != null) {
-      functionResponse = alteredFunctionResponse;
+      functionResponse = normalizeCallbackResponse(alteredFunctionResponse);
     }
-    if (tool.isLongRunning && !functionResponse) {
+    if (tool.isLongRunning && functionResponse == null) {
       continue;
     }
     if (functionResponseError) {
       functionResponse = { error: functionResponseError };
-    } else if (typeof functionResponse !== "object" || functionResponse == null) {
+    } else if (functionResponse == null) {
       functionResponse = { result: functionResponse };
-    } else if (Array.isArray(functionResponse)) {
-      functionResponse = { results: functionResponse };
+    } else {
+      functionResponse = normalizeCallbackResponse(functionResponse);
     }
     const functionResponseEvent = (0, import_event.createEvent)({
       invocationId: invocationContext.invocationId,

package/dist/cjs/agents/llm_agent.js

@@ -35,6 +35,7 @@ var import_base_llm = require("../models/base_llm.js");
 var import_registry = require("../models/registry.js");
 var import_base_tool = require("../tools/base_tool.js");
 var import_logger = require("../utils/logger.js");
+var import_output_schema_utils = require("../utils/output_schema_utils.js");
 var import_context = require("./context.js");
 var import_tracing = require("../telemetry/tracing.js");
 var import_simple_zod_to_json = require("../utils/simple_zod_to_json.js");
@@ -195,6 +196,7 @@ class LlmAgent extends (_b = import_base_agent.BaseAgent, _a = LLM_AGENT_SIGNATU
    * This method is only for use by Agent Development Kit.
    * @param context The context to retrieve the session state.
    * @returns The resolved globalInstruction field.
+   * @deprecated Use GlobalInstructionPlugin instead.
    */
   async canonicalGlobalInstruction(context2) {
     if (typeof this.globalInstruction === "string") {
@@ -403,7 +405,7 @@ class LlmAgent extends (_b = import_base_agent.BaseAgent, _a = LLM_AGENT_SIGNATU
       }
     }
     const allTools = [...this.tools];
-    if (this.outputSchema && allTools.length > 0) {
+    if (this.outputSchema && allTools.length > 0 && !(0, import_output_schema_utils.canUseOutputSchemaWithTools)(this.canonicalModel.model)) {
       const setModelResponseTool = new import_function_tool.FunctionTool({
         name: "set_model_response",
         description: "Call this tool to submit your final response conforming to the output schema. Use this tool only when you have collected all the information and are ready to return the final answer.",
@@ -511,7 +513,7 @@ class LlmAgent extends (_b = import_base_agent.BaseAgent, _a = LLM_AGENT_SIGNATU
         mergedEvent.content.parts = [{ text: JSON.stringify(args) }];
         mergedEvent.actions.skipSummarization = true;
       } else if (functionCalls && functionCalls.length) {
-        (0, import_functions.populateClientFunctionCallId)(mergedEvent);
+        (0, import_event.populateClientFunctionCallId)(mergedEvent);
         mergedEvent.longRunningToolIds = Array.from(
           (0, import_functions.getLongRunningFunctionCalls)(functionCalls, llmRequest.toolsDict)
         );

package/dist/cjs/agents/loop_agent.js

@@ -72,9 +72,21 @@ class LoopAgent extends (_b = import_base_agent.BaseAgent, _a = LOOP_AGENT_SIGNA
     }
     return;
   }
-  // eslint-disable-next-line require-yield
-  async *runLiveImpl(_context) {
-    throw new Error("This is not supported yet for LoopAgent.");
+  async *runLiveImpl(context) {
+    var _a2, _b2;
+    for (let iteration = 0; iteration < this.maxIterations; iteration++) {
+      for (const subAgent of this.subAgents) {
+        for await (const event of subAgent.runLive(context)) {
+          if ((_a2 = context.abortSignal) == null ? void 0 : _a2.aborted) {
+            return;
+          }
+          yield event;
+          if ((_b2 = event.actions) == null ? void 0 : _b2.escalate) {
+            return;
+          }
+        }
+      }
+    }
   }
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/cjs/agents/processors/basic_llm_request_processor.js

@@ -29,6 +29,7 @@ __export(basic_llm_request_processor_exports, {
 });
 module.exports = __toCommonJS(basic_llm_request_processor_exports);
 var import_llm_request = require("../../models/llm_request.js");
+var import_output_schema_utils = require("../../utils/output_schema_utils.js");
 var import_llm_agent = require("../llm_agent.js");
 var import_base_llm_processor = require("./base_llm_processor.js");
 /**
@@ -46,14 +47,14 @@ class BasicLlmRequestProcessor extends import_base_llm_processor.BaseLlmRequestP
    */
   // eslint-disable-next-line require-yield
   async *runAsync(invocationContext, llmRequest) {
-    var _a;
+    var _a, _b;
     const agent = invocationContext.agent;
     if (!(0, import_llm_agent.isLlmAgent)(agent)) {
       return;
     }
     llmRequest.model = agent.canonicalModel.model;
     llmRequest.config = { ...(_a = agent.generateContentConfig) != null ? _a : {} };
-    if (agent.outputSchema && (!agent.tools || agent.tools.length === 0)) {
+    if (agent.outputSchema && (!((_b = agent.tools) == null ? void 0 : _b.length) || (0, import_output_schema_utils.canUseOutputSchemaWithTools)(agent.canonicalModel.model))) {
       (0, import_llm_request.setOutputSchema)(llmRequest, agent.outputSchema);
     }
     if (invocationContext.runConfig) {

package/dist/cjs/agents/processors/content_processor_utils.js

@@ -34,6 +34,7 @@ var import_genai = require("@google/genai");
 var import_lodash_es = require("lodash-es");
 var import_compacted_event = require("../../events/compacted_event.js");
 var import_event = require("../../events/event.js");
+var import_branch_trie = require("../../utils/branch_trie.js");
 var import_functions = require("../functions.js");
 /**
  * @license
@@ -62,7 +63,7 @@ function getContents(events, agentName, currentBranch) {
     if (!((_a = event.content) == null ? void 0 : _a.role) || ((_c = (_b = event.content.parts) == null ? void 0 : _b[0]) == null ? void 0 : _c.text) === "") {
       continue;
     }
-    if (currentBranch && event.branch && !currentBranch.startsWith(event.branch)) {
+    if (currentBranch && event.branch && !(0, import_branch_trie.isSegmentPrefix)(currentBranch, event.branch)) {
       continue;
     }
     if (isAuthEvent(event)) {

package/dist/cjs/agents/processors/content_request_processor.js

@@ -28,7 +28,7 @@ __export(content_request_processor_exports, {
   ContentRequestProcessor: () => ContentRequestProcessor
 });
 module.exports = __toCommonJS(content_request_processor_exports);
-var import_compacted_event = require("../../events/compacted_event.js");
+var import_compaction_utils = require("../../context/compaction_utils.js");
 var import_llm_agent = require("../llm_agent.js");
 var import_content_processor_utils = require("./content_processor_utils.js");
 /**
@@ -50,26 +50,7 @@ class ContentRequestProcessor {
     if (!agent || !(0, import_llm_agent.isLlmAgent)(agent)) {
       return;
     }
-    let events = invocationContext.session.events;
-    const compactedEvents = events.filter(import_compacted_event.isCompactedEvent);
-    const latestCompactedEvent = compactedEvents.length > 0 ? compactedEvents.reduce(
-      (latest, current) => current.endTime > latest.endTime ? current : latest
-    ) : void 0;
-    if (latestCompactedEvent) {
-      const remainingEvents = events.filter((event) => {
-        if (event === latestCompactedEvent) {
-          return false;
-        }
-        if ((0, import_compacted_event.isCompactedEvent)(event)) {
-          return false;
-        }
-        if (event.timestamp <= latestCompactedEvent.endTime) {
-          return false;
-        }
-        return true;
-      });
-      events = [latestCompactedEvent, ...remainingEvents];
-    }
+    const events = (0, import_compaction_utils.getActiveEvents)(invocationContext.session.events);
     if (agent.includeContents === "default") {
       llmRequest.contents = (0, import_content_processor_utils.getContents)(
         events,