@google/adk 1.5.0 → 1.6.0

package/dist/types/utils/crypto_shim.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Browser stand-in for the `node:crypto` builtin, wired up by the alias in
+ * `build.js` so that the Node fallback in `env_aware_utils.ts` does not pull a
+ * Node builtin into the web bundle.
+ *
+ * `randomUUID` is reached here only after both `globalThis.crypto` branches in
+ * `env_aware_utils.ts` have been ruled out. In a browser that means the Web
+ * Crypto API is genuinely absent, so there is no secure source left to fall
+ * back to and the only correct move is to fail rather than degrade.
+ */
+export declare function randomUUID(): string;

package/dist/types/utils/env_aware_utils.d.ts

@@ -7,6 +7,29 @@
  * Returns true if the environment is a browser.
  */
 export declare function isBrowser(): boolean;
+/**
+ * Generates a random UUID from a cryptographically secure source.
+ *
+ * `crypto.randomUUID()` is only exposed in secure contexts, so it is absent on
+ * plain-HTTP origins even though `crypto` itself is present.
+ * `crypto.getRandomValues()` carries no such restriction, so it is used as the
+ * fallback rather than `Math.random()`.
+ *
+ * In Node the `globalThis.crypto` global was added in v17.4.0 and stayed behind
+ * `--experimental-global-webcrypto` until v19.0.0, so neither of those branches
+ * matches on a default Node 18 or earlier. `node:crypto` carries no such gate —
+ * its `randomUUID` has existed since v14.17.0 — so it is the last resort. In
+ * the bundled web build the import is aliased to `crypto_shim.ts`, which
+ * throws, because a browser without the Web Crypto API has no secure source
+ * left. The non-bundle `dist/web` output that `package.json#browser` points
+ * at keeps the import verbatim, as it already does for `node:async_hooks`
+ * and `node:path`.
+ *
+ * Some callers use this value to make security decisions — the OAuth2 `state`
+ * parameter in `AuthHandler` and the session identifiers minted by the session
+ * services — so this function must not silently degrade to a non-cryptographic
+ * generator.
+ */
 export declare function randomUUID(): string;
 /**
  * Encodes the given string or Uint8Array to base64.

package/dist/types/utils/error_utils.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Formats an arbitrary thrown value into a readable, root-cause message.
+ *
+ * Recursively flattens `AggregateError.errors` (joining leaves with ` | `) and
+ * unwraps the `Error.cause` chain, and — when HTTP details are synchronously
+ * available — appends the status code and a response-body snippet truncated to
+ * 1000 characters with a `... [truncated]` marker. It never throws and is safe
+ * on `null`/`undefined` and cyclic error graphs.
+ *
+ * @param err The thrown or rejected value to format.
+ * @return A single human-readable message describing the root cause(s).
+ */
+export declare function formatError(err: unknown): string;

package/dist/types/utils/output_schema_utils.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Returns whether the model can natively accept an output schema at the same
+ * time as tools, which is strictly more reliable than the prompt-based
+ * `set_model_response` workaround.
+ *
+ * Early Access Program model names encode no numeric version, so
+ * `isGemini2OrAbove` rejects them even on Vertex AI. The Python
+ * implementation accepts them; that gap lives in the shared predicate.
+ *
+ * @param modelString A simple or path-based model name.
+ * @return True if the model supports an output schema alongside tools.
+ */
+export declare function canUseOutputSchemaWithTools(modelString: string): boolean;

package/dist/types/utils/vertex_ai_utils.d.ts

@@ -3,6 +3,7 @@
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+export declare const EXPRESS_MODE_UNSUPPORTED_MESSAGE: string;
 /**
  * Validates and returns the API key for Express Mode.
  *

package/dist/types/version.d.ts

@@ -3,4 +3,4 @@
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-export declare const version = "1.5.0";
+export declare const version = "1.6.0";

package/dist/web/a2a/a2a_remote_agent.js

@@ -127,7 +127,12 @@ class RemoteA2AAgent extends BaseAgent {
                   yield new __await(callback(context, chunk));
                 }
               }
-              const adkEvent = toAdkEvent(chunk, context.invocationId, this.name);
+              const adkEvent = toAdkEvent(
+                chunk,
+                context.invocationId,
+                this.name,
+                context.branch
+              );
               if (!adkEvent) {
                 continue;
               }
@@ -158,7 +163,12 @@ class RemoteA2AAgent extends BaseAgent {
               yield new __await(callback(context, result));
             }
           }
-          const adkEvent = toAdkEvent(result, context.invocationId, this.name);
+          const adkEvent = toAdkEvent(
+            result,
+            context.invocationId,
+            this.name,
+            context.branch
+          );
           if (adkEvent) {
             processor.updateCustomMetadata(adkEvent, result);
             yield adkEvent;

package/dist/web/a2a/agent_to_a2a.js

@@ -70,7 +70,6 @@ async function toA2a(agent, options = {}) {
   );
   const app = (_d = options.app) != null ? _d : express();
   if (!options.app) {
-    app.use(express.urlencoded({ limit: "50mb", extended: true }));
     app.use(express.json({ limit: "50mb" }));
   }
   app.use(

package/dist/web/a2a/auth.js

@@ -0,0 +1,37 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { timingSafeEqual } from "node:crypto";
+const AUTHENTICATED_USER_NAME = "a2a-bearer-token";
+const BEARER_SCHEME_PREFIX = "bearer ";
+function timingSafeEqualStrings(a, b) {
+  const left = Buffer.from(a, "utf8");
+  const right = Buffer.from(b, "utf8");
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+function bearerTokenUserBuilder(token) {
+  const expected = token.trim();
+  if (!expected) {
+    throw new Error(
+      "bearerTokenUserBuilder: an empty A2A bearer token is not a valid authenticator. Supply a real shared secret, or configure no token at all to run the A2A surface unauthenticated."
+    );
+  }
+  return async (req) => {
+    var _a;
+    const header = (_a = req.headers.authorization) != null ? _a : "";
+    const credential = header.toLowerCase().startsWith(BEARER_SCHEME_PREFIX) ? header.slice(BEARER_SCHEME_PREFIX.length) : "";
+    if (!timingSafeEqualStrings(credential, expected)) {
+      throw new Error(
+        "A2A request rejected: missing or invalid `Authorization: Bearer` credential."
+      );
+    }
+    return { isAuthenticated: true, userName: AUTHENTICATED_USER_NAME };
+  };
+}
+export {
+  bearerTokenUserBuilder
+};

package/dist/web/a2a/event_converter_utils.js

@@ -62,33 +62,34 @@ function toA2AMessage(event, {
     metadata: getA2AEventMetadata(event, { appName, userId, sessionId })
   };
 }
-function toAdkEvent(event, invocationId, agentName) {
+function toAdkEvent(event, invocationId, agentName, branch) {
   if (isMessage(event)) {
-    return messageToAdkEvent(event, invocationId, agentName);
+    return messageToAdkEvent(event, invocationId, agentName, branch);
   }
   if (isTask(event)) {
-    return taskToAdkEvent(event, invocationId, agentName);
+    return taskToAdkEvent(event, invocationId, agentName, branch);
   }
   if (isTaskArtifactUpdateEvent(event)) {
-    return artifactUpdateToAdkEvent(event, invocationId, agentName);
+    return artifactUpdateToAdkEvent(event, invocationId, agentName, branch);
   }
   if (isTaskStatusUpdateEvent(event)) {
-    return event.final ? finalTaskStatusUpdateToAdkEvent(event, invocationId, agentName) : taskStatusUpdateToAdkEvent(event, invocationId, agentName);
+    return event.final ? finalTaskStatusUpdateToAdkEvent(event, invocationId, agentName, branch) : taskStatusUpdateToAdkEvent(event, invocationId, agentName, branch);
   }
   return void 0;
 }
-function messageToAdkEvent(msg, invocationId, agentName) {
+function messageToAdkEvent(msg, invocationId, agentName, branch) {
   const parts = toGenAIParts(msg.parts);
   const content = parts.length === 0 ? void 0 : msg.role === MessageRole.USER ? createUserContent(parts) : createModelContent(parts);
   return __spreadProps(__spreadValues({}, createAdkEventFromMetadata(msg)), {
     invocationId,
     author: msg.role === MessageRole.USER ? MessageRole.USER : agentName,
+    branch,
     content,
     turnComplete: true,
     partial: false
   });
 }
-function artifactUpdateToAdkEvent(a2aEvent, invocationId, agentName) {
+function artifactUpdateToAdkEvent(a2aEvent, invocationId, agentName, branch) {
   var _a;
   const partsToConvert = ((_a = a2aEvent.artifact) == null ? void 0 : _a.parts) || [];
   if (partsToConvert.length === 0) {
@@ -98,12 +99,13 @@ function artifactUpdateToAdkEvent(a2aEvent, invocationId, agentName) {
   return __spreadProps(__spreadValues({}, createAdkEventFromMetadata(a2aEvent)), {
     invocationId,
     author: agentName,
+    branch,
     content: createModelContent(toGenAIParts(partsToConvert)),
     longRunningToolIds: getLongRunningToolIDs(partsToConvert),
     partial
   });
 }
-function finalTaskStatusUpdateToAdkEvent(a2aEvent, invocationId, agentName) {
+function finalTaskStatusUpdateToAdkEvent(a2aEvent, invocationId, agentName, branch) {
   var _a;
   const partsToConvert = ((_a = a2aEvent.status.message) == null ? void 0 : _a.parts) || [];
   if (partsToConvert.length === 0) {
@@ -115,13 +117,14 @@ function finalTaskStatusUpdateToAdkEvent(a2aEvent, invocationId, agentName) {
   return __spreadProps(__spreadValues({}, createAdkEventFromMetadata(a2aEvent)), {
     invocationId,
     author: agentName,
+    branch,
     errorMessage: isFailedTask ? getFailedTaskStatusUpdateEventError(a2aEvent) : void 0,
     content: hasContent ? createModelContent(parts) : void 0,
     longRunningToolIds: getLongRunningToolIDs(partsToConvert),
     turnComplete: true
   });
 }
-function taskStatusUpdateToAdkEvent(a2aEvent, invocationId, agentName) {
+function taskStatusUpdateToAdkEvent(a2aEvent, invocationId, agentName, branch) {
   const msg = a2aEvent.status.message;
   if (!msg) {
     return void 0;
@@ -133,12 +136,13 @@ function taskStatusUpdateToAdkEvent(a2aEvent, invocationId, agentName) {
   return __spreadProps(__spreadValues({}, createAdkEventFromMetadata(a2aEvent)), {
     invocationId,
     author: agentName,
+    branch,
     content: createModelContent(parts),
     turnComplete: false,
     partial: true
   });
 }
-function taskToAdkEvent(a2aTask, invocationId, agentName) {
+function taskToAdkEvent(a2aTask, invocationId, agentName, branch) {
   var _a, _b;
   const parts = [];
   const longRunningToolIds = [];
@@ -165,16 +169,26 @@ function taskToAdkEvent(a2aTask, invocationId, agentName) {
   return __spreadProps(__spreadValues({}, createAdkEventFromMetadata(a2aTask)), {
     invocationId,
     author: agentName,
+    branch,
     content: isFailed ? void 0 : createModelContent(parts),
     errorMessage: isFailed ? getFailedTaskStatusUpdateEventError(a2aTask) : void 0,
     longRunningToolIds,
     turnComplete: isTerminal
   });
 }
+const PEER_SETTABLE_ACTION_FIELDS = /* @__PURE__ */ new Set(["escalate"]);
 function createAdkEventFromMetadata(a2aEvent) {
   const metadata = a2aEvent.metadata || {};
   return createEvent({
-    branch: metadata[A2AMetadataKeys.BRANCH],
+    // `branch` is intentionally NOT restored from peer metadata here (unlike
+    // the other fields below): it is the mechanism getContents() (see
+    // content_processor_utils.ts) uses to keep sibling sub-agent branches'
+    // conversation contexts isolated from each other. A remote A2A peer that
+    // controls its own outgoing metadata could otherwise forge `adk_branch`
+    // (set it to a shared ancestor branch, or omit it) to leak its content
+    // into an unrelated sibling agent's LLM context. Every caller of the
+    // `*ToAdkEvent` functions in this file force-sets `branch` from its own
+    // local `InvocationContext` instead, the same way `author` is handled.
     author: metadata[A2AMetadataKeys.AUTHOR],
     partial: metadata[A2AMetadataKeys.PARTIAL],
     errorCode: metadata[A2AMetadataKeys.ERROR_CODE],
@@ -183,10 +197,21 @@ function createAdkEventFromMetadata(a2aEvent) {
     groundingMetadata: metadata[A2AMetadataKeys.GROUNDING_METADATA],
     usageMetadata: metadata[A2AMetadataKeys.USAGE_METADATA],
     customMetadata: metadata[A2AMetadataKeys.CUSTOM_METADATA],
-    actions: createEventActions({
-      escalate: !!metadata[A2AMetadataKeys.ESCALATE],
-      transferToAgent: metadata[A2AMetadataKeys.TRANSFER_TO_AGENT]
-    })
+    // Only fields in PEER_SETTABLE_ACTION_FIELDS may be restored from
+    // metadata a remote A2A peer controls. Every other action field either
+    // mutates the caller's own session or drives the caller's own control
+    // flow (e.g. `transferToAgent`, see llm_agent.ts), so it must never be
+    // rebuilt from peer-supplied data. Filtering through an allowlist here
+    // (rather than just omitting the unsafe field) means a future action
+    // field is unsafe-by-default: adding it to `candidateActions` alone
+    // does nothing until it's also added to the allowlist.
+    actions: createEventActions(
+      Object.fromEntries(
+        Object.entries({
+          escalate: !!metadata[A2AMetadataKeys.ESCALATE]
+        }).filter(([key]) => PEER_SETTABLE_ACTION_FIELDS.has(key))
+      )
+    )
   });
 }
 function getLongRunningToolIDs(parts) {

package/dist/web/agents/functions.js

@@ -185,6 +185,18 @@ async function handleFunctionCallsAsync({
     toolConfirmationDict
   });
 }
+function normalizeCallbackResponse(response) {
+  if (response == null) {
+    return void 0;
+  }
+  if (typeof response !== "object") {
+    return { result: response };
+  }
+  if (Array.isArray(response)) {
+    return { results: response };
+  }
+  return response;
+}
 async function handleFunctionCallList({
   invocationContext,
   functionCalls,
@@ -231,6 +243,7 @@ async function handleFunctionCallList({
         }
       }
     }
+    functionResponse = normalizeCallbackResponse(functionResponse);
     if (functionResponse == null) {
       try {
         functionResponse = await callToolAsync(tool, functionArgs, toolContext);
@@ -242,8 +255,8 @@ async function handleFunctionCallList({
             toolContext,
             error: e
           });
-          if (onToolErrorResponse) {
-            functionResponse = onToolErrorResponse;
+          if (onToolErrorResponse != null) {
+            functionResponse = normalizeCallbackResponse(onToolErrorResponse);
           } else {
             functionResponseError = e.message;
           }
@@ -272,17 +285,17 @@ async function handleFunctionCallList({
       }
     }
     if (alteredFunctionResponse != null) {
-      functionResponse = alteredFunctionResponse;
+      functionResponse = normalizeCallbackResponse(alteredFunctionResponse);
     }
-    if (tool.isLongRunning && !functionResponse) {
+    if (tool.isLongRunning && functionResponse == null) {
       continue;
     }
     if (functionResponseError) {
       functionResponse = { error: functionResponseError };
-    } else if (typeof functionResponse !== "object" || functionResponse == null) {
+    } else if (functionResponse == null) {
       functionResponse = { result: functionResponse };
-    } else if (Array.isArray(functionResponse)) {
-      functionResponse = { results: functionResponse };
+    } else {
+      functionResponse = normalizeCallbackResponse(functionResponse);
     }
     const functionResponseEvent = createEvent({
       invocationId: invocationContext.invocationId,

package/dist/web/agents/llm_agent.js

@@ -84,6 +84,7 @@ import { isBaseLlm } from "../models/base_llm.js";
 import { LLMRegistry } from "../models/registry.js";
 import { isBaseTool } from "../tools/base_tool.js";
 import { logger } from "../utils/logger.js";
+import { canUseOutputSchemaWithTools } from "../utils/output_schema_utils.js";
 import { Context } from "./context.js";
 import {
   runAsyncGeneratorWithOtelContext,
@@ -499,7 +500,7 @@ class LlmAgent extends (_b = BaseAgent, _a = LLM_AGENT_SIGNATURE_SYMBOL, _b) {
         }
       }
       const allTools = [...this.tools];
-      if (this.outputSchema && allTools.length > 0) {
+      if (this.outputSchema && allTools.length > 0 && !canUseOutputSchemaWithTools(this.canonicalModel.model)) {
         const setModelResponseTool = new FunctionTool({
           name: "set_model_response",
           description: "Call this tool to submit your final response conforming to the output schema. Use this tool only when you have collected all the information and are ready to return the final answer.",

package/dist/web/agents/processors/basic_llm_request_processor.js

@@ -38,6 +38,7 @@ var __asyncGenerator = (__this, __arguments, generator) => {
  * SPDX-License-Identifier: Apache-2.0
  */
 import { setOutputSchema } from "../../models/llm_request.js";
+import { canUseOutputSchemaWithTools } from "../../utils/output_schema_utils.js";
 import { isLlmAgent } from "../llm_agent.js";
 import { BaseLlmRequestProcessor } from "./base_llm_processor.js";
 class BasicLlmRequestProcessor extends BaseLlmRequestProcessor {
@@ -51,14 +52,14 @@ class BasicLlmRequestProcessor extends BaseLlmRequestProcessor {
   // eslint-disable-next-line require-yield
   runAsync(invocationContext, llmRequest) {
     return __asyncGenerator(this, null, function* () {
-      var _a;
+      var _a, _b;
       const agent = invocationContext.agent;
       if (!isLlmAgent(agent)) {
         return;
       }
       llmRequest.model = agent.canonicalModel.model;
       llmRequest.config = __spreadValues({}, (_a = agent.generateContentConfig) != null ? _a : {});
-      if (agent.outputSchema && (!agent.tools || agent.tools.length === 0)) {
+      if (agent.outputSchema && (!((_b = agent.tools) == null ? void 0 : _b.length) || canUseOutputSchemaWithTools(agent.canonicalModel.model))) {
         setOutputSchema(llmRequest, agent.outputSchema);
       }
       if (invocationContext.runConfig) {

package/dist/web/agents/processors/content_request_processor.js

@@ -21,7 +21,7 @@ var __asyncGenerator = (__this, __arguments, generator) => {
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-import { isCompactedEvent } from "../../events/compacted_event.js";
+import { getActiveEvents } from "../../context/compaction_utils.js";
 import { isLlmAgent } from "../llm_agent.js";
 import {
   getContents,
@@ -42,26 +42,7 @@ class ContentRequestProcessor {
       if (!agent || !isLlmAgent(agent)) {
         return;
       }
-      let events = invocationContext.session.events;
-      const compactedEvents = events.filter(isCompactedEvent);
-      const latestCompactedEvent = compactedEvents.length > 0 ? compactedEvents.reduce(
-        (latest, current) => current.endTime > latest.endTime ? current : latest
-      ) : void 0;
-      if (latestCompactedEvent) {
-        const remainingEvents = events.filter((event) => {
-          if (event === latestCompactedEvent) {
-            return false;
-          }
-          if (isCompactedEvent(event)) {
-            return false;
-          }
-          if (event.timestamp <= latestCompactedEvent.endTime) {
-            return false;
-          }
-          return true;
-        });
-        events = [latestCompactedEvent, ...remainingEvents];
-      }
+      const events = getActiveEvents(invocationContext.session.events);
       if (agent.includeContents === "default") {
         llmRequest.contents = getContents(
           events,

package/dist/web/agents/processors/instructions_llm_request_processor.js

@@ -22,6 +22,7 @@ var __asyncGenerator = (__this, __arguments, generator) => {
  * SPDX-License-Identifier: Apache-2.0
  */
 import { appendInstructions } from "../../models/llm_request.js";
+import { canUseOutputSchemaWithTools } from "../../utils/output_schema_utils.js";
 import { injectSessionState } from "../instructions.js";
 import { isLlmAgent } from "../llm_agent.js";
 import { ReadonlyContext } from "../readonly_context.js";
@@ -33,6 +34,7 @@ class InstructionsLlmRequestProcessor extends BaseLlmRequestProcessor {
   // eslint-disable-next-line require-yield
   runAsync(invocationContext, llmRequest) {
     return __asyncGenerator(this, null, function* () {
+      var _a;
       const agent = invocationContext.agent;
       if (!isLlmAgent(agent)) {
         return;
@@ -64,7 +66,7 @@ class InstructionsLlmRequestProcessor extends BaseLlmRequestProcessor {
         }
         appendInstructions(llmRequest, [instructionWithState]);
       }
-      if (agent.outputSchema && agent.tools && agent.tools.length > 0) {
+      if (agent.outputSchema && ((_a = agent.tools) == null ? void 0 : _a.length) && !canUseOutputSchemaWithTools(agent.canonicalModel.model)) {
         appendInstructions(llmRequest, [
           'To output the final result, you must call the "set_model_response" function with the appropriate values. Do not output anything else.'
         ]);

package/dist/web/artifacts/in_memory_artifact_service.js

@@ -70,16 +70,14 @@ class InMemoryArtifactService {
     userId,
     sessionId
   }) {
-    const sessionPrefix = "".concat(appName, "/").concat(userId, "/").concat(sessionId, "/");
-    const usernamespacePrefix = "".concat(appName, "/").concat(userId, "/user/");
+    const sessionPrefix = artifactPrefix("session", appName, userId, sessionId);
+    const userPrefix = artifactPrefix("user", appName, userId);
     const filenames = [];
     for (const path in this.artifacts) {
       if (path.startsWith(sessionPrefix)) {
-        const filename = path.replace(sessionPrefix, "");
-        filenames.push(filename);
-      } else if (path.startsWith(usernamespacePrefix)) {
-        const filename = path.replace(usernamespacePrefix, "");
-        filenames.push(filename);
+        filenames.push(decodeURIComponent(path.slice(sessionPrefix.length)));
+      } else if (path.startsWith(userPrefix)) {
+        filenames.push(decodeURIComponent(path.slice(userPrefix.length)));
       }
     }
     return Promise.resolve(filenames.sort());
@@ -150,9 +148,12 @@ class InMemoryArtifactService {
 }
 function artifactPath(appName, userId, sessionId, filename) {
   if (fileHasUserNamespace(filename)) {
-    return "".concat(appName, "/").concat(userId, "/user/").concat(filename);
+    return "".concat(artifactPrefix("user", appName, userId)).concat(encodeURIComponent(filename));
   }
-  return "".concat(appName, "/").concat(userId, "/").concat(sessionId, "/").concat(filename);
+  return "".concat(artifactPrefix("session", appName, userId, sessionId)).concat(encodeURIComponent(filename));
+}
+function artifactPrefix(scope, ...parts) {
+  return "".concat([scope, ...parts].map(encodeURIComponent).join("/"), "/");
 }
 function fileHasUserNamespace(filename) {
   return filename.startsWith("user:");

package/dist/web/auth/credential_service/in_memory_credential_service.js

@@ -7,7 +7,18 @@ const require = topLevelCreateRequire(import.meta.url);
  */
 class InMemoryCredentialService {
   constructor() {
-    this.credentials = {};
+    /**
+     * A map from app name to a map from user ID to a map from credential key to
+     * credential.
+     *
+     * `appName`, `userId` and `credentialKey` are all attacker-influenced, so
+     * every level is created with `Object.create(null)`. On an ordinary `{}`
+     * literal a key of `__proto__` resolves to the inherited `__proto__`
+     * accessor rather than creating an own property, so nested assignment
+     * pollutes every object in the process, and a lookup of an inherited key
+     * such as `toString` returns a function instead of `undefined`.
+     */
+    this.credentials = /* @__PURE__ */ Object.create(null);
   }
   loadCredential(authConfig, toolContext) {
     const credentialBucket = this.getBucketForCurrentContext(toolContext);
@@ -22,10 +33,10 @@ class InMemoryCredentialService {
   getBucketForCurrentContext(toolContext) {
     const { appName, userId } = toolContext.invocationContext.session;
     if (!this.credentials[appName]) {
-      this.credentials[appName] = {};
+      this.credentials[appName] = /* @__PURE__ */ Object.create(null);
     }
     if (!this.credentials[appName][userId]) {
-      this.credentials[appName][userId] = {};
+      this.credentials[appName][userId] = /* @__PURE__ */ Object.create(null);
     }
     return this.credentials[appName][userId];
   }

package/dist/web/code_executors/unsafe_local_code_executor.js

@@ -5,7 +5,7 @@ const require = topLevelCreateRequire(import.meta.url);
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-import { spawn } from "child_process";
+import { spawn } from "node:child_process";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -17,13 +17,21 @@ import {
   CodeExecutionLanguage
 } from "./code_execution_utils.js";
 const IS_WINDOWS = os.platform() === "win32";
+const POWERSHELL_BASE_ARGS = [
+  "-NoLogo",
+  "-NoProfile",
+  "-ExecutionPolicy",
+  "Bypass",
+  "-File"
+];
+const CMD_BASE_ARGS = ["/D", "/c"];
+function isPowerShellCommand(commandPath) {
+  return /^(powershell|pwsh)(\.exe)?$/i.test(path.win32.basename(commandPath));
+}
 async function createTempScriptFile(code, language, shellCommandPath) {
-  const tempDir = path.join(
-    os.tmpdir(),
-    "adk_js_unsafe_code_executor",
-    Date.now().toString() + "_" + Math.random().toString(36).slice(2)
+  const tempDir = await fs.mkdtemp(
+    path.join(os.tmpdir(), "adk_js_unsafe_code_executor_")
   );
-  await fs.mkdir(tempDir, { recursive: true });
   const ext = getExtensionForLanguage(language, shellCommandPath) || ".js";
   const filePath = path.join(tempDir, "script".concat(ext));
   await fs.writeFile(filePath, code);
@@ -43,6 +51,9 @@ function getExtensionForLanguage(language, shellCommandPath) {
     return ".bat";
   }
   if (language === CodeExecutionLanguage.SHELL) {
+    if (shellCommandPath && isPowerShellCommand(shellCommandPath)) {
+      return ".ps1";
+    }
     if (IS_WINDOWS) {
       if (shellCommandPath && shellCommandPath.toLowerCase().includes("cmd")) {
         return ".bat";
@@ -101,17 +112,17 @@ class UnsafeLocalCodeExecutor extends BaseCodeExecutor {
         command = this.pythonCommandPath;
       } else if (language === CodeExecutionLanguage.SHELL) {
         command = this.shellCommandPath;
-        if (this.shellCommandPath.toLowerCase().includes("powershell")) {
-          args = ["-NoLogo", "-ExecutionPolicy", "Bypass", "-File", filePath];
+        if (isPowerShellCommand(this.shellCommandPath)) {
+          args = [...POWERSHELL_BASE_ARGS, filePath];
         } else if (this.shellCommandPath.toLowerCase().includes("cmd")) {
-          args = ["/c", filePath];
+          args = [...CMD_BASE_ARGS, filePath];
         }
       } else if (language === CodeExecutionLanguage.POWERSHELL) {
         command = IS_WINDOWS ? "powershell" : "pwsh";
-        args = ["-NoLogo", "-ExecutionPolicy", "Bypass", "-File", filePath];
+        args = [...POWERSHELL_BASE_ARGS, filePath];
       } else if (language === CodeExecutionLanguage.WINDOWS_CMD) {
         command = "cmd.exe";
-        args = ["/c", filePath];
+        args = [...CMD_BASE_ARGS, filePath];
       }
       if (params.codeExecutionInput.args) {
         if (Array.isArray(params.codeExecutionInput.args)) {

package/dist/web/common.js

@@ -121,6 +121,7 @@ import {
 import { ExampleTool } from "./tools/example_tool.js";
 import { EXIT_LOOP, ExitLoopTool } from "./tools/exit_loop_tool.js";
 import { FunctionTool, isFunctionTool } from "./tools/function_tool.js";
+import { getUserChoiceTool } from "./tools/get_user_choice_tool.js";
 import {
   GOOGLE_MAPS_GROUNDING,
   GoogleMapsGroundingTool
@@ -137,6 +138,7 @@ import {
   PRELOAD_MEMORY,
   PreloadMemoryTool
 } from "./tools/preload_memory_tool.js";
+import { requestInputTool } from "./tools/request_input_tool.js";
 import { ToolConfirmation } from "./tools/tool_confirmation.js";
 import { URL_CONTEXT, UrlContextTool } from "./tools/url_context_tool.js";
 import { VertexAiSearchTool } from "./tools/vertex_ai_search_tool.js";
@@ -305,6 +307,7 @@ export {
   getFunctionCalls,
   getFunctionResponses,
   getLogger,
+  getUserChoiceTool,
   hasThoughts,
   hasTrailingCodeExecutionResult,
   isAgentTool,
@@ -332,6 +335,7 @@ export {
   loadWebPage,
   populateClientFunctionCallId,
   pruneThoughts,
+  requestInputTool,
   runWithClientLabel,
   setLogLevel,
   setLogger,