@google/adk 2.0.0 → 2.1.0

package/dist/esm/a2a/a2a_remote_agent.js

@@ -19,12 +19,13 @@ import { MessageRole } from "./a2a_event.js";
 import { A2ARemoteAgentRunProcessor } from "./a2a_remote_agent_run_processor.js";
 import {
   getUserFunctionCallAt,
+  peerRequestedCallIds,
+  toForwardableA2AParts,
   toMissingRemoteSessionParts
 } from "./a2a_remote_agent_utils.js";
 import { resolveAgentCard } from "./agent_card.js";
 import { toAdkEvent } from "./event_converter_utils.js";
 import { getA2ASessionMetadata } from "./metadata_converter_utils.js";
-import { toA2AParts } from "./part_converter_utils.js";
 const _RemoteA2AAgent = class _RemoteA2AAgent extends BaseAgent {
   constructor(a2aConfig) {
     super(a2aConfig);
@@ -67,9 +68,11 @@ const _RemoteA2AAgent = class _RemoteA2AAgent extends BaseAgent {
       let contextId = void 0;
       if (userFnCall) {
         const event = userFnCall.response;
-        parts = toA2AParts(
-          ((_a = event.content) == null ? void 0 : _a.parts) || [],
-          event.longRunningToolIds
+        const peerRequestedIds = peerRequestedCallIds(events, this.name);
+        parts = toForwardableA2AParts(
+          event.content,
+          event.longRunningToolIds,
+          peerRequestedIds
         );
         taskId = userFnCall.taskId;
         contextId = userFnCall.contextId;
@@ -91,9 +94,11 @@ const _RemoteA2AAgent = class _RemoteA2AAgent extends BaseAgent {
       };
       if (taskId) message.taskId = taskId;
       if (contextId) message.contextId = contextId;
+      const metadata = (_a = this.a2aConfig.metadata) != null ? _a : context.a2aMetadata;
       const params = {
         message,
-        configuration: this.a2aConfig.messageSendConfig
+        configuration: this.a2aConfig.messageSendConfig,
+        ...metadata ? { metadata } : {}
       };
       const processor = new A2ARemoteAgentRunProcessor(params);
       if (this.a2aConfig.beforeRequestCallbacks) {

package/dist/esm/a2a/a2a_remote_agent_utils.js

@@ -7,8 +7,11 @@ var __name = (target, value) => __defProp(target, "name", { value, configurable:
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+import { REQUEST_CREDENTIAL_FUNCTION_CALL_NAME } from "../agents/functions.js";
 import { requireAgent } from "../agents/invocation_context.js";
 import { createEvent } from "../events/event.js";
+import { camelCaseKeys } from "../utils/case_utils.js";
+import { logger } from "../utils/logger.js";
 import { AdkMetadataKeys } from "./metadata_converter_utils.js";
 import { toA2AParts } from "./part_converter_utils.js";
 function getUserFunctionCallAt(session, index) {
@@ -61,23 +64,118 @@ function getFunctionResponseCallId(event) {
   return (_a = responsePart == null ? void 0 : responsePart.functionResponse) == null ? void 0 : _a.id;
 }
 __name(getFunctionResponseCallId, "getFunctionResponseCallId");
+const AUTH_CONFIG_SCHEME_KEY = "authScheme";
+const AUTH_CONFIG_CREDENTIAL_KEYS = [
+  // camelCase only by design: callers normalise the payload with
+  // camelCaseKeys() before these keys are looked up, so the snake_case
+  // spellings (raw_auth_credential, exchanged_auth_credential) are covered.
+  "rawAuthCredential",
+  "exchangedAuthCredential"
+];
+function payloadIsAuthConfig(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return false;
+  }
+  const keys = new Set(Object.keys(payload));
+  if (!keys.has(AUTH_CONFIG_SCHEME_KEY)) {
+    return false;
+  }
+  return AUTH_CONFIG_CREDENTIAL_KEYS.some((key) => keys.has(key));
+}
+__name(payloadIsAuthConfig, "payloadIsAuthConfig");
+function isCredentialFunctionCall(functionCall) {
+  if (functionCall.name === REQUEST_CREDENTIAL_FUNCTION_CALL_NAME) {
+    return true;
+  }
+  const args = camelCaseKeys(functionCall.args);
+  if (!args || typeof args !== "object") {
+    return false;
+  }
+  const authConfig = args["authConfig"];
+  return payloadIsAuthConfig(authConfig);
+}
+__name(isCredentialFunctionCall, "isCredentialFunctionCall");
+function isCredentialFunctionResponse(functionResponse) {
+  if (functionResponse.name === REQUEST_CREDENTIAL_FUNCTION_CALL_NAME) {
+    return true;
+  }
+  return payloadIsAuthConfig(camelCaseKeys(functionResponse.response));
+}
+__name(isCredentialFunctionResponse, "isCredentialFunctionResponse");
+function peerRequestedCallIds(events, peerName) {
+  var _a, _b, _c;
+  const peer = /* @__PURE__ */ new Set();
+  const local = /* @__PURE__ */ new Set();
+  for (const event of events) {
+    for (const part of (_b = (_a = event.content) == null ? void 0 : _a.parts) != null ? _b : []) {
+      const id = (_c = part.functionCall) == null ? void 0 : _c.id;
+      if (!id) {
+        continue;
+      }
+      (event.author === peerName ? peer : local).add(id);
+    }
+  }
+  return new Set([...peer].filter((id) => !local.has(id)));
+}
+__name(peerRequestedCallIds, "peerRequestedCallIds");
+function withoutCredentialParts(content, peerRequestedIds) {
+  if (!content || !content.parts) {
+    return content;
+  }
+  const isDroppedCredentialPart = /* @__PURE__ */ __name((part) => {
+    if (part.functionCall && isCredentialFunctionCall(part.functionCall)) {
+      return true;
+    }
+    if (part.functionResponse && isCredentialFunctionResponse(part.functionResponse)) {
+      const id = part.functionResponse.id;
+      return !(id && peerRequestedIds.has(id));
+    }
+    return false;
+  }, "isDroppedCredentialPart");
+  const parts = content.parts.filter((part) => !isDroppedCredentialPart(part));
+  if (parts.length === content.parts.length) {
+    return content;
+  }
+  logger.warn(
+    `Dropped ${content.parts.length - parts.length} credential-bearing part(s) before forwarding to the remote peer -- it did not request them.`
+  );
+  return { ...content, parts };
+}
+__name(withoutCredentialParts, "withoutCredentialParts");
+function toForwardableA2AParts(content, longRunningToolIds, peerRequestedIds) {
+  const scrubbed = withoutCredentialParts(content, peerRequestedIds);
+  if (!(scrubbed == null ? void 0 : scrubbed.parts)) {
+    return [];
+  }
+  return toA2AParts(scrubbed.parts, longRunningToolIds);
+}
+__name(toForwardableA2AParts, "toForwardableA2AParts");
 function toMissingRemoteSessionParts(ctx, session) {
   const events = session.events;
+  const peerName = requireAgent(ctx).name;
   let contextId = void 0;
   let lastRemoteResponseIndex = -1;
   for (let i = events.length - 1; i >= 0; i--) {
     const event = events[i];
-    if (event.author === requireAgent(ctx).name) {
+    if (event.author === peerName) {
       lastRemoteResponseIndex = i;
       const metadata = event.customMetadata || {};
       contextId = metadata[AdkMetadataKeys.CONTEXT_ID];
       break;
     }
   }
+  const peerRequestedIds = peerRequestedCallIds(events, peerName);
   const missingParts = [];
   for (let i = lastRemoteResponseIndex + 1; i < events.length; i++) {
     let event = events[i];
-    if (event.author !== "user" && event.author !== requireAgent(ctx).name) {
+    const scrubbedContent = withoutCredentialParts(
+      event.content,
+      peerRequestedIds
+    );
+    if (scrubbedContent !== event.content) {
+      event = { ...event, content: scrubbedContent };
+    }
+    if (event.author !== "user" && event.author !== peerName) {
       event = presentAsUserMessage(ctx, event);
     }
     if (!event.content || !event.content.parts || event.content.parts.length === 0) {
@@ -136,6 +234,8 @@ export {
   getFunctionResponseCallId,
   getUserFunctionCallAt,
   isFunctionCallEvent,
+  peerRequestedCallIds,
   presentAsUserMessage,
+  toForwardableA2AParts,
   toMissingRemoteSessionParts
 };

package/dist/esm/a2a/agent_card.js

@@ -9,6 +9,7 @@ var __name = (target, value) => __defProp(target, "name", { value, configurable:
  */
 import { DefaultAgentCardResolver } from "@a2a-js/sdk/client";
 import * as fs from "node:fs/promises";
+import { fileURLToPath } from "node:url";
 import {
   InvocationContext
 } from "../agents/invocation_context.js";
@@ -20,18 +21,48 @@ import { isSequentialAgent } from "../agents/sequential_agent.js";
 import { isBaseTool } from "../tools/base_tool.js";
 import { isBaseToolset } from "../tools/base_toolset.js";
 import { logger } from "../utils/logger.js";
+import {
+  isHttpUrl,
+  isLinkLocalAddress,
+  normalizeHost,
+  resolveHostAddresses
+} from "../utils/ssrf_guard.js";
 import { isWorkflow } from "../workflow/workflow.js";
+const WINDOWS_DRIVE_PROTOCOL = /^[a-z]:$/i;
 async function resolveAgentCard(agentCard) {
   if (typeof agentCard === "object") {
     return agentCard;
   }
-  const source = agentCard;
-  if (source.startsWith("http://") || source.startsWith("https://")) {
-    const resolver = new DefaultAgentCardResolver();
-    return await resolver.resolve(source);
+  const url = parseCardUrl(agentCard);
+  if (url && isHttpUrl(url)) {
+    await assertHostAllowed(url);
+    const resolver = new DefaultAgentCardResolver({
+      fetchImpl: noRedirectFetch(agentCard)
+    });
+    return resolver.resolve(agentCard);
+  }
+  if (url && url.protocol !== "file:") {
+    throw new Error(
+      `Unsupported agent card URL scheme "${url.protocol}": ${agentCard}. Use http://, https:// or file://, or pass a filesystem path with no scheme.`
+    );
+  }
+  return readAgentCardFile(agentCard, url);
+}
+__name(resolveAgentCard, "resolveAgentCard");
+function parseCardUrl(source) {
+  let url;
+  try {
+    url = new URL(source);
+  } catch {
+    return null;
   }
+  return WINDOWS_DRIVE_PROTOCOL.test(url.protocol) ? null : url;
+}
+__name(parseCardUrl, "parseCardUrl");
+async function readAgentCardFile(source, url) {
   try {
-    const content = await fs.readFile(source, "utf-8");
+    const path = url ? fileURLToPath(url) : source;
+    const content = await fs.readFile(path, "utf-8");
     return JSON.parse(content);
   } catch (err) {
     throw new Error(
@@ -39,7 +70,33 @@ async function resolveAgentCard(agentCard) {
     );
   }
 }
-__name(resolveAgentCard, "resolveAgentCard");
+__name(readAgentCardFile, "readAgentCardFile");
+function noRedirectFetch(source) {
+  return async (input, init) => {
+    const response = await fetch(input, { ...init, redirect: "manual" });
+    if (isRedirect(response.status)) {
+      throw new Error(
+        `Refusing to follow a redirect while fetching the agent card from ${source} (status ${response.status}, location ${response.headers.get("location")}). Configure the final URL instead.`
+      );
+    }
+    return response;
+  };
+}
+__name(noRedirectFetch, "noRedirectFetch");
+function isRedirect(status) {
+  return status === 0 || status >= 300 && status < 400;
+}
+__name(isRedirect, "isRedirect");
+async function assertHostAllowed(url) {
+  const host = normalizeHost(url.hostname);
+  const addresses = await resolveHostAddresses(host);
+  if (addresses.some(isLinkLocalAddress)) {
+    throw new Error(
+      `Refusing to fetch agent card from a link-local address: ${host}`
+    );
+  }
+}
+__name(assertHostAllowed, "assertHostAllowed");
 async function getA2AAgentCard(agent, transports) {
   return {
     name: agent.name,

package/dist/esm/a2a/agent_executor.js

@@ -26,6 +26,7 @@ import {
   getA2ASessionMetadata
 } from "./metadata_converter_utils.js";
 import { toA2AParts, toGenAIContent } from "./part_converter_utils.js";
+import { getA2aRequestMetadata } from "./request_metadata.js";
 const _A2AAgentExecutor = class _A2AAgentExecutor {
   constructor(config) {
     this.config = config;
@@ -47,14 +48,16 @@ const _A2AAgentExecutor = class _A2AAgentExecutor {
       adkRunner.sessionService,
       adkRunner.appName
     );
+    const a2aMetadata = getA2aRequestMetadata(ctx);
     const executorContext = createExecutorContext({
       session,
       userContent: genAIUserMessage,
-      requestContext: ctx
+      requestContext: ctx,
+      a2aMetadata
     });
     try {
       if (this.config.beforeExecuteCallback) {
-        await this.config.beforeExecuteCallback(ctx);
+        await this.config.beforeExecuteCallback(ctx, a2aMetadata);
       }
       const unansweredRequestEvent = getUnansweredRequestEvent({
         taskId: ctx.taskId,
@@ -94,7 +97,11 @@ const _A2AAgentExecutor = class _A2AAgentExecutor {
         // Marked remote so the run knows this message came from a peer rather
         // than from the operator: a human-in-the-loop gate is not answerable
         // over A2A unless the deployment opts in.
-        runConfig: { ...this.config.runConfig, remoteDelivered: true }
+        runConfig: {
+          ...this.config.runConfig,
+          remoteDelivered: true,
+          ...a2aMetadata ? { a2aMetadata } : {}
+        }
       })) {
         adkEvents.push(adkEvent);
         const a2aEvent = this.convertAdkEventToA2AEvent(

package/dist/esm/a2a/agent_to_a2a.js

@@ -29,13 +29,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
  * SPDX-License-Identifier: Apache-2.0
  */
 import { AGENT_CARD_PATH } from "@a2a-js/sdk";
-import { DefaultRequestHandler, InMemoryTaskStore } from "@a2a-js/sdk/server";
+import { InMemoryTaskStore } from "@a2a-js/sdk/server";
 import { StreamingMode } from "../agents/run_config.js";
 import { InMemorySessionService } from "../sessions/in_memory_session_service.js";
 import { logger } from "../utils/logger.js";
 import { loadOptionalPeer } from "../utils/optional_peer.js";
 import { getA2AAgentCard, resolveAgentCard } from "./agent_card.js";
 import { A2AAgentExecutor } from "./agent_executor.js";
+import {
+  AdkDefaultRequestHandler,
+  getA2aRequestMetadata
+} from "./request_metadata.js";
 async function loadExpressBindings() {
   const expressModule = await loadOptionalPeer(
     { packageName: "express", feature: "toA2a" },
@@ -91,7 +95,7 @@ async function toA2a(agent, options = {}) {
       streamingMode: StreamingMode.SSE
     }
   });
-  const requestHandler = new DefaultRequestHandler(
+  const requestHandler = new AdkDefaultRequestHandler(
     agentCard,
     new InMemoryTaskStore(),
     agentExecutor
@@ -122,5 +126,7 @@ async function toA2a(agent, options = {}) {
 }
 __name(toA2a, "toA2a");
 export {
+  AdkDefaultRequestHandler,
+  getA2aRequestMetadata,
   toA2a
 };

package/dist/esm/a2a/event_processor_utils.js

@@ -13,7 +13,6 @@ import {
 } from "../agents/user_input_request.js";
 import { createEventActions } from "../events/event_actions.js";
 import {
-  createInputMissingErrorEvent,
   createTaskCompletedEvent,
   createTaskFailedEvent,
   createTaskInputRequiredEvent,
@@ -138,7 +137,7 @@ function getUnansweredRequestEvent(options) {
   if (!missingId) {
     return void 0;
   }
-  return createInputMissingErrorEvent({
+  return createTaskInputRequiredEvent({
     taskId: (_b = task == null ? void 0 : task.id) != null ? _b : taskId,
     contextId: (_c = task == null ? void 0 : task.contextId) != null ? _c : contextId,
     parts: [

package/dist/esm/a2a/executor_context.js

@@ -10,7 +10,8 @@ var __name = (target, value) => __defProp(target, "name", { value, configurable:
 function createExecutorContext({
   session,
   userContent,
-  requestContext
+  requestContext,
+  a2aMetadata
 }) {
   return {
     userId: session.userId,
@@ -19,7 +20,8 @@ function createExecutorContext({
     readonlyState: session.state,
     events: session.events,
     userContent,
-    requestContext
+    requestContext,
+    a2aMetadata
   };
 }
 __name(createExecutorContext, "createExecutorContext");

package/dist/esm/a2a/index.js

@@ -8,13 +8,19 @@ const require = topLevelCreateRequire(import.meta.url);
 import { AGENT_CARD_PATH, RemoteA2AAgent } from "./a2a_remote_agent.js";
 import { getA2AAgentCard } from "./agent_card.js";
 import { A2AAgentExecutor } from "./agent_executor.js";
-import { toA2a } from "./agent_to_a2a.js";
+import {
+  AdkDefaultRequestHandler,
+  getA2aRequestMetadata,
+  toA2a
+} from "./agent_to_a2a.js";
 import { bearerTokenUserBuilder } from "./auth.js";
 export {
   A2AAgentExecutor,
   AGENT_CARD_PATH,
+  AdkDefaultRequestHandler,
   RemoteA2AAgent,
   bearerTokenUserBuilder,
   getA2AAgentCard,
+  getA2aRequestMetadata,
   toA2a
 };

package/dist/esm/a2a/request_metadata.js

@@ -0,0 +1,68 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import {
+  DefaultRequestHandler
+} from "@a2a-js/sdk/server";
+const requestMetadataStore = /* @__PURE__ */ new Map();
+function getA2aRequestMetadata(ctx) {
+  var _a, _b;
+  const reqContext = ctx;
+  if ((_a = reqContext.request) == null ? void 0 : _a.metadata) {
+    return reqContext.request.metadata;
+  }
+  const messageId = (_b = ctx.userMessage) == null ? void 0 : _b.messageId;
+  if (messageId && requestMetadataStore.has(messageId)) {
+    return requestMetadataStore.get(messageId);
+  }
+  return void 0;
+}
+__name(getA2aRequestMetadata, "getA2aRequestMetadata");
+const _AdkDefaultRequestHandler = class _AdkDefaultRequestHandler extends DefaultRequestHandler {
+  async sendMessage(params, context) {
+    var _a;
+    const messageId = (_a = params.message) == null ? void 0 : _a.messageId;
+    if (messageId && params.metadata) {
+      requestMetadataStore.set(
+        messageId,
+        params.metadata
+      );
+    }
+    try {
+      return await super.sendMessage(params, context);
+    } finally {
+      if (messageId) {
+        requestMetadataStore.delete(messageId);
+      }
+    }
+  }
+  async *sendMessageStream(params, context) {
+    var _a;
+    const messageId = (_a = params.message) == null ? void 0 : _a.messageId;
+    if (messageId && params.metadata) {
+      requestMetadataStore.set(
+        messageId,
+        params.metadata
+      );
+    }
+    try {
+      yield* super.sendMessageStream(params, context);
+    } finally {
+      if (messageId) {
+        requestMetadataStore.delete(messageId);
+      }
+    }
+  }
+};
+__name(_AdkDefaultRequestHandler, "AdkDefaultRequestHandler");
+let AdkDefaultRequestHandler = _AdkDefaultRequestHandler;
+export {
+  AdkDefaultRequestHandler,
+  getA2aRequestMetadata
+};

package/dist/esm/agents/base_agent.js

@@ -18,7 +18,7 @@ import {
 import { BaseNode } from "../workflow/base_node.js";
 import { Context } from "./context.js";
 import { InvocationContext } from "./invocation_context.js";
-const BASE_AGENT_SIGNATURE_SYMBOL = Symbol.for("google.adk.baseAgent");
+const BASE_AGENT_SIGNATURE_SYMBOL = /* @__PURE__ */ Symbol.for("google.adk.baseAgent");
 function isBaseAgent(obj) {
   return typeof obj === "object" && obj !== null && BASE_AGENT_SIGNATURE_SYMBOL in obj && obj[BASE_AGENT_SIGNATURE_SYMBOL] === true;
 }
@@ -54,15 +54,16 @@ const _BaseAgent = class _BaseAgent extends (_b = BaseNode, _a = BASE_AGENT_SIGN
   /**
    * Creates a copy of this agent with the given config fields overridden.
    *
-   * Mirrors adk-python's `BaseAgent.clone(update=...)`. The clone is a detached
-   * root: its `parentAgent` is always `undefined`. Sub-agents are recursively
-   * cloned (and re-parented to the clone) unless `subAgents` is overridden.
-   * Rebuilding via the concrete constructor re-derives all state, so a cloned
-   * `LlmAgent` gets a fresh `requestProcessors` array rather than sharing the
-   * original's. See google/adk-js#534.
+   * The clone is a detached root: its `parentAgent` is always `undefined`.
+   * Sub-agents are recursively cloned (and re-parented to the clone) unless
+   * `subAgents` is overridden. Rebuilding via the concrete constructor
+   * re-derives all state, so a cloned `LlmAgent` gets a fresh
+   * `requestProcessors` array rather than sharing the original's.
+   * See google/adk-js#534.
    *
    * @param overrides Config fields to override on the clone. Overriding
-   *     `parentAgent` is rejected, matching adk-python.
+   *     `parentAgent` is rejected: parentage is assigned only when a parent
+   *     agent is constructed with its sub-agents.
    * @returns A new detached agent instance of the same concrete class.
    */
   clone(overrides) {

package/dist/esm/agents/context.js

@@ -24,8 +24,14 @@ const _Context = class _Context extends ReadonlyContext {
    *     call.
    * @param options.toolConfirmation The tool confirmation of the current tool
    *     call.
+   * @param options.resumeInputs The inputs the current tool call is being
+   *     resumed with, if it paused to ask for them, keyed by interrupt id.
+   *     Defaults to empty rather than absent, matching adk-python's
+   *     `Context.resume_inputs`. Carries no approval; see
+   *     {@link ResumeInputs}.
    */
   constructor(options) {
+    var _a;
     super(options.invocationContext);
     this.eventActions = options.eventActions || createEventActions();
     this._state = new State(
@@ -34,6 +40,7 @@ const _Context = class _Context extends ReadonlyContext {
     );
     this.functionCallId = options.functionCallId;
     this.toolConfirmation = options.toolConfirmation;
+    this.resumeInputs = (_a = options.resumeInputs) != null ? _a : {};
     this.abortSignal = options.invocationContext.abortSignal;
   }
   /**