feat(a2a): add A2A protocol plugin for Genkit agents

[pavelgj]

Introduce @genkit-ai/a2a, a new plugin that exposes Genkit agents over the A2A (Agent2Agent) protocol using @a2a-js/sdk.

Provides GenkitA2ARequestHandler, which runs a Genkit agent turn for each incoming A2A message, streams output back as A2A task events, and derives the agent's AgentCard automatically. The A2A contextId maps to the Genkit sessionId so server-managed agents resume sessions across tasks.

Includes README with installation, quick start, and usage details.

[gemini-code-assist]

Code Review

This pull request introduces the @genkit-ai/a2a plugin, which exposes Genkit Agents over the Agent2Agent (A2A) protocol using the @a2a-js/sdk. It includes mapping utilities, an agent card generator, a custom request handler supporting streaming and interrupts, and a comprehensive travel concierge test application. The review feedback focuses on improving robustness and security, specifically recommending a FIFO eviction policy for the unbounded in-memory task map to prevent memory leaks, replacing a regular expression with string slicing to mitigate ReDoS risks, adding optional chaining to prevent potential null-pointer crashes on agent metadata, and simplifying the fresh message mapping to eliminate an unsafe non-null assertion.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The tasks map is an unbounded in-memory Map. In a long-running server environment, this map will grow indefinitely as new tasks are created, leading to a memory leak and potential Out-Of-Memory (OOM) errors. Since Map in JavaScript preserves insertion order, we can easily implement a simple FIFO eviction policy to keep only the most recent tasks (e.g., up to 10,000 tasks) and prevent memory exhaustion.

Suggested change

	this.tasks.set(taskId, task);
	this.tasks.set(taskId, task);
	if (this.tasks.size > 10000) {
	const oldestKey = this.tasks.keys().next().value;
	if (oldestKey !== undefined) {
	this.tasks.delete(oldestKey);
	}
	}

[gemini-code-assist]

Using a regular expression to parse potentially very large base64 data URIs can lead to high CPU usage or catastrophic backtracking (ReDoS) under load. Replacing the regex with simple string slicing and splitting is significantly faster, safer, and immune to regex-based performance issues.

Suggested change

	function parseDataUri(
	url: string
	): { mimeType?: string; bytes: string } | undefined {
	const match = /^data:([^;,]*)?(;base64)?,(.*)$/s.exec(url);
	if (!match) return undefined;
	const [, mimeType, isBase64, data] = match;
	// Only base64 inline data maps cleanly to A2A `bytes`; percent-encoded text
	// data uris are left as a uri reference.
	if (!isBase64) return undefined;
	return { mimeType: mimeType || undefined, bytes: data };
	}
	function parseDataUri(
	url: string
	): { mimeType?: string; bytes: string } | undefined {
	if (!url.startsWith('data:')) return undefined;
	const commaIdx = url.indexOf(',');
	if (commaIdx === -1) return undefined;
	const meta = url.substring(5, commaIdx);
	const parts = meta.split(';');
	if (!parts.includes('base64')) return undefined;
	const mimeType = parts[0] && parts[0] !== 'base64' ? parts[0] : undefined;
	return { mimeType, bytes: url.substring(commaIdx + 1) };
	}

[gemini-code-assist]

To prevent potential runtime crashes if agent is null or undefined, use optional chaining (agent?.__action) to safely access the action metadata.

Suggested change

	export function getAgentName(agent: AgentLike): string {
	const name = agent.__action?.name;
	export function getAgentName(agent: AgentLike): string {
	const name = agent?.__action?.name;

[gemini-code-assist]

To prevent potential runtime crashes if agent is null or undefined, use optional chaining (agent?.__action) to safely access the action metadata.

Suggested change

	export function getAgentDescription(agent: AgentLike): string | undefined {
	return agent.__action?.description;
	}
	export function getAgentDescription(agent: AgentLike): string | undefined {
	return agent?.__action?.description;
	}

[gemini-code-assist]

Import a2aMessageToGenkit directly from ./mapping.js so we can simplify the fresh message mapping and avoid the unsafe non-null assertion in a2aMessageToResumeInputFresh.

Suggested change

	import {
	a2aMessageToResumeInput,
	genkitPartToA2A,
	genkitPartsToA2A,
	} from './mapping.js';
	import {
	a2aMessageToGenkit,
	a2aMessageToResumeInput,
	genkitPartToA2A,
	genkitPartsToA2A,
	} from './mapping.js';

[gemini-code-assist]

Simplify a2aMessageToResumeInputFresh to directly call a2aMessageToGenkit(message). The current implementation calls a2aMessageToResumeInput and uses a non-null assertion (!), which will crash with a TypeError if the message contains data parts that look like tool responses/restarts but isResume is false.

Suggested change

	const input = a2aMessageToResumeInput(message);
	// `a2aMessageToResumeInput` returns `{ message }` for a fresh turn.
	return input.message!;
	}
	function a2aMessageToResumeInputFresh(message: A2AMessage) {
	return a2aMessageToGenkit(message);
	}