google-gemini / google-gemini/gemini-cli
Bug: A2A server GET /tasks/metadata missing return after 501 response — causes ERR_HTTP_HEADERS_SENT crash with GCS task store
- Dominant language
- TypeScript
- Stars
- 107k
- Forks
- 14.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 45
Description
## Bug Report
### Description
The `GET /tasks/metadata` endpoint in `packages/a2a-server/src/http/app.ts` is missing a `return` statement after sending a `501` response when using a non-InMemory task store (e.g., `GCSTaskStore`). This causes the handler to fall through into the `try` block and attempt to send a **second response**, which triggers `ERR_HTTP_HEADERS_SENT` and crashes the server.
### Steps to Reproduce
1. Set `GCS_BUCKET_NAME` environment variable (triggers `GCSTaskStore`)
2. Start the A2A server
3. Send `GET /tasks/metadata`
4. Server sends 501 response
5. Code falls through to try block → sends 200/204/500
6. `ERR_HTTP_HEADERS_SENT` — **server crashes**
### Root Cause
In [`packages/a2a-server/src/http/app.ts`](https://github.com/google-gemini/gemini-cli/blob/main/packages/a2a-server/src/http/app.ts#L322-L345) line ~324:
```typescript
expressApp.get("/tasks/metadata", async (req, res) => {
if (!(taskStoreForExecutor instanceof InMemoryTaskStore)) {
res.status(501).send({
error: "Listing all task metadata is only supported when using InMemoryTaskStore.",
});
// ❌ Missing: return;
}
try {
// Falls through — sends a SECOND response
const wrappers = agentExecutor.getAllTasks();
...
res.status(200).json(tasksMetadata); // ERR_HTTP_HEADERS_SENT
```
### Evidence
The adjacent `/tasks/:taskId/metadata` endpoint handles this correctly:
```typescript
if (!wrapper) {
res.status(404).send({ error: "Task not found" });
return; // ✅ Correct pattern
}
```
Every other early-exit guard in the same file (`handleExecuteCommand` lines 161, 165, 170, 176) correctly uses `return`.
### Impact
- **Severity**: Server crash (unhandled exception)
- **Scope**: All A2A server deployments using GCS persistence (`GCS_BUCKET_NAME` set)
- **Reproducibility**: 100% — every call to `GET /tasks/metadata` crashes the server
### Proposed Fix
Add `return;` after the `res.status(501).send()` call (1-line fix). I have a PR ready.
Contributor guide
Assessment
This issue has not been assessed yet.