google-gemini / google-gemini/gemini-cli

Bug: A2A server GET /tasks/metadata missing return after 501 response — causes ERR_HTTP_HEADERS_SENT crash with GCS task store

Open
#21,729 12 comments 0 reactions 1 assignee Claimed by @M-DEV-1 View on GitHub
area/core effort/small help wanted kind/bug priority/p1 status/manual-triage
Dominant language
TypeScript
Stars
107k
Forks
14.6k
Avg merge
2d 3h
Merged PRs (30d)
45

Description

## Bug Report

### Description

The `GET /tasks/metadata` endpoint in `packages/a2a-server/src/http/app.ts` is missing a `return` statement after sending a `501` response when using a non-InMemory task store (e.g., `GCSTaskStore`). This causes the handler to fall through into the `try` block and attempt to send a **second response**, which triggers `ERR_HTTP_HEADERS_SENT` and crashes the server.

### Steps to Reproduce

1. Set `GCS_BUCKET_NAME` environment variable (triggers `GCSTaskStore`)
2. Start the A2A server
3. Send `GET /tasks/metadata`
4. Server sends 501 response
5. Code falls through to try block → sends 200/204/500
6. `ERR_HTTP_HEADERS_SENT` — **server crashes**

### Root Cause

In [`packages/a2a-server/src/http/app.ts`](https://github.com/google-gemini/gemini-cli/blob/main/packages/a2a-server/src/http/app.ts#L322-L345) line ~324:

```typescript
expressApp.get("/tasks/metadata", async (req, res) => {
if (!(taskStoreForExecutor instanceof InMemoryTaskStore)) {
res.status(501).send({
error: "Listing all task metadata is only supported when using InMemoryTaskStore.",
});
// ❌ Missing: return;
}
try {
// Falls through — sends a SECOND response
const wrappers = agentExecutor.getAllTasks();
...
res.status(200).json(tasksMetadata); // ERR_HTTP_HEADERS_SENT
```

### Evidence

The adjacent `/tasks/:taskId/metadata` endpoint handles this correctly:

```typescript
if (!wrapper) {
res.status(404).send({ error: "Task not found" });
return; // ✅ Correct pattern
}
```

Every other early-exit guard in the same file (`handleExecuteCommand` lines 161, 165, 170, 176) correctly uses `return`.

### Impact

- **Severity**: Server crash (unhandled exception)
- **Scope**: All A2A server deployments using GCS persistence (`GCS_BUCKET_NAME` set)
- **Reproducibility**: 100% — every call to `GET /tasks/metadata` crashes the server

### Proposed Fix

Add `return;` after the `res.status(501).send()` call (1-line fix). I have a PR ready.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.