Implement A2UI parser to extract text parts and A2UI JSON parts separately

[nan-yu]

Description

It hides the A2UI delimiter as implementation details by injecting the LLM response format (text part and JSON part separated by the delimiter) into the system prompt and extracting them with a parser.

• Tested: The orchestrator sample runs successfully from end-to-end.
• Fixes: Extract a parser in the agent SDK to parse LLM response #778
• TODO:
  • Replace the A2UI delimiter with XML/HTML style tags
  • Support multiple pairs of text part and A2UI JSON part

Pre-launch Checklist

• I signed the CLA.
• I read the Contributors Guide.
• I read the Style Guide.
• I have added updates to the CHANGELOG.
• I updated/added relevant documentation.
• My code changes (if any) have tests.

If you need help, consider asking for advice on the discussion board.

[gemini-code-assist]

Code Review

This pull request refactors the A2UI JSON parsing and validation logic by introducing a new a2ui.core.parser module. The previous A2uiPayloadFixer class has been removed, and its functionality, including parsing and fixing trailing commas, is now handled by new parse_response and parse_and_fix functions within the new parser module. The A2UI_DELIMITER constant and DEFAULT_WORKFLOW_RULES are introduced to standardize LLM response formatting, and the system prompt generation now incorporates these default rules.

Significant changes include updating the SendA2uiToClientToolset to use a new A2uiEventConverter and A2uiPartConverter for converting GenAI parts to A2A parts, which now supports both tool-based and text-based A2UI with catalog-aware validation. The agent_development.md documentation and various sample agent implementations (component_gallery, contact_lookup, contact_multiple_surfaces, restaurant_finder, rizzcharts) have been updated to reflect these new parsing and validation mechanisms, including using parse_response and catalog.validator.validate directly.

Review comments highlight critical issues in the sample agents: two instances of a bug in retry logic where a continue statement causes unnecessary retries instead of exiting with a valid empty JSON list, and multiple instances of missing A2UI payload validation before sending to the client, posing a security risk due to potential prompt injection. Additionally, the retry logic in stream methods was flagged for concatenating user queries directly into prompts, creating a prompt injection vulnerability by allowing attackers to override agent instructions.

[gemini-code-assist]

The continue statement here introduces a bug in the retry logic. When parsed_json_data is an empty list, it's considered a valid response, and is_valid is set to True. However, continue forces the loop to the next iteration, causing an unnecessary retry instead of exiting and returning the valid response. Removing continue will allow the logic to flow to the if is_valid: check and complete the task as intended.

[gemini-code-assist]

The continue statement here introduces a bug in the retry logic. When parsed_json_data is an empty list, it's considered a valid response, and is_valid is set to True. However, continue forces the loop to the next iteration, causing an unnecessary retry instead of exiting and returning the valid response. Removing continue will allow the logic to flow to the if is_valid: check and complete the task as intended.

[gemini-code-assist]

This agent executor sends A2UI JSON payloads to the client without validation, which is a critical security vulnerability. Malicious payloads could be rendered if the LLM is compromised via prompt injection. Always validate A2UI payloads against the intended catalog/schema using catalog.validator.validate() before sending them to the client. Additionally, the isinstance(json_data, list) check is redundant as parse_response ensures json_data is always a list, and the else block is unreachable. This code block can be simplified.

           if json_data:
            for msg in json_data:
              final_parts.append(create_a2ui_part(msg))

[gemini-code-assist]

This agent executor sends A2UI JSON payloads from LLM responses to the client without validation against the A2UI catalog/schema. This is a security risk as validation can be bypassed if the LLM is manipulated via prompt injection. Always validate A2UI payloads against the intended catalog/schema in the executor before sending them to the client. Additionally, the isinstance(json_data, list) check and its else block are redundant because parse_response ensures json_data is always a list. The if len(json_data) == 0: check is also unreachable. The logic can be simplified.

Suggested change

	final_parts.append(create_a2ui_part(message))
	if json_data:
	logger.info(
	f"Found {len(json_data)} messages. Creating individual DataParts."
	)
	for message in json_data:
	final_parts.append(create_a2ui_part(message))
	else:
	logger.info("Received empty list. Skipping DataPart.")

[gemini-code-assist]

The retry logic in the stream method concatenates the original user query directly into a new prompt sent to the LLM. An attacker can craft a query that, when included in the retry prompt, overrides the agent's instructions (e.g., by including "Ignore previous instructions and..."). This is especially risky as the retry prompt uses authoritative language ("You MUST").

Remediation: Sanitize or quote the user query when including it in prompts. Ideally, use a structured format or separate the user input from the system instructions using clear delimiters that the LLM is trained to respect.

[gemini-code-assist]

The retry logic in the stream method concatenates the original user query directly into a new prompt sent to the LLM. An attacker can craft a query that, when included in the retry prompt, overrides the agent's instructions. This is a common pattern for prompt injection.

Remediation: Sanitize or quote the user query when including it in prompts.