Bug: A2A server GET /tasks/metadata missing return after 501 response — causes ERR_HTTP_HEADERS_SENT crash with GCS task store

Bug Report

Description

The GET /tasks/metadata endpoint in packages/a2a-server/src/http/app.ts is missing a return statement after sending a 501 response when using a non-InMemory task store (e.g., GCSTaskStore). This causes the handler to fall through into the try block and attempt to send a second response, which triggers ERR_HTTP_HEADERS_SENT and crashes the server.

Steps to Reproduce

1. Set GCS_BUCKET_NAME environment variable (triggers GCSTaskStore)
2. Start the A2A server
3. Send GET /tasks/metadata
4. Server sends 501 response
5. Code falls through to try block → sends 200/204/500
6. ERR_HTTP_HEADERS_SENT — server crashes

Root Cause

In packages/a2a-server/src/http/app.ts line ~324:

expressApp.get("/tasks/metadata", async (req, res) => {
    if (!(taskStoreForExecutor instanceof InMemoryTaskStore)) {
        res.status(501).send({
            error: "Listing all task metadata is only supported when using InMemoryTaskStore.",
        });
        // ❌ Missing: return;
    }
    try {
        // Falls through — sends a SECOND response
        const wrappers = agentExecutor.getAllTasks();
        ...
        res.status(200).json(tasksMetadata); // ERR_HTTP_HEADERS_SENT

Evidence

The adjacent /tasks/:taskId/metadata endpoint handles this correctly:

if (!wrapper) {
    res.status(404).send({ error: "Task not found" });
    return;  // ✅ Correct pattern
}

Every other early-exit guard in the same file (handleExecuteCommand lines 161, 165, 170, 176) correctly uses return.

Impact

• Severity: Server crash (unhandled exception)
• Scope: All A2A server deployments using GCS persistence (GCS_BUCKET_NAME set)
• Reproducibility: 100% — every call to GET /tasks/metadata crashes the server

Proposed Fix

Add return; after the res.status(501).send() call (1-line fix). I have a PR ready.