feat: genkit agents - #242
Conversation
Bumps [com.puppycrawl.tools:checkstyle](https://github.com/checkstyle/checkstyle) from 13.6.0 to 13.7.0. - [Release notes](https://github.com/checkstyle/checkstyle/releases) - [Commits](checkstyle/checkstyle@checkstyle-13.6.0...checkstyle-13.7.0) --- updated-dependencies: - dependency-name: com.puppycrawl.tools:checkstyle dependency-version: 13.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Code Review
This pull request introduces the beta Agents API for Genkit Java, replacing the old agent and chat session implementations with a robust stateful, multi-turn agent framework. It adds the com.google.genkit.ai.agent package, supporting both server-managed and client-managed sessions, bidirectional streaming, detached execution, and session state persistence. Feedback on these changes highlights critical security vulnerabilities regarding path traversal in FileSessionStore where sessionId is resolved against the filesystem without validation. Additionally, a potential ClassCastException was identified in InProcessTransport due to raw class deserialization of parameterized state, a redundant filter was found in FileSessionStore's chain pruning, and a potential thread leak was noted due to an unclosed ScheduledExecutorService.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| } | ||
|
|
||
| try { | ||
| return (AgentOutput<S>) JsonUtils.getObjectMapper().treeToValue(outNode, AgentOutput.class); |
There was a problem hiding this comment.
Because AgentOutput.class is a raw class, Jackson will deserialize the parameterized custom state field as a LinkedHashMap instead of the concrete POJO class S. This will cause a ClassCastException when the caller attempts to cast or use the state as S. To support custom POJO state types correctly, the Agent and transport should be aware of the concrete Class<S> stateType (which can be passed from CustomAgentConfig) and use Jackson's TypeFactory to construct the proper parametric type (e.g., mapper.getTypeFactory().constructParametricType(AgentOutput.class, stateType)).
Description
Support For Genkit Agents
Type of Change
Changes Made
Testing
Checklist
Breaking Changes
New agents redefined
Documentation