[Linux2010]

Summary

A REST task ID ending in :subscribe or :cancel can be confused with an action. Go's url.PathEscape leaves colons unescaped, so GetTask for foo:subscribe can send a subscription request. On the server, even a properly escaped request such as GET /tasks/foo%3Asubscribe is decoded before dispatch and incorrectly subscribes to foo; POST /tasks/foo%3Acancel can cancel foo.

Escape colons in GetTask IDs and distinguish literal action separators from encoded colons using the raw path segment before dispatch. Preserve encoded action characters and existing GET/POST subscription support. Add client and server regressions covering encoded and literal separators, double encoding, query strings and tenants.

Validation

• Confirmed client and server regressions fail before the fix.
• go test ./...
• go test -race ./a2aclient ./a2asrv
• go vet ./...
• golangci-lint run ./... (v2.11.4)
• git diff --check

Loopback tests used NO_PROXY=localhost,127.0.0.1,::1.