User Confirmation Tool returns nested response object causing TypeError in backend (json.loads)

[PeterHiroshi]

Describe the bug
In google-adk v1.18.0, when invoking the User Confirmation Tool, the frontend sends a payload that incorrectly includes an additional nested response property.
As a result, the backend receives a structure like:

{
  "response": {
    "response": {
      "confirmed": true
    }
  }
}

Instead of the expected:

  "response": {
    "confirmed": true
  }
}

This leads to a TypeError during backend execution:

TypeError: the JSON object must be str, bytes or bytearray, not dict

To Reproduce
Steps to reproduce the behavior:

1. Install google-adk 1.18.0
2. Invoke the user_confirmation tool from the frontend
3. Check the payload sent to the backend — it includes a double response nesting
4. Observe backend logs showing the following error:

TypeError: the JSON object must be str, bytes or bytearray, not dict

Expected behavior
The backend should receive a correctly formatted JSON payload (single response layer) so that json.loads() can process it without error.

Screenshots
Invoke the user confirmation tool from the frontend

Observe the request payload from the frontend

Debug the code at google/adk/flows/llm_flows/request_confirmation.py:84 from the backend, the value of function_response.response['response'] like below

Observe backend logs showing the following error

Desktop (please complete the following information):

• OS: macOS
• Python version: 3.11.9
• ADK version: 1.18.0

Model Information:
• Using LiteLLM: Yes
• Model used: claude-4.5

Additional context
The issue seems to originate from the frontend serialization step in the User Confirmation Tool handler, where the response object is wrapped twice before sending to the backend.

[ridhwanashir]

having the same issue, i develop my own chat interface now

[surajksharma07]

@PeterHiroshi This is a bug in the web frontend that double-nests the response object, causing json.loads() to fail at request_confirmation.py:84 when it receives a dict instead of a JSON string.

The fix is to add defensive handling in request_confirmation.py:84 to check if response_data is already a dict (buggy case) or a string (correct case), and handle both: if isinstance(response_data, str): json.loads(response_data) else use the dict directly.

This backend fix will unblock users immediately while the frontend is being fixed to send the correct single-nested structure.

See the proposed fix code in the analysis - it handles both the buggy frontend payload {"response": {"response": {...}}} and the correct format {"response": "{...}"}.

Thanks!