[LI (ktz03)]

Motivation & Context

Equivalent literal and percent-encoded base64 data URIs currently produce different results. Core media detection/payload extraction and several adapter consumers reject encoded payloads or decode the wrong bytes. Decoding during metadata validation would also do unnecessary work before any payload is consumed.

Description & Review Guide

• What are the major changes? Percent-decode once at the existing payload-consumption boundaries in core, Ollama, A2A, hosting-MCP and hosting-A2A. Each module uses the standard-library decoder directly, so independently installed adapters do not acquire a dependency on a new private core symbol. Extend seven existing test files.
• What is the impact of these changes? Literal plus signs retain their meaning, stored URIs and metadata remain unchanged, and nested escapes are not recursively decoded. Existing header checks, empty-attachment behavior and strict base64 validators retain their contracts. MCP emits normalized base64 text; A2A retains raw-byte output. No new payload-size policy is introduced.
• What do you want reviewers to focus on? The existing metadata parser, URI validator and general byte getter remain unchanged. The new tests cover literal/escaped/mixed payloads, a valid PNG, serialization without payload decoding, one-time consumption, strict rejection and adapter output metadata. Local validation is bounded as described below; this draft is not a claim that the full affected-package suites passed.

Local checks on Windows/Python 3.14.3 exercised the real core public exports with the complete preserved helper-module snapshot, the complete A2A URI helper and the exact extracted Ollama decoder: 14 failing cases and 16 passing controls on the current core baseline become 30 passing cases after the change. The helper snapshot is a selected source closure, not a complete current SDK installation. Separate non-author checks exercise the complete hosting conversion functions with recording constructors at the protocol boundary; those checks do not validate native MCP/A2A SDK types or schemas.

All 12 changed files compile and pass the applicable Ruff format check. The five production files pass Ruff lint; six existing test import-order findings reproduce on the baseline as well. Full affected-package pytest suites, native protocol integration, type checks and official CI have not run; the installed protocol/test dependencies do not match the current lock.

Related Issue

Fixes #9653.

This replaces #9664 under MuonChaser's agreed handoff and the maintainer's explicit direction. MuonChaser's original percent-decoding work and escaped-PNG coverage informed this replacement. The old author branch is unchanged; this moves decoding out of metadata validation and covers the named consumers.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: Codex: implementation, tests, and this PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change.

[Copilot]

🟢 Approval recommended

There are no active review issues for the data URI payload-decoding change.

No open issues 🎉

What changed in this PR

This PR addresses #9653 by percent-decoding base64 data URI payloads when consumed by Python core helpers and adapters, rather than during metadata validation.

Changes:

• Decode payloads once across core, Ollama, A2A, hosting-MCP, and hosting-A2A using the standard library.
• Preserve literal +, stored URIs, metadata, and existing validation behavior.
• Extend seven test files with encoded-payload regressions, including PNG detection, serialization, adapter output, and nested-escape rejection.

Full affected-package tests, native protocol integration, type checks, and official CI remain unverified, as noted in the PR description.

File	Description
python/​packages/​ollama/​tests/​test_ollama_chat_client.py	Test escaped image payloads in chat requests.
python/​packages/​ollama/​agent_framework_ollama/​_chat_client.py	Percent-decode image payloads before strict base64 decoding.
python/​packages/​hosting-mcp/​tests/​hosting_mcp/​test_conversion.py	Test normalized payloads, preserved metadata, and invalid inputs.
python/​packages/​hosting-mcp/​agent_framework_hosting_mcp/​_conversion.py	Normalize escaped base64 text before validation and output.
python/​packages/​hosting-a2a/​tests/​hosting_a2a/​test_conversion.py	Test raw-byte output, metadata, and invalid payload rejection.
python/​packages/​hosting-a2a/​agent_framework_hosting_a2a/​_conversion.py	Percent-decode payloads before conversion to raw bytes.
python/​packages/​core/​tests/​core/​test_types.py	Cover PNG detection, extraction, serialization, and single decoding.
python/​packages/​core/​agent_framework/​_types.py	Decode payload escapes during detection and extraction.
python/​packages/​a2a/​tests/​test_utils.py	Test literal, escaped, mixed, and nested-escaped payloads.
python/​packages/​a2a/​tests/​test_a2a_executor.py	Exercise escaped attachments while retaining empty-attachment coverage.
python/​packages/​a2a/​tests/​test_a2a_agent.py	Test escaped data payloads in outgoing A2A messages.
python/​packages/​a2a/​agent_framework_a2a/​_utils.py	Validate headers separately and decode payload escapes once.

_{Review effort: Balanced}