Python: feat: add agent-framework-monty (Monty-backed CodeAct provider) (#5915)

* Python: feat: add agent-framework-monty (Monty-backed CodeAct) New alpha package that wraps pydantic-monty (a Rust-based Python interpreter) behind the same CodeAct API surface as agent-framework-hyperlight, so users can swap providers with minimal code change. Public API (agent_framework_monty): - MontyCodeActProvider — ContextProvider that injects a run-scoped execute_code tool plus dynamic CodeAct instructions. - MontyExecuteCodeTool — standalone FunctionTool for mixed-tool agents or manual static wiring. - FileMount / FileMountInput / MountMode — public types mirroring the Hyperlight names, with Monty's mode (read-only/read-write/overlay) and write_bytes_limit on FileMount. Constructor kwargs (both classes) mirror Hyperlight where possible: tools, approval_mode, workspace_root, file_mounts; plus a Monty-only resource_limits forwarding ResourceLimits to Monty.start(). Filesystem flow: - workspace_root auto-mounts at /input (read-write), matching Hyperlight. - file_mounts accepts string shorthand, (host, mount) tuple, or FileMount with mode + write cap. - Files written under read-write mounts are scanned post-execution and returned as Content.from_data items (mirrors Hyperlight /output). - overlay mounts buffer writes in-memory; read-only mounts reject writes. Internals: - _monty_bridge.InlineCodeBridge ports the inline (non-durable) bridge from anthonychu/maf-codeact-monty-python; handles FunctionSnapshot / FutureSnapshot pause/resume, dispatches direct typed calls + the call_tool fallback, forwards mount/limits to Monty.start(...). - generate_type_stubs emits per-tool stubs so Monty's `ty` type-checker rejects bad calls before any host tool runs. Alpha-policy compliance (per python-package-management skill): - Added agent-framework-monty = { workspace = true } to root pyproject.toml. - Added row to python/PACKAGE_STATUS.md. - Added monty entry under Experimental in python/AGENTS.md. - NOT added to core[all]; NO agent_framework.monty lazy shim (deferred to beta promotion). Samples (three sets, import from agent_framework_monty directly): - samples/02-agents/context_providers/code_act/monty_code_act.py (provider pattern) + updated local README. - samples/02-agents/tools/monty_code_interpreter/ (standalone + manual-wiring + README). - samples/04-hosting/foundry-hosted-agents/responses/11_monty_codeact/ (full hosted-agent layout with uv-based pyproject.toml + Dockerfile, Azure Monitor wiring via APPLICATIONINSIGHTS_CONNECTION_STRING + enable_instrumentation, ENABLE_INSTRUMENTATION and ENABLE_SENSITIVE_DATA env vars). The alpha wheel is vendored into ./wheels/ (gitignored) via vendor-wheel.sh; new row added to the parent Responses-API README. Tests: - 28 hermetic unit tests (stubbed pydantic_monty). - 18 integration tests marked @pytest.mark.integration, auto-skipped when pydantic_monty is unimportable; exercise the real Monty runtime: print round-trip, last-expression value, direct typed tool dispatch, call_tool fallback, async tool, asyncio.gather parallelism, ty type-check rejection, OS blocked by default, workspace_root read+write capture, read-only / overlay mount semantics, resource_limits.max_duration_secs abort, approval gating end-to-end, full Agent run with a scripted chat client. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Python: fix: monty FileMount test compares against the normalized POSIX path The shorthand string mount goes through _normalize_mount_path, which rewrites Windows drive letters like 'C:\\Users\\...' into '/C:/Users/...' (POSIX-style). The Windows CI runners surfaced this because tmp_path resolves to a backslashed Windows path; the test was comparing against the raw str(host_a) instead of the normalized form. Compare against _normalize_mount_path(str(host_a)) so the assertion is platform-independent. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Python: fix: address PR #5915 review feedback - _execute_code_tool docstring: clarify that the Monty backend supports scoped filesystem access via workspace_root / file_mounts (blocked by default). - _to_monty_mount: import pydantic_monty lazily through load_monty so missing-dependency errors surface as the same actionable RuntimeError the rest of the package raises (not a bare ImportError at module load). Renamed _load_monty -> load_monty for the same reason. - _python_type_repr: emit None for type(None) instead of Any, and normalize both typing.Union[...] and PEP-604 X | Y to PEP-604 syntax so Optional[X] / Union[..., None] / -> None signatures round-trip correctly through ty validation. Added a regression test. - _PrintCollector: track a running character count instead of recomputing sum(len(c) for c in self.chunks) per callback. Eliminates the O(n^2) cost on print-heavy code. - Instructions: mention that the value of the final expression is also returned alongside captured stdout (matches actual behavior). - 11_monty_codeact Dockerfile: pin ghcr.io/astral-sh/uv to 0.11.6 instead of :latest for reproducible builds. - 11_monty_codeact README: replace the bare "see parent README" pointer with sample-specific steps (./vendor-wheel.sh + uv sync + uv run), since the sample uses pyproject.toml + a vendored wheel rather than requirements.txt. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Python: sample: 11_monty_codeact installs agent-framework-monty from PyPI Drop the vendored-wheel scaffolding now that agent-framework-monty is on PyPI as an alpha (1.0.0a*) release: - pyproject.toml: remove [tool.uv.sources] override; keep [tool.uv] prerelease = "allow" so uv pulls the alpha automatically. - Dockerfile: drop the COPY wheels/ step. - README: drop the ./vendor-wheel.sh setup step and the not-yet-on-PyPI warning. - Delete vendor-wheel.sh and the gitignored wheels/ directory. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Python: fix(monty): harden post-execution file capture against symlink escape Same class of issue as the MSRC-reported Hyperlight finding: the post-execution capture walked workspace_root with Path.rglob() + is_file() + read_bytes() - all of which follow symlinks. An attacker who controls the workspace (cloned repo, extracted archive, shared workspace) could pre-place `workspace/leak.txt -> /etc/passwd` or `workspace/outside_dir -> /etc/` and have host files surface as captured Content items. Monty's mount layer already rejects symlink reads from inside the sandbox across all three modes (verified empirically), so the runtime path was safe. This commit closes the post-execution scan path. Changes: - New `_iter_real_files(root)` walker that uses iterdir() + is_symlink() to skip symlinks at every directory level and yields only real files. Replaces the previous `host_root.rglob("*")` calls in both `_snapshot_writable_mounts` and `_capture_written_files`. - Use `Path.lstat()` instead of `Path.stat()` so size/mtime can never be taken from a symlink target. - Three new integration tests reproducing the MSRC attack shape against the workspace_root flow: symlink-to-file outside workspace, symlink-to-directory outside workspace, and a guard ensuring legitimate sandbox writes are still captured when symlinks are present. Per user request, hyperlight is untouched in this commit (separate fix). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Python: fix(monty): skip symlink regression tests when unsupported Apply the same Windows-CI safety guard as the hyperlight fix in PR #5919: the three symlink integration tests create symlinks via Path.symlink_to(), which fails with OSError / NotImplementedError on unprivileged Windows runners. Add a local _symlinks_supported helper (mirroring the one in packages/core/tests/core/test_skills.py) and pytest.skip when symlinks aren't available, so the tests no longer fail for environment reasons. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Python: fix(monty): address PR #5915 follow-up review feedback - _invoke_tool: drop the inspect.iscoroutinefunction(...) branch and always `await self.tool_map[name](**kwargs)`. Every entry in tool_map is `partial(FunctionTool.invoke, skip_parsing=True)` and FunctionTool.invoke is `async def`, so the branching was dead code - and on Python versions affected by cpython#98590, iscoroutinefunction(partial(bound_async_method, ...)) returns False, causing the bridge to take the asyncio.to_thread path, return an unawaited coroutine, and surface it as a JSON-serialization failure for every tool call. Added a regression test test_invoke_tool_awaits_partial_wrapped_async_method. - generate_type_stubs: skip tools whose name is not a valid Python identifier or is a Python keyword. FunctionTool.name has no upstream validation, so a name like "weird-name" produced a syntax error in the stubs and a name like "broken\n pass\nasync def injected" would inject arbitrary stub source. Non-identifier names stay reachable via `call_tool("weird-name", ...)` at runtime; they just don't get type-checked stubs. Added regression test test_generate_type_stubs_skips_non_identifier_tool_names. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-06-16 21:04:09 +08:00 · 2026-05-20 00:35:23 +00:00
parent 4b0522d62d
commit 4609535e22
29 changed files with 3738 additions and 10 deletions
@@ -0,0 +1,642 @@
+# Copyright (c) Microsoft. All rights reserved.
+
+"""Hermetic unit tests for ``agent_framework_monty``.
+
+These tests inject a fake Monty runtime via ``monkeypatch`` so they run without
+the real ``pydantic-monty`` package doing any work. End-to-end tests against
+the real runtime live in ``test_monty_codeact_integration.py``.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+import types
+from collections.abc import Iterable, Iterator
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Annotated, Any
+from unittest.mock import MagicMock
+
+import pytest
+from agent_framework import Content, FunctionTool, Message, tool
+from agent_framework._sessions import SessionContext
+
+from agent_framework_monty import MontyCodeActProvider, MontyExecuteCodeTool
+from agent_framework_monty import _execute_code_tool as execute_code_module
+from agent_framework_monty import _monty_bridge as bridge_module
+
+# ---------------------------------------------------------------------------
+# Fake Monty runtime - drop-in replacement for pydantic_monty
+# ---------------------------------------------------------------------------
+
+
+@dataclass
+class _FakeMontyComplete:
+    output: Any = None
+
+
+@dataclass
+class _FakeFunctionSnapshot:
+    function_name: str
+    call_id: int
+    args: tuple[Any, ...] = ()
+    kwargs: dict[str, Any] = field(default_factory=dict)
+    is_os_function: bool = False
+    _script: _FakeScript | None = None
+
+    def resume(self, payload: Any) -> Any:
+        assert self._script is not None, "Snapshot must be attached to a script."
+        return self._script.advance(("function_resume", self, payload))
+
+
+@dataclass
+class _FakeFutureSnapshot:
+    pending_call_ids: list[int]
+    _script: _FakeScript | None = None
+
+    def resume(self, payload: Any) -> Any:
+        assert self._script is not None, "Snapshot must be attached to a script."
+        return self._script.advance(("future_resume", self, payload))
+
+
+@dataclass
+class _FakeNameLookupSnapshot:
+    variable_name: str
+
+
+@dataclass
+class _PrintAction:
+    """Marker pushed onto a script to emit captured stdout via the print callback."""
+
+    text: str
+
+
+class _FakeScript:
+    """Replayable Monty progress script with a resume log."""
+
+    def __init__(self, items: Iterable[Any]) -> None:
+        self._queue: list[Any] = list(items)
+        self.resume_log: list[tuple[str, Any, Any]] = []
+
+    def attach(self, snapshot: Any) -> Any:
+        snapshot._script = self
+        return snapshot
+
+    def next_item(self) -> Any:
+        if not self._queue:
+            return _FakeMontyComplete(output=None)
+        item = self._queue.pop(0)
+        if isinstance(item, _FakeMontyComplete):
+            return item
+        if isinstance(item, _PrintAction):
+            return item
+        if isinstance(item, _FakeNameLookupSnapshot):
+            return item
+        return self.attach(item)
+
+    def advance(self, log_entry: tuple[str, Any, Any]) -> Any:
+        self.resume_log.append(log_entry)
+        return self.next_item()
+
+
+_current_script: list[_FakeScript | None] = [None]
+
+
+def _set_script(*items: Any) -> _FakeScript:
+    script = _FakeScript(items)
+    _current_script[0] = script
+    return script
+
+
+def _get_script() -> _FakeScript:
+    script = _current_script[0]
+    assert script is not None, "Test must call _set_script(...) before running code."
+    return script
+
+
+class _FakeMonty:
+    def __init__(
+        self,
+        code: str,
+        *,
+        script_name: str,
+        type_check: bool,
+        type_check_stubs: str | None,
+    ) -> None:
+        self.code = code
+        self.script_name = script_name
+        self.type_check = type_check
+        self.type_check_stubs = type_check_stubs
+        self._script = _get_script()
+
+    def start(self, *, print_callback: Any) -> Any:
+        while True:
+            item = self._script.next_item()
+            if isinstance(item, _PrintAction):
+                print_callback("stdout", item.text)
+                continue
+            return item
+
+
+@pytest.fixture(autouse=True)
+def fake_monty_module(monkeypatch: pytest.MonkeyPatch) -> Iterator[None]:
+    """Install a fake ``pydantic_monty`` module for the duration of each test."""
+    fake = types.ModuleType("pydantic_monty")
+    fake.Monty = _FakeMonty  # type: ignore[attr-defined]
+    fake.MontyComplete = _FakeMontyComplete  # type: ignore[attr-defined]
+    fake.FunctionSnapshot = _FakeFunctionSnapshot  # type: ignore[attr-defined]
+    fake.FutureSnapshot = _FakeFutureSnapshot  # type: ignore[attr-defined]
+    fake.NameLookupSnapshot = _FakeNameLookupSnapshot  # type: ignore[attr-defined]
+
+    monkeypatch.setitem(sys.modules, "pydantic_monty", fake)
+    _current_script[0] = None
+    yield
+    _current_script[0] = None
+
+
+# ---------------------------------------------------------------------------
+# Sample tools used across tests
+# ---------------------------------------------------------------------------
+
+
+@tool
+def add_tool(
+    a: Annotated[int, "First addend"],
+    b: Annotated[int, "Second addend"],
+) -> int:
+    """Add two integers."""
+    return a + b
+
+
+@tool
+def mul_tool(
+    a: Annotated[int, "First factor"],
+    b: Annotated[int, "Second factor"],
+) -> int:
+    """Multiply two integers."""
+    return a * b
+
+
+@tool(approval_mode="always_require")
+def dangerous_tool(payload: Annotated[str, "Anything"]) -> str:
+    """A tool that always requires approval."""
+    return payload
+
+
+# ---------------------------------------------------------------------------
+# MontyExecuteCodeTool tests
+# ---------------------------------------------------------------------------
+
+
+def test_tool_construction_defaults() -> None:
+    monty_tool = MontyExecuteCodeTool()
+    assert monty_tool.name == "execute_code"
+    assert monty_tool.approval_mode == "never_require"
+    assert monty_tool.get_tools() == []
+
+
+def test_add_remove_clear_tools_round_trip() -> None:
+    monty_tool = MontyExecuteCodeTool()
+
+    monty_tool.add_tools([add_tool, mul_tool])
+    assert [t.name for t in monty_tool.get_tools()] == ["add_tool", "mul_tool"]
+
+    monty_tool.remove_tool("add_tool")
+    assert [t.name for t in monty_tool.get_tools()] == ["mul_tool"]
+
+    with pytest.raises(KeyError):
+        monty_tool.remove_tool("missing")
+
+    monty_tool.clear_tools()
+    assert monty_tool.get_tools() == []
+
+
+def test_approval_required_tool_gates_execute_code() -> None:
+    monty_tool = MontyExecuteCodeTool(tools=[add_tool])
+    assert monty_tool.approval_mode == "never_require"
+
+    monty_tool.add_tools([dangerous_tool])
+    assert monty_tool.approval_mode == "always_require"
+
+    monty_tool.remove_tool("dangerous_tool")
+    assert monty_tool.approval_mode == "never_require"
+
+
+def test_default_approval_mode_always_require_is_sticky() -> None:
+    monty_tool = MontyExecuteCodeTool(tools=[add_tool], approval_mode="always_require")
+    assert monty_tool.approval_mode == "always_require"
+
+    monty_tool.clear_tools()
+    assert monty_tool.approval_mode == "always_require"
+
+
+def test_dynamic_description_reflects_registered_tools() -> None:
+    monty_tool = MontyExecuteCodeTool(tools=[add_tool])
+    description = monty_tool.description
+    assert "add_tool" in description
+    assert "Monty" in description
+
+    monty_tool.add_tools([mul_tool])
+    description_updated = monty_tool.description
+    assert "mul_tool" in description_updated
+
+
+def test_create_run_tool_snapshots_current_state() -> None:
+    monty_tool = MontyExecuteCodeTool(tools=[add_tool], approval_mode="never_require")
+    run_tool = monty_tool.create_run_tool()
+
+    assert run_tool is not monty_tool
+    assert [t.name for t in run_tool.get_tools()] == ["add_tool"]
+    assert run_tool.approval_mode == monty_tool.approval_mode
+
+    # Mutating the original must not leak into the snapshot.
+    monty_tool.add_tools([mul_tool])
+    assert [t.name for t in run_tool.get_tools()] == ["add_tool"]
+
+
+def test_build_serializable_state_matches_effective_config() -> None:
+    monty_tool = MontyExecuteCodeTool(tools=[add_tool, dangerous_tool])
+    state = monty_tool.build_serializable_state()
+    assert state["runtime"] == "monty"
+    assert state["approval_mode"] == "always_require"
+    assert set(state["tool_names"]) == {"add_tool", "dangerous_tool"}
+    assert state["workspace_root"] is None
+    assert state["file_mounts"] == []
+    assert state["resource_limits"] is None
+
+
+def test_file_mounts_normalized_and_round_tripped(tmp_path: Path) -> None:
+    from agent_framework_monty import FileMount
+    from agent_framework_monty._execute_code_tool import _normalize_mount_path
+
+    host_a = tmp_path / "a"
+    host_a.mkdir()
+    host_b = tmp_path / "b"
+    host_b.mkdir()
+
+    monty_tool = MontyExecuteCodeTool(
+        file_mounts=[
+            str(host_a),  # shorthand: same path on both sides
+            (str(host_b), "/work"),  # explicit tuple
+            FileMount(host_path=host_a, mount_path="/data", mode="read-only"),
+        ],
+    )
+
+    mounts = monty_tool.get_file_mounts()
+    by_mount = {m.mount_path: m for m in mounts}
+
+    # The shorthand string is normalized through _normalize_mount_path (POSIX-style),
+    # so on Windows `C:\\...` becomes `/C:/...`. Compare against the same normalizer.
+    shorthand_key = _normalize_mount_path(str(host_a))
+    assert set(by_mount) == {shorthand_key, "/work", "/data"}
+    assert by_mount["/work"].host_path == host_b.resolve()
+    assert by_mount["/data"].mode == "read-only"
+    assert by_mount[shorthand_key].mode == "overlay"  # default
+
+
+def test_workspace_root_auto_mounts_at_input(tmp_path: Path) -> None:
+    monty_tool = MontyExecuteCodeTool(workspace_root=tmp_path)
+    mounts = monty_tool._effective_mounts()
+    assert any(m.mount_path == "/input" and m.mode == "read-write" for m in mounts)
+
+
+def test_workspace_root_yields_to_explicit_input_mount(tmp_path: Path) -> None:
+    from agent_framework_monty import FileMount
+
+    explicit = tmp_path / "explicit"
+    explicit.mkdir()
+    monty_tool = MontyExecuteCodeTool(
+        workspace_root=tmp_path,
+        file_mounts=[FileMount(host_path=explicit, mount_path="/input", mode="read-only")],
+    )
+    input_mounts = [m for m in monty_tool._effective_mounts() if m.mount_path == "/input"]
+    assert len(input_mounts) == 1
+    assert input_mounts[0].mode == "read-only"
+    assert input_mounts[0].host_path == explicit.resolve()
+
+
+def test_remove_file_mount_raises_on_missing() -> None:
+    monty_tool = MontyExecuteCodeTool()
+    with pytest.raises(KeyError):
+        monty_tool.remove_file_mount("/never-added")
+
+
+def test_dynamic_description_mentions_filesystem_when_mounts_configured(tmp_path: Path) -> None:
+    monty_tool = MontyExecuteCodeTool(workspace_root=tmp_path)
+    description = monty_tool.description
+    assert "Filesystem access is enabled" in description
+    assert "/input" in description
+
+
+def test_dynamic_description_default_mentions_no_filesystem() -> None:
+    monty_tool = MontyExecuteCodeTool()
+    description = monty_tool.description
+    assert "Filesystem access is unavailable" in description
+
+
+def test_resource_limits_round_trip() -> None:
+    monty_tool = MontyExecuteCodeTool(resource_limits={"max_duration_secs": 5.0})
+    assert monty_tool.resource_limits == {"max_duration_secs": 5.0}
+    state = monty_tool.build_serializable_state()
+    assert state["resource_limits"] == {"max_duration_secs": 5.0}
+
+
+def test_build_instructions_includes_registered_tools() -> None:
+    monty_tool = MontyExecuteCodeTool(tools=[add_tool])
+    instructions = monty_tool.build_instructions(tools_visible_to_model=False)
+    assert "add_tool" in instructions
+    assert "execute_code" in instructions
+    assert "asyncio.gather" in instructions
+
+
+def test_execute_code_filtered_out_when_added_as_tool() -> None:
+    spurious = FunctionTool(
+        name="execute_code",
+        description="should not appear",
+        func=lambda: None,
+    )
+    monty_tool = MontyExecuteCodeTool(tools=[spurious, add_tool])
+    assert [t.name for t in monty_tool.get_tools()] == ["add_tool"]
+
+
+# ---------------------------------------------------------------------------
+# _run_code behavior with the fake Monty runtime
+# ---------------------------------------------------------------------------
+
+
+async def test_run_code_with_no_tools_returns_default_text() -> None:
+    _set_script(_FakeMontyComplete(output=None))
+
+    monty_tool = MontyExecuteCodeTool()
+    result = await monty_tool._run_code(code="None")
+
+    assert len(result) == 1
+    assert isinstance(result[0], Content)
+
+
+async def test_run_code_surfaces_stdout_and_output() -> None:
+    _set_script(_PrintAction("hello\n"), _FakeMontyComplete(output=42))
+
+    monty_tool = MontyExecuteCodeTool()
+    result = await monty_tool._run_code(code="print('hello')")
+
+    text_contents = [c for c in result if c.type == "text"]
+    assert any("hello" in (c.text or "") for c in text_contents)
+    assert any(
+        (c.text or "").strip() and json.loads(c.text or "null") == 42
+        for c in text_contents
+        if (c.text or "").strip().isdigit()
+    )
+
+
+async def test_run_code_direct_typed_call_invokes_registered_tool() -> None:
+    func_snapshot = _FakeFunctionSnapshot(
+        function_name="add_tool",
+        call_id=1,
+        kwargs={"a": 2, "b": 3},
+    )
+    future_snapshot = _FakeFutureSnapshot(pending_call_ids=[1])
+    script = _set_script(func_snapshot, future_snapshot, _FakeMontyComplete(output=None))
+
+    monty_tool = MontyExecuteCodeTool(tools=[add_tool])
+    await monty_tool._run_code(code="await add_tool(a=2, b=3)")
+
+    payloads = [payload for _, _, payload in script.resume_log]
+    assert {"future": ...} in payloads
+    final_resume = next(p for p in payloads if isinstance(p, dict) and 1 in p)
+    assert final_resume[1] == {"return_value": 5}
+
+
+async def test_run_code_call_tool_fallback_invokes_registered_tool() -> None:
+    func_snapshot = _FakeFunctionSnapshot(
+        function_name="call_tool",
+        call_id=7,
+        args=("add_tool",),
+        kwargs={"a": 4, "b": 8},
+    )
+    future_snapshot = _FakeFutureSnapshot(pending_call_ids=[7])
+    script = _set_script(func_snapshot, future_snapshot, _FakeMontyComplete(output=None))
+
+    monty_tool = MontyExecuteCodeTool(tools=[add_tool])
+    await monty_tool._run_code(code="await call_tool('add_tool', a=4, b=8)")
+
+    payloads = [payload for _, _, payload in script.resume_log]
+    final_resume = next(p for p in payloads if isinstance(p, dict) and 7 in p)
+    assert final_resume[7] == {"return_value": 12}
+
+
+async def test_run_code_unknown_tool_returns_nameerror_resume() -> None:
+    func_snapshot = _FakeFunctionSnapshot(
+        function_name="does_not_exist",
+        call_id=11,
+    )
+    script = _set_script(func_snapshot, _FakeMontyComplete(output=None))
+
+    monty_tool = MontyExecuteCodeTool(tools=[add_tool])
+    await monty_tool._run_code(code="await does_not_exist()")
+
+    payloads = [payload for _, _, payload in script.resume_log]
+    assert any(isinstance(p, dict) and p.get("exc_type") == "NameError" for p in payloads)
+
+
+async def test_run_code_os_function_is_rejected_with_permissionerror() -> None:
+    os_snapshot = _FakeFunctionSnapshot(
+        function_name="os.listdir",
+        call_id=12,
+        is_os_function=True,
+    )
+    script = _set_script(os_snapshot, _FakeMontyComplete(output=None))
+
+    monty_tool = MontyExecuteCodeTool(tools=[add_tool])
+    await monty_tool._run_code(code="import os; os.listdir('.')")
+
+    payloads = [payload for _, _, payload in script.resume_log]
+    assert any(isinstance(p, dict) and p.get("exc_type") == "PermissionError" for p in payloads)
+
+
+async def test_when_any_returns_nameerror_now_that_it_is_removed() -> None:
+    """`when_any` is no longer part of the DSL and should resolve to a NameError."""
+    func_snapshot = _FakeFunctionSnapshot(
+        function_name="when_any",
+        call_id=99,
+        args=([{"tool": "add_tool", "kwargs": {"a": 1, "b": 2}}],),
+    )
+    script = _set_script(func_snapshot, _FakeMontyComplete(output=None))
+
+    monty_tool = MontyExecuteCodeTool(tools=[add_tool])
+    await monty_tool._run_code(code="await when_any([{'tool': 'add_tool', 'kwargs': {'a': 1, 'b': 2}}])")
+
+    payloads = [payload for _, _, payload in script.resume_log]
+    assert any(isinstance(p, dict) and p.get("exc_type") == "NameError" for p in payloads)
+
+
+async def test_run_code_call_tool_with_unregistered_name_returns_error() -> None:
+    func_snapshot = _FakeFunctionSnapshot(
+        function_name="call_tool",
+        call_id=20,
+        args=("missing",),
+        kwargs={},
+    )
+    script = _set_script(func_snapshot, _FakeMontyComplete(output=None))
+
+    monty_tool = MontyExecuteCodeTool(tools=[add_tool])
+    await monty_tool._run_code(code="await call_tool('missing')")
+
+    payloads = [payload for _, _, payload in script.resume_log]
+    assert any(
+        isinstance(p, dict) and p.get("exc_type") == "ValueError" and "Tool 'missing'" in p.get("message", "")
+        for p in payloads
+    )
+
+
+async def test_run_code_returns_error_content_on_runtime_failure(monkeypatch: pytest.MonkeyPatch) -> None:
+    class _BoomBridge:
+        def __init__(self, tool_map: Any, **_: Any) -> None:
+            pass
+
+        async def run(self, code: str) -> dict[str, Any]:
+            raise RuntimeError("boom")
+
+    monkeypatch.setattr(execute_code_module, "InlineCodeBridge", _BoomBridge)
+
+    monty_tool = MontyExecuteCodeTool()
+    result = await monty_tool._run_code(code="x = 1")
+    assert len(result) == 1
+    assert result[0].type == "error"
+    assert "boom" in (result[0].error_details or "")
+
+
+# ---------------------------------------------------------------------------
+# MontyCodeActProvider tests
+# ---------------------------------------------------------------------------
+
+
+async def test_provider_injects_execute_code_tool_and_instructions() -> None:
+    provider = MontyCodeActProvider(tools=[add_tool])
+    context = SessionContext(input_messages=[Message(role="user", contents=[Content.from_text("hi")])])
+    state: dict[str, Any] = {}
+
+    await provider.before_run(agent=MagicMock(), session=None, context=context, state=state)
+
+    assert state["monty_codeact"]["tool_names"] == ["add_tool"]
+    assert any("add_tool" in instruction for instruction in context.instructions)
+    assert len(context.tools) == 1
+    assert isinstance(context.tools[0], MontyExecuteCodeTool)
+    # The injected tool is a per-run snapshot, not the provider's stored copy.
+    assert context.tools[0] is not provider._execute_code_tool  # type: ignore[attr-defined]
+
+
+def test_provider_delegates_tool_management_to_internal_tool() -> None:
+    provider = MontyCodeActProvider()
+    provider.add_tools([add_tool, mul_tool])
+    assert [t.name for t in provider.get_tools()] == ["add_tool", "mul_tool"]
+
+    provider.remove_tool("add_tool")
+    assert [t.name for t in provider.get_tools()] == ["mul_tool"]
+
+    provider.clear_tools()
+    assert provider.get_tools() == []
+
+
+# ---------------------------------------------------------------------------
+# generate_type_stubs - signature smoke test
+# ---------------------------------------------------------------------------
+
+
+def test_generate_type_stubs_emits_dsl_and_tool_signatures() -> None:
+    def custom(x: int, y: str = "z") -> bool:
+        """Stub-test tool."""
+        return True
+
+    stubs = bridge_module.generate_type_stubs({"custom": custom})
+
+    assert "async def call_tool(name: str, **kwargs: Any) -> Any:" in stubs
+    assert "async def custom(x: int, y: str = ...) -> bool:" in stubs
+    assert "when_any" not in stubs
+
+
+def test_generate_type_stubs_preserves_none_and_optional() -> None:
+
+    def nullable_return(x: int) -> None:
+        """Returns nothing."""
+        return
+
+    def optional_param(x: int | None = None) -> bool:  # noqa: UP045 - intentional
+        """Optional via typing.Optional."""
+        return x is None
+
+    def union_param(x: int | str | None) -> str:  # noqa: UP007 - intentional
+        """Union with None."""
+        return str(x)
+
+    stubs = bridge_module.generate_type_stubs({
+        "nullable_return": nullable_return,
+        "optional_param": optional_param,
+        "union_param": union_param,
+    })
+
+    # ``None`` return must round-trip as None, not Any.
+    assert "async def nullable_return(x: int) -> None:" in stubs
+    # ``Optional[X]`` is ``Union[X, None]`` at runtime; preserve None.
+    assert "async def optional_param(x: int | None = ...) -> bool:" in stubs
+    # Multi-arm union with None.
+    assert "async def union_param(x: int | str | None) -> str:" in stubs
+
+
+def test_generate_type_stubs_skips_non_identifier_tool_names() -> None:
+    """Tool names that are not valid Python identifiers must not be splatted into stub source.
+
+    The model can still reach them via ``call_tool("weird-name", ...)`` at
+    runtime; they just don't get type-checked stubs.
+    """
+
+    def evil(x: int) -> int:
+        return x
+
+    def normal(x: int) -> int:
+        return x
+
+    stubs = bridge_module.generate_type_stubs({
+        # Hyphens are not valid identifier chars.
+        "weird-name": evil,
+        # Newlines in the name would inject arbitrary stub source.
+        "broken\n    pass\nasync def injected": evil,
+        # Python keywords are valid identifiers per ``str.isidentifier()`` but
+        # would still produce uncompilable stubs.
+        "async": evil,
+        # Real tool that should still appear.
+        "normal": normal,
+    })
+
+    assert "async def normal(x: int) -> int:" in stubs
+    assert "weird-name" not in stubs
+    assert "injected" not in stubs
+    assert "async def async(" not in stubs
+
+
+async def test_invoke_tool_awaits_partial_wrapped_async_method() -> None:
+    """A FunctionTool callback registered via partial(FunctionTool.invoke, ...) must be awaited.
+
+    Regression for PR #5915 review feedback: relying on ``inspect.iscoroutinefunction``
+    to choose between ``await`` and ``asyncio.to_thread`` is fragile for
+    ``functools.partial`` wrappers (cpython#98590) and would surface the
+    returned coroutine as a JSON-serialization error instead of the real
+    tool result. The bridge must always ``await`` entries in ``self.tool_map``.
+    """
+    from functools import partial
+
+    from agent_framework_monty._monty_bridge import InlineCodeBridge
+
+    @tool
+    def adder(a: Annotated[int, ""], b: Annotated[int, ""]) -> int:
+        """Add."""
+        return a + b
+
+    # Mirrors what _make_tool_callback returns.
+    cb = partial(adder.invoke, skip_parsing=True)
+    bridge = InlineCodeBridge({"adder": cb})
+
+    cid, payload = await bridge._invoke_tool(7, "adder", {"a": 6, "b": 7})
+    assert cid == 7
+    assert payload == {"return_value": 13}, payload
@@ -0,0 +1,601 @@
+# Copyright (c) Microsoft. All rights reserved.
+
+"""Integration tests for ``agent_framework_monty`` exercising the real Monty runtime.
+
+These tests import the real ``pydantic-monty`` package and run actual Python
+code through it via :class:`MontyExecuteCodeTool`. They are marked
+``@pytest.mark.integration`` and are skipped automatically when
+``pydantic_monty`` is unavailable.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import importlib.util
+import time
+from typing import Annotated, Any
+from unittest.mock import MagicMock
+
+import pytest
+from agent_framework import Agent, Content, Message, tool
+from agent_framework._sessions import SessionContext
+
+from agent_framework_monty import MontyCodeActProvider, MontyExecuteCodeTool
+
+
+def _monty_integration_skip_reason() -> str | None:
+    if importlib.util.find_spec("pydantic_monty") is None:
+        return "pydantic-monty is not installed."
+    return None
+
+
+pytestmark = [
+    pytest.mark.integration,
+    pytest.mark.skipif(
+        _monty_integration_skip_reason() is not None,
+        reason=_monty_integration_skip_reason() or "Monty integration tests are disabled.",
+    ),
+]
+
+
+# ---------------------------------------------------------------------------
+# Sample tools
+# ---------------------------------------------------------------------------
+
+
+@tool
+def add(
+    a: Annotated[int, "First addend"],
+    b: Annotated[int, "Second addend"],
+) -> int:
+    """Return ``a + b``."""
+    return a + b
+
+
+@tool
+def multiply(
+    a: Annotated[int, "First factor"],
+    b: Annotated[int, "Second factor"],
+) -> int:
+    """Return ``a * b``."""
+    return a * b
+
+
+@tool
+async def async_echo(value: Annotated[str, "Value to echo"]) -> str:
+    """Return ``value`` after a no-op await."""
+    await asyncio.sleep(0)
+    return value
+
+
+def _async_slow_factory(label: str, delay: float) -> Any:
+    @tool(name=f"slow_{label}")
+    async def slow(value: Annotated[int, "Input"]) -> int:
+        """Sleep asynchronously, then return value untouched."""
+        await asyncio.sleep(delay)
+        return value
+
+    return slow
+
+
+@tool(approval_mode="always_require")
+def restricted(payload: Annotated[str, "Any text"]) -> str:
+    """A tool that always requires approval."""
+    return payload
+
+
+def _text_outputs(contents: list[Content]) -> list[str]:
+    return [c.text or "" for c in contents if c.type == "text"]
+
+
+# ---------------------------------------------------------------------------
+# Basic execution
+# ---------------------------------------------------------------------------
+
+
+async def test_plain_python_print_round_trips() -> None:
+    monty_tool = MontyExecuteCodeTool()
+    result = await monty_tool._run_code(code="print('hello world')")
+
+    texts = _text_outputs(result)
+    assert any("hello world" in text for text in texts)
+
+
+async def test_last_expression_value_is_returned() -> None:
+    monty_tool = MontyExecuteCodeTool()
+    result = await monty_tool._run_code(code="5 + 7")
+
+    texts = _text_outputs(result)
+    assert any(text.strip() == "12" for text in texts)
+
+
+# ---------------------------------------------------------------------------
+# Tool dispatch
+# ---------------------------------------------------------------------------
+
+
+async def test_direct_typed_tool_call_invokes_host() -> None:
+    monty_tool = MontyExecuteCodeTool(tools=[add])
+    result = await monty_tool._run_code(code="print(await add(a=2, b=3))")
+
+    texts = _text_outputs(result)
+    assert any("5" in text for text in texts)
+
+
+async def test_call_tool_fallback_invokes_host() -> None:
+    monty_tool = MontyExecuteCodeTool(tools=[add])
+    result = await monty_tool._run_code(code="print(await call_tool('add', a=4, b=8))")
+
+    texts = _text_outputs(result)
+    assert any("12" in text for text in texts)
+
+
+async def test_async_host_tool_is_awaited() -> None:
+    monty_tool = MontyExecuteCodeTool(tools=[async_echo])
+    result = await monty_tool._run_code(code="print(await async_echo(value='ping'))")
+
+    texts = _text_outputs(result)
+    assert any("ping" in text for text in texts)
+
+
+# ---------------------------------------------------------------------------
+# Concurrency
+# ---------------------------------------------------------------------------
+
+
+async def test_asyncio_gather_fans_out_tool_calls_concurrently() -> None:
+    """Two async tools dispatched via ``asyncio.gather`` should run on the event loop in parallel.
+
+    Sync tools cannot fan out (FunctionTool.invoke runs them inline on the event loop),
+    so this test uses async host tools to verify the bridge's gather pipeline does
+    not introduce extra serialization.
+    """
+    slow_a = _async_slow_factory("a", delay=0.25)
+    slow_b = _async_slow_factory("b", delay=0.25)
+    monty_tool = MontyExecuteCodeTool(tools=[slow_a, slow_b])
+
+    code = """
+results = await asyncio.gather(slow_a(value=1), slow_b(value=2))
+print(results)
+"""
+
+    start = time.perf_counter()
+    result = await monty_tool._run_code(code=code)
+    elapsed = time.perf_counter() - start
+
+    texts = _text_outputs(result)
+    assert any("[1, 2]" in text for text in texts)
+    # Allow some scheduling slack but verify it's noticeably less than sequential (~0.5s).
+    assert elapsed < 0.45, f"Expected concurrent execution; took {elapsed:.3f}s"
+
+
+# ---------------------------------------------------------------------------
+# Sandbox safety + type checking
+# ---------------------------------------------------------------------------
+
+
+async def test_type_check_rejects_wrong_argument_type() -> None:
+    invocation_count = {"count": 0}
+
+    @tool
+    def typed_add(
+        a: Annotated[int, "First"],
+        b: Annotated[int, "Second"],
+    ) -> int:
+        """Add two ints; records invocations."""
+        invocation_count["count"] += 1
+        return a + b
+
+    monty_tool = MontyExecuteCodeTool(tools=[typed_add])
+    result = await monty_tool._run_code(code="print(await typed_add(a='not an int', b=3))")
+
+    texts = _text_outputs(result)
+    errors = [c for c in result if c.type == "error"]
+    # Either ty raises and surfaces as an error Content, or Monty reports the typing error in stdout.
+    assert errors or any("type" in text.lower() or "monty" in text.lower() for text in texts)
+    assert invocation_count["count"] == 0
+
+
+async def test_os_calls_are_blocked() -> None:
+    monty_tool = MontyExecuteCodeTool()
+    code = """
+try:
+    import os
+    os.listdir('/')
+    print('LEAKED')
+except PermissionError as exc:
+    print('blocked:', exc)
+except Exception as exc:
+    print('other:', type(exc).__name__)
+"""
+    result = await monty_tool._run_code(code=code)
+    texts = _text_outputs(result)
+    assert not any("LEAKED" in text for text in texts)
+    assert any("blocked" in text or "PermissionError" in text or "other" in text for text in texts)
+
+
+async def test_unknown_tool_call_returns_clean_error() -> None:
+    monty_tool = MontyExecuteCodeTool(tools=[add])
+    code = """
+try:
+    await call_tool('missing')
+except Exception as exc:
+    print('err:', type(exc).__name__, str(exc))
+"""
+    result = await monty_tool._run_code(code=code)
+    texts = _text_outputs(result)
+    assert any("missing" in text for text in texts)
+
+
+# ---------------------------------------------------------------------------
+# Print capture
+# ---------------------------------------------------------------------------
+
+
+async def test_print_truncation_caps_output() -> None:
+    monty_tool = MontyExecuteCodeTool()
+    # Emit more than MAX_PRINT_OUTPUT_CHARS bytes of output.
+    code = """
+for _ in range(2000):
+    print('X' * 64)
+"""
+    result = await monty_tool._run_code(code=code)
+    texts = _text_outputs(result)
+    combined = "\n".join(texts)
+    assert len(combined) <= 9000  # MAX_PRINT_OUTPUT_CHARS=8192 plus a small truncation marker
+    assert "[stdout truncated]" in combined
+
+
+# ---------------------------------------------------------------------------
+# Filesystem (workspace_root, file_mounts, output capture, resource limits)
+# ---------------------------------------------------------------------------
+
+
+async def test_workspace_root_reads_seed_files_from_host(tmp_path: Any) -> None:
+    seed = tmp_path / "seed.txt"
+    seed.write_text("hello from host", encoding="utf-8")
+    monty_tool = MontyExecuteCodeTool(workspace_root=tmp_path)
+
+    code = """
+import pathlib
+data = pathlib.Path('/input/seed.txt').read_text()
+print(data)
+"""
+    result = await monty_tool._run_code(code=code)
+    texts = _text_outputs(result)
+    assert any("hello from host" in text for text in texts)
+
+
+async def test_workspace_root_writes_are_captured_as_content(tmp_path: Any) -> None:
+    monty_tool = MontyExecuteCodeTool(workspace_root=tmp_path)
+
+    code = """
+import pathlib
+pathlib.Path('/input/report.txt').write_text('result-payload')
+print('wrote report')
+"""
+    result = await monty_tool._run_code(code=code)
+    data_contents = [c for c in result if c.type == "data"]
+    assert len(data_contents) == 1, [c.type for c in result]
+    written = data_contents[0]
+    # Content.from_data stores bytes as a base64-encoded data: URI.
+    import base64
+
+    assert written.uri is not None
+    payload = written.uri.split(",", 1)[1]
+    assert base64.b64decode(payload) == b"result-payload"
+    assert (written.additional_properties or {}).get("path") == "/input/report.txt"
+    # And the file actually landed on the host filesystem (read-write mode).
+    assert (tmp_path / "report.txt").read_text() == "result-payload"
+
+
+async def test_read_only_mount_writes_are_rejected_and_not_captured(tmp_path: Any) -> None:
+    from agent_framework_monty import FileMount
+
+    seed = tmp_path / "seed.txt"
+    seed.write_text("ro-content", encoding="utf-8")
+
+    monty_tool = MontyExecuteCodeTool(
+        file_mounts=[FileMount(host_path=tmp_path, mount_path="/ro", mode="read-only")],
+    )
+
+    code = """
+import pathlib
+print(pathlib.Path('/ro/seed.txt').read_text())
+try:
+    pathlib.Path('/ro/should-not-exist.txt').write_text('nope')
+    print('LEAKED')
+except Exception as exc:
+    print('write blocked:', type(exc).__name__)
+"""
+    result = await monty_tool._run_code(code=code)
+    texts = _text_outputs(result)
+    assert any("ro-content" in t for t in texts)
+    assert not any("LEAKED" in t for t in texts)
+    # No write went to host; no captured Content for the rejected write.
+    assert not (tmp_path / "should-not-exist.txt").exists()
+    assert not any(c.type == "data" for c in result)
+
+
+async def test_overlay_mount_writes_do_not_persist_to_host(tmp_path: Any) -> None:
+    from agent_framework_monty import FileMount
+
+    monty_tool = MontyExecuteCodeTool(
+        file_mounts=[FileMount(host_path=tmp_path, mount_path="/overlay", mode="overlay")],
+    )
+
+    code = """
+import pathlib
+pathlib.Path('/overlay/scratch.txt').write_text('overlay-only')
+print('wrote')
+"""
+    result = await monty_tool._run_code(code=code)
+    assert any("wrote" in t for t in _text_outputs(result))
+    # Overlay writes stay in-memory: nothing on host, nothing captured.
+    assert not (tmp_path / "scratch.txt").exists()
+    assert not any(c.type == "data" for c in result)
+
+
+async def test_resource_limit_short_duration_aborts_long_loop() -> None:
+    # Cap CPU time hard; a busy loop should be killed before it can print 'done'.
+    monty_tool = MontyExecuteCodeTool(resource_limits={"max_duration_secs": 0.2})
+
+    code = """
+total = 0
+for i in range(10_000_000):
+    total += i
+print('done', total)
+"""
+    result = await monty_tool._run_code(code=code)
+    # Result is either an error Content (timeout surfaces as RuntimeError) or
+    # truncated stdout without the 'done' marker.
+    texts = _text_outputs(result)
+    assert not any("done" in t for t in texts), texts
+
+
+# ---------------------------------------------------------------------------
+# Symlink escape regression (MSRC-style)
+# ---------------------------------------------------------------------------
+
+
+def _symlinks_supported(tmp: Any) -> bool:
+    """Return True if the current platform/environment supports symlinks.
+
+    Mirrors python/packages/core/tests/core/test_skills.py so the symlink
+    regression tests are skipped on restricted Windows CI runners instead of
+    failing on ``OSError`` / ``NotImplementedError`` during creation.
+    """
+    test_target = tmp / "_symlink_test_target"
+    test_link = tmp / "_symlink_test_link"
+    try:
+        test_target.write_text("test", encoding="utf-8")
+        test_link.symlink_to(test_target)
+        return True
+    except (OSError, NotImplementedError):
+        return False
+    finally:
+        test_link.unlink(missing_ok=True)
+        test_target.unlink(missing_ok=True)
+
+
+async def test_symlinks_inside_workspace_are_not_followed_by_runtime(tmp_path: Any) -> None:
+    """A pre-existing symlink in workspace_root must NOT let sandbox code read its target.
+
+    Monty's mount layer enforces this (PermissionError at the OS bridge), but we
+    pin the behavior here so any future change to the OS dispatch path is
+    detected.
+    """
+    if not _symlinks_supported(tmp_path):
+        pytest.skip("Symlinks not supported on this platform/environment")
+
+    workspace = tmp_path / "workspace"
+    workspace.mkdir()
+    outside = tmp_path / "outside_secret.txt"
+    outside.write_text("SECRET_OUTSIDE_WORKSPACE", encoding="utf-8")
+    (workspace / "leak.txt").symlink_to(outside)
+
+    monty_tool = MontyExecuteCodeTool(workspace_root=workspace)
+    code = """
+import pathlib
+try:
+    print('read:', pathlib.Path('/input/leak.txt').read_text())
+except PermissionError as exc:
+    print('blocked:', exc)
+except Exception as exc:
+    print('other:', type(exc).__name__, exc)
+"""
+    result = await monty_tool._run_code(code=code)
+    texts = _text_outputs(result)
+    assert not any("SECRET_OUTSIDE_WORKSPACE" in t for t in texts), texts
+    assert any("blocked" in t or "PermissionError" in t or "other" in t for t in texts), texts
+
+
+async def test_post_capture_skips_symlinks_pointing_outside_workspace(tmp_path: Any) -> None:
+    """File capture must NOT read through a symlink that points outside the mount.
+
+    Reproduces the MSRC-reported Hyperlight pattern in Monty's post-execution
+    file-capture path: an attacker-placed ``workspace/leak.txt -> /outside/secret``
+    must not be returned as Content.
+    """
+    if not _symlinks_supported(tmp_path):
+        pytest.skip("Symlinks not supported on this platform/environment")
+    workspace = tmp_path / "workspace"
+    workspace.mkdir()
+    outside = tmp_path / "outside_secret.txt"
+    outside.write_text("SECRET_OUTSIDE_WORKSPACE", encoding="utf-8")
+    (workspace / "leak.txt").symlink_to(outside)
+    outside_dir = tmp_path / "outside_dir"
+    outside_dir.mkdir()
+    (outside_dir / "deep.txt").write_text("DEEP_SECRET", encoding="utf-8")
+    (workspace / "leak_dir").symlink_to(outside_dir)
+
+    monty_tool = MontyExecuteCodeTool(workspace_root=workspace)
+    # Run trivial code so the post-execution scan fires.
+    result = await monty_tool._run_code(code="print('ran')")
+
+    # Inspect the URIs of any returned data Content items.
+    import base64
+
+    leaked_paths: list[str] = []
+    leaked_bodies: list[bytes] = []
+    for content in result:
+        if content.type != "data" or not content.uri:
+            continue
+        payload = content.uri.split(",", 1)[1] if "," in content.uri else ""
+        try:
+            body = base64.b64decode(payload)
+        except Exception:  # noqa: BLE001
+            body = b""
+        leaked_bodies.append(body)
+        leaked_paths.append((content.additional_properties or {}).get("path", ""))
+
+    assert not any(b"SECRET_OUTSIDE_WORKSPACE" in body for body in leaked_bodies), (
+        "Symlink file outside workspace was captured: " + repr(leaked_paths)
+    )
+    assert not any(b"DEEP_SECRET" in body for body in leaked_bodies), (
+        "Symlinked directory escape was captured: " + repr(leaked_paths)
+    )
+
+
+async def test_post_capture_still_returns_real_writes_when_symlinks_present(tmp_path: Any) -> None:
+    """The symlink-skipping logic must not regress capture of legitimate sandbox writes."""
+    if not _symlinks_supported(tmp_path):
+        pytest.skip("Symlinks not supported on this platform/environment")
+    workspace = tmp_path / "workspace"
+    workspace.mkdir()
+    outside = tmp_path / "outside_secret.txt"
+    outside.write_text("SHOULD_NEVER_LEAK", encoding="utf-8")
+    (workspace / "leak.txt").symlink_to(outside)
+
+    monty_tool = MontyExecuteCodeTool(workspace_root=workspace)
+    code = """
+import pathlib
+pathlib.Path('/input/report.txt').write_text('legit-output')
+print('wrote')
+"""
+    result = await monty_tool._run_code(code=code)
+    import base64
+
+    data_items = [c for c in result if c.type == "data" and c.uri]
+    # Exactly one new file should be captured: report.txt.
+    assert len(data_items) == 1, [(c.additional_properties or {}).get("path") for c in data_items]
+    item = data_items[0]
+    assert (item.additional_properties or {}).get("path") == "/input/report.txt"
+    payload = item.uri.split(",", 1)[1] if item.uri and "," in item.uri else ""
+    assert base64.b64decode(payload) == b"legit-output"
+
+
+# ---------------------------------------------------------------------------
+# Provider + approval gating
+# ---------------------------------------------------------------------------
+
+
+async def test_provider_run_tool_executes_real_monty_end_to_end() -> None:
+    provider = MontyCodeActProvider(tools=[add])
+    context = SessionContext(input_messages=[Message(role="user", contents=[Content.from_text("hi")])])
+    state: dict[str, Any] = {}
+
+    await provider.before_run(agent=MagicMock(), session=None, context=context, state=state)
+
+    run_tool = context.tools[0]
+    assert isinstance(run_tool, MontyExecuteCodeTool)
+
+    result = await run_tool._run_code(code="print(await add(a=10, b=32))")
+    texts = _text_outputs(result)
+    assert any("42" in text for text in texts)
+
+
+async def test_approval_required_tool_gates_execute_code_end_to_end() -> None:
+    provider = MontyCodeActProvider(tools=[restricted])
+    context = SessionContext(input_messages=[Message(role="user", contents=[Content.from_text("hi")])])
+    state: dict[str, Any] = {}
+
+    await provider.before_run(agent=MagicMock(), session=None, context=context, state=state)
+    run_tool = context.tools[0]
+    assert isinstance(run_tool, MontyExecuteCodeTool)
+    assert run_tool.approval_mode == "always_require"
+    assert state["monty_codeact"]["approval_mode"] == "always_require"
+
+
+# ---------------------------------------------------------------------------
+# End-to-end Agent run with a fake chat client
+# ---------------------------------------------------------------------------
+
+
+async def test_agent_runs_monty_codeact_end_to_end() -> None:
+    """A fake chat client emits one execute_code tool call; Monty runs it end-to-end."""
+    from collections.abc import Awaitable, Mapping, MutableSequence
+
+    from agent_framework import (
+        BaseChatClient,
+        ChatResponse,
+        ChatResponseUpdate,
+        FunctionInvocationLayer,
+        ResponseStream,
+    )
+
+    class _FakeCodeActChatClient(FunctionInvocationLayer[Any], BaseChatClient[Any]):
+        def __init__(self) -> None:
+            FunctionInvocationLayer.__init__(self)
+            BaseChatClient.__init__(self)
+            self.call_count = 0
+
+        def _inner_get_response(
+            self,
+            *,
+            messages: MutableSequence[Message],
+            stream: bool,
+            options: Mapping[str, Any],
+            **kwargs: Any,
+        ) -> Awaitable[ChatResponse] | ResponseStream[ChatResponseUpdate, ChatResponse]:
+            if stream:
+                raise AssertionError("Streaming is not used in this integration test.")
+
+            async def _get_response() -> ChatResponse:
+                self.call_count += 1
+
+                if self.call_count == 1:
+                    return ChatResponse(
+                        messages=Message(
+                            role="assistant",
+                            contents=[
+                                Content.from_function_call(
+                                    call_id="execute_code_call",
+                                    name="execute_code",
+                                    arguments={"code": "print(await add(a=6, b=7))"},
+                                )
+                            ],
+                        )
+                    )
+
+                function_results = [
+                    content for message in messages for content in message.contents if content.type == "function_result"
+                ]
+                assert len(function_results) == 1
+
+                result_content = function_results[0]
+                result_text = ""
+                if isinstance(result_content.result, list):
+                    for item in result_content.result:
+                        text = getattr(item, "text", None)
+                        if text:
+                            result_text += text
+                else:
+                    result_text = str(result_content.result or "")
+
+                return ChatResponse(
+                    messages=Message(
+                        role="assistant",
+                        contents=[f"answer: {result_text.strip() or 'none'}"],
+                    )
+                )
+
+            return _get_response()
+
+    client = _FakeCodeActChatClient()
+    provider = MontyCodeActProvider(tools=[add])
+    agent = Agent(client=client, context_providers=[provider])
+
+    response = await agent.run("Add 6 and 7 inside execute_code.")
+    assert "13" in (response.text or "")
+    assert client.call_count == 2