16 Commits

• Python: Add tool approval middleware (#6414)

  * Add Python tool approval middleware
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Fix tool approval restored state handling
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Gate hidden approvals on explicit approval responses
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Handle string inputs in approval replay scan
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Cover argument-scoped approval rules
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Refine tool approval state and budgets
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Fix tool approval PR CI failures
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Revert DevUI Aspire README link change
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-06-11 17:35:44 +00:00
  df29af611c
• Python: progressive tool exposure via FunctionInvocationContext (#6233)

  * Python: progressive tool exposure via FunctionInvocationContext
  
  Add first-class progressive tool exposure to the Python core function-calling
  loop. Tools can now add or remove real FunctionTool schemas at runtime via the
  injected FunctionInvocationContext, taking effect on the next iteration of the
  loop.
  
  - FunctionInvocationContext gains a live `tools` list plus experimental
    `add_tools()` / `remove_tools()` helpers (feature: PROGRESSIVE_TOOLS).
  - The function-calling loop establishes a run-local, normalized tools list and
    threads it into the context at both invocation paths so mutations propagate.
  - Add a sample (dynamic_tool_exposure.py) and a tools samples README, including
    a note that CodeAct providers (Monty/Hyperlight) use their own provider-level
    tool management instead.
  
  Supersedes #3877.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Validate non-negative input in dynamic_tool_exposure sample tools
  
  Address review feedback: factorial and fibonacci now return an error
  message for negative n instead of producing incorrect results.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Make add_tools atomic and surface swallowed function errors
  
  Address review feedback on progressive tool exposure:
  
  - add_tools now validates the full batch against a throwaway copy before
    committing, so a duplicate-name clash partway through a sequence leaves
    the live tool list unchanged (all-or-nothing).
  - _auto_invoke_function now logs a warning (with traceback) when a tool
    raises, so contract errors such as a duplicate-name ValueError from
    add_tools are debuggable without enabling include_detailed_errors.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Avoid retaining tracebacks when logging swallowed function errors
  
  Logging with exc_info=exc fed the exception traceback to the logging
  machinery, whose frame references created reference cycles collected
  lazily by the cyclic GC. On Windows that could drop a hyperlight
  WasmSandbox on a non-owning thread ("unsendable, dropped on another
  thread"), crashing the xdist worker. Log a pre-formatted message with
  the exception repr instead, so no traceback object is retained.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * added missing decorator
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-06-03 09:01:07 +00:00
  49a6e433a3
• Python: Shell tool with support for local and Docker (#5664)

  * feat(tools): add cross-OS LocalShellTool in new agent-framework-tools package
  
  Introduces a safe, cross-OS local shell tool as the first citizen of a new
  
  agent-framework-tools workspace package. Supports persistent (default) and
  
  stateless modes across pwsh/powershell.exe/bash/sh, with policy denylist,
  
  allowlist, approval gating, process-tree kill on timeout, output truncation,
  
  and audit hooks. Integrates with existing provider get_shell_tool(func=...)
  
  factories via FunctionTool kind='shell'.
  
  See docs/decisions/0026-builtin-tools-local-shell.md for the full design.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * feat(tools): security hardening for LocalShellTool
  
  Codifies what LocalShellTool does and does not defend against, and
  
  delegates the security-relevant lifecycle primitive to a battle-tested
  
  library instead of hand-rolled per-OS code.
  
  Changes:
  
  - Adopt psutil for cross-OS process-tree termination (executor + session).
  
    Replaces hand-rolled taskkill/killpg with one canonical implementation.
  
  - Resolve taskkill.exe to absolute %SystemRoot%\System32 path so PATH
  
    poisoning cannot redirect us to an attacker-supplied binary.
  
  - Reframe ShellPolicy docstring + ADR + README: denylist is a guardrail,
  
    not a security boundary.
  
  - Require acknowledge_unsafe=True to set approval_mode='never_require',
  
    making the unsafe path explicitly opt-in with a self-documenting name.
  
  - Add tests/test_security.py codifying named CVE-style cases. Defenses
  
    we DO claim are asserted; non-defenses (denylist bypasses via
  
    backslash insertion, variable expansion, interpreter escape, base64,
  
    alternative tools, PowerShell-native verbs) are documented as
  
    expected-to-pass tests so residual risk stays visible.
  
  - Add Threat Model + Confidence Strategy sections to ADR 0026.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * feat(tools): add DockerShellTool sandboxed shell tier
  
  Adds a container-backed shell executor as the recommended pattern for untrusted-input shell workflows. The container provides the security boundary (--network none, non-root user, --read-only, --cap-drop ALL, no-new-privileges, memory/pids limits, tmpfs /tmp), so approval gating is optional unlike LocalShellTool.
  
  Also introduces a ShellExecutor Protocol so callers can plug in custom backends (Firecracker, SSH, WASI) without forking the framework.
  
  Removes the planned HyperlightShellExecutor follow-up from ADR 0026: Hyperlight is a WASM code sandbox with no kernel/userland/shell binary, so a Hyperlight-backed shell is not viable. Docker is the realistic sandbox tier for shell.
  
  Tests: 11 unit tests for argv builders + lifecycle (no Docker daemon required); 3 integration tests gated on is_docker_available().
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix(tools): backport shell-tool fixes from .NET parity review
  
  Applies the applicable subset of bug fixes accumulated during the
  .NET shell-tool PR review (microsoft/agent-framework#5604) to the
  Python shell tool.
  
  A1 - Quote workdir safely in _maybe_reanchor
  
    Previously _tool.py used double-quote interpolation when emitting
    the cd/Set-Location prefix, which expanded $VAR, $(), and backticks
    in the workdir path. A workdir containing shell metacharacters could
    trigger arbitrary command execution before the user command ran.
  
    Replaced with single-quote escaping helpers _quote_posix and
    _quote_powershell that emit literal-string forms safe for both
    hosts.
  
  A5/A6 - Consolidate truncation to a single byte-aware helper
  
    Extracted a shared truncate_head_tail / truncate_text_head_tail
    helper in _truncate.py. The new implementation distributes odd
    caps so head receives floor(cap/2) and tail receives ceil(cap/2)
    bytes, matching the .NET round-9 fix and ensuring no input bytes
    are silently dropped on the boundary.
  
    _session.py previously truncated by Python str length while the
    caller passed _max_output_bytes - the unit mismatch is now gone:
    raw byte buffers go through truncate_head_tail and decoded text
    goes through truncate_text_head_tail.
  
  Unit tests added for the truncate and quote helpers.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * docs(tools): tone down narrative and overconfident comments in shell tool
  
  The shell tool's docstrings and comments contained two patterns that
  the .NET review pushed back on:
  
  - Narrative framing about implementation history ("hard-won",
    "we sidestep", "design inspiration: ...", competitor framework
    name-drops in module docstrings).
  - Overstated security guarantees ("battle-tested",
    "reasonable for untrusted input", "recommended executor for any
    agent that runs commands from untrusted input",
    "destructive commands are blocked", "safe local shell tool",
    "blocks shell injection").
  
  Rewrites the affected docstrings and comments to describe what the
  code does in neutral terms. Behaviour is unchanged.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * feat(tools): add ShellEnvironmentProvider for the Python shell tool
  
  Ports the .NET ShellEnvironmentProvider as a Python ContextProvider
  so agents using LocalShellTool or DockerShellTool can be primed with
  an accurate description of the shell they're talking to (family,
  version, OS, working directory, and which CLIs are available).
  
  The provider runs probes through any ShellExecutor, caches the
  resulting snapshot, and on every before_run extends the session
  instructions with a markdown block describing the shell idiom to
  use. A failed first probe leaves the cache empty so the next call
  retries (no permanent poisoning).
  
  Probe failures from a narrow set of expected error types
  (ShellCommandError, ShellExecutionError, ShellTimeoutError, and
  asyncio.TimeoutError from the per-probe timeout) are recorded as
  None fields in the snapshot. Other exceptions propagate. Tool
  names are validated against ^[A-Za-z0-9._-]+$ before being
  interpolated into a probe command.
  
  Includes 12 unit tests covering happy path, stderr fallback,
  timeout handling, expected/unexpected exception paths, malicious
  tool name rejection, case-insensitive deduplication, retry after
  failure, concurrent first-callers sharing one probe, and the
  default and custom formatter paths.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * docs(tools): document ShellEnvironmentProvider and finish comment cleanup
  
  Add a README section introducing ShellEnvironmentProvider, soften two remaining overconfident security-boundary comments in _executor_base.py and the DockerShellTool class docstring, and add a sample (shell_with_environment_provider.py) that demonstrates the provider in stateless and persistent modes.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * refactor(tools): move shell samples to python/samples/02-agents/tools
  
  The repository convention is to host samples under python/samples/ rather than inside the package directory. Move the two net-new shell samples (allow-list and environment-provider) to python/samples/02-agents/tools/ and drop the in-package samples/ directory; the existing top-level providers/openai/client_with_local_shell.py already covers the basic LocalShellTool walkthrough.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * test(tools): cover confine_workdir default and ShellResult.format_for_model
  
  Two new tests in test_local_shell_tool.py exercise the default confine_workdir=True behaviour on POSIX and PowerShell, asserting that 'cd' inside one persistent-mode call does not leak into the next. A new test_shell_result.py module provides direct unit coverage for every conditional branch of ShellResult.format_for_model (stdout, truncated, stderr, timed_out, exit_code) so regressions in the LLM-facing format are caught immediately.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix(tools): address PR #5664 review feedback
  
  - _tool.py: detect PowerShell via is_powershell() helper instead of basename string match
  
  - _environment.py: use public ContextProvider import (no private _ prefix)
  
  - _session.py: trim _stdout_buf/_stderr_buf after copying to avoid unbounded retention across calls
  
  - _docker.py: short-circuit start()/close() in stateless mode; add configurable shell kwarg (default bash, e.g. 'sh' for alpine)
  
  - tests: parenthesized multi-line assert; alpine integration tests now pass shell='sh'
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix(tools): satisfy CI quality gates
  
  - pyupgrade: drop quoted self-class refs in __aenter__/method annotations
  
  - ruff format: reflow long lines per workspace style
  
  - pyright: assert psutil non-None in optional-import branch; lowercase mutable module globals; annotate _approval_mode as Literal so tool() Literal-typed kwarg is accepted; add ... body to ShellExecutor.run protocol; remove unused deprecated _kill_tree wrapper
  
  - tests: skip docker integration tests on win32 (Windows containers don't support --read-only / alpine images)
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Remove DEFAULT_DENYLIST; document single-session ownership; fix bandit findings
  
  Mirrors the .NET PR #5604 cleanup:
  
  - Remove DEFAULT_DENYLIST from ShellPolicy. ShellPolicy() now ships with an empty deny-list; operators opt into site-specific patterns explicitly. No major agent framework uses regex matching as a primary security control; AutoGen v2 removed theirs. Approval gating + sandbox tier remain the real boundaries.
  
  - Rewrite module / class docstrings to frame ShellPolicy as a UX pre-filter, not a security control.
  
  - Add Single-session ownership paragraphs to ShellExecutor, ShellSession, LocalShellTool, and DockerShellTool: a persistent-mode tool is owned by exactly one conversation / agent session; do not share across users or concurrent conversations.
  
  - Tests now supply explicit deny patterns instead of relying on a default.
  
  - Address Pre-commit Hooks (bandit) CI failures: convert internal-invariant asserts to explicit RuntimeError, annotate intentional subprocess/shell usage with # nosec, document container-internal /tmp paths.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address PR #5664 round-2 review feedback
  
  Deny-list documentation drift:
  
  - README and the OpenAI/local-shell sample no longer claim a built-in deny-list of destructive commands. ShellPolicy is described as an optional, operator-supplied UX pre-filter; the real boundaries remain approval gating and the sandbox tier.
  
  Behavioural fixes called out in review:
  
  - ShellPolicy.evaluate() now denies empty / whitespace-only commands explicitly instead of returning allow with no rationale.
  
  - truncate_head_tail() raises ValueError for cap <= 0 instead of silently returning the full input with truncated=False, which previously could defeat output-capping in callers that mis-configured the budget.
  
  - LocalShellTool.as_function() / DockerShellTool.as_function() return the ShellCommandError text directly so the model sees a single, non-redundant 'Command rejected by policy: …' message instead of the prior duplicated 'Command blocked by policy: Command rejected …' wrapping.
  
  - ShellSession POSIX sentinel trailer now snapshots and restores the prior errexit (set -e) state around the trailer, so a user 'set -e' in the persistent shell is no longer permanently disabled by the next run().
  
  Tests:
  
  - New test_shell_parse_rc.py covers the full _parse_rc() edge-case surface (zero, positive, negative, CRLF, no newline, missing prefix, empty input, non-digits, trailing garbage, partial digits).
  
  - test_policy.py asserts the new empty-command deny.
  
  - test_shell_truncate_and_quote.py asserts ValueError for cap=0 and cap<0.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address PR review feedback for shell tool
  
  - _resolve.py: reject empty/whitespace shell override string
  - _tool.py / _docker.py: mode-aware default tool description (persistent vs stateless)
  - _tool.py: fix misleading workdir docstring (re-anchor, not blocking)
  - _types.py: emit stream-agnostic [output truncated] marker
  - _policy.py: declare _denies/_allows as dataclass fields
  - _environment.py: use $(pwd) instead of $PWD in POSIX probe
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address PR review feedback: shell override flag + probe timeout safety
  
  - _resolve.py: in stateless mode, ensure shell overrides end with -c/-Command so commands aren't misinterpreted as script-file paths.
  - ShellExecutor.run / LocalShellTool.run / DockerShellTool.run now accept an optional 	imeout kwarg; ShellEnvironmentProvider drops the outer asyncio.wait_for and lets the executor enforce the probe timeout internally, so cancellation no longer risks leaving a hung subprocess or corrupted session.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address review feedback: docker isolation + lifecycle robustness
  
  - pyproject.toml: bump agent-framework-core minimum from 1.2.0 to 1.2.2 to align with the rest of the workspace.
  - _docker.py: validate extra_run_args at construction time and reject flags that would dismantle the isolation defaults (--privileged, --cap-add, --security-opt, --network/--net, -v/--volume/--mount, --device, --pid, --ipc, --userns, --user, --read-only, --tmpfs, --add-host, --gpus, --cgroupns, --device-cgroup-rule); also documented the warning on the docstring.
  - _docker._stop_container: retry docker rm -f once and log a warning/error when it does not succeed, so operators can audit leaked containers instead of getting a silent success.
  - _docker._run_stateless timeout path: fall back to docker rm -f when docker kill fails or times out (--rm only reaps on clean exit), and log instead of silently swallowing communicate() errors.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: alliscode <bentho@microsoft.com>
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  Co-authored-by: alliscode <25218250+alliscode@users.noreply.github.com>

  Ben Thomas · 2026-05-22 00:29:59 +00:00
  8e54f0b0e7
• Python: feat: add agent-framework-monty (Monty-backed CodeAct provider) (#5915)

  * Python: feat: add agent-framework-monty (Monty-backed CodeAct)
  
  New alpha package that wraps pydantic-monty (a Rust-based Python
  interpreter) behind the same CodeAct API surface as
  agent-framework-hyperlight, so users can swap providers with minimal
  code change.
  
  Public API (agent_framework_monty):
  - MontyCodeActProvider — ContextProvider that injects a run-scoped
    execute_code tool plus dynamic CodeAct instructions.
  - MontyExecuteCodeTool — standalone FunctionTool for mixed-tool agents
    or manual static wiring.
  - FileMount / FileMountInput / MountMode — public types mirroring the
    Hyperlight names, with Monty's mode (read-only/read-write/overlay)
    and write_bytes_limit on FileMount.
  
  Constructor kwargs (both classes) mirror Hyperlight where possible:
  tools, approval_mode, workspace_root, file_mounts; plus a Monty-only
  resource_limits forwarding ResourceLimits to Monty.start().
  
  Filesystem flow:
  - workspace_root auto-mounts at /input (read-write), matching Hyperlight.
  - file_mounts accepts string shorthand, (host, mount) tuple, or
    FileMount with mode + write cap.
  - Files written under read-write mounts are scanned post-execution and
    returned as Content.from_data items (mirrors Hyperlight /output).
  - overlay mounts buffer writes in-memory; read-only mounts reject writes.
  
  Internals:
  - _monty_bridge.InlineCodeBridge ports the inline (non-durable) bridge
    from anthonychu/maf-codeact-monty-python; handles FunctionSnapshot /
    FutureSnapshot pause/resume, dispatches direct typed calls + the
    call_tool fallback, forwards mount/limits to Monty.start(...).
  - generate_type_stubs emits per-tool stubs so Monty's `ty` type-checker
    rejects bad calls before any host tool runs.
  
  Alpha-policy compliance (per python-package-management skill):
  - Added agent-framework-monty = { workspace = true } to root
    pyproject.toml.
  - Added row to python/PACKAGE_STATUS.md.
  - Added monty entry under Experimental in python/AGENTS.md.
  - NOT added to core[all]; NO agent_framework.monty lazy shim (deferred
    to beta promotion).
  
  Samples (three sets, import from agent_framework_monty directly):
  - samples/02-agents/context_providers/code_act/monty_code_act.py
    (provider pattern) + updated local README.
  - samples/02-agents/tools/monty_code_interpreter/ (standalone +
    manual-wiring + README).
  - samples/04-hosting/foundry-hosted-agents/responses/11_monty_codeact/
    (full hosted-agent layout with uv-based pyproject.toml + Dockerfile,
    Azure Monitor wiring via APPLICATIONINSIGHTS_CONNECTION_STRING +
    enable_instrumentation, ENABLE_INSTRUMENTATION and
    ENABLE_SENSITIVE_DATA env vars). The alpha wheel is vendored into
    ./wheels/ (gitignored) via vendor-wheel.sh; new row added to the
    parent Responses-API README.
  
  Tests:
  - 28 hermetic unit tests (stubbed pydantic_monty).
  - 18 integration tests marked @pytest.mark.integration, auto-skipped
    when pydantic_monty is unimportable; exercise the real Monty
    runtime: print round-trip, last-expression value, direct typed
    tool dispatch, call_tool fallback, async tool, asyncio.gather
    parallelism, ty type-check rejection, OS blocked by default,
    workspace_root read+write capture, read-only / overlay mount
    semantics, resource_limits.max_duration_secs abort, approval
    gating end-to-end, full Agent run with a scripted chat client.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: fix: monty FileMount test compares against the normalized POSIX path
  
  The shorthand string mount goes through _normalize_mount_path, which
  rewrites Windows drive letters like 'C:\\Users\\...' into
  '/C:/Users/...' (POSIX-style). The Windows CI runners surfaced this
  because tmp_path resolves to a backslashed Windows path; the test was
  comparing against the raw str(host_a) instead of the normalized form.
  
  Compare against _normalize_mount_path(str(host_a)) so the assertion is
  platform-independent.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: fix: address PR #5915 review feedback
  
  - _execute_code_tool docstring: clarify that the Monty backend supports
    scoped filesystem access via workspace_root / file_mounts (blocked by
    default).
  - _to_monty_mount: import pydantic_monty lazily through load_monty so
    missing-dependency errors surface as the same actionable RuntimeError
    the rest of the package raises (not a bare ImportError at module load).
    Renamed _load_monty -> load_monty for the same reason.
  - _python_type_repr: emit None for type(None) instead of Any, and
    normalize both typing.Union[...] and PEP-604 X | Y to PEP-604 syntax
    so Optional[X] / Union[..., None] / -> None signatures round-trip
    correctly through ty validation. Added a regression test.
  - _PrintCollector: track a running character count instead of
    recomputing sum(len(c) for c in self.chunks) per callback. Eliminates
    the O(n^2) cost on print-heavy code.
  - Instructions: mention that the value of the final expression is also
    returned alongside captured stdout (matches actual behavior).
  - 11_monty_codeact Dockerfile: pin ghcr.io/astral-sh/uv to 0.11.6
    instead of :latest for reproducible builds.
  - 11_monty_codeact README: replace the bare "see parent README" pointer
    with sample-specific steps (./vendor-wheel.sh + uv sync + uv run),
    since the sample uses pyproject.toml + a vendored wheel rather than
    requirements.txt.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: sample: 11_monty_codeact installs agent-framework-monty from PyPI
  
  Drop the vendored-wheel scaffolding now that agent-framework-monty is on
  PyPI as an alpha (1.0.0a*) release:
  
  - pyproject.toml: remove [tool.uv.sources] override; keep [tool.uv]
    prerelease = "allow" so uv pulls the alpha automatically.
  - Dockerfile: drop the COPY wheels/ step.
  - README: drop the ./vendor-wheel.sh setup step and the
    not-yet-on-PyPI warning.
  - Delete vendor-wheel.sh and the gitignored wheels/ directory.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: fix(monty): harden post-execution file capture against symlink escape
  
  Same class of issue as the MSRC-reported Hyperlight finding: the
  post-execution capture walked workspace_root with Path.rglob() +
  is_file() + read_bytes() - all of which follow symlinks. An attacker
  who controls the workspace (cloned repo, extracted archive, shared
  workspace) could pre-place `workspace/leak.txt -> /etc/passwd` or
  `workspace/outside_dir -> /etc/` and have host files surface as
  captured Content items.
  
  Monty's mount layer already rejects symlink reads from inside the
  sandbox across all three modes (verified empirically), so the runtime
  path was safe. This commit closes the post-execution scan path.
  
  Changes:
  - New `_iter_real_files(root)` walker that uses iterdir() +
    is_symlink() to skip symlinks at every directory level and yields
    only real files. Replaces the previous `host_root.rglob("*")` calls
    in both `_snapshot_writable_mounts` and `_capture_written_files`.
  - Use `Path.lstat()` instead of `Path.stat()` so size/mtime can never
    be taken from a symlink target.
  - Three new integration tests reproducing the MSRC attack shape
    against the workspace_root flow: symlink-to-file outside workspace,
    symlink-to-directory outside workspace, and a guard ensuring
    legitimate sandbox writes are still captured when symlinks are
    present.
  
  Per user request, hyperlight is untouched in this commit (separate fix).
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: fix(monty): skip symlink regression tests when unsupported
  
  Apply the same Windows-CI safety guard as the hyperlight fix in PR #5919:
  the three symlink integration tests create symlinks via Path.symlink_to(),
  which fails with OSError / NotImplementedError on unprivileged Windows
  runners. Add a local _symlinks_supported helper (mirroring the one in
  packages/core/tests/core/test_skills.py) and pytest.skip when symlinks
  aren't available, so the tests no longer fail for environment reasons.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: fix(monty): address PR #5915 follow-up review feedback
  
  - _invoke_tool: drop the inspect.iscoroutinefunction(...) branch and
    always `await self.tool_map[name](**kwargs)`. Every entry in
    tool_map is `partial(FunctionTool.invoke, skip_parsing=True)` and
    FunctionTool.invoke is `async def`, so the branching was dead code -
    and on Python versions affected by cpython#98590,
    iscoroutinefunction(partial(bound_async_method, ...)) returns False,
    causing the bridge to take the asyncio.to_thread path, return an
    unawaited coroutine, and surface it as a JSON-serialization failure
    for every tool call. Added a regression test
    test_invoke_tool_awaits_partial_wrapped_async_method.
  
  - generate_type_stubs: skip tools whose name is not a valid Python
    identifier or is a Python keyword. FunctionTool.name has no upstream
    validation, so a name like "weird-name" produced a syntax error in
    the stubs and a name like "broken\n    pass\nasync def injected"
    would inject arbitrary stub source. Non-identifier names stay
    reachable via `call_tool("weird-name", ...)` at runtime; they just
    don't get type-checked stubs. Added regression test
    test_generate_type_stubs_skips_non_identifier_tool_names.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-05-20 00:35:23 +00:00
  4609535e22
• Python: Fix hyperlight WasmSandbox cross-thread Drop and harden hosted-agent sample (#5603)

  * update hyperlight to beta and move samples, add hosted agent sample
  
  * Python: Fix hyperlight WasmSandbox cross-thread Drop and harden sample
  
  Root cause: when a worker-side closure raised, the exception's __traceback__
  retained frame locals that included the partially constructed PyO3 sandbox.
  Future.result() re-raised that exception on the caller thread, and when the
  caller's exception was eventually GC'd the frame locals were released
  off-thread, dec_ref'ing the unsendable sandbox from the wrong thread and
  tripping the PyO3 panic
  '_native_wasm::WasmSandbox is unsendable, but is being dropped on another thread'.
  
  Fix:
  * Add _SandboxWorker._run_on_worker which catches every exception on the
    worker, drops __traceback__ there, deletes the original exception, and
    re-raises a fresh instance on the caller thread. initialize and execute
    route through it; dispose keeps its bare-submit semantics.
  * Add an opt-in diagnostic module _drop_diagnostic (no-op unless
    HYPERLIGHT_TRACE_DROPS=1) that installs a sys.unraisablehook and dumps
    owner-thread + per-thread stacks on any future cross-thread unsendable
    Drop. Useful for triaging similar PyO3 regressions.
  * Tests: cross-thread invocation, traceback-leak isolation, _SandboxEntry
    attribute-shape check, and a stale-reference stress test driven through
    asyncio.to_thread.
  
  Sample (samples/04-hosting/foundry-hosted-agents/responses/06_hyperlight_codeact):
  * Dockerfile installs agent-framework-* from in-tree source with python/ as
    build context so unreleased fixes can be validated end-to-end.
  * call_server.py pins the Responses API version.
  * main.py enables include_detailed_errors=True so future tool failures
    surface the actual exception text instead of a bare 'Error: Function
    failed.' string.
  * README.md documents the in-tree-package build and the Hyperlight
    hypervisor requirement (/dev/kvm on Linux, MSHV on Windows). Hosted
    environments without hypervisor passthrough surface 'No Hypervisor was
    found for Sandbox'; this is a hosting constraint, not a hyperlight bug.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: remove _drop_diagnostic from hyperlight package
  
  The diagnostic module was useful while bisecting the cross-thread Drop bug,
  but it is no longer needed now that _SandboxWorker._run_on_worker prevents
  the panic at the source.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: address PR review feedback on hyperlight
  
  - Use lazy agent_framework.hyperlight import in sample main.py.
  - Env-driven endpoint (FOUNDRY_AGENT_ENDPOINT) in call_server.py; remove personal URLs.
  - Align agent.yaml model deployment with manifest (gpt-4.1-mini).
  - Tighten Dockerfile requirements guard; drop dangling deploy.ps1 reference.
  - Preserve exception args when sanitizing tracebacks in _run_on_worker.
  - Add public _SandboxWorker.is_alive(); update test to avoid private attr.
  - Add namespace coverage tests for agent_framework.hyperlight lazy loader.
  - Add prominent note: Foundry hosted-agent runtime does not yet support
    Hyperlight (no hypervisor exposed); container works locally with /dev/kvm.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: bump hyperlight-sandbox dependencies to 0.4.x
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: renumber hyperlight codeact sample to 08
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Coerce worker exception args to strings for cross-thread safety
  
  Stringify exc.args on the worker thread before propagating, so any
  PyO3 unsendable object captured in args (e.g. via a caller-supplied
  callback or underlying SDK) cannot be Dropped on the calling thread.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * moved sample
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-05-05 10:06:16 +00:00
  57c901a245
• Python: [BREAKING] Remove deprecated Python OpenAI/Azure AI surfaces (#4990)

  * [BREAKING] Remove deprecated Python OpenAI/Azure AI surfaces
  
  Also clean up follow-on docs, environment guidance, package metadata, and lab test stability.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Fix deleted semantic-kernel sample links
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address PR review feedback
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * improve foundry language
  
  * Fix A2A Foundry sample regression
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-03-31 20:36:21 +00:00
  3a49b1d6dd
• Python: Fix sample bugs: incorrect API params, wrong client types, and invalid options (#4983)

  * Fix sample bugs: incorrect API params, wrong client types, and invalid options
  
  - typed_options.py: Fix AnthropicClient model->model_id, wrap raw strings in Message objects for get_response(), fix reasoning_effort->reasoning dict, fix budget_tokens minimum (1024), use OpenAIChatClient not FoundryChatClient, remove unused import
  
  - client_reasoning.py: Fix deprecated model_id to model param
  
  - client_with_hosted_mcp.py: Remove invalid store=True kwarg from Agent.run()
  
  - code_defined_skill.py: Fix precision kwarg to use function_invocation_kwargs
  
  - Various other samples: Fix deprecated API usage and incorrect params
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address PR review comments
  
  - client_with_hosted_mcp.py: Fix remaining store=True kwarg on line 68 to use options dict
  
  - client_with_session.py: Change store=True to store=False to match in-memory persistence demo intent
  
  - typed_options.py: Remove non-existent import and model key from docstring example
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * new sample fixes
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Giles Odigwe · 2026-03-31 16:58:51 +00:00
  7c2dae8855
• Python: [BREAKING] Python: Provider-leading client design & OpenAI package extraction (#4818)

  * Python: Provider-leading client design & OpenAI package extraction
  
  Major refactoring of the Python Agent Framework client architecture:
  
  - Extract OpenAI clients into new `agent-framework-openai` package
  - Core package no longer depends on openai, azure-identity, azure-ai-projects
  - Rename clients for discoverability: OpenAIResponsesClient → OpenAIChatClient,
    OpenAIChatClient → OpenAIChatCompletionClient
  - Unify `model_id`/`deployment_name`/`model_deployment_name` → `model` param
  - New FoundryChatClient for Azure AI Foundry Responses API
  - New FoundryAgent/FoundryAgentClient for connecting to pre-configured Foundry agents
  - Remove OpenAIBase/OpenAIConfigMixin from non-deprecated client MRO
  - Deprecate AzureOpenAI* clients, AzureAIClient, OpenAIAssistantsClient
  - Reorganize samples: azure_openai+azure_ai+azure_ai_agent → azure/
  - ADR-0020: Provider-Leading Client Design
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix: missing Agent imports in samples, .model_id → .model in foundry_local sample
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix: CI failures — mypy errors, coverage targets, sample imports
  
  - azure-ai mypy: add type ignores for TypedDict total=, model arg, forward ref
  - Coverage: replace core.azure/openai targets with openai package target
  - project_provider: add type annotation for opts dict
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix: populate openai .pyi stub, fix broken README links, coverage targets
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fixes
  
  * updated observabilitty
  
  * reset azure init.pyi
  
  * fix errors
  
  * updated adr number
  
  * fix foundry local
  
  * fixed not renamed docstrings and comments, and added deprecated markers to old classes
  
  * fix tests and pyprojects
  
  * fix test vars
  
  * updated function tests
  
  * update durable
  
  * updated test setup for functions
  
  * Fix Foundry auth in workflow samples
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Stabilize Python integration workflows
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Update hosting samples for Foundry
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Trigger full CI rerun
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Trigger CI rerun again
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * trigger rerun
  
  * trigger rerun
  
  * fix for litellm
  
  * undo durabletask changes
  
  * Move Foundry APIs into foundry namespace
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Fix Foundry pyproject formatting
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Split provider samples by Foundry surface
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Restore hosting sample requirements
  
  Also fix the Foundry Local sample link after the provider sample move.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * updated tests
  
  * udpated foundry integration tests
  
  * removed dist from azurefunctions tests
  
  * Use separate Foundry clients for concurrent agents
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix client setup in azfunc and durable
  
  * disabled two tests
  
  * updated setup for some function and durable tests
  
  * improved azure openai setup with new clients
  
  * ignore deprecated
  
  * fixes
  
  * skip 11
  
  * remove openai assistants int tests
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-03-25 09:56:29 +00:00
  5e056b672e
• Python: Simplify Python Poe tasks and unify package selectors (#4722)

  * updated automation tasks and commands, with alias for the time being
  
  * Restore aggregate test exclusions
  
  Preserve the legacy all-tests scope for test --all by excluding lab and devui from the default aggregate sweep, while still allowing explicit package selection. Also ignore hidden/generated test directories such as .mypy_cache during aggregate discovery.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * updated versions in pre-commit
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-03-18 18:39:11 +00:00
  f48c4512d3
• [BREAKING] Python: clean up kwargs across agents, chat clients, tools, and sessions (#4581)

  * Python: clean up kwargs across agents, chat clients, tools, and sessions (#3642)
  
  Audit and refactor public **kwargs usage across core agents, chat clients,
  tools, sessions, and provider packages per the migration strategy codified
  in CODING_STANDARD.md.
  
  Key changes:
  - Add explicit runtime buckets: function_invocation_kwargs and client_kwargs
    on RawAgent.run() and chat client get_response() layers.
  - Refactor FunctionTool to prefer explicit ctx: FunctionInvocationContext
    injection; legacy **kwargs tools still work via _forward_runtime_kwargs.
  - Refactor Agent.as_tool() to use direct JSON schema, always-streaming
    wrapper, approval_mode parameter, and UserInputRequiredException
    propagation (integrates PR #4568 behavior).
  - Remove implicit session bleeding into FunctionInvocationContext; tools
    that need a session must receive it via function_invocation_kwargs.
  - Lower chat-client layers after FunctionInvocationLayer accept only
    compatibility **kwargs (client_kwargs flattened, function_invocation_kwargs
    ignored).
  - Add layered docstring composition from Raw... implementations via
    _docstrings.py helper.
  - Clean up provider constructors to use explicit additional_properties.
  - Deprecation warnings on legacy direct kwargs paths.
  - Update samples, tests, and typing across all 23 packages.
  
  Resolves #3642
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * clarified docstring
  
  * feedback fixes
  
  * Add unit tests for _docstrings.py build/apply helpers
  
  Tests cover: no docstring source, no extra kwargs, appending to existing
  Keyword Args section, inserting after Args, inserting in plain docstrings,
  multiline descriptions, ordering, and apply_layered_docstring.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Add test for propagate_session TypeError on non-AgentSession values
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Add tests for multi-content and empty UserInputRequiredException propagation
  
  Cover the branching logic in _try_execute_function_calls for:
  - Multiple user_input_request items in a single exception (extra_user_input_contents path)
  - Empty contents list (fallback function_result path)
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Add tests for DurableAIAgent.get_session forwarding service_session_id
  
  Verifies get_session correctly forwards service_session_id and session_id
  to the executor's get_new_session, replacing the removed kwargs test.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Simplify ag-ui test stub to read session from client_kwargs only
  
  Remove dual-mode detection (client_kwargs vs raw kwargs fallback) from
  the test mock. Session is now read exclusively from client_kwargs,
  matching the settled public calling convention.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * updated create and get sessions in durable
  
  * fixed docstrings
  
  * fix test
  
  * updated session handling
  
  * updated from main
  
  * updated tests
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-03-13 08:58:32 +00:00
  a4b9539b62
• Python: Add propagate_session to as_tool() for session sharing in agent-as-tool scenarios (#4439)

  * Python: Add propagate_session parameter to as_tool() for session sharing
  
  Add opt-in session propagation in agent-as-tool scenarios. When
  propagate_session=True, the parent agent's AgentSession is forwarded
  to the sub-agent's run() call, allowing both agents to share session
  state (history, metadata, session_id).
  
  - Add propagate_session parameter to BaseAgent.as_tool() (default False)
  - Include session in additional_function_arguments so it flows to tools
  - Add 3 tests for propagation on/off and shared state verification
  - Add sample showing session propagation with observability middleware
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Clarify propagate_session docstring per review feedback
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Giles Odigwe · 2026-03-04 23:14:17 +00:00
  d02051dbb6
• Python: Add max_function_calls to FunctionInvocationConfiguration (#2329) (#4175)

  * Add max_function_calls to FunctionInvocationConfiguration (#2329)
  
  Add a new per-request max_function_calls setting to FunctionInvocationConfiguration
  that limits the total number of individual function invocations across all iterations
  within a single get_response call. This complements max_iterations (which limits LLM
  roundtrips) by providing a hard cap on actual tool executions regardless of parallelism.
  
  - Add max_function_calls field to FunctionInvocationConfiguration (default: None/unlimited)
  - Track cumulative function call count in both streaming and non-streaming tool loops
  - Force tool_choice='none' when the limit is reached
  - Add validation in normalize_function_invocation_configuration
  - Improve docstrings for FunctionInvocationConfiguration, FunctionTool, and @tool
    to clarify semantics of max_iterations vs max_function_calls vs max_invocations
  - Add tests for parallel calls, single calls, unlimited mode, and config validation
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Add sample for controlling total tool executions
  
  Showcases all three mechanisms for limiting tool executions:
  1. max_iterations — caps LLM roundtrips
  2. max_function_calls — caps total individual function invocations per request
  3. max_invocations — lifetime cap on a specific tool instance
  Plus a combined scenario demonstrating defense in depth.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Suppress ruff E305/fmt in hosting sample to preserve XML doc tags
  
  The XML snippet tags (# <create_agent> / # </create_agent>) are used for
  docs extraction and must stay adjacent to the code they wrap. Both ruff
  check (E305) and ruff format add blank lines after the function definition,
  pushing the closing tag away. Suppress with ruff: noqa: E305 and fmt: off.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Add per-agent tool wrapping scenario to control_total_tool_executions sample
  
  Show that wrapping the same callable with @tool multiple times creates
  independent FunctionTool instances with separate invocation counters,
  enabling per-agent max_invocations budgets for shared functions.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Clarify max_function_calls is a best-effort limit
  
  The limit is checked after each batch of parallel calls completes, so the
  current batch always runs to completion even if it overshoots the limit.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address PR review: fix docstring reference, clarify best-effort in sample
  
  - Fix malformed Sphinx :attr: role in FunctionTool docstring — use plain
    backtick reference instead
  - Update sample to say 'best-effort cap' instead of 'hard cap' for
    max_function_calls, noting it's checked between iterations
  - Parametrize pattern is correct (fixture override, matching existing tests)
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * clarify max_invocations limits
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-02-24 01:00:25 +00:00
  55398e21df
• Python: Add load_dotenv() to samples for .env file support (#4043)

  * Initial plan
  
  * Add load_dotenv() to 303 Python samples for environment variable loading
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Update SAMPLE_GUIDELINES.md to document load_dotenv() requirement
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Update samples README.md to document .env file usage
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Run ruff format on all changed sample files
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Clarify load_dotenv() usage in README - local dev vs production
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Remove deprecated getting_started folder as requested
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Document env_file_path parameter for per-client configuration
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Merge main branch to resolve conflicts
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Fix run_evaluation.py file that was empty in merge commit
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Remove dotnet changes from merge - out of scope for this PR
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Remove package and test changes from merge - only sample changes needed
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Remove test_func_utils.py - only sample changes needed
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Revert sample files not in original changeset - keep only load_dotenv additions
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Move load_dotenv() outside snippet tag in 06_host_your_agent.py
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Fix comment placement - move load_dotenv before code comments
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Fix load_dotenv() placement across all samples - after docstring, before code comments
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Merge latest main branch with load_dotenv changes
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Remove non-sample changes from merge - keep only load_dotenv additions
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Revert non-load_dotenv sample changes from merge
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Fix run_evaluation.py - use main's improved version (file already had load_dotenv)
  
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  
  * Manual update
  
  * Manual update 2
  
  * Fix Role usage and load_dotenv placement per PR review feedback
  
  Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com>
  
  * Fix Role usage - use string literals not enum attributes
  
  Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com>
  
  * Fix SAMPLE_GUIDELINES.md example - load_dotenv before docstring per guidance
  
  Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com>
  
  * Move load_dotenv() before docstrings in all samples per SAMPLE_GUIDELINES ordering
  
  Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com>
  
  * Address PR review: rename files, fix placement, add session usage, remove note
  
  Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com>
  
  * Update Redis README to reference renamed file redis_history_provider.py
  
  Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
  Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
  Co-authored-by: Tao Chen <taochen@microsoft.com>
  Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com>
  Co-authored-by: Eduard van Valkenburg <eavanvalkenburg@users.noreply.github.com>

  Copilot · 2026-02-19 10:55:13 +00:00
  b05fc9e849
• Python: Fixed AutoGen migration and tool samples (#4027)

  * Fixed ollama_chat_client sample
  
  * Fixed ollama_chat_multimodal sample
  
  * Fixed function_tool_with_approval_and_sessions sample
  
  * Updated function_tool_with_session_injection sample
  
  * Small clean-up
  
  * Update 01_round_robin_group_chat.py
  
  * Update 02_selector_group_chat.py
  
  * Update 03_swarm.py
  
  * Update 03_assistant_agent_thread_and_stream.py
  
  * Update 04_agent_as_tool.py
  
  * Resolved comments

  Dmytro Struk · 2026-02-18 15:58:38 +00:00
  f087b864fb
• Python: [BREAKING] PR2 — Wire context provider pipeline, remove old types, update all consumers (#3850)

  * PR2: Wire context provider pipeline and update all internal consumers
  
  - Replace AgentThread with AgentSession across all packages
  - Replace ContextProvider with BaseContextProvider across all packages
  - Replace context_provider param with context_providers (Sequence)
  - Replace thread= with session= in run() signatures
  - Replace get_new_thread() with create_session()
  - Add get_session(service_session_id) to agent interface
  - DurableAgentThread -> DurableAgentSession
  - Remove _notify_thread_of_new_messages from WorkflowAgent
  - Wire before_run/after_run context provider pipeline in RawAgent
  - Auto-inject InMemoryHistoryProvider when no providers configured
  
  * fix: update all tests for context provider pipeline, fix lazy-loaders, remove old test files
  
  * refactor: update all sample files for context provider pipeline (AgentThread→AgentSession, ContextProvider→BaseContextProvider)
  
  * fix: update remaining ag-ui references (client docstring, getting_started sample)
  
  * fix: make get_session service_session_id keyword-only to avoid confusion with session_id
  
  * refactor: rename _RunContext.thread_messages to session_messages
  
  * refactor: remove _threads.py, _memory.py, and old provider files; migrate devui to use plain message lists
  
  * rename: remove _new_ prefix from test files
  
  * refactor: rewrite SlidingWindowChatMessageStore as SlidingWindowHistoryProvider(InMemoryHistoryProvider)
  
  * fix: read full history from session state directly instead of reaching into provider internals
  
  * fix: update stale .pyi stubs, sample imports, and README references for new provider types
  
  * fix: remove stale message_store, _notify_thread_of_new_messages, and session_id.key references in samples
  
  * refactor: merge context_providers and sessions sample folders into sessions, remove aggregate_context_provider
  
  * refactor: UserInfoMemory stores state in session.state instead of instance attributes
  
  * feat: add Pydantic BaseModel support to session state serialization
  
  Pydantic models stored in session.state are now automatically serialized
  via model_dump() and restored via model_validate() during to_dict()/from_dict()
  round-trips. Models are auto-registered on first serialization; use
  register_state_type() for cold-start deserialization.
  
  Also export register_state_type as a public API.
  
  * fix mem0
  
  * Update sample README links and descriptions for session terminology
  
  - Replace 'thread' with 'session' in sample descriptions across all READMEs
  - Update file links for renamed samples (mem0_sessions, redis_sessions, etc.)
  - Fix Threads section → Sessions section in main samples/README.md
  - Update tools, middleware, workflows, durabletask, azure_functions READMEs
  - Update architecture diagrams in concepts/tools/README.md
  - Update migration guides (autogen, semantic-kernel)
  
  * Fix broken Redis README link to renamed sample
  
  * Fix Mem0 OSS client search: pass scoping params as direct kwargs
  
  AsyncMemory (OSS) expects user_id/agent_id/run_id as direct kwargs,
  while AsyncMemoryClient (Platform) expects them in a filters dict.
  Adds tests for both client types.
  
  Port of fix from #3844 to new Mem0ContextProvider.
  
  * Fix rebase issues: restore missing _conversation_state.py and checkpoint decode logic
  
  - Add back _conversation_state.py (encode/decode_chat_messages) lost in rebase
  - Fix on_checkpoint_restore to decode cache/conversation with decode_chat_messages
  - Fix on_checkpoint_restore to use decode_checkpoint_value for pending requests
  - Add tests/workflow/__init__.py for relative import support
  - Fix test_agent_executor checkpoint selection (checkpoints[1] not superstep)
  
  * Add STORES_BY_DEFAULT ClassVar to skip redundant InMemoryHistoryProvider injection
  
  Chat clients that store history server-side by default (OpenAI Responses API,
  Azure AI Agent) now declare STORES_BY_DEFAULT = True. The agent checks this
  during auto-injection and skips InMemoryHistoryProvider unless the user
  explicitly sets store=False.
  
  * Fix broken markdown links in azure_ai and redis READMEs
  
  * Fix getting-started samples to use session API instead of removed thread/ContextProvider API
  
  * updates to workflow as agent
  
  * fix group chat import
  
  * Rename Thread→Session throughout, fix service_session_id propagation, remove stale AGUIThread
  
  - Fix: Propagate conversation_id from ChatResponse back to session.service_session_id
    in both streaming and non-streaming paths in _agents.py
  - Rename AgentThreadException → AgentSessionException
  - Remove stale AGUIThread from ag_ui lazy-loader
  - Rename use_service_thread → use_service_session in ag-ui package
  - Rename test functions from *_thread_* to *_session_*
  - Rename sample files from *_thread* to *_session*
  - Update docstrings and comments: thread → session
  - Update _mcp.py kwargs filter: add 'session' alongside 'thread'
  - Fix ContinuationToken docstring example: thread=thread → session=session
  - Fix _clients.py docstring: 'Agent threads' → 'Agent sessions'
  
  * Fix broken markdown links after thread→session file renames
  
  * fix azure ai test

  Eduard van Valkenburg · 2026-02-12 21:00:32 +00:00
  1e350ea22f
• Python: restructure: Python samples into progressive 01-05 layout (#3862)

  * restructure: Python samples into progressive 01-05 layout
  
  - 01-get-started/: 6 numbered steps (hello agent → hosting)
  - 02-agents/: all agent concept samples (tools, middleware, providers, etc.)
  - 03-workflows/: ALL existing workflow samples preserved as-is
  - 04-hosting/: azure-functions, durabletask, a2a
  - 05-end-to-end/: demos, evaluation, hosted agents
  - Old files moved to _to_delete/ for review
  - Added AGENTS.md with structure documentation
  - autogen-migration/ and semantic-kernel-migration/ preserved at root
  
  * fix: switch to AzureOpenAI Foundry, fix CI failures
  
  - Switch all 01-get-started samples to AzureOpenAIResponsesClient with
    Azure AI Foundry project endpoint (AZURE_AI_PROJECT_ENDPOINT +
    AZURE_OPENAI_RESPONSES_DEPLOYMENT_NAME + AzureCliCredential)
  - Add _to_delete/ and 05-end-to-end/ to pyrightconfig.samples.json excludes
  - Fix test paths in packages/ that referenced old getting_started/ dirs:
    durabletask conftest + streaming test, azurefunctions conftest,
    devui conftest + capture_messages + openai_sdk_integration
  - Fix workflow_as_agent_human_in_the_loop.py import (sibling import)
  - Update hosting READMEs and tool comment paths
  - Replace root README.md with new structure overview
  - Update AGENTS.md to document Azure OpenAI Foundry as default provider
  
  * cleanup: remove _to_delete folder, copy resource files to active dirs
  
  All files in _to_delete/ were either:
  - Exact duplicates of files in the new structure (240 files)
  - Same file with only comment path updates (100 files)
  - One import-fix diff (workflow_as_agent_human_in_the_loop.py)
  - One superseded minimal_sample.py
  
  Resource files (sample.pdf, countries.json, employees.pdf, weather.json)
  copied to 02-agents/sample_assets/ and 02-agents/resources/ since active
  samples reference them.
  
  * fix: address PR review comments, centralize resources, remove root duplicates
  
  - Fix type annotation in 04_memory.py (string union -> proper types)
  - Fix old sample paths in observability files
  - Fix grammar/spelling in observability samples
  - Move sample_assets/ and resources/ to shared/ folder
  - Remove 8 duplicate observability files from 02-agents root
  - Update resource path references in multimodal_input and provider samples
  
  * fix: update broken links from old getting_started paths to new structure
  
  - Update relative paths in READMEs: getting_started/ → 01-get-started/,
    02-agents/, 03-workflows/, 04-hosting/, 05-end-to-end/
  - Fix absolute GitHub URLs in package READMEs
  - Fix broken link in ollama package README
  
  * fix: convert absolute GitHub URLs to relative paths for link checker
  
  Absolute URLs to python/samples/ on main branch 404 until PR merges.
  Converted to relative paths that linkspector can verify locally.
  
  * fix: update link for handoff sample moved to orchestrations/
  
  * fix: update chatkit-integration README path from demos/ to 05-end-to-end/
  
  * fix: update broken links in orchestrations README to match flat directory structure

  Eduard van Valkenburg · 2026-02-12 17:36:36 +00:00
  a2856d3b92