75 Commits

• Python: refresh dev dependencies and validate runtime bounds (#6238)

  Updates third-party dev dependencies across the Python workspace and
  validates that all runtime dependency bounds still hold at both ends.
  
  Dev dependency bumps (root, lab, declarative, durabletask):
  - uv 0.11.6 -> 0.11.17, ruff 0.15.8 -> 0.15.15,
    pytest-asyncio 1.3.0 -> 1.4.0, mcp 1.27.0 -> 1.27.2,
    azure-monitor-opentelemetry 1.8.7 -> 1.8.8,
    poethepoet 0.42.1 -> 0.46.0, prek 0.3.9 -> 0.4.3,
    types-python-dateutil and types-PyYaml stub bumps.
  - Transitive Dependabot items swept via lock: idna 3.11 -> 3.17,
    pip 26.0.1 -> 26.1.2.
  
  Deliberately excluded:
  - opentelemetry-sdk stays 1.40.0: azure-monitor-opentelemetry (incl.
    1.8.8) hard-pins opentelemetry-sdk==1.40.
  - mypy stays 1.20.0 and pyright stays 1.1.408: the 2.1.0 / 1.1.409
    bumps introduce new diagnostics that fail type checking and need
    dedicated PRs.
  - rich kept as a range: agentlightning (lab[lightning]) forces
    rich==13.9.4.
  
  Code/formatting changes driven by the ruff upgrade:
  - devui lifespan now uses try/finally so shutdown cleanup always runs
    (ruff RUF075).
  - Removed unused TYPE_CHECKING imports in core and foundry flagged by
    ruff 0.15.15.
  - Reapplied ruff 0.15.15 formatting to the files it changed.
  
  Validation: validate-dependency-bounds-test "*" passes (31/31 lower +
  31/31 upper); typing 62/62; lint 31/31; devui tests pass.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-06-01 17:53:56 +00:00
  8091d052d8
• Python: Fix DevUI streaming memory growth regression (#6038)

  * Fix DevUI streaming memory growth regression
  
  Bounds retained streaming/debug state in DevUI and strengthens browser regression coverage for long streamed responses.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address DevUI memory review feedback
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Fix DevUI bundle trailing whitespace
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-05-27 07:48:29 +00:00
  3242d8a4c4
• Python: Improve the handling of intermediate outputs for workflows and orchestrations (#5623)

  * Improve the handling of intermediate outputs for workflows and orchestrations
  
  * Address PR review feedback on intermediate output forwarding
  
  - Switch workflow.as_agent() forwarding to an explicit allowlist of {output,
    intermediate, data, request_info} so orchestration-internal events
    (group_chat, handoff_sent, magentic_orchestrator) stay inside the workflow
    instead of leaking into agent responses via str(data) coercion.
  - Stop raising on intermediate AgentResponseUpdate in non-streaming run();
    surface the partial as a Message with text_reasoning content. The defensive
    raise still applies to terminal output events, where Update payloads would
    corrupt message ordering.
  - Extend the DevUI workflow-event mapper so intermediate yields wrapping
    plain strings, Messages, and list[Message] render as visible output items
    instead of generic completed-trace events.
  - Add orchestration coverage for GroupChat, Handoff, and Magentic builders
    (default vs intermediate_outputs=True; structural where end-to-end is heavy).
  
  * Lift output-designation policy into a value type
  
  Replace the ``Workflow._output_executors`` list and the
  ``RunnerContext.should_label_as_intermediate`` Protocol method with a single
  immutable ``OutputDesignation`` value type owned by ``Workflow``. Thread the
  designation as a parameter through the existing call chain (Runner ->
  EdgeRunner -> Executor -> WorkflowContext) so ``yield_output`` consults the
  threaded snapshot directly rather than calling back into the runner context.
  
  Removes the ``InProcRunnerContext._workflow`` back-reference and the
  ``WorkflowBuilder.build()`` assignment that wired it up. Adds the public
  predicate ``Workflow.is_terminal_executor(executor_id)`` for external
  observers; ``OutputDesignation`` itself stays package-internal.
  
  Key decisions
  - ``OutputDesignation.designated`` is ``frozenset[str] | None`` -- ``None``
    preserves legacy "every yield is type='output'" behavior, any frozenset
    (including empty) opts into strict mode. The ``DeprecationWarning`` for
    legacy mode at build time is unchanged.
  - ``output_designation`` is an optional parameter on ``Runner``,
    ``EdgeRunner.send_message``, ``EdgeRunner._execute_on_target``,
    ``Executor.execute``, ``Executor._create_context_for_handler``, and
    ``WorkflowContext.__init__``. Each defaults to legacy ``OutputDesignation()``
    so direct callers (Azure Functions ``CapturingRunnerContext``,
    ``test_runner`` recording fixtures) keep working without ceremony.
  - The workflow-level filter in ``_run_core`` reads ``self._output_designation``
    live, preserving today's semantics where mutating the designation after
    build still affects subsequent runs (used by two existing tests).
  - ``Workflow.to_dict()`` continues to emit ``"output_executors":
    list[str] | None`` (sorted from the frozenset). Checkpoint format unchanged.
  
  Files changed
  - _workflow.py: add ``OutputDesignation`` dataclass; replace
    ``_output_executors`` with ``_output_designation``; add
    ``is_terminal_executor``; delete ``_should_yield_output_event``.
  - _runner_context.py: drop ``should_label_as_intermediate`` Protocol method
    and ``InProcRunnerContext`` impl; drop ``_workflow`` back-reference.
  - _workflow_builder.py: remove ``context._workflow = workflow`` assignment.
  - _runner.py, _edge_runner.py, _executor.py, _workflow_context.py: thread
    ``output_designation`` parameter through the call chain.
  - tests/workflow/test_output_designation.py (new): three-state coverage of
    the value type plus the public predicate delegation.
  - tests/workflow/test_workflow_builder.py, test_validation.py,
    test_workflow.py, test_runner.py and
    orchestrations/tests/test_orchestration_intermediate_vs_terminal.py:
    switch probes from ``_output_executors`` set checks to
    ``get_output_executors`` / ``is_terminal_executor``; update two
    post-build mutation tests to set ``_output_designation`` instead.
  
  Verification
  - core/tests/workflow/, orchestrations/tests/, azurefunctions/tests/:
    1119 passed, 42 skipped, 2 xfailed.
  - ``uv run poe lint``: clean.
  - ``uv run poe typing``: only the pre-existing
    ``_AGENT_FORWARDED_EVENT_TYPES`` pyright warning from 394bcd607 remains.
  
  Notes for next iteration
  - The builder's own ``_output_executors`` attribute (``list[Executor |
    SupportsAgentRun]``) is intentionally untouched; the issue scoped the
    rename to the workflow attribute.
  - Adjacent review candidates (twin ``WorkflowAgent`` translators,
    ``_AGENT_FORWARDED_EVENT_TYPES`` kind classifier,
    ``_event_origin_context`` ContextVar removal, ``WorkflowEvent`` ADT
    split, legacy-mode removal) remain out of scope.
  
  * Add explicit workflow output designation
  
  Key decisions
  
  - Extend the internal OutputDesignation value type from terminal-only membership to output/intermediate/hidden classification. Legacy mode remains outputs=None, so workflows built without output_executors or intermediate_executors still label every yield_output as type='output'.
  
  - WorkflowBuilder now accepts intermediate_executors. Providing either designation enters explicit mode; output executors emit output, intermediate executors emit intermediate, and unlisted yield_output payloads are hidden from caller-facing events while remaining in executor_completed data.
  
  - Empty explicit designation, duplicate entries, overlaps, unknown executors, and designated executors without workflow output annotations fail build validation. Existing orchestration builders pass intermediate-capable participants through intermediate_executors to preserve current intermediate_outputs behavior until participant-oriented designation lands.
  
  Files changed
  
  - packages/core/agent_framework/_workflows/_workflow.py, _workflow_builder.py, _workflow_context.py, _validation.py, _events.py
  
  - packages/core/tests/workflow/test_output_designation.py, test_output_executors_contract.py, test_strict_mode_event_labeling.py, test_validation.py, test_workflow.py, test_workflow_agent_intermediate.py
  
  - packages/orchestrations/agent_framework_orchestrations/_sequential.py, _concurrent.py, _group_chat.py, _magentic.py
  
  - packages/core/AGENTS.md
  
  Verification
  
  - uv run pytest packages/core/tests/workflow packages/orchestrations/tests packages/devui/tests/devui/test_mapper.py -q
  
  - uv run pytest packages/azurefunctions/tests -q
  
  - uv run poe lint
  
  - uv run poe typing fails only on pre-existing packages/core/agent_framework/_workflows/_agent.py _AGENT_FORWARDED_EVENT_TYPES private-use pyright error.
  
  Notes for next iteration
  
  - issues/03-core-workflow-explicit-designation.md was moved to issues/done but issues/ remains untracked and intentionally excluded from this commit.
  
  - Slice 4 should tighten workflow.as_agent() mapping for hidden emissions and streaming-only update payloads; Slice 5 should replace orchestration intermediate_outputs with participant-oriented designation.
  
  * Tighten workflow-as-agent output mapping
  
  Key decisions
  
  - Treat AgentResponseUpdate as a streaming-only payload across the workflow.as_agent() adapter, so non-streaming agent runs now reject both terminal output and intermediate workflow events carrying updates.
  - Keep streaming classification behavior explicit: terminal update payloads remain normal text content, while intermediate update payloads are rewritten to text_reasoning content.
  - Add explicit-mode coverage proving hidden yield_output emissions do not appear in non-streaming AgentResponse messages or streaming AgentResponseUpdate chunks.
  
  Files changed
  
  - packages/core/agent_framework/_workflows/_agent.py
  - packages/core/tests/workflow/test_workflow_agent_intermediate.py
  
  Verification
  
  - uv run pytest packages/core/tests/workflow/test_workflow_agent_intermediate.py -q
  - uv run pytest packages/core/tests/workflow/test_workflow_agent.py packages/core/tests/workflow/test_workflow_agent_intermediate.py -q
  - uv run pytest packages/core/tests/workflow packages/orchestrations/tests packages/devui/tests/devui/test_mapper.py -q
  - uv run poe lint
  - uv run poe typing fails only on the pre-existing packages/core/agent_framework/_workflows/_agent.py _AGENT_FORWARDED_EVENT_TYPES private-use pyright error.
  
  Blockers or notes for next iteration
  
  - issues/04-workflow-as-agent-output-mapping.md was moved to issues/done/ but issues/ remains untracked and intentionally excluded from this commit.
  - Slice 5 should replace orchestration intermediate_outputs with participant-oriented designation.
  
  * Add orchestration participant output designation
  
  Key decisions
  
  - Replace orchestration intermediate_outputs with participant-oriented output_participants and intermediate_participants across Sequential, Concurrent, GroupChat, Magentic, and Handoff builders.
  - Keep synthetic final executors terminal by default for Concurrent, GroupChat, and Magentic; keep Sequential's final participant terminal by default; keep Handoff participants terminal by default.
  - Centralize participant designation validation for empty explicit designation, duplicates, overlaps, and unknown participants, then map validated participants to workflow output/intermediate executors.
  
  Files changed
  
  - packages/orchestrations/agent_framework_orchestrations/_participant_designation.py
  - packages/orchestrations/agent_framework_orchestrations/_sequential.py
  - packages/orchestrations/agent_framework_orchestrations/_concurrent.py
  - packages/orchestrations/agent_framework_orchestrations/_group_chat.py
  - packages/orchestrations/agent_framework_orchestrations/_magentic.py
  - packages/orchestrations/agent_framework_orchestrations/_handoff.py
  - packages/orchestrations/tests/test_orchestration_intermediate_vs_terminal.py
  - packages/orchestrations/tests/test_magentic.py
  
  Blockers or notes for next iteration
  
  - issues/05-orchestration-participant-designation.md was moved to issues/done/ but issues/ remains untracked and intentionally excluded from this commit.
  - Slice 7 should migrate samples and docs away from intermediate_outputs to the new participant designation API.
  - uv run poe typing still fails only on the pre-existing packages/core/agent_framework/_workflows/_agent.py _AGENT_FORWARDED_EVENT_TYPES private-use pyright error.
  
  * Migrate samples to explicit output designation
  
  Key decisions
  
  - Replace sample usage of the removed orchestration intermediate_outputs boolean with participant-oriented intermediate_participants designation.
  - Update raw workflow guidance to show output_executors together with intermediate_executors, and document that unlisted yields are hidden in explicit designation mode.
  - Keep orchestration final outputs terminal while streaming designated participant responses as intermediate progress, including workflow.as_agent() samples where intermediates map to text_reasoning content.
  - Refresh workflow and orchestration README guidance plus the changelog reference so public docs no longer point users at intermediate_outputs.
  
  Files changed
  
  - CHANGELOG.md
  - packages/orchestrations/README.md
  - samples/README.md
  - samples/03-workflows/README.md
  - samples/03-workflows/control-flow/intermediate_vs_terminal_outputs.py
  - samples/03-workflows/orchestrations/README.md
  - samples/03-workflows/orchestrations/group_chat_agent_manager.py
  - samples/03-workflows/orchestrations/group_chat_philosophical_debate.py
  - samples/03-workflows/orchestrations/group_chat_simple_selector.py
  - samples/03-workflows/orchestrations/magentic.py
  - samples/03-workflows/orchestrations/magentic_human_plan_review.py
  - samples/03-workflows/orchestrations/sequential_chain_only_agent_responses.py
  - samples/03-workflows/agents/group_chat_workflow_as_agent.py
  - samples/03-workflows/agents/magentic_workflow_as_agent.py
  - samples/03-workflows/agents/sequential_workflow_as_agent.py
  - samples/semantic-kernel-migration/orchestrations/group_chat.py
  - samples/semantic-kernel-migration/orchestrations/magentic.py
  
  Blockers or notes for next iteration
  
  - issues/07-samples-and-docs-explicit-output-designation.md was moved to issues/done/ but issues/ remains untracked and intentionally excluded from this commit.
  - issues/06-devui-intermediate-event-rendering.md remains present and appears already satisfied by existing DevUI mapper/tests from the prior implementation slice.
  - PRD-explicit-workflow-output-designation.md remains untracked and intentionally excluded from this commit.
  
  * Render DevUI intermediate workflow outputs
  
  Key decisions
  
  - Preserve workflow output designation metadata on visible DevUI output messages and text deltas so intermediate/data emissions remain distinguishable from terminal output.
  - Render intermediate workflow message items in the execution timeline using executor metadata, while excluding them from the final workflow result aggregation.
  - Keep terminal output message rendering unchanged and retain legacy data events on the intermediate compatibility path.
  
  Files changed
  
  - packages/devui/agent_framework_devui/_mapper.py
  - packages/devui/frontend/src/components/features/workflow/execution-timeline.tsx
  - packages/devui/frontend/src/components/features/workflow/workflow-view.tsx
  - packages/devui/frontend/src/types/openai.ts
  - packages/devui/tests/devui/test_mapper.py
  
  Blockers or notes for next iteration
  
  - issues/06-devui-intermediate-event-rendering.md was moved to issues/done/ but issues/ remains untracked and intentionally excluded from this commit.
  - PRD-explicit-workflow-output-designation.md remains untracked and intentionally excluded from this commit.
  - uv run poe typing still fails only on the pre-existing packages/core/agent_framework/_workflows/_agent.py _AGENT_FORWARDED_EVENT_TYPES private-use pyright error.
  
  * Fix mypy
  
  * Clarify orchestration participant output config
  
  * Rename participant output kwargs for clarity
  
  output_participants -> final_output_from, intermediate_participants ->
  intermediate_output_from. The old names read like categories of
  participant; the new names make it clear the kwarg designates which
  participants' outputs surface as final vs. intermediate events.
  
  * Rename core workflow output kwargs with deprecation shim
  
  Adds final_output_from / intermediate_output_from as canonical kwargs on
  Workflow and WorkflowBuilder. Old output_executors / intermediate_executors
  kwargs continue to work but emit DeprecationWarning via a shared coalesce
  helper that also rejects supplying both. Wire-format keys in to_dict()
  stay as output_executors / intermediate_executors so checkpoint
  compatibility is preserved.
  
  Internal call sites in orchestrations and samples updated to the new
  names so users following sample code learn the canonical vocabulary;
  legacy callers still work with a one-shot warning.
  
  * Suppress pyright reportPrivateUsage on cross-module sentinel import
  
  * Update docstrings
  
  * Propagate sub-workflow intermediate outputs, fix handoff/sequential intermediate-only designation, and shore up tests, sample, and docstrings around the intermediate output contract.
  
  * Add canonical workflow output_from selection
  
  Key decisions:\n- Make output_from the canonical workflow-output allow-list and keep output_executors/final_output_from as deprecated compatibility aliases.\n- Treat empty output_from/intermediate_output_from lists as explicit selections and keep validation responsible for empty, duplicate, overlap, and unknown selections.\n- Remove the branch-only public intermediate_executors WorkflowBuilder kwarg while preserving legacy wire keys in to_dict().\n\nFiles changed:\n- packages/core/agent_framework/_workflows/_workflow.py\n- packages/core/agent_framework/_workflows/_workflow_builder.py\n- packages/core/agent_framework/_workflows/_workflow_context.py\n- packages/core/agent_framework/_workflows/_agent.py\n- packages/core/agent_framework/_workflows/_agent_executor.py\n- packages/core/tests/workflow/* output-selection coverage updates\n- packages/core/AGENTS.md\n- issues/done/001-canonical-list-based-output-selection.md\n\nBlockers/notes:\n- Orchestration builders still pass final_output_from internally; follow-up issue 004 should migrate them to output_from.\n- Legacy omitted-selection behavior and explicit all/all_other literals are left for issues 002 and 003.
  
  * Add explicit all workflow output selection
  
  Key decisions:
  - Treat output_from='all' as an explicit workflow-output selection sentinel and expand it at build time to executors with declared workflow output types.
  - Keep omitted output selections in legacy all-output mode with a deprecation warning that names output_from and intermediate_output_from and points to output_from='all'.
  - Reject intermediate_output_from='all' at construction because the all-output literal is output-only for this issue.
  
  Files changed:
  - packages/core/agent_framework/_workflows/_workflow_builder.py
  - packages/core/tests/workflow/test_output_executors_contract.py
  - issues/done/002-explicit-all-output-and-legacy-migration.md
  
  Blockers/notes:
  - all_other intermediate-output selection remains for issue 003.
  - Workflow-as-agent/orchestration parity remains for issue 004.
  
  * Add all-other intermediate output selection
  
  Key decisions:
  - Treat intermediate_output_from='all_other' as an explicit intermediate-output selection sentinel and expand it at build time after the workflow graph is complete.
  - Expand all_other to output-capable executors not selected by output_from; omitted or empty output_from selects no workflow outputs, while output_from='all' leaves an empty intermediate selection.
  - Keep output_from='all_other' invalid so all_other remains intermediate-output-only and runtime classification still receives concrete executor-id sets.
  
  Files changed:
  - packages/core/agent_framework/_workflows/_workflow_builder.py
  - packages/core/tests/workflow/test_output_executors_contract.py
  - issues/done/003-all-other-intermediate-output-selection.md
  
  Blockers/notes:
  - Workflow-as-agent and orchestration parity remains for issue 004.
  - Full documentation updates remain for issue 005.
  
  * Add orchestration output selection parity
  
  Key decisions:
  - Expose output_from on sequential, concurrent, group chat, handoff, and magentic builders while keeping final_output_from as a deprecated compatibility alias.
  - Resolve orchestration participant selections through the same explicit rules as workflows: output_from='all', intermediate_output_from='all_other', hidden unselected participant payloads, and overlap/duplicate/unknown/invalid-literal validation.
  - Continue preserving documented orchestration defaults by always designating each pattern's terminal internal executor where applicable.
  
  Files changed:
  - packages/orchestrations/agent_framework_orchestrations/_participant_output_config.py
  - packages/orchestrations/agent_framework_orchestrations/_sequential.py
  - packages/orchestrations/agent_framework_orchestrations/_concurrent.py
  - packages/orchestrations/agent_framework_orchestrations/_group_chat.py
  - packages/orchestrations/agent_framework_orchestrations/_handoff.py
  - packages/orchestrations/agent_framework_orchestrations/_magentic.py
  - packages/orchestrations/agent_framework_orchestrations/_orchestration_request_info.py
  - packages/orchestrations/tests/test_orchestration_intermediate_vs_terminal.py
  - issues/done/004-workflow-as-agent-and-orchestration-parity.md
  
  Blockers/notes:
  - Full documentation and sample migration wording remains for issue 005.
  - Existing tests that intentionally use final_output_from now emit the new deprecation warning.
  
  * Document workflow output selection contract
  
  Key decisions:
  - Use Workflow Output and Intermediate Output as the developer-facing terms for selected caller-facing emissions.
  - Document output_from and intermediate_output_from as the canonical API, with output_from as an allow-list and unselected payloads hidden unless explicitly selected as intermediate.
  - Add scenario and invalid-selection tables for workflow and orchestration docs, including legacy omission warnings, output_from='all', intermediate_output_from='all_other', list selections, invalid literals, overlap, duplicates, unknown selections, and empty explicit selections.
  - Migrate samples away from final_output_from and output_executors except where compatibility aliases are explicitly documented.
  
  Files changed:
  - packages/core/AGENTS.md
  - packages/orchestrations/README.md
  - packages/orchestrations/agent_framework_orchestrations/_handoff.py
  - packages/orchestrations/agent_framework_orchestrations/_sequential.py
  - samples/03-workflows/README.md
  - samples/03-workflows/control-flow/intermediate_vs_terminal_outputs.py
  - samples/03-workflows/human-in-the-loop/agents_with_approval_requests.py
  - samples/03-workflows/orchestrations/README.md
  - samples/04-hosting/foundry-hosted-agents/responses/05_workflows/main.py
  - scripts/sample_validation/create_dynamic_workflow_executor.py
  - issues/done/005-document-output-selection-contract.md
  
  Blockers/notes:
  - Direct full Ruff on scripts/sample_validation/create_dynamic_workflow_executor.py still reports pre-existing docstring/print/line-length issues outside this docs migration; syntax-focused checks for changed files pass.
  - No remaining AFK issue files are present under issues/.
  
  * Latest updates
  
  * Typing fixes
  
  * Cleanup

  Evan Mattson · 2026-05-19 00:15:25 +00:00
  3bbc81554b
• Improvements for DevUI (#5840)
  Evan Mattson · 2026-05-14 15:05:27 +00:00
  0e12640c70
• [BREAKING] Python: DevUI: tighten default access controls and CORS posture (#5740)

  * Python: DevUI: tighten default access controls and CORS posture
  
  Adjusts the default configuration of the DevUI server so the out-of-the-box
  posture matches what most callers expect when running locally. Adds explicit
  opt-outs for callers who need the previous behavior.
  
  - DevServer gains auth_enabled and auth_token constructor params; auth is on by
    default. Auto-generates and logs a token when none provided.
  - CORS default is an empty allowlist on every host. Callers wanting cross-origin
    pass cors_origins explicitly.
  - Streaming /v1/responses no longer sets Access-Control-Allow-Origin directly;
    CORSMiddleware owns all CORS decisions.
  - Loopback binds enforce a Host-header allowlist.
  - /meta moved out of the auth bypass list (was alongside /health and /).
  - serve() default flipped to auth_enabled=True; passes auth args through to
    DevServer instead of using env-var indirection.
  - CLI: --auth opt-in replaced with --no-auth opt-out; --auth-token preserved.
  - Tests cover the eight behaviors above in test_server.py.
  
  * Python: DevUI: address PR review comments
  
  - /meta now derives auth_required from self.auth_enabled instead of
    reading DEVUI_AUTH_TOKEN, so the auto-generated and explicit
    auth_token paths report correctly.
  - Reorder middleware so the loopback Host-header allowlist is registered
    last; Starlette wraps later-added middleware around earlier-added ones,
    so the host check now runs outermost (before CORS/auth) as intended.
  - Rework comments to describe the behavior rather than threat scenarios.
  - Streaming-headers and CORS tests now construct the server with an
    explicit auth_token and send a Bearer header, so the assertions
    actually exercise the streaming/CORS path instead of short-circuiting
    in the auth middleware.

  Evan Mattson · 2026-05-14 00:37:46 +00:00
  fbccad091b
• Python: information-flow control prompt injection defense (#5331)

  * Python: Information-flow control based prompt injection defense (#5024)
  
  * fides integration
  
  * documentation
  
  * documentation
  
  * documentation
  
  * human-approval on policy violation
  
  * numenous hyena 'works'
  
  * IFC based implementation
  
  * minor edits in documentation
  
  * rebasing the branch and running the email example
  
  * Add security tests for IFC middleware
  
  * Fix Role.TOOL NameError in approval handling
  
  * tiered labelling scheme
  
  * 3 tier labelling scheme in middleware
  
  * Adapt security middleware to list[Content] tool results
  
  * Refactor SecureAgentConfig as context provider and address Copilot review comments
  
  * Update FIDES docs to reflect context provider pattern and update code for ContextProvider rename
  
  * Fix security examples: use OpenAIChatClient instead of non-existent AzureOpenAIChatClient
  
  * Address PR review: consolidate security modules, remove ContentLineage, update docs
  
  * remove unrelated files
  
  * remove comment from _tools.py and rename decision file
  
  * Fix CI failures: Bandit B110, broken md links, hosted approval passthrough
  
  * apply template to decision doc 0024
  
  * minor fixes to decision doc 0024
  
  ---------
  
  Co-authored-by: Aashish <t-akolluri@microsoft.com>
  
  * Python: follow up FIDES security flow (#5330)
  
  * Python: follow up FIDES security flow
  
  Refine the secure approval path, mark the security classes with the FIDES experimental feature label, and clean up the related docs/tests. Also fix workspace-level validation regressions uncovered while running the full Python check suite.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: remove FIDES GitHub MCP sample
  
  Drop the GitHub MCP security sample from the FIDES follow-up branch while keeping the remaining security docs and samples intact.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address PR review: fix paths and update FIDES implementation (#5352)
  
  * Python: updated import naming and comment from review (#5421)
  
  * updated import naming and comment from review
  
  * Add approval replay None call-id test
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: Address PR 5331 comments and track sesssion while calling Agent in email_security_example (#5446)
  
  * Address PR review: fix paths and update FIDES implementation
  
  * Address PR comments and add session tracking in email example in samples
  
  * Fix session creation and resolve merge conflict in docstring example
  
  * Resolve merge conflict in docstring example
  
  * Python: add test for empty-message pruning in approval result replacement (#5617)
  
  Adds test coverage for the second-pass logic in
  `_replace_approval_contents_with_results` that removes messages whose
  `contents` list becomes empty after first-pass content removal.
  
  Addresses review comment on PR #5331:
  https://github.com/microsoft/agent-framework/pull/5331#discussion_r3129039445
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: shrutitople <shruti.tople@gmail.com>
  Co-authored-by: Aashish <t-akolluri@microsoft.com>
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-05-05 18:08:08 +00:00
  ddfbdf5c7a
• Python: Fix incorrect workflow timings in DevUI by adding created_at to executor events (#5615)

  * fix(devui): add created_at to custom output item events for correct workflow timings (#5545)
  
  CustomResponseOutputItemAddedEvent and CustomResponseOutputItemDoneEvent lacked a
  created_at field, causing the frontend to synthesize timestamps using integer-second
  precision with a forced +1s minimum gap between events. This made instant workflows
  appear to take 3+ seconds in the DevUI timeline.
  
  Fix:
  - Add optional created_at: float | None field to both custom event models
  - Populate created_at=float(time.time()) in the mapper for executor_invoked,
    executor_completed, and executor_failed events
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix(devui): use event created_at for accurate workflow timeline timings
  
  workflow-view.tsx synthesized _uiTimestamp using Math.max(baseTimestamp,
  lastTimestamp + 1) with integer-second precision, forcing a minimum 1-second
  gap between every sequential event. This made instant workflows appear to take
  several seconds in the DevUI timeline.
  
  The fix prefers event.created_at (a float Unix timestamp populated by the
  backend mapper for all executor events) and only falls back to the synthetic
  timestamp when created_at is absent. This matches the pattern already used in
  devuiStore.ts:addDebugEvent.
  
  Added a regression test in test_mapper.py verifying that the mapper attaches
  created_at to all executor lifecycle events (invoked, completed, failed).
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix(devui): address review feedback for issue #5545
  
  - Read data.timestamp (ISO string) and response.created_at in addition
    to top-level created_at when deriving _uiTimestamp, so
    response.workflow_event.completed events get a real server timestamp
    instead of a synthesized one
  - Change uniqueTimestamp tiebreaker: when a real server timestamp is
    available use Math.max(eventTimestamp, lastTimestamp) rather than
    lastTimestamp + 1, eliminating artificial 1-second gaps while still
    preserving monotonic ordering
  - Apply the same fix in the HIL streaming path (second setOpenAIEvents
    call in workflow-view.tsx)
  - Add assert event.created_at > 0 to regression test to guard against
    zero or negative timestamps
  - Add test_custom_output_item_event_models_have_created_at_field model-
    level test so removing the field produces a clear named failure rather
    than a downstream ValidationError
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix(#5545): guard NaN timestamps, fix fallback ID uniqueness, add regression tests
  
  - workflow-view.tsx (×2): Wrap data.timestamp ISO→number conversion in a
    Number.isFinite() guard.  Python's datetime.now().isoformat() emits
    microseconds without a trailing 'Z' (e.g. '2024-01-15T12:34:56.123456'),
    which some JS engines cannot parse, returning NaN.  NaN !== undefined is
    true so the eventTimestamp !== undefined guard did not catch it, poisoning
    _uiTimestamp and resetting the monotonic ordering seed (NaN || 0 → 0).
  
  - execution-timeline.tsx: Replace uiTimestamp in the fallback syntheticItemId
    with the per-executor runNumber counter.  Two runs of the same executor
    within the same second previously received identical _uiTimestamp values
    and therefore identical syntheticItemIds, causing their output buckets,
    state, and run entries to collide (execution-timeline.tsx:360–408).
  
  - Add missing test_workflow_timings_bug.py source file (only a stale .pyc
    existed).  Three regression tests:
      · test_custom_event_models_lack_created_at_field – model field guard
      · test_workflow_executor_events_lack_created_at – mapper populates created_at
      · test_rapid_workflow_events_have_no_top_level_timestamps – confirms
        data.timestamp format that requires the frontend NaN guard
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address review feedback for #5545: Python: [Bug]: Workflow timings in DevUI are incorrect
  
  * devui: move timing regression tests into test_mapper.py, remove dedicated bug file
  
  - Delete test_workflow_timings_bug.py; tests belong in existing module files
  - The two tests already present in test_mapper.py (test_executor_events_carry_created_at_timestamp
    and test_custom_output_item_event_models_have_created_at_field) cover the same ground as the
    first two tests in the deleted file
  - Add test_executor_completed_maps_to_output_item_done_event to test_mapper.py, replacing the
    third test from the deleted file with a generic, issue-agnostic name and docstring
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address review feedback for #5545: review comment fixes
  
  ---------
  
  Co-authored-by: Copilot <copilot@github.com>
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Evan Mattson · 2026-05-05 05:59:08 +00:00
  27f926609f
• Python: Fix DevUI streaming memory growth and add cross-platform regression coverage (#5221)

  * fix for memory leak in devui
  
  * update async sleep
  
  * remove old func

  Eduard van Valkenburg · 2026-04-14 09:27:52 +00:00
  98e17764a4
• Python: [BREAKING] update to v1.0.0 (#5062)

  * updates to final deprecated pieces and versions
  
  * fix mypy
  
  * fix readme links

  Eduard van Valkenburg · 2026-04-02 15:26:30 +00:00
  3446eb8d5d
• Python: [BREAKING] Python: move Azure AI embeddings to Foundry (#5056)

  * renamed AzureAIINferenceEmbeddings and lazy load azure-cosmos and env var rename
  
  * updated coverage
  
  * fix readme

  Eduard van Valkenburg · 2026-04-02 11:26:35 +00:00
  95fd5ec658
• Python: [BREAKING] Standardize model selection on model (#4999)

  * Refactor Anthropic model option and provider clients
  
  Rename the Anthropic client model option from model_id to model, add provider-specific Anthropic wrappers for Foundry, Bedrock, and Vertex, and expose them through the Anthropic, Foundry, Amazon, and Google namespaces. Update core option handling, docs, samples, and tests accordingly.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Fix Anthropic skills sample typing
  
  Cast the Anthropic beta client to Any in the skills sample so the pre-commit sample pyright check no longer fails on beta skills and files endpoints that are not exposed by the current SDK stubs.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * undo sample mypy
  
  * Retry CI after transient external failures
  
  Retrigger PR validation after an unrelated Copilot review workflow SAML failure and a transient external tau2 git fetch failure in the Windows Python test setup.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address review feedback on model option merging
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address Anthropic compatibility review feedback
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * moved all to `model`
  
  * fixes for azure ai search
  
  * Python: standardize remaining sample env var names
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: fix foundry-local pyright compatibility
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * updated env vars in cicd
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-04-01 19:00:18 +00:00
  6acab3d1d6
• Python: [BREAKING] Remove deprecated Python OpenAI/Azure AI surfaces (#4990)

  * [BREAKING] Remove deprecated Python OpenAI/Azure AI surfaces
  
  Also clean up follow-on docs, environment guidance, package metadata, and lab test stability.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Fix deleted semantic-kernel sample links
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address PR review feedback
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * improve foundry language
  
  * Fix A2A Foundry sample regression
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-03-31 20:36:21 +00:00
  3a49b1d6dd
• [BREAKING] Python: fix OpenAI Azure routing and provider samples (#4925)

  * Python: fix OpenAI Azure routing and provider samples
  
  Prefer OpenAI when OPENAI_API_KEY is present unless Azure is explicitly requested. Clarify constructor docs, keep deprecated Azure wrappers compatible with stricter settings validation, and refresh the provider samples and tests to use the current client patterns.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix bandit
  
  * Python: align OpenAI embedding Azure routing
  
  Extend the shared OpenAI-vs-Azure routing and credential behavior to the embedding client, add Azure embedding regression coverage, and refresh the embedding samples to use the generic client path.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: fix embedding client pyright check
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: thin OpenAI embedding wrapper
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: document embedding overload routing
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: fix callable OpenAI key routing
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: fix Azure credential routing tests
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: address OpenAI review feedback
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: narrow Azure routing markers
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: refine OpenAI model fallback order
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: narrow Azure deployment docs
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: remove embedding routing wording
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: run embedding Azure integration tests
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * changed variable name
  
  * Python: expand OpenAI package README
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * clarified readme
  
  * Python: fix Azure OpenAI integration setup
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: correct Azure integration env mapping
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * updated code to fix int tests
  
  * test updates
  
  * test fix
  
  * fix test setup
  
  * updates to tests and setup
  
  * remove openai assistants int tests
  
  * improvements in int tests
  
  * fix env var
  
  * fix env vars
  
  * fix azure responses test
  
  * trigger actions
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-03-27 13:33:39 +00:00
  cc0cfaaac8
• Fix CWE-863: Validate function approval responses in DevUI executor (#4598)

  The DevUI /v1/responses endpoint accepts function_approval_response content
  without verifying that the request_id corresponds to a real pending approval
  request issued by the server. This allows forged approval responses to
  execute arbitrary tools with attacker-controlled arguments, bypassing
  approval_mode='always_require'.
  
  Changes:
  - Track outgoing approval requests in a server-side registry
    (_pending_approvals) keyed by request_id
  - Validate incoming approval responses against this registry; reject
    any response whose request_id was not issued by the server
  - Use server-stored function_call data (tool name, arguments, call_id)
    instead of client-supplied data when constructing the approval response
  - Consume request_ids on use (pop from registry) to prevent replay attacks
  
  Tests:
  - 8 new tests covering forged rejection, server-data enforcement,
    anti-replay, multiple independent approvals, and edge cases
  
  Co-authored-by: REDMOND\tusharmudi <tusharmudi@microsoft.com>

  Tushar Mudi · 2026-03-12 02:34:31 +00:00
  378bee577e
• Python: [Breaking] Upgrade to azure-ai-projects 2.0+ (#4536)

  * Prepare azure-ai-projects 2.0 GA compatibility
  
  Add allow_preview support for internal AIProjectClient creation, keep backward compatibility for renamed SDK model classes, and align Azure AI/core paths and tests for GA validation workflows.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * upgrade to ai-project==2.0.0
  
  * Python: remove azure-ai-projects keyword-guard paths
  
  Assume azure-ai-projects 2.0+ in Azure AI client/provider/responses code paths by removing _supports_keyword_argument gating and related fallback branching.
  
  Also fix pyright typing in FoundryMemoryProvider memory store calls by using ResponseInputItemParam-typed items.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * check fixes
  
  * Python: remove unsupported foundry_features option
  
  Drop foundry_features from Azure AI client and provider surfaces because azure-ai-projects 2.0.0 does not expose that create_version parameter.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: add allow_preview to Foundry memory provider
  
  Propagate allow_preview when FoundryMemoryProvider constructs an AIProjectClient and update tests accordingly.
  
  Also finish wiring allow_preview through AzureAIClient-facing surfaces and related docs.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * aligning docstrings
  
  * udpated lock
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-03-09 10:12:47 +00:00
  23d6d91c8f
• Python: Fix Python pyright package scoping and typing remediation (#4426)

  * Fix Python pyright package scoping and typing remediation
  
  Implements issue #4407 by removing the root pyright include, adding package-level pyright includes, and resolving pyright/mypy typing issues across Python packages. Also cleans unnecessary casts and applies line-level, rule-specific ignores where external libraries are too dynamic.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Reduce pyright cost in handoff cloning
  
  Simplify cloned_options construction in HandoffAgentExecutor to avoid expensive TypedDict narrowing/inference in _handoff.py, which was causing pyright to spend a long time in orchestrations.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix types
  
  * Fix lint and type-check regressions
  
  Resolve current Python package check failures across lint, pyright, and mypy after recent code changes, including purview/declarative pyright issues and multiple ruff simplification findings.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fixed hooks
  
  * Stabilize package tests and test tasks
  
  Resolve cross-package non-integration test failures, simplify streaming type flow, harden locale/culture handling, and standardize package test poe tasks to exclude integration tests where applicable.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * lots of small fixes
  
  * Fix current Python test regressions
  
  Address current failing unit tests in azure-ai, bedrock, and azure-cosmos while keeping Bedrock parsing logic inline (no new static helper methods).
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * small fixes
  
  * small fixes
  
  * removed pydantic from json
  
  * final updates
  
  * fix core
  
  * fix tests
  
  * fix obser
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-03-05 15:32:24 +00:00
  55ddd841b7
• Python: .NET: Fix .NET conversation memory in DevUI (#3484) (#4294)

  * Fix .NET conversation memory in DevUI (#3484)
  
  * formatting fixes
  
  * fix memory regression in python devui , fix for #4123
  
  * Fix for #3983: Added _get_event_type() helper that safely accesses event type on both objects (.type) and dicts (.get("type")). Replaced all 4 bare event.type accesses in _executor.py (lines 267, 477, 499, 523).
  
  Root cause: PR #3690 changed event.__class__.__name__ == "RequestInfoEvent" (safe) to event.type == "request_info" (crashes on dicts), but _execute_workflow still yields raw dicts on error paths.
  
  Test: test_workflow_error_yields_dict_event_without_crash — mocks a workflow that raises, verifies execute_entity consumes the dict error events without crashing.
  
  * format fixes
  
  * lint fixes

  Victor Dibia · 2026-03-02 10:34:25 +00:00
  9124d51e0e
• Python: Tuning auto sample validation workflow (#4218)

  * Tuning validate-01-get-started
  
  * Add gh token
  
  * Add model
  
  * enable debug log
  
  * bump up timeout for testing purposes
  
  * Test cli is working
  
  * Fix end quote
  
  * Run gh auth
  
  * Run gh auth trail 2
  
  * Run gh auth trail 3
  
  * Test token
  
  * Add zcure login
  
  * Add zcure login 2
  
  * Add zcure login 3
  
  * Add zcure login 4
  
  * Extract common actions
  
  * Extract common actions 2
  
  * Correct env vars
  
  * Print outputs to action console
  
  * Disable end-to-end samples
  
  * Fix ruff errors
  
  * Fix ruff errors 2
  
  * Revert workflow changes to fix tests
  
  * Revert workflow changes to fix tests 2
  
  * Revert workflow changes to fix tests 3
  
  * Revert workflow changes to fix tests 4

  Tao Chen · 2026-02-27 11:45:10 +09:00
  c45d47d4b2
• Python: Remove duplicate samples (#3899)

  * Remove duplicate samples
  
  * Correct paths
  
  * Update readme
  
  * Update readme
  
  * Fix ruff
  
  ---------
  
  Co-authored-by: Evan Mattson <35585003+moonbox3@users.noreply.github.com>

  Tao Chen · 2026-02-12 23:46:41 +00:00
  e064f943ae
• Python: Fix streamed workflow agent continuation context by finalizing AgentExecutor streams (#3882)

  * Fix streamed workflow agent continuation context by finalizing AgentExecutor streams
  
  * Fix stream handling
  
  * Fixes
  
  * Fix DevUI and tests

  Evan Mattson · 2026-02-12 22:45:46 +00:00
  a276c1295a
• Python: [BREAKING] PR2 — Wire context provider pipeline, remove old types, update all consumers (#3850)

  * PR2: Wire context provider pipeline and update all internal consumers
  
  - Replace AgentThread with AgentSession across all packages
  - Replace ContextProvider with BaseContextProvider across all packages
  - Replace context_provider param with context_providers (Sequence)
  - Replace thread= with session= in run() signatures
  - Replace get_new_thread() with create_session()
  - Add get_session(service_session_id) to agent interface
  - DurableAgentThread -> DurableAgentSession
  - Remove _notify_thread_of_new_messages from WorkflowAgent
  - Wire before_run/after_run context provider pipeline in RawAgent
  - Auto-inject InMemoryHistoryProvider when no providers configured
  
  * fix: update all tests for context provider pipeline, fix lazy-loaders, remove old test files
  
  * refactor: update all sample files for context provider pipeline (AgentThread→AgentSession, ContextProvider→BaseContextProvider)
  
  * fix: update remaining ag-ui references (client docstring, getting_started sample)
  
  * fix: make get_session service_session_id keyword-only to avoid confusion with session_id
  
  * refactor: rename _RunContext.thread_messages to session_messages
  
  * refactor: remove _threads.py, _memory.py, and old provider files; migrate devui to use plain message lists
  
  * rename: remove _new_ prefix from test files
  
  * refactor: rewrite SlidingWindowChatMessageStore as SlidingWindowHistoryProvider(InMemoryHistoryProvider)
  
  * fix: read full history from session state directly instead of reaching into provider internals
  
  * fix: update stale .pyi stubs, sample imports, and README references for new provider types
  
  * fix: remove stale message_store, _notify_thread_of_new_messages, and session_id.key references in samples
  
  * refactor: merge context_providers and sessions sample folders into sessions, remove aggregate_context_provider
  
  * refactor: UserInfoMemory stores state in session.state instead of instance attributes
  
  * feat: add Pydantic BaseModel support to session state serialization
  
  Pydantic models stored in session.state are now automatically serialized
  via model_dump() and restored via model_validate() during to_dict()/from_dict()
  round-trips. Models are auto-registered on first serialization; use
  register_state_type() for cold-start deserialization.
  
  Also export register_state_type as a public API.
  
  * fix mem0
  
  * Update sample README links and descriptions for session terminology
  
  - Replace 'thread' with 'session' in sample descriptions across all READMEs
  - Update file links for renamed samples (mem0_sessions, redis_sessions, etc.)
  - Fix Threads section → Sessions section in main samples/README.md
  - Update tools, middleware, workflows, durabletask, azure_functions READMEs
  - Update architecture diagrams in concepts/tools/README.md
  - Update migration guides (autogen, semantic-kernel)
  
  * Fix broken Redis README link to renamed sample
  
  * Fix Mem0 OSS client search: pass scoping params as direct kwargs
  
  AsyncMemory (OSS) expects user_id/agent_id/run_id as direct kwargs,
  while AsyncMemoryClient (Platform) expects them in a filters dict.
  Adds tests for both client types.
  
  Port of fix from #3844 to new Mem0ContextProvider.
  
  * Fix rebase issues: restore missing _conversation_state.py and checkpoint decode logic
  
  - Add back _conversation_state.py (encode/decode_chat_messages) lost in rebase
  - Fix on_checkpoint_restore to decode cache/conversation with decode_chat_messages
  - Fix on_checkpoint_restore to use decode_checkpoint_value for pending requests
  - Add tests/workflow/__init__.py for relative import support
  - Fix test_agent_executor checkpoint selection (checkpoints[1] not superstep)
  
  * Add STORES_BY_DEFAULT ClassVar to skip redundant InMemoryHistoryProvider injection
  
  Chat clients that store history server-side by default (OpenAI Responses API,
  Azure AI Agent) now declare STORES_BY_DEFAULT = True. The agent checks this
  during auto-injection and skips InMemoryHistoryProvider unless the user
  explicitly sets store=False.
  
  * Fix broken markdown links in azure_ai and redis READMEs
  
  * Fix getting-started samples to use session API instead of removed thread/ContextProvider API
  
  * updates to workflow as agent
  
  * fix group chat import
  
  * Rename Thread→Session throughout, fix service_session_id propagation, remove stale AGUIThread
  
  - Fix: Propagate conversation_id from ChatResponse back to session.service_session_id
    in both streaming and non-streaming paths in _agents.py
  - Rename AgentThreadException → AgentSessionException
  - Remove stale AGUIThread from ag_ui lazy-loader
  - Rename use_service_thread → use_service_session in ag-ui package
  - Rename test functions from *_thread_* to *_session_*
  - Rename sample files from *_thread* to *_session*
  - Update docstrings and comments: thread → session
  - Update _mcp.py kwargs filter: add 'session' alongside 'thread'
  - Fix ContinuationToken docstring example: thread=thread → session=session
  - Fix _clients.py docstring: 'Agent threads' → 'Agent sessions'
  
  * Fix broken markdown links after thread→session file renames
  
  * fix azure ai test

  Eduard van Valkenburg · 2026-02-12 21:00:32 +00:00
  1e350ea22f
• [BREAKING] Python: Checkpoint refactor: encode/decode, checkpoint format, etc (#3744)

  * WIP: Checkpoint refactor: encode/decode, checkpoint format, etc
  
  * WIP: Remove workflow ID in checkpoints
  
  * Refactor checkpointing
  
  * Add get_latest tests
  
  * Increase test coverage
  
  * Fix formatting
  
  * Fix unit tests
  
  * Fix samples
  
  * fix unit tests
  
  * fix pipeline
  
  * Copilot comments
  
  * Fix tests
  
  * Fix more tests
  
  * Address comments part 1
  
  * Address comments part 2
  
  * Comments

  Tao Chen · 2026-02-11 20:57:15 +00:00
  7db6c4ab4e
• Python: [BREAKING] Simplify API: ChatAgent -> Agent, ChatMessage -> Message (#3747)

  * [BREAKING] Rename ChatAgent -> Agent, ChatMessage -> Message, ChatClientProtocol -> SupportsChatGetResponse
  
  Simplify the public API by removing redundant 'Chat' prefix from core types:
  - ChatAgent -> Agent
  - RawChatAgent -> RawAgent
  - ChatMessage -> Message
  - ChatClientProtocol -> SupportsChatGetResponse
  
  Also renamed internal WorkflowMessage (was Message in _runner_context) to avoid collision.
  
  No backward compatibility aliases - this is a clean breaking change.
  
  * [BREAKING] Rename Agent chat_client parameter to client
  
  * Fix rebase issues: WorkflowMessage references and broken markdown links
  
  * Fix formatting and lint issues from code quality checks
  
  * Fix import ordering in workflow sample files
  
  * fixed rebase
  
  * Fix test failures: use WorkflowMessage and A2AMessage after ChatMessage→Message rename
  
  - Replace Message(data=..., source_id=...) with WorkflowMessage(...) in workflow tests
  - Fix isinstance check in A2A agent to use A2AMessage instead of Message
  - Fix import in test_workflow_observability.py (Message→WorkflowMessage)
  
  * Fix lint, fmt, and sample errors after ChatMessage→Message rename
  
  - Auto-fix 70+ ruff lint issues across samples (ChatMessage→Message refs)
  - Fix HostedVectorStoreContent→Content.from_hosted_vector_store in file search sample
  - Fix _normalize_messages→normalize_messages in custom agent sample
  - Fix context.terminate→raise MiddlewareTermination in middleware samples
  - Fix with_update_hook→with_transform_hook in override middleware sample
  - Add TOptions_co import back to custom_chat_client sample
  - Add noqa for FastAPI File() default in chatkit sample
  - Fix B023 loop variable capture in weather agent sample
  
  * fix: update Agent constructor calls from chat_client to client in declaration-only tool tests
  
  * fix: add register_cleanup to devui lazy-loading proxy and type stub
  
  * fixed tests and updated new pieces
  
  * fix agui typevar
  
  * fix merge errors
  
  * fix merge conflicts
  
  * fiux merge
  
  * Remove unused links
  
  ---------
  
  Co-authored-by: Evan Mattson <evan.mattson@microsoft.com>

  Eduard van Valkenburg · 2026-02-10 23:04:32 +00:00
  0521f5bed8
• Python: replace pre-commit with prek, add PEP 723 script deps, clean up dev dependencies (#3748)

  * python: replace pre-commit with prek, add PEP 723 script deps, clean up dev dependencies
  
  - Replace pre-commit with prek (Rust-native, faster pre-commit alternative)
  - Move supported hooks to repo: builtin for zero-clone speed
  - Add new builtin hooks: trailing-whitespace, check-merge-conflict, detect-private-key, check-added-large-files
  - Update all hook versions to latest (pre-commit-hooks v6, pyupgrade v3.21.2, bandit 1.9.3, uv-pre-commit 0.10.0)
  - Add PEP 723 inline script metadata to 34 samples with external deps
  - Remove autogen-agentchat/autogen-ext from dev deps (now declared per-sample)
  - Remove unused dev deps: pytest-env, tomli-w
  - Add agent-framework-core>=1.0.0b260130 lower bound to all 21 packages
  - Update CI workflow to use j178/prek-action
  - Update docs: DEV_SETUP.md, AGENTS.md, CODING_STANDARD.md, SAMPLE_GUIDELINES.md
  
  * updated lock
  
  * python: fix prek config paths for local execution and CI workflow
  
  Remove global 'files: ^python/' filter and strip python/ prefix from all path patterns in .pre-commit-config.yaml so prek finds files when run from the python/ directory. Update CI workflow to use --cd python instead of --config path. Include trailing whitespace fixes and dev dependency cleanup.
  
  * python: move helper scripts to scripts/ folder and exclude from checks
  
  * python: exclude AGENTS.md from prek markdown code lint
  
  * python: exclude AGENTS.md and azure_ai_search sample from markdown lint
  
  * fix m365 sample
  
  * python: ignore CPY rule for samples with PEP 723 headers
  
  * fix in dev_setup
  
  * python: replace aiofiles with regular open in samples
  
  * python: suppress reportUnusedImport in markdown code block checker
  
  * python: use samples pyright config for markdown code block checker
  
  Write a temp pyrightconfig.json matching pyrightconfig.samples.json rules (typeCheckingMode=off, only reportMissingImports and reportAttributeAccessIssue). Filter output to only fail on these rules since syntax-level errors (top-level await, undefined vars) are expected in README documentation snippets.
  
  * python: use markdown-code-lint with fixed globs instead of prek file list
  
  The prek-markdown-code-lint task received all changed files including non-README markdown and files with pre-existing broken imports. Replace with the standard markdown-code-lint task which uses the correct glob patterns (README.md, packages/**/README.md, samples/**/*.md).
  
  * python: exclude READMEs with pre-existing broken imports from markdown lint
  
  * python: fix broken README code snippets instead of excluding them
  
  - ag-ui: replace TextContent (removed) with content.type == 'text'
  - durabletask: fix import path to durabletask.worker.TaskHubGrpcWorker
  - orchestrations: use constructor params instead of .participants() method
  - observability: mark deprecated code blocks as plain text, filter
    reportMissingImports to agent_framework modules only
  - remove README excludes from markdown-code-lint task
  
  * add revision to gaia download
  
  * feat(python): parallelize checks across packages
  
  Run (package × task) cross-product in parallel using ThreadPoolExecutor
  and subprocesses. Key changes:
  
  - Add scripts/task_runner.py with shared parallel execution engine
  - Update run_tasks_in_packages_if_exists.py to accept multiple tasks
  - Update run_tasks_in_changed_packages.py with --files flag and parallel support
  - Add check-packages poe task (fmt+lint+pyright+mypy in parallel)
  - Add prek-markdown-code-lint and prek-samples-check with change detection
  - Split CI code quality workflow into parallel prek and mypy jobs
  - Update DEV_SETUP.md to document new parallel behavior
  
  Core package changes still trigger checks on all packages.
  
  * feat(ci): split code quality into 4 parallel jobs
  
  Split the single prek job into parallel jobs:
  - pre-commit-hooks: lightweight hooks (SKIP=poe-check)
  - package-checks: fmt/lint/pyright/mypy via check-packages
  - samples-markdown: samples-lint, samples-syntax, markdown-code-lint
  - mypy: change-detected mypy checks
  
  All 4 jobs run concurrently (×2 Python versions = 8 runners).
  
  * feat(ci): use only Python 3.10 for code quality checks
  
  * refactor(python): add future annotations and remove quoted types
  
  Add `from __future__ import annotations` to 93 package files that
  used quoted string annotations, then run pyupgrade --py310-plus to
  remove the now-unnecessary quotes.
  
  Fixes https://github.com/microsoft/agent-framework/issues/3578

  Eduard van Valkenburg · 2026-02-09 17:51:01 +00:00
  977c3adfb2
• [BREAKING] Python: Move single-config fluent methods to constructor parameters (#3693)

  * Move single-config fluent methods to constructor parameters
  
  * Updates
  
  * Adjust magentic and group chat

  Evan Mattson · 2026-02-07 06:01:52 +00:00
  74ac470a56
• [BREAKING] Python: Merge send_responses into run method (#3720)

  * Streamline workflow run api with send responses in one method
  
  * Fixes
  
  * Address copilot feedback

  Evan Mattson · 2026-02-06 22:32:38 +00:00
  a17f13598b
• Python: [BREAKING] Renamed AgentProtocol to SupportsAgentRun (#3717)

  * Renamed AgentProtocol to AgentLike
  
  * Resolved comments
  
  * Renamed AgentLike to SupportsAgentRun
  
  * Resolved comments

  Dmytro Struk · 2026-02-06 17:53:21 +00:00
  15256bb616
• [BREAKING] Python: Refactor workflow events to unified discriminated union pattern (#3690)

  * Refactor events
  
  * Merge main
  
  * Fixes
  
  * Cleanup
  
  * Update samples and tests
  
  * Remove unused imports
  
  * PR feedback
  
  * Merge main. Add properties for events to help typing
  
  * Formatting
  
  * Cleanup
  
  * use builtins.type to avoid shadowing by WorkflowEvent.type attribute
  
  * Final improvements

  Evan Mattson · 2026-02-06 07:47:20 +00:00
  0f3f4dbcaf
• Python: [BREAKING] Moved to a single get_response and run API (#3379)

  * WIP
  
  * big update to new ResponseStream model
  
  * fixed tests and typing
  
  * fixed tests and typing
  
  * fixed tools typevar import
  
  * fix
  
  * mypy fix
  
  * mypy fixes and some cleanup
  
  * fix missing quoted names
  
  * and client
  
  * fix  imports agui
  
  * fix anthropic override
  
  * fix agui
  
  * fix ag ui
  
  * fix import
  
  * fix anthropic types
  
  * fix mypy
  
  * refactoring
  
  * updated typing
  
  * fix 3.11
  
  * fixes
  
  * redid layering of chat clients and agents
  
  * redid layering of chat clients and agents
  
  * Fix lint, type, and test issues after rebase
  
  - Add @overload decorators to AgentProtocol.run() for type compatibility
  - Add missing docstring params (middleware, function_invocation_configuration)
  - Fix TODO format (TD002) by adding author tags
  - Fix broken observability tests from upstream:
    - Replace non-existent use_instrumentation with direct instantiation
    - Replace non-existent use_agent_instrumentation with AgentTelemetryLayer mixin
    - Fix get_streaming_response to use get_response(stream=True)
    - Add AgentInitializationError import
    - Update streaming exception tests to match actual behavior
  
  * Fix AgentExecutionException import error in test_agents.py
  
  - Replace non-existent AgentExecutionException with AgentRunException
  
  * Fix test import and asyncio deprecation issues
  
  - Add 'tests' to pythonpath in ag-ui pyproject.toml for utils_test_ag_ui import
  - Replace deprecated asyncio.get_event_loop().run_until_complete with asyncio.run
  
  * Fix azure-ai test failures
  
  - Update _prepare_options patching to use correct class path
  - Fix test_to_azure_ai_agent_tools_web_search_missing_connection to clear env vars
  
  * Convert ag-ui utils_test_ag_ui.py to conftest.py
  
  - Move test utilities to conftest.py for proper pytest discovery
  - Update all test imports to use conftest instead of utils_test_ag_ui
  - Remove old utils_test_ag_ui.py file
  - Revert pythonpath change in pyproject.toml
  
  * fix: use relative imports for ag-ui test utilities
  
  * fix agui
  
  * Rename Bare*Client to Raw*Client and BaseChatClient
  
  - Renamed BareChatClient to BaseChatClient (abstract base class)
  - Renamed BareOpenAIChatClient to RawOpenAIChatClient
  - Renamed BareOpenAIResponsesClient to RawOpenAIResponsesClient
  - Renamed BareAzureAIClient to RawAzureAIClient
  - Added warning docstrings to Raw* classes about layer ordering
  - Updated README in samples/getting_started/agents/custom with layer docs
  - Added test for span ordering with function calling
  
  * Fix layer ordering: FunctionInvocationLayer before ChatTelemetryLayer
  
  This ensures each inner LLM call gets its own telemetry span, resulting in
  the correct span sequence: chat -> execute_tool -> chat
  
  Updated all production clients and test mocks to use correct ordering:
  - ChatMiddlewareLayer (first)
  - FunctionInvocationLayer (second)
  - ChatTelemetryLayer (third)
  - BaseChatClient/Raw...Client (fourth)
  
  * Remove run_stream usage
  
  * Fix conversation_id propagation
  
  * Python: Add BaseAgent implementation for Claude Agent SDK (#3509)
  
  * Added ClaudeAgent implementation
  
  * Updated streaming logic
  
  * Small updates
  
  * Small update
  
  * Fixes
  
  * Small fix
  
  * Naming improvements
  
  * Updated imports
  
  * Addressed comments
  
  * Updated package versions
  
  * Update Claude agent connector layering
  
  * fix test and plugin
  
  * Store function middleware in invocation layer
  
  * Fix telemetry streaming and ag-ui tests
  
  * Remove legacy ag-ui tests folder
  
  * updates
  
  * Remove terminate flag from FunctionInvocationContext, use MiddlewareTermination instead
  
  - Remove terminate attribute from FunctionInvocationContext
  - Add result attribute to MiddlewareTermination to carry function results
  - FunctionMiddlewarePipeline.execute() now lets MiddlewareTermination propagate
  - _auto_invoke_function captures context.result in exception before re-raising
  - _try_execute_function_calls catches MiddlewareTermination and sets should_terminate
  - Fix handoff middleware to append to chat_client.function_middleware directly
  - Update tests to use raise MiddlewareTermination instead of context.terminate
  - Add middleware flow documentation in samples/concepts/tools/README.md
  - Fix ag-ui to use FunctionMiddlewarePipeline instead of removed create_function_middleware_pipeline
  
  * fix: remove references to removed terminate flag in purview tests, add type ignore
  
  * fix: move _test_utils.py from package to test folder
  
  * fix: call get_final_response() to trigger context provider notification in streaming test
  
  * fix: correct broken links in tools README
  
  * docs: clarify default middleware behavior in summary table
  
  * fix: ensure inner stream result hooks are called when using map()/from_awaitable()
  
  * Fix mypy type errors
  
  * Address PR review comments on observability.py
  
  - Remove TODO comment about unconsumed streams, add explanatory note instead
  - Remove redundant _close_span cleanup hook (already called in _finalize_stream)
  - Clarify behavior: cleanup hooks run after stream iteration, if stream is not
    consumed the span remains open until garbage collected
  
  * Remove gen_ai.client.operation.duration from span attributes
  
  Duration is a metrics-only attribute per OpenTelemetry semantic conventions.
  It should be recorded to the histogram but not set as a span attribute.
  
  * Remove duration from _get_response_attributes, pass directly to _capture_response
  
  Duration is a metrics-only attribute. It's now passed directly to _capture_response
  instead of being included in the attributes dict that gets set on the span.
  
  * Remove redundant _close_span cleanup hook in AgentTelemetryLayer
  
  _finalize_stream already calls _close_span() in its finally block,
  so adding it as a separate cleanup hook is redundant.
  
  * Use weakref.finalize to close span when stream is garbage collected
  
  If a user creates a streaming response but never consumes it, the cleanup
  hooks won't run. Now we register a weak reference finalizer that will close
  the span when the stream object is garbage collected, ensuring spans don't
  leak in this scenario.
  
  * Fix _get_finalizers_from_stream to use _result_hooks attribute
  
  Renamed function to _get_result_hooks_from_stream and fixed it to
  look for the _result_hooks attribute which is the correct name in
  ResponseStream class.
  
  * Add missing asyncio import in test_request_info_mixin.py
  
  * Fix leftover merge conflict marker in image_generation sample
  
  * Update integration tests
  
  * Fix integration tests: increase max_iterations from 1 to 2
  
  Tests with tool_choice options require at least 2 iterations:
  1. First iteration to get function call and execute the tool
  2. Second iteration to get the final text response
  
  With max_iterations=1, streaming tests would return early with only
  the function call/result but no final text content.
  
  * Fix duplicate function call error in conversation-based APIs
  
  When using conversation_id (for Responses/Assistants APIs), the server
  already has the function call message from the previous response. We
  should only send the new function result message, not all messages
  including the function call which would cause a duplicate ID error.
  
  Fix: When conversation_id is set, only send the last message (the tool
  result) instead of all response.messages.
  
  * Add regression test for conversation_id propagation between tool iterations
  
  Port test from PR #3664 with updates for new streaming API pattern.
  Tests that conversation_id is properly updated in options dict during
  function invocation loop iterations.
  
  * Fix tool_choice=required to return after tool execution
  
  When tool_choice is 'required', the user's intent is to force exactly one
  tool call. After the tool executes, return immediately with the function
  call and result - don't continue to call the model again.
  
  This fixes integration tests that were failing with empty text responses
  because with tool_choice=required, the model would keep returning function
  calls instead of text.
  
  Also adds regression tests for:
  - conversation_id propagation between tool iterations (from PR #3664)
  - tool_choice=required returns after tool execution
  
  * Document tool_choice behavior in tools README
  
  - Add table explaining tool_choice values (auto, none, required)
  - Explain why tool_choice=required returns immediately after tool execution
  - Add code example showing the difference between required and auto
  - Update flow diagram to show the early return path for tool_choice=required
  
  * Fix tool_choice=None behavior - don't default to 'auto'
  
  Remove the hardcoded default of 'auto' for tool_choice in ChatAgent init.
  When tool_choice is not specified (None), it will now not be sent to the
  API, allowing the API's default behavior to be used.
  
  Users who want tool_choice='auto' can still explicitly set it either in
  default_options or at runtime.
  
  Fixes #3585
  
  * Fix tool_choice=none should not remove tools
  
  In OpenAI Assistants client, tools were not being sent when
  tool_choice='none'. This was incorrect - tool_choice='none' means
  the model won't call tools, but tools should still be available
  in the request (they may be used later in the conversation).
  
  Fixes #3585
  
  * Add test for tool_choice=none preserving tools
  
  Adds a regression test to ensure that when tool_choice='none' is set but
  tools are provided, the tools are still sent to the API. This verifies
  the fix for #3585.
  
  * Fix tool_choice=none should not remove tools in all clients
  
  Apply the same fix to OpenAI Responses client and Azure AI client:
  - OpenAI Responses: Remove else block that popped tool_choice/parallel_tool_calls
  - Azure AI: Remove tool_choice != 'none' check when adding tools
  
  When tool_choice='none', the model won't call tools, but tools should
  still be sent to the API so they're available for future turns.
  
  Also update README to clarify tool_choice=required supports multiple tools.
  
  Fixes #3585
  
  * Keep tool_choice even when tools is None
  
  Move tool_choice processing outside of the 'if tools' block in OpenAI
  Responses client so tool_choice is sent to the API even when no tools
  are provided.
  
  * Update test to match new parallel_tool_calls behavior
  
  Changed test_prepare_options_removes_parallel_tool_calls_when_no_tools to
  test_prepare_options_preserves_parallel_tool_calls_when_no_tools to reflect
  that parallel_tool_calls is now preserved even when no tools are present,
  consistent with the tool_choice behavior.
  
  * Fix ChatMessage API and Role enum usage after rebase
  
  - Update ChatMessage instantiation to use keyword args (role=, text=, contents=)
  - Fix Role enum comparisons to use .value for string comparison
  - Add created_at to AgentResponse in error handling
  - Fix AgentResponse.from_updates -> from_agent_run_response_updates
  - Fix DurableAgentStateMessage.from_chat_message to convert Role enum to string
  - Add Role import where needed
  
  * Fix additional ChatMessage API and method name changes
  
  - Fix ChatMessage usage in workflow files (use text= instead of contents= for strings)
  - Fix AgentResponse.from_updates -> from_agent_run_response_updates in workflow files
  - Fix test files for ChatMessage and Role enum usage
  
  * Fix remaining ChatMessage API usage in test files
  
  * Fix more ChatMessage and Role API changes in source and test files
  
  - Fix ChatMessage in _magentic.py replan method
  - Fix Role enum comparison in test assertions
  - Fix remaining test files with old ChatMessage syntax
  
  * Fix ChatMessage and Role API changes across packages
  
  - Add Role import where missing
  - Fix ChatMessage signature: positional args to keyword args (role=, text=, contents=)
  - Fix Role enum comparisons: .role.value instead of .role string
  - Fix FinishReason enum usage in ag-ui event converters
  - Rename AgentResponse.from_updates to from_agent_run_response_updates in ag-ui
  
  Fixes API compatibility after Types API Review improvements merge
  
  * Fix ChatMessage and Role API changes in github_copilot tests
  
  * Fix ChatMessage and Role API changes in redis and github_copilot packages
  
  - Fix redis provider: Role enum comparison using .value
  - Fix redis tests: ChatMessage signature and Role comparisons
  - Fix github_copilot tests: ChatMessage signature and Role comparisons
  - Update docstring examples in redis chat message store
  
  * Fix ChatMessage and Role API changes in devui package
  
  - Fix executor: ChatMessage signature change
  - Fix conversations: Role enum to string conversion in two places
  - Fix tests: ChatMessage signatures and Role comparisons
  
  * Fix ChatMessage and Role API changes in a2a and lab packages
  
  - Fix a2a tests: Role comparisons and ChatMessage signatures
  - Fix lab tau2 source: Role enum comparison in flip_messages, log_messages, sliding_window
  - Fix lab tau2 tests: ChatMessage signatures and Role comparisons
  
  * Remove duplicate test files from ag-ui/tests (tests are in ag_ui_tests)
  
  * Fix ChatMessage and Role API changes across packages
  
  After rebasing on upstream/main which merged PR #3647 (Types API Review
  improvements), fix all packages to use the new API:
  
  - ChatMessage: Use keyword args (role=, text=, contents=) instead of
    positional args
  - Role: Compare using .value attribute since it's now an enum
  
  Packages fixed:
  - ag-ui: Fixed Role value extraction bugs in _message_adapters.py
  - anthropic: Fixed ChatMessage and Role comparisons in tests
  - azure-ai: Fixed Role comparison in _client.py
  - azure-ai-search: Fixed ChatMessage and Role in source/tests
  - bedrock: Fixed ChatMessage signatures in tests
  - chatkit: Fixed ChatMessage and Role in source/tests
  - copilotstudio: Fixed ChatMessage and Role in tests
  - declarative: Fixed ChatMessage in _executors_agents.py
  - mem0: Fixed ChatMessage and Role in source/tests
  - purview: Fixed ChatMessage in source/tests
  
  * Fix mypy errors for ChatMessage and Role API changes
  
  - durabletask: Use str() fallback in role value extraction
  - core: Fix ChatMessage in _orchestrator_helpers.py to use keyword args
  - core: Add type ignore for _conversation_state.py contents deserialization
  - ag-ui: Fix type ignore comments (call-overload instead of arg-type)
  - azure-ai-search: Fix get_role_value type hint to accept Any
  - lab: Move get_role_value to module level with Any type hint
  
  * Improve CI test timeout configuration
  
  - Increase job timeout from 10 to 15 minutes
  - Reduce per-test timeout to 60s (was 900s/300s)
  - Add --timeout_method thread for better timeout handling
  - Add --timeout-verbose to see which tests are slow
  - Reduce retries from 3 to 2 and delay from 10s to 5s
  
  This ensures individual test timeouts are shorter than the job
  timeout, providing better visibility when tests hang.
  
  With 60s timeout and 2 retries, worst case per test is ~180s.
  
  * Fix ChatMessage API usage in docstrings and source
  
  - Fix ChatMessage positional args in docstrings: _serialization.py, _threads.py, _middleware.py
  - Fix ChatMessage in tau2 runner.py
  - Fix role comparison in _orchestrator_helpers.py to use .value
  - Fix role comparison in _group_chat.py docstring example
  - Fix role assertions in test_durable_entities.py to use .value
  
  * Revert tool_choice/parallel_tool_calls changes - must be removed when no tools
  
  OpenAI API requires tool_choice and parallel_tool_calls to only be
  present when tools are specified. Restored the logic that removes
  these options when there are no tools.
  
  - Restored check in _chat_client.py to remove tool_choice and
    parallel_tool_calls when no tools present
  - Restored same logic in _responses_client.py
  - Reverted test to expect the correct behavior
  
  * fixed issue in tests
  
  * fix: resolve merge conflict markers in ag-ui tests
  
  * fix: restructure ag-ui tests and fix Role/FinishReason to use string types
  
  * fix: streaming function invocation and middleware termination
  
  - Refactor streaming function invocation to use get_final_response() on inner streams
  - Fix MiddlewareTermination to accept result parameter for passing results
  - Fix _AutoHandoffMiddleware to use MiddlewareTermination instead of context.terminate
  - Fix AgentMiddlewareLayer.run() to properly forward function/chat middleware
  - Remove duplicate middleware registration in AgentMiddlewareLayer.__init__
  - Fix exception handling in _auto_invoke_function to properly capture termination
  - Fix mypy errors in core package
  - Update tests to use stream=True parameter for unified run API
  
  * fix all tests command
  
  * Refactor integration tests to use pytest fixtures
  
  - Merge testutils.py into conftest.py for azurefunctions integration tests
  - Merge dt_testutils.py into conftest.py for durabletask integration tests
  - Convert all integration tests to use fixtures instead of direct imports
    (fixes ModuleNotFoundError with --import-mode=importlib)
  - Add sample_helper fixture for azurefunctions tests
  - Add agent_client_factory and orchestration_helper fixtures for durabletask
  - Integration tests now skip with descriptive messages when services unavailable
  - Restructure devui tests into tests/devui/ with proper conftest.py
  - Add test organization guidelines to CODING_STANDARD.md
  - Remove __init__.py from test directories per pytest best practices
  
  * Fix pytest_collection_modifyitems to only skip integration tests
  
  The hook was skipping all tests in the test session, not just
  integration tests. Now it only skips items in the integration_tests
  directory.
  
  * Fix mem0 tests failing on Python 3.13
  
  Use patch.object on the imported module instead of @patch with string
  path to ensure the mock takes effect regardless of import timing.
  
  * fix mem0
  
  * another attempt for mem0
  
  * fix for mem0
  
  * fix mem0
  
  * Increase worker initialization wait time in durabletask tests
  
  Increase from 2 to 8 seconds to allow time for:
  - Python startup and module imports
  - Azure OpenAI client creation
  - Agent registration with DTS worker
  - Worker connection to DTS
  
  This helps prevent test failures in CI where the first tests may run
  before the worker is fully ready to process requests.
  
  * Fix streaming test to use ResponseStream with finalizer
  
  The _consume_stream method now expects a ResponseStream that can provide
  a final AgentResponse via get_final_response(). Update the test to use
  ResponseStream with AgentResponse.from_updates as the finalizer.
  
  * Fix MockToolCallingAgent to use new ResponseStream API and update samples
  
  * small updates to run_stream to run
  
  * fix sub workflow
  
  * temp fix for az func test
  
  ---------
  
  Co-authored-by: Dmytro Struk <13853051+dmytrostruk@users.noreply.github.com>

  Eduard van Valkenburg · 2026-02-05 20:09:58 +00:00
  3dc59c83b5
• [BREAKING] Python: Fix workflow as agent streaming output (#3649)

  * WIP: with_output_from
  
  * Add with_output_from to other modules; next: workflow as agent
  
  * WIP: remove agent run events
  
  * orchestrations
  
  * WIP: update samples; next start at guessing_game_With_human_input.py
  
  * Update all samples
  
  * WIP: consolidate workflow as agent streaming vs non-streaming
  
  * Consolidate workflow as agent streaming vs non-streaming
  
  * Move request info event processing to a share method
  
  * Final pass on the samples
  
  * Fix mypy
  
  * Fix mypy
  
  * Comments
  
  ---------
  
  Co-authored-by: Evan Mattson <35585003+moonbox3@users.noreply.github.com>

  Tao Chen · 2026-02-05 00:16:45 +00:00
  a971d24f1e
• Python: [BREAKING] Types API Review improvements (#3647)

  * Replace Role and FinishReason classes with NewType + Literal
  
  - Remove EnumLike metaclass from _types.py
  - Replace Role class with NewType('Role', str) + RoleLiteral
  - Replace FinishReason class with NewType('FinishReason', str) + FinishReasonLiteral
  - Update all usages across codebase to use string literals
  - Remove .value access patterns (direct string comparison now works)
  - Add backward compatibility for legacy dict serialization format
  - Update tests to reflect new string-based types
  
  Addresses #3591, #3615
  
  * Simplify ChatResponse and AgentResponse type hints (#3592)
  
  - Remove overloads from ChatResponse.__init__
  - Remove text parameter from ChatResponse.__init__
  - Remove | dict[str, Any] from finish_reason and usage_details params
  - Remove **kwargs from AgentResponse.__init__
  - Both now accept ChatMessage | Sequence[ChatMessage] | None for messages
  - Update docstrings and examples to reflect changes
  - Fix tests that were using removed kwargs
  - Fix Role type hint usage in ag-ui utils
  
  * Remove text parameter from ChatResponseUpdate and AgentResponseUpdate (#3597)
  
  - Remove text parameter from ChatResponseUpdate.__init__
  - Remove text parameter from AgentResponseUpdate.__init__
  - Remove **kwargs from both update classes
  - Simplify contents parameter type to Sequence[Content] | None
  - Update all usages to use contents=[Content.from_text(...)] pattern
  - Fix imports in test files
  - Update docstrings and examples
  
  * Rename from_chat_response_updates to from_updates (#3593)
  
  - ChatResponse.from_chat_response_updates → ChatResponse.from_updates
  - ChatResponse.from_chat_response_generator → ChatResponse.from_update_generator
  - AgentResponse.from_agent_run_response_updates → AgentResponse.from_updates
  
  * Remove try_parse_value method from ChatResponse and AgentResponse (#3595)
  
  - Remove try_parse_value method from ChatResponse
  - Remove try_parse_value method from AgentResponse
  - Remove try_parse_value calls from from_updates and from_update_generator methods
  - Update samples to use try/except with response.value instead
  - Update tests to use response.value pattern
  - Users should now use response.value with try/except for safe parsing
  
  * Add agent_id to AgentResponse and clarify author_name documentation (#3596)
  
  - Add agent_id parameter to AgentResponse class
  - Document that author_name is on ChatMessage objects, not responses
  - Update ChatResponse docstring with author_name note
  - Update AgentResponse docstring with author_name note
  
  * Simplify ChatMessage.__init__ signature (#3618)
  
  - Make contents a positional argument accepting Sequence[Content | str]
  - Auto-convert strings in contents to TextContent
  - Remove overloads, keep text kwarg for backward compatibility with serialization
  - Update _parse_content_list to handle string items
  - Update all usages across codebase to use new format: ChatMessage("role", ["text"])
  
  * Allow Content as input on run and get_response
  
  - Update prepare_messages and normalize_messages to accept Content
  - Update type signatures in _agents.py and _clients.py
  - Add tests for Content input handling
  
  * Fix ChatMessage usage across packages and samples
  
  Update all remaining ChatMessage(role=..., text=...) to use new
  ChatMessage('role', ['text']) signature.
  
  * Fix Role string usage and response format parsing
  
  - Fix redis provider: remove .value access on string literals
  - Fix durabletask ensure_response_format: set _response_format before accessing .value
  
  * Fix ollama .value and ai_model_id issues, handle None in content list
  
  - Fix ollama _chat_client: remove .value on string literals
  - Fix ollama _chat_client: rename ai_model_id to model_id
  - Fix _parse_content_list: skip None values gracefully
  
  * Fix A2AAgent type signature to include Content
  
  * Fix Role/FinishReason NewType dict annotations and improve test coverage to 95%
  
  * Fix mypy errors for Role/FinishReason NewType usage
  
  * Fix Role.TOOL and Role.ASSISTANT usage in _orchestrator_helpers.py
  
  * Fix Role NewType usage in durabletask _models.py

  Eduard van Valkenburg · 2026-02-04 10:13:23 +00:00
  838a7fd61d
• Python: added generic types to ChatOptions and ChatResponse/AgentResponse for Response Format (#3305)

  * added generic types to ChatOptions and ChatResponse/AgentResponse for response format
  
  * fix typevar import
  
  * fix for older python versions
  
  * fix missing import
  
  * fixed imports
  
  * fixed mypy
  
  * mypy fix

  Eduard van Valkenburg · 2026-01-28 21:23:02 +00:00
  1226828ec2
• Python: [Breaking] Simplified Content types to a single class with classmethod constructors. (#3252)

  * ported Content to a new model
  
  * fixed linting
  
  * fixes
  
  * fixed data format handling
  
  * fix for 3.10 mypy
  
  * fix
  
  * fix int test

  Eduard van Valkenburg · 2026-01-20 22:09:39 +00:00
  83e6229c11
• fix #3171, ensure proper form rendering for int (#3201)
  Victor Dibia · 2026-01-20 07:25:12 +00:00
  0f29637b86
• Python: fix(ag-ui): add MCP tool support for AG-UI approval flows (#3212)

  * add MCP tool support for AG-UI approval flows
  
  * use attribute in place of property

  Evan Mattson · 2026-01-15 02:34:11 +00:00
  620da7a829
• fix(workflows): rename WorkflowOutputEvent.source_executor_id to executor_id for API consistency (#3166)
  Evan Mattson · 2026-01-15 02:11:25 +00:00
  80b25a782b
• renamed all (#3207)
  Eduard van Valkenburg · 2026-01-14 05:54:07 +00:00
  d8cf8361bd
• Python: [BREAKING]: Introducing Options as TypedDict and Generic (#3140)

  * WIP typeddict for options
  
  * updated all clients and ChatAgents
  
  * updated everything
  
  * added ADR
  
  * fix mypy
  
  * proper typevar imports
  
  * fixed import
  
  * fixed other imports
  
  * slight update in the sample
  
  * updated from feedback
  
  * fixes
  
  * fixed missing covariants and test fixes
  
  * fixed typing
  
  * updated anthropic thinking config
  
  * ruff fixes
  
  * fixed int tests
  
  * fix tests and mypy
  
  * updated integration tests
  
  * updated docstring and test fix
  
  * improved options handling in obser
  
  * mypy fix
  
  * updated a host of integration tests
  
  * fix tests
  
  * bedrock fix

  Eduard van Valkenburg · 2026-01-13 16:41:05 +00:00
  3e97425245
• Python: [BREAKING]: removed display_name, renamed context_providers, middleware and AggregateContextProvider (#3139)

  * removed display_name, renamed context_providers, middleware and AggregateContextProvider
  
  * fixes
  
  * fixed test
  
  * testfix
  
  * removed mistakenly put back test
  
  * updated new test
  
  * rename middlewares to middleware
  
  * middleware fixes

  Eduard van Valkenburg · 2026-01-13 02:24:07 +00:00
  203fb7b1c4
• Python: Improve DevUI, add Context Inspector view as new tab under traces (#2742)

  * Improve DevUI, add Context Inspector view as new tab under traces
  
  * fix mypy errors
  
  * fix: Handle stale MCP connections in DevUI executor
  
  MCP tools can become stale when HTTP streaming responses end - the underlying
  stdio streams close but `is_connected` remains True. This causes subsequent
  requests to fail with `ClosedResourceError`.
  
  Add `_ensure_mcp_connections()` to detect and reconnect stale MCP tools before
  agent execution. This is a workaround for an upstream Agent Framework issue
  where connection state isn't properly tracked.
  
  Fixes MCP tools failing on second HTTP request in DevUI.
  
  fixes  #1476 #1515 #2865
  
  * fix #1572 report import dependency errors more clearly
  
  * Ensure there is streaming toggle where users can select streaming vs non streaming mode in devui . Fixes .NET: [Python] DevUI tool call rendering in non-streaming mode?
  
  * remove unused dead code
  
  * improve ux - workflows with agents show a chat component in execution timelien, also ensure magentic final output shows correctly
  
  * update ui build
  
  * update devui to use instrumentation instead of tracing, other instrumentation and type/instance check fixes

  Victor Dibia · 2026-01-07 08:26:08 +00:00
  2e1189ca65
• Python: cleanup and refactoring of chat clients (#2937)

  * refactoring and unifying naming schemes of internal methods of chat clients
  
  * set tool_choice to auto
  
  * fix for mypy
  
  * added note on naming and fix #2951
  
  * fix responses
  
  * fixes in azure ai agents client

  Eduard van Valkenburg · 2025-12-18 12:02:23 +00:00
  e5c11d38d6
• Python: [BREAKING] Observability updates (#2782)

  * fixes Python: Add env_file_path parameter to setup_observability() similar to AzureOpenAIChatClient
  Fixes #2186
  
  * WIP on updates using configure_azure_monitor
  
  * improved setup and clarity
  
  * fixed root .env.example
  
  * revert changes
  
  * updated files
  
  * updated sample
  
  * updated zero code
  
  * test fixes and fixed links
  
  * fix devui
  
  * removed planning docs
  
  * added enable method and updated readme and samples
  
  * clarified docstring
  
  * add return annotation
  
  * updated naming
  
  * update capatilized version
  
  * updated readme and some fixes
  
  * updated decorator name inline with the rest
  
  * feedback from comments addressed

  Eduard van Valkenburg · 2025-12-16 06:56:30 +00:00
  3139347526
• Python: Title: DevUI Fix WorkflowFailedEvent error extraction (#2706)

  * Title: Fix WorkflowFailedEvent error extraction to use details instead of error Body:
  Summary
  Fixed WorkflowFailedEvent mapping to extract error message from details.message instead of non-existent error attribute
  Added support for including details.extra context in error messages when present
  Problem
  The WorkflowFailedEvent handler in _mapper.py was reading event.error, but WorkflowFailedEvent uses a details attribute (of type WorkflowErrorDetails), not error. This caused all workflow failures to display "Unknown error" in the UI instead of the actual error message.
  Fix
  Updated the handler to match the pattern already used by ExecutorFailedEvent:
  Read from event.details instead of event.error
  Extract details.message for the error text
  Include details.extra context when available
  
  * improve error handling consistency

  Victor Dibia · 2025-12-08 21:44:32 +00:00
  d889fa6f87
• fixes Python: DevUI fails when uploading Pdf file (tested on Python Foundry Agent) (#2675)

  Fixes #2652

  Victor Dibia · 2025-12-08 17:00:57 +00:00
  0675000f4b
• Python: DevUI, Fix message serialization issue, improve tests (#2674)

  * fix message serialization issue, improve tests for devui
  
  * update tests

  Victor Dibia · 2025-12-06 02:20:54 +00:00
  8c6b12e664
• Python: DevUI fixes : Add multimodal input support for workflows and refactor chat input (#2593)

  * show app version in devui .NET: Python: Improved Versioning for DevUI
  Fixes #2059
  
  * feat: Add multimodal input support for workflows and refactor chat input
  
  This PR adds support for multimodal content (images, files) in workflow
  inputs and refactors the chat input into a reusable component.
  
  ## Multimodal Workflow Support
  - Add `isChatMessageSchema()` to detect ChatMessage input schemas
  - Update `RunWorkflowButton` to use `ChatMessageInput` for ChatMessage workflows
  - Wrap multimodal content in OpenAI message format for backend processing
  - Add `_is_openai_multimodal_format()` to detect OpenAI ResponseInputParam
  - Update `_parse_workflow_input()` to route multimodal input through
    existing `_convert_input_to_chat_message()` converter
  
  ## Reusable ChatMessageInput Component
  - Extract chat input logic from agent-view into `ChatMessageInput` component
  - Support file upload, drag & drop, paste handling, and attachments
  - Add `useDragDrop` hook for parent-level drag handling with full-area
    drop zones
  - Refactor agent-view to use the new shared component
  
  ## Other Improvements
  - Add `isStreaming` prop to executor nodes for animation control
  - Clean up unused imports and state variables in agent-view
  - Add tests for multimodal workflow input handling
  
  Fixes workflow input not receiving images when using AgentExecutor nodes.
  
  * add self loop edge, fix #2470
  
  * fix test

  Victor Dibia · 2025-12-03 20:15:51 +00:00
  411ee7a60f
• Fix MangenticAgentExecutor producing repr str for tool call content (#2566)
  Evan Mattson · 2025-12-02 08:40:11 +00:00
  c2d285e614
• Python: make tool call view optional in DevUI + other link fixes (#2243)

  * make tool call view optional in devui + other link fixes
  
  * fix #2310, ensure correct port is shown in command
  
  * fix dialog bug
  
  * ensure executor ids are tracked per items, fix bug where data from concurrent executors where not seperated properly fix #2351
  
  * fix: Enable multi-round human-in-the-loop (HIL) in DevUI workflows
  
  - Backend: Enrich RequestInfoEvents with response schemas in send_responses_streaming path
  - Frontend: Replace old HIL requests with new ones instead of accumulating them
  - Frontend: Fix HIL response state management to prevent sending stale request responses
  
  This allows workflows to properly handle sequential HIL requests, showing only the
  current request to users and progressing through multiple input rounds correctly.
  
  fixes #2334
  
  * fix bug to ensure in memory entities cannot be reloaded in ui

  Victor Dibia · 2025-11-24 07:22:53 +00:00
  f0f1051c7d
• Python: Clean up imports (#2318)

  * chore: tidy imports
  
  * Update python/packages/azurefunctions/agent_framework_azurefunctions/_errors.py
  
  Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
  
  * Update python/packages/azurefunctions/agent_framework_azurefunctions/_callbacks.py
  
  Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
  
  * chore: revert stub file change
  
  * chore: trigger pre-commit hook, re-add `annotations` import
  
  ---------
  
  Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

  Brandon McConnell · 2025-11-19 23:41:01 +00:00
  79bb87061b
• Python: fix for Incomplete URL substring sanitization (#2274)

  * Potential fix for code scanning alert no. 29: Incomplete URL substring sanitization
  
  Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
  
  * Python: Fix URL parsing to handle trailing punctuation in deployment progress detection (#2296)
  
  * Initial plan
  
  * Fix URL parsing to handle trailing punctuation correctly
  
  Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
  Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com>
  
  * updated lock
  
  ---------
  
  Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
  Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
  Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com>
  Co-authored-by: Victor Dibia <chuvidi2003@gmail.com>

  Eduard van Valkenburg · 2025-11-18 22:16:58 +00:00
  293abf5b56